full-disclosure - Re: [Dailydave] Linux's unofficial security-through-coverup policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 18 Jul 2008 12:08:00 -0400
From: Valdis.Kletnieks@...edu
To: Joel Jose <joeljose420@...il.com>
Cc: Blue Boar <BlueBoar@...evco.com>, Brad Spengler <spender@...ecurity.net>,
	full-disclosure@...ts.grok.org.uk, dailydave@...ts.immunitysec.com
Subject: Re: [Dailydave] Linux's unofficial
	security-through-coverup policy

On Fri, 18 Jul 2008 21:07:47 +0530, Joel Jose said:

> abetting the crime. But a GUI crash is always less severe. People can
> quickly loose trust in the software and the services that depend on
> them can be irrecoverably damaged. 

If continual GUI crashes cause people to lose trust in the operating
system, that's *more* severe for that system than the occasional security
issue.

>                                     Think about it.... there are more
> people engaged in penetrating, propagating security holes than filing
> common bug reports.... it definitely isn't a time-waster for them.

Do you have any numbers to back that up?  RedHat/Fedora's bugzilla is
sitting at well over 450,000 bugs now.  Remember that *for the user who
files the common bug report*, it's not a time-waster for *them* either.

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/