full-disclosure - Re: Two MSIE 6.0/7.0 NULL pointer crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 20 Jan 2010 16:17:32 -0800
From: ☣ frank^2 <frank2@...49.org>
To: Dan Kaminsky <dan@...para.com>
Cc: Full-disclosure <full-disclosure@...ts.grok.org.uk>,
	Valdis.Kletnieks@...edu
Subject: Re: Two MSIE 6.0/7.0 NULL pointer crashes

On Wed, Jan 20, 2010 at 10:25 AM, Dan Kaminsky <dan@...para.com> wrote:
> Seriously.  I mean, just look at Linux, Firefox, and OpenOffice.
> Pristine code, not a single security vulnerability between them :)
>

That's a red herring. His point was the public perception of the
software company-- true or not-- would be hindered because Microsoft
is all-encompassing. Compared to the world of open-source, the risk is
distributed by the sheer virtue of software engineering being
distributed amongst thousands of entities. This means that the
vulnerabilities are spread across different parties, rather than
having all vulnerabilities encompassed by a single party-- in this
case, Microsoft.

His argument was irrelevant to corporations vs. open-source being more
vulnerable than one another-- it was simply a commentary on
distributed risk in software engineering.

-- 
"Did you and them get your degree from the same university of trolls?
I have mistaken nothing for nothing. Fuck you."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/