lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 30 Jun 2005 10:23:53 -0700 (PDT) From: "Gary E. Miller" <gem@...lim.com> To: Aviram Jenik <aviram@...ondsecurity.com> Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com Subject: Re: Publishing exploit code - what is it good for -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yo Aviram! On Thu, 30 Jun 2005, Aviram Jenik wrote: > What I need is a security administrator, CSO, IT manager or sys admin th > at can > explain why they find public exploits are good for THEIR organizations. Getting a serious bug fixed before full-disclosure was much harder. Any and all potential isssues were just denied by vendors. Denial no longer worked after everyone could just google for a working exploit. Then vendors got a bit of religion and started admitting and fixing a few things. Same thing for customer networks. "It ain't broke so we won't fix fix it" was the ruile of the day. Now when a pen test, using a public exploit, pokes a hole in a customer system there is a chance they may fix it. They can no longer claim that just because you found it does not mean the bad guys can. Going back to the old ways is just burying our collective heads in the sand again. Nothing got fixed because no-one could "prove" there was a problem. Now that some things get fixed, the net is safer for all on the net. RGDS GARY - --------------------------------------------------------------------------- Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701 gem@...lim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFCxCqt8KZibdeR3qURApa7AJwLoJYjZ4z91L7y7tgEUDhZtgUePQCeKc3u YQgKGjOc90ZV/42ktKwbdss= =Ts5l -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists