bugtraq - Re: Publishing exploit code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050630222658.4237.qmail@mailweb33.rediffmail.com>
Date: 30 Jun 2005 22:26:58 -0000
From: "Raghu Chinthoju" <raghu.chinthoju@...iffmail.com>
To: "Aviram Jenik" <aviram@...ondsecurity.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: Publishing exploit code - what is it good for

Though my experience doesnt dig in miles deep, in my humble opinion, I think it has evolved this way; the present state is the eventuality of the series of debates, discussions etc like this ones, which led us into full disclosure. To prove in support of full disclosure, lets assume there is no full disclosure. Every one lets the world know about the existence of the vulnerability and no one would disclose how the vulnerability is exploited (expect to the product vendor, ofcource). Then what? Do you think there would be so much importance given to the vulnerability fixing as we see it today? Do you think it would be this easy (I know some would disagree, if you do so, please read this from the beginig again ;) for us to convenience the vendors about the seriousness of the vulnerability? Would there be so much advancement and knowledge in this field? I think not! And then, the persistence of people who desired secure computing led to full disclosure. And this is why we need full disclosure!

I agree with your 'security analysts' that many security administrators and so many others who hooked on to Internet need not have access to the exploits, but then, this is one the vital vectors that led to full disclosure.

Raghu

On 6/30/05, Aviram Jenik <aviram@...ondsecurity.com> wrote:
> Hi,
> 
> I recently had a discussion about the concept of full disclosure 
[...]
Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/