bugtraq - Re: defining 0day

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 25 Sep 2007 15:54:55 -0500
From: "Brian Loe" <knobdy@...il.com>
To: "Adrian Griffis" <adriang63@...il.com>
Cc: "Gadi Evron" <ge@...uxbox.org>,
	"Thor (Hammer of God)" <thor@...merofgod.com>,
	bugtraq@...urityfocus.com, "Chad Perrin" <perrin@...theon.com>,
	"Crispin Cowan" <crispin@...ell.com>, Casper.Dik@....com,
	"pdp (architect)" <pdp.gnucitizen@...glemail.com>,
	full-disclosure@...ts.grok.org.uk,
	"Lamont Granquist" <lamont@...iptkiddie.org>,
	"Roland Kuhn" <rkuhn@....physik.tu-muenchen.de>
Subject: Re: defining 0day

On 9/25/07, Adrian Griffis <adriang63@...il.com> wrote:

> I understand why this descriptivist approach is tempting over a
> prescriptivist approach.  But it's important, I think, to keep in mind
> that the public uses the word "illegal" when they really mean
> "unlawful" and uses the word "Schizophrenic" when they are talking
> about multiple personality disorders.  All technical fields have their
> jargon, and the general public is simply not well educated enough
> about the issues involved to arbitrate disputes over usage.  Just as
> the legal profession needs the word "illegal" with its proper meaning,
> we also need our jargon to facilitate precise discussions about
> security matters.  The public can't always be the source of our
> definitions.

I understand and agree. The issue is, that as with those other terms,
the industry has allowed the term to be misused long enough that the
public now using it wrong as well. However, the "public" I was
referring to is reference materials - dictionaries, wikipedia, etc..
If a newcomer to the security field hears the term "zero day" where
does he go to find out what a "zero day" exploit is? Most students go
to dictionaries or the like... and whats wrong with the current
definition of a "zero day"?

Okay, dump "zero day" completely and choose a new term for each
division of exploit or vulnerability.

Blue Sky Rambling: Try to enable a unified method of disclosure for
all types of exploits and vulnerabilities via a single medium/site or
multiple sites with a unified form or some such. I envision a check
list asking things like "is this vulnerability known to the vendor -
yes/no" and "does this exploit work against latest versions and all
patches - yes/no" or whatever it takes to filter disclosures and allow
them to be programatically labeled and disseminated, and the
"participating" vendor to be contacted - everything occurring in an
orderly, acceptable fashion by way of carved-in-stone rules.
Definitions of the labels can't be argued because the rules don't bend
for one person's perception. If all of the right check boxes are
checked, its zero day, or its not. Oh, and you have to be "certified"
to release a disclosure!