full-disclosure - [Secure Network Operations, Inc.] Full Disclosure != Exploit Release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <004201c2c702$9e047730$3744cd3e@INTERNET>
From: Nicolas.Villatte at advalvas.be (Nicolas Villatte)
Subject: [Secure Network Operations, Inc.] Full Disclosure != Exploit Release

I am sorry but people who made this virus does not appear as script
kiddies to me. Do you prefer to be aware of the exploit like the ones
that will use it after some modifications or do you prefer only some
"elite" is able to harm the systems?

Personally, I prefer to die seeing my enemy than being stabbed.

-----Message d'origine-----
De?: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] De la part de Strategic
Reconnaissance Team
Envoy??: lundi 27 janvier 2003 3:19
??: full-disclosure@...ts.netsys.com
Objet?: [Full-Disclosure] [Secure Network Operations, Inc.] Full
Disclosure != Exploit Release

All, 

I have been following the subject of full disclosure for a while, and as
most of you know, have dealt with some of the issues that full
disclosure can cause (HP/Secure Network Operations/DMCA).  While the
idea of full disclosure is a good idea, and while we support it, we feel
that the exploit source code should not be released to everyone.

It is possible to prove a vulnerability exists by releasing well written
advisories.  Because of this fact, proof of concept code (exploit
source) is not a requirement for the education of the possibly
vulnerable. Releasing non-malicious exploit code is also not an option
as any local script bunny/kiddie can easily render it functional.

Proof of concept code is useful for legitimate contract based
penetration tests. It is also useful for study as it demonstrates
fundamental flaws computers today (not built in security). But again,
proof of concept code is not for everyone.

I am interested in hearing the opinions of the people on this list. If
you are for exploit source disclosure, I would like to hear arguments
supported by facts, that explain why.  I am equally interested in
reasons why not to disclose information. 

With that said, Secure Network Operations, Inc. will no longer be
releasing functional proof of concept code. We may release sufficiently
detailed advisories. 

-- 
Sincerely, 
	Adriel T. Desautels
	Secure Network Operations, Inc. (SNOsoft)
	phone: (978) 263-3829  | http://www.snosoft.com
	--------------------------------------------------------------
	http://www.snosoft.com/documents/SNOsoft-corporate-outline.pdf
	BEDD 0FAD 4CE2 6399 551F  86F5 B036 A540 D47C EC101

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3374 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030128/07224fab/smime.bin