full-disclosure - R: [Secure Network Operations, Inc.]FullDisclosure != Exploit Release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: recon at snosoft.com (Strategic Reconnaissance Team)
Subject: R: [Secure Network Operations,
	Inc.]FullDisclosure != Exploit Release

Right, 
	We don't want all of the kids to have guns.  Same argument here in a
way.



On Wed, 2003-01-29 at 12:58, Andrea Vecchio wrote:
> > Da: full-disclosure-admin@...ts.netsys.com
> > 
> > Good points, 
> > 	One question remains however.  If we are to attach 
> > exploit code to our
> > advisories, how do we protect the innocent from attacks by malicious
> > people using our exploit code? I honestly believe that exploits are
> > digital munitions that should be distributed under 
> > restrictions. Do you
> > agree that a vulnerability can be clearly demonstrated in an 
> > advisory by
> > showing debugger output and explaining the output? If proof of concept
> > code needs to be made, it could be generated from the detail in the
> > advisory. Why is that not a solution? 
> 
> Sorry, but I think that full disclosure, by definition, is 
> telling something without careing a think about consequences.
> I'm not telling whether it's right or not, but so it is.
> If we believe in full disclosure (as i do) we have (silently)
> accepted that what we're saying can be used in different ways.
> "full disclosure" != "exploit release", but 
> "exploit release" C "full disclosure"
> ( C -> belongs to :)
> By! A.
-- 
Strategic Reconnaissance Team <recon@...soft.com>
Secure Network Operations, Inc.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 232 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030129/a980db7d/attachment.bin