lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <000701c2c7dc$d2f3a2b0$6601a8c0@rms2>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: [Secure Network Operations, Inc.] Full Disclosure != Exploit Release

 >>> One problem with anyone making private exploits is that 
 >>> they always seem to get leaked, no matter who it is. 

I've written at least a dozen proof-of-concept examples for security
holes.  I've given these examples to vendors and shared them with
friends and other security researchers.  I'm not aware of any of them
being made public.  In addition, I serious doubt that any of the
examples are of much use to anyone except to the vendor who messed up in
the first place.

Vendors probably find the bulk of security holes and I seriously doubt
many of these problems have proof-of-concept code published for them.

OTOH we know that public proof-of-concept examples are going to get into
the wrong hands.

Richard


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ