full-disclosure - Microsoft Cries Wolf ( again )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00b901c33fe5$bd044460$550ffea9@rms>
From: rms at computerbytesman.com (Richard M. Smith)
Subject: Microsoft Cries Wolf ( again )

Along these lines, if the C programming language had a proper string
data type from day one, buffer overflows would be much less common
today.  By a proper string data type I mean that the C runtime library
would check to make sure that a program wasn't trying to put 10 pounds
of characters into a 5 pound buffer.  Buffer overflows involving
characrter strings could still be in DoS attacks, but they could be used
to run code.  The IT security business would have much less to do today.
;-)

Richard

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Schmehl,
Paul L
Sent: Tuesday, July 01, 2003 10:44 AM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Microsoft Cries Wolf ( again )

> -----Original Message-----
> From: Peter van den Heuvel [mailto:peter@...k-connect.com] 
> Sent: Tuesday, July 01, 2003 4:04 AM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] Microsoft Cries Wolf ( again )
> 
> I find all these posts on irresponsible behaviour a bit surprising. 
> Driving through a red light is irresponsible, blowing 
> oneanothers heads 
> out with firearms is irresponsible (and USA citizens seem to be 
> cunningly good at that), and still it happens. The problem is 
> not going 
> away, so face it and learn to live with it best you can.
> 
> So, lets make it illegal! Yeah, like that ever solved a problem. It 
> would make more sense to research a bit more into why people do this, 
> how they could be convinced to be more social, and most particularly, 
> how the process of "decent" disclosure could be facilitated. 

Research?  Please!?!?!?!  Subjects like this have been researched to
death.  It doesn't matter *why* people do it.  The fact is that they
*do* and they always will.  No amount of research, no laws, no cajoling,
no berating, no belittling is ever going to change human behavior.  Why
do you think the Serbs and Bosnians have been fighting each other since
the 14th century?  Because it makes sense?  Because it's the right thing
to do?  Because it's responsible?

No matter what system you try to implement, *somebody* will try to
circumvent it.  That's just human nature.  The solution to this problem
lies in the hands of the vendors, *not* in the hands of the researchers.

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html