| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20031020062321.A95177@stackheap.org> From: attica at stackheap.org (S . f . Stover) Subject: re: openssh exploit code? : /* snip */ : : > BTW, I thought "whitehat" implied : > non-disclosure, which isn't really the direction I'm coming from. : : /* snip */ : : Nothing of the sort. : : In fact, whitehats and blackhats often perform exactly the same tasks : at the keyboard while doing research, and use the same tools. : : It's just the ulitmate purpose to which the research is put that : differs... I guess I was thinking along the lines of attitude towards full disclosure. I think of whitehats as not wanting to expose source or even the vulnerability before the vendor fixes it. Greyhats then will give the vendor the opportunity to fix, but will release the vulnerability regardless, while the blackhat feels that the everyone should know when it's discovered. However, this does run counter to what I'll call "real" blackhats or people who use their exploits for gain or illegal purposes. Obviously releasing source so patches can be developed, IDS vendors can write signatures, etc. does not futher that end. -- aka Dolph Longhorn attica@...ckheap.org GPG Key ID: 0xF8F859D0 http://pgp.mit.edu:11371/pks/lookup?search=0xF8F859D0&op=index "There is no such thing as right and wrong, there's just popular opinion." -Jeffrey Goines -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 187 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20031020/c2c40f33/attachment.bin
Powered by blists - more mailing lists