lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: attica at (S . f . Stover)
Subject: re: openssh exploit code?

: /* snip */
: > BTW, I thought "whitehat" implied
: > non-disclosure, which isn't really the direction I'm coming from.
: /* snip */
: Nothing of the sort.
: In fact, whitehats and blackhats often perform exactly the same tasks
: at the keyboard while doing research, and use the same tools.
: It's just the ulitmate purpose to which the research is put that
: differs...

I guess I was thinking along the lines of attitude towards full disclosure.  I
think of whitehats as not wanting to expose source or even the vulnerability
before the vendor fixes it.  Greyhats then will give the vendor the
opportunity to fix, but will release the vulnerability regardless, while the
blackhat feels that the everyone should know when it's discovered.

However, this does run counter to what I'll call "real" blackhats or people
who use their exploits for gain or illegal purposes.  Obviously releasing source
so patches can be developed, IDS vendors can write signatures, etc. does not
futher that end.


aka Dolph Longhorn
GPG Key ID: 0xF8F859D0

"There is no such thing as right and wrong, there's just popular opinion."
-Jeffrey Goines
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url :

Powered by blists - more mailing lists