full-disclosure - A funny (but real) story for XMAS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: A funny  (but real) story for XMAS

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Cael Abal
> Sent: Tuesday, December 16, 2003 7:58 AM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] A funny (but real) story for XMAS
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> |> "Join www.osvdb.org to make a better non-corporated vulnerability 
> |> database since CERT sucks ! "
> |
> | CERT sucks? Humm... In my UNIX & Security college course, 
> we're being 
> | told CERT is a great resource for security-related information. Can 
> | anybody else make a comment on this? Agree? Disagree?
> 
> Hi Chris,
> 
> Depends on which side of the fence you're on.  CERT has been 
> criticized in the past for being frugal with vulnerability 
> information.  They don't publish exploits, for one, which 
> means k1ddi3z prefer FD.  :)

For "real" security people, CERT is simply waaaayyyy too slow releasing
information.  By the time they publish vulnerabilities, they've been
thoroughly discussed on the security lists.

They're fine for research papers for class.  :-)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/