lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: exibar at thelair.com (Exibar)
Subject: no more public exploits

I agree, but the timing of the patch for an exploited vulnerability or a
non-exploited vulnerability can make a difference.  If there's an exploit
out in the wild for a vulnerability, you might want to drop everything and
patch everything you have.  But, if there isn't an exploit, you might be
able to get away with adding that patch to your weekly or whatever patching
schedule.

  Exibar
(I AM NOT AN ANIMAL!)  hehehe
----- Original Message ----- 
From: "Baum, Stefan" <stefan.baum@....com>
To: <full-disclosure@...ts.netsys.com>
Sent: Tuesday, April 27, 2004 2:06 PM
Subject: AW: [Full-Disclosure] no more public exploits


IMHO, no sysadmin taking his work seriously, will wait patching the systems
until an exploit is available throughout the internet.

Stefan
(I AM A SYSADMIN)

> -----Urspr?ngliche Nachricht-----
> Von: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com] Im Auftrag von Yabby
> Gesendet: Dienstag, 27. April 2004 19:06
> An: johnny cyberpunk; full-disclosure@...ts.netsys.com
> Betreff: Re: [Full-Disclosure] no more public exploits
>
> Even though I think that the publication of your code might
> have been a couple of weeks too soon: too bad you chose to
> abandon full disclosure. A lot of people do not have the
> skills to transform theoretical vulnerabilities into
> practical exploits. With the lack of proof that the
> vulnerability can really be exploited, a lot of sysadmins
> will decide not to patch, leaving the holes in tact for the
> real blackhats, that have possession of the malicious code anyway....
>
> maarten
>
> > this is an anouncement that i personally have no more intention to
> > publish any
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ