full-disclosure - no more public exploits: just a n00bie view

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200404280302.i3S32Y923398@netsys.com>
From: randallm at fidmail.com (RandallM)
Subject: no more public exploits: just a n00bie view

Hey,
I have to agree with Borg. I am of course new to your list. I joined it to
learn the "what, when and where" of security. I must say that when I saw
exploits posted I was a bit taken back. My first thought was "Guess I can
expect to see it soon". A question naturally comes; would it show in the
wild had it not been posted. And what percentages of exploits do go in the
wild due to being posted along with the advisory? Then again how can I be
concerned about an advisory if I can't see the effects of the exploit? Of
course, then again, I really have understood little about the code of the
exploit but did a lot on the advisory. Just a n00bie view.

Borg wrote:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
Message: 28
Date: Tue, 27 Apr 2004 13:19:44 -0400
From: chris <chris@...secure.net>
To: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] no more public exploits

Heres my two cents :-/

Exploit code is better kept private.
Advisories should be public.

Why?

Because exploit code is not easy to write depending on the bug. And I 
for one sure dont want some 'penetration tester' taking my code and 
plugging it into his automated scanner and collecting the cash. Im far 
to greedy to watch that happen. Sorry.

NON-Disclosure of Exploit code.
Full-Disclosure of Advisories.

As far as the discussion of sysadmins patching on time or not. All I 
will say is this . . .  if they did patch on time there wouldnt be a 
www.zone-h.org.

- borg (ChrisR-)

--__--__--

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
Borg ended.