full-disclosure - AW: no more public exploits

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <FBF77CAA2771D31188580008C79182F213CBC8B6@usphlx16.phl.sap.corp>
From: craig.soderland at sap.com (Soderland, Craig)
Subject: AW: no more public exploits

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com [mailto:full-disclosure-
> admin@...ts.netsys.com] On Behalf Of Bernard J. Duffy
> Sent: Wednesday, April 28, 2004 3:38 PM
> To: full-disclosure@...ts.netsys.com
> Subject: Re: AW: [Full-Disclosure] no more public exploits

[Soderland, Craig] Much Stuff filtered. 

> I would venture to guess that you would not be a happy camper if the
> IT organization supporting the systems that process your payroll or
> banking applied code fixes without a robust testing procedure.

[Soderland, Craig] I'd be even less happy if my banking institution, or payroll department got hacked. A delay in getting to my accounts I can live with, and complete cleaning out I cannot. 

The long and short of it is, you can patch, and break something, however if you go that route you can also back it out. 

You can not patch, and be at someone else's mercy and perhaps not know what they have done or how to fix short of a rebuild. 

Me, well I prefer to maintain the illusion of being the master of my own destiny. 

Besides I've seen the time and effort required, if you do get hit, as opposed to the time and effort required to patch. I'll take the easy way out and patch. 

----------------------------------------------------------------------------