full-disclosure - Web sites compromised by IIS attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <40E87010.3040505@science.org>
From: jasonc at science.org (Jason Coombs)
Subject: Web sites compromised by IIS attack

>>frank, this is not a kindergarden list. this not a housewife support
>>list. this is a security list, this a full disclousure list. period.

It also is not a list for the benefit exclusively of people who are 
fortunate enough to have simple security problems. The security issues 
surrounding the question "how do I keep my home computer safe from 
attack?" are trivial compared to those surrounding the question "how do 
I keep the 200,000 computing devices worldwide within my organization 
from being owned and then attacking each other?"

Anyone with a truly complex security problem knows that it is hopeless 
to ever really control many computers in the presence of many people. 
You have no choice in a complex situation but to let things happen that 
you think are beneficial to you (the vendor installing patches, in this 
discussion) and find a way, after the fact, or periodically, to confirm 
that the end result was in fact beneficial to you.

Sincerely,

Jason Coombs
jasonc@...ence.org