full-disclosure - Response to comments on Security and Obscurity

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <b7bc1b1f040902233339200284@mail.gmail.com>
From: uberguidoz at gmail.com (Über GuidoZ)
Subject: Response to comments on Security and Obscurity

Personally, I feel it's a VERY valid point. If the only way to fix
something, for example, is by training and education, it's entirely
possible the time (and resources) necessary to do such a thing isn't
there.

secfocuslist@...oo.com said:
> If you do not have time, and the audience does not care
> enough to spend the time, then the battle is already lost.

I believe this is entirely two different things (you do not have the
time and the audience doesn't care), and usually they don't exist at
once in a given situation. (It's one or the other.) However, I will
agree that the battle will be lost if no one cares or tries to do
anything in a given situation.

James Tucker said:
> I apologise, but I have spent most of my life at this and I don't know
> everything, I doubt my audience would donate that much time, even
> if I gave it.

Agreed. I've been down the same path and have met with resistence when
I tried to provide the time and resources necessary to solve a given
problem. More often then not I find it's the "audience" that is
unwilling. They don't want to take the time to learn something new,
train their staff something new, or provide the money to do all, or
any of, the above. Pity.

-- 
Peace. ~G

On Thu, 2 Sep 2004 22:42:27 +0100, James Tucker <jftucker@...il.com> wrote:
> On Thu, 2 Sep 2004 12:53:20 -0700 (PDT), Security List
> <secfocuslist@...oo.com> wrote:
> > Mr. Tucker wrote:
> >
> > >Maybe, but you have to educate people somehow, and
> > you don't have time
> > >to explain everything.
> >
> > This is an excuse and the weak point.  If you do not
> > have time, and the audience does not care enough to
> > spend the time, then the battle is already lost.
> 
> I apologise, but I have spent most of my life at this and I don't know
> everything, I doubt my audience would donate that much time, even if I
> gave it. But thank you for your encouragement.