full-disclosure - Re: Publishing exploit code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.63.0506301013380.23164@catbert.rellim.com>
Date: Thu Jun 30 18:24:20 2005
From: gem at rellim.com (Gary E. Miller)
Subject: Re: Publishing exploit code - what is it good for

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yo Aviram!

On Thu, 30 Jun 2005, Aviram Jenik wrote:

> What I need is a security administrator, CSO, IT manager or sys admin th
> at can
> explain why they find public exploits are good for THEIR organizations.

Getting a serious bug fixed before full-disclosure was much harder.  Any
and all potential isssues were just denied by vendors.  Denial no longer
worked after everyone could just google for a working exploit.  Then
vendors got a bit of religion and started admitting and fixing a few
things.

Same thing for customer networks.  "It ain't broke so we won't fix fix
it" was the ruile of the day.  Now when a pen test, using a public
exploit, pokes a hole in a customer system there is a chance they may
fix it.  They can no longer claim that just because you found it does
not mean the bad guys can.

Going back to the old ways is just burying our collective heads in the
sand again.  Nothing got fixed because no-one could "prove" there was
a problem.

Now that some things get fixed, the net is safer for all on the net.

RGDS
GARY
- ---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
	gem@...lim.com  Tel:+1(541)382-8588 Fax: +1(541)382-8676

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCxCqt8KZibdeR3qURApa7AJwLoJYjZ4z91L7y7tgEUDhZtgUePQCeKc3u
YQgKGjOc90ZV/42ktKwbdss=
=Ts5l
-----END PGP SIGNATURE-----