lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu Apr 27 14:43:15 2006
From: str0ke at milw0rm.com (str0ke)
Subject: MSIE (mshtml.dll) OBJECT tag vulnerability

This isn't the whitehat lovers group, anything and everything goes for
Full Disclosure.

> "Just who does he think he is? [...] Zalewski may think
>  he's some sort of hero disclosing this information, but his is the act of a vandal.

No a vandal wouldn't disclose the information, a vandal on the other
hand would sell the information / code to spyware companies.  Hmm,
think about it.

The funny part about this whole situation is that the people that
bashed on MZ never contributed a pea to what he has to this list.

/str0ke

On 4/27/06, Pedro Hugo <fractalg@...hspeedweb.net> wrote:
> >   "Just who does he think he is? [...] Zalewski may think he's some sort
> of hero disclosing this information, but his is the act of a vandal.
> If
> >   it turns out that the bug is exploitable and abused before it's
> patched,
> >   then perhaps he'll be proud to be remembered for that."
>
> He is what he wants to be... Afaik, there are no laws about disclosure.
> Everyone does what he thinks it's best, even if it's best only for himself
> (like Adam Smith "said", everyone acts on their own interest).
> The bug requires user interaction. If most users are too stupid to click
> anything, the problem will not be solved with patching.
> And, even with patches, can you estimate what percentage of systems which
> are patched right away ? Yeah, most aren't!
>
> No sysadmin likes to be catched by surprise with security problems. But,
> life isn't always perfect !
>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Powered by blists - more mailing lists