full-disclosure - Re: [Dailydave] Linux's unofficial security-through-coverup policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 18 Jul 2008 21:07:47 +0530
From: "Joel Jose" <joeljose420@...il.com>
To: staff@...-disclosure.net
Cc: dailydave@...ts.immunitysec.com, full-disclosure@...ts.grok.org.uk,
	Brad Spengler <spender@...ecurity.net>, Blue Boar <BlueBoar@...evco.com>
Subject: Re: [Dailydave] Linux's unofficial
	security-through-coverup policy

if ppl stop giving "special" consideration to security, the quality of
security enforcement could come down. Ideally we like to "clean" all
bugs. But as is pointed out, bugs are many. Prioritizing bugs and
"dealing with a strong deadline" is vitally important. classification
of bugs into domain is the most effective way to deal with them. Not
only does it help people concerned in the area to be aware..fast. but
also it helps in "discussing" it with like-minded people. Posting a
security bug in a general list will prove a little hard, as the people
may not know what meat-in-the middle, privilege escalation..etc mean.
Its just bare stupidity to "clout" the bug space by generalizing it.
One more point, The security bugs are important because the harm done
is usually "crafted", with "bad intentions" and "on purpose". It also
leads to financial "theft" an d"crimes" than just the normal loss of
data or work time(as in normal bug). You could get penalized as
abetting the crime. But a GUI crash is always less severe. People can
quickly loose trust in the software and the services that depend on
them can be irrecoverably damaged. Think about it.... there are more
people engaged in penetrating, propagating security holes than filing
common bug reports.... it definitely isn't a time-waster for them.

-- 
As soon as men decide that all means are permitted to fight an
evil, then their good becomes indistinguishable from the evil
that they set out to destroy.
 - Christopher Dawson, The Judgment of Nations

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/