full-disclosure - Re: Getting Off the Patch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <58DB1B68E62B9F448DF1A276B0886DF16EBD277C@EX2010.hammerofgod.com>
Date: Fri, 14 Jan 2011 15:32:24 +0000
From: "Thor (Hammer of God)" <thor@...merofgod.com>
To: "Valdis.Kletnieks@...edu" <Valdis.Kletnieks@...edu>, phocean
	<0x90@...cean.net>
Cc: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>,
	Zach C <fxchip@...il.com>, "lists@...com.org" <lists@...com.org>
Subject: Re: Getting Off the Patch

Ah, so that makes perfect sense then.   Rather than hiring the young hires and teaching them to patch, we are supposed to hire highly experienced experts who are already supposed to know how to patch because young hires cannot do it.  However, since the argument is that patching is already incredibly hard, and that it creates exponential costs of operations, this must be because the experienced experts who set the whole thing up originally did it wrong based on their inherited, faulty knowledge. 

So instead of patching, since even the experts can't do to it right without the spiraling costs crippling operations, we tell the same people who can't patch that they are to " find the right balance of operational controls at each interactive point within a vector [to] provide protection against 100% of the threats including unknown threats" and to, obviously, do so in such an effective manner that the costs of doing so somehow get substantially minimized and at a level that justifies the risks of not patching, even given the salary difference between noobs and ninjas.   And since the knowledge required for those who *can't* patch but *can* balance operational controls at each interactive point within a vector is available freely at www.osstmm.org , we should stop trying to patch, even though the process detailed and the knowledge required in the PDF was compiled by those who obviously also couldn't figure out how to patch or else they wouldn't have needed an alternative in 
 the first place.  

All they have to do is read, understand, and act on the information in the PDF as opposed to reading, understanding, and acting on patch management. 

It's brilliant!  Where do I sign up?

t

>-----Original Message-----
>From: full-disclosure-bounces@...ts.grok.org.uk [mailto:full-disclosure-
>bounces@...ts.grok.org.uk] On Behalf Of Valdis.Kletnieks@...edu
>Sent: Friday, January 14, 2011 7:01 AM
>To: phocean
>Cc: full-disclosure@...ts.grok.org.uk; Zach C; lists@...com.org
>Subject: Re: [Full-disclosure] Getting Off the Patch
>
>On Fri, 14 Jan 2011 09:25:51 +0100, phocean said:
>> But this is so well known, at least I thought, that I wonder what is
>> the purpose of all of this.
>
>It's a symptom of our industry slowly getting older.  In the '70s and '80s, pretty
>much everybody had 3-5 years experience, and almost nobody had more than
>10, because the field wasn't 10 years old.  Nobody looked down on the
>newbies, because (a) they didn't stay newbies long because there was only 3-
>4 years worth of stuff to learn and (b) the old-timers could still remember
>being newbies themselves.
>
>Now it's different - the guys who were here at the beginning are all old, gray,
>and/or bald, and looking at retirement, and we have to start worrying about
>the collective brain drain that will happen at that time.  Meanwhile, demand is
>surging faster than truly qualified people can be supplied, so we're seeing a lot
>of young hires who only know what they learned in an 18 month course at
>ECPI or similar trade school.  In other words, we're at exactly the same
>position when the great flood of McSE holders happened a few years back.
>
>RFC1925 says: "Some things in life can never be fully appreciated nor
>understood unless experienced firsthand. Some things in networking can
>never be fully understood by someone who neither builds commercial
>networking equipment nor runs an operational network."  We've gotten to
>the point where a large segment of the industry wasn't taught "patching
>doesn't work" in school, and they have yet to experience it themselves out in
>the real world.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/