full-disclosure - Re: Python ssl handling could be better...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=zBV6eN==TMR32J3DEgOqTXbFdCyUmAgd6k9cO@mail.gmail.com>
Date: Fri, 4 Mar 2011 09:53:28 -0600
From: Michael Krymson <krymson@...il.com>
To: full-disclosure <Full-Disclosure@...ts.grok.org.uk>
Subject: Re: Python ssl handling could be better...

The problem with this discussion is simply one of definition of security.
For some, security is entirely black and white. It is either perfectly
secure or it is not. These are the people who would say telnetd with
authentication is worse/same as telnetd without any authentication. (False
sense of security aside....really?)

On the other hand, there are people who believe in incremental security, or
grey levels of security, where something like a password is at least
somewhat better than none at all.  Where *some* encryption is at least
somewhat better than none at all. These people probably tend to be those
who've actually had jobs in general digital defense...

Unfortunately, one person's level of risk/value/security is not another's,
especially if their definitions are never going to match up.

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/