full-disclosure - Re: NiX API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <16497.1307633639@turing-police.cc.vt.edu>
Date: Thu, 09 Jun 2011 11:33:59 -0400
From: Valdis.Kletnieks@...edu
To: nix@...roxylists.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: NiX API

On Thu, 09 Jun 2011 18:05:37 +0300, nix@...roxylists.com said:
> In most cases, the malicious user is denied access even before a
> fraudulent purchase is made!

> Since implementation of NiX API with it's current featuers: 0 fraudulent
> purchases in last 2-3 weeks period. It definitely does something.

OK, I'll bite - how many *lost sales* did you have because NIX false-positived
and rejected a non-malicious user before a valid purchase was made?  Making
something that rejects *every* malicious attack is *easy* - just reject every
request.  Of course, that's not very practical for production use, so you end
up having to trade off false positives and negatives to minimize the total
cost...

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/