full-disclosure - Re: VUPEN Security Research - Adobe Flash Player RTMP Data Processing Object Confusion (CVE-2013-2555)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130421000212.GA25237@neo.hsd1.nh.comcast.net>
Date: Sat, 20 Apr 2013 20:02:12 -0400
From: Bryan <bryan@...wildhats.com>
To: Benji <me@...ji.com>
Cc: Full-Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: VUPEN Security Research - Adobe Flash Player
 RTMP Data Processing Object Confusion (CVE-2013-2555)

The only point that I was trying to make is that there needs to be
more of an investement in the security facet of software development,
and that if a company is not willing to invest the resources to 
create a secure product, not to whine when they get hacked.

On Sun, Apr 21, 2013 at 12:43:15AM +0100, Benji wrote:
>    Sorry, by flaws, I should have said, *"has not prevent bad
>    code/ineffective patches from being pushed out"
> 
>    On Sun, Apr 21, 2013 at 12:41 AM, Benji <me@...ji.com> wrote:
> 
>      (For
>      example, http://webcache.googleusercontent.com/search?q=cache:2cXGaaHnqyMJ:www.computerworld.com/s/article/9235954/Researchers_find_critical_vulnerabilities_in_Java_7_Update_11+&cd=8&hl=en&ct=clnk&gl=uk
>      )
> 
>      On Sun, Apr 21, 2013 at 12:37 AM, Benji <me@...ji.com> wrote:
> 
>        Because security engineers are different to a QA department you
>        originally suggested, and you seem to be very ideologist about the
>        scenarios. As we've seen, Oracle's Java product has security engineers
>        and this has not prevented flaws.
> 
>        On Sun, Apr 21, 2013 at 12:34 AM, Bryan <bryan@...wildhats.com> wrote:
> 
>          "Your 5-chained-0day-to-code-exec, in my opinion, does not count as
>          negligence  and comes from the developer effectively not being a
>          security engineer"
>          Solution: Hire security engineers.
>          "In my opinion we are not at the stage in industry where we can
>          consider/expect any developer to think through each implication of
>          each feature they implement"
>          Solution: Hire security engineers to think through each implication.
> 
>          Why are we disagreeing?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/