[Full-disclosure] Re: Publishing exploit code - what is it good for

From: Gary E. Miller (gem_at_rellim.com)
Date: 06/30/05

  • Next message: Matt Huston: "[Full-disclosure] RE: Publishing exploit code - what is it good for" 
    Date: Thu, 30 Jun 2005 10:23:53 -0700 (PDT)
To: Aviram Jenik <aviram@beyondsecurity.com>

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Yo Aviram!

    On Thu, 30 Jun 2005, Aviram Jenik wrote:

    > What I need is a security administrator, CSO, IT manager or sys admin th
    > at can
    > explain why they find public exploits are good for THEIR organizations.

    Getting a serious bug fixed before full-disclosure was much harder. Any
    and all potential isssues were just denied by vendors. Denial no longer
    worked after everyone could just google for a working exploit. Then
    vendors got a bit of religion and started admitting and fixing a few
    things.

    Same thing for customer networks. "It ain't broke so we won't fix fix
    it" was the ruile of the day. Now when a pen test, using a public
    exploit, pokes a hole in a customer system there is a chance they may
    fix it. They can no longer claim that just because you found it does
    not mean the bad guys can.

    Going back to the old ways is just burying our collective heads in the
    sand again. Nothing got fixed because no-one could "prove" there was
    a problem.

    Now that some things get fixed, the net is safer for all on the net.

    RGDS
    GARY
    - ---------------------------------------------------------------------------
    Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
            gem@rellim.com Tel:+1(541)382-8588 Fax: +1(541)382-8676

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.1 (GNU/Linux)

    iD8DBQFCxCqt8KZibdeR3qURApa7AJwLoJYjZ4z91L7y7tgEUDhZtgUePQCeKc3u
    YQgKGjOc90ZV/42ktKwbdss=
    =Ts5l
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Matt Huston: "[Full-disclosure] RE: Publishing exploit code - what is it good for"