Re: End of all Open Source.

From: Barry Margolin (barry.margolin@level3.com)
Date: 03/07/03

  • Next message: Doug Fox: "Clean Up undesirable elements in a PC" 
    From: Barry Margolin <barry.margolin@level3.com>
Date: Fri, 07 Mar 2003 01:21:53 GMT

    In article <isjf6v0krtkvp9cs9up7j5s5camcqqop9e@4ax.com>,
    Bradley Bungmunch <Bradley@Bungmunch.com> wrote:
    >On Wed, 05 Mar 2003 23:47:12 GMT, Barry Margolin
    ><barry.margolin@level3.com> wrote:
    >
    >>In article <e3nc6vctfkutoajk6so9ig4g802vj3u01d@4ax.com>,
    >>Bradley Bungmunch <Bradley@Bungmunch.com> wrote:
    >>>If this bug had been announced straight away, it would also have been
    >>>fixed almost immediately. Instead they kept it quiet and it took three
    >>>months for a fix to be issued.
    >>
    >>Yet, as far as we know, it was never exploited during that time.
    >>
    >And on what bit of research do you base this? Illuminate me please.

    The CERT advisory said so.

    >>>In the meantime, the systems remained vulnerable and the people who
    >>>never bother to patch their systems will still have unpatched systems
    >>>in the weeks to come.
    >>
    >>People like that are irrelevant -- if they don't bother to patch their
    >>systems, it doesn't matter when the vulnerability and fixes are announced.
    >>
    >So what was the point in the delay?

    To give implementors time to fix it before the vulnerability was made well
    known. That's CERT's standard practice.

    >>If the vulnerability had been announced immediately, what could end users
    >>have done with the knowledge? Should they shut down their mail servers
    >>until the patches are made available? Or frantically convert to some other
    >>mailer like postfix?
    >>
    >Why did the fix take so long to produce? What was so different? Like
    >I said - in a previous paragraph - people who don't patch their
    >systems aren't going to bother patching just because their has been a
    >three month delay.

    I don't know what point you're trying to make about the people who don't
    patch their systems. Like I said, they're irrelevant.

    >But the failure to provide a timeous solution seems to have been
    >*caused* by the very fact that the bug was kept secret.

    On what research do you base that statement? How can you know what would
    have happened in other circumstances? You can only speculate. 

    -- 
Barry Margolin, barry.margolin@level3.com
Genuity Managed Services, Woburn, MA
*** DON'T SEND TECHNICAL QUESTIONS DIRECTLY TO ME, post them to newsgroups.
Please DON'T copy followups to me -- I'll assume it wasn't posted to the group.
  • Next message: Doug Fox: "Clean Up undesirable elements in a PC"

    Relevant Pages

    • Re: End of all Open Source.
      ... Illuminate me please. ... it doesn't matter when the vulnerability and fixes are announced. ... To give implementors time to fix it before the vulnerability was made well ... >three month delay. ...
      (alt.computer.security)
    • Re: Newbie holding questions
      ... Why would I hold if there is no delay? ... You'd receive clearance beyond the previously issued holding ... > Hold is doing a racetrack pattern around a fix is what I was taught. ...
      (rec.aviation.ifr)
    • Re: [openssh-unix-announce] Re: Upcoming OpenSSH vulnerability (fwd)
      ... >>apparently it's so complicated that you can't fix it right away on your ... details of the vulnerability now: the black hats could use the ... OpenSSH version is the most straightforward solution. ... In my opinion, the advantages of immediate disclosure outweigh the ...
      (FreeBSD-Security)
    • Re: [PATCH] x86_64: fix problems due to use of "outb" to port 80 on some AMD64x2 laptops, etc.
      ... with udelay based time delay on x86_64 architecture machines. ... wow, cool fix! ... static void* memset ...
      (Linux-Kernel)
    • Re: MicroMonopoly aids Terrorism?
      ... It's the links at the bottom that demonstrate the vulnerability... ... "Tedd Riggs" wrote in message ... >> the actual Web site is at a different address in Pakistan." ... >> effin' hard to fix fully. ...
      (microsoft.public.security)
    • Quantcast