Re: Public disclosure of discovered vulnerabilities
From: Andi Kleen (freitag_at_alancoxonachip.com)
Date: 05/17/05
- Next message: John Savard: "Re: Novelist thanks the group"
- Previous message: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- In reply to: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Next in thread: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Reply:(deleted message) Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 17 May 2005 15:38:58 +0200
"Stephen Sprunk" <stephen@sprunk.org> writes:
>
> Unfortunately, certain vendors absolutely refuse to fix a security hole,
> often denying that it exists even when presented with irrefutable
> evidence, unless it's made public and customer pressure becomes
> significant. There's nothing to be gained by delaying public release of
This attitude used to be very common, but now luckily disappears more and
more because there has been an industry wide push to more
security. I guess even executives traditionally ignorant of such issues
get the message that something needs to be done when their mailboxes
get flooded by e-mail worms.
> In contrast, one vendor I worked with would fix security bugs and ship
> patches (without telling customers what they fixed) as quickly as
That seems like a bad strategy because software patches can be usually
relatively easy reverse engineered. Disassembling a big program is
quite tough because it is so much code, but just looking at some
differences to an earlier version of the image is much easier.
So a blackhat just needs to watch the new patches and then use the
exploits before all the customers know about it and updated their
systems. Worst of both ways.
-Andi
- Next message: John Savard: "Re: Novelist thanks the group"
- Previous message: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- In reply to: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Next in thread: Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Reply:(deleted message) Stephen Sprunk: "Re: Public disclosure of discovered vulnerabilities"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
