Full Disclosure mailing list archives
Re: no more public exploits: just a n00bie view
From: "RandallM" <randallm () fidmail com>
Date: Tue, 27 Apr 2004 22:02:38 -0500
Hey, I have to agree with Borg. I am of course new to your list. I joined it to learn the "what, when and where" of security. I must say that when I saw exploits posted I was a bit taken back. My first thought was "Guess I can expect to see it soon". A question naturally comes; would it show in the wild had it not been posted. And what percentages of exploits do go in the wild due to being posted along with the advisory? Then again how can I be concerned about an advisory if I can't see the effects of the exploit? Of course, then again, I really have understood little about the code of the exploit but did a lot on the advisory. Just a n00bie view. Borg wrote:
Message: 28 Date: Tue, 27 Apr 2004 13:19:44 -0400 From: chris <chris () cr-secure net> To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] no more public exploits Heres my two cents :-/ Exploit code is better kept private. Advisories should be public. Why? Because exploit code is not easy to write depending on the bug. And I for one sure dont want some 'penetration tester' taking my code and plugging it into his automated scanner and collecting the cash. Im far to greedy to watch that happen. Sorry. NON-Disclosure of Exploit code. Full-Disclosure of Advisories. As far as the discussion of sysadmins patching on time or not. All I will say is this . . . if they did patch on time there wouldnt be a www.zone-h.org. - borg (ChrisR-) --__--__--
Borg ended. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: no more public exploits: just a n00bie view RandallM (Apr 27)