Full Disclosure mailing list archives
DJB's contest (repost after being moderated on BGTQ)
From: <support () sabre-security com>
Date: Sat, 25 Dec 2004 08:31:25 -0800
Hey all, DJB,
Is the class on responsible disclosure next semester perhaps?
Responsible disclosure is a euphemism creating by industry lobby groups like OIS, which never had much support in the security scene in the first place.
The reason that the 16 students sent their 91 reports to me privately is so that they wouldn't have to deal with people like you. It was entirely my decision to send out these 44 public notices.
If I am allowed to suggest something for a possible re-run of the same course: It would probably be more interesting to set a lower bar on the number of vulnerabilities but to restrict the focus a bit more -- e.g. asking for 1 remotely exploitable bug in a list of widely used software (Bind/OpenSSH/ProFTPd (or even QMail :-) would focus students on larger pieces of software that are a bit more critical than e.g. nasm. This would lead to the students searching for less "standardized" problems, as well. Then again, it sounds like a really fun course :) Cheers, Thomas Dullien
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DJB's contest (repost after being moderated on BGTQ) support (Dec 29)