Full Disclosure mailing list archives
Re: what is this?
From: "Fredrick Diggle" <fdiggle () gmail com>
Date: Thu, 17 Jan 2008 15:16:30 -0600
Seems to Fredrick Diggle that if you are any good at your job you should be thanking the sheltered research corner for keeping you in mustache wax. If you inform your clients of the realistic risks involved then you also must realize that very few researchers are actually finding the types of bugs which keep your clients scared enough to hire you o.0. Fredrick Diggle thinks you owe someone an apology. Also, we should all put a description of our jobs on here like Valdis has so graciously started. That way we will all know who we are dealing with. Fredrick Diggle will start. Fredrick's job is to primarily clean the primate cages but also he is allowed to feed the chimps, train the babies to do backflips for grapes (monkeys love grapes), and teach the older ones to search for web vulns (The zoo doesn't know but he is building an army of monkey hackers). Sometimes he is also asked to brush the hippopotamus' teeth but Fredrick tends to get angry and throw things when he is forced to do that because no matter how much you brush you just can't get rid of the smell (interesting fact: hippos have bad breathe). YAY! On Jan 17, 2008 2:36 PM, <Valdis.Kletnieks () vt edu> wrote:
On Wed, 16 Jan 2008 20:41:21 CST, reepex said:woah paul are you talking about stuff you do not know about again? [1] You like to butt in on conversations. and how do you that this virus has been put in virustotal, maybe it is new? Most people with decent RE skill ( unlike you and gadi ),It might come as quite the shock to you in your sheltered corner of the security community, but many of us have jobs and roles in the community that don't directly involve either creating exploits or doing RE. For instance, I will cheerfully admit that I suck at writing exploits, and I'm not the world expert on RE. On the other hand, that's OK, because that's not my job. My job is to answer questions like "What is our exposure if somebody has an exploit for bug #19345" and "What can we do to minimize the damage if somebody in the VP's office gets hit with the FooBar trojan?" and other similar "How do we keep our 30,000 users out of trouble?" questions. And to answer those sorts of questions doesn't take a lot of writing/RE knowledge, but it *does* require understanding things like "escalating privilege" (if attacker has X, can they get to Y?), auditing (how do we know if an attacker did or didn't get Y), deployment issues (how do you get 30,000 users to patch against something, when you don't have administrative control over their boxes), and social engineering (what you resort to when you can't find other ways to get the users to patch :) and social engineering. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: what is this?, (continued)
- Re: what is this? Jose Nazario (Jan 14)
- Re: what is this? crazy frog crazy frog (Jan 14)
- Re: what is this? 3APA3A (Jan 14)
- Re: what is this? Mario Contestabile (Jan 14)
- Re: what is this? Gadi Evron (Jan 14)
- Re: what is this? reepex (Jan 16)
- Re: what is this? Paul Schmehl (Jan 16)
- Re: what is this? worried security (Jan 16)
- Re: what is this? reepex (Jan 16)
- Re: what is this? Valdis . Kletnieks (Jan 17)
- Re: what is this? Fredrick Diggle (Jan 17)
- Re: what is this? Valdis . Kletnieks (Jan 17)
- Re: what is this? Paul Schmehl (Jan 17)
- Re: what is this? Fredrick Diggle (Jan 18)
- Re: what is this? worried security (Jan 18)
- Re: what is this? reepex (Jan 16)
- Re: what is this? Jose Nazario (Jan 14)
- Re: what is this? Tremaine Lea (Jan 16)
- Re: what is this? scott (Jan 16)
- Re: what is this? reepex (Jan 17)
- Re: what is this? Valdis . Kletnieks (Jan 17)
- Re: what is this? crazy frog crazy frog (Jan 14)