Re: Plain Text Password Disclosure vulnerability in rediff mail

[Valdis.Kletnieks () vt edu]

On Fri, 11 Sep 2009 21:49:00 BST, you said:

> would one not rather hire someone *not* well-known and *doesn't* 
> get owned?

Feel free to hire that guy flipping burgers at McD's to do your security
assessment.  Let me know how it turns out.

Also, remember that there is an asymmetric component to this - the sysadmin
has to stop *every* attack to remain un-owned, but the attacker only needs one.

And there's always the "security is tradeoffs" component - Dan's a smart guy,
and knows he can't secure every server perfectly.  So he figures out what he
has to do to limit the likelyhood, and takes his chances.  If you estimate that
a server of yours will be hacked once every year, and cost you $1,200 to clean
up, then if you're spending more than $100/month in security you're being an
idiot.  Especially if you can do good PR spin on it:

"I'm Dan Kaminsky - hated by hackers the world over.  Our systems average
25,392 attacks per day, and in 4 years only one has gotten through.  If we
can do that when under attack by the worst the world has to offer, imagine
what we can do for *your* business."

:)

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/