Full Disclosure mailing list archives
Re: no more public exploits
From: Dave Sherohman <esper () sherohman org>
Date: Tue, 27 Apr 2004 13:36:17 -0500
On Tue, Apr 27, 2004 at 12:52:26PM -0500, Duquette, John wrote:
That is a terrible policy to follow. If the vulnerability is real enough for the vendor to publish a patch, then sysadmins should patch their systems. Haven't all the recent worms taught people anything?
The problem is that many vendors don't publish pure security patches, instead bundling new features with the security fix. This places sysadmins in the position of having to evaluate the existing vulnerability against the chance of new holes and/or broken features in the patch. If you're dealing with a vendor who does pure security patches, then I agree with you. (That's why I run Debian stable - they backport all security patches, so you know that your security upgrade is _just_ a security upgrade.) If you're dealing with '90s-era Microsoft, where the only security patches are bundled with dozens of other changes and "enhancements" in a Service Pack that's liable to break more things than it fixes, then the situation isn't so clear- cut. -- The freedoms that we enjoy presently are the most important victories of the White Hats over the past several millennia, and it is vitally important that we don't give them up now, only because we are frightened. - Eolake Stobblehouse (http://stobblehouse.com/text/battle.html) _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- no more public exploits johnny cyberpunk (Apr 27)
- Re: no more public exploits Yabby (Apr 27)
- RE: no more public exploits Curt Purdy (Apr 27)
- Re: no more public exploits list (Apr 28)
- Re: no more public exploits rd (Apr 28)
- <Possible follow-ups>
- RE: no more public exploits Duquette, John (Apr 27)
- Re: no more public exploits Dave Sherohman (Apr 27)
- Re: no more public exploits Yabby (Apr 27)
- Detecting newly added Windows Services (was: no more public exploits) Marcel Krause (Apr 28)
- RE: no more public exploits Douglas Carvalho (Apr 27)
- RE: no more public exploits Ng, Kenneth (US) (Apr 27)
- Re: no more public exploits Dave Aitel (Apr 27)
- Re: no more public exploits nicolas vigier (Apr 27)
- Re: no more public exploits Dave Aitel (Apr 27)
- Re: no more public exploits Dave Aitel (Apr 27)
- RE: no more public exploits Ng, Kenneth (US) (Apr 27)
- Re: no more public exploits chris (Apr 27)
- Re: no more public exploits james (Apr 27)