Re: The 'good worm' from HP

[michael williamson <michael () puffin tamucc edu>]

There are much better alternatives to using exploit code to install
patches.    The security folk at TAMU have come up with an in-line
network sniffer automagically blocks infected machines and notifies them
via an internal webserver of their infection.  After a set time it
allows them back on.  (clever...motivates _user_ to clean/patch)

http://netsquid.tamu.edu/

This is a _lot_ more responsible than running exploit code of any sort,
even for a good purpose.  I admin one particular windows server that I
must actually wait for vender approval before applying any hotfixes.  
I'd be extremely pissed if some do-gooder net admin tried to patch my
box via sploit code and ended up breaking it.  (it is that fickle)

-Michael

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html