Re: Publishing exploit code - what is it good for

["Gary E. Miller" <gem () rellim com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Yo Aviram!

On Thu, 30 Jun 2005, Aviram Jenik wrote:

> What I need is a security administrator, CSO, IT manager or sys admin th
> at can
> explain why they find public exploits are good for THEIR organizations.

Getting a serious bug fixed before full-disclosure was much harder.  Any
and all potential isssues were just denied by vendors.  Denial no longer
worked after everyone could just google for a working exploit.  Then
vendors got a bit of religion and started admitting and fixing a few
things.

Same thing for customer networks.  "It ain't broke so we won't fix fix
it" was the ruile of the day.  Now when a pen test, using a public
exploit, pokes a hole in a customer system there is a chance they may
fix it.  They can no longer claim that just because you found it does
not mean the bad guys can.

Going back to the old ways is just burying our collective heads in the
sand again.  Nothing got fixed because no-one could "prove" there was
a problem.

Now that some things get fixed, the net is safer for all on the net.

RGDS
GARY
- ---------------------------------------------------------------------------
Gary E. Miller Rellim 20340 Empire Blvd, Suite E-3, Bend, OR 97701
        gem () rellim com  Tel:+1(541)382-8588 Fax: +1(541)382-8676

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFCxCqt8KZibdeR3qURApa7AJwLoJYjZ4z91L7y7tgEUDhZtgUePQCeKc3u
YQgKGjOc90ZV/42ktKwbdss=
=Ts5l
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/