Re: Publishing exploit code - what is it good for

["Raghu Chinthoju" <raghu.chinthoju () rediffmail com>]

Though my experience doesn’t dig in miles deep, in my humble opinion, I think it has evolved this way; the present 
state is the eventuality of the series of debates, discussions etc like this ones, which led us into full disclosure. 
To prove in support of full disclosure, lets assume there is no full disclosure. Every one lets the world know about 
the existence of the vulnerability and no one would disclose how the vulnerability is exploited (expect to the product 
vendor, ofcource). Then what? Do you think there would be so much importance given to the vulnerability fixing as we 
see it today? Do you think it would be this easy (I know some would disagree, if you do so, please read this from the 
beginig again ;) for us to convenience the vendors about the seriousness of the vulnerability? Would there be so much 
advancement and knowledge in this field? I think not! And then, the persistence of people who desired secure computing 
led to full disclosure. And this is why we need full disclosure!

I agree with your 'security analysts' that many security administrators and so many others who hooked on to Internet 
need not have access to the exploits, but then, this is one the vital vectors that led to full disclosure.

Raghu

On 6/30/05, Aviram Jenik <aviram () beyondsecurity com> wrote:
> Hi,
>
> I recently had a discussion about the concept of full disclosure 
[...]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/