Full Disclosure mailing list archives
Re: what we REALLY learned from WMF
From: Gadi Evron <ge () linuxbox org>
Date: Fri, 06 Jan 2006 02:11:11 +0200
Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:
Don't release a beta patch ....1. it would get patches into reverse engineering faster [hello look what happened to the leaked patch]and 2.Don't ask for an untested patch if you are not willing to be there in the newsgroups, communities and listserves helping the dead bodies after a bad patch sir.Do you do/handle change management in your firm? Even in my small firm I could not handle the 'any time/any day' that patches used to come out before.Be careful of what you ask for sir...because if you get what you want.... ensure your firm has the resources to test/deploy/change management on a 24 hours a day 7 days a week schedule because exploits can be built in less than 20 minutes.If the security issue has been responsible disclosed, there is a process that is needed to build a patch and test the patch. Some issues take more than 'days' sir. And testing takes time as well, sir.For my community I want tested patches sir, and I will argue until doomsday on that point. Don't hurt my community with a bad patch or a beta patch, sir.
I quite agree, I disagree on the amount of time it currently takes for any vendor to release patches. Apparently we "Got used" to slowness, false positives and many other ills. Maybe it's time that changed?
Gadi. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- what we REALLY learned from WMF Gadi Evron (Jan 05)
- Re: what we REALLY learned from WMF James Lay (Jan 05)
- Re: what we REALLY learned from WMF Niek (Jan 05)
- Re: what we REALLY learned from WMF Nick FitzGerald (Jan 05)
- Re: what we REALLY learned from WMF Niek (Jan 05)
- Re: what we REALLY learned from WMF Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Jan 05)
- Re: what we REALLY learned from WMF Gadi Evron (Jan 05)
- Re: what we REALLY learned from WMF Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Jan 05)
- Re: what we REALLY learned from WMF Gadi Evron (Jan 05)
- Re: what we REALLY learned from WMF Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Jan 05)
- Re: what we REALLY learned from WMF Gadi Evron (Jan 05)
- Re: what we REALLY learned from WMF James Lay (Jan 05)
- Re: Re: what we REALLY learned from WMF Devdas Bhagat (Jan 06)
- Re: what we REALLY learned from WMF Dave Korn (Jan 06)
- Re: Re: what we REALLY learned from WMF Michael Holstein (Jan 06)