Re: Rixstep aren't as leet as they thought they were

[security curmudgeon <jericho () attrition org>]

: "It may not come as a shocker, but so far the Month of Rixstep Bugs
: has not netted a single bug."
: -- http://rixstep.com/1/20070115,00.shtml
: 
: Maybe because nobody was looking?

http://osvdb.org/blog/?p=160
Month of .. who?!
Posted in General Vulnerability Info on January 15th, 2007 by jericho

http://rixstep.com/2/20070104,00.shtml

:    A Month of Rixstep Bugs

:    Its a win-win proposition.

:    Starting now and for the duration of January 2007 Rixstep will be 
: holding a Month of Rixstep Bugs campaign: find a bug in any Rixstep 
: software product and win a prize.

Its not a win-win proposition, it is a lame gimmick. After the month of 
apple bugs, week of (cancelled) oracle bugs, and the month of linux kernel 
bugs, Rixstep wants in on the bandwagon. Few small problems:

   1. They posted this announcement on the 4th, not even giving a full 
month.
   2. They didnt post this to Bugtraq, Full-Disclosure or any other 
security list/resource I monitor.
   3. Rixstep doesnt have the saturation that Linux, Apple or Oracle do. 
It is considerably easier to test those products and platforms versus 
Rixstep, who many of us have never heard of, let alone seen deployed.

If you want to play with the big boys Rixstep, man up and put some of your 
products up on your site and post the challenge to Bugtraq and 
Full-Disclosure.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/