Full Disclosure mailing list archives
Re: defining 0day
From: "Brian Loe" <knobdy () gmail com>
Date: Tue, 25 Sep 2007 15:54:55 -0500
On 9/25/07, Adrian Griffis <adriang63 () gmail com> wrote:
I understand why this descriptivist approach is tempting over a prescriptivist approach. But it's important, I think, to keep in mind that the public uses the word "illegal" when they really mean "unlawful" and uses the word "Schizophrenic" when they are talking about multiple personality disorders. All technical fields have their jargon, and the general public is simply not well educated enough about the issues involved to arbitrate disputes over usage. Just as the legal profession needs the word "illegal" with its proper meaning, we also need our jargon to facilitate precise discussions about security matters. The public can't always be the source of our definitions.
I understand and agree. The issue is, that as with those other terms, the industry has allowed the term to be misused long enough that the public now using it wrong as well. However, the "public" I was referring to is reference materials - dictionaries, wikipedia, etc.. If a newcomer to the security field hears the term "zero day" where does he go to find out what a "zero day" exploit is? Most students go to dictionaries or the like... and whats wrong with the current definition of a "zero day"? Okay, dump "zero day" completely and choose a new term for each division of exploit or vulnerability. Blue Sky Rambling: Try to enable a unified method of disclosure for all types of exploits and vulnerabilities via a single medium/site or multiple sites with a unified form or some such. I envision a check list asking things like "is this vulnerability known to the vendor - yes/no" and "does this exploit work against latest versions and all patches - yes/no" or whatever it takes to filter disclosures and allow them to be programatically labeled and disseminated, and the "participating" vendor to be contacted - everything occurring in an orderly, acceptable fashion by way of carved-in-stone rules. Definitions of the labels can't be argued because the rules don't bend for one person's perception. If all of the right check boxes are checked, its zero day, or its not. Oh, and you have to be "certified" to release a disclosure! _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: 0day: PDF pwns Windows, (continued)
- Re: 0day: PDF pwns Windows Chad Perrin (Sep 25)
- Re: 0day: PDF pwns Windows Lamont Granquist (Sep 25)
- Re: 0day: PDF pwns Windows Roland Kuhn (Sep 25)
- Re: 0day: PDF pwns Windows Thor (Hammer of God) (Sep 25)
- defining 0day Gadi Evron (Sep 25)
- Re: defining 0day Brian Loe (Sep 25)
- Re: defining 0day Gadi Evron (Sep 25)
- Re: defining 0day Brian Loe (Sep 25)
- Re: defining 0day Epic (Sep 25)
- Re: defining 0day Adrian Griffis (Sep 25)
- Re: defining 0day Brian Loe (Sep 25)
- Re: defining 0day Andrew Weaver (Sep 25)
- Re: defining 0day don bailey (Sep 25)
- Re: defining 0day Charles Miller (Sep 25)
- Re: defining 0day Gadi Evron (Sep 25)
- Re: defining 0day scott (Sep 25)
- Re: defining 0day Zow (Sep 27)
- Re: defining 0day David Gillett (Sep 25)
- Re: defining 0day evilrabbi (Sep 26)
- defining 0day Gadi Evron (Sep 25)
- Re: defining 0day Juergen Marester (Sep 25)