|
Nish [BusterBoy] wrote:
Say there is a new bug in my box's FTP server.
I download the exploit.
Test my server and if it is vulnerable I take it down.
And what if the exploit is for something more serious than an FTP server? Or that you depend on the FTP server for day-to-day duties. You can't just "take it down" without serious problems occuring.
Publishing bugs that don't affect security should be published, since publishing them does tend to get them fixed faster. Put publishing security bugs just hurts everyone who relies on the software for their business.
James
Sonork ID: 100.11138 - Hasaki
"My words but a whisper -- your deafness a SHOUT.
I may make you feel but I can't make you think." - Thick as a Brick, Jethro Tull 1972
|
|
|
|
|
James T. Johnson wrote:
And what if the exploit is for something more serious than an FTP server? Or that you depend on the FTP server for day-to-day duties. You can't just "take it down" without serious problems occuring.
Publishing bugs that don't affect security should be published, since publishing them does tend to get them fixed faster. Put publishing security bugs just hurts everyone who relies on the software for their business.
James you seem to have no idea of how the cracking community works. If one of them discovers a hole, it'll spread like fire. Thus if a valid security agency keeps the bug a secret, the only people who miss out will be the end-users. The malicious ones will always be the first ones to get access to the exploits. Believe me James, I know what I am talking about.
Hiding an exploit won't make it vanish. On the other hand revealing it might at the very least enable an end-user to be at least ready for it. And it is very very good to pressurize the vendors.
I am not sure you'll be convinced. This kind of thing needs real experience before convincement.
Anyway, I understand your thought process, but your data is all wrong. Often vendors have kept quiet about holes and this has lead to a lot of security breaches costing dear to many users of their products.
Guess I'll stop now...
Thanks
Nish
My most recent CP article :-
A newbie's elementary guide to spawning processes
www.busterboy.org
|
|
|
|
|
Nish [BusterBoy] wrote:
James you seem to have no idea of how the cracking community works. If one of them discovers a hole, it'll spread like fire.
To the cracking community, yes, but not to the general community. Crackers will find holes no matter, but if someone posts information about a hole to the community t large (with detailed instructions on how to do it) then it encourages those who would otherwise not know or have the energy/wherewithall to find out.
I would imagine those who would try a hole simply because it's been widely publicised would outway those who would find out through their cracker networks by a factor or a hundred to one or more.
cheers,
Chris Maunder
|
|
|
|
|
|
|
Nish [BusterBoy] wrote:
Seems like so long ago though to me
I thought its been more than a week too.
Chris basically said what I had been trying to type in a reply too :-P
James
Sonork ID: 100.11138 - Hasaki
"My words but a whisper -- your deafness a SHOUT.
I may make you feel but I can't make you think." - Thick as a Brick, Jethro Tull 1972
|
|
|
|
|
|
Nish [BusterBoy] wrote:
As usual I am singled out
We'll be coming for you soon! Are you ready?
James
Sonork ID: 100.11138 - Hasaki
"My words but a whisper -- your deafness a SHOUT.
I may make you feel but I can't make you think." - Thick as a Brick, Jethro Tull 1972
|
|
|
|
|
|
Take some deep breaths and get a good nights sleep we'll be there in the morning.
Don't worry though, there's no pain involved, unless you get some weird idea about leaving; that involves scars .
James
Sonork ID: 100.11138 - Hasaki
"My words but a whisper -- your deafness a SHOUT.
I may make you feel but I can't make you think." - Thick as a Brick, Jethro Tull 1972
|
|
|
|
|
Besides if we all agreed then what would be the fun?
cheers,
Chris Maunder
|
|
|
|
|
Nish [BusterBoy] wrote:
I guess Colin must have mailed you how he did it by now.
Of course not,
Telling Chris about an ASP exploit would be like telling my granny how to suck eggs.
Remember Chris is our ASP guru chap.
He probably already plugged the hole when he saw the Dr Wluff post.
Regardz
Colin J Davies
Sonork ID 100.9197:Colin
Most people should stick to calculators, Isaac Sasson
28 th Law of Computing:
Anything that can go wr#
Segmentation violation -- Core dumped
|
|
|
|
|
Colin Davies wrote:
Telling Chris about an ASP exploit would be like telling my granny how to suck eggs.
Remember Chris is our ASP guru chap
Dunno whether Chris M will take the comparison of his ASP skills to your grand-ma's egg related skills
I guess he's plugged it by now.
Nish
My most recent CP article :-
A newbie's elementary guide to spawning processes
www.busterboy.org
|
|
|
|
|
Nish the comparisson was not meant to be derrogatory at all.
It is a usage of an English expession "to suck eggs" it signifys that you really know your stuff.
Nish [BusterBoy] wrote:
I guess he's plugged it by now.
I'd say so, I'll test it tomorrow, just to be on the safe side.
Regardz
Colin J Davies
Sonork ID 100.9197:Colin
Most people should stick to calculators, Isaac Sasson
28 th Law of Computing:
Anything that can go wr#
Segmentation violation -- Core dumped
|
|
|
|
|
Colin Davies wrote:
Nish the comparisson was not meant to be derrogatory at all.
I know
It was my idea of a subtle joke.
Like if someone tells me, 'Nish you are as cool as Peter Norton', I'd say, "uh huh" in a manner as if to suggest I was actually cooler.
Nish
My most recent CP article :-
A newbie's elementary guide to spawning processes
www.busterboy.org
|
|
|
|
|
Nish [BusterBoy] wrote:
'Nish you are as cool as Peter Norton'
I haven't heard of him in years !
Where is he now ?
Regardz
Colin J Davies
Sonork ID 100.9197:Colin
Most people should stick to calculators, Isaac Sasson
28 th Law of Computing:
Anything that can go wr#
Segmentation violation -- Core dumped
|
|
|
|
|
|
Nish [BusterBoy] wrote:
CEO and CIO of Symantec Corporation!
Gosh, I do lead a sheltered life.
Regardz
Colin J Davies
Sonork ID 100.9197:Colin
Most people should stick to calculators, Isaac Sasson
28 th Law of Computing:
Anything that can go wr#
Segmentation violation -- Core dumped
|
|
|
|
|
|
Hey Colin,
I'll be on the road (well, in the air) all day tomorrow and will try to work a fix but no promises that I'll get a chance.
cheers,
Chris Maunder
|
|
|
|
|
|
Nish [BusterBoy] wrote:
Sounds like heaven to me...
Believe me, it isn't Nish.
The glamour of travel soon wears off, especially if is the same flight, same destination every time. Flying is not some exotic adventure, it is more some exotic torture
Nish [BusterBoy] wrote:
coding in an aeroplane.
Everytime you hit turbelence they ask you to shut down any electronic equipment. On take off and landing you also cannot use it. During meals you have no space, and the rest of the time your neigbour is complaining about the monitor glare or your elbows sticking out while typing.
So in short, it sounds fun but it isn't
regards,
Paul Watson
Bluegrass
Cape Town, South Africa
"The greatest thing you will ever learn is to love, and be loved in return" - Moulin Rouge
Sonork ID: 100.9903 Stormfront
|
|
|
|
|
|
My country doesn´t apper in demographics...
Mauricio Ritter - Brazil
Sonorking now: 100.13560 Trank
|
|
|
|
|
Mauricio Ritter wrote:
My country doesn´t apper in demographics...
Wow! You mean Brazil is actually a separate country?
I thought it was the club you played football for
Nish
p.s. Mauritio, this was a joke
p.s. to p.s. and I made the joke cause I trust you'd understand me
p.s to end all p.s.'s These p.s's are for other brazilians who may not know me well enough to appreciate my amazing joking capabilities
My most recent CP article :-
A newbie's elementary guide to spawning processes
www.busterboy.org
|
|
|
|