RE: [Full-Disclosure] A funny (but real) story for XMAS

["Schmehl, Paul L" <pauls@utdallas.edu>]

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com 
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Cael Abal
> Sent: Tuesday, December 16, 2003 7:58 AM
> To: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] A funny (but real) story for XMAS
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> |> "Join www.osvdb.org to make a better non-corporated vulnerability 
> |> database since CERT sucks ! "
> |
> | CERT sucks? Humm... In my UNIX & Security college course, 
> we're being 
> | told CERT is a great resource for security-related information. Can 
> | anybody else make a comment on this? Agree? Disagree?
> 
> Hi Chris,
> 
> Depends on which side of the fence you're on.  CERT has been 
> criticized in the past for being frugal with vulnerability 
> information.  They don't publish exploits, for one, which 
> means k1ddi3z prefer FD.  :)

For "real" security people, CERT is simply waaaayyyy too slow releasing
information.  By the time they publish vulnerabilities, they've been
thoroughly discussed on the security lists.

They're fine for research papers for class.  :-)

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html