Re: [Full-Disclosure] no more public exploits: just a n00bie view

["RandallM" <randallm@xxxxxxxxxxx>]

Hey,
I have to agree with Borg. I am of course new to your list. I joined it to
learn the "what, when and where" of security. I must say that when I saw
exploits posted I was a bit taken back. My first thought was "Guess I can
expect to see it soon". A question naturally comes; would it show in the
wild had it not been posted. And what percentages of exploits do go in the
wild due to being posted along with the advisory? Then again how can I be
concerned about an advisory if I can't see the effects of the exploit? Of
course, then again, I really have understood little about the code of the
exploit but did a lot on the advisory. Just a n00bie view.

Borg wrote:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
Message: 28
Date: Tue, 27 Apr 2004 13:19:44 -0400
From: chris <chris@xxxxxxxxxxxxx>
To: full-disclosure@xxxxxxxxxxxxxxxx
Subject: Re: [Full-Disclosure] no more public exploits

Heres my two cents :-/

Exploit code is better kept private.
Advisories should be public.

Why?

Because exploit code is not easy to write depending on the bug. And I 
for one sure dont want some 'penetration tester' taking my code and 
plugging it into his automated scanner and collecting the cash. Im far 
to greedy to watch that happen. Sorry.

NON-Disclosure of Exploit code.
Full-Disclosure of Advisories.

As far as the discussion of sysadmins patching on time or not. All I 
will say is this . . .  if they did patch on time there wouldnt be a 
www.zone-h.org.

- borg (ChrisR-)

--__--__--

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
>>>>>>>>>>>>>>>>>>>>
Borg ended.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html