The whole full-disclosure/"Responsible Disclosure" has been raging on the Win2KSecAdvice mail list (from www.ntsecurity.net) since Monday. A lot of good points have been raised by both sides of the issue.
And while I don't agree wholly with any one side, the point that I agree with in that whole mess that goes against this email (clearly for very restricted disclosure) is this:
I want to know why I'm installing this patch. What does it fix? Do I trust Microsoft to fix it? They broke it in the first place! How do I test my system once the patch is applied to ensure the patch actually fixed anything?
Should I have to pay to be part of some exclusive club that gets to find out how these vulnerabilties work? Sounds like printing money to me...
You can't have your cake and eat it too - either I know how it works or I don't. Giving the information to SysAdmins levels the playing field against the Blackhats. You can bet your @$$ they already know about it.
Slashdot Mirror
Ooohhh... Where the hell did I put my Wardialer...
;)
You remember? In the Olde Dayes, with accustic couplers? War Games anyone?
The whole full-disclosure/"Responsible Disclosure" has been raging on the Win2KSecAdvice mail list (from www.ntsecurity.net) since Monday. A lot of good points have been raised by both sides of the issue.
And while I don't agree wholly with any one side, the point that I agree with in that whole mess that goes against this email (clearly for very restricted disclosure) is this:
I want to know why I'm installing this patch. What does it fix? Do I trust Microsoft to fix it? They broke it in the first place! How do I test my system once the patch is applied to ensure the patch actually fixed anything?
Should I have to pay to be part of some exclusive club that gets to find out how these vulnerabilties work? Sounds like printing money to me...
You can't have your cake and eat it too - either I know how it works or I don't. Giving the information to SysAdmins levels the playing field against the Blackhats. You can bet your @$$ they already know about it.