People shouldn't be allowed to be innovative and original.
It forces people to have to think too much, and you know how bad that is.
That javascript based ouse gestures thing for example, that was a terrible idea.
Using CSS to make things autoexpand move when you mouse over them... terrible idea.
Flash animations and games... oh.. um... i forgot if I was trying to be sarcastic or not... um... yeah.. ah.
* zen goes back to what he was doing before he posted this.
> Sorry, I don't consider publishing the personal, home contact information for public > figures to be an essential liberty.
Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
Of course it's not really going against the free speech/free press part, because there should be restrictions on freedom of speech: nobody involved in passing the amendment could possibly have considered free speech might be used to protest the behaviour of the current government in ways that could otherwise be repressed, could they?
I propose a new amendment to amend the 1st one so it makes CLEAR that freedom of speech is designed to be used in protest against the government in such a way.
Isn't the point of communication to get the point of the communication across?
When writing for a broad audience, you should write as clearly as possible.
Writing clearly means the readers will be less likely to misunderstand you. It also makes it less likely you will make a mistake, and not get your point across.
What the indexes in the article refer to are 'readablity indexes'. The lower the score, the more likely you are to be understood. A low is a good score.
Why?
The longer the average sentence is, the higher the index will be.
The longer the average word is, the higher the index will be.
Using shorter sentences and shorter words lowers the index.
A lower index means more people can understand you.
Someone who can communicate ideas effectively is more likely to get a low score on the indexes in the test. Try analysing a newspaper. The NYT has a Fog Index of 12 (according to a quick google), which is about the level of someone who has finished high school. Anything above about 12 severely limits your audience.
I had taken the term 'duplicates' to mean 'substantially similar', based on the patent mentioning some things about non-important differences.
On re-reading the patent, I noticed that it only mentioned the ignoring the headers.
I guess I was influenced by other outside information in assuming that it would do this.
What i find though to be the interesting part of the patent is the part that would've prevented me from recieving multiple copies. This might save my 'delete' key some wear.;]
(Ok.. I know that what it would really mean is I would get the same amount of spam, but with different content/subjects... but well, I can hope, eh?)
Could you point to the actual claim they make in the patent that has prior art?
The part that seems to be unique is the checking that you are not sending the same message to an email adress that is substantially the same, from what I see.
If you could show some actual prior art, showing how it matches point for point with one of their claims, then maybe you might be on to something.
I'm not ruling out the possiblity of it, but you haven't justified what you claim is prior art actually being related to the patent.
Based soley on your original message, where you only mentioned "random letters or dictionary words", a method that was not mentioned at all in the patent, it appeared that you hadn't read much more than the abstract, and appeared merely to be extrapolating what the rest contained purely on that.
I hope that you noticed that I said 'If you are too lazy..." not "You are too lazy...".
There is, in my mind at least, a large difference between adding "random letters or dictionary words" to break hashes, and using semantically similar but syntactally different paragraphs.
It appears that you think differently.
It is relatively easy to make filters that will ignore 'non-words', which make the random character method less effective, and the method of adding random words to messages would likely detract from the convincingness/power of a message being sent.
The trick of using html comments to hide these hash-busting words/characters is also easy enough to detect.
It would be more complicated to work out that a properly formed, completely valid looking message, with no strange words and no strange comments at all was spam. Having recognizable 'hash busting' sequences would tend to be recognizable, whereas this method would tend not to be.
Just because 'any spammer could figure that out for himself' doesn't mean they have.
Based on the contents of my inbox it seems that none of the spammers about have realized that. Most messages I get arrive in pairs.
Could you show me some of the obvious prior art with respect to this?
I don't mean the 'hash-busting' part, I mean the combination of any one of the claims in the patent?
I'm not meaning to say that you are lying, but do seem to be using the 'Everybody knows it is true' proof.
If it was 'obvious' it would seem that the duplicate filtering method of spam detection wouldn't work even now, woudln't it?
I may be wrong, but if I am, I would like evidence.
If you read the patent, you'll see it has nothing to do with "random letters or dictionary words"
to break hashing detectors.
If you are too lazy to read the entire patent, and insist on only reading a small part, how about also reading what the claims section says instead of just the abstract?
Sometimes, you know, patents are allowed that don't actually have prior art, or at least aren't as obvious as the abstract makes them sound.
The actual patent is here, and if you push 'page down' once or twice you will see (assuming you can actually be bothered) what they are actually claiming.
Thus, Anti-spam techniques based on the various forms of duplicate detection are useful only as long as spammers don't use the list-splitting countercountermeasure, because the LS-spammer has a powerful advantage in the arms race. I believe the anti-spam research and development communities should focus attention instead on the techniques that are impervious to list Splitting, such as cryptographic techniques and the email channels approach.
Keeping information secret about methods that could let spammers avoid filters would not prevent someone else from discovering the same techniques, if they haven't already.
Having information publicly about how to circumvent a technology at worst will let these techniques be used slightly earlier than they would've otherwise.
At best, it allows some people to start thinking about how to make counter-counter-counter-filter detectors, or come up with some other strategy
AND sue spamming software makers.
So you know what the "email channels" mentioned in the previous quote are, patent are the 2nd to last paragraph states:
By contrast, the email channels approach (see R. J. Hall; How to avoid unwanted email; Comm. ACM 41(S'), 88-95, March 1998) exploits the simple idea that spammers must know a valid address in order to successfully send email to a user. The user is provided with a transparent way of allocating and deallocating different addresses for use by distinct correspondents. Thus, if a spammer obtains one address for a user and sends a message to it, the user can simply close the channel and all subsequent messages are bounced by the server at the protocol level before the message data are even transferred. Because this approach is not dependent on message content, it is completely impervious to list-splitting.
(No, I'm not going to paste the whole thing in backwards.)
Some mail providers allow you to have multiple aliases for one email address, and to remove any of them when you feel like it. The same (or at least a similar) idea as using an @hotmail or @yahoo account as your non-primary mail, but much simpler to manage your contacts with.
The patent has nothing to do with this method of spam avoidance, except to mention it as not being susceptable to the patented form of counter-filtering. Read the patent. Just thought I'd mention that in case someone didn't RTFA.
It seemed to me when she started complaining about it detecting the wrong IP (not sure why she wanted it to detect the that she hasn't tried the system running on a 'naked cpu' and was instead using VMWare to test it.
Samba 3 still doesn't work for me via Konqueror
or Nautilus (smb-client command line tool kind
of works better), because it insists on
connecting on my VMWare's virtual IP address
of 10.0.0.19 instead of my XP's real 10.0.0.10
IP on my home network (even when I do
"smb://10.0.0.10").
Not mentioning what type of network adapter in vmware she was using, at a guess it could be related to NAT somewhere doing something. (Vague enough?;])
And when she mentioned the non-responsiveness and audio problems that seemed to point to her running it inside VMWare too. Emulating a sound card takes resources, and the documentation with vmware mentions that there can under some situations be problems with the quality.
But earlier she mentioned it detected her graphics card and monitor fine.
This doesn't happen (at least for me) with a GeForce4/something or other, and Generic Plug and Play monitor... something to do with vmware using a virtual card. (maybe she wasn't using vmware?)
Then it says 'There is not a chance that I would use Fedora as my main OS at this point.' Ok... does that mean she installed it on a separate machine to your normal one, or she was using vmware?
My point?
If you are going to write a review of an operating system, it is helpful to give an overview of the hardware you are testing it on, and if you are testing it under VMWare (or in conjunction with VMWare) specify that, along with the configuration you used.
VMWare doesn't (at least with the last version I have seen, so I may be wrong) have any video accelleration support, which, for some strange reason, may make programs seem less responsive...
It can make a huge difference running an OS under it.
ps:
If you are running Windows, hosting a VMWare client OS and have trouble with poor quality multimedia in linux, you might want to consider running the multimedia stuff in the host?
If you are running linux hosting a VMWare client OS and are having trouble with multimedia in linux, why are you trying to do that?! Run it in the host!
VMWare is a useful tool, but if definately wasn't designed for multimedia stuff.
Not everyone can benefit, because of side effects of it's parasitic nature.
The amount of storage this system gives in the text would be total available for ALL users of the system. More users, less avaiable storage.
Parasites can do better when there little competition from other parasites, but if the system get's infested, the host it lives of may die. Or someone may develop a cure.
Either way, after a certain threshold, the more popular any system using this gets, the less useful it would be.
Just some random thoughts I had when I was talking about a similar idea with someone.
F = show file type with final character l = long directory format (detailed) a = even the.files t = sort by time r = reverse the order c = by change date k = block size of 1k... not really useful, but helps me remember the alias to make on a new system.
On FreeBSD, before BSD died(*) I would use ls -Flatrock but the 'o' has a different meaning with the GNU ls (omit group column in long output) than the BSD ls (include the file flags in the long output).
(*) Before the -1 Flamebait, I mean 'Died on my system'. I decided to install RedHat instead though, because as everyone knows: BSD is dying.;P
Here's an idea I had a while ago, (probably around slammer time) but never got around to doing anything about (because I don't admin any networks).
A module for your IDS which, if it detects a machine on your network is infected with something, automatically set your router to NAT that machine so it points to some server which will inform the user they are infected, and gives details on how to disinfect themself, or to contact the helpdesk, or whatever.
In addition to the NATing, the next DHCP request they perform could take them off the local network address space (except for the disinfection message machine) so they won't be spreading their infections locally.
The infoming machine would not just be HTTP, which could return the webpage, but also have SMTP, POP3, IMAP servers, whatever else they could be running, which return an error, which (hopefully) will be displayed by the users application, telling the user what is happening.
Even if the user doesn't receive the error messages, they would most likely notice something is wrong when they can't connect to anything, and even if they don't they are isolated from the internet, and after their dhcp lease expires (assuming it has a reasonable length) they would also be isolated from the internal network.
It sounds similar to the 'Billy goat' idea... I hope it's not too similar, or it might be covered by restrictive software patents.;/
At least one of these is exploitable via a url... I think that was mentioned somewhere in the advisory. (If not, that is what the remote method is, so you know.)
If you get an email with a specially constructed image link in it, or visit a website with that url, you can be remotely exploited... it ignores the firewall because it is you doing the connecting to it. (Can even put every possible address you might have a printer on your LAN into a page, with every possible offset... or at least the most likely ones... too many malformed connections, and your daemon dies... remote denial of service maybe?)
Filtering connections to port 631 in mozilla/netscape would protect you from this, but it would also stop you being able to use the administration via http features of CUPS, which gives you the proverbial choice between dancing elephants and security, it seems.
Overview:
You MUST patch it to be protected. Firewalling also won't protect you from malicious local users getting root, and it won't stop you being hacked by yourself.
> How many people might've come to know about them in that time?
I would estimate that no more that 4 to 6 people had complete access to all of the problems before they were made public.
To the best of my knowlege none of these problems were ever exploited in the wild. (And if they were, as long as people patch their systems, they won't be.)
I found these problems by auditing the source, and not because of any rumors of active exploitation.
Open source software is sometimes considered to be more secure than closed source because you can see the source code.... the same reason other people say that it is less secure.
For being able to see the source code to make any difference at all, someone actually has to look at it, which doesn't appear to happen as often as either side claim does.
All it takes for a piece of software to be insecure is one exploitable problem, whether it is open or closed source.
What helps keep people secure is publicity that there is something wrong.
It's no use there being patches made available if nobody knows there was a problem... this article has probably done more for getting peoples boxes patched than all the security lists combined.
Anonymous Coward complained that it was a month between the holes being discovered and the patch being released... check out the problem's I found with the posterboy of open source in business, Netscape/Mozilla... 4 months to get some of them fixed... and when they released a buggy version and patched it 2 days later (or something like that) people actually CONGRATULATED THEM!!! Publicity over the bugs in Mozilla/Netscape was minimal to say the least...
Look at Code Red. Publicity caused that to be much less of a problem than it could've been.
The more exploits the 'bad guys' have, the more likely those exploits will be patched.
Having an exploit for a vulnerability that is patched on 99% of boxes is pretty much useless... distributing an exploit with your advisory isn't 'a neccessary evil', it's a bloody good idea.
A complete working script kiddie friendly exploit for every hole that is found should be given away, free of charge. Let the holes that people don't patch get exploited. If you know that within a day of a security advisory being released there will be an easy to use way for anyone in the world to use it against you, are you going to let your guard down?
Comment Submitted. There will be a delay before the comment becomes part of the static page. What you submitted appears below. If there is a mistake...well, you should have used the 'Preview' button!
Oops. HTML is hard.
If you read the script properly, you'll see it does trojan the binaries built from it.
"The (relevant) gencode.c diff:" part shows how it filters out the port used by the trojan.
Slashdot Mirror
People shouldn't be allowed to be innovative and original.
It forces people to have to think too much, and you know how bad that is. That javascript based ouse gestures thing for example, that was a terrible idea.
Using CSS to make things autoexpand move when you mouse over them... terrible idea.
Flash animations and games... oh.. um... i forgot if I was trying to be sarcastic or not... um... yeah.. ah.
* zen goes back to what he was doing before he posted this.
> Sorry, I don't consider publishing the personal, home contact information for public
> figures to be an essential liberty.
Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.
Of course it's not really going against the free speech/free press part, because there should be restrictions on freedom of speech: nobody involved in passing the amendment could possibly have considered free speech might be used to protest the behaviour of the current government in ways that could otherwise be repressed, could they?
I propose a new amendment to amend the 1st one so it makes CLEAR that freedom of speech is designed to be used in protest against the government in such a way.
Who's with me? Anyone? Anyone? Anyone at all?
400 Bad Request
Bad Request. Bad! Go sit in the corner. Go on. Corner! Sit!
("400" errors are invalid request errors. See RFC2616)br>
409 Conflicting Request
An attack is a form of conflict...
412 Precondition Failed
There are conditions of use for Google. One says something to the effect of:
"You can't use automated request things which make an excessive number of requests."
A precondition of using this service is YOU ARE NOT A WORM.
There could, however, be a new one... br>
411 Problem exists between keyboard and chair
Catch all for human caused errors.
Ok... so it's not exactly accurate use for these codes, but close enough?
Isn't the point of communication to get the point of the communication across?
When writing for a broad audience, you should write as clearly as possible.
Writing clearly means the readers will be less likely to misunderstand you. It also makes it less likely you will make a mistake, and not get your point across.
What the indexes in the article refer to are 'readablity indexes'. The lower the score, the more likely you are to be understood. A low is a good score.
Why?
The longer the average sentence is, the higher the index will be.
The longer the average word is, the higher the index will be.
Using shorter sentences and shorter words lowers the index.
A lower index means more people can understand you.
Someone who can communicate ideas effectively is more likely to get a low score on the indexes in the test. Try analysing a newspaper. The NYT has a Fog Index of 12 (according to a quick google), which is about the level of someone who has finished high school. Anything above about 12 severely limits your audience.
Hope that this was clear enough for everyone.
We're talking about different things then.
I had taken the term 'duplicates' to mean 'substantially similar', based on the patent mentioning some things about non-important differences.
On re-reading the patent, I noticed that it only mentioned the ignoring the headers.
I guess I was influenced by other outside information in assuming that it would do this.
What i find though to be the interesting part of the patent is the part that would've prevented me from recieving multiple copies. This might save my 'delete' key some wear. ;]
(Ok.. I know that what it would really mean is I would get the same amount of spam, but with different content/subjects... but well, I can hope, eh?)
Just checked my email...
+ 59 Nov 16 Vanessa (1592) Unreal Penetrat1ons
+ 60 Nov 16 Vanessa (1558) Unreal Penetrat1ons
+ 61 Nov 16 Vanessa (1575) Unreal Penetrat1ons
And only differences are the "hash busting" parts.
No effort at all to make the message _substantially_ different at all.
Oh ja, and the badly spoofed Z-Mailer: part.
Strange though that they don't do the 'obvious' duplicate filtering...
The part that seems to be unique is the checking that you are not sending the same message to an email adress that is substantially the same, from what I see.
If you could show some actual prior art, showing how it matches point for point with one of their claims, then maybe you might be on to something.
I'm not ruling out the possiblity of it, but you haven't justified what you claim is prior art actually being related to the patent.
I hope that you noticed that I said 'If you are too lazy..." not "You are too lazy...". There is, in my mind at least, a large difference between adding "random letters or dictionary words" to break hashes, and using semantically similar but syntactally different paragraphs.
It appears that you think differently.
It is relatively easy to make filters that will ignore 'non-words', which make the random character method less effective, and the method of adding random words to messages would likely detract from the convincingness/power of a message being sent.
The trick of using html comments to hide these hash-busting words/characters is also easy enough to detect.
It would be more complicated to work out that a properly formed, completely valid looking message, with no strange words and no strange comments at all was spam. Having recognizable 'hash busting' sequences would tend to be recognizable, whereas this method would tend not to be.
Just because 'any spammer could figure that out for himself' doesn't mean they have.
Based on the contents of my inbox it seems that none of the spammers about have realized that. Most messages I get arrive in pairs.
Could you show me some of the obvious prior art with respect to this?
I don't mean the 'hash-busting' part, I mean the combination of any one of the claims in the patent?
I'm not meaning to say that you are lying, but do seem to be using the 'Everybody knows it is true' proof.
If it was 'obvious' it would seem that the duplicate filtering method of spam detection wouldn't work even now, woudln't it?
I may be wrong, but if I am, I would like evidence.
If you are too lazy to read the entire patent, and insist on only reading a small part, how about also reading what the claims section says instead of just the abstract?
Sometimes, you know, patents are allowed that don't actually have prior art, or at least aren't as obvious as the abstract makes them sound.
The actual patent is here, and if you push 'page down' once or twice you will see (assuming you can actually be bothered) what they are actually claiming.
From the final paragraph, before the appendices:
Keeping information secret about methods that could let spammers avoid filters would not prevent someone else from discovering the same techniques, if they haven't already.
Having information publicly about how to circumvent a technology at worst will let these techniques be used slightly earlier than they would've otherwise.
At best, it allows some people to start thinking about how to make counter-counter-counter-filter detectors, or come up with some other strategy AND sue spamming software makers.
So you know what the "email channels" mentioned in the previous quote are, patent are the 2nd to last paragraph states:
(No, I'm not going to paste the whole thing in backwards.)Some mail providers allow you to have multiple aliases for one email address, and to remove any of them when you feel like it. The same (or at least a similar) idea as using an @hotmail or @yahoo account as your non-primary mail, but much simpler to manage your contacts with.
The patent has nothing to do with this method of spam avoidance, except to mention it as not being susceptable to the patented form of counter-filtering. Read the patent. Just thought I'd mention that in case someone didn't RTFA.
It seemed to me when she started complaining about it detecting the wrong IP (not sure why she wanted it to detect the that she hasn't tried the system running on a 'naked cpu' and was instead using VMWare to test it.
;])
Samba 3 still doesn't work for me via Konqueror
or Nautilus (smb-client command line tool kind
of works better), because it insists on
connecting on my VMWare's virtual IP address
of 10.0.0.19 instead of my XP's real 10.0.0.10
IP on my home network (even when I do
"smb://10.0.0.10").
Not mentioning what type of network adapter in vmware she was using, at a guess it could be related to NAT somewhere doing something. (Vague enough?
And when she mentioned the non-responsiveness and audio problems that seemed to point to her running it inside VMWare too. Emulating a sound card takes resources, and the documentation with vmware mentions that there can under some situations be problems with the quality.
But earlier she mentioned it detected her graphics card and monitor fine.
This doesn't happen (at least for me) with a GeForce4/something or other, and Generic Plug and Play monitor... something to do with vmware using a virtual card. (maybe she wasn't using vmware?)
Then it says 'There is not a chance that I would use Fedora as my main OS at this point.' Ok... does that mean she installed it on a separate machine to your normal one, or she was using vmware?
My point?
If you are going to write a review of an operating system, it is helpful to give an overview of the hardware you are testing it on, and if you are testing it under VMWare (or in conjunction with VMWare) specify that, along with the configuration you used.
VMWare doesn't (at least with the last version I have seen, so I may be wrong) have any video accelleration support, which, for some strange reason, may make programs seem less responsive...
It can make a huge difference running an OS under it.
ps:
If you are running Windows, hosting a VMWare client OS and have trouble with poor quality multimedia in linux, you might want to consider running the multimedia stuff in the host?
If you are running linux hosting a VMWare client OS and are having trouble with multimedia in linux, why are you trying to do that?! Run it in the host!
VMWare is a useful tool, but if definately wasn't designed for multimedia stuff.
Not everyone can benefit, because of side effects of it's parasitic nature.
The amount of storage this system gives in the text would be total available for ALL users of the system. More users, less avaiable storage.
Parasites can do better when there little competition from other parasites, but if the system get's infested, the host it lives of may die. Or someone may develop a cure.
Either way, after a certain threshold, the more popular any system using this gets, the less useful it would be.
Just some random thoughts I had when I was talking about a similar idea with someone.
I personally use ls -Flatrck
.files
;P
F = show file type with final character
l = long directory format (detailed)
a = even the
t = sort by time
r = reverse the order
c = by change date
k = block size of 1k... not really useful, but helps me remember the alias to make on a new system.
On FreeBSD, before BSD died(*) I would use ls -Flatrock but the 'o' has a different meaning with the GNU ls (omit group column in long output) than the BSD ls (include the file flags in the long output).
(*) Before the -1 Flamebait, I mean 'Died on my system'. I decided to install RedHat instead though, because as everyone knows: BSD is dying.
Here's an idea I had a while ago, (probably around slammer time) but never got around to doing anything about (because I don't admin any networks).
;/
A module for your IDS which, if it detects a machine on your network is infected with something, automatically set your router to NAT that machine so it points to some server which will inform the user they are infected, and gives details on how to disinfect themself, or to contact the helpdesk, or whatever.
In addition to the NATing, the next DHCP request they perform could take them off the local network address space (except for the disinfection message machine) so they won't be spreading their infections locally.
The infoming machine would not just be HTTP, which could return the webpage, but also have SMTP, POP3, IMAP servers, whatever else they could be running, which return an error, which (hopefully) will be displayed by the users application, telling the user what is happening.
Even if the user doesn't receive the error messages, they would most likely notice something is wrong when they can't connect to anything, and even if they don't they are isolated from the internet, and after their dhcp lease expires (assuming it has a reasonable length) they would also be isolated from the internal network.
It sounds similar to the 'Billy goat' idea... I hope it's not too similar, or it might be covered by restrictive software patents.
Massey University == massey.ac.NZ
:P
not massey.edu.au
NEW ZEALAND
like WETA DIGITAL
OMG!
You mixed up Canadians!!
At least one of these is exploitable via a url... I think that was mentioned somewhere in the advisory. (If not, that is what the remote method is, so you know.)
If you get an email with a specially constructed image link in it, or visit a website with that url, you can be remotely exploited... it ignores the firewall because it is you doing the connecting to it. (Can even put every possible address you might have a printer on your LAN into a page, with every possible offset... or at least the most likely ones... too many malformed connections, and your daemon dies... remote denial of service maybe?)
Filtering connections to port 631 in mozilla/netscape would protect you from this, but it would also stop you being able to use the administration via http features of CUPS, which gives you the proverbial choice between dancing elephants and security, it seems.
Overview:
You MUST patch it to be protected. Firewalling also won't protect you from malicious local users getting root, and it won't stop you being hacked by yourself.
> How many people might've come to know about them in that time?
I would estimate that no more that 4 to 6 people had complete access to all of the problems before they were made public.
To the best of my knowlege none of these problems were ever exploited in the wild. (And if they were, as long as people patch their systems, they won't be.)
I found these problems by auditing the source, and not because of any rumors of active exploitation.
Open source software is sometimes considered to be more secure than closed source because you can see the source code.... the same reason other people say that it is less secure.
For being able to see the source code to make any difference at all, someone actually has to look at it, which doesn't appear to happen as often as either side claim does.
All it takes for a piece of software to be insecure is one exploitable problem, whether it is open or closed source.
What helps keep people secure is publicity that there is something wrong.
It's no use there being patches made available if nobody knows there was a problem... this article has probably done more for getting peoples boxes patched than all the security lists combined.
Anonymous Coward complained that it was a month between the holes being discovered and the patch being released... check out the problem's I found with the posterboy of open source in business, Netscape/Mozilla... 4 months to get some of them fixed... and when they released a buggy version and patched it 2 days later (or something like that) people actually CONGRATULATED THEM!!! Publicity over the bugs in Mozilla/Netscape was minimal to say the least...
Look at Code Red. Publicity caused that to be much less of a problem than it could've been.
The more exploits the 'bad guys' have, the more likely those exploits will be patched.
Having an exploit for a vulnerability that is patched on 99% of boxes is pretty much useless... distributing an exploit with your advisory isn't 'a neccessary evil', it's a bloody good idea.
A complete working script kiddie friendly exploit for every hole that is found should be given away, free of charge. Let the holes that people don't patch get exploited. If you know that within a day of a security advisory being released there will be an easy to use way for anyone in the world to use it against you, are you going to let your guard down?
-- zen-parse
They fixed a bug that should've been detected ages before 1.2 was released within a few days, and you CONGRATULATE them?!?!?!?
I have to say that mozilla/netscape are among the WORST developers I have ever worked with getting security bugs fixed.
Unfortunately because security issues tend to happen behind the scenes, people often get the illusion bugs get fixed really fast.
There is a flaw in jar file handling that may allow a user to execute arbitrary commands...
Comment Submitted. There will be a delay before the comment becomes part of the static page. What you submitted appears below. If there is a mistake...well, you should have used the 'Preview' button! Oops. HTML is hard.
If you read the script properly, you'll see it does trojan the binaries built from it. "The (relevant) gencode.c diff:" part shows how it filters out the port used by the trojan.