Re: What is the point here?
On Sun, 18 Jan 2004, Alun Jones wrote:
> I'd like to think that Bugtraq positions itself as something more than a
> semi-sneaky, behind-the-back-of-the-vendors rant group, or an assembly point
> for root-kit starters. Moderators, please stop accepting posts where the
> poster has stated specifically that they have not yet notified the vendor,
The problem with this, of course, is that the security hole
exists, but the whitehats (ie. us) haven't been generally notified. I
agree that in a perfect world, everyone should notify the vendor first.
But a lot of people, if they got knocked back, and told to follow proper
procedure, would just say "Ah well, I don't have time for that". My
understanding of Bugtraq is that it is to provide timely information on
potential problems, and allow workarounds (ie. turn off javascript, or
whatever it happens to be).
> or where the only new thing that is contributed is a more insidious version
> of an existing exploit. And posters, please consider carefully before you
I agree on this one -- if an exploit only functions under some
circumstances (OS specific is a good example), then making it function
under a wider range of circumstances is good because it allows people to
see that they're vulnerable where they might've thought otherwise. But
posting an exploit that drops a root shell -- well, I wonder whether these
shouldn't be rejected even if they are the first POC -- it shouldn't be
too hard for the POC writer to change their code so that it doesn't.
> post whether what you post is going to contribute to an increase in security
> or a decrease in security. If you cannot claim that your post will help to
> improve security, then do us a favour and take it somewhere else.
I agree, although I think I'd phrase that as "enable the whitehats
to deal with their security situation better".
Thanks,
--
Tim Nelson
Systems Administrator
Sunet Internet
Tel: +61 3 5241 1155
Fax: +61 3 5241 6187
Web: http://www.sunet.com.au/
Email: sysadmin@xxxxxxxxxxxx