On Sat, 14 Jul 2007, Dragos Ruiu wrote:
On Tuesday 10 July 2007 08:53, Gadi Evron wrote:To paraphrase Guninski, this is still not a 0day. It is a vulnerability being disclosed.You're being pedantic Gadi. :-) We have to accept the term "0day" has passed into the realm of meaningless nebulousness along with "hacker" and other misused terms. If we are to be pedantic, the original meaning of 0day is new warez release :-).
I think there is still hope for us buddy, at least when professionals make releases. For example, instead of saying I'm being pedantic on this (which I am), you could (also, in addition) reply and say "yep" or "nope", thus contributing to some discussion. Meaning, we would either make a stand for our profession or at the very least get educated as we go along.
Some people believe the way to reach a "mature industry" is time, others believe it's training or in a more specific fashion, certifications. I don't know what the answer is, and I am sure it isn't terminology (or certifications, hehe).
I do know though, what a 0day is, and don't intend to compromise it for the sake of what the press makes of it. It's a strong term and concept which shouldn't be abused. That or we can decide on a new term for what 0day used to mean. How about "blubla"?
From professionals, we can expect good language and for their work tospeak for them. We shouldn't compromise on silly things like what 0day means.
Maybe I will give this up next year, but for now, advisories named "0day" have disapeared lately. Maybe peer pressure does have some effect.
The above is over-thinking and some could consider it very silly, but for now, I believe in it. It's just like I resent those among consultants who conduct themselves in a fashion that makes me ashamed of my profession, as a far-off analogy.
cheers, --dr -- World Security Pros. Cutting Edge Training, Tools, and Techniques Tokyo, Japan November 29/30 - 2007 http://pacsec.jp pgpkey http://dragos.com/ kyxpgp