Date: Sat, 25 Jul 2015 14:18:05 -0700 From: Michal Zalewski <lcamtuf@...edump.cx> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: Qualys Security Advisory - CVE-2015-3245 userhelper - CVE-2015-3246 libuser > Frankly, over the years I have seen pretty few people on the side of the > angels complain that "But *why* didn't you include a weaponized exploit > with your advisory? I feel so cheated!". AFAICT, virtually all the open-source and closed-source security testing tools are dependent on the availability of this information; this certainly includes Nessus, most web security scanners, most AV software, etc. > In these situations, where an exploit for a new local root vulnerability > turned up without prior warning, we typically started seeing root-level > incidents within 24 hours. Have you ever tried to get big organizations, > made up of a zillion independent entities, to apply security patches > within a timescale of hours? Would you choose not to do this in situations where no public exploit is available, and therefore you would be unlikely to see the immediately evident nuisance attacks described in your message? Starting with the premise that the disclosure of security bugs makes computer systems more vulnerable to attacks, would it be preferable to completely discourage sharing vulnerability information with the general public? If not, why? /mz
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.