Re: [Full-disclosure] Publishing exploit code - what is it good for

["Raghu Chinthoju" <raghu.chinthoju@xxxxxxxxxxxxxx>]

Though my experience doesn?t dig in miles deep, in my humble opinion, I think 
it has evolved this way; the present state is the eventuality of the series of 
debates, discussions etc like this ones, which led us into full disclosure. To 
prove in support of full disclosure, lets assume there is no full disclosure. 
Every one lets the world know about the existence of the vulnerability and no 
one would disclose how the vulnerability is exploited (expect to the product 
vendor, ofcource). Then what? Do you think there would be so much importance 
given to the vulnerability fixing as we see it today? Do you think it would be 
this easy (I know some would disagree, if you do so, please read this from the 
beginig again ;) for us to convenience the vendors about the seriousness of the 
vulnerability? Would there be so much advancement and knowledge in this field? 
I think not! And then, the persistence of people who desired secure computing 
led to full disclosure. And this is why we need full disclosure!

I agree with your 'security analysts' that many security administrators and so 
many others who hooked on to Internet need not have access to the exploits, but 
then, this is one the vital vectors that led to full disclosure.

Raghu

On 6/30/05, Aviram Jenik <aviram@xxxxxxxxxxxxxxxxxx> wrote:
> Hi,
> 
> I recently had a discussion about the concept of full disclosure 
[...]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/