Re: [Full-disclosure] SECNICHE : Dwelling Security is On the Run

[Michal Zalewski <lcamtuf@xxxxxxxxxxxx>]

On Tue, 12 Jun 2007 dcdave@xxxxxxx wrote:

> In an admittedly brief review of this page, I saw nothing useful or
> informative to my career in information assurance.

Aditya has a history of using security mailing lists to advertise
his various security consulting projects (metaeye.org, etc) under the
guise of fairly bogus whitepapers and vulnerability reports:

http://portal.spidynamics.com/blogs/jeff/archive/2007/04/16/ASP.NET-encoding-shortcomings-_2800_review-of-MetaEye-analysis_2900_.aspx
http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00079.html
http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00115.html

As a rule, these claim to discuss cutting-edge attack techniques whilist
in fact describing something remarkably mundane (register_globals as
"Global Space Exploitation", form-based XSS as "Double Trap Attacks").

I would advise WEBSECURITY moderators to exercise... well, moderation in
approving his non-advisory posts:

http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00010.html
http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00019.html

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/