Re: [Full-disclosure] Getting Off the Patch

["Thor (Hammer of God)" <thor@xxxxxxxxxxxxxxx>]

When the OP can't even support his own idea, it's probably time for this thread 
to die.  However, I thought about what you said, and it actually serves as an 
excellent example of why engaging in conversation around this sort of thing is 
important.


>Cor Rosielle wrote:
<snip>
> I did not know about the OSSTMM in those days. If I did, I could have
> explained why patching is not always the best solution: it interferes
> with your operations. 
</snip>

And thus lies the core purpose of this sort of "open standard." You would have 
liked for the OSSTMM to exist back then NOT because there was value in their 
approach to security, but because it would give you justification for not doing 
what you were already not doing.  You made a conscious decision not to patch a 
Windows 2000 box with IIS5 on it even though the radio listed off your company 
name (about that, what, what is Wikileaks Radio or something?).  There is 
justification now because you say the box never got hacked.  Of course, you 
don't know that, and can never know that.  Pursuant to that, put that box up on 
the internet in the same configuration it was in and post the IP here.  I 
guarantee that you'll only need an egg timer, if that. 

Since you already had a clear position of not caring about patching, there 
would be no need for the OSSTMM to exist for you at all.  And as you have 
stated, if it DID exist, you would have used it purely for justifying your 
actions.  When a CTO assumes that position and identifies the value of that 
organization to provide a straw-man standard, that is when people who have a 
better understanding of what security is should speak up. 

t



 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/