🚀 go-pugleaf

In article <3cmafr$7di@neuro.usc.edu> merlin@neuro.usc.edu (merlin) writes:

   Please stop publishing system penetration aids.  Notify contact
   people in the appropriate vendor organization.  Notify CERT and
   other credible discrete computer security organizations.  But,
   never broadcast enough information to compromise anyone's system.

The reason 8lgm posts this stuff is because CERT refuses to: the holes
are present and known to at least some crackers. Because CERT waits
until the manufacturer posts a fix, or gives them permission as I
understand it, they cannot publish even glaring security holes in
current operating systems. They have effectively throttled themselves,
leaving the mistaken impression that systems are safe because we
haven't seen the holes discussed. In fact, I have heard vendors who
cooperate with CERT (like Sun), accused of having bad security because
we heard about holes, where other vendors (like SCO) had their recent
holes published by 8lgm, demonstrating the fallacy of the approach.
Moreover, 8lgm's policies assure that we as customers know about
these holes and can demand that they be fixed in future releases.

   I know CERT.  I trust their methods and announcements.  I don't
   know 8lgm.  I certainly don't appreciate their public broadcasts.

CERT is not sufficient: they are hog-tied by their agreements with
the vendors. While I question 8lgm's motives, and especially their
behavior when they published root-cracking scripts all over the net,
their current behavior is a responsible exposition of real problems,
and I for one appreciate it.

				Nico Garcia
				raoul@athena.mit.edu