🚀 go-pugleaf

Ken Gunther (kgunther@delphi.com) wrote:
:    There have been a number of suggestions that the only people allowed on
: the list are those who are identified as the technical contact. Perhaps I'm
: paranoid but I believe that there are governments and commercial
: institutions that have something to gain by sponsoring some crackers. The
: cover of government or commercial enterprise lends legitimacy to these
: crackers making them appear quite trustworthy since they are supported by a
: large organization. 

:    I agree with those that state that full disclosure should only come AFTER
: the patch is available.

At this moment, I would guess that 80-90% of the SCO market is totally
unaware of this problem.  Yes, I said UNaware.

Disclosure will eventually filter out to everyone in the tech support
and hacker community, but I bet even 5 years from now there will be
SCO users who never heard a peep about this.

So those people will remain vulnerable, because they won't be patched.

I see no reason for disclosure.  Why the heck do I need to know how to
exploit this?  Why does anyone?  To check that it's been fixed completely?
Maybe, but it opens up vulnerability for a whole bunch of people.

--
Tony