🚀 go-pugleaf

In article <3bg70j$78h@zikzak.apana.org.au>,
Zik Saleeba <zik@zikzak.apana.org.au> wrote:
>davidsen@tmr.com (bill davidsen) writes:
>
>>This "security by obscurity" policy is a crock; I've been helping keep
>>business systems secure for over 25 years, and full disclosure has
>>always been best, allowing the system administrators to understand and
>
>Full disclosure by 8lgm once got my machine broken into in the
>nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
>the opportunity to take some defensive action before every weenie was
>given the ability to crack my system.

So maybe it is better to first post the necessary patches, and only make
the exploit script available a day or what later?

And if there isn't a patch available yet just mention that there is a
security problem and that they are waiting for the patch to be released
before the exploit script is made available? oh, right, they did that
already. But I have to agree that the amount of information available
was about zero. Indicating ways to "reasonably" secure the system would've
been nice (if tcp wrappers would help, or if making login non setuid root
would help, as a temporary solution that is).

Also, someone mentioned in this thread that system administrators have to
listen in to all the cracker circles because that is where a lot of
security information is available at an early time. Someone else
mentioned that they wanted to have a life too... something which
crackers obviously don't, given the time needed to actually get at the
info. But I thought that's why I subscribed to 8lgm in the first place?
To act as a substitute for roaming all underground fsp servers and
obscure BBSes for hot info, who happen to change location and number
every week?

I think the 8lgm list can be a bit more informative than it has been
for the recently sent advisories (for example: i really think releaving
the bug in sunos binmail wouldn't harm. Replacements ARE available, just
not from SUN (procmail, mail.local). Oh, do I smell commercialisation here?)

Regards,

-- 
Jan-Pieter Cornet
<cornet@otech.fgg.eur.nl>