🚀 go-pugleaf

In article <MGG.94Nov30141142@triada.triad.com> mgg@triada.triad.com writes:
>I think what we need is some cryptography.  8lgm could encrypt the
>exploit script, and then provide the decryption key to verified sysadms.
>The issue of how to verify a sysadms is a big one, but this would enable
>8lgm to continue to provide the necessary advisories, without giving
>the crackers any more advantage than they already have.
>

This is the most ridiculous thing I have heard yet in this debate.  How
would you possibly "verify" sysadmins?  Hackers can break into your system --
they can also pretend to be sysadmins, they can also get a hold of these
supposed keys provided to people.  Not to mention all the work to maintain
this information which would have to be done by the 8lgm folks.  They're 
already giving us a lot of information for free as it is, and providing
free access to their advisories.  A more reasonable suggestion was made
to make one post which does not provide exploit details, followed by
another post some time later, e.g. a week, which provides full disclosure.
That seems to be the most reasonable compromise to me.

-Mike

-- 
Mike Shapiro Box 6198 Brown Univ. Providence RI 02912 mws@cs.brown.edu