🚀 go-pugleaf

In article <BORUD.94Dec1133525@istind.dsl.unit.no> borud@dsl.unit.no (Bj�rn Borud) writes:

   What about a mailing list where they distribute disclosures encrypted
   by PGP (encrypted with the public key of the individual subscribers) ?
   A mailing list composed by having your company officials verify who
   you are, so not just anybody can join. Also; have people subscribe to
   advisories on individual platforms so that you don't have to mail
   EVERYTHING to EVERYBODY.

Hmm. I do appreciate that 8lgm has taken the hint and stopped posting
the blatant exploitation scripts. Last time they did that, I called
several commercial providers I know the sys-admins of, cracked root,
and called the sys-admins to explain the urgency of fixing the holes.
They really did invite people to break in immediately, while us
sys-admins have to examine the fixes and preferably do backups before
altering our systems. This was especially bad when they posted over
the weekend, when many sys-admins were home with their families and
many hackers were up late because they couldn't get a date....

However, by posting the holes very publicly, they have encouraged
people to keep up to date and fix the holes *now*, and told *all* of
us about it so we realize it needs to be fixed. While security through
obscurity is bad, so is hackery through obscurity: it's important to
publicize that people know and use these holes. And it beats the hell
out of wading through phrack to find the subtle holes some folks
mention and the fix for your system. 8lgm is being better than CERT in
this sense as well: they publicize dangerous holes that vendors could
otherwise ignore, leaving us dangerously vulnerable.

				Nico Garcia
				raoul@athena.mit.edu