🚀 go-pugleaf

In article <3bl4u9$rsp@cat.cis.Brown.EDU> md@pstc3.pstc.brown.edu (Michael P. Deignan) writes:
>In article <1994Dec1.022022.25768@cs.brown.edu>,
>	Mike Shapiro <mws@cs.brown.edu> wrote:
>
>>They're 
>>already giving us a lot of information for free as it is, and providing
>>free access to their advisories.  
>
>I fail to understand the significance of this statement. Are you suggesting 
>that because these advisories are posted "free" somehow that means that if we
>"paid" for them we would be entitled to more information?

No.  You're misunderstanding me here -- I don't suggest that we would get more
for paying or even that we should pay.  I'm just saying that the original
poster's suggestion would require all kinds of work which I don't think will
realistically happen.  So my point is just that he was asking for something
as a solution which I don't think would happen realisticalliy.

>
>>A more reasonable suggestion was made
>>to make one post which does not provide exploit details, followed by
>>another post some time later, e.g. a week, which provides full disclosure.
>>That seems to be the most reasonable compromise to me.
>
>To me, its as useless as no post at all. As a system admin, I need to
>understand the substance of a security hole to properly assess the
>risk to my machines. Part of that involves knowing how it is exploited so I can
>put together a response in my environment. Simply doing something like taking
>a machine off the net, or disabling remote logins, may not be possible
>given the circumstances. A temporary "work around" for you may not work for me.
>
>Simply saying there is a bug in "login" that allows you to get root access
>is next to useless. Using the "login" command I can gain root access to ANY
>system I have access to -- all I have to do guess the proper password 
>(half :))
>
>MD

I understand your valid point -- and I _personally_ agree with the full
disclosure argument.  The point of my post was more to propose what I think
is the best _compromise_.  I think we should have full disclosure as soon
as the info is available.  But that obviously angers many who read this
newsgroup -- especially those who post stories of people taking the 8lgm
scripts and breaking into their site before they have read the 8lgm post
and have a chance to take action.  So I suggested the compromise instead.
If I understand you correctly, you don't view this as a compromise
because you think it's basically the same as no post at all.  Do you see
any kind of compromise at all?  What steps do you take if 8lgm decides to
opt for the current system (no exploit details) as their final solution?
Maybe just ask them to either go for full disclosure, or not post anything
at all ? :)

-Mike

-- 
Mike Shapiro Box 6198 Brown Univ. Providence RI 02912 mws@cs.brown.edu