🚀 go-pugleaf

In article <3bi8i2$gvj@gaia.otech.fgg.eur.nl> cornet@OTech.fgg.EUR.nl (Jan-Pieter Cornet) writes:
>In article <3bg70j$78h@zikzak.apana.org.au>,
>Zik Saleeba <zik@zikzak.apana.org.au> wrote:
>>davidsen@tmr.com (bill davidsen) writes:
>>
>>>This "security by obscurity" policy is a crock; I've been helping keep
>>>business systems secure for over 25 years, and full disclosure has
>>>always been best, allowing the system administrators to understand and
>>
>>Full disclosure by 8lgm once got my machine broken into in the
>>nighttime hours before I next read c.s.u.. I'd _far_ prefer to have
>>the opportunity to take some defensive action before every weenie was
>>given the ability to crack my system.
>
>So maybe it is better to first post the necessary patches, and only make
>the exploit script available a day or what later?
[...]

Perhaps a full-disclosure mailing list that only accepts subscriptions from
root@* addresses is in order.  This is far, far from a perfect solution (I 
don't think there is a perfect solution), but it might buy enough time for
interested system administrators to take action.  In general, I'd still rather
see too much information that not enough.

(Followup-to: set to comp.security.unix)

Frank Stuart              | (Admiral Grace) Hopper's Law:
fstuart@vetmed.auburn.edu | It's easier to get forgiveness than permission.