5 ms·
It is. Both Thomas Ptacek and Dino Dai Zovi say they were wrong in thinking it was not a big thing. Read this: http://blog.trailofbits.com/2008/07/09/dan-kamin
by nickb 18y ago
It is. Both Thomas Ptacek and Dino Dai Zovi say they were wrong in thinking it was not a big thing. Read this:
http://blog.trailofbits.com/2008/07/09/dan-kaminsky-disqualified-from-most-overhyped-bug-pwnie/ http://blog.trailofbits.com/2008/07/09/dan-kaminsky-disquali...
http://www.matasano.com/log/1093/patch-your-non-djbdns-server-now-dan-was-right-i-was-wrong/ http://www.matasano.com/log/1093/patch-your-non-djbdns-serve...
- cperciva 18y agoBoth Thomas Ptacek and Dino Dai Zovi say they were wrong in thinking it was not a big thing. Yes, I know. I was part of the pre-notified group. To clarify: Ptacek and Dai Zovi were wrong in thinking that this attack is not a big thing, and changed their mind when they heard more details. Having those details, I agree that this is big -- just not as big as Kaminsky is making it sound.
- nickb 18y agoBut were you told the details and you still think it's no big deal?
- cperciva 18y agoYes, I was told the details. I don't think it's "no big deal" -- I think it's not as big of a deal as Kaminsky makes it sound.
- tptacek 18y agoThis is a DNS forgery attack that, among other problems, works as effectively as a drive-by XSS. The patch for many organizations involves network rearchitecture. How many firewall rules had to change last time OpenSSH gave up remote code execution? Is it the worst vulnerability ever? No. But your counterexamples are egregiously off.