3 ms·
> The attacker may also be able The infosec community loves their weasel words don't they? The only other career path other than "meteorologist" where they ge
by sugarpimpdorsey 1y ago
> The attacker may also be able
The infosec community loves their weasel words don't they?
The only other career path other than "meteorologist" where they get it wrong half the time with the burden of proof on the recipient, and everyone looks the other way.
Show your work, or it's not possible.
- Sohcahtoa82 1y agoThis is the wrong attitude to have. There are cases where vulnerable code is found, but it may take weeks of tinkering to actually build an exploit that gets arbitrary RCE. An example could be a buffer overflow that only allows a few bytes to be written. At first, you're likely just causing segmentation faults. DEP and ASLR will make writing an exploit that gives RCE difficult. This is when an attacker "may" be able to do something, if there's an attacker determined enough to figure out a full exploit. The original researcher might not be interested in spending that time and just wants the vendor to fix it.
- sugarpimpdorsey 1y agoUnfortunately, you can only cry wolf so many times before no one will believe you anymore.