3 ms·
I know we shouldn't rely on security by obscurity but I hope people will stop posting proof of concepts within the first 24 hours of the announcement.
by viseztrance 14y ago
I know we shouldn't rely on security by obscurity but I hope people will stop posting proof of concepts within the first 24 hours of the announcement.
- angersock 14y agoWhat, then we'll have to work for a living? Good thing I hadn't had anything planned this evening. :P
- viseztrance 14y agoI'm not against work. I just realise that my collegue who access to deploy our app is in Japan and won't get up for a few hours. It's just common sense.
- bradleyland 14y agoWhy? The PoC makes it easy to test your apps with tools like Metasploit. The blackhats don't care. They're going to build a sploit anyway, and they're not going to share it so we can use it to test.
- viseztrance 14y agoThere are many smaller targets and this lowers the barrier for script kiddies to an unprecedented level. And it's one thing to detect the exploit and another to actually run it and post it on the web before people have time to patch their installations (talking about hours!).
- bradleyland 14y agoI know this line of reasoning is tempting, but it simply doesn't hold up under scrutiny. Even scriptkiddies know where to get "sploits". The difference is, we won't get those as part of our security tool subscription, so we won't have an easy way to test. There's no hiding when the necessary patches point out exactly where the vulnerability is. Your only choice is to patch immediately. Lamenting the availability of PoC tools for whitehats isn't going to reduce your chances of being hit by a blackhat one iota.
- px43 14y agoIf there were no PoC, significantly fewer would patch, and even those that did patch would have a hard time verifying that their patch worked.