3 ms·

Sorry about the lack of data, here it's: https://docs.google.com/a/mavitunasecurity.com/spreadsheet/ccc?key=0Ai3Dfx3aMZQ9dEJiemw0UE9TS0tUemdldVNTWG5MR2c https:

Sorry about the lack of data, here it's: https://docs.google.com/a/mavitunasecurity.com/spreadsheet/ccc?key=0Ai3Dfx3aMZQ9dEJiemw0UE9TS0tUemdldVNTWG5MR2c https://docs.google.com/a/mavitunasecurity.com/spreadsheet/c... Sure we added infographic to get more traffic and marketing purposes, not because it's fun to create infographics. FYI, it's not really easy to install and scan 235 OSS applications then get in touch with vendors to reports those issues in details, so it's not really just cheap marketing trick. AFAIK no one has produced this kind big statistical report on security of OSS applications before, there are reports from Whitehat - https://www.whitehatsec.com/resource/stats.html https://www.whitehatsec.com/resource/stats.html but mostly on commercial applications.

ambiate 13y ago
Now you've transitioned me from skeptic to potential client. Yet, my reasons are for evil purposes. Could I not feed countless lists of websites to the Professional version? I believe I see support for proxy(ies). In turn, could I not sell these lists of vulnerable sites to some market? Understand, my position comes as a product of prior environments. This is basically a script kiddie's paradise. Could I use Google tricks to find lists of sites that use all of the softwares mentioned in your spreadsheet, set out a list of 500 proxies to do my bidding, and reap the black-hat rewards? I could be a good guy, find the vulnerable sites, and use the list to WHOIS every domain and email the owners with Perl/Python. If you give me a product that can brute force my bitcoin wallet password, but for an extra $1000, I can brute force unlimited bitcoin wallets, you attract a certain breed.
- mentat 13y ago
  There are people who can write this stuff from scratch. Some of those people have "evil purposes". Do you propose making all the information secret? It still won't change things. Check out Metasploit, that improves the overall state of security because the good guys can do more in less time. This may be a similar tool.

ambiate 13y ago

Now you've transitioned me from skeptic to potential client. Yet, my reasons are for evil purposes. Could I not feed countless lists of websites to the Professional version? I believe I see support for proxy(ies). In turn, could I not sell these lists of vulnerable sites to some market? Understand, my position comes as a product of prior environments. This is basically a script kiddie's paradise. Could I use Google tricks to find lists of sites that use all of the softwares mentioned in your spreadsheet, set out a list of 500 proxies to do my bidding, and reap the black-hat rewards? I could be a good guy, find the vulnerable sites, and use the list to WHOIS every domain and email the owners with Perl/Python. If you give me a product that can brute force my bitcoin wallet password, but for an extra $1000, I can brute force unlimited bitcoin wallets, you attract a certain breed.

mentat 13y ago
There are people who can write this stuff from scratch. Some of those people have "evil purposes". Do you propose making all the information secret? It still won't change things. Check out Metasploit, that improves the overall state of security because the good guys can do more in less time. This may be a similar tool.