AFAICT, the project zero team is about hunting down bugs and disclosing them responsibly.[1] They occasionally do write-ups on the projec...
AFAICT, the project zero team is about hunting down bugs and disclosing them responsibly.[1] They occasionally do write-ups on the project zero blog , after the vuln has gone public, but without actually giving out "kiddies-ready expoits", i.e. exploit source. But even if they did , that still isn't a "questionable practice" - if the full details of the exploit are public, you'd barely need a writeup to connect the dots. > Even if patches were available, it would be far better to wait for most devices to be patched before releasing a full exploit. So, for router exploits (say), that would be Infinity? If the manufacturer doesn't care, or the update ecosystem is broken (or nonexistent), nobody is more secure because someone did a writeup about a vuln that everyone (..interested) knows about. Most exploits, however complex their discovery process may have been, end up as "send these bytes in this order" - they are usually very simple to duplicate once you know where the bodies are buried. [1] As the GP says, 90 days is responsible disclosure.
Posted by yourad_io on Jan 3, 2015, 1:04 AM
Tags
Related issues
- Huh, this is not my experience.
- For some reason an Azure outage does not faze me in the same way that an AWS outage does.
- The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
- Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
- [YouTube] Unable to extract uploader id
- Add ability to prioritize GitHub Action runners
Raise real-world problems, find people facing the same issue, and discuss solutions.9,000 issues0 comments
reliability (E-commerce)
Huh, this is not my experience.
For some reason an Azure outage does not faze me in the same way that an AWS outage does.
The triplet of wind, pole, dragon appears multiple times in the same order, so is possibly a single phrase that has been broken up into t...
Option to skip refreshing resource instances whose configuration hasn't changed since the last apply
[YouTube] Unable to extract uploader id
Add ability to prioritize GitHub Action runners
Microsoft Flight Simulator (2020) (1250410)
Codegen collaboration with Apollo Codegen and GraphQL Code Generator
AFAICT, the project zero team is about hunting down bugs and disclosing them responsibly.[1] They occasionally do write-ups on the projec...
AFAICT, the project zero team is about hunting down bugs and disclosing them responsibly.[1] They occasionally do write-ups on the project zero blog , after the vuln has gone public, but without actually giving out "kiddies-ready expoits", i.e. exploit source. But even if they did , that still isn't a "questionable practice" - if the full details of the exploit are public, you'd barely need a writeup to connect the dots. > Even if patches were available, it would be far better to wait for most devices to be patched before releasing a full exploit. So, for router exploits (say), that would be Infinity? If the manufacturer doesn't care, or the update ecosystem is broken (or nonexistent), nobody is more secure because someone did a writeup about a vuln that everyone (..interested) knows about. Most exploits, however complex their discovery process may have been, end up as "send these bytes in this order" - they are usually very simple to duplicate once you know where the bodies are buried. [1] As the GP says, 90 days is responsible disclosure.
Comments (0)
No comments yet. Start the discussion.