Chris, It is an old debate between full / partial / non-discolsure. Everybody has its own point. Personally I prefer to know there is an exploit and to have it to quickly test/patch (not all patches fixes all exploits). Public exploit will always be better than private exploit in my opinion. You can't compare nuclear weapon to an exploit because you usually can protect yourself from an exploit.
If everybody had nuclear weapon I do not think some countries would have so much influence in the world politics and economics. So if I enter your logic, meaning public exploit=nuclear weapon, I only see the advantage in keeping it secret to make money about it (sell the technology to people not having it) and use it as a threat towards the others (maybe selling security stuff in the pipe to get even richer and keep exclusivity). Unfortunately sometimes, there is no difference between keeping it secret to make a lot of money on it while we still may and security through obscurity Cheers. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of gregh Sent: Sunday, July 27, 2003 5:09 AM To: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] DCOM RPC exploit (dcom.c) ----- Original Message ----- From: Chris Paget <mailto:[EMAIL PROTECTED]> To: Len Rose <mailto:[EMAIL PROTECTED]> Cc: [EMAIL PROTECTED] Sent: Sunday, July 27, 2003 12:08 PM Subject: Re: [Full-Disclosure] DCOM RPC exploit (dcom.c) Len, IMHO there's a difference between "security through obscurity" and posting working exploit code. Knowing that there is a vulnerability in DCOM, accessible over a range of RPC mechanisms (primarily 135/tcp) is all that most administrators need to know. It's one thing knowing that you can kill a person with a gun, and it's another to give away firearms. Just my $0.02: Shoot the messenger - that always stops the bad event happening. Sorry for the sarcasm. I can never see the point in "If we don't tell the enemy how to build a nuclear weapon they never will so we are safer as a result" logic. Greg - you may call me a "Jihad O'Clue." if you wish.
smime.p7s
Description: S/MIME cryptographic signature
