> -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Cael Abal > Sent: Tuesday, December 16, 2003 7:58 AM > To: [EMAIL PROTECTED] > Subject: Re: [Full-Disclosure] A funny (but real) story for XMAS > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > |> "Join www.osvdb.org to make a better non-corporated vulnerability > |> database since CERT sucks ! " > | > | CERT sucks? Humm... In my UNIX & Security college course, > we're being > | told CERT is a great resource for security-related information. Can > | anybody else make a comment on this? Agree? Disagree? > > Hi Chris, > > Depends on which side of the fence you're on. CERT has been > criticized in the past for being frugal with vulnerability > information. They don't publish exploits, for one, which > means k1ddi3z prefer FD. :)
For "real" security people, CERT is simply waaaayyyy too slow releasing information. By the time they publish vulnerabilities, they've been thoroughly discussed on the security lists. They're fine for research papers for class. :-) Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
