Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Anonymous surfing my ass!
From: full-disclosure () lists netsys com (Charles 'core' Stevenson)
Date: Sun, 14 Jul 2002 12:25:27 -0600

Hasty flames are counterproductive. Let us not be so quick to judge. 
Speaking from personal experience, I would imagine that most people's 
first few advisories are bound to lack clarity/details. Additionally one 
must remember not to hit that reply button instantly after reading a 
post that triggers anger/hostility. I myself am guilty of all the 
aforementioned shortcomings. But hey we're human aren't we?

Nor should a man be in a hurry to publish his advisory the instant his 
proof-of-concept exploit works. Sitting on a bug for a little while will 
afford the time to polish the advisory and/or exploit. The discloser 
must determine the fundamental pieces of information every advisory 
should have and a format which puts the bottom-line-up-front. In this 
fashion the discloser can take pride in knowing, whether the bug was 
trivial to exploit or a work of art, that all of those who read it will 
walk away with a clear understanding of the problem, impact, solution, 
etc.. Take a look at security focus's vuln-help advisory template.


Steve wrote:
You would think that the email sent to the list would have contained
more information.  Based on the email sent, one would might not even
bother clicking on the link.  And for those of us who happen to be
checking email on Windoze boxes, clicking on random Internet links
probably isn't the brightest thing to do from IE unless you have
bothered to disable all the various active scripting etc.......

How seriously would you take an email that simply said "click here

I think if you at least clicked the advisory link ( 

surfing, NOT! ) it would help relieve some of your ignorance. What he's
reffering to is a getting script (usually javascript) through the
filters and executing on the 'anonymous' person's machine. If a site can
do that they can save cookies to the machine, thereby breaking the

It's not really cross site scripting, though the techniques used to get
it through are similar. Right now 'cross site scripting' seems to be the
buzz word attached to any security breach involving scripts. Something
we have to live with I guess. Anyway, whatever it's called SkyLined
seems to be the l33test at it ;)

- Blazde

Full-Disclosure - We believe in it. Full-Disclosure () lists netsys com

Full-Disclosure - We believe in it.
Full-Disclosure () lists netsys com

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]