Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

DJB's contest (repost after being moderated on BGTQ)
From: <support () sabre-security com>
Date: Sat, 25 Dec 2004 08:31:25 -0800

Hey all, DJB,

Is the class on responsible disclosure next semester perhaps?

Responsible disclosure is a euphemism creating by industry lobby groups
like OIS, which never had much support in the security scene in the first 
place.

The reason that the 16 students sent their 91 reports to me privately is
so that they wouldn't have to deal with people like you. It was entirely
my decision to send out these 44 public notices.

If I am allowed to suggest something for a possible re-run of the same 
course:
It would probably be more interesting to set a lower bar on the number of
vulnerabilities but to restrict the focus a bit more -- e.g. asking for 1 
remotely
exploitable bug in a list of widely used software (Bind/OpenSSH/ProFTPd (or 
even QMail :-)
would focus students on larger pieces of software that are a bit more 
critical than
e.g. nasm. This would lead to the students searching for less "standardized" 
problems,
as well.

Then again, it sounds like a really fun course :)

Cheers,
Thomas Dullien 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
  • DJB's contest (repost after being moderated on BGTQ) support (Dec 29)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]