mailing list archives
DJB's contest (repost after being moderated on BGTQ)
From: <support () sabre-security com>
Date: Sat, 25 Dec 2004 08:31:25 -0800
Hey all, DJB,
Is the class on responsible disclosure next semester perhaps?
Responsible disclosure is a euphemism creating by industry lobby groups
like OIS, which never had much support in the security scene in the first
The reason that the 16 students sent their 91 reports to me privately is
so that they wouldn't have to deal with people like you. It was entirely
my decision to send out these 44 public notices.
If I am allowed to suggest something for a possible re-run of the same
It would probably be more interesting to set a lower bar on the number of
vulnerabilities but to restrict the focus a bit more -- e.g. asking for 1
exploitable bug in a list of widely used software (Bind/OpenSSH/ProFTPd (or
even QMail :-)
would focus students on larger pieces of software that are a bit more
e.g. nasm. This would lead to the students searching for less "standardized"
Then again, it sounds like a really fun course :)
Full-Disclosure - We believe in it.
- DJB's contest (repost after being moderated on BGTQ) support (Dec 29)