mailing list archives
Re: Getting Off the Patch
From: "Thor (Hammer of God)" <thor () hammerofgod com>
Date: Wed, 19 Jan 2011 20:01:01 +0000
When the OP can't even support his own idea, it's probably time for this thread to die. However, I thought about what
you said, and it actually serves as an excellent example of why engaging in conversation around this sort of thing is
Cor Rosielle wrote:
I did not know about the OSSTMM in those days. If I did, I could have
explained why patching is not always the best solution: it interferes
with your operations.
And thus lies the core purpose of this sort of "open standard." You would have liked for the OSSTMM to exist back then
NOT because there was value in their approach to security, but because it would give you justification for not doing
what you were already not doing. You made a conscious decision not to patch a Windows 2000 box with IIS5 on it even
though the radio listed off your company name (about that, what, what is Wikileaks Radio or something?). There is
justification now because you say the box never got hacked. Of course, you don't know that, and can never know that.
Pursuant to that, put that box up on the internet in the same configuration it was in and post the IP here. I
guarantee that you'll only need an egg timer, if that.
Since you already had a clear position of not caring about patching, there would be no need for the OSSTMM to exist for
you at all. And as you have stated, if it DID exist, you would have used it purely for justifying your actions. When
a CTO assumes that position and identifies the value of that organization to provide a straw-man standard, that is when
people who have a better understanding of what security is should speak up.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/