Re: Extreme Hacking

[Bennett Todd <bet () newritz mordor net>]

1999-07-09-03:38:02 Brad J Passwaters:
> On Wed, 7 Jul 1999, Darren Reed wrote:
> > Knowing how to break into a system does not provide knowledge in making it
> > secure.
> Knowing that running program A will get you a root shell does not help you
> secure your system.

There's an interesting and important difference between those two statements.

While knowing how to break into a system doesn't tell you how to secure it,
having a test program that can demonstrate a bug is really valuable for
convincing yourself that you've actually fixed it. And being able to
demonstrate how easy a bug is to exploit is often _very_ valuable in
convincing people to commit the resources (possibly in loss of access to
systems, or loss of the convenience of some poorly-designed utility, or
whatever) to address the problem.

-Bennett