RE: [stable] Linux 2.6.25.10

david
2008-07-19T01:00:33Z

On Fri, 18 Jul 2008, David Schwartz wrote:

> Greg KH wrote:
>
>> Personally, I omit posting full "and here is explicitly how to exploit
>> this problem" notices as that is foolish.
>
> That means only people with the time, energy, and expertise to create an
> exploit will have an exploit. This includes probably 90% of the people who
> would use the exploit maliciously

haven't you ever heard of script-kiddies? they are by far the majority of
attacks on systems but do not have the expertise to create exploits. it
takes someone else writing the exploit for them and packaging it to make
them a threat.

in the meantime there's a chance for the fix to get propogated out to a
released version and for people to upgrade their systems. providing
exploit code along with the bugfix means that the script kiddies have the
exploit immediatly, but the fix isn't in any released version (not even a
-rc or daily -git snapshot)

> and 100% of the people who pose a real
> thread to the community.

this depends on how you define threat.

> It does, however, ensure that the majority of
> ordinary users won't be able to test their systems to see if they're
> vulnerable or if the vulnerability is fixed. So at least it will have some
> effect.

how many people run exploits against their production systems to 'see if
they are fixed', very few, and those only on strict schedules with lots of
adnvance notice and other safeguards.

David Lang