i am in no way against full disclosure of conventional vulnerabilities - the fact that *some* viruses and worms have dependencies on specific vulnerabilities is a non-sequitur... it's entirely possible (and happens in practice) to follow full disclosure for the vulnerability without disclosing the worm or virus...

full disclosure of vulnerabilities is not in any way comparable to full disclosure of viruses... i've argued this fact so many times that i now just point people here:

http://anti-virus-rants.blogspot.com/2004/12/viruses-and-disclosure.html

that you think viruses and vulnerabilities are so linked points to a deeper misunderstanding of the virus field on your part... a state which cannot be blamed on a lack of available information (http://members.tripod.com/~k_wismer/papers.htm)...

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/11379/33306#33306