Exploit Code on Trial

Exploit Code on Trial
Kevin Poulsen, SecurityFocus 2003-11-23

Security pros gathering at a Stanford University Law School conference on responsible vulnerability disclosure Saturday harmonized on the principle that vendors should be privately notified of holes in their products, and given at least some time to produce a patch before any public disclosure is made. But there was pronounced disagreement on the question of whether or not researchers should publicly release proof-of-concept code to demonstrate a vulnerability.

Exploit Code on Trial 2003-11-24
Bob Radvanovsky

I can hardly say that Microsoft is the only company that does NOT want exploits published, and for that, there are several reasons, one of which is the fact that this puts unnecessary blame and a scutinzing eye upon Microsoft to produce more secure, more competent software. Microsoft (lately) has b...

[ more ]