While I appreciate the academic possibilities such a tool like Metasploit yields and the engineering that goes into making this possible, I strongly disagree with the cost-benefit ethical analysis that is behind deciding whether or not to write a tool that can be used for destruction (even if that's not its intended purpose). The thought that security product sales engineers are using this to demonstrate that this tool is better than others is not something I want to see the real-world analogy of in my neighborhood. [I imagine door-to-door home security system vendors demonstrating with free tools how to break into neighbors' houses, spreading FUD to make their own products sell.] This isn't something I want on my org's networks. I'd rather find the holes in more responsible ways, thanks.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/439/34448#34448