This has been one of the most popular polls that I've had. My post about this garnered a good deal of comments and emails. Most of which disagree with me. Not surprising since usually people who do agree don't comment nearly as much as those who disagree. I'm not through with this either. LonerVamp has come good comments that I want to respond to when I have more time.
There were 106 votes on the poll almost 70% of you said that HD should have released the exploit for one of the 3 yes reasons. The totals were 70 yes and 26 no. For a while I thought I would be the only one to vote "No, It was irresponsible of him". I still stand by that statement and when I respond to Loners comment I'll explain why in more detail. But for now I will say that I'm not against him releasing an exploit at a later date, just not at the time he did.
Here is the breakdown by answer.
Yes, we deserve to have it | 18 (16%) |
Yes, if he didn't someone else would | 24 (22%) |
Yes, the bad guys already have their own | 28 (26%) |
No, it was irresponsible of him to do so | 9 (8%) |
No, it's too early and several people haven't patched their servers yet. | 23 (21%) |
No, we don't need WhiteHat exploits. | 4 (3%) |
I was a little surprised that 4 of you voted "No, we don't need WhiteHat exploits." I'd love to hear from you with your reasoning why you feel that way.
Hopefully by now everyone has patched their servers, including AT&T (that is another irresponsible matter in my opinion) and that this is behind us.
CG · 869 weeks ago
This isnt the first time its taken an exploit being released to cause people to get off their asses and actually patch. And I think everyone would agree that no one is waiting for after Kaminisky's talk now to see what "all the fuss is about."
But all the grumbling about disclosure makes we wonder if we are more concerned about real bad guys (that already had exploit code) or script kiddies who still have to link at least one more attack to the dns poisoning to deliver some sort of client side exploit as well.
I personally am more worried about the real criminals and unfortunately we still live in a world were no public exploit = no hurry to patch.