Anti-Sec Crusade Against Full-Disclosure. "Imageshacked"

[Siliconmaster]

I don't like the thumbnails, but I do use it for hosting images because I find it pretty easy to use.

Please don't ban we who use the shack.

[Sel]

The thumbnails are a fucking joke. I tend to ignore them, and when I don't, I usually have to click 4 different things to get the full sized picture.

[n00b1n8R]

I only ever used it for shit that photobucket wouldn't take (too hires or potentially considered pornographic)

[rossmum]

I have to admit that I'm more than a little pissed off at the open availability of exploits; I get that it's to force devs to improve their software's security, but it also means any Tom, Dick or Harry who's watched one too many hacker films and thinks they're hot shit can cause a disproportionate amount of chaos with no consequences at all. These aren't the kinds of kids who threaten to hack you in Halo because you beat them, but never go through with it; these are the fucking dolts who try and say 'smart' or 'intimidating' things, and then exploit whatever they can to get at you if you don't play along with them. The only real way to beat them is either to completely wreck their shit yourself, or to outsmart them (usually not that hard, but they're persistent little cunts).

How do I know this? Personal experience. I was part of a community which had something one of these kids wanted. He terrorised the place, jacking steam accounts, emails, what have you left and right; he brought the servers and forums down; hell, I got an email notification from there just the other week telling me that HE WAS MASTER OF YOUR INBOX - the little cunt had done something to give himself full access to everyone's inboxes. I was on the verge of leaving when things started to really kick off, but I had to accelerate things a little to avoid the shit that was going down there. I was one of few people with credible influence there (I was a basic admin, but my word held a lot of sway) who didn't lose their Steam account - possibly because he realised he was fucking with someone out of his league mentally, or because he just lost interest. Either way, he's tried to 'remind' me of his presence since I completely disassociated myself with that community, and nothing has happened (the rootkit saga was apparently totally unrelated - someone else jacked FPSB and used it as an attack site).

My point is that disclosure is fine, but full disclosure is more trouble than it's worth. If you find an exploit, tell the devs, not the kids who are just waiting for some way of getting what they want.

[Phopojijo]

Well Security Through Obscurity isn't designed to hold off patches you assume people don't know about... it's *designed* to slow the attacker's ability to find the exploits.

Doesn't work though.

[rossmum]

Both methods are kind of shit, you'd think if they found an exploit they could surely keep it to themselves to use it, or at least amongst people who don't get giddy on delusions of power?

[Jelly]

Both methods are kind of shit, you'd think if they found an exploit they could surely keep it to themselves to use it, or at least amongst people who don't get giddy on delusions of power?

Exploits are only normally published by ethical and white-hat hackers. The ones who hack programs to protect users, rather than to exploit them. The risk of script kiddies is the reason that the devs want to patch the exploit.

[rossmum]

Yeah, but it'd be nice if they could sort all this out without risking losses of money or risk to personal information for the general userbase.

[klange]

Yeah, but it'd be nice if they could sort all this out without risking losses of money or risk to personal information for the general userbase.

It doesn't work. That's why full disclosure is used in the first place. Companies refuse to patch out exploits when they don't pose enough of a risk.

[rossmum]

Oh, that's alright then. As long as some upstart gets hold of my Steam account which is worth a few hundred by now (hypothetically speaking, nobody's been successful to date but most of my mates have fallen victim at least once) for a good cause!

The devs might be risking this by not patching, but I fail to see how telling all and sundry how to exploit the hole is not worse than the problem it's meant to alleviate. Now instead of a few determined malicious sorts trying to lift people's accounts, I see kids jacking accounts just because they don't get their own way in an online community. It's like amputating someone's arm because they have a mild skin rash, total overkill and far more of a menace.