You say that because you are not on the other end of this and don't suffer any of the consequences as a result of the actions of people who create some of these things which make it for sure easier for more people to exploit systems.

Please don't take this as an attack but your perspective is based upon your job [1] and your apparent lack of exposure to how people have to scramble and are actually impacted by certain types of disclosures. I mean the end users of the technology. Who in no way are in a position to get the vendors to do anything or make things more secure, in general.

This is for sure different from vendors and developers needing to write secure code and not make mistakes.

So have a bit of empathy. Not appropriate to call parent commenter, imo, a "jerk".

[1] "I'm a hacker in the computer science department at the University of California"

I think that things like metasploit and heartleech are an almost purely unalloyed good. In my experience, the "bad guys" already have easy-to-use tools. What publicly available tools do is give defenders access to these techniques, which they can use to demonstrate that problems really are a Big Deal. There is a certain kind of person (who seem to gravitate towards management) that cannot be convinced to take an issue seriously unless they can see the impact with their own eyes. A tool that prints out the private key of their production server is worth a dozen blog posts and security advisories as far as convincing them the danger is real.

Getting a private key using the extent simple scrypts is quite complicated, with lots of difficult steps. This is no barrier to teenage kids, who has lots of time on their hands that can play around until they get things right.

As a defender, however, you don't have that much time. For you, it's really easy. If you have a server, and want to know if the private key is visible, just download the Windows heartleech binary from github, run it against a server, walk away for 10 hours, and then come back to see if it's gotten the key.

In short, as you say, a tool that effortlessly prints the private key of a production server is worth a bazillion blogposts and security advisories. Code or GTFO, IMO :)

For a huge majority of folks, some unfortunately in the position of making decisions and policy surrounding security, the attack just isn't real until there's a nicely usable and widely available tool.

That all aside, the job of the security community is not to make your life or my life easier. And neither you or the person I was replying to gets to be angry at someone for exposing a problem because it inconveniences you or your colleagues.

The only thing that will do you any good is to fix your shit.

Pretending that it is someone else's fault that you have to scramble to fix your shit is not okay. I think my comment was phrased bluntly, but was both truthful and appropriate. I understand the emotions that cause it, but no one who blames others for their own problems has much high ground to stand on when it comes to empathy.

Writing offensive security tools is bound to get the attention of the vendors, to cause a storm that will get attention from the vendors.

What you're advocating amounts to shooting the messenger. How dare some person write software that disrupts your falsely ingrained peace of mind.

The fact of the matter is, vendors have been notorious throughout the ages for not listening to the security community. So many easily preventable mistakes have led to so many breaches.

Well, it's time to get people to listen. What better way to do that then demonstrate, first-hand, the gravity of their errors?

I agree his justification is a bit weak, but in my opinion he doesn't need any justification at all, if you haven't patched your OpenSSL version yet you're no more vulnerable today than you were tomorrow IMO, it's already too late.

It's not like he released a 0-day exploit into the wild.

You mean the NSA?

One of the things I'm famous for is creating "BlackICE" 15 years ago, an intrusion-detection technology that we shipped as a variety of products, such as a personal firewall, gigabit IDS, and inline protection (i.e. intrusion-prevention-system or IPS).

The distinguishing feature of this technology is that we wrote "protocol-decodes" for everything. This made the product faster, able to catch more things, yet producing fewer false-positives. It's a vastly better technique than Snort-style pattern-matching.

Yet, it was an uphill battle convincing the market of this. That's because people are stupid and don't understand how things work well enough to appreciate the difference. All they know is that they download a public exploit, run it, and if the IDS catches it, then the IDS is good.

Today, there are lots of commercial products that do things the right way, with protocol decodes. There is also the open-source "Bro" project which does things the right way. All these products can catch my heartleech tool -- it can't evade tools doing things the right way.

Even Snort often does things the right way, but only when people like me prod them. They are going to add an SSL decode (I predict).

So the upshot is this: I really are about the difference between protocol-analysis and pattern-matching in IDS technology, and as long as people like you aren't smart enough to understand the difference, I'm going to keep releasing exploits to demonstrate it. None of my exploits evade properly written IDS -- only IDS that takes shortcuts.

I think you published this because it was fun to write. "Auto pwn", as you call it, has nothing to do with convincing Snort to do anything.

I don't believe you agree with Daniel Weber's argument at all. Don't dodge it by making things up. Engage with it directly. I wouldn't think it would be that difficult for you to knock down.

But most other IDSs can, such as Bro.

Unless there is a tool that demonstrates this, people won't believe that there is a difference between Snort and Bro, because existing tools don't show a difference.

By the way, this isn't really related to or damning of the concept of full disclosure in any way. It still remains the most widespread philosophy. The CVE lists would be drastically smaller, if it were otherwise.

There are plenty of casual PLs conventions, meetups, hackathons, unconferences, just about any format you want. If anything I think that community is more welcoming and casual than the computer-security convention scene, which has a heavy tilt towards big-money, "rockstar" conferences like DEF CON and Black Hat, full of corporate and government presenters and attendees. There are conferences like that outside of security, like videogames (E3, GDC), but security really takes it to ridiculous levels, even holding the damn things in places like Las Vegas and Abu Dhabi.

What that portion of the security scene's image most reminds me of outside tech is the rockstars they'd like to be: a manufactured pretense of "anarchy and chaos" sold as a business's brand image.

I agree though. Hard to argue that this particular security issue needed any extra attention in order to get it fixed.

100% true. The argument Dan and others are trying to make is there are a lot of people caught in the cross-fire who have nothing to do with IDS-vendors claims.

But I don't get the leap from "IDS vendors suck" to "I made a command-line tool so any idiot can suck down private keys from a server." If the idea was to show that the IDS rules sucked, then just release a slightly different version of the previous heartbleed testers that gets around it.

But that's not as much fun.

If you went back in time two years and fixed the Heartbleed bug, no one would be writing newspaper articles about you.

This is hardly something isolated to the security industry. It's human nature. Some person sealing a hole is nowhere near as attention-gathering as a hole leading to a catastrophic flood due to no one realizing that it needs to be sealed.

The potential for something bad to happen doesn't raise anywhere near as much eyebrows as the bad thing actually happening, especially for something as invisible to the average person as a software vulnerability.

[1] hey, they read some bytes of server memory, it's fairly simple to move on from there and read more.

No. Stop.

A good security tool that does what it says and means what it says is just a good tool that does what it says and means what it says. There is no "weapons grade" or not "weapons grade" tools. I've seen people pop boxes with netcat and a keyboard. I've seen people fail to pop boxes with the best fucking attack framework you could put in their hands. Nothing is "weapons grade" and code isn't a weapon.

Leave the weapons grade labels to radioactive isotopes where they actually have real meaning.

Calling some types of code weapons grade is a huge bad thing.

Ignorance is not bliss, nor is it security.

More information is always, always better, and hiding information and implementation has been proven, over and over again, to not work, and to piss people off.

I hate seeing a green lock sign next to the url in my browser. I am amazed Snowden didn't leak anything about root CAs.

Your statement is true, but surely there's a better and less damaging way to reach the end goal? e.g., if I run over someone with my car and they're saddled with life-long medical bills, they're more likely to call their Congressman and demand a better healthcare system.