Re:Heartleech: Automated OpenSSL private key extraction tool...
by djcapelis on Tuesday April 15, 2014 @02:45PM
(#7593592)
> Granted, this is weapon grade quality
No. Stop.
A good security tool that does what it says and means what it says is just a good tool that does what it says and means what it says. There is no "weapons grade" or not "weapons grade" tools. I've seen people pop boxes with netcat and a keyboard. I've seen people fail to pop boxes with the best fucking attack framework you could put in their hands. Nothing is "weapons grade" and code isn't a weapon.
Leave the weapons grade labels to radioactive isotopes where they actually have real meaning.
Calling some types of code weapons grade is a huge bad thing.
No. Stop.
A good security tool that does what it says and means what it says is just a good tool that does what it says and means what it says. There is no "weapons grade" or not "weapons grade" tools. I've seen people pop boxes with netcat and a keyboard. I've seen people fail to pop boxes with the best fucking attack framework you could put in their hands. Nothing is "weapons grade" and code isn't a weapon.
Leave the weapons grade labels to radioactive isotopes where they actually have real meaning.
Calling some types of code weapons grade is a huge bad thing.