Re:Heartleech: Automated OpenSSL private key extraction tool...
by vezzy-fnord on Tuesday April 15, 2014 @03:27PM
(#7593809)
I mean the end users of the technology. Who in no way are in a position to get the vendors to do anything or make things more secure, in general.
Writing offensive security tools is bound to get the attention of the vendors, to cause a storm that will get attention from the vendors.
What you're advocating amounts to shooting the messenger. How dare some person write software that disrupts your falsely ingrained peace of mind.
The fact of the matter is, vendors have been notorious throughout the ages for not listening to the security community. So many easily preventable mistakes have led to so many breaches.
Well, it's time to get people to listen. What better way to do that then demonstrate, first-hand, the gravity of their errors?
Writing offensive security tools is bound to get the attention of the vendors, to cause a storm that will get attention from the vendors.
What you're advocating amounts to shooting the messenger. How dare some person write software that disrupts your falsely ingrained peace of mind.
The fact of the matter is, vendors have been notorious throughout the ages for not listening to the security community. So many easily preventable mistakes have led to so many breaches.
Well, it's time to get people to listen. What better way to do that then demonstrate, first-hand, the gravity of their errors?