Re:Everything you need to know about the Shellshock Bash bug
by PeterWhittaker on Thursday September 25, 2014 @01:51PM
(#8368488)
Yes, I did have a good reason: Our initial tests indicate that the organization is not vulnerable.
To be fair to you and to me, I can understand your take on what I posted but what I posted was redacted to remove organization-identifying information. A better redaction would perhaps have been Our initial scans and appraisals are that our public-facing systems are likely not subject to shellshock.
All the managers I know will stop reading after this, sit back and think "aaah, those silly techies. Worrying about nothing".
I gave exactly the opposite advice: We should assume every public and non-public facing system is vulnerable (many were). I'd rather cause a big stinky scare and be proven wrong than downplaying the issue and being proven wrong.. the hard way.
You probably had a good reason for saying this to your organisation, but it's not something that other people should blindly re-use for their own purposes.