Re:“Why are you releasing a full exploit just minutes after ...
by mzs on Friday July 24, 2015 @07:38PM
(#9945881)
For 1, in this case a much simpler script that verifies if newline can be added or not would have been sufficient.
For 2, not releasing a PoC could be even better. Someone else from the advisory might come-up with an even more clever angle. With the PoC released and it being so intricate, there is less motivation, so less surface area is explored in this case.
For 3, yes it's always false sense, that's why the PoC release being delayed should not influence any appropriate reactions anyway.
For 2, not releasing a PoC could be even better. Someone else from the advisory might come-up with an even more clever angle. With the PoC released and it being so intricate, there is less motivation, so less surface area is explored in this case.
For 3, yes it's always false sense, that's why the PoC release being delayed should not influence any appropriate reactions anyway.