“Why are you releasing a full exploit just minutes after the patch is released?”

Re:“Why are you releasing a full exploit just minutes after ... by tzs on Friday July 24, 2015 @09:35PM (#9946214)

1) How often do patches fail to apply successfully in a way that does not generate an error message from the patch management system?

2) How many security researchers actually start doing this so soon after the PoC is released that delaying the PoC by a short time (even a day would greatly help many admins) would have any effect on them?

3) This is a good argument against a long delay in releasing a PoC. I don't see how it is relevant to a short, pre-announced, delay. It is unrealistic to expect every vulnerable system in the world to be patched at the same time, immediately after the patch is released.

[ Parent | on HN ]

Re:“Why are you releasing a full exploit just minutes after ... by tptacek on Saturday July 25, 2015 @12:09AM (#9946513)

1) Not very often.

2) In this case, probably none.

3) The real false sense of security in this case is the notion that the patch obscures the bug meaningfully more than the exploit code does.

[ Parent | on HN ]