Re: Re: Malware sharing? People are full of shit [was: Getyour computer viruses here!]

[Paul Vixie <paul () vix com>]

yada:

# >> Why not? You got it via email spam, so did many others. Time is
# >> critical, and you can help.

yada:

# >  Because if I send malware to someone, it's my responsibility to satisfy
# > myself that doing so won't cause harm. I can't do that with an unvetted
# > list. So, I can't send it to an unvetted list.

yada:

# The Bad Guy will get it in a day anyway, or maybe even already has it.

and so on.  the first major internet worm was my robert morris jr., and it
targetted vax and sun computers using a buffer overrun in "finger" and a
backdoor built into "sendmail".  this was 1989 or so.  and the then-elite
of internet security argued endlessly as to whether to release source code.
every argument i've seen on this thread, i saw 15 years ago, and some i've
seen this week, i wrote 15 years ago.

why have we failed to advance our understanding in this area?

does anyone who argued 15 years ago for keeping the morris worm's source code
closed, believe either (1) that it stayed closed, or (2) that whatever amount
of clositude they achieved, helped the internet in any way?

the best germicide is sunlight.  the remedy for hate speech isn't censorship,
it's more speech and better speech.

if this stuff is out there, let's catalogue it, publish it, study it, and make
our results widely available.  yes, there will be a smattering of newbie bad
guys who will be educated and otherwise helped by this.  but we can't bother
with that when what's really at stake is educating society as a whole.  yes,
let's vet the community who can see the cutting-edge analysis, if there ever
is any.  but limiting distro of the binaries themselves?  "it is to laugh."
_______________________________________________
Fun and Misc security discussion for OT posts.
https://linuxbox.org/cgi-bin/mailman/listinfo/funsec
Note: funsec is a public and open mailing list.