Re: [Full-disclosure] Getting Off the Patch

Cor Rosielle wrote: I don't agree with the statement: From a security standpoint, patching is better than not patching. Period.. Sometimes patching is the right solution, often it is not. Since some asked experiences from larger companies, here is one: snip I did not know about the OSSTMM

Re: [Full-disclosure] GNU libc/regcomp(3) Multiple Vulnerabilities

[ GNU libc/regcomp(3) Multiple Vulnerabilities ] Author: Maksymilian Arciemowicz http://securityreason.com/ http://cxib.net/ Date: - - Dis.: 01.10.2010 - - Pub.: 07.01.2011 CERT: VU#912279 CVE: CVE-2010-4051 CVE-2010-4052 Affected (tested): - - Ubuntu 10.10 - - Slackware 13 -

Re: [Full-disclosure] how i stopped worrying and loved the backdoor

BMF wrote: Dan Kaminsky d...@doxpara.com wrote: Don't we have hardware RNG in most motherboard chipsets nowadays? Do we? By what mechanism do they operate? Thermal noise seems the easiest way to go although I have always preferred the idea of sampling random radioactive decay simply for

Re: [Full-disclosure] Security Incident Response Testing To Meet Audit

Christian Sciberras wrote: Just to satisfy my curiosity, but, when was the last AV update performed? One could assume some anti-virus would be up-to-date even if the last update was performed a month or so ago. On the other hand, an anti-virus update usually is done sometimes even several