AV/FW Adoption Sudies

Thu Jun 10 18:54:31 UTC 2004

Paul G <paul at rusko.us> wrote:

> ----- Original Message ----- 
> From: "Eric Rescorla" <ekr at rtfm.com>
> To: <Valdis.Kletnieks at vt.edu>
> Cc: "Sean Donelan" <sean at donelan.com>; "'Nanog'" <nanog at merit.edu>
> Sent: Thursday, June 10, 2004 2:37 PM
> Subject: Re: AV/FW Adoption Sudies
> 
> -- snip ---
> 
> > If we assume that the black hats aren't vastly more
> > capable than the white hats, then it seems reasonable to believe that
> > the probability of the black hats having found any particular
> > vulnerability is also relatively small.
> 
> and yet, some of the most damaging vulns were kept secret for months before
> they got leaked and published. i won't pretend to have the answer, but fact
> remains fact.

I don't think that this contradicts what I was saying.

My hypothesis is that the sets of bugs independently found by white
hats and black hats are basically disjoint. So, you'd definitely
expect that there were bugs found by the black hats and then used as
zero-days and eventually leaked to the white hats. So, what you
describe above is pretty much what one would expect.

-Ekr