cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1995-09-22 - Re: Another Netscape Bug (and possible security hole)

Header Data

From: “Perry E. Metzger” <perry@piermont.com>
To: Ray Cromwell <rjc@clark.net>
Message Hash: 872240a3b061d9229333e5b6d8a6c32fa7a8ad076601aa1186171b1424a9b8e7
Message ID: <199509221236.IAA03762@frankenstein.piermont.com>
Reply To: <199509220715.DAA27920@clark.net>
UTC Datetime: 1995-09-22 12:36:15 UTC
Raw Date: Fri, 22 Sep 95 05:36:15 PDT

Raw message

From: "Perry E. Metzger" <perry@piermont.com>
Date: Fri, 22 Sep 95 05:36:15 PDT
To: Ray Cromwell <rjc@clark.net>
Subject: Re: Another Netscape Bug (and possible security hole)
In-Reply-To: <199509220715.DAA27920@clark.net>
Message-ID: <199509221236.IAA03762@frankenstein.piermont.com>
MIME-Version: 1.0
Content-Type: text/plain



Ray Cromwell writes:
> THIS IS A SERIOUS BUG!
[...]
> [I hear Perry in the background groaning and muttering "I told you so"]

Of course I told you so. I knew what I was saying when I mentioned
buffer overflows being a big problem in code written by the NCSA team,
most of whom went over to Netscape When at NCSA, they showed very
little capacity to learn this lesson no matter how many cracks
occured. They always just tried to kludge around the thing instead of
fixing it. When I write security oriented code, I outright ban the use
of certain C library calls.

> These buffer overflow bugs should be taught in every programming
> 101 course along with fencepost errors.
> 
> I'm not even sure if I want to write the obligatory program to exploit
> the hack given that some malicious jerk would probably use it
> on his home page to attack people.

The problem is that if you don't produce a (benign) exploit people
aren't going to take it seriously enough.

Perry

Thread