To publish PoC exploits or not?
Interesting question, right?
Stumbled over this again and again in the last 10 years. Spreading knowledge as an effective defense might work in some cases but in others it'll give bad actors "good ideas", maybe?
We live in a world were the contradictions are immanent everywhere. We got all the info and stats on digital hygiene and patch discipline on the one hand and PoC exploits might be very helpful to some bad actors out there as well.
Pressuring the market to comply with patching needs and other mitigation tactics by publishing PoC exploits works for the most part. At least for those organizations that have a matured ITSM in place.
Others, especially in the SMB arena and sadly even in many government services, can't seem to keep up with those needs and often fall short and prey to the threats out there.
It's a dilemma that'll be with us for the forseable future I'm afraid.
Just now I've read the following article and poll about this, interesting!
https://threatpost.com/poll-published-poc-exploits-good-bad/151966/
So, what do you think? Is it better to put it all out there so that people can protect themselves by putting in place the needed mitigations or rather weigh the likeliness of such an exploit being used against "us" before publishing?
Cheers!
Lucky
Hello @doifeellucky
Thank you for followed @haccolong account. As a thanks, this post has been randomly selected and upvoted by @hoaithu's Curation Trail !.
To earn more rewards with your Steemit account. Check through some of the ways at this post.
I will continue with random upvotes in the future &wish you lots of luck :)