×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Sun Pushes Emergency Java Patch

timothy posted about 4 years ago | from the emergency-shot-of-soy-latte dept.

Security 90

Trailrunner7 writes "In a sudden about-face, Sun has rushed out a Java update to fix a drive-by download vulnerability that exposed Windows users to in-the-wild malware attacks. The patch comes less than a week after Sun told a Google researcher it did not consider the issue serious enough to warrant an out-of-cycle patch and less than a day after researchers spotted live exploits on a booby-trapped Web site. The flaw, which was also discovered independently by Ruben Santamarta, occurs because the Java-Plugin Browser is running 'javaws.exe' without validating command-line parameters. Despite the absence of documentation, a researcher was about to figure out that Sun removed the code to run javaws.exe from the Java plugin. The about-face by Sun is another sign that some big vendors still struggle to understand the importance of working closely with white hat researchers to understand the implications of certain vulnerabilities. In this case, Google's Tavis Ormandy was forced to use the full-disclosure weapon to force the vendor into a proper response."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

90 comments

PHB syndrome (4, Insightful)

18_Rabbit (663482) | about 4 years ago | (#31862366)

Why is it that corporate types never understand that if the white hats have found it, the black hats have too...and are exploiting it.

Re:PHB syndrome (4, Informative)

ILuvRamen (1026668) | about 4 years ago | (#31862594)

They assume white hats are smarter and faster because they have jobs and are being paid. What they don't realize is that black hats also have "jobs" and are being paid.

Re:PHB syndrome (3, Insightful)

phantomcircuit (938963) | about 4 years ago | (#31863340)

What they don't realize is that black hats also have "jobs" and are being paid.

It's even worse than that. The black hats are almost certainly being paid far more than the white hats are.

Re:PHB syndrome (0)

Anonymous Coward | about 4 years ago | (#31866098)

I wonder, would it be illegal to sell an exploit/spambot/botnet toolkit to some entrepeneur. As long as it is not me who actually uses it? I mean I thought Mr. Kasparov was running Kaspersky.
It is a pity that my talent is wasted and these guys seem to value what I do.
I do not want to go to jail or get a bullet into my head, though.
Anyone got references?

Re:PHB syndrome (5, Insightful)

mea37 (1201159) | about 4 years ago | (#31863048)

That's not the problem.

The problem is, management (the people in control of the big corporations who harbor at most marginal technical aptitude) see the flaw but lack the imagination to understand how it could be used for real harm until they see it used for real harm.

(Actually, "lack the imagination" may be misleading. They are motivated to think that the problem is not a big deal, and they have no problem convincing themselves of this rather than exploring the possible threat scenarios.)

Full disclosure changes the risk from the company's point of view ("Oh, great, now we know people are trying to think of a way we're not seeing to exploit this") but the real tipping point is when they see a demonstration of harm being done (not merely a proof-of-concept that they can rationalize away).

Re:PHB syndrome (3, Insightful)

eloki (29152) | about 4 years ago | (#31866898)

Really? I thought the problem might be that they see the flaw but see it as lacking urgency as they have insufficient stake in an urgent patch.

When it becomes an exploited flaw, the company reputation is now at risk and customers/users experiencing actual (as opposed to possible) loss are much more likely to get angry and demanding. Now the company has a stake in the patch.

(But as pointed out elsewhere, it's hard to comprehensively test on an urgent patch.)

Re:PHB syndrome (2, Informative)

shentino (1139071) | about 4 years ago | (#31867196)

An unfortunate side effect that full disclosure also gets them royally pissed at you for "exposing" their flaw.

Re:PHB syndrome (1)

ultranova (717540) | about 4 years ago | (#31867960)

And an unfortunate side effect of that is that you have to disclose anonymously for your own protection, and that means simply making the whole thing public from the start.

Re:PHB syndrome (0)

Anonymous Coward | about 4 years ago | (#31868904)

About half of your post is in brackets. (It's really annoying, and if you're having to use brackets so much, consider re-wording your post).

Re:PHB syndrome (2, Insightful)

david_thornley (598059) | about 4 years ago | (#31864318)

Why is it that Slashdotters never understand that hasty patches are dangerous and expensive? This patch almost certainly hasn't been tested as well as Sun would like, and they could well be screwing up people's computers. There are dangers in patching too hastily and patching too slowly, and somebody has to decide on the trade-offs.

My guess is that they were hoping to run it through the normal cycle when they saw it being used in the wild, and decided that it was important to get something off now, regardless of risk and possible additional expense.

The fact that they were able to issue a patch the day after they found live exploits indicates that they were probably working on it already, and simply misjudged the immediacy of the danger.

Re:PHB syndrome (1)

ls671 (1122017) | about 4 years ago | (#31864644)

> This patch almost certainly hasn't been tested as well as Sun would like

You do not have to release the latest and greatest if hasn't been tested enough for your taste.

Just branch from the last stable release and apply only the fix that is needed for security reasons. This is done all the time !

A patch to filter input parameters should be trivial enough to test ;-))

Re:PHB syndrome (2, Informative)

Anonymous Coward | about 4 years ago | (#31866004)

True, but the last stable release (update 19) is crap already. Unfortunately, 19 was also a critical security update so we had to start deploying it. It has broken at least 5 major applications already (for example a resource scheduling application - to reserve meeting rooms and equipment, a publishing application used to move internal web code from test to production, and several more). Sun's habit of breaking stuff with every release is really a serious problem.

Re:PHB syndrome (1, Insightful)

Anonymous Coward | about 4 years ago | (#31867412)

Dude, you're full of crap.

Re:PHB syndrome (0)

Anonymous Coward | about 4 years ago | (#31867092)

You've obviously never released any real software.

Re:PHB syndrome (1)

ls671 (1122017) | about 4 years ago | (#31869300)

You have obviously never worked on a serious project and you are obviously unaware of tools such as source repositories, with functionality such as versioning and branching functionality.

I bet your sources live on your hard-drive. At best, you might be using MS source-safe which is pretty limited in functionality.

Re:PHB syndrome (1)

david_thornley (598059) | about 4 years ago | (#31870034)

On the theory that a patch from a stable version will break nothing? If it filters input parameters, how are you to know, without extensive testing, that it filters the right ones? If it filters out too much, it may break perfectly reasonable applications. If it filters out too little, it may leave the system vulnerable. It may do both, if it's just a little wrong.

Yes, I, too, have deployed very simple patches to stable software without adequate testing. One recent time, I put a hundred-thousand-dollar machine out of commission that way, and I'm generally quite competent while fixing things.

Re:PHB syndrome (0)

Anonymous Coward | about 4 years ago | (#31866780)

There only is Ormandy's claim that Sun *ahem* Oracle wasn't going to issue an emergency patch. I trust Ormandy that he *thought* that Oracle would not issue an emergency patch. But I consider it dumb to just go public with an exploit rather than give the vendor a few weeks of time to first analyze and then fix the issue. The public then gets a patch that was not properly tested, and thus is more likely than usual to either contain an incomplete security fix, or breaks something else.

Re:We are all individuals (1)

b4dc0d3r (1268512) | about 4 years ago | (#31873348)

Why is it that slashdot poster types group everyone together, as if they all have a hive mind? Each company has to learn this lesson, and often if a person is replaced the new guy has to learn it as well. Each company learns as it happens, and still they might resist the change in certain situations.

I frequently find small quirks in my codebase while looking at other unrelated items like general performance monitoring, and don't have time to investigate completely, but if someone complains I'll fix it. The change control process and testing is a lot of overhead to fix something that most people don't run into. So I can see the perspective of the "don't fix unless it's necessary" crowd, and it requires a real change in thinking and process updates to ensure everyone is going to be onboard. If someone doesn't think the change is worthwhile they can reject the change or delay it, either through making additional informational or approval requests, or flat out rejecting the change request. So it sits.

On the other hand, I write code for corporate internal sites and their clients, with heavy security and tracking, so if someone manages to turn a quirk into a vulnerability they will be caught and fired - and my data isn't sensitive enough that anyone would even try to break in. Most websites do not have the ability to threaten "you will lose your job" if the users hack it, so my motivation is just what can I package into a release without documenting all of the little bug fixes.

My point is, it will take a lot to switch me to the "fix everything just in case" mentality, and it would take other people, individually, some revelation or event like this before they start being proactive in their fixes.

This post incorporates the linked post below by reference as well.
http://it.slashdot.org/comments.pl?sid=1620242&cid=31864318 [slashdot.org]

White Hats (5, Insightful)

DarkKnightRadick (268025) | about 4 years ago | (#31862376)

I think White Hats need to not only use that threat, but follow up on it, more regularly so that serious flaws like this get the attention they deserve.

Re:White Hats (2, Informative)

poetmatt (793785) | about 4 years ago | (#31862806)

that sounds nice and all, but there are currently very real legal risks involved even if you are a white hat and employed by a company to look for this stuff.

I agree that white hats should do it anyway - one way or the other the legal system will get around to protecting it, probably as whistleblowing/free speech, but in the meantime I think plenty are afraid to be taken to court for disclosing vulnerabilities and/or not being employed for future whitehat jobs.

Re:White Hats (0)

Anonymous Coward | about 4 years ago | (#31863218)

Does white hat mean good, lawful or lawful-good?

Re:White Hats (1)

hlee (518174) | about 4 years ago | (#31863632)

I take white hat to mean Good, i.e. you're not using the exploit for personal gain.

You're Lawful Good if you're working on behalf of some legal authority. Chaotic Good if you're exposing it to shame/antagonize the companies. Neutral Good if just out of your own personal reasons.

Re:White Hats (0)

Anonymous Coward | about 4 years ago | (#31868532)

But does that mean the Black hats have Lawful Evil?

Re:White Hats (0)

Anonymous Coward | about 4 years ago | (#31868886)

If they sell the exploit to others for money they are Lawful Evil.
If they use the exploit to steal data and use it for extortion they are Neutral Evil.
If they use the exploit to wipe the system, delete files, damage stuff, they are Chaotic Evil.

Need a new breed of white hat (4, Funny)

syousef (465911) | about 4 years ago | (#31863290)

I think White Hats need to not only use that threat, but follow up on it, more regularly so that serious flaws like this get the attention they deserve.

I recommend we coin a new term for this elite breed of white hat. White hats that are more aggressive. Not afraid to be an asshole when required. I would like to propose: "ass hats"

Re:Need a new breed of white hat (0)

Anonymous Coward | about 4 years ago | (#31867466)

That honor is reserved for most on /.

Re:White Hats (0)

Anonymous Coward | about 4 years ago | (#31866128)

then you are not a white hat.
you are a grey hat

Hm... (0, Redundant)

oldhack (1037484) | about 4 years ago | (#31862442)

But does it affect any iStuff?

Re:Hm... (0, Offtopic)

laederkeps (976361) | about 4 years ago | (#31862882)

I only just realized that you can go into the slashdot preferences and select which sections of the site you wish to see.
You'll notice that all the iStuff is conveniently collected under the "Apple" section.
Hiding it sure removes a lot of cruft from the front page.

Re:Hm... (1)

sqlrob (173498) | about 4 years ago | (#31863190)

If Sun patched this today, you can expect the patch for iStuff around Christmas or so, if that quickly.

They've been that slow before on exploited vulnerabilities, they'll be that slow again.

Re:Hm... (1)

mlyle (148697) | about 4 years ago | (#31867634)

Given that the problem is not exploitable on MacOS X with Safari... I think they'll be very slow to release a fix.

Summary reads better with hyphenated words only (5, Funny)

bugeaterr (836984) | about 4 years ago | (#31862600)

about-face
drive-by
in-the-wild
out-of-cycle
booby-trapped
Java-Plugin
command-line
about-face
full-disclosure

Re:Summary reads better with hyphenated words only (1)

clone53421 (1310749) | about 4 years ago | (#31862714)

Summary reads better with hyphenated words only

That is surprisingly true.

Oracle (4, Informative)

farble1670 (803356) | about 4 years ago | (#31862856)

there is no company or organization called "sun" ... there is only oracle now.

Re:Oracle (0)

Anonymous Coward | about 4 years ago | (#31864190)

"On January 26, 2010, we completed our acquisition of Sun Microsystems, Inc. (Sun), a provider of hardware systems, software and services, by means of a merger of one of our wholly owned subsidiaries with and into Sun such that Sun became a wholly owned subsidiary of Oracle" -- Oracle 10-Q [sec.gov] (emphasis added)

Rarely are "mergers" destructive of corporate entities (especially so early in an acquisition)

Re:Oracle (1)

game kid (805301) | about 4 years ago | (#31865818)

Rarely are "mergers" destructive of corporate entities (especially so early in an acquisition)

Don't worry, they'll find a way.

Re:Oracle (1)

iggymanz (596061) | about 4 years ago | (#31866496)

uh huh, why don't you go to *sun.com* and check out some *sun solaris* features, and observe

Sun is Dead (0)

Anonymous Coward | about 4 years ago | (#31872576)

Seems you haven't been there in a while. sun.com redirects to oracle.com. It is now called Oracle Solaris.

See: Oracle Solaris [oracle.com]

The Sun has died and turned into a brown dwarf.

Re:Oracle (0)

Anonymous Coward | about 4 years ago | (#31873718)

Believe it or not, legal entities are not defined by domain names.

Re:Oracle (1)

John Hasler (414242) | about 4 years ago | (#31867124)

Even if Oracle does intend to liquidate Sun and merge its assets into itself rather than operate it as a wholly-owned subsiduary Sun certainly still exists as a legal entity. It takes many months (sometimes years) to work through all the details of a merger.

Re:Oracle (1)

drinkypoo (153816) | about 4 years ago | (#31869840)

there is no company or organization called "sun" ... there is only oracle now.

It's not too late for Oracle to sell some or all of Sun, as "Sun".

Your grasp on corporatism is only half-sufficient to keep you from falling off a cliff.

Re:Oracle (1)

tehcyder (746570) | about 4 years ago | (#31869922)

there is no company or organization called "sun" ... there is only oracle now.

In the same way that you can only buy Diageo and not Guinness?

OK Corral (0)

mindbrane (1548037) | about 4 years ago | (#31862894)

I've not been able to stay current with security affairs since about Windows 98, not because staying current with computer security isn't important, but because I just don't have the time. Fortunately I'm able to keep my work computers offline. But as a Luser look at it this way, every security patch is a bullet you hoped to have dodged, now think of how many security patches a Window's box needs, especially if it's always online and loaded with 3rd party software, it's like the Gunfight at the OK Corral. What does it say about the true state of the internet?

Does it bypass UAC? (2, Interesting)

tkinnun0 (756022) | about 4 years ago | (#31863270)

Does this exploit bypass UAC in 7 and Vista?

Re:Does it bypass UAC? (2, Insightful)

Anonymous Coward | about 4 years ago | (#31864632)

Does this exploit bypass UAC in 7 and Vista?

No, the user still does that.

There's a workaround (3, Insightful)

afidel (530433) | about 4 years ago | (#31863306)

Just disable jnlp file association, we have a number of third party websites that require a specific version of java to function (I'm looking at you ADP etime) and so we can't just upgrade to the newest version. The workaround is to remove the JNLP file association from the registry which leads IE to prompt to download the file instead of automatically running it.

Re:There's a workaround (1)

woodsrunner (746751) | about 4 years ago | (#31872564)

Your post worried me, and immediately tested with ADP Timesaver and it worked for me. Not sure if it's the same product.

Saw this earlier today (2, Informative)

VGPowerlord (621254) | about 4 years ago | (#31863344)

The Register mentioned this earlier today, and I immediately informed our local IT guy, who contacted someone higher up at Enterprise Security.

Then Worf came to my desk and said I needed to test the Java upgrade before they deployed it to everyone.

...

Ok, not Worf, just one of our tech guys. Since I'm one of two Java developers on this floor as well as the one who reported it, I got the fun job of making sure everything i have (Eclipse, OC4J, Oracle SQLDeveloper, Oracle JDeveloper, etc...) still worked.

Re:Saw this earlier today (1)

StuartHankins (1020819) | about 4 years ago | (#31863718)

As least your org is clueful enough to have you test for problems before rolling it out. Some orgs might choose to avoid it altogether because of the chance it could break something, or because they're lazy, or countless other reasons. Sounds like you're lucky you work for someone who took a timely, thoughtful approach to the problem.

Come on, be adults. (3, Insightful)

Anonymous Coward | about 4 years ago | (#31863434)

It's not that corporations don't "get the value" of White Hat reports. They love them!

But these corporations are not giant machines running on magic. They are made up of people who have other priorities, other dead lines and will not get paid anything for going through the mountains of work that must be done to issue an emergency fix. Absolutely, they should be more responsive. But it's not like they're sitting on the beach smokin a bowl. These corporations are busting their ass to find enough money to keep all their people employed. Issuing an embarrassing, costly and difficult fix is a lot like working an extra job to pay an unexpected hospital bill. How much enthusiasm would have in that situation?

Re:Come on, be adults. (0)

Anonymous Coward | about 4 years ago | (#31871928)

I imagined corporate officers in the bowl smoking and finding enough money to keep employees employed situations that you described. Sadly, I found the former more believable than the latter.

Huge hole (0)

Anonymous Coward | about 4 years ago | (#31863610)

At least it works now, unlike the hastily pushed out 1.6.0_19-b05 version that crippled our app on numerous computers.

The hole was so big - it should have been fixed ASAP (with at most a day or two of high-priority testing). Shame on you Soracle.

Re:Huge hole (0)

Anonymous Coward | about 4 years ago | (#31863746)

yeah it was a huge hole. Measured 6-goatses in diameter.

Java 1.5 users are screwed (3, Informative)

Anonymous Coward | about 4 years ago | (#31863732)

Due to development constraints, I run JDK 5 Update 22 on my system.
As of Nov 3rd 2009, Update 22 is the last public release of version 5.
I used the exploit demo link to see if it is also vulnerable, and sure enough it attempted to launch a program.
So now the still-quite-large-installed-base of 1.5.0_x users are screwed!!!

Fortunately though, my AVG quickly blocked it, reporting it as "Exploit JSE WebStart (type 1067)"

Re:Java 1.5 users are screwed (0, Flamebait)

jo42 (227475) | about 4 years ago | (#31864276)

I ended up uninstalling Java the day I got hit by malware through Java.

Don't need it to run anything on my machine so the POS is gone, gone, gone.

Re:Java 1.5 users are screwed (1)

loxosceles (580563) | about 4 years ago | (#31866102)

Corporate constraints?

That's what VMs are for: testing and development without exposing your main desktop and web browser to those vulnerabilities.

No they're not (0)

Anonymous Coward | about 4 years ago | (#31866730)

http://www.sun.com/software/javaforbusiness/index.jsp

Just those that don't pay, rather than migrate.

Re:Java 1.5 users are screwed (2, Insightful)

Anonymous Coward | about 4 years ago | (#31867186)

Java 5 is from 2004. Now we have 2010.
I know how you feel. I liked my firefox 1.0, too. It sucked when I had to upgrade to firefox 2.0.
I would have preferred mozilla to support firefox 1.0 forever. Free of charge, of course.

Re:Java 1.5 users are screwed (0)

Anonymous Coward | about 4 years ago | (#31873194)

PowerPC Mac users are stuck with Java 1.5. These computers are at least 4 years old, not six.

I was affected (2, Interesting)

Anonymous Coward | about 4 years ago | (#31863992)

I was actually hit by one of these "drive by downloads" within firefox via java 5-6 weeks ago. Browsing porn, opened a tab to a video, the browser suddenly got sluggish like crazy. Task manager showed java executable running at near 100% cpu. The processes were so locked up that an attempt to kill either the java process or firefox just wasn't doing anything. I have Avast for anti-virus, and it wasn't complaining about any virus - until the exact moment I clicked to reboot the machine. At that instant, Avast popped up a virus alert, but it was too late - I guess the reboot process shut down the Avast service/process *before* the browser. Immediately after a reboot I discovered I was, for the first time in my life, rootkitted. It took 2 rounds of Malwarebytes' Anti-Malware [malwarebytes.org] and a windows-xp-recovery execution of `fixmbr` to completely eradicate.

I would *not* have java installed (at least not for browsers) to begin with if not for the fact that the Canada Revnue Agency's website *requires* java just to login to one's government account. Ridiculous.

Use an alternate profile with different settings (0)

Anonymous Coward | about 4 years ago | (#31868826)

If you are using Firefox, you could create a separate profile just for accessing the Canada Revnue Agency and have Java enabled only in that profile. I do something similar for banking. Or you could manually enable the Java plugin only while accessing the Canada Revnue Agency; you can do this in Firefox without even a restart.

Using separate OS accounts with different sets of plugins enabled would work as well.

The fact that your browser could install a rootkit means that you're running with administrator privileges. Not smart. If you can't browse porn from a limited account, you can at least turn off administrative privileges for Firefox using the DropMyRights [cnet.com] program from Microsoft.

Ahem. The patch doesn't seem to work well here. (1)

surveyork (1505897) | about 4 years ago | (#31864904)

I installed the new JRE and then tried the PoC http://3.ly/qht4 [3.ly] . Sometimes I get an error message as shown in the article, but most times the calculator pops up. I'm using XP SP3 & PaleMoon 3.6.3 browser.

Re:Ahem. The patch doesn't seem to work well here. (1)

surveyork (1505897) | more than 3 years ago | (#31965054)

Yo! I discovered that the patch left some systems still vulnerable:

http://www.kb.cert.org/vuls/id/886582

"Note: The installer for Java 1.6.0_20 may not correctly update all instances of the Java Deployment Toolkit plugin. In some cases, the plugin that resides in the \bin\new_plugin directory may not be updated to the fixed 6.0.200.2 version of npdeployJava1.dll. If the new_plugin directory contains npdeploytk.dll version 6.0.190.4 or earlier, then browsers that use plug-ins, such as Mozilla Firefox or Google Chrome, may still be vulnerable. To correct this situation, delete the vulnerable npdeploytk.dll from the new_plugin directory and replace it with the npdeployJava1.dll version from the bin directory.

Please note that the Java Development Toolkit can be installed in multiple browsers, therefore workarounds need to be applied to all browsers with the Java Development Toolkit.
"

I hate JAVA update (3, Insightful)

JaCKeL 1.0 (670980) | about 4 years ago | (#31865772)

They will once again propose me to install a toolbar. WTF, just do your update and stop trying to install shit I don't want after I already said "NO" to the same queation 10 freaking times before.

Re:I hate JAVA update (1)

pne (93383) | about 4 years ago | (#31907720)

I'm always amused that the annoying Yahoo toolbar ad in the installer claims to "block annoying ads".

Update Links (2, Informative)

kcbnac (854015) | about 4 years ago | (#31866810)

For Java, here's a quick link to see what version you have installed, and if there's a new version available or not:

www.java.com/en/download/installed.jsp?detect=jre&try=1

Here's one for Adobe Flash Player:

http://www.adobe.com/software/flash/about/ [adobe.com]

What other plugins are there links for like this?

I'd love to have a page set up that I can just click through a set of links to verify each app is current when checking PCs. If the update process is painless enough, just have friends and family run through it every so often, or when they hear of a "java exploit" or "flash bug" or whatever. (I train most of 'em well enough that they can do this, or I automate the system to check regularly)

The major browsers (except IE, that's tied to Windows) update themselves on Windows boxes - what links are useful to ensure the rest of the browser-accessible ecosystem is current?

Re:Update Links (0)

Anonymous Coward | about 4 years ago | (#31868900)

You seem to be looking for the Secunia Online Software Inspector (OSI) [secunia.com]. It will scan your Windows OS plus common applications and plugins (including Flash and Java) to tell you whether any are out of date from a security point of view. Warnings about out of date programs include a link to the updated versions.

Ironically, the software is written in Java. The online scanner doesn't require any installation, though Secunia does offer an installable version.

Java 6 u19 Works Fine (1)

rliden (1473185) | about 4 years ago | (#31867756)

I have Java 6 update 19 installed and I get the same error and failed attempt using this link (weird url but it's the one from the TFA): test demo [cmpxchg8b.com]. The author also said the fix wasn't mentioned in the patch notes. Could this vulnerability have been fixed in a previous version and no one actually tested what versions/updates were actually vulnerable before publishing these articles, or did I miss something?

Here in Europe we want the LAVA patch from Iceland (0)

Anonymous Coward | about 4 years ago | (#31868576)

first... forget the Sun, some of us can no longer see it!

eyelet kasugai (1)

Mana Mana (16072) | about 4 years ago | (#31868682)

Know what, security analyst jobs became common and then we had these periodic reports of `vendor ignores for-long-time reported insecure flaws, errors, etc.' bullshit. Fuckthat! go back to the ole publish to Bugtraq all warts most post haste. But then you don't get legally usable cred for your resume---oh, excuse me, Curriculum vitae, oh so sorry, CV---awww.

IN THE NAME OF F*** (0)

Anonymous Coward | about 4 years ago | (#31879470)

It is very simple - large vendors - work with white hat researchers you hubristic f*** tards. What is the problem???????Do you have a problem with people doing uber skiled work for free? Sweet zombie jesus pass the vodka......................

Check for New Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...