I appreciate your response Blaine0002. This reminds me of a comic strip that I once seen called "bobby tables" - google it, it is funny.
"Obscurity" as a protection, proves to be little or no protection at all. Just look at anything that is hacked. If an exploiter is so inclined, they CAN find information on the desired subject they want to exploit. Just take a look at pay-tv systems, playstations, or even vbulletin itself. "Obscurity" proved to be nothing more than a minor inconvenience. While carousing through google looking for information about vbulletin, I found many things from people you would consider "unfriendly". It was not hard finding every plugin that vbulletin has ever had posted on this site.
Sure, you may get more people that exploit weaknesses, yet you would get more people that could sanitize these vulnerabilities before they ever made it to the public scene. "Obscurity" will not stop someone with the "know how", not if they are obliging enough. Instead, we should be looking at sanitizing every sort of user input, to get rid of these vulnerabilities. And coders themselves should be on the lookout for other coder's code that could pose a potential vunerability... then discuss how to fix it.
What would you rather have? A product with holes in it that a select few can exploit at will, at any given time... things that aren't public? Or the exploits to made public, and fixes to be made? I would choose the latter of these two options.
12-23-2007, 10:49 PM
Hybrid Mode
