More - Michael Sutton Quotes

Patching is very urgent. We expect public exploit code to become available, especially for the MSDTC issue.

Michael Sutton

 

I would certainly recommend that users implement the vendor workarounds until a patch is made available. We feel that exploit code can and will be created.

Michael Sutton

 

I would certainly recommend that users implement the vendor workarounds until a patch is made available, ... We feel that exploit code can and will be created.

Michael Sutton

 

A DLL is canned functionality, so if you include a vulnerable DLL in an application, that application is by default vulnerable.

Michael Sutton

 

Patching is very urgent, ... We expect public exploit code to become available, especially for the MSDTC issue.

Michael Sutton

 

It was definitely a surprise to see Cisco's reaction. I don't think that's the best approach. I do feel that it is happening less and that vendors are realizing that we don't want to work against them, but with them.

Michael Sutton

 

There's always code reuse in development, which is a good thing. No one writes an entire application from scratch. But if you're using someone else's code, you're relying on the security of that code. Developers need to apply the same level of security testing to those shared pieces as they do to their own code.

Michael Sutton

 

The attraction is that we are not bogged down in tremendous bureaucracies and processes that make it difficult to get the transactions done.

Michael Sutton

 

The only model that makes no sense to me is the altruistic model. The vendor wants the researcher to do his code review for free and that doesn't quite fly. They are profiting from the vulnerability information but they don't want to pay for it.

Michael Sutton

 

Many of our most valuable contributors consistently identify significant vulnerabilities that may never make the front page, but both avert major exploitation and secure considerable compensation through our rewards program.

Michael Sutton