Re: [tcpm] PoC for draft-moncaster-tcpm-rcv-cheat-02

On Thu, 27 Mar 2008 23:28:54 +0200
Stefanos Harhalakis <v13@v13.gr> wrote:

> Thank you for the information. It was very helpfull. After thinking it a lot, 
> I decided to first disclose it in the form of a paper which should further 
> alert vendors and security organizations (I'll contact them when it is ready) 
> but it won't be used by script-kiddies reading the bugtraq. I believe that 
> this is the best approach (tm) right now and that it won't do any harm.

From an operational perspective my personal opinion is that this is
probably the best approach at this time.  Releasing code is likely
going to result in two things, pain for some and public notoriety
for you.  Sounds like your ego is already well intact.  Thats good. :-)

Perhaps you or a designated colleague would be willing to give a
lightning talk and expose the attack(s) to a forum such as USENIX,
RIPE or NANOG to help raise awareness?  A few well formed graphs
showing real-world results might get some influential operators and
implementors to put mitigation higher on the priority list?

John
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm