Login  |  Register  |  Contact

Security Researchers Discover ... 5 Stages of Disclosure Grief

Denial: "Dan may be smart, but Tom Ptacek states the obvious that this isn't a new threat. Maybe a new spin on an old flaw."

Anger: "Dan didn't find shit. He read RFC3383 ..." and "Dan has brought NOTHING new to the table. Simply made a name for himself by regurgitating the same old problems."

Bargaining: "... the sky was already falling before Dan opened his mouth, ...", and "This is just another reason why we need DNSSEC", and "What Should Dan Have Done?"

Depression: "What can we say right now? Dan has the goods."

Acceptance: "Dan Kaminsky Disqualified from Most Overhyped Bug Pwnie" and "This is absolutely one of the most exceptional research projects I've seen. Dan's reputation will emerge more than intact ..."

DNS Vulnerability: Very interesting. Blog Discourse on DNS Vulnerability: Absolutely mesmerizing. Dan Kaminsky finds a DNS flaw, and half the security research community grieves.

—Adrian Lane

Posted at Wednesday 30th July 2008 10:30 am Filed under: dan kaminsky • dns • geek • off topic

Previous entry: The Art of Dysfunction | | Next entry: Securosis Hits Black Hat and DefCon

Comments:

If you like to leave comments, and aren't a spammer, register for the site and email us at info@securosis.com and we'll turn off moderation for your account.

By Wesley McGrew  on  07/22  at  08:37 AM

And for those who’‘ve followed Dan Kaminsky’s previous Black Ops talks, and paid very close attention to the episode of Network Security with him talking about the problem…

...well those people could skip several of the above steps ;)

By wishi  on  07/30  at  02:28 PM

Well… thing is:
Dan is everywhere :). He’s at toorcon, c3, Defcon/Blackhat, ... TCP/IP black ops. Who didn’‘t hear about that?! Dan even is in German boulevard press. "Man of the day."
He’s in every Security Blog (>700 entries in my feedreader), he’s in every podcast, in every magazine. He’s like a Security-Madonna. (Madonna is brilliant, too…)

I like that: people bringing attention to security research. And we need that in this "science" as I’‘d like to define it. But that’s another question. I think Dan creates awareness. I completely failed trying to do so - several times.

... But he… I’‘ve something which is not so "boring". You know: you get the impression millions of people care about DNS at the moment. That’s not true.
I just like to compare this with Schroedingers Cat: will DNS die like the cat - likely - unlikely? (http://wishinet.blogspot.com/2008/07/dns-schrdinger-cat-miaus.html). We need more humor.

By corq  on  08/04  at  04:44 AM

As a new arrival to the security scene (though old to IT) I was fascinated and perplexed by how much Dan has attempted and succeeded exploiting DNS this way and that. I was a neophyte, and his persistence at DNS manipulations stumped me, all I could ask was ‘‘why???’’ Clearly a lot of people asked this same question of Dan.

Yet it was clear he was trying to advocate re-examination of older systems before another few years of progress and dependency are built around them, and this is a good example of why all aging technology frameworks need a good stare, and a poke with a stick now and then.

Thanks for the "reaction timeline"— I think Kaminsky earned his dues, yet the messenger rarely gets a warm welcome…

Page 1 of 1 pages

Name:

Email:

Remember my personal information

Notify me of follow-up comments?

Submit the word you see below: