Comments on: A Good Samaritan Botnet http://securitymusings.com/article/291/a-good-samaritan-botnet Rants and raves from information security professionals Fri, 03 Feb 2012 13:03:11 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Walt http://securitymusings.com/article/291/a-good-samaritan-botnet/comment-page-1#comment-116 Walt Wed, 07 May 2008 01:26:43 +0000 http://securitymusings.com/article/291/a-good-samaritan-botnet#comment-116 <p>Violation of privacy aside, I don’t trust anyone other than the software vendor to patch their own product. The “good samaritan” approach, while it sounds good in theory, is really dangerous. The biggest problem is that it’s really, really hard to write bug-free code…especially when updating a program that you didn’t write in the first place.</p> <p>What would happen when the “fix” contains a new bug? Something along <a href="http://www.zdnet.com.au/news/security/soa/Third-party-MS-patch-a-farce/0,130061744,120282116,00.htm" rel="nofollow" >these lines</a> could easily happen, which would just compound the problem. On a distributed network, where you can’t be sure of which computer is running what versions of what software, do you trust yourself to write a patch that is 100% bulletproof? I’ve got a big head, but I don’t think my ego is inflated enough to think that I could.</p> <p>Closing up security holes is important, but this seems like a really bad way to go about it. The risk/reward ratio is insanely skewed towards the risk side. I think it would be better if we, as an industry, make education and self-sufficience more accessible to end users rather than surreptitiously try to save them from themselves.</p> Violation of privacy aside, I don’t trust anyone other than the software vendor to patch their own product. The “good samaritan” approach, while it sounds good in theory, is really dangerous. The biggest problem is that it’s really, really hard to write bug-free code…especially when updating a program that you didn’t write in the first place.

What would happen when the “fix” contains a new bug? Something along these lines could easily happen, which would just compound the problem. On a distributed network, where you can’t be sure of which computer is running what versions of what software, do you trust yourself to write a patch that is 100% bulletproof? I’ve got a big head, but I don’t think my ego is inflated enough to think that I could.

Closing up security holes is important, but this seems like a really bad way to go about it. The risk/reward ratio is insanely skewed towards the risk side. I think it would be better if we, as an industry, make education and self-sufficience more accessible to end users rather than surreptitiously try to save them from themselves.

]]>