Re: defining 0day

On 9/25/07, Adrian Griffis <adriang63@gmail.com> wrote:

> I understand why this descriptivist approach is tempting over a
> prescriptivist approach. But it's important, I think, to keep in mind
> that the public uses the word "illegal" when they really mean
> "unlawful" and uses the word "Schizophrenic" when they are talking
> about multiple personality disorders. All technical fields have their
> jargon, and the general public is simply not well educated enough
> about the issues involved to arbitrate disputes over usage. Just as
> the legal profession needs the word "illegal" with its proper meaning,
> we also need our jargon to facilitate precise discussions about
> security matters. The public can't always be the source of our
> definitions.

I understand and agree. The issue is, that as with those other terms, the industry has allowed the term to be misused long enough that the public now using it wrong as well. However, the "public" I was referring to is reference materials - dictionaries, wikipedia, etc.. If a newcomer to the security field hears the term "zero day" where does he go to find out what a "zero day" exploit is? Most students go to dictionaries or the like... and whats wrong with the current definition of a "zero day"?

Okay, dump "zero day" completely and choose a new term for each division of exploit or vulnerability.

Blue Sky Rambling: Try to enable a unified method of disclosure for all types of exploits and vulnerabilities via a single medium/site or multiple sites with a unified form or some such. I envision a check list asking things like "is this vulnerability known to the vendor - yes/no" and "does this exploit work against latest versions and all patches - yes/no" or whatever it takes to filter disclosures and allow them to be programatically labeled and disseminated, and the "participating" vendor to be contacted - everything occurring in an orderly, acceptable fashion by way of carved-in-stone rules. Definitions of the labels can't be argued because the rules don't bend for one person's perception. If all of the right check boxes are checked, its zero day, or its not. Oh, and you have to be "certified" to release a disclosure! Received on Tue Sep 25 17:37:41 2007