What do you think? Does the publication of exploit code help or hinder Internet security?

Sound Off is a weekly column about current IT-related issues. Web Editorial Director Art Jahnke (ajahnke@cio.com) always welcomes feedback.

I think this is the wrong question. Should there be exploits to be published online? is a better question. Just take a look at the long list of vulnerabilities published for just the past few days on sites such as Symantec. Nearly every major vendor of software is listed for some problem. Recently, we have had major busts on Microsoft and Cisco IOS that have kept my folks much too busy, and we no longer seem to have the time to test patches before the next one is released. How about a new feature in the feature-rich software: no vulnerabilities!
Gerald McGowan
Security and Privacy Officer
Monette Information Systems

I feel that the question this article alludes to is moot.

Yes, we can logically support that it is unethical to post "holey" code before giving the vendor a chance to fix it, but honestly, this is a reflection of the world we live in. Get used to it.

I also sympathize with Gerald McGowan (previous responder) in that we no longer have time to test before implementing fixes. The immediacy of patch implementation and the frequency with which they are delivered are overwhelming. I applaud Microsoft and others for building very complex, feature-rich OSs and apps, but I lament the fact that I need to "manage" security patch updates weekly across the enterprise as part of my scheduled tasks.

Posting "at risk" code prior to notifying the vendor is selfish, shortsighted and malicious. People who do so should be penalized. Hackers don’t think ahead to recognize the billions of people whose lives are damaged by each attack. Their limited vision provides them only with glimpses of short-term authority absent long-term responsibility and consequences.

We as IT must maintain vigilance on all fronts. We owe it to our organizations, families and coworkers.

The question is no longer should buggy code be posted for all to exploit, but how do we defend against the inevitable?
James A. Taylor
CEO
AICompany.com

While I strongly agree that we have to alert the masses that a danger exists, I just as strongly believe that publishing the code gives even the most novice hacker the keys to the city. That places many more systems in danger than is necessary.

Microsoft isn’t the only bad guy in this situation. We need to take some of the blame as we continually want bigger, faster, more fully integrated systems that will work with anyone’s hardware and software and be completely secure.