The Lupper worm

Posted Nov 10, 2005 14:21 UTC (Thu) by jabby (guest, #2648) [Link]

I think he was mostly referring to the "fended off" terminology. I think that "fending off" carries a nuance of meaning in common usage that would imply that the server had _actively_identified_ the attack and specifically chose to ignore/deny it. Simply not understanding the request wouldn't qualify as an active defense, and certainly not a "brave" defense. :-)

I imagine he would suggest replacements along the lines of "dutifully ignored" or "failed to succumb to" or "drooled mindlessly at"... :-)

I'm not sure what more closely reflects reality. It would depend on how the patches were written, I suppose. If they are written to solve the problem at a low level (that is, causing the use of a pipe in the command to simply fail to parse), then it might be seen as more passive. If the patches were written at a higher level (where they would recognize a pipe being passed into a particular function and then not only refuse to execute, but also flag the situation as a potential attack), then that could be considered to be more of an active defense.