I heard that somewhere on Twitter a discussion about publishing exploit PoCs arose. Good thing information security is so repetitive, and I can field most discussions by referring to previously written long-form blog posts: addxorrol.blogspot.com/2019/08/rashom…
Another note: Discussions make progress when new arguments are fielded, not when old ones are repeated, so I encourage y’all to write long-form posts with new arguments vs celebrating Groundhog Day on Twitter.
Before going to sleep, some troll-y arguments why exploits or PoCs should never be published:
Troll 1) I already know how to write them, so game-theoretically my lifetime income is maximized if my skill remains scarce. As such no teachable artifacts should exist.
Troll 2) Defenders being confused about how modern exploits work is great because it ensures that defensive resources are misapplied, ensuring sustainable economics on the offensive side.
Troll 3) Bugs in libraries have much better long term survival if no triggers are published, ensuring slower bug depletion and the survival of otherwise endangered species.
Troll 4) Mitigations for which people want to get promoted may look broken, endangering proper career progression.
I will try to think of more reasons tomorrow.
