Is finding security holes a good idea?

By Eric Rescorla. IEEE Security and Privacy, 2005

307 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Predicting vulnerable software components (2007, background): “Eric Rescorla argues that finding and patching security holes does not lead to an improvement in software quality [25].”
A Learning-Based Approach to Reactive Security (2009, background): “Our use of a linear function re ects a level of abstraction more appropriate to a CISO who can never fully defend assets, which we justify by observing that the rate of vulnerability discovery in a particular piece of software is roughly constant [29].”
Before we knew it: an empirical study of zero-day attacks in the real world (2012, background): “could not find the same strong evidence on a more limited data set [26].”
The Economics of Information Security (2006, background): “bug makes little dierence to the likelihood of an attacker finding another one later [ 11 ].”