RE: Sources: Full and Partial Coverage

[security curmudgeon <jericho@attrition.org>]

On Tue, 8 May 2012, Steven M. Christey wrote:

: Tim and Brian,
: 
: EDB at least has a field that states whether they've independently 
: verified each issue or not, and it is very commonly referenced, so 
: that's one reason it has more focus than the others.  We do pick up 
: Packet Storm on a fairly regular basis.  We have not examined whether 
: inj3ct0r provides any additional or significant value, or any of the 
: dozens of similar vulnerability databases across the Internet.  The 
: commonality between all these sources increases the workload 
: significantly, so it had evolved (at least to the point of this Board 
: discussion) to more closely watch Exploit-DB than the others.

That is why I would argue for EDB. They have a vetting process in place, 
are quick to remove duplicate or bogus entries, etc. On the other hand, PS 
beats them by volume, but also has a high rate of junk entries (i.e. 
incorrect, very hard to understand, etc). I haven't done a real comparison 
with inj3ct0r, but my quick assessment is there is mostly overlap between 
PS / EDB.

Overall, I agree with the board's decision on EDB.