@mttaggart posting here because i just shared the link with coworkers and don't feel like being recognized, but had a different (maybe naive) perspective on your latest at @ifin
The early rumors of 0-days in Netscalers were at best unhelpful, at worst a signal to attackers to increase their efforts on that attack surface.
I can't entirely get behind that. Did they contain actionable intelligence? No. But as much as they may have been a signal to attackers, they were also a signal to defenders to start looking, start demanding information from the vendor, and without that signal I think we would have seen the vendor continue to sit on the advisory on their timeline.
There's a lot of noise to signal in RUMINT, and I don't think we as defenders should dedicate much time or resources to addressing it, but I do think there's value in keeping our ears open and being generally prepared to act or investigate further where the volume hits critical mass or the combination of risk and confidence exceeds our thresholds. I think that also extends to sharing RUMINT at a personal level with careful attribution and clear delineation as rumor, so that others can make their own evaluations based on their threat models.
