Review of Gray Hat Hacking Posted

Amazon.com just published my four star review of Gray Hat Hacking. From the review:

"'Gray Hat Hacking' (GHH) is positioned as a next-generation book for so-called ethical hackers, moving beyond the tool-centric discussions of books like 'Hacking Exposed.' The authors leave their definition of 'gray hat' unresolved until ch 3, where they claim that a 'white hat' is a person who 'uncovers a vulnerability and exploits it with authorization;' a 'black hat' is one who 'uncovers a vulnerability and illegally exploits it and/or tells others how to;' and a 'gray hat' is one who 'uncovers a vulnerability, does not illegally exploit it or tell others how to do it, but works with the vendor.' I disagree and prefer SearchSecurity.com's definitions, where white hats find vulnerabilities and tell vendors without providing public exploit code; black hats find vulnerabilities, code exploits, and maliciously attack victims; and gray hats find vulnerabilities, publish exploits, but do not illegally use them. According to these more common definitions, the book should have been called 'White Hat Hacking.' I doubt it would sell as well with that title!"

My review echoes most of Patrick Mueller's review in Information Security magazine, except for his comment that "The authors did, however, deliver on their ethical obligations to provide accurate countermeasures to the attack methods they describe--a true value to readers." This makes no sense to me. Defense gets a short 10 page chapter, which should have been dropped and replaced by a reference to any of the extensive tomes written about network defense.