🚀 go-pugleaf

In article <BwJ4H3.1Jp@rice.edu> jaw@owlnet.rice.edu (Joseph A. Watters) writes:
>In article <mumble>, fein@epg.nist.gov (Aaron Fein) writes:
>|> I am trying to establish a policy regarding downloading software 
>|> from the outside and find that I am walking a very fine line between
>|> protecting our system and limiting the "freedom and creativity" of 
>|> those who use the system.

>Please help me out here.  You work for NIST, so presumably do your
>users.  Correct me if I'm wrong, but it seems to me that unless a user
>has a work related reason to be downloading code, they shouldn't be
>doing it in the first place.  These are agency systems, meant to be
>used for agency business, not personal "freedom and creativity" for
>everyone on the system.

Arguable...

>Also, correct me if I'm wrong here, it seems that those few people who
>might have a valid, work related reason to be downloading source code
>would (should) also be sophisticated enough to look for trapdoors or
>trojan horses, and would also be involved in and concerned enough about
>system security to do source code audits on anything that they plan to
>compile from downloaded code.

You are wrong.  Just for example, how many man days do you think the
NIST should allocate to doing a source code audit of Emacs?  Even if
they did such an audit, do you really think they would find a larege
percentage of the security holes in the product?


-- 
-------------------------------------------------------------------------------
I am not an official Oracle spokesman.  I speak for myself and no one else.