🚀 go-pugleaf

Well...'how about the attitude....


If I run a system, then it is my responsibility to maintain security.
if you don't like the way I maintain it, then don't use my system,
or report your concerns to my boss (NOTE: THIS IS ONLY AN EXAMPLE,
NOT MY OPINION....).

I still believe that "logging in to a users account and sending them
mail from their own account" is not the proper way to inform someone of a
security hole. This is akin to removing all files on a system to show someone
that all files can be removed. Furtermore, if you are not the sysadmin
on that system, it is not your responsibility to insure that another
user has a good password. All you are responsible for is maintaining
your own password as being safe. How do you think the sysadmin is
going to react when a user tells him/her that "someone broke into my
account"? 

-- 
Jon Alperin
Bell Communications Research

---> Internet: jona@iscp.bellcore.com
---> Voicenet: (908) 699-8674
---> UUNET: uunet!bcr!jona

* All opinions and stupid questions are my own *