🚀 go-pugleaf

merlin@neuro.usc.edu's message of 14 Dec 1994 00:30:51 -0800 blathered:

 > Surely some legal genius could come up with a credible threat of
 > civil or criminal liability against 8lgm message originators for
 > something like aiding and abetting a specific identifiable crime
 > (e.g. the system breakin described above).  

And likewise, some other legal genius could come up with a case for
holding (say) CERT liable for *not* releasing similar vital security
information and thereby allowing somebody's system to be cracked.

Don't think that doesn't happen.

 > In my opinion, there should be a reasonable embargo period before
 > such announcements -- and no broadcast public announcement should
 > contain script or other information sufficient to accomplish a
 > system penetration.

What use is an embargo period, besides more time for breakins to
happen? Or do you propose that all "good guys" are magically connected
by telepathic link so we all hear before the "bad guys" get it on
netnews? Get a clue.

 > Please stop publishing system penetration aids.  Notify contact
 > people in the appropriate vendor organization.  Notify CERT and
 > other credible discrete computer security organizations.  But,
 > never broadcast enough information to compromise anyone's system.

Sure. What are we supposed to do, secure ourselves and sit back while
the rest of the world gets cracked because only the bad guys know? You
can do this and sleep easily at night?

 > I know CERT.  I trust their methods and announcements. 

Do you now? Well, I'm glad you feel comfortable. I don't. Just today I
got another useless CERT advisory in my mailbox, nothing that there
are "security problems" with Ultrix 4.3 and 4.3A and recommending
upgrading to 4.4. Nowhere is there an indication of whether there's
actually a kernel bug, or whether it's just the collection of binaries
mentioned as part of a "security upgrade kit" to 4.4. (Those are the
usual suspects - sendmail, rdist, /bin/mail... all of which are
ancient history on my machine.)

I don't like this one bit. 

--
   - David A. Holland             |    Any sufficiently advanced bug is
     dholland@husc.harvard.edu    |    indistinguishable from a feature.