🚀 go-pugleaf

merlin@neuro.usc.edu (merlin) writes:
}Then do something about changing CERT policies.  They do not operate
}in a vacuum.

They pretty consistently discount anyone's claim of a "need to know"
to protect themselves though.

}		But I trust their current operations better than some
}random organization (8lgm) which publishes material likely to help a
}system cracker get into my less than completely up-to-date on needed
}security patches unix box.

And whose fault is that?

}				I don't have time or staff to devote to
}full time monitoring of security newsgroups -- nor do my people have
}technical competence to design security patches for our systems.

And whose fault is that?


If you think that just because it isn't being distributed in the open
so people who need to know CAN know implies that these problems aren't
being distributed underground, you're fooling yourself.  You're just as
likely to get hacked by someone knowledgeable and interested either way.

Obscurity only protects you from the bozos who couldn't do it themselves.
While I don't think exploit scripts that give away root are a *good*
idea, at least they give ME a way to quickly check MY systems.  I 
*make* time to keep reasonably current with security issues.  8lgm could
design their tests better (so that wannabes would have to actually know
what they were doing before getting root with them), but I prefer information
to ignorance.

I'm not a damn mushroom, and I resent people whining that because they
don't have tiiiime I must be treated like one.  They need to whine to
management explaining the fact that UNIX is a minefield of security
problems, and if the systems are expected to be secure time and manpower
needs to be applied to makeing them that way.
-- 
Pete Hartman		       Bradley University	pwh@bradley.bradley.edu
                   "Welcome to Jamaica mon, have a nice day."