🚀 go-pugleaf

In article <3bca3q$6dh@eldborg.rhi.hi.is>,
Rikhardur Egilsson <rikardur@rhi.hi.is> wrote:
| In <3bbrjo$ot@cat.cis.Brown.EDU> md@pstc3.pstc.brown.edu (Michael P. Deignan) writes:
| 
| >Boy, this one was really helpful. Maybe I should just disable the
| >"login" command until a patch becomes available, huh?
| 
| If someone breaks root at your site, at least you will have some clue as to 
| how it was done, right ?

No!

This gives me absolutely no help in determining where the problem lies,
how it can be utilized, what conditions open my system to attack (do
wrappers protect me?, does the intruder need a regular login as well?)
or anything else useful.

And my solution has had to be "take the SCO boxes off the net." Since I
have no information on the magnitude of the hole or how to fix it, or if
it requires other conditions other than the login program being present.

This "security by obscurity" policy is a crock; I've been helping keep
business systems secure for over 25 years, and full disclosure has
always been best, allowing the system administrators to understand and
evaluate the problems for their own machines. This "we won't tell you
what the problems is, but there is one, and the vendor will tell you
when it's fixed, but you won't be able to test it because the problem is
a SECRET only the few are allowed to know" policy translates to the
crackers having the info on their mailing lists and BBS's, while
legitimate system owners are in the dark.
-- 
Bill Davidsen (davidsen@tmr.com) UNIX Codger
	Will solve problems for money.
Stupidity, like virtue, is its own reward.