🚀 go-pugleaf

A little bird told me that bill davidsen (davidsen@tmr.com) wrote:
>
> This gives me absolutely no help in determining where the problem lies,
> how it can be utilized, what conditions open my system to attack (do
> wrappers protect me?, does the intruder need a regular login as well?)
> or anything else useful.

This is a valid point.

> This "security by obscurity" policy is a crock; I've been helping keep
> business systems secure for over 25 years, and full disclosure has
> always been best, allowing the system administrators to understand and
> evaluate the problems for their own machines. This "we won't tell you
> what the problems is, but there is one, and the vendor will tell you
> when it's fixed, but you won't be able to test it because the problem is
> a SECRET only the few are allowed to know" policy translates to the
> crackers having the info on their mailing lists and BBS's, while
> legitimate system owners are in the dark.

This, IMHO, is not.  So your solution is to give every two-bit idiot
that doesn't have the brains to be a cracker, but enough brains to read
and be dangerous a sure-fire way of becoming 'root' on your system?  How
many crackers do you think there are in the world?  How many cracker-
wannabe's are there?  I'll bet you everything I own that the second group
is larger than the first.

And, not everyone who would be tempted to try this trick to login as 'root' 
is subscribed to mailing lists and/or BBS's.  There are quite a few
people in the world, however, that would be more than happy to try something
like this if they were handed the solution on a silver platter, whether
or not they have had any incliniations or desires to becoming a cracker
in the first place.


Cheers,
-+JLS

-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu