🚀 go-pugleaf

	Just to be annoyingly anal about this, the 8glm advisory said
that the problem was with "login".  So the smart thing to do is
disable programs and protocols that call login: telnetd, rlogind,
rshd, and if you don't have a secure console, getty or whetever it is
on SCO boxes that manages console terminals.  Your Web, ftp, News, etc
services don't need to be taken offline because of a bug in login.

	That aside, I'm still on the fence about the full disclosure
bit.  Right now I'm in favor of full disclosure, so that the problem
can be fixed as soon as possible.  An example would be the login bug
that cropped up in Linux a few months ago.  Because the linux
community is based on full disclosure, patches were out less than
three hours after the bug was reported.  (Less sloppy patches were out
a day later, after much debate on the "proper" way to fix the
problem.)  

	However, the same bug showed up in AIX, and it was a few days
before patches were available.  In this situation, every AIX machine
that had an rlogin daemon running was vulnerable.

	How about a policy of "three days warning" or something to
that effect.  8glm could send out a message as soon as a security
problem appears, giving recommended actions.  Three days later, when
everyone has had a chance to take those actions if they want, the
nature of the hole is described.  Perhaps several days to a week
afterwards, an exploit program might be released.  The point is that
making the announcement of a security hole in several stages might
solve many of the problems that folks have been pointing out as this
debate has raged on.  I'm sure that someone has suggested this before,
but I thought I'd raise the idea again.


--
Lee Silverman, Brown class of '94, Brown GeoPhysics ScM '95
Email to: Lee_Silverman@brown.edu
Phish-Net Archivist: phish-archives@phish.net
"Nonsense - you only say it's impossible because nobody's ever done it."