🚀 go-pugleaf

A little bird told me that Jay Ashworth (jra@zeus.IntNet.net) wrote:
>
> So, seagull, what _you're_ saying is that it's no longer the system
> administrator's responsibility to take all appropriate and necessary
> measures to stay abreast of current security problems, check to see if
> they are subject to them, fix if possible, avoid if not, and know what
> sorts of attacks to look for?

That's funny...I don't remember saying that.  :)

Read my original post again, please.  I agreed that 8lgm's method of
saying "login is broken" and providing no other information is a poor
way of alerting sysadmins.  The person who made this objection had a 
valid point: if you're going to say something is broken, provide some
useful information. I believe he asked some decent questions, like
"Does the user also need to have an acocunt on the system?", and so
on.  This is useful: it provides us with information on which we can 
base our decisions.  If that information then in turn points to a need 
for a full disclosure, then go for it.  But I don't think we should be
blindly handing out exploitation scripts without that intermediate
step.


Cheers,
-+JLS

-- 
                    "The best way out is always through."
                              --Robert Frost

seagull@netcom.com                                     seagull@jg.cso.uiuc.edu