🚀 go-pugleaf

In article <1994Dec1.022022.25768@cs.brown.edu>,
	Mike Shapiro <mws@cs.brown.edu> wrote:

>They're 
>already giving us a lot of information for free as it is, and providing
>free access to their advisories.  

I fail to understand the significance of this statement. Are you suggesting 
that because these advisories are posted "free" somehow that means that if we
"paid" for them we would be entitled to more information?


>A more reasonable suggestion was made
>to make one post which does not provide exploit details, followed by
>another post some time later, e.g. a week, which provides full disclosure.
>That seems to be the most reasonable compromise to me.

To me, its as useless as no post at all. As a system admin, I need to
understand the substance of a security hole to properly assess the
risk to my machines. Part of that involves knowing how it is exploited so I can
put together a response in my environment. Simply doing something like taking
a machine off the net, or disabling remote logins, may not be possible
given the circumstances. A temporary "work around" for you may not work for me.

Simply saying there is a bug in "login" that allows you to get root access
is next to useless. Using the "login" command I can gain root access to ANY
system I have access to -- all I have to do guess the proper password 
(half :))

MD
-- 
--   Who needs looks when you have taste?
--  
--   "I'm not a bigot -- I hate everyone."