🚀 go-pugleaf

>>>>> "Richard" == HEIN JR R C (h23@ORNL.GOV)

Richard> PLEASE!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Richard> Don`t post everything, if you must know the details e-mail someone,
Richard> don't just leave it sit so anyone can read it.

Security by obfuscation does not work, it never did, and it never
will. 

If you have access to the metal you can *always* get at everything in
the box, do anything, get any type of access. The procedures for doing
so on all kinds of platforms are "public knowledge", readily
accessible to everyone who wants it and available from a great number
of sources.

Anyone who owns a computer has a legitimate need to have this
information and vendors should *always* print it in the *standard*
documentation. When you forget your root and hardware password, we all
know it will happen saturday night in a panic situation with a
life-or-death deadline monday morning. Make sure you know how to
handle this *before* you need to do it.

Trying to keep the procedure for handling these things secret is
folly. There are simply too many people out there who need to know. I
understand that people feel bad about their stolen property, but this
is not and never was never the goal of having root or hardware
passwords.  Hardware password exist so that you can make workstations
publicly available and not worry too much about people becoming root
by rebooting the box.

Getting around these things takes at most 30 minutes, including taking
the box apart. It must be so since I, as an owner, must be sure that I
can always get a my box.

The fact that hardware passwords does not give you much in the way of
protection and that well prepared people can get around it quickly is
something else again. Never trust a machine that people can touch.
Never.

/Lars
--
Lars Fischer, fischer@iesd.auc.dk | It takes an uncommon mind to think of
CS Dept., Aalborg Univ., DENMARK. | these things.  -- Calvin