🚀 go-pugleaf

In article <C1H3u9.J2v@Novell.COM> Mark_Muhlestein@Novell.COM (Mark Muhlestein) writes:
>
>I appreciate the calm tone of this discussion, Brett.  Let's try to
>get any remaining questions cleared up.
 
As do I.  I think this may finally put a rest to these concerns.  I am glad 
someone from Novell.COM has taken the time top respond.

>>  [ Stuff about KNOCK.EXE deleted ]           
>
>OK, I think we can straighten this out.  The problem was found in
>December 1990, as nearly as I can determine.  The 3.10 patch was
>devised within two days of the bug report, and was officially made
>available early in January, 1991.  By the end of January 1991,
>thousands of downloads of the patch ("PASSFIX") had been done on
>NetWire.  The 3.11 release was cut mid-February 1991, and incorporated
>the bug fix.  The timing of these events was fairly close, so I can see
>why you might have been confused about this, although you are way off
>on the date of 3.10 patch.

OK.  I was not aware of any 3.10 patch until KNOCK.EXE was discussed on the
net (this group) about March or April 1992.  After a day or two of      
discussion someone from Novell (I think) posted that a patch was available on
NetWire and via the normal FTP sites. I got the impression that the patch had
just been written my Novell.  If it was in fact written and released in early
1991 then I am indeed way off.  I take your word that the patch was released in
January 1991, and I stand corrected.

>>Why?  Because they can hope that no one will ever find it, and then the
>>users will never have to be told that it exists, which will make
>>NetWare look better.  (A bad strategy, it would seem to me, as there
>>are plenty of hackers out there doing their best to find their way in.)
>>     - Brett
>
>As I mentioned before, the problem was not discovered in-house, so
>there was never any question of avoiding telling the users.  In any
>case I agree this would be a bad strategy, which is why I asked the
>question.  I hope this information helps clear things up.
 
True.  I was speaking hypothetically (probably not a great idea).  
I must say, I've brought these concerns up before and never gotten much in the
way of a response.  I am glad these issues have finally been cleared up (at
least for me).  I have never doubted Novell's resolve to create a secure
system.  It had just been my opinion that the way Novell handled security
breaches left something to be desired (deny that there is even the possible of
a security hole until some posts or threatens to post code to exploit a hole
then stall about the issue until a patch is written, then admit the whole,
release the patch, and state that most other NOS's have the same hole (which,
of course, is generally true)).

My main complaint has always been information.  I don't mind the fact that
NetWare is not 100% secure.  It never will be. While there is merit to the idea
that code to implement loopholes should not be posted to the net, I think that
it is reasonably to expect that NetWare administrators should be informed of
the nature of security breaches, so that they can evalute the security risk in
their own situation.  
 
However, those are all opinions.  All the factual stuff (such as the release
dates for the various patches) has been cleared up.  (And it is my opinion that
Novell is getting better with the way security breaches are handled).

>Speaking for myself only,
 
Same here.

>Mark_Muhlestein@novell.com

Thanks for responding.  It is good that someone with better access to the facts
that I has finally cleared most of this up.  Now the net should be able to 
get back to as close to normal as it ever is.  
 
        - Brett    (rfranken@cs.umr.edu)