🚀 go-pugleaf

In article <40b1qq$suu@galaxy.ucr.edu>, jjs@dostoevsky.ucr.edu (Joe Sloan)
wrote:

> If memory serves me correctly, unix hackers had a handle on the problem
> within hours of it's outbreak, that being possible because of the open
> nature of unix.

Having OS sources doesn't help all that much when you are trying to figure
out what an application you don't have the source code to is doing.  The
only thing that works is sitting in a debugger, examining memory, and
stepping through the code, probably in assembler (since you probably have
no symbol information).  The run time characteristics are far more useful
than the compile time characteristics.  Once you've figured out what is
going on, having source code can be useful.

> Are you advocating "security thru obscurity"?

No.  I just don't buy the argument that things are more (or less) secure
because source code is available.  The holes exploited by the Worm were in
the systems for *years*.  Although others had claimed to have found these
holes before, no one bothered to fix them.  IMHO, a lot more of the
security problems are found by people having their systems attacked and
reacting than by pouring over the source code and proacting.

> Can you just imagine if this had occurred with nt?

Microsoft would rush to get a fix out.  Since they are constantly working
on the OS, they have the talent concentrated in one place.  Unlike the
free software crowd, they do have something tangible to lose (their
market, which they do care about having) if they don't fix the problem.
-- 
        Nevin ":-)" Liber       nevin@CS.Arizona.EDU    (520) 293-2799
                                                office: (520) 621-1815