Vendor Responsibility -- example

Article View: comp.sys.sun

Article #9240

#9240

From: Matt Crawford
Date: Wed, 23 Nov 1988 17:46

19 lines
1498 bytes

On the subject of vendor responsiveness to, and responsibility for,
security holes, a friend at a large commercial site sent me this, and
permission to post it.  It describes that site's discovery of the
anonymous ftp bug approximately ONE YEAR ago.

> It was rather odd how we discovered that one.  The Sun rep "stationed"
> at [this site] was doing alot of ftp activity one day (enough so that
> we noticed).  I just happened to move over to the offending Sun while
> said Sun rep was in the ladies room.  She had left the ftp nasties on
> her screen and when I saw what was happening I COULDN'T BELIEVE IT.
> So the Sun rep never showed/informed us of the bug; we informed her of
> the bug after noticing her screen.

You might keep in mind that one Sun employee's knowledge of the problem
does not imply that any other employee knew of it, but it is clear that at
some level there was what the internet community seems to consider
"irresponsible behavior".

	Matt Crawford

Technical Details

Message-ID: <8811151600.AA15455@oddjob.uchicago.edu>

Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!husc6!rice!sun-spots-request

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!attcan!uunet!husc6!rice!sun-spots-request
From: matt@oddjob.uchicago.edu (Matt Crawford)
Newsgroups: comp.sys.sun
Subject: Vendor Responsibility -- example
Message-ID: <8811151600.AA15455@oddjob.uchicago.edu>
Date: 23 Nov 88 17:46:35 GMT
Sender: usenet@rice.edu
Reply-To: Sun-Spots@Rice.edu
Organization: Rice University, Houston, Texas
Lines: 19
Approved: Sun-Spots@rice.edu
Original-Date: Tue, 15 Nov 88 10:00:42 198
X-Sun-Spots-Digest: Volume 7, Issue 26, message 8 of 12