Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.3 4.3bsd-beta 6/6/85; site ucbvax.BERKELEY.EDU
Path: utzoo!watmath!clyde!cbosgd!ulysses!ucbvax!info-vax
From: Magill@UPENN.CSNET (MSCF Operations Manager)
Newsgroups: mod.computers.vax
Subject: Does DEC even care about security issues
Message-ID: <8511180828.AA21362@ucbvax.berkeley.edu>
Date: Sat, 16-Nov-85 21:57:00 EST
Article-I.D.: ucbvax.8511180828.AA21362
Posted: Sat Nov 16 21:57:00 1985
Date-Received: Tue, 19-Nov-85 04:03:30 EST
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: The ARPA Internet
Lines: 50
Approved: info-vax@sri-kl.arpa

One aspect of the security issue overlooked in the
discussion is DEC's concern about security.
They don't really care about security - They will give
ANYBODY with the $$ the COMPLETE documentation to the
security system.
Andy is concerned with corporate vanity not Security.
........
If you are really serious about security one implements 
a program such as Sperry's. An OS/1100 site nominates
a Security Office to Sperry in writing. That individual
is contacted by Sperry and required to sign a "security
pledge" (my term). Then they are given one copy of the
Security documentation which is printed on special anti
"xerox" paper etc.
This person now has a legally enforceable responsibility
and obligation to safeguard security information both
for his company and for Sperry.
He has had these responsibilities explained to him and
has affirmed that he understands and will abidie by them.
Sperry is serious about security and has many government 
sites who are also serious about security.
Clearly DEC is not.
........
Any operating system which does NOT PERMIT its backup
system to enforce standard labels can't even joke about
security - they simply don't give a damm.
Any system which permits ANY user to arbitrarily overrule
standard ANSI tape labels cannot even jokeingly talk 
about secureity. I can not even protect my backup tapes
from users except by physically locking them up.
........
By the way, don't get me wrong, I like VMS. It's the
best operating system on the market since Sperry capped
the old RCA TSOS (later VMOS, later VS/9) operating 
system.... Funny VMS appeared about the same time as
VS/9 was capped... there seem to be an awfully lot of
people at DEC from Woster Polley and a surprisingly
large number of VMS developers who seem to know all about 
IDA.
Now if I could just find someone to explain WHY VMS has
such a wierd paging/swapping algorthym.... Did it ever
get published? What's wrong with demand paging? Demand

Enough is enough already....
Bill Magill
Operations Manager
Moore School Computing Facility
University of Pennsylvania

Magill@upenn-lrsm.csnet-relay