Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Path: utzoo!utgpu!water!watnot!watmath!clyde!rutgers!dayton!meccts!ems!mark From: mark@ems.UUCP Newsgroups: comp.unix.wizards Subject: Re: UNIX-WIZARDS Digest V3#078 Message-ID: <159@ems.UUCP> Date: Tue, 10-Mar-87 23:22:27 EST Article-I.D.: ems.159 Posted: Tue Mar 10 23:22:27 1987 Date-Received: Thu, 12-Mar-87 23:39:08 EST References: <4836@brl-adm.ARPA> Sender: news@ems.UUCP Reply-To: mark@ems.UUCP (Mark H. Colburn) Organization: EMS/McGraw-Hill, Eden Pairie, MN Lines: 51 In article <4836@brl-adm.ARPA> black@ee.UCLA.EDU (Rex Black) writes: >> [ A request of details on holes in UNIX ] > >I feel that Gould was *extremely* ill-advised to post such a challenge, >much less allow someone to take them up on it. This so-called contest >really boils down into nothing more than an extremely advanced seminar >in how to destroy a Unix system. By the time this ACM "attack team" >is finished with their "project", every one of these people is going >to be a veritable black-belt in system destruction. It speaks pretty >poorly of Gould that they feel no compunction about encouraging people >to obtain this type of knowledge. > Althought I agree with Mr. Black about his concerns about the possible implications of allowing access to this kind of sensitive information, I can also see Gould's and ACM's point of view. I think that Mr. Black's is concerned that once the information about breaking a Unix system is shared with this 'attack team' that these same people will go around breaking system's for the fun of it may be taking the issue a little too far. Face it someone out there knows how to break the system, that is why ACM has solicited the response of the Unix community. They KNOW that there are people out there who can break a system. However, much care must be taken to make sure that the people who form this attack team will not use the technics that they learn to harm other people. After all, most black belts in martial arts do not run around killing people just for the hell of it. Gould is saying that they have produced the tightest system that they know how. However, they may have missed some holes, and they want to make sure that these holes are plugged. I think that it is admirable (if somewhat cocky, based on there past 'competition') of Gould to do this kind of QA. Only by breaking a system can you hope to fix the hole in it. How do you break it? Trial and error. It's similar to the fact that if nobody broke into houses, they would not be equiped with locks. If a locks is made to keep out burglars, what better way to test it than to have the best burgular try to pick it. Obviously, you must be able to have some sort of trust in the burgular first... This is done all the time in real life. Who do you think banks hire to reposess things? Ex-cons. Once again, I must reiterate that I do agree that care must be taken in the selection of the attack team. I would hope that whoever does the selection is aware of the magnitude of the information that they are dealing with. -- Mark H. Colburn mark@ems.uucp EMS/McGraw-Hill {rutgers|amdahl|ihnp4}!{dayton|meccts}!ems!mark 9855 West 78th Street Eden Prairie, MN 55344 (612) 829-8200 x235