Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!rutgers!ames!ucbcad!ucbvax!jade!eris!mwm
From: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Newsgroups: misc.headlines,comp.misc
Subject: Re: Hacker Scholarship
Message-ID: <4049@jade.BERKELEY.EDU>
Date: Mon, 22-Jun-87 01:59:26 EDT
Article-I.D.: jade.4049
Posted: Mon Jun 22 01:59:26 1987
Date-Received: Tue, 23-Jun-87 03:55:14 EDT
References: <2757@mtgzz.UUCP> <345@genesis.UUCP> <532@houxa.UUCP>
Sender: usenet@jade.BERKELEY.EDU
Reply-To: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Distribution: na
Organization: Missionaria Phonibalonica
Lines: 84
Keywords: Wozniak, CU, Apple, security
Xref: mnetor misc.headlines:702 comp.misc:710

In article <532@houxa.UUCP> mel1@houxa.UUCP (M.HAAS) writes:
<to exist.  Why?  Who makes these decisions?  Why?

The people who design computer systems make some of them, the people
who run them make others.

<Why?  Call back and random password techniques are readily
<available, but aren't used.  Why? 

Sorry, but call back and random password technology *are* used. Just
not widely. Why? Because they tend to cost more, and are make getting
to a system harder for the legitimate users as well as crackers (*not*
hackers - hackers you put on your payroll and let them make your
system a nicer place to be).

<Why?  Our computer systems can be designed to be reliable and fault
<tolerant, but still require "superuser" gurus to administer them. 

Reliable and fault tolerant? Hmmm. The few I know of that actually are
cost lots of extra $$$s.

As for needing gurus, simple systems (a Macintosh, say) don't require
gurus to administer them. But a box that supports 20+ users is
noticably more complicated than a Macintosh, so you expect it to be
more complicated to run.

<I think the damage is being done by the people who bury their heads
<in the sand and foist these security horrors onto the public, not
<the college kid hackers.

Oh, horse pucky. You can buy secure systems if you want to. But they
cost (and cost, and cost). The public (since individuals very seldom
buy multi-user boxes, "the public" is actually closer to "corporate
america") chooses to spend fewer dollars for less security.

<Make it so that nothing gets onto any storage hardware in clear text.

How much extra will this cost? And what do you do about moving things
to other sites with different hardware and character sets?

<Don't allow anyone to get access to the system without their handy-dandy
<vest pocket gadget. 

How much more does this cost than a simple lock? How about the extra
inconvenience of having to carry a passcard and a key?

<Don't put anything over any line or cable in clear text.

How much does it cost? What do you do for dialin lines?

<Don't let anybody, ever, get into the system with "privileged" access.

So how do you do maintenance things that require privileges, like
reading all the files to back them up to tape? Privileged programs? So
who gets the privs needed to create those? The vendor supplies them
all (snicker)?

<Then, do as Woz suggests, and pay the
<brightest and best to find holes in the defenses.  And pay rewards
<for being a hacker and learning the next generation of techniques to
<cause problems.  ----  Then DO SOMETHING about the problems, don't let
<another 12 years or so go by with heads buryed.

All of which costs money. This cost gets passed back to your
customers. Pretty soon, most of your customers have gone to a less
secure and less costly system.

You forgot some important things, though. Make sure that *no* lines
carrying data go outside the machine/terminal rooms. Make sure both
rooms are EMF tight, including filtering on the power line. Of course,
that all costs mone too.

Face it: what people are willing to spend on security is less than the
percieved costs of having a system broken into. For most people,
that's significantly less than what real security costs, so they
settle for a placebo.

	"The only secure computer is one that's turned off."
	<mike
--
How many times do you have to fall			Mike Meyer
While people stand there gawking?			mwm@berkeley.edu
How many times do you have to fall			ucbvax!mwm
Before you end up walking?				mwm@ucbjade.BITNET