Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!husc6!rutgers!ucla-cs!zen!ucbvax!jade!eris!mwm
From: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Newsgroups: comp.misc
Subject: Re: Security
Message-ID: <4245@jade.BERKELEY.EDU>
Date: Fri, 3-Jul-87 21:12:20 EDT
Article-I.D.: jade.4245
Posted: Fri Jul  3 21:12:20 1987
Date-Received: Sat, 4-Jul-87 19:38:21 EDT
References: <1517@rti.UUCP>
Sender: usenet@jade.BERKELEY.EDU
Reply-To: mwm@eris.BERKELEY.EDU (Mike (My watch has windows) Meyer)
Distribution: world
Organization: Missionaria Phonibalonica
Lines: 97

In article <1517@rti.UUCP> rcb@rti.UUCP (Randy Buckland) writes:
<I have been watching all the debate over the hacker schloarship and I would
<like to make a quick survey about security in general.

Not a bad idea; I just think the survey is slightly broken. Let's hack [*]
on it some....

<	1. Who has managed or worked seriously on a system that has had a

Good question. You left room for all the possible answers. You might
have provided multiple choice for the common cases, though.

<	2. How do you feel about hackers? (pick one)
<		a) Credit to the industry, freedom fighters, security testers?
<		b) Minor annoyance that can be handled with simple precautions
<		c) Major annoyance that takes a lot of time and effort to
<			control.
<		d) Serious problem, need strong laws, shoot the lot of them.

How about "other - describe?" I don't think any of the answers is
correct.

You're also missing some important questions, like:

	N. What kind of data do you store on your system(s)?
		a) nothing important
		<some other selections>
		x) data that is vital to one or more human lives
		next(x)) other - describe

	next(N). What type of security do you feel is apropriate for
			your data?
		a) None.
		b) None, the law should prevent it from being harmed.
		<etc>
		x) It should never appear anywhere that it could cause
			radiation, or on any permanent storage mieda, in
			unencrypted form.
		next(x)) other - describe.


<Now for some terms to be defined.

And here's where I think you went really wrong.

<	hacker - Lets just stick to the definition of someone trying to break
<		into a system where they should not be.

That's the definition in common use, as opposed to the meaning
attached by the people who first applied the term to computer types.
It seriously devaules the term, and "cracker" or something similar
should be used instead. Like trademarks and ethnic stereotypes,
allowing such misuse to pass eventually leads to it being accepted as
normal and correct. So it should be corrected at every occurence.

<	system - Multiuser computer system with serious information on it
<		pdp-11/vax power or higher. Has things like bank data,
<		company data, researchers programs, etc. (things that
<		would take a lot of effort to replace if damaged.)

Power should be inconsequential. Especially since buying something new
with less CPU than a VAX 750 (your average MAC has as much cpu as a
750) is hard, and buying something new with less power than a VAX 730
is probably impossible.

Likewise, difficulty to replace and value are different things. The
contents of my mail archives (~20 Meg from the last year) would
probably be impossible to replace. Most of it is worthless, though.
I'm just a packrat. Similarly, almost any micro-based BBS system has a
non-trivial message database. Replacing it is probably impossible;
it's value is probably close to zero.

You've also ignored an important aspect of online data. The amount of
damage done if it's missing may be significantly less than the amount
done if it's changed. I can see it now "Gee, Joe has had every loan
payment in on time. Why don't I make that 'late' instead of 'on
time?'"

This is why you need questions covering the value of the data on the
systems. Leave that aspect out, and just look at users. I'd suggest
something like:

	system - A computer system that supports multiple users (not
		necessarily simultaneously), trys to verify the
		identity of the users, and provides at least the
		illusion of allowing one user to protect their data
		from other users.

In other words, a system is anything that has some "security" that can
be cracked.

	<mike
--
I'm gonna lasso you with my rubberband lazer,		Mike Meyer
Pull you closer to me, and look right to the moon.	mwm@berkeley.edu
Ride side by side when worlds collide,			ucbvax!mwm
And slip into the Martian tide.				mwm@ucbjade.BITNET