Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!uunet!husc6!mit-eddie!ll-xn!ames!sdcsvax!ncr-sd!greg
From: greg@ncr-sd.SanDiego.NCR.COM (Greg Noel)
Newsgroups: comp.arch,comp.unix.wizards,comp.os.misc
Subject: Re: GNU Security (was Re: FSF et all)
Message-ID: <1828@ncr-sd.SanDiego.NCR.COM>
Date: Wed, 14-Oct-87 17:05:39 EDT
Article-I.D.: ncr-sd.1828
Posted: Wed Oct 14 17:05:39 1987
Date-Received: Fri, 16-Oct-87 06:11:38 EDT
References: <1494@geac.UUCP> <287@usl>
Reply-To: greg@ncr-sd.SanDiego.NCR.COM (Greg Noel)
Organization: NCR Corporation, Rancho Bernardo
Lines: 24
Xref: mnetor comp.arch:2646 comp.unix.wizards:4911 comp.os.misc:297

In article <287@usl> elg@usl (Eric Lee Green) writes:
   ...  [discussion of lack of security features in GNU] ...
>Call him a Utopian if you will, for believing in the Better Nature of
>Man. But hey, since he's doing it for free, and providing complete
>source, you can do whatever the heck you want to once you get the
>stuff, including, of course, adding your own security features to it.

Unfortunately, the reason that security features get such a bad rap is
that they usually \are/ add-ons.  If you have to do this, the security
aspects will neither be transparent nor cheap.  If security is designed
in from the beginning, you can do things to minimize or eliminate the
performance impact while making it as unobtrusive as possible.

Besides, it's easier to lower security barriers on a case-by-case basis
as the need arises than to run around frantically trying to plug holes
caused by an initial bad design.  (I've done both; believe me, it's true.)

I had hopes that the GNU project would be of great value by providing an
alternative to the commercial products.  It bothered me that the initial
products were so prolifigate with memory (thereby moving themselves out of
the market that has been the most supportive of them), but this issue kills
it for me.  Security is not an add-on.
-- 
-- Greg Noel, NCR Rancho Bernardo     Greg.Noel@SanDiego.NCR.COM