Xref: utzoo comp.sys.misc:1825 comp.os.misc:614
Path: utzoo!attcan!uunet!husc6!rutgers!njin!princeton!phoenix!mbkennel
From: mbkennel@phoenix.Princeton.EDU (Matthew B. Kennel)
Newsgroups: comp.sys.misc,comp.os.misc
Subject: What does NeXT do about security?
Keywords: NeXT, security
Message-ID: <4006@phoenix.Princeton.EDU>
Date: 16 Oct 88 22:02:42 GMT
References: <360@elan.UUCP> <5806@killer.DALLAS.TX.US> <9265@bigtex.cactus.org> <1403@percival.UUCP>
Distribution: na
Organization: Princeton University, NJ
Lines: 22

If the optical disks on the Next machine are removable and writable,
then presumably the user of such a machine can write to his disk and
basically give himself root privileges.

In that case, in a networked environment, he can pretend to be any other
user.  How does a mail server, for example, know that a specific userid
is actually logged on to some node, or if it's some hacker masqureading
as the user?  Encryption/decryption of all files?  Same goes for
remotely mounted volumes.

I'm sure this problem has been looked at before, but the Next computer seems
like it will be the first time that this will be a prevalent problem.

Most Sun or Apollo clusters generally run diskless, or at least with some
central userid clearing house.  But apparently Jobs want you to be able
to take your disk with all your work on it to any Next machine you can find:
this is very different from most present workstation clusters, and would
seem to make validation very difficult.


Matt Kennel
mbkennel@phoenix.princeton.edu