OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 2nd quarter (Apr-Jun) 1994: Re: UnixWare

Re: UnixWare

der Mouse (mousecollatz.mcrcim.mcgill.edu)
Fri, 29 Apr 1994 09:30:48 -0400 

> This all got started because I tried to remind people that
> CERT/CIAC/NASIRC/ASSIST/Santa Claus is not why we have problems; they
> didn't put the bugs in your systems, and they aren't responsible for
> fixing them.

No, but I had thought they had advertised themselves as a worthwhile
place to report them, and my perception, and apparently that of many
other people here, is that this is not the case.

> The bugs came from your vendors, and it is up to those vendors to
> provide working fixes.

In many cases, the bugs come from the original BSD (or sometimes V7)
code, and knowing this is valuable to those who are working with a
non-vendor version derived from that same code.  But CERT never says
anything like this; all they ever seem to say is "<foo> is a security
hole.  The following vendors have patched versions available, here's
where to get them.", which is useless in helping people with other
vendor versions, or people with non-vendor versions, decide whether
they are at risk.

That's one reason I subscribed to bugtraq - in the hope of actually
finding out enough about bugs to let me determine when I'm vulnerable.
And I'm glad to say it's done that.

					der Mouse

			    mousecollatz.mcrcim.mcgill.edu