> The one to watch are the machines that allow remote shutdown via lan messages.
> They have a password scheme, but its unencrypted
Nope -- the one to watch are those implementing the "reboot from LAN
image" option.
I think, today, that is none, but the PC98, etc specifications make
some hilarious reading -- hilarious, that is, if so many of the
things suggested as likely to be required in near-future updates of
the spec weren't so damn stupid/short-sighted.
The afterthought (expressed in a footnote to the "reboot from LAN
image" option) to the effect "it may be advisable to develop an
authentication mechanism for this feature" is a classic example of
the contempt in which security is held amongst designers at Richmond.
Regards,
Nick FitzGerald
