From: Mike Marion <[EMAIL PROTECTED]>
Did a quick search and didn't see any talk of this on the list:
http://www.ranum.com/security/computer_security/editorials/dumb/
Should be required reading for anyone that wants to be a programmer, admin,
or
really work in any level of IT (especially management and execs should be
forced to read it too).
One problem with his enumerating badness point- if you do the opposite and
lock down anything but a list of apps, it can be hard to get things done.
Who here hasn't needed to write a quick program, or dl one from the web to
get something done before? Multiply that by everyone in a company. If you
had to get approval for every little app, you'd be in major trouble.
Another with his penetrate and patch point- there is no other way. Writing
100% secure software is at a minimum extremely difficult. It may not even
be possible (how do you prove a negative? What if someone comes up with a
whole new technique?).
All in all it feels like a rant without any real ideas of how to improve
things.
Gabe
--
[email protected]
http://www.kernel-panic.org/cgi-bin/mailman/listinfo/kplug-list
