On Thu, Aug 16, 2001 at 11:47:18AM +0800, Ian C. Sison wrote:
> Not every package, but every package that listens for connections on the
> net.. Unless you want to open the possibility that one package may
> actually be a trojan, which is quite praning already.
>
Remember, paranoia is a VIRTUE in the world of information security! :)
Besides, I like not having too much excess fat on my systems that I'll
never use. Some tools may have creative uses that nobody has ever
thought of, so I'd prefer to keep these extra packages down to the
absolute minimum.
>
> What is that saying in CAT/CMT before? "Ignorance is no excuse for
> non-compliance" A sysad is a sysad is a sysad, they must be aware of the
> problems they face when administering NT. If they want to seat in the
> captain's chair, be ready for a ship full of problems, known and unknown.
>
> At the start it may be a walk in the park, with all the bells and whistles
> of the NT system, but then again...
>
I think that is the big problem with the way Microsoft makes its
software, which is why I think that few Microsoft-based systems will
ever be close to being secure. It's a fundamental flaw in their
development methodology. They've taken the ideal of shielding people
from "messy details" much too far. It's like that article on
salon.com on the dumbing down of programming. With NT and W2K they've
tried to excessively dumb down even system and network administration,
with predictable, and catastrophic results with regards to information
security. Code Red is only the latest.
--
Rafael R. Sevilla <[EMAIL PROTECTED]> +63(2) 8177746 ext. 8311
Programmer, InterdotNet Philippines +63(917) 4458925
http://dido.engr.internet.org.ph/ OpenPGP Key ID: 0x5CDA17D8
PGP signature
