Bugtraq: Re: Internet Worm

[bet () ritz mordor com (Bennett Todd)]

Perry E. Metzger <perry () imsi com> wrote:
> You don't and can't know what you are messing up.
Then it's critically important to figure out what, and how to avoid messing
it up.

> The whole point is that the vendor is responsible for problems in
> their system and should fulfill its obligations to customers who've
> bought its software. Saying "quit bitching; use public sources" is
> dangerously wrong.
"The vendor is responsible" doesn't found like reality. "Wait for the vendor
to behave responsibly and fix it" is pretty dangerous too. Where does the
most responsible course lie? I dunno. But Sun has made it clear that they
won't be shipping a secure, robust OS anytime in the forseeable future.
Their response to security bug reports is "fixed in Solaris 2"; Solaris 2 is
still in alpha, in terms of robustness and stability, and promises to remain
so until the current crop of managers is fired at Sun. I ain't holding my
breath.

-Bennett
bet () mordor com