Re: The Register: OpenVMS among most-secure of operating systems

From: jlsue (jefflsxxxz_at_sbcglobal.net)
Date: 02/02/04

  • Next message: Simon Clubley: "RE: [OT] MyDoom = Microsoft + SCO" 
    Date: Mon, 02 Feb 2004 18:07:21 GMT

    On Thu, 29 Jan 2004 17:19:58 +0000, Andrew Harrison SUNUK Consultancy
    <Andrew_No.Harrison_No@nospamn.sun.com> wrote:

    >jlsue wrote:

    >
    >Since SunOS 4.x is out of support the answer is no. Similar
    >story with out of support versions of VMS/OpenVMS as well.
    >
    >Take LAND there is no CERT advisory for LAND refering to
    >OpenVMS or any other Compaq/HP layered product. We know
    >however that there was a vunerability not from a patch
    >report but from an ask the wizard answer.
    >
    >We also know that this vunerability is fixed in a later
    >release of the IP stack we also know that the version
    >of the IP stack that you need to upgrade from was the
    >one that was current when LAND was first reported.

    But the question is, then, how can you say that it wasn't patched when it
    was - albeit as a new version.? (I'm assuming that this was a point release
    update, if not, then this question doesn't apply).

    >> You can check google yourself (get it? That's one of YOUR argument
    >> techniques). Check responses from icerq4a, hoff, Killgallen, etc. They've
    >> tried (to no avail) to explain reality to you, but it's obviously a waste
    >> of time.
    >>
    >
    >Really perhaps you should check again rather more carefully.
    >Remember that you and google have never really got on.

    I don't actually need to check google on this as the posts are still on my
    hard drive (I'm using Agent). They have responded to most of the actual
    CERT advisories that you've continued on about. I have not seen any
    substantive reply on your part that addresses their posts.

    >
    >
    >>>Nor am I, outlandish claims would be ones that have no supporting
    >>>data to back them up. You forget that I have provided supporting
    >>>data.
    >>
    >>
    >> That makes no sense. You've made no claims, but yet you've provided
    >> supporting data? The only claim made was by one (or two) individuals tying
    >> CERT to some kind of nonsense conclusion. Almost everyone else in here has
    >> agreed that CERT is not, in itself, worthy of being called "proof" of
    >> secuity. However, others' who actually KNOW the source code, and also who
    >> have reviewed the advisories that you've presented as "supporting data"
    >> have shown the errors or weaknesses in your arguments. You
    >> counter-argument technique consists of this engaging tactic:
    >>
    >
    >Do you have a comprehension problem ?????????????

    No, I understand perfectly. You have claimed that CERT advisory counts is
    not a good measure of the relative security of a system. And I have agreed
    with your point in this matter. What's the problem?

    >>
    >> Well, you haven't proven whether it is providing an unsecure one yet. You
    >> have shown that, at one time, some software stacks were vulnerable, and
    >> this has been subsequently dropped as a product. And in more recent ones,
    >> not all of the "fixes" patch actual vulnerabilities that affect the
    >> security of the platform.
    >>
    >
    >What utter BS, POP, LAND, TearDrop they were all holes and there
    >are loads more BIND, SSH etc etc.
    >
    >Pay attention you seem to think that simply saying they don't
    >exist can conterweight your documentation, 3rd party reports
    >and the responses of your own engineers.

    I'm paying attention fine. You've shown that there are advisories out for
    these problems, but you haven't shown whether there is actually an
    exploitable vulnerability. That's all I'm saying. The existence of a
    patch does not prove that there was a security vulnerability.

    >
    >I have seen you post some unmitigated BS in the past but
    >this takes the biscuit.

    I find it telling that it is apparently impossible for you to respond to
    questions about your logic and reasoning without resorting to immature
    tactics, such as name calling, personal attacks, etc.

    >No I havn't its the responsibility of the corporation that
    >you work for. Who does it is irrelevant providing its actually
    >done. However what is most revealing is that no-one seems to want
    >to coordinate the different engineering teams into providing a
    >response for the platform as a whole.
    >
    >What an idiotic point.
    >> It's completely separate argument as to whether HP is responsible for
    >> releasing fixes for problems. But once again, we're back to whether you're
    >> talking about a real problem in a currently-existing product.

    Well, your reading comprehension of this part of the discussion has veered
    it off into the weeds so far it's impossible to get you back ontrack.

    You have no point here that anyone can actually address because you're just
    thrashing about in an anit-hp rant.

    >>
    >>>Someone has to have the responsibility for reporting
    >>>vunerabiliites to CERT (assuming you are going to bother)
    >>>if you don't want to report layered product vunerabilites
    >>>as part of the OS well fine but you have to report them
    >>>somewhere, currently they are entirely absent.
    >>
    >>
    >> Ah, is there an RFC converning this? I just want to make sure we're
    >> covering all our bases.
    >>
    >
    >Does that imply that you only fix security holes in
    >OpenVMS if they are covered by an RFC.

    And you're the one making comments about reading comprehension problems of
    others?

    The point is that you, personally, do not dictate how all companies are
    supposed to use or not use CERT. So, whatever you believe (quoted in your
    ">>>" paragraph above) is immaterial. You may have some valid points, but
    there's no industry-wide agreement on this.

    So your spouting on-and-on is pointless.

    >> But talk about yer spin.. now you're changing your original argument from
    >> one that states it MUST appear as an OS vulnerability. This ENTIRE
    >> discussion came about converning relative vulnerabilities in OSes, and
    >> OpenVMS in particular. So if you are changing your stance, please at least
    >> admit that somewhere first, and then we can discuss the new stance. I'm
    >> not saying I even disagree with it, but I don't know what it is yet.
    >>
    >
    >Ditto

    Yeah. It's much easier to NOT commit to making a point. Then you don't
    have to defend it.

    >>
    >> Just to be sure. Are POD and LAND vulnerabilities in the CURRENT IP stack
    >> (e.g., TCP/IP services)? Or is this only applicable to the one that was
    >> dropped some 4 or 5 years - and several software release versions - ago?
    >>
    >
    >Ditto

    How do you determine that this question is not a valid one? Merely because
    it paints you into a corner? The fact is that the current owner of
    OpenVMS, TCP/IP services, et. al. can only be concerned with those versions
    that are currently supported. To belabor any kind of "security" argument
    about an older, unsupported version will only declare open season on all
    older versions of your own OS that have very big, and unpatched security
    holes.

    >> If the latter, just let me know what the official ruling on how long all
    >> vendors are supposed to provide this kind of patch support for outdated,
    >> and even *unsupported* software. Is Sun following the same guidelines in
    >> all of it's products?
    >>
    >
    >Ditto

    Of course you want to claim it invalid. All hail Emperor Andrew! He had
    declared that everyone, except his favorite employer, must conform to his
    own ever-changing opinion on what's valid in the realm of CERT advisories
    and responses.

    >
    >>
    >>
    >>>And I always laugh at OpenVMS security BS merchants who are happy
    >>>to tout the number of CERTS for OpenVMS around while being unhapppy
    >>>to allow the layered products to be included.
    >>
    >>
    >> Again, this is a position that is based on completely false premises. Only
    >> one (or two) troll(s) are making any statements wrt to CERTS and relative
    >> OS comparisons. Nobody else in here has backed up their silliness.
    >>
    >>
    >
    >Wrong, Keith started this particular thread so I assume this means
    >that you think he is a troll as well.

    He started this thread with an article. If you want to debunk something in
    the article, have at it. But right now you're so far off the original mark
    that it's just a bunch of your own personal diatribes scribbling bits
    around the world.

    >
    >Fantastic set of points BTW you really scraped the bottom of the barrel
    >and thats saying something in your case.
    >

    Whatever. When you get me all the security patches for my Sun v1.0
    systems, then we'll talk.

    --- jls
    The preceding message was personal opinion only.
    I do not speak in any authorized capacity for anyone,
    and certainly not my employer.
    (get rid of the xxxz in my address to e-mail)

  • Next message: Simon Clubley: "RE: [OT] MyDoom = Microsoft + SCO"

    Relevant Pages

    • FW: {RTCProd#003-520-317}Windows Update Support Request
      ... support policy for Windows NT 4.0 Workstation SP6a. ... The Microsoft Support Lifecycle defines the support policies for all ... This means that after this date, Microsoft would no longer create ... security fixes for this platform, nor automatically post to WU, etc. ...
      (NT-Bugtraq)
    • Anybody compose grateful fees along the nice overwhelming column, whilst Mark especially acknowledge
      ... insurances unless Brahimi will therefore enquire afterwards. ... land Kareem's arena with conducts, ... Sometimes, meetings time but primary weddings, unless they're ... married representation in support of Lisette's section. ...
      (sci.crypt)
    • dont even try to dump a dress
      ... Yesterday Mary will doubt the land, and if Mustafa and so on ... Clifford and Faris administered the fierce messs in support of ... districts, footballs, and spendings are all straightforward and ...
      (sci.crypt)
    • RE: Vendor wants remote control of our Servers and Workstations
      ... Of course the age-old problem with security is that ... Vendor has significant access to your internal ... this vendor uses the same method to support a number ... customer and makes significant changes ... ...
      (Security-Basics)
    • Re: Both security mode with WSHttpBinding?
      ... I've been scouring the WCF Security Guide. ... and only bindings that support the Microsoft Message Queuing ... establish a binding which will support both transport security via ...
      (microsoft.public.dotnet.framework.webservices)