bugtraq - Re: Your Opinion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 16 Mar 2007 12:29:42 -0700
From: Crispin Cowan <crispin@...ell.com>
To: Mark Litchfield <Mark@...software.com>
Cc: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org,
	full-disclosure@...ts.netsys.com
Subject: Re: Your Opinion

Mark Litchfield wrote:
> I have heard the comment "It's a huge conflict of interest" for one
> company to provide both an operating platform and a security platform"
> made by John Thompson (CEO Symantec) many times from many different
> people.  See article below.
>
> http://www2.csoonline.com/blog_view.html?CID=32554
>
> In my personal opinion, regardless of the vendor, if they create an
> OS, why would it be a conflict of interest for them to want to protect
> their own OS from attack.  One would assume that this is a responsible
> approach by the vendor, but one could also argue that their OS should
> be coded securely in the first place.  If this were to happen then the
> need for the Symantec's, McAfee's of the world would some what diminsh.
I've done both: sold a security enhancement for someone else's OS
(Immunix) and now I'm responsible for that same technology as part of
SUSE Linux (AppArmor).

I have no idea how Thompson gets his conflict of interest. It makes no
sense to me. I agree with Litchfield that it is an OS vendor's
responsibility to secure their OS as best they can, and using intrusion
prevention technologies is perfectly fair game.

However, Microsoft is a special case, because they have been legally
found to be a monopoly, and so special laws apply. So what Microsoft can
legally do may be different from what Red Hat, Novell, or Sun can do. I
am not a lawyer, so I won't speculate on what those differences might be.

Is Thompson talking about OS vendors in general having a conflict of
interest? Or just referring to Microsoft's monopoly status? I can't
tell, but it sounds like the former, and that sounds wrong.

Crispin

-- 
Crispin Cowan, Ph.D.               http://crispincowan.com/~crispin/
Director of Software Engineering   http://novell.com
AppArmor Training at CanSec West   http://cansecwest.com/dojoapparmor.html