bugtraq - RE: Your Opinion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 16 Mar 2007 16:15:32 -0400
From: "Scott Blake" <blake@...eport.org>
To: <bugtraq@...urityfocus.com>, <vulnwatch@...nwatch.org>,
	<full-disclosure@...ts.netsys.com>
Subject: RE: Your Opinion

Wouldn't it be wonderful if we could have this discussion without mentioning
the M-word?

It seems to me that the OS vendor's ethical obligation is to produce the
most secure platform they reasonably can and to fix any and all problems in
it for free.  Beyond that, lots of security problems exploit weaknesses in
things other than the OS (like, say, the users) and there will always be a
place (market?) for protection against those things regardless of how secure
the OS platform is.

Further, I'd bet that most of us are fans of defense in depth.  Even if an
OS was as secure as it could be and patches were free and ubiquitous,
wouldn't it be prudent to layer something on top of that?  If the OS vendor
is acting ethically, following the obligations mentioned above, what
difference could it make who produces the layered security product?

The so-called conflict of interest arises from the perception, rightly or
wrongly, that the OS vendor might be tempted to act in a less than ethical
manner.  If we presume ethics always and punish severely ethical lapses
(which we should do regardless), it doesn't matter who produces the security
platform.

It would be most interesting to have a poll on this subject, both of the
security community and the public at large.

Scott

-----Original Message-----
From: Mark Litchfield [mailto:Mark@...software.com] 
Sent: Friday, March 16, 2007 2:49 PM
To: bugtraq@...urityfocus.com; vulnwatch@...nwatch.org;
full-disclosure@...ts.netsys.com
Subject: Your Opinion

I have heard the comment "It's a huge conflict of interest" for one company
to provide both an operating platform and a security platform" made by John
Thompson (CEO Symantec) many times from many different people.  See article
below.

http://www2.csoonline.com/blog_view.html?CID=32554

In my personal opinion, regardless of the vendor, if they create an OS, why
would it be a conflict of interest for them to want to protect their own OS
from attack.  One would assume that this is a responsible approach by the
vendor, but one could also argue that their OS should be coded securely in
the first place.  If this were to happen then the need for the Symantec's,
McAfee's of the world would some what diminsh.

Anyway I am just curious as to what other people think.

Thanks in advance

Mark