lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <45FAF667.5000504@mibsoftware.com>
Date: Fri, 16 Mar 2007 15:56:23 -0400
From: "Forrest J. Cavalier III" <mibsoft@...software.com>
To: Mark Litchfield <Mark@...software.com>
Cc: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org,
	full-disclosure@...ts.netsys.com
Subject: Re: Your Opinion

Mark Litchfield wrote:

> I have heard the comment "It's a huge conflict of interest" for one company 
> to provide both an operating platform and a security platform" made by John 
> Thompson (CEO Symantec) many times from many different people.  See article 
> below.
> 
> http://www2.csoonline.com/blog_view.html?CID=32554
> 
> In my personal opinion, regardless of the vendor, if they create an OS, why 
> would it be a conflict of interest for them to want to protect their own OS 
> from attack.  One would assume that this is a responsible approach by the 
> vendor, but one could also argue that their OS should be coded securely in 
> the first place.  If this were to happen then the need for the Symantec's, 
> McAfee's of the world would some what diminsh.
> 
> Anyway I am just curious as to what other people think.

 From a technical standpoint, of course everyone at an OS vendor, even down
to the janitors, wants their OS secure as possible.

But the problem isn't the desire or the knowledge of the technology.

Anytime Thompson, or any software publisher CEO uses a vague term like 
"security platform," you know they have a marketing hat on, and their comments 
are going to be largely devoid of supporting detail.  That is not an indication 
these people are ignorant.

Second, I think at least part of what he left out is that developing, deploying, 
and maintaining software that performs malware identification and mitigation is 
a multi-faceted task.  In fact, all software publishing is complicated.  Success 
requires some marketing, a lot of research, some high-traffic and spiked 
distribution server access patterns, a clean parking lot, janitors, and did I 
mention some actual software development too?

So yes, there are lots of ways to get distracted.  Budget politics, marketing
choices, shareholder dividends, talent shortage, growth, acquisitions (did 
someone say Veritas?), currency fluctuation.

Claiming "conflict of interest" is a diversion.  The truth, I think, is that
competition keeps vendors honest, on their toes, and delivering increased value 
at decreased price.  Symantec would improve if they faced more competition, and 
MicroSoft would improve if they faced more competition.  It's how a free market 
works.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ