full-disclosure - Who's to blame for malicious code?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: steve.wray at paradise.net.nz (Steve Wray)
Subject: Who's to blame for malicious code?

> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of 
> Paul Schmehl
[snip]
> We expect people to change the oil in their cars regularly.  
> Why don't we expect similar behavior in the computer world?
> 
> Would you blame OpenBSD if a user got hacked because he 
> hadn't bothered to patch?

The car analogy is a good one I think, to an extent.

Something that I'm looking into at the moment are better ways
to manage computer systems (see www.infrastructures.org)

I think that the way we generally build and maintain computers today is
a lot like the way that cars were built and maintained in the days
before Henry Ford; each one is largely hand-build and maintained by
craftsmen (ok, crafts *people*).

There are ways to roll out identical builds and there are a few systems,
largely still under development, for maintaining numbers of machines
en-masse, but this really is in its infancy.

The IT trade needs to grow up a bit.

I fear that one of the problems in the IT industry, is that lots of
sysadmins are very *very* keen. They are hard working. They typically
*love* fixing computer problems.

Thats the problem.

They love fixing computer problems *so* much that they don't mind
when computers go wrong. They love it, especially the hands-on approach,
which is where all the time goes; manually logging in and editing files,
etc.

Me? I *hate* fixing computers. I am lazy as hell.
So I try to make sure that they *don't* go wrong in the first place.

Admins who leave it till something goes wrong and then *gleefuly* fix
it up are the bane of my existance.
;)