From owner-freebsd-security  Fri May 17 09:30:24 1996
Return-Path: owner-security
Received: (from root@localhost)
          by freefall.freebsd.org (8.7.3/8.7.3) id JAA29267
          for security-outgoing; Fri, 17 May 1996 09:30:24 -0700 (PDT)
Received: from mail6 (root@mail6.netcom.com [192.100.81.142])
          by freefall.freebsd.org (8.7.3/8.7.3) with SMTP id JAA29262;
          Fri, 17 May 1996 09:30:22 -0700 (PDT)
Received: from boris.scccc.com ([198.243.16.202]) by mail6 (8.6.13/Netcom)
	id JAA03734; Fri, 17 May 1996 09:30:17 -0700
Received: by boris.scccc.com (940816.SGI.8.6.9/940406.SGI)
	 id KAA10791; Fri, 17 May 1996 10:26:17 -0600
Received: from natasha.scccc.com(198.243.16.198) by boris.scccc.com via smap (V1.3)
	id sma010789; Fri May 17 10:25:56 1996
Received: by natasha.scccc.com (940816.SGI.8.6.9/940406.SGI)
	 id KAA15759; Fri, 17 May 1996 10:16:36 -0600
From: kduling@natasha.scccc.com (Kevin J. Duling)
Message-Id: <199605171616.KAA15759@natasha.scccc.com>
Subject: Re: very bad
To: owner-freebsd-security@freefall.freebsd.org (Glen Foster)
Date: Fri, 17 May 1996 10:16:36 -0600 (MDT)
Cc: jkh@time.cdrom.com, coredump@nervosa.com, freebsd-security@freebsd.org
In-Reply-To: <199605171100.HAA00301@ptavv.nsta.org> from "Glen Foster" at May 17, 96 07:00:35 am
X-Mailer: ELM [version 2.4 PL23]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-security@freebsd.org
X-Loop: FreeBSD.org
Precedence: bulk

> I, for one, am very happy that he announced it to the group rather
> than attempting STO.  I was able fix the systems for which I have
> responsibility immediately.  Thanks to Chris for getting the word out!
> ---
> Glen Foster <gfoster@gfoster.com>

I agree.  I once had a talk with Chris McDonald from WSMR about system
security and the debate about whether or not to protect your system through
ignorance or not.  I was a student at NMSU at the time, working on a paper
for system security on NMSU-NET.  My audience was my instructor who was
also my manager at the Computer Center.  Wow, did that stir up a hornets
nest, but that's another story...

If you don't announce the bugs, then the crackers learn them while the
admins are left in ignorance.  You're not going to find a forum where
you know you're only telling "the right people" about the problem.

Now I'm wondering about how many others are out there that I don't know
about because they weren't posted on the lists I read.

Who's Chris McDonald?  One of the few people who listened to Cliff Stoll.

-- 
Kevin J. Duling               /\/^\^/^\^\/\           SCC Communications Corp.
kduling@scc911.com          Boulder, Colorado         (303) 581-5769