Messages in this thread | | | Date | Sun, 1 Nov 1998 16:29:31 -0600 | From | Mitchell Blank Jr <> | Subject | Re: Database vendors. Tsk :-) |
| |
(off-list)
Haines, Tony wrote: > Since I just subscribed... I didn't expect to get this kind of junk mail. > does anybody oversee what gets posted... or better still is there a code of > ethics sung or unsung.... Keep the Coporate marketing out of this. SUID by > itself is not a security risk..
You should realize that Chris Evans is THE biggest contributor to the LSAP and Linux security in general. And he made a valid point. And he did mention that he worked for Oracle - if it were really just a marketing ploy he wouldn't have mentioned it probably. And yes, suid might not *always* be a risk, but those of us who do auditing realize that it very often is (and its even more certainly a sign of ill-thought-out security design in general when someone makes a huge setuid program like that). This is a technical list - we can certainly understand the risks involved and interpret Chris's statement appropriately.
So, frankly, go fuck yourself. If you're only planning to contribute flames toward people who actually ARE doing security work, just unsubscribe yourself now.
-Mitch
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |