RE: Recent bugtraq postings

["Hall, Philip" <phall@xxxxxxxx>]

> The following are my personal opinions and in no way reflect the official
> position of my employer or anyone else...

Patrick, they pretty much reflect mine!

---[ snip ]---

> So while some of the postings have bits and pieces that may be accurate,
> they all contain glaring inaccuracies which tend to sensationalize and
> magnify the ramifications of any of the parts that are accurate.
> 

I read the first such posting (the one about being able to invoke programs on 
your PC from the AS/400 via your CA session, and the 'risk' of running evil CL 
programs) and posted a copy the midrange security list. I posted it because I 
found it amusing. There were (as you stated) a couple of other postings, but 
they weren't as funny, so I didn't post them.

> I suspect most security experts would also agree that publicly announcing
> exposures without ever informing the vendor (before or after making the
> public announcement) is generally assumed to be grandstanding...

They are great examples of FUD, and of course have only one real purpose which 
is to sell someone's 'book'.

--phil