RE: Recent bugtraq postings

James,

Often you pi$$ me off with your comments.  But you are right on here.  It 
goes back to the flawed "security by obscurity" concept.  Joe's right, 
that the odds of it happening are limited.  But you're right in pointing 
out that it could happen.  Frankly, is the rexec service limited to only 
iSeries communications attempts?  Could not someone write a PC program to 
access that same service?

Rob Berendt
-- 
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





James Rich <james@xxxxxxxxxxx> 
Sent by: midrange-l-bounces@xxxxxxxxxxxx
04/23/2005 02:37 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
cc

Subject
RE: Recent bugtraq postings






On Fri, 22 Apr 2005, Joe Pluta wrote:

> Because my point was nothing like what you're complaining about.  My
> point is that the iSeries is a business computer and iSeries programmers
> are business programmers, and those who attach via client access are
> business users.  The idea of writing an iSeries program that would
> attack an end user's PC is ludicrous.

I don't think I missed your point at all.  My reply is simply that a 
security model that relies on the fact that its users are business users, 
its programmers business programmers, and is itself a business computer is 

no security at all.

If the flaw actually exists and is as described then it is a security 
problem. That the iSeries is a business computer doesn't somehow negate 
such security problems.  If there is a problem fix it, don't avoid it by 
saying everyone is too busy to notice.

James Rich

It's not the software that's free; it's you.
                 - billyskank on Groklaw
-- 
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.