RE: DB2UDB hack

From: Tom Liotta

Regardless, I actually believe that that's an element of Joe's
passion. He expects a significant degree of openness from IBM on
issues of security and regularly pushes for it by demanding evidence.

If such vulnerabilities exist and they're simply kept quiet, a
degree of risk keeps rising. The argument against 'security by
obscurity' is refuted many times over. Joe demands evidence because
(IMO) he intends to force any such vulnerabilities to be _fixed_ pronto.

I want to retire on this platform. That's why I'm on various beta teams.
So it's what you mentioned above Tom, and the fact that I want to stop the
Windows advocates dead in their tracks as they try to argue that Windows is
"as good as" or "almost as good as" i5/OS when it comes to security.

That's hogwash. Yes, a properly trained security administrator with lots of
time can keep a Windows server farm as secure as a System i, but it's not
easy. Certainly not as easy as securing a System i. And at the same time,
it's absolutely correct that most of us don't properly secure our systems,
so I'm glad that Patrick and John are chiming in, because it's important
that we know where the vulnerabilities are.

But there's a difference between having vulnerabilities (which all machines
do) and being riddled with security holes, which Windows has been and still
is to this day. (And that's why I'm being VERY careful about how I look at
PASE. The more I see about PASE, the less I like it on my system.)

Joe