Re: DB2UDB hack

On 10/25/07, Joe Pluta <joepluta@xxxxxxxxxxxxxxxxx> wrote:

Especially the out-of-the-box experience is WORSE with i5/OS.

Agh. Can we drop this? If you spend tens of thousands of dollars on a
machine and you aren't prepared to secure it, you deserve what you get.

I'm sorry, but disagree with this basic premise. In a perfect world,
it would work out like this.

But the problem is that people don't care that much, and they make mistakes.

If you get in a car without knowing how to drive, you're going to get into a
wreck. If you start doing wiring in your house without knowing what you're
doing, you're going to die. If you go hunting without knowing firearms,
you're the Vice President of the United States... oops, cheap shot <grin>.

I can't start my AT car without pressing brake, because people
totalled their cars.
I can't start my bikes engine without being in neutral or having
pulled the clutch.

People make mistakes, and there should be safeguards for these mistakes.

i5/OS can prevent most(all?) buffer overflows. But why should it?
Programmers could just write stuff that does not HAVE buffer
overflows.

You expect more from a System Administrator than you expect from a
Developer. Why should the System Administrator be perfect, when the OS
protects the Developer who is not?

Anyway, if you expect the machine to be secure out of the box, then you will
be burnt. The trick is, how much does it take to secure the machine
properly, and how much does it take to keep it secure? And remember, with
Windows, you need to multiply that times however many servers in your server
farm.

Windows has a different model of operation, which has advantages and
disadvantages. I don't know how much you know about Windows
administration, but let me assure you that applying (not designing!) a
security policy on 500 servers does not require much more work than
applying it to only one machine.

And believe me Lukas, I'm not trying to downplay your concerns. I
understand your pain. At the low end SMB level, the tradeoff may be small
enough to justify the Windows machine. But that's the price you pay for
playing in the SMB space.

It's important to know that at the SMB space, the choice is usually
"Windows" or "Windows and a System i" (not always, just usually).

Just so that you don't get me wrong. I don't hate or dislike the
System i. I just think that there are lots of things that IBM needs to
get their hand on, and fix swiftly if they want to stay competitive.

(There are also a lot of things about Windows that are idiotic,
stupid, misengineered, overpriced, etc. but i don't think this is the
list to write about this)