Bugtraq mailing list archives
RE: Your Opinion
From: "Scott Blake" <blake () homeport org>
Date: Fri, 16 Mar 2007 16:15:32 -0400
Wouldn't it be wonderful if we could have this discussion without mentioning the M-word? It seems to me that the OS vendor's ethical obligation is to produce the most secure platform they reasonably can and to fix any and all problems in it for free. Beyond that, lots of security problems exploit weaknesses in things other than the OS (like, say, the users) and there will always be a place (market?) for protection against those things regardless of how secure the OS platform is. Further, I'd bet that most of us are fans of defense in depth. Even if an OS was as secure as it could be and patches were free and ubiquitous, wouldn't it be prudent to layer something on top of that? If the OS vendor is acting ethically, following the obligations mentioned above, what difference could it make who produces the layered security product? The so-called conflict of interest arises from the perception, rightly or wrongly, that the OS vendor might be tempted to act in a less than ethical manner. If we presume ethics always and punish severely ethical lapses (which we should do regardless), it doesn't matter who produces the security platform. It would be most interesting to have a poll on this subject, both of the security community and the public at large. Scott -----Original Message----- From: Mark Litchfield [mailto:Mark () ngssoftware com] Sent: Friday, March 16, 2007 2:49 PM To: bugtraq () securityfocus com; vulnwatch () vulnwatch org; full-disclosure () lists netsys com Subject: Your Opinion I have heard the comment "It's a huge conflict of interest" for one company to provide both an operating platform and a security platform" made by John Thompson (CEO Symantec) many times from many different people. See article below. http://www2.csoonline.com/blog_view.html?CID=32554 In my personal opinion, regardless of the vendor, if they create an OS, why would it be a conflict of interest for them to want to protect their own OS from attack. One would assume that this is a responsible approach by the vendor, but one could also argue that their OS should be coded securely in the first place. If this were to happen then the need for the Symantec's, McAfee's of the world would some what diminsh. Anyway I am just curious as to what other people think. Thanks in advance Mark
Current thread:
- Your Opinion Mark Litchfield (Mar 16)
- Re: Your Opinion bugtraq (Mar 16)
- Re: Your Opinion Jonathan Glass (GM) (Mar 16)
- RE: Your Opinion Mario Contestabile (Mar 16)
- Re: Your Opinion Crispin Cowan (Mar 16)
- Re: Your Opinion William A. Rowe, Jr. (Mar 16)
- RE: Your Opinion Scott Blake (Mar 16)
- Re: Your Opinion The Fungi (Mar 17)
- Re: Your Opinion Casper . Dik (Mar 17)
- RE: Your Opinion Jim Harrison (Mar 20)
- RE: Your Opinion Jim Harrison (Mar 17)
- RE: Your Opinion Alex Eckelberry (Mar 19)
- Re: Your Opinion Andrew Kramer (Mar 20)
- Re: Your Opinion Forrest J. Cavalier III (Mar 19)
- Re: Your Opinion Paul Stepowski (Mar 20)
- <Possible follow-ups>
- Re: Your Opinion Neil Dickey (Mar 16)
- Re: Your Opinion Jack Lloyd (Mar 20)
(Thread continues...)