Sleepycatz

Paranoia(?) and Info

Well, it’’s been a busy couple of weeks. Things we should all be aware of:

Meanwhile, our governmental leaders have been busy trying to fix what is not broken. A series of last minute additions to the Homeland Security Bill have strengthened penalties against “hackers” and allow carriers to become snooping agents of federal law enforcement. Additionally, the bill now encourages software manufactures to report security flaws by ensuring confidentiality. The bill goes so far as to preempt Freedom of Information Act (FOIA) requests. Although the privacy issues raised by these addtionsto the bill are frightening, and there are several good resources to get involved in these issues (see CDT for example), this notion that secrecy is equivenlent to security in computer systems is just asinine. As a terrorist or hostile agent it would be far easier for me to find a undocumented security bug and exploit it, then to use a known bug which administrators have knoweldge of, and have patched or adjusted for. The greater problem is that large software companies (such as Microsoft) are already discouraged from releasing bug reports, due to adverse reactions in the market place — after all who really believes they can run a secure website on IIS nowadays — and to allow them to hide security holes within the government gives them an additional shield against criticism and does not allow the bug to be fully explored - most bugs are not fully fixed in the first patch release, and many fixes have relied on users in the wild to pinpoint all possible exploits within a given bug. Additionally, this type of provision creates two classes of operators — those in the know (presumebly Government systems) and the rest of us. How can we, as ops, trust any software provider — or goevernment agency — who is aware of insecurities in our systems, but won”t share that information with us? I guess Orwell was right: “War is peace. Freedom is slavery. Ignorance is strength.

This entry was posted by steve on Friday, November 15th, 2002 at 6:47 pm and is filed under Internet, Politics. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.