[Full-disclosure] RE: [ISN] How To Save The Internet

Arndt.WA_at_forces.gc.ca
Date: 03/23/05

  • Next message: Vladamir: "Re: RES: [Full-disclosure] CISSP Test" 
    To: jasonc@science.org, gillettdavid@fhda.edu, jericho@attrition.org
Date: Wed, 23 Mar 2005 11:24:14 -0500

    Jason Coombs wrote:
    >
    > David Gillett wrote:
    > > are the various rights of the owner
    > > of the CPU, the *operator* of the
    > > CPU, and the owner of the *data*,
    > > each of whom may have a more or
    > > less legitimate say in what code
    > > actually gets executed.
    >
    > Nonsense. Absurd, ridiculous nonsense.
    >
    > There is only one party who has any say over what code gets
    > executed by a CPU: the owner of that physical property.
    >
    > Everyone else can go fly a kite.

    Hold on. If you're dealing with a large company or government
    department, who "physically owns" the computer in question,
    you can't tell me that they're going to micromanage exactly
    what goes on with that system. They'll delegate the authority
    off to someone who'll actually run the equipment. That sounds
    like an "*operator* of the CPU" to me...
    >
    > Take your intellectual property fantasies and your heady
    > legal concerns to law school, they have no place in security
    > technology.

    I don't read "intellectual property" anywhere in David's
    position at all. He quite rightly separates the three obvious
    stakeholders in any computer system, be it a desktop or a huge
    data storage facility.

    When you're dealing with a system that's primary function is
    serving up reams of data (say a database), the access to that
    data will involve someone running "code" (read: an application).
    This access cannot be controlled solely by the maintainer of the
    computer(s) and other equipment that make up the DB. Similarly,
    isn't going to be the DBA, who's role is to maintain the data
    contained in the DB, either. In this example, a user running
    queries against that DB is exercising control and most certainly
    has a "say in what code actually gets executed" as a result. I
    don't think I need to point out that this user could even be
    someone external to your organisation, but I will anyway...
    >
    <Snip out Intellectual Property driven rant>

    I'm not trying to flame or troll here. I just think that in
    the world we live in now, where computers (and the CPUs they
    contain) are "operated" by various stakeholders, it is a hard
    sell to say that only one entity controls the resources in
    question. As the "owner" of the CPU, you might be able to say
    when it will be available (NO, I don't like you. Power off),
    but this won't help the bottom line. Same thing with an the
    folks assigned the role of "operator" - they're there to enable
    the business, not impede it. Users, be they your own or the
    customers your system is designed to serve, will always get
    a say. The issue here, as I see it, is to properly govern how
    the rights assigned.

    Like it or not, we're all here to ultimately make the end users
    happy. Besides, isn't security supposed to support and improved
    your operations? Your approach would, IMHO, do the opposite...

    Alex Arndt
    CISSP, GCIA
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Vladamir: "Re: RES: [Full-disclosure] CISSP Test"

    Relevant Pages

    • RE: [ISN] How To Save The Internet
      ... > executed by a CPU: the owner of that physical property. ... I don't read "intellectual property" anywhere in David's ... the rights assigned. ...
      (Bugtraq)
    • [Full-disclosure] Re: [ISN] How To Save The Internet
      ... Absurd, ridiculous nonsense. ... There is only one party who has any say over what code gets executed by a CPU: the owner of that physical property. ... The more you try to stuff Intellectual Property down people's throats as though it is “Property” that grants its “owner” rights equivalent to rights of real property ownership, the closer you push us to a complete abandonment of all IP protections. ...
      (Full-Disclosure)
    • Re: [ISN] How To Save The Internet
      ... Absurd, ridiculous nonsense. ... There is only one party who has any say over what code gets executed by a CPU: the owner of that physical property. ... The more you try to stuff Intellectual Property down people's throats as though it is “Property” that grants its “owner” rights equivalent to rights of real property ownership, the closer you push us to a complete abandonment of all IP protections. ...
      (Bugtraq)
    • Re: rt_mutex_timed_lock() vs hrtimer_wakeup() race ?
      ... // runs on CPU 0 ... bit is set, we are holding ->wait_lock, so the 'owner' can't go away until ... owner->pi_lock, the owner could than become blocked on a lock. ... So the protection was probably more on that boost = 1 and if we _are_ ...
      (Linux-Kernel)
    • New install problem on old hardware -solved
      ... the owner bought a new computer. ... So I bought a new MB, a copy of Windows XP Pro and a hard drive. ... The computer booted up just fine, but would not complete the installation of ... Finally, I took the heat sink off the cpu, scraped it clean and applied some ...
      (microsoft.public.windowsxp.help_and_support)