FW: Information Anarchy

From: Robert Dennis (rdennis@ALPHAPROTECH.COM)
Date: 11/02/01 

Message-ID:  <EBC80FC0AD13D311B3D10008C7B1FF09018165DA@aptntpdc>
Date:         Fri, 2 Nov 2001 17:23:57 -0500
From: Robert Dennis <rdennis@ALPHAPROTECH.COM>
Subject:      FW: Information Anarchy
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It scares me senseless to hear Microsoft's recent stand on security.
It has become painfully clear that the practice of "bullying"
partners into compliance is being used by Microsoft now on its
customers. Referring to the security community as "information
anarchists" is frightening.

As a system administrator, I can not possibly keep up with the
security information, patches, service packs etc that are released. I
use the community as a source of information to help with common
problems, issues etc. I want to know how a patch works, what it
affects, and what is the experience of others to date. Often a patch,
or service pack fixes one problem, yet may cause another.

To quote Scott Culp "...regardless of whether the remediation takes the
form of a patch or a workaround, an administrator doesn't need to
know how a vulnerability works in order to understand how to protect
against it, any than a person needs to know how to cause a headache
in order to take an aspirin."

According to Scott Culp this is not necessary, and we should all
blindly turn our security and stability issues over to Microsoft for
management. In an environment with only Microsoft Software, this is
not possible, nor advisable, let alone in a mixed environment which
represents 99% of us out there. I would not go to a doctor regarding
an ailment, and take his prescription without asking what could cause
the ailment? How can it be avoided in the future? What is the risk in
taking this medication? Yet according to Microsoft we are all blind
lab rats taking aspirin without cause, or regard, or understanding.

To advocate this type of behavior is irresponsible and demeaning.
Recent policies regarding licenses, MSTPP, and others have created
headaches for IT departments, system/network admins all over.
MS01-052 was a disgrace. Not only did the patch create an unstable
environment, under Mr. Culp's prescribed course of action, we should
not understand a thing about and wait patiently for a remedy. If my
servers were down due to a "pushed" or any update for days, I would
loose my job. Is Microsoft willing to compensate me for this lost
earning? Just a thought, but probably not.

"Many people have faulted the patching process itself for the low
uptake rate. Fair enough - we do need to make it easier for users to
keep their systems secure, and Microsoft acknowledged this very point
in a recent major security announcement."

This statement speakes for itself, however, below, Scott Culp refers
to sensible sharing of information for the betterment of all as akin
to yelling "fire" in a crowded movie house.

"...this isn't a call for people for give up freedom of speech; only
that they stop yelling "fire" in a crowded movie house."

Shall we refer to Microsoft's recent initiatives as nothing more than
controlling, self-serving, protectionist, monopolistic practices (I
know the DOJ and Microsoft agreed to a settlement today on these very
types of issues.)

To quote Samuel Johnson "Example is always more effacious than
precept"

Maybe Microsoft will lead by example, not bullying tactics of the
past, we can all dare to dream.

Regards,

Robert Dennis
Network Admin
Alpha Pro Tech

-----BEGIN PGP SIGNATURE-----
Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>

iQA/AwUBO7ov16LUUAY7v+KDEQIC8wCeN1YtMgIqC3plCB2pDynl05XFAhYAmwb9
PlPDrW/qlUwoDzg1yfQMk1Ms
=B2h6
-----END PGP SIGNATURE-----

============================================================================
Delivery co-sponsored by Trend Micro, Inc.
============================================================================
BEST-OF-BREED ANTIVIRUS SOLUTION FOR MICROSOFT EXCHANGE 2000
Earn 5% rebate on licenses purchased for Trend Micro ScanMail for
Microsoft Exchange 2000 between October 1 and November 16. ScanMail
ensures 100% scanning of inbound and outbound traffic and provides
remote software management. For program details or to download your
30-day FREE evaluation copy:
http://www.antivirus.com/banners/tracking.asp?si=53&bi=245&ul=http://www.a
ntivirus.com/smex2000_rebate

Relevant Pages