From: vjs@rhyolite.wpd.sgi.com (Vernon Schryver)
Subject: Re: Security hole in default /etc/passwd file under 4.0.x
Organization: Silicon Graphics, Inc.  Mountain View, CA
Date: Wed, 8 Apr 1992 07:23:48 GMT

In article <Apr.7.23.35.48.1992.24569@psi.rutgers.edu>, scooper@psi.rutgers.edu (Simon P. Cooper) writes:
> olson@anchor.esd.sgi.com (Dave Olson) writes:
>  ...
>                              .        ....    said "as shipped" we want
> >the system easy to use.  I personally feel that anybody whose machine
> >is accessible directly over the internet is crazy to run with any
> >accounts unpassworded.  A reasonably large number of our more 'unix naive'
> >customers are not in this environment, though.
> 
>    I am sorry, but I think you are viewing things through your
> _fire_walled_network_ rose spectacles :)
> ....

Yes, you are right about the glasses.  We have a firewall here.

It is also true that your machine with its direct Internet connection and
vulnerability to dimwits is in a tiny market, altho a market with large
influence on the real market.

The vast majority of all existing IRIS's, and more so all Indigos, will
never (before being obsolete) have direct Internet connections.  An IRIS
with a modem might be vulnerable to modem equiped jerks, but the vast
majority of all Indigos will never have a modem.  (DSP or no.)

These facts would distress someone lke me, a programmer mostly of network
and modem stuff, if it were not also true the next generation or the
one after that may be different.


>    SGI is the vendor, you are supposed to know what you are doing.  Why not
> take that responsibility?  I can assure you that customers will be far more
> irritated at SGI if a "cracker" gets onto a machine and erases their work than
> the potential problems caused by having to read documentation to get remote
> printing to work.

Where is it written "SGI knows what it's doing"?  We're just people doing
the best we can.  Part of that is paying attention to the numbers.  If 50
people would loose $10,000 to damage from nerd-wannabes, or 10,000 people
would buy a PC instead because a PC prints easily, what should a computer
company do?  A company in a market to which the commodity PC guys are
trying to escape?  A company that is a long way from #1, #2, or even #3 in
technical workstation market share?  I do not know if anyone here has made
such calculations, but they should have.  Such calculations do not mean
that anyone has any excuse for shipping a security bug (!), but that
issues of "usability vs. safety" cannot be put in any simple, Politically
Correct box.

Requiring customers to read any documentation, not just "more" is
completely hopeless.  That you read and write USENET shows you're very
unusual.  Most people don't RTFM, and we can't make them.  All we can do
is "dumb-down" the system, make it safe, easy, and less powerful.  ugh.

> ...
>    A bad analogy (hmm, I wonder why I thought of this :) might be;
> <<
>    A car salesman just sold me a "ready to drive" car with two cans of oil.
>    on the back seat.  When my engine blew up the only comment the salesman
>    made was, "Oh, didn't you know that you were supposed to install the oil?".
> >>

If an Indigo with an open lp account should not be sold what about the
millions of PC's and MAC's?

What about the customer who can't figure out how to print on his new
$10,000 workstation because of all of the "UNIX stuff"?  Who can go buy a
$5,000 MAC or PC and print without understanding much of anything?

I'm sometimes less than overjoyed by the continuing decline in the median
technical sophistication of SGI customers.  It's no fun to deal with the
same old problems from computer-uninterested users.  Then I check the stock
price and go back to the grind.

I think there are better solutions than no password on lp, but they take
time and effort to implement.  Should SGI have fixed the lp problem or
produced Crimson?  The competition from several hundred things like lp with
things like Crimson is very real.


Vernon Schryver,  vjs@sgi.com