From: spexet@engin.umich.edu (Dennis Robert Spexet)
Subject: Re: Why people bow and scrape before NT (long)
Date: Thu, 27 Aug 92 09:53:33 EDT
Organization: University of Michigan Engineering, Ann Arbor
Distribution: world 

In article <1992Aug26.223838.7436@hellgate.utah.edu> brian%jaguar.cs.utah.edu@cs.utah.edu (Brian Sturgill) writes:
>In article <pQj-SC+@engin.umich.edu> spexet@engin.umich.edu (Dennis Robert Spexet) writes:
>>There aren't very many.  What is your point?  My point is, bluntly stated,
>>that Microsoft and its supporters (namely yourself) are claiming that the
>>NT platform satisfies a level C2 security rating.  Until said rating is
>>assigned by an approved contractor, I cannot agree with your claim.
>
>My point is that Microsoft's competition (most Unix vendors for example)
>also states C2 level security and don't have it blessed by God either.
>This is a common practice, and those that care know that this is the practice.
>This just isn't a problem.

This information is incorrect.  Other vendors (namely IBM and Sun) *do*
provide secured versions of their products, which have gone through the
necessary testing and approval.  While the approval process may be tied
to the hardware/software combination, rather than just an OS, it is no excuse
for Microsoft to run around calling their product "C2-secured" when it has
not been formally verified.

To settle for anything less is a compromise.  How much of a compromise it is
can be left to the buyer.  For yourself, you apparently do not see too much
value in having such claims formally tested and verified.  I do.

>>This may seem "anal-retentive" to you, but system security by its very
>>nature is anal-retentive.
>
>No, system security is not anal-retentive... it simply requires precision
>and unfortunately software development does not lend itself well to
>precision.  What is "anal-retentive" is to not acknowledge the value of
>having C2-level features, even if they are not certified.  It is nearly
>impossible for a mainstream system to remain C2 certified because the
>certification process takes longer than most places software release cycle.
>I.E. by the time version 1.0 gets certified, version 2.0 is already shipping.

Precision?  Please explain yourself.  Your links between system security
and precision are most unclear.  Furthermore, while the individual "C2-level
features" do have value in and among themselves, the system as a whole
(remember, security is not just satisfying a checklist) is questionable
in satisfying said rating until it is actually tested.

As far as mainstream systems go, secured systems are generally not con-
sidered mainstream products.  Nevertheless, because Microsoft considers NT
to be a secured product up to a formal security level, and is promoting it
as such, it should go out and get the formal approval and rating.  Otherwise,
who have we, the buying public, to believe other than MS and its supporters?

>>According to the SGI rep I spoke to last week, NT-based platforms from
>>SGI are not shipping yet to the general public, except for developers.
>>This goes for Chameleon also.  While you may have some product announcements,
>>they do not constitute shipping products.
>
>They have an ad in Dr. Dobbs, there is no restriction to developers.  It's
>true that mainly only a developer would want to run NT in it's current state,
>but it is indeed publically available... If you've got the money, I'll
>gladly obtain it for you.

As I have stated before, advertising and product literature do not make
a product.  Also, while it is nice for developers to be able to obtain 
pre-release versions of various pieces of software, that does not imply
that said software is "available" for the general public.

In other words, a "pre-release" version of a product does not make a 
"finished product".  So as not to be confused with symantics, I consider
a "finished product" to be one that is intended for mass consumption by
the general public.

>>When you see some applications that are now shipping for NT (as opposed to
>>being announced, or 3.1 apps), then come back and tell this newsgroup all
>>about them.
>
>MAJOR ANNOUNCEMENT FOLLOWS: :-)
>Well they're here!!!! You put up the money and I'll arrange the purchase...
>I won't even charge a handling fee.  Yes the shipping apps are intended to
>go to developers, but it's not like they check your "union-card" or something.
>If you want I'll make you a world-class version of hello, world and sell
>it to you for a buck!  Then I could be the first to ship to
>"non-developers".  This is a limited time offer, after NT ships I'm gonna
>quadruple my prices. :-)
>I'll sell you one on a C2-certified version of NT for $1,000,000,000. :-) :-)
>	(delivery within 5 years!)

Your sarcasm has been noted and ignored.

>>You may find further references on this process in the appropriate
>>books in the rainbow series, if you are interested.
>
>Why thank you... I have them on the shelf in the other room... (this
>part is not sarcastic, I do have them), wish I'd have thought to look at them.
>(This last part is sarcasm.)

They contain much valuable information for the interested reader.

>>>Gratuituous editing!!!!!  NT is not a system for end-users yet,  I don't,
>>>didn't, and will not claim that it is.  It is however fully featured
>>>minus the TAPE API and POSIX and miscellaneous small parts.
>>
>>The POSIX layer, to me, is not really a "small part".
>
>Fine, use your OS/2 POSIX subsystem then!  Oh, forgot... not out yet. It's
>promised though... Lee Reiswig said so at the OS/2 rollout at Spring
>Comdex... wonder if it will be there next year... care to make a bet?

The fact that OS/2 currently has no POSIX subsystem is irrelevant, since
IBM does not claim that OS/2 has one.  Microsoft, on the other hand, claims
that NT has or will soon have a POSIX subsystem.  I don't see one in the
copy of NT that I have.

>>>>SVGA is already running on many boards, though not all.  As for Windows
>>>Bullshit... there are precisely 3 drivers available now, 2 of which
>>>are in beta.  Only one supports seemless windows.  3 does not equal many.
>>
>>The nice thing about most video boards is that they support fewer hardware
>>standards than video board makers.  That means that drivers specific to
>>each video board maker do not have to be created.  For example, let's say
>>that we have a VGA driver, an XGA driver, an 8514 driver, and an ET4000
>>driver.  (We do.)  Four drivers.  Four may not be very many drivers to you,
>>but I make the proposition that those four drivers would cover a majority of
>>the current video board market.
>
>Sigh...  guess IBM must of had you in mind when they decided things like
>SVGA are unimportant.

Aren't many SVGA modes based on an ET4000?

>Brian

-- 
D. Robert Spexet II, N0OKR   Internet:  spexet@math.lsa.umich.edu
Department of Mathematics    BITnet:    user68xr@umichum.bitnet
The University of Michigan   UUCP:      uunet!mailrus!math.lsa.umich.edu!spexet
Ann Arbor, Michigan 48109