HDTenEightyP/NetNews huggingface dataset:
From: jyanowitz@hamp.hampshire.edu
Subject: .plan as verification?
Organization: Hampshire College
Date: Sat, 26 Sep 1992 20:56:06 GMT

Hi all,

  Given the all the reasonable hullabaloo about verifying keys, what do
people think about, in the interim, placing copies of our keys in our
.plan (on unix and vms) so when people finger you, they can see a copy
of it.  Obviously, two flaws with this method are:
a) someone could create a fake account...
b) someone could intercept the finger requests.

Still, it's an idea to play with (we could also combine it with other
checks..none of which are great alone, but together make it more
difficult to spoof something).  In the end, we can never be sure
(even a phone call could be spoofed), but we can develop a certain degree
of confidence.  Also, if this idea is totally stupid, please don't flame,
I'm new at cryptography, so be nice :).

-- 
Jason
jyanowitz@hamp.hampshire.edu
finger my account to verify this public key!  (obviously this isn't a sure-
fire verification method, but it's better than nothing).
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0

mQCNAirCdxIAAAEEAK9cLwZRjzdSsYk/MPYIbT3xmJZ+73IxM8rPaOL5Mrh7Qojk
zXcNZr7VtY+b5Za/R1icmspKZDuxhsorejB39vK80hgLpB83Y2XQLxFw2TiV24uU
6URZfNC4so9pmGrH25qG2JtKceZ/vTmUOdc3iKM8B3mihzfS1//7Icoms1zTAAUT
tC1KYXNvbiBZYW5vd2l0eiA8anlhbm93aXR6QGhhbXAuaGFtcHNoaXJlLmVkdT4=
=k41S
-----END PGP PUBLIC KEY BLOCK-----

Newsgroups: alt.security.pgp,sci.crypt
From: ian@bvsd.co.edu (Ian Nelson)
Subject: Re: .plan as verification?
Organization: Boulder Valley School District
Date: Sun, 27 Sep 1992 13:49:18 GMT

How would I go about this.  I put my public key in my .plan, but shortly after,
I fingered myself from a different system and noticed that none of my .plan or
.project information is sent.  I think it might be because this is my school's
system and they might want to protect students..  Anyone know some tricks to
override this?
adv(tnx)ance,
Ian Nelson
-- 
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0
mQBYAiqtYqEAAAECWKssWKoVxXAu9S0A/rKepT1GT+PJjv+lHh1LyIYwI9gzfnoq
ydwdKIJ81qIDgkMAliSIOWZiGSYbXszmmspRDenRARe15NOEM36pGQAFE7ABh7Qc
Xref: sparky alt.security.pgp:58 sci.crypt:3545
From: ehrlich@cs.psu.edu (Dan Ehrlich)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: here is my key
Date: 29 Sep 92 21:05:49 GMT
	<MYCROFT.92Sep27030423@hal.gnu.ai.mit.edu>
Organization: Computer Science Department, Penn State University

In article <MYCROFT.92Sep27030423@hal.gnu.ai.mit.edu> mycroft@hal.gnu.ai.mit.edu (Charles Hannum) writes:

Chucky> In article <Bv7HML.B16@ibmpcug.co.uk> gtoal@ibmpcug.co.uk (Graham Toal)
Chucky> writes:
>
> Hmmm - there's an idea - a regular FAQ-like posting with collected
> public keys?

Chucky> I *strongly* urge you to read the PGP 2.0 manual.  After doing so, you
Chucky> should understand why this is a bad idea.

What manual are you reffering to?  There are a bunch of .doc and .txt files.
Do you mean pgpdoc[12].txt?

--
Dan Ehrlich - Sr. Systems Programmer - Penn State Computer Science
"Universities should be safe havens where ruthless examination of
 realities will not be distorted by the aim to please or inhibited
 by the risk of displeasure." - Kingman Brewster
Xref: sparky alt.security.pgp:34 sci.crypt:3499
From: cbbrowne@csi.uottawa.ca (Christopher Browne)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: .plan as verification?
Date: 27 Sep 92 14:40:07 GMT
Organization: Dept. of Computer Science, University of Ottawa

In article <1992Sep26.165606.1@hamp.hampshire.edu> jyanowitz@hamp.hampshire.edu writes:
>Hi all,
>
>  Given the all the reasonable hullabaloo about verifying keys, what do
>people think about, in the interim, placing copies of our keys in our
>.plan (on unix and vms) so when people finger you, they can see a copy
>of it.

I'm afraid you can't do that :-(.  I submitted that method of
verification to the patent authorities 4 days ago, (NOT!) and
subsequently posted the method on one of the PGP newsgroups.

Certainly it isn't a PERFECT method - but it's probably better than
e-mail, because it tends to involve a closer connection.  

Hmmm...  Could there be a way of using a Gopher server to do this sort
of thing?  I see another patent coming on...

-- 
Christopher Browne
cbbrowne@csi.uottawa.ca
University of Ottawa
Master of System Science Program
Xref: sparky alt.security.pgp:23 sci.crypt:3482
From: norstar@tnl.com (Daniel Ray)
Newsgroups: alt.security.pgp,sci.crypt
Subject: here is my key
Keywords: pgp
Date: 25 Sep 92 12:46:56 GMT
Organization: The Northern Lights, Troy NY

Not sure if this is worth much, but here is my public key for those
who collect them.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0

mQCNAirCabMAAAEEAM09aKfWXU4V1kq/gui9pj56apEmt/csLYg8RcJBsRSxjHi7
33c7HGvabIgJw8FACHD2LB/44oa+4PylzUnF/z6DZCLP0+xnEpUnEAptXiY4zEjT
Ii+bzTrG/mykeNooHLx/o6eV3zLbxxwb/kadHrYefnZE2QbH7CeT+k9zhrmrAAUR
tBxEYW5pZWwgUmF5IDxub3JzdGFyQHRubC5jb20+
=y9f/
-----END PGP PUBLIC KEY BLOCK-----

-- norstar
The Northern Lights, Troy NY                                 |      
tnl dialins: 518 237-2163 @ 300-2400 bps 8N1 $free         ` | /    
------------------------------------------------------   --- * ---  
UUCP: uunet!uupsi3!tnl!norstar                             / | .    
Internet: norstar@tnl.com                                    |      

Xref: sparky alt.security.pgp:30 sci.crypt:3493
From: mycroft@hal.gnu.ai.mit.edu (Charles Hannum)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: here is my key
Date: 27 Sep 92 08:04:23 GMT
Organization: MIT Laboratory for Computer Science


In article <Bv7HML.B16@ibmpcug.co.uk> gtoal@ibmpcug.co.uk (Graham Toal)
writes:
>
> Hmmm - there's an idea - a regular FAQ-like posting with collected
> public keys?

I *strongly* urge you to read the PGP 2.0 manual.  After doing so, you
should understand why this is a bad idea.

--
 \  /   Charles Hannum, mycroft@ai.mit.edu
 /\ \   PGP public key available on request.
Scheme  White heterosexual atheist male (WHAM) pride!
Newsgroups: alt.security.pgp,sci.crypt
From: jasper@bcl.santarosa.edu (Dane Jasper)
Subject: Re: .plan as verification?
Organization: Santa Rosa Junior College, Santa Rosa, CA
Date: Mon, 28 Sep 1992 21:39:14 GMT
X-Posted-From: pcs.santarosa.edu
NNTP-Posting-Host: sol.ctr.columbia.edu

>>people think about, in the interim, placing copies of our keys in our
>>.plan (on unix and vms) so when people finger you, they can see a copy
>>of it.

>I'm afraid you can't do that :-(.  I submitted that method of
>verification to the patent authorities 4 days ago, (NOT!) and
>subsequently posted the method on one of the PGP newsgroups.

>Christopher Browne

Why not?  Most of us are... Or am I missing something here?
Dane Jasper <dane@cs.santarosa.edu> - Computing Services, Santa Rosa JC
       PGP - Data Encription for the masses!  Get it and use it!
      Public key available by fingering dane@nermal.santarosa.edu
Xref: sparky alt.security.pgp:60 sci.crypt:3552
From: thantos@runic.via.mind.org (Paul Williams [SysOp])
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: .plan as verification?
Date: 28 Sep 92 19:27:08 GMT
Organization: Runic Writings / Lawrenceville, GA



jyanowitz@hamp.hampshire.edu writes:

>   Given the all the reasonable hullabaloo about verifying keys, what do
> people think about, in the interim, placing copies of our keys in our
> .plan (on unix and vms) so when people finger you, they can see a copy

   Hmmmm...  Too  bad  I  don't  have  a UNIX/VMS system...  Sounds like a
        pretty good idea at first blush.


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.0

mQBNAiq05BMAAAECAMhHbpLYkMQMao3SB9Qt/ddi6Gj3KZ3lHicc3Kx6iX94Hb4D
bDPn6knzrwLzVMCdUX0BWU+CW87+WuD5YSiiw+cABRG0LVBhdWwgQS4gV2lsbGlh
bXMgPHRoYW50b3NAcnVuaWMudmlhLm1pbmQub3JnPg==
=/Otn
-----END PGP PUBLIC KEY BLOCK-----
thantos@runic.via.mind.org (Paul Williams [SysOp])
Xref: sparky alt.security.pgp:45 alt.security:4482
Organization: Central Michigan University
Date: Monday, 28 Sep 1992 13:00:55 EDT
From: David Jelinek <34AAQ77@CMUVM.CSV.CMICH.EDU>
Newsgroups: alt.security.pgp,alt.security
Subject: PGP ported to VM/CMS?

I was wondering if anyone has ported PGP to VM/CMS or is working on
such a port?
Xref: sparky alt.security.pgp:21 sci.crypt:3477
From: mathew@mantis.co.uk (mathew)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Info-PGP Mailing List
Keywords: info-pgp mailing list
Date: 23 Sep 92 10:00:09 GMT
Followup-To: alt.config
Organization: Mantis Consultants, Cambridge. UK.

hmiller@lucpul.it.luc.edu (Hugh Miller) writes:
> systems.  It is primarily intended for users on Internet sites without access
> to the `alt.security.pgp' newsgroup.

I didn't see alt.security.pgp discussed on alt.config.  Many sites refuse to
carry alt groups which have not been mentioned in alt.config.  Perhaps if
you'd discussed the newsgroup properly instead of just blindly creating it, a
lot more people would have access to it and the mailing list wouldn't be
necessary.


mathew
-- 
PGP 2.0 public key
begin 644 mathew.pub
MF0"-`BJP<SX```$$`*.6X_'WX!53/_"F6AR#R@=E>D[WP0TQR%,&\@YU..UV
M3I*V<DGN^XBI02.TA<LJ0EZ4R__DV@'`^;M7^O.V&5&ZDF;`!1@C$:LF'QK$
MK3@)/K96>9I6QB**))A&>U789QUV2/O.S"L-=LZ.%/%E6;6M"3R,6X:+EWS7
G-^5K.;E%``43M!QM871H97<@/&UA=&AE=T!M86YT:7,N8V\N=6L^
`
end
Newsgroups: alt.security.pgp,sci.crypt
From: ebrandt@jarthur.claremont.edu (Eli Brandt)
Subject: Re: .plan as verification?
Organization: Harvey Mudd College, Claremont, CA 91711
Date: Sun, 27 Sep 1992 07:34:29 GMT

In article <1992Sep26.165606.1@hamp.hampshire.edu> jyanowitz@hamp.hampshire.edu writes:
>  Given the all the reasonable hullabaloo about verifying keys, what do
>people think about, in the interim, placing copies of our keys in our
>.plan (on unix and vms) so when people finger you, they can see a copy
>of it.  Obviously, two flaws with this method are:
>a) someone could create a fake account...
>b) someone could intercept the finger requests.

This is what I was planning to do... (as soon as I check over my
PGP).  It would be possible, I suppose, to install high-speed
search-and-replace hardware on all routers.  As I don't know what
the backbone connectivity is like, I don't know how feasible this is.
Probably expensive, though I'm sure the NSA would give its eyeteeth
for that kinda setup...

It would also be easy, as you say, for any fool to set up an
"eli@bogus.nsa.int" account and post "finger me for my key!" to the
net...  but this isn't really a cryptographic problem.  This is a
problem of initial verification, which can then be maintained by
cryptographic means.  Once you're known to have an account at a
given site which is associated with "the real you", claims of new
accounts elsewhere can be checked by key comparison.  

Another attack would be to subvert everybody's finger program, as
well as everything that can telnet to the finger port.  Really, if
the spooks can trojan everybody's telnet, they can trojan everybody's
PGP too.

The brute-force attack of breaking security on my system and lying
about my .plan when fingered (a sophisticated intruder could lie
only to the fingerd, not to me checking my .plan) could be checked
for by fingering your name from another machine.  Perhaps fingerd
could provide the following feature:  if I finger the bogus user
"callback:ebrandt" at a remote site, it will finger the user
ebrandt@<my IP> and pass me the result.  This would require the
attacker to break everybody's fingerd to get me.

While this doesn't provide sufficient security, it seems marginally
more difficult to forge a .plan than to forge a Usenet posting.
Saves bandwidth too.  :-)   (This could become significant when and
if people start attaching a slew of certifications.)

So, what grievous hole have I missed?

>Jason
>jyanowitz@hamp.hampshire.edu

   Eli   ebrandt@jarthur.claremont.edu
Newsgroups: alt.security.pgp,sci.crypt
From: mathew@mantis.co.uk (mathew)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: .plan as verification?
Date: 28 Sep 92 14:29:10 GMT
Organization: Mantis Consultants, Cambridge. UK.

hmiller@lucpul.it.luc.edu (Hugh Miller) writes:
>     That's where my PGP pubkey certificate is - just finger
> hmiller@lucpul.it.luc.edu.

Just one snag:  Those of us at UUCP sites can't finger you.


mathew
Newsgroups: alt.security.pgp,sci.crypt
From: ebrandt@jarthur.claremont.edu (Eli Brandt)
Subject: Re: .plan as verification?
Organization: Harvey Mudd College, Claremont, CA 91711
Date: Sun, 27 Sep 1992 23:52:02 GMT

In article <Bv8w77.4G9@ibmpcug.co.uk> gtoal@ibmpcug.co.uk (Graham Toal) writes:
> Most fingers already do this - finger user@site1@site2  passes the
>parameter user@site1 to site2.  In fact, if you're being silly, you

Of course, I neglected the obvious spook stratagem of watching all
outwards traffic and faking the callbacks.  The bottom line is that
if you can't trust your own machine, you're screwed.  Unfortunately,
many (most?) people (e.g. me) pass all traffic through a single
upstream node, which results in the same problem w.r.t. that machine,
which you probably trust much less.  Still, I think it beats news.

   Eli   ebrandt@jarthur.claremont.edu
Newsgroups: alt.security.pgp,sci.crypt
From: jasper@bcl.santarosa.edu (Dane Jasper)
Subject: Re: Info-PGP Mailing List
Organization: Santa Rosa Junior College, Santa Rosa, CA
Keywords: info-pgp mailing list
Date: Sat, 3 Oct 1992 17:40:56 GMT
X-Posted-From: pcs.santarosa.edu
NNTP-Posting-Host: sol.ctr.columbia.edu

>jasper@bcl.santarosa.edu (Dane Jasper) writes:
>> Mathew, you should use the -kea command to extract your key in an armortext 
>> file - this eliminates the need for UUen/decoding..

>Unfortunately, it makes the key 9 lines long instead of 6, and a .signature
>is supposed to be 4 lines.  Ah, well, so much for netiquette.

>mathew

Mathew - most of use have given up on putting our keys in sigs, and are 
instead using our .plan files, or just putting something in our sig to the 
affect of 'PGP key available by request'.

I think it's nice to have a line in your sig to let others know that you are 
using pgp - perhaps it will encourage it's widespread use.

Dane Jasper <dane@cs.santarosa.edu> - Computing Services, Santa Rosa JC
       PGP - Data Encription for the masses!  Get it and use it!
      Public key available by fingering dane@nermal.santarosa.edu
Xref: sparky alt.security.pgp:25 sci.crypt:3484
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Info-PGP Mailing List
From: jasper@bcl.santarosa.edu (Dane Jasper)
Date: 26 Sep 92 11:37:25 PDT
Organization: Santa Rosa Junior College, Santa Rosa, CA
Keywords: info-pgp mailing list

>mathew
>-- 
>PGP 2.0 public key
>begin 644 mathew.pub

Mathew, you should use the -kea command to extract your key in an armortext 
file - this eliminates the need for UUen/decoding..
Newsgroups: alt.security.pgp,sci.crypt
From: hirai@cc.swarthmore.edu (Eiji Hirai)
Subject: Re: here is my key
Organization: Information Services, Swarthmore College, Swarthmore, PA, USA
Date: Tue, 29 Sep 1992 20:47:11 GMT

ehrlich@cs.psu.edu (Dan Ehrlich) writes:
> What manual are you reffering to?  There are a bunch of .doc and .txt files.
> Do you mean pgpdoc[12].txt?

There's also the sci.crypt FAQ (available at rsa.com:/pub/faq), which
is useful to read when talking about RSA public key encryption.

Obligatory whine:
(1) why do people post their public keys?  One feedsite can mangle with your
public keys very easily.  I'd rather receive someone's public key via email,
finger or ftp rather than through netnews.  Sure, those are vulnerable too
but netnews is much easier to mangle lots of articles at a single choke
point.
(2) why don't people put expiration dates on their public keys?

--
hirai@cc.swarthmore.edu (Eiji Hirai)    :     :    :   :  : :: ::: :::: :::::
Unix Geek for Swarthmore College        :     :    :   :  : :: ::: :::: :::::
Information Services, Swarthmore, PA, US.       Copyright 1992 by Eiji Hirai.
I don't speak for Swarthmore College.                    All Rights Reserved.
Newsgroups: alt.security.pgp,sci.crypt
From: mather@sees.bangor.ac.uk (Paul Mather)
Subject: Re: Info-PGP Mailing List
Organization: Centre for Applied Obfuscation.
Keywords: info-pgp mailing list
Date: Mon, 28 Sep 1992 16:19:40 GMT
X-Posted-From: sol.sees.bangor.ac.uk
NNTP-Posting-Host: sol.ctr.columbia.edu

jasper@bcl.santarosa.edu (Dane Jasper) writes:
> >mathew
> >-- 
> >PGP 2.0 public key
> >begin 644 mathew.pub
> 
> Mathew, you should use the -kea command to extract your key in an armortext 
> file - this eliminates the need for UUen/decoding..

Actually, with all this talk recently about spoofing and such, perhaps
it's wiser to buck the trend and communicate ones key in a format other
than the standard "PGP PUBLIC KEY BLOCK" armourtext?

As I see it, general spoofing of all PGP users by THEM is infeasible.
Just think of the manpower involved?  However, it would be a *lot* easier
to detect and, if necessary, replace all PGP public keys in e-mail and
news postings if sent in the standard easy-to-recognise format.  I mean
folks, they do stand out a mile, don't they?

And even if THEY didn't want to actively spoof keys, but simply
sabotage keys and hence disrupt or stop the usage of PGP (which perhaps
THEY mightn't want people to use for some inscrutable reason), the
standard format for the "PGP PUBLIC KEY BLOCK" makes such sabotage
trivial.  A simply awk script could be used to search and replace
any such keys in e-mail or news postings.

Also, the "PGP PUBLIC KEY BLOCK" beacon makes it very easy for THEM to
see just who is using PGP, and to compile lists automatically if they're
looking for folks to take interest in.  (Not that THEY would ever do
that sort of thing, just like THEY would never jot down license plates
of those attending fringe group meetings and all of the rest of that
lovely COINTELPRO stuff that went down.  No, THEY would never go out
looking for "potential threats.":)

So folks, maybe we should all be looking at atob, uuencode, boo, et al
when we come to communicating our public keys to others?

Cheers,

Paul.

PS: Damn, this paranoia is contagious, isn't it? ;-)

Disclaimer:  Any resemblence between THEM and the NSA and PKP
is unintended and purely accidental. :-)
-- 
e-mail: p.mather@sees.bangor.ac.uk

If your mailer can't reach me, I'm obviously not worth talking to.

"And I wanna tell ya, if there's anybody here who doesn't believe that
 it is FUCKING GREAT TO BE ALIVE I wish they'd go now because this show
 will bring them down so much."

        --- Frank Zappa, "Call Any Vegetable", _Just Another Band From L.A._
Newsgroups: alt.security.pgp,sci.crypt
From: thiel@hardy.u.washington.edu (me me me me...)
Subject: Re: .plan as verification?
Organization: University of Washington, Seattle
Date: Mon, 28 Sep 1992 06:50:41 GMT

   Just a question, but: Why are public key's needed from everyone, and why
is certain verification of these keys needed?

thanks.
thiel

Newsgroups: alt.security
From: splee@alchemy.tn.cornell.edu (Seng-Poh Lee)
Subject: How safe is a setuid 'expect' script?
Organization: Alchemy International
X-Newsreader: TIN [version 1.1 PL6]
Date: Mon, 28 Sep 1992 13:05:20 GMT

Is a setuid 'expect' script safe, from a security standpoint? I know
a setuid shell script is a no no, but is an expect script any better?

Thanks

--
Seng-Poh Lee    <splee@alchemy.tn.cornell.edu>
Newsgroups: alt.security,comp.security.misc
From: wietse@wzv.win.tue.nl (Wietse Venema)
Newsgroups: alt.security
Subject: Re: How safe is a setuid 'expect' script?
Date: 28 Sep 92 19:29:35 GMT
Organization: Eindhoven University of Technology, The Netherlands

splee@alchemy.tn.cornell.edu (Seng-Poh Lee) writes:

>Is a setuid 'expect' script safe, from a security standpoint? I know
>a setuid shell script is a no no, but is an expect script any better?

This is FAQ stuff. I have sent a copy to the poster.

	Wietse
Newsgroups: alt.security,comp.security.misc,alt.sys.sun,alt.religion.computers
From: u9048979@cc.uow.edu.au (glen eastment)
Subject: DES - ENDORSED IN '92 ????
Summary: Did DES get endorsed again in Jan. '92?
Keywords: DES, NSB, NSA
Organization: University Of Wollongong
Date: Wed, 30 Sep 92 02:53:16 GMT

DES (Data Encryption Standard) was re-endorsed in '87 for another 5 years.
It was up for review in Jan. '92.

Could anyone tell me whether it was re-endorsed again ??

Thanks in advance!

Cheers!

<GE> a.k.a. u9048979@wampyr.cc.uow.edu.au

_____________________________________________________________________________
Disclaimer:	The opinions expressed above are not necessarily those of the
		University of Wollongong.
-----------------------------------------------------------------------------


-- 

<GE> a.k.a. u9048979@wampyr.cc.uow.edu.au

_____________________________________________________________________________
Newsgroups: alt.security
From: peter@ferranti.com (peter da silva)
Subject: Re: Xenix
Organization: Xenix Support, FICC
Date: Fri, 2 Oct 1992 18:51:46 GMT

In article <3569.9209300913@pyr.swan.ac.uk> iiitac@PYR.SWAN.AC.UK (Alan Cox) writes:
> Xenix isn't exactly secure either. There are standard tools floating
> around the dos/unix world which just scan hard disks for sectors
> beginning 
> root:
> print them out and ask if you want to kill the root password.

Yes, this is a technique that would be successful for any operating system
that doesn't encrypt disk data. But it does (as I remarked) require booting
another operating system... you can't just do it by playing with the console,
and if you use a SCSI disk you can't do it from a DOS floppy either.

'taint perfect, but it's better than passwords in CMOS.

> Quite literally if you can't physically lock the machine away you don't
> have a chance of making a machine secure.

Secure isn't an absolute. You can be more or less secure, and Xenix-386 is
more secure than a system that lets you boot into a single-user shell from
the hard disk without a password.

> Before you hug any wolves - remember little red riding hood

Red Riding Hood was a tool of the lackey capitalist anti-wolf forces.
-- 
Peter da Silva                                          `-_-'
Ferranti Intl. Ctls. Corp.                               'U` 
Sugar Land, TX  77487-5012
+1 713 274 5180                           Heb jij vandaag je wolf al geaaid ?
From: matthews@oberon.umd.edu (Mike Matthews)
Newsgroups: alt.security
Subject: Re: UNIX Boxes, which is most secure
Date: 26 Sep 92 21:38:41 GMT
Organization: /etc/organization

In article <80514@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:

>  Between A/UX 3.0 which is the Apple Macintosh implementation of Unix,
>NeXT which is natively UNIX based, and Sun OS, which is Windows NT based
>[NOT!] :-), which OS is the most secure for resisting hacking attacks,
>and which is the most secure if an unauthorized user gets console access?

If you get console access, security will not exist.  You can boot singleuser
(after taking apart the machine and removing the battery to get rid of
hardware monitor passwords, if need be) and you're root.

As far as which machine is the most secure or insecure, it all depends on the
system administrator.  The way they come out of the box, I don't think Suns
are all that secure (do they still have an /etc/hosts.equiv file of '+'?).
NeXTs aren't *too* bad, speaking from experience, but they certainly have
holes to plug (NeXTstep 3.0 fixes most of 'em).  I have no idea about A/UX.

>ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd)
------
Mike Matthews, matthews@oberon.umd.edu (NeXTmail accepted)
------
Hi there!  This is just a note from me, to you, to tell you, the person
reading this note, that I can't think up any more famous quotes, jokes,
nor bizarre stories, so you may as well go home.


Newsgroups: alt.security
From: chinson@chin.cs.ucla.edu (Chinson Yi)
Subject: help
Organization: UCLA, Computer Science Department
X-Newsreader: TIN [version 1.1 PL6]
Date: Tue, 29 Sep 92 23:40:10 GMT



Test I
--
   /\~ /\      O\_  "I think my golf ball landed around here."
 ~/\/\/  \~  +--\\\                          
~~ ~~~~~ ~~  |  /|@       
/      \   \ !  \ \  Chinson Yi (chinson@cs.ucla.edu 310-206-3584)
Xref: sparky alt.security:4479 comp.sys.novell:7700 comp.security.misc:1300