From: brian%jaguar.cs.utah.edu@cs.utah.edu (Brian Sturgill)
Subject: Re: Why people bow and scrape before NT (long)
Date: 26 Aug 92 22:38:38 MDT
Organization: University of Utah CS Dept
Distribution: world 

In article <pQj-SC+@engin.umich.edu> spexet@engin.umich.edu (Dennis Robert Spexet) writes:
>In article <1992Aug26.190954.28937@hellgate.utah.edu> brian%jaguar.cs.utah.edu@cs.utah.edu (Brian Sturgill) writes:
>>The get a life comment was directed at you, one of those anal-retentive
....
>Oh my, now we are down to name-calling.  Without going into too much detail,

I thought when I told you to get a life that I was already down
to the name-calling level.... it's not like your posting didn't warrant it.

...
>>>Until it's rated as C2-secure by someone other than MS or yourself, then it
>>>cannot and should not be trusted as such.
>>
>>That's correct, if you must have C2 certification, then you must wait for
...
>>(at least as of a year ago, when I actually cared about such things) VERY FEW
>>that had been certified... can you say how many there are now?
>
>There aren't very many.  What is your point?  My point is, bluntly stated,
>that Microsoft and its supporters (namely yourself) are claiming that the
>NT platform satisfies a level C2 security rating.  Until said rating is
>assigned by an approved contractor, I cannot agree with your claim.

My point is that Microsoft's competition (most Unix vendors for example)
also states C2 level security and don't have it blessed by God either.
This is a common practice, and those that care know that this is the practice.
This just isn't a problem.

>It is irrelevent whether or not IBM, SCO, Sun, etc. are providing secured
>systems.  (They do.)  What is relevant is that MS is claiming something that,
>IMHO, cannot be claimed as yet.

No, as direct competitors to NT, it is quite relevant.

>In other words, having a "checklist" (your words) of various C2-level
>features does not automatically qualify the operating system as satisfying
>a C2 security class.  While NT may indeed satisfy such a checklist, the
>combination has not to my knowledge been tested as a whole.  This is just as
>important, if not even more so, than satisfying a checklist.
>
>This may seem "anal-retentive" to you, but system security by its very
>nature is anal-retentive.

No, system security is not anal-retentive... it simply requires precision
and unfortunately software development does not lend itself well to
precision.  What is "anal-retentive" is to not acknowledge the value of
having C2-level features, even if they are not certified.  It is nearly
impossible for a mainstream system to remain C2 certified because the
certification process takes longer than most places software release cycle.
I.E. by the time version 1.0 gets certified, version 2.0 is already shipping.

>
>>I came back from the NT Developer's conference with an arm full of glossies.
>>From memory: Hamiltion C-shell, Blue Sky Softwares complete suite of GUI
>>tools, Chameleon had TCP/IP add-ons.  I believe were 40 vendors
>>shipping products for NT, I'm sure that number grow daily.  Certainly
>>I intend to be shipping my product before NT's release.  SGI is already
>>shipping hardware that comes with NT running on it (check some of
>>my previous posts.. it had the phone number).  There are two or three
>>small companies shipping MIPS based machines made to the ACE spec.
>>Two of them have multiprocessors that run NT.  I think one was Acler, but
>>I don't remember the other one at all... someone want to help this guy
>>get a machine running NT and some apps? :-)
>
>According to the SGI rep I spoke to last week, NT-based platforms from
>SGI are not shipping yet to the general public, except for developers.
>This goes for Chameleon also.  While you may have some product announcements,
>they do not constitute shipping products.

They have an ad in Dr. Dobbs, there is no restriction to developers.  It's
true that mainly only a developer would want to run NT in it's current state,
but it is indeed publically available... If you've got the money, I'll
gladly obtain it for you.

>
>When you see some applications that are now shipping for NT (as opposed to
>being announced, or 3.1 apps), then come back and tell this newsgroup all
>about them.

MAJOR ANNOUNCEMENT FOLLOWS: :-)
Well they're here!!!! You put up the money and I'll arrange the purchase...
I won't even charge a handling fee.  Yes the shipping apps are intended to
go to developers, but it's not like they check your "union-card" or something.
If you want I'll make you a world-class version of hello, world and sell
it to you for a buck!  Then I could be the first to ship to
"non-developers".  This is a limited time offer, after NT ships I'm gonna
quadruple my prices. :-)

I'll sell you one on a C2-certified version of NT for $1,000,000,000. :-) :-)
	(delivery within 5 years!)

>You may find further references on this process in the appropriate
>books in the rainbow series, if you are interested.

Why thank you... I have them on the shelf in the other room... (this
part is not sarcastic, I do have them), wish I'd have thought to look at them.
(This last part is sarcasm.)

>>Gratuituous editing!!!!!  NT is not a system for end-users yet,  I don't,
>>didn't, and will not claim that it is.  It is however fully featured
>>minus the TAPE API and POSIX and miscellaneous small parts.
>
>The POSIX layer, to me, is not really a "small part".

Fine, use your OS/2 POSIX subsystem then!  Oh, forgot... not out yet. It's
promised though... Lee Reiswig said so at the OS/2 rollout at Spring
Comdex... wonder if it will be there next year... care to make a bet?

(LAME JOKE FOLLOWS)
Do you know the real reason Gordon Letwin is retiring?  He needs the time
to collect on all the "who'll get SMP first" bets. :-)

>>>SVGA is already running on many boards, though not all.  As for Windows
>>Bullshit... there are precisely 3 drivers available now, 2 of which
>>are in beta.  Only one supports seemless windows.  3 does not equal many.
>
>The nice thing about most video boards is that they support fewer hardware
>standards than video board makers.  That means that drivers specific to
>each video board maker do not have to be created.  For example, let's say
>that we have a VGA driver, an XGA driver, an 8514 driver, and an ET4000
>driver.  (We do.)  Four drivers.  Four may not be very many drivers to you,
>but I make the proposition that those four drivers would cover a majority of
>the current video board market.

Sigh...  guess IBM must of had you in mind when they decided things like
SVGA are unimportant.

>-- 
>D. Robert Spexet II, N0OKR   Internet:  spexet@math.lsa.umich.edu
>Department of Mathematics    BITnet:    user68xr@umichum.bitnet
>The University of Michigan   UUCP:      uunet!mailrus!math.lsa.umich.edu!spexet
>Ann Arbor, Michigan 48109


Brian