From: hallam@zeus02.desy.de (Phill Hallam-Baker)
Newsgroups: comp.os.vms
Subject: Re: FLAME ALERT>> Kerberos over SYSUAF
Date: 16 Oct 92 00:52:39 GMT
Reply-To: Hallam@zeus02.desy.de
Organization: Deutsches Elektronen Synchrotron, Experiment ZEUS bei HERA

In article <1992Oct13.124028.1@alien.gici.com>, laut@alien.gici.com (Bill Laut)
writes:

|>Example:  They have tons of LN03R Postscript laser printers, scattered
|>throughout 30 or 40 different plants.  As part of a consolidation move, the
|>network was being merged into a larger corporate network which is pure
|>TCP/IP.
|>DEC, in their foresight, split the intelligence for the LN03R between the
|>printer and the symbiont.  Then, they engineered the symbiont to only support
|>hardwired and LAT connections.  Duhhh, what do we do now?  The account rep
|>at the Colorado Support Center was forced into saying that there weren't
|>too many options available.  I.E., either run DECnet and LAT, or scrap your 
|>investment in LN03Rs.

IE the printer is not just a dumb printer but a "print server" which does rather
more than some other systems. And those extra feature require a connection
system with rather more intelligence than TCP/IP.

We run TCP/IP and DECNET and LAT with zero problems. We do have fun and games
with Novell poxy fleaboxes which send ethernet protocols they should not which
can cause ethernet storms (we have a solution, we turn off the IBMPCs).

So some joker who thinks he is a mega genius makes a political move to make
himself a bigshot by making eveything TCP/IP and in the process creates a lot of
work. I don't suppose you considered that creating the work was the whole point
of the exercise so that he could say "I told you this was a stupid system"?

|>You wouldn't believe what DEC's response to this was.  Any time we had a
|>system crash, the DEC residents were falling over themselves to see if it
|>was my driver that crashed the system, so that they could make a really big
|>stink about it, in order to force the code to be removed, and thus try to
|>re-force the issue of having to support DECnet and LAT.  Mind you, we had
|>more documented system crashes because of faults in VAX/VMS than we ever
|>did in my driver. 

If you had a single fault because of an unnecessary system change then you are
at fault.


|>
|>The situation quickly degenerated to the point that I had to tell the DEC
|>residents point-blank that I had a copy of the production source code
|>squirrled away off-line where they couldn't find it, and if there ever was
|>a system crash and they tried to make a stink out of it, I would extract
|>the driver from the crash dump, rebuild the driver from my secret kit, and
|>see if there were any differences, and if so, I would make an even bigger
|>stink about the appearance of our system being "sabotaged" for purposes of
|>"market share." That, and that alone, is what held them at bay. 

You sound paranoid, could this be why the DEC people found you difficult to talk
to?

|>I can't wait to see their reaction when they see the next thing I spring on
|>them:  *More* custom software to implement a DECServer-style load balancing,
|>but under TCP/IP!  I can hear the screams already... (%^@)....

Oh goody, we could do with something like that for our IBM 9000 (no don't laugh
we are into antiques here). They need to have LAT to get the thing connected
since otherwise the CPU ends up doing the I/O and not the front end processors.

|>I'm sorry if this turned into a flame.  I really do like DEC's products.
|>It's just they can be **arrogant*as*hell** sometimes, especially when it
|>comes to dominating the customer, both in terms of marketing and
|>engineering. The client feels that DEC views them as a "fatted lamb," and I
|>end up as the shepherd guarding the flock from the ravenous wolves. 

So? That is simply the game plan. Try dealing with *any* firm that thinks that
you are in their pocket. They all end up a real pain when the marketing side
wins the argument and they go out to stich up the customer. Look what Sun are up
to with Solaris - an "open system" that they are putting "private" hooks into so
that Sun hardware is always better than the competition and Sun software always
has an inside track. Look at what IBM did (and failed to to) with Microchannel.


|>	(heh, heh).  When the idea of even *bringing* Kerberos near the VAX,
|>a different DEC resident fired off a memo to me about how great VMS security
|>is, and how she didn't want stuff being "forced down our throats," etc.
|>
|>	The fact that DEC is really only a small island there in a sea of
|>other computer manufacturers, and that Kerberos likely will play on all of
|>them, didn't matter:  Everybody else has to bow in obseisance to the VAX.

Five years ago there was a good reason to get out of VAX and into UNIX, if you
needed price performance then UNIX was better. Now this is no longer the case
but there are a lot of people who have drawn their battle lines and got into the
fortifications and are fighting the old battle. Now the urgent need is to get
rid of UNIX, the operating system that succeeded only because Kellogs gave it
away free with packets of cornflakes.


|>I agree with all of this.  At first, I thought I would have to replace 
|>LOGINOUT with a custom version.  However, in another posting somebody (Sorry,
|>I don't have the name in front of me) mentioned that v5.5 has "undocumented"
|>hooks in LOGINOUT to allow for alternative authentication schemes.

They should be documented, they have been in for a while, look on the CD docs
5.4 I think had all the fanfare about new security stuff - all the changes for
getting B-1 or whatever recertified I would guess.

--

Phill Hallam-Baker