Subject: RE: [Asrg] DCC and IP checksums

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 12 Mar 2003 15:01:39 -0800

I was hoping that we could avoid further rants on this topic.

Security is about risk control, not risk elimination. It is certainly
not the result of blind implementation of dogma.

The Authentication/Authorization distinction is a decomposition of
the problem that has value in certain circumstances but certainly
not all.

The design of the code signing services was to ensure that code
obtained through the web was at least as trustworthy as code bought
in a shrinkwrap box in a store. It was not to eliminate all possible
risks.

If you want to see an example of an environment that does provide
the degree of control you seek look at .NET.

However we do not need that degree of flexibility to solve our 
problem here.

The perfect is the enemy of the good.
The ideological is the enemy of everything.

		Phill

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, March 12, 2003 5:52 PM
> To: Hallam-Baker, Phillip
> Cc: 'Vernon Schryver'; [email-masked]
> Subject: Re: [Asrg] DCC and IP checksums 
> 
> 
> On Wed, 12 Mar 2003 14:42:02 PST, "Hallam-Baker, Phillip" 
> <[email-masked]>  said:
> 
> > Microsoft employ many people whose credentials in the 
> security world vastly
> > outrank your own. In addition to Roger Needham who recently 
> passed away,
> > Butler Lampson has been working for them for many years.
> 
> Microsoft also employs bozos who make mistakes.
> 
> If they *DIDNT* confuse "authentication" with 
> "authorization", please enumerate
> the options besides "dont run code" and "run code".  Is there 
> a "allow this
> code to access network", or "allow this code to access temp 
> disk space only, no
> user files", or....
> 
> It equates "signed and accepted" with "fully priveleged".
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 12 Mar 2003 17:30:28 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> ...
> ...

Requiring that the signature on the new version of the code match the
signature on the original from the shrinkwrap box would be a significant
and radical improvement on the ActiveX model and what I understood Phillip
Hallam-Baker to be proposing.  As I understand ActiveX, esssentially any
code signed by any vendor recognized by Microsoft and marked "safe" by
the vendor is allowed free reign to do whatever it wants.

However, I don't see how to allow Vendor X to change only bits that
have been previously signed by Vendor X except with something that
sounds like special case of "sandbox."

Vernon Schryver    [email-masked]

P.S.  I would like to apologize to the list about my previous message.
 I didn't realize I was replying to a message from the list until
 after I'd hit the switch.

P.P.S.  "Fraud" is too strong for ActiveX if you cannot conceive of
 any network except a centrally controlled corporate net where there
 are are very few naive over-the-wire security threats and where
 whatever the central controllers want to do to other systems is
 kosher.  I'm sure I'm not the only one who has asked/warned users
 equuivalents of "this virus will aid the maintenance of your system"
 before Microsoft had heard of IP or thought of ActiveX or auto-update.
 Hooks to add and remove cron scripts and other things can ease a lot
 of transitions and deployment hassles.  Outside controlled corporate
 networks such things are worse than frauds.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg