Re: [cobalt-security] FTP Scans

["Ed Morgan" <excalde@xxxxxxx>]

Hi Michael,

> I'm sorry to sound the wakeup call for you, but this strictly means >that 
> SUN/Cobalt will charge you for anything unless you can prove them >that the 
> fault is on their side. ;o)

Trust me, a "wake-up" call is not necessary. I have gone through all 
material I have been able to find, and the warranty statement says a lot 
more than you give it credit for saying. Any alterations to the core system, 
hardware or software, and you void your warranty. It could not be any 
simplier than that. Now, I can not say if Sun would actually deny service, 
but they are within their rights to do so.

> If *you* can live with the fact that an out-of-the-box Cobalt RaQ >leaves a 
> lot to be desired in regards to security issues, then that's >certainly 
> fine with the rest of us.

I am well aware of the lack of security, and in no way am I saying I am 
happy to leave it unsecured. We are testing our Cobalt system, and reviewing 
ways to properly secure it. Until we are confident with the system, it will 
remain in testing only. While I can understand not wanting to handle 
problems created by the user, I do feel that Sun could do a bit more on 
building a more secure environment. In my opinion, it is like selling a car 
without wheels, and voiding the warranty if you add them.


> It always pays to RTFM (Read The *Fine* Manual). But it might also pay >if 
> you listen to sound advice. You're always free to do it your way - >of 
> course -, but ipchains (and other means talked about on this board) >can 
> greatly enhance the security and your awareness about what's going >on at 
> your machine.

I don't believe I ever said I had no interest in using IPChains. I did say I 
was not at a point that I was comfortable with altering them. Where I am 
from there is a big difference between the two. I always listen to advice, 
but have learned over the years not to fix something I have not studied 
first. I've seen more messages regarding problems due to user error than 
those due to being hacked.

> Once you've been hacked, all Cobalt will do is to send you (for hard >cash) 
> an OS restore CD, so that you can format your disk and start >over.

They will do the same for when you kill your own system as well.

Regards,
Ed

_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp