[Info-vax] "Shanghai Stock Exchange" and OpenVMS

[Bill Gunshannon]

In article <glaua6$4pu$1 at tempo.update.uu.se>,
	Johnny Billquist <bqt at softjar.se> writes:
> Bill Gunshannon wrote:
>> In article <CKqdnel_5rWYS-XUnZ2dnUVZ_v_inZ2d at giganews.com>,
>> 	"Richard B. Gilbert" <rgilbert88 at comcast.net> writes:
>>> Bill Gunshannon wrote:
>>>> In article <0005d0dd$0$2088$c3e8da3 at news.astraweb.com>,
>>>> 	JF Mezei <jfmezei.spamnot at vaxination.ca> writes:
>>>>> Richard B. Gilbert wrote:
>>>>>
>>>>>> You can safely plug them in and turn them on.  It's when you connect 
>>>>>> them to a network that you have to worry about "electronic organisms" 
>>>>>> infecting your Windows systems.
>>>>> This week's virus can be transmitted when you plug in an USB key.
>>>>>
>>>>> Sony managed to infect Windows machines when the user inserted a MUSIC
>>>>> CD into the machines (that rootkit thing).
>>>>>
>>>>> So leaving a Windows box unconnected to a network is not a garantee that
>>>>>  it won't be infected.
>>>> And all of these exploits can be prevented by proper configuration of
>>>> Windows.
>>>>
>>>> bill
>>>>
>>> And how many people know how to "properly configure Windows"???
>> 
>> How many know how to "properly configure VMS"?
>> 
>>> Where is this "proper configuration" documented?  The last time I looked
>>> Windows was shipping without any "documentation".
>>  
>> Well, you can get docs from NIST specifically covering security.  And then
>> there are the checklists from DISA that are publicly available.  And, being
>> as we are talking about supposed professionals in major corporations and
>> not your momma's PC,  if they don't already know where to find this stuff
>> they certainly should know how to go out and find it.  Even Google finds
>> piles of references including the stuff from NIST.
> 
> Right. So, all you have to do to make your Windows computer safe is surf 
> around a while, look at various places, which you *hope* will give you 
> good information, and not actually make your machine more exploitable 
> (how do you know what to trust on the Internet?). 

I realize you are not from this side of the pond, but I cn assure I
would trust security information I got from DISA, NIST and NSA (yes,
I looked today and they do Windows security docs, too) long before
I would trust what I was likely to get from HP.  :-)

>                                                   So you boot your 
> machine, insert a CD or two, to install some software, hopefully don't 
> insert any music CDs, surf around without catching the attention of 
> anyone who just happens to probe your machine before you manager to 
> improve the security. 

I thought we were talking about datacenters and professionals here?
Of course you secure the machine before you put it into the production
environment.  I would hope the same was true of VMS no matte rhow secure
you think it is.

>                        Find information on the net which is correct, and 
> which you can trust, which you then follow. And then you hope that there 
> isn't even more you need to do which isn't mentioned anywhere you can 
> find (how did you even know what to look for in the first place?).

Well, just for the fun of it I typed "Securing Windows" into google.
Got lots of stuff.  Tried a few more times adding "NIST", "DISA" and
"NSA" each time and pretty much found all the stuff I have been telling
people here about for years.  Some people just don't want to hear.  
They are quite happy living with their delusion.

> 
> Don't you see how ridiculous this is?

Not at all.  Claiming that Windows can't be secured when what you really
mean is I want it to be that way out of the box is ridiculous.  We are
supposed to be professionals.  If everyone could do this we wouldn't have
jobs.

bill

-- 
Bill Gunshannon          |  de-moc-ra-cy (di mok' ra see) n.  Three wolves
billg999 at cs.scranton.edu |  and a sheep voting on what's for dinner.
University of Scranton   |
Scranton, Pennsylvania   |         #include <std.disclaimer.h>