Subject: Re: misc/143: Setuid programs installed unreadable
To: None <netbsd-bugs@sun-lamp.cs.berkeley.edu>
From: Kevin Lahey <kml%rokkaku.UUCP@mathcs.emory.edu>
List: netbsd-bugs
Date: 03/01/1994 13:13:36
>> I have to second this. I think security through obscurity is great
>> with the non-technical, but just let a student at them... If everything
>> is readable, then there is nothing to "hide" and people (me for one)
>> feel less inclinded to worry about hidden bugs.
>
>once again, there are people out there using this code on systems which:
>	(1) don't have source installed
>	(2) don't have source easily accessible
>	(3) have users who aren't necessarily the most savory...
>
>
>Just because it's a moot point to you, and just because everybody
>on the internet can get the source easily (IF THEY KNOW WHERE TO LOOK)
>DOES NOT MEAN that it's irrelevant for 'randoms' out there running the
>system.

I think that this is overkill.  How secure is NetBSD in the first place?
Is it really appropriate to take these kind of draconian measures?
Do they make sense in the context of the level of security in the rest
of the system?

Or, more realisticly, can the random cracker who is fairly ignorant
do anything just because he can read the executables?  I would imagine
that the more knowledgable crackers, who could do something with
these readable executables (I'm having trouble imagining what this
is), could probably find the source on the net, examine another NetBSD
system that *doesn't* have them protected, etc.

Good luck,
Kevin
kml@rokkaku.atl.ga.us

------------------------------------------------------------------------------