Full Disclosure mailing list archives

RE: MS should point windowsupdate.com to 127.0.0.1


From: Tobias Oetiker <oetiker () ee ethz ch>
Date: Fri, 15 Aug 2003 10:12:53 +0200 (MEST)

Yesterday Schmehl, Paul L wrote:

Because the local techs have no clue, it will
take the affected companies ages to get back on the net.

Which is perfect actually as it points out all the
stupid admins who get paid a lot of cash but really
sit around all day with their finger up their noses.

I just curious how you geniuses would solve this problem.  You have a
multi-six figure scientific instrument, which is only manufactured by
one vendor in the entire world.  Your research department depends upon
that instrument to do research for which they are being funded
handsomely by grants and expected to produce results.

There's only one problem.  The instrument requires that you run Windows
2000 Server with IIS, and the vendor requires that you not apply *any*
patches post SP2.  The government certifies the equipment at a certain
patch level, and if the equipment is patched then the certification no
longer applies, the research is no longer funded and you are now staring
a six figure boat anchor.

Given that scenario, please apply your scintillating logic to the
problem of patching this machine to protect it against threats that were
discovered *after* SP2.

In the paragraph before you say, that there are not to be applied
*any* patches ... so how comes now you want to patch it ?

* If no patches are to be applied then all is well, you don't care
  about windowsupdate working or not.

* If patches are to be applied, I assume the vendor would certify
  the one which makes patching possible as well.

cheers
tobi

-- 
 ______    __   _
/_  __/_  / /  (_) Oetiker @ ISG.EE, ETZ J97, ETH, CH-8092 Zurich
 / // _ \/ _ \/ /  System Manager, Time Lord, Coder, Designer, Coach
/_/ \.__/_.__/_/   http://people.ee.ethz.ch/~oetiker   +41(0)1-632-5286
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


Current thread: