RE: Sidewinder G2

[Ron DuFresne <dufresne () winternet com>]

On Tue, 18 Nov 2003, Brent J. Nordquist wrote:

> On Tue, 18 Nov 2003, Kruse, Steve <Steve.Kruse () lakelandgov net> wrote:
>
> > Repeated "hacker challenges" by Secure Computing against the Sidewinder
> > have proven it hasn't been compromised.
>
> "Proven" is much too strong a word.  See:
>
> http://www.schneier.com/crypto-gram-9812.html#contests

Agreed, these hacking contests are of little if any real value, yet, the
real question buried in this thread is;

How secure is the sidewinder?

Now, not arguing about this acquisition crazy economy, that will get
reversed once it settles back into something a tad more solid <such as the
state of it prior to the 2000 elections>, and secure computings
acqusition./merger with another large vendor in the not to distant past,
the issue that begs to be addressed in this whole thread is whether or not
the history of this device stands up to the claims of it's vendor.  So,
then I have to ask here;  do you or anyone else know of a security
incident that compromised the perimiter guarded by one of these
blackboxen?  And I'd direct folks to the sec-focus vuln listings to
determine how these systems have faired historically say since oh, 1995 or
so.  Now, if that's not enough information for one to base their decisions
upon, then go ask those that are using these boxen, the firewall wizards
list will surely find a number of folks with hands-on experience with the
product, and refering a question about the solidity of these systems
and/or how secure they are with a 'sendmail agent' running upon/within the
system might be addressed with some level of knowledge, rather then the
mass speculation (outright FUD) the majority of this thread has entailed
thus far.


Thanks,

Ron DuFresne
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation." -- Johnny Hart
        ***testing, only testing, and damn good at it too!***

OK, so you're a Ph.D.  Just don't touch anything.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html