Re: Your Opinion

[Crispin Cowan <crispin () novell com>]

Mark Litchfield wrote:
> I have heard the comment "It's a huge conflict of interest" for one
> company to provide both an operating platform and a security platform"
> made by John Thompson (CEO Symantec) many times from many different
> people.  See article below.
>
> http://www2.csoonline.com/blog_view.html?CID=32554
>
> In my personal opinion, regardless of the vendor, if they create an
> OS, why would it be a conflict of interest for them to want to protect
> their own OS from attack.  One would assume that this is a responsible
> approach by the vendor, but one could also argue that their OS should
> be coded securely in the first place.  If this were to happen then the
> need for the Symantec's, McAfee's of the world would some what diminsh.
I've done both: sold a security enhancement for someone else's OS
(Immunix) and now I'm responsible for that same technology as part of
SUSE Linux (AppArmor).

I have no idea how Thompson gets his conflict of interest. It makes no
sense to me. I agree with Litchfield that it is an OS vendor's
responsibility to secure their OS as best they can, and using intrusion
prevention technologies is perfectly fair game.

However, Microsoft is a special case, because they have been legally
found to be a monopoly, and so special laws apply. So what Microsoft can
legally do may be different from what Red Hat, Novell, or Sun can do. I
am not a lawyer, so I won't speculate on what those differences might be.

Is Thompson talking about OS vendors in general having a conflict of
interest? Or just referring to Microsoft's monopoly status? I can't
tell, but it sounds like the former, and that sounds wrong.

Crispin

-- 
Crispin Cowan, Ph.D.               http://crispincowan.com/~crispin/
Director of Software Engineering   http://novell.com
AppArmor Training at CanSec West   http://cansecwest.com/dojoapparmor.html