Educause Security Discussion mailing list archives

Re: Vendor Participation on List and Proper Identification


From: Theresa M Rowe <rowe () OAKLAND EDU>
Date: Fri, 29 Jul 2005 15:17:14 -0400

I have been contacted by vendors based on posts to the
lists.  Vendors need to think before trying to contact based
on list posts.

Our university has a no solicitation policy, so I do not
respond (responding would be viewed as a policy violation).
It would be nice if vendors would check such things before
soliciting; I wouldn't have to delete 40 or so email and
phone messages without responding.

I also don't care for the attitude left on my phone and
email when I do not respond.  If a vendor does not get a
response from the first contact, a vendor should not try a
second contact.  Leaving a message with that "You weren't
even polite enough to return my call" is not a way to make a
sale - even if you could.

My voicemail says to contact our purchasing department and
that I do not return unsolicited vendor calls.  Can you
imagine that vendors STILL leave messages?  They even will
say "I say your post, so I can't believe your message
applies to me."  I still do not return their calls.

Bottom line - posting to the list should not be construed to
mean that I am open to vendor contact, that I am interested
in the vendor product, that university policy supports such
a contact, or that I have funding for a solution.

Theresa Rowe


---- Original message ----
Date: Fri, 29 Jul 2005 12:52:57 -0400
From: "Dennis Meharchand, CEO Valt.x" <dennis () VALTX COM>
Subject: Re: [SECURITY] Vendor Participation on List and
Proper Identification
To: SECURITY () LISTSERV EDUCAUSE EDU

I am a vendor. Most every vendor understands the #1 rule of
the forum -
do not try to sell on the forum itself. The question is
whether
targeting a prospective sale by knowing of the need via the
forum is
acceptable or not. This is up to the members to decide and
then modify
the policy if necessary. Our company needs to know what the
problems are
so that we can go out and make the stuff to solve the
problems. Not
having access to the forum would be a significant drawback
to our
product development process.  P.S. The person that started
the barracuda
spam discussion should get an award.

-----Original Message-----
From: Tom Bossie [mailto:tbossie () CITADEL COM]
Sent: Friday, July 29, 2005 8:53 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Vendor Participation on List and
Proper
Identification

Let's face it; given the human factor you're always going
to have those
that
honor the rules and those that take advantage of the
situation.

To be honest, this list-serv feels a little invasive in
general. To
anomalously listen to the various issues and problems,
ignoring our
nature
to sell, is a daily temptation. And given the general
business
environment
these days there is a strong tendency to exploit the
available venues in
competing for the available funds!(revenue) Like the song
says: sales is
a
"sorry substitution for a spiritual life".

I can appreciate the need to have a private (education
only) forum, for
all
the obvious reasons. It sounds like these forums already
exist from a
previous posting. Your (Edu) comments are valuable to us
(Vendor).
Maybe
Educause could publish the contents of the discussion
strings sans the
individual identities on a daily basis and allow a separate
facility for
response by vendors. Then you could decide to call the
vendor directly
at
your discretion.

Or create a vendor list-serv where your members could ask
questions to
the
vendor community when and if they wish, using some sort of
common alias
to
avoid the marketing backlash. I'm sure there is way to make
it work,
that's
why we go to school!

Tom Bossie
Citadel Security Software

-----Original Message-----
From: Dave Koontz [mailto:dkoontz () MBC EDU]
Sent: Thursday, July 28, 2005 6:29 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Vendor Participation on List and
Proper
Identification

IMO this issue seems to be a little broader that than just
a simple
"List-Serve" issue.

Shortly after I responded to an email on this list
regarding our various
problems with Cisco's Acquitition of Perfigo, I have been
swamped with
calls
from various vendors. Since I did not post my direct phone
number in my
posting, these calls have all came through our main campus
phone line,
asking for me.  As this is the only forum in which I've
mentioned
anything
about this issue, it's pretty clear where these vendors got
my contact
information.

While I agree that vendor input on issues and questions can
be very
valuable
here, this list should not be used as a sales /
marketing "Hit List".
Jamie
@ CBSI  did the correct thing, Identified himself as a
Vendor, attempted
to
answer our questions.  It seems that there are many other
vendors out
there
that are using this list soley as a marketing / sales lead
tool.

-----Original Message-----
From: Information Security [mailto:infosecurity () UTPA EDU]
Sent: Thursday, July 28, 2005 9:26 AM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] Vendor Participation on List and
Proper
Identification

Parker, Ron wrote:

Before we all bounce down this road about vendors on the
list, remember

that EDUCAUSE's policies do allow it. I think it can be
valuable in
many cases.


Seconded.  Let's save that argument until the day someone
abuses the
list.
Jamie Stapleton's posts are generally helpful and worth
reading, and
it's
clear from his email address he is a vendor.  Not a problem
to me.
Let's
return to the discussion of spam appliances...  I'm
surprised no-one has
mentioned Brightmail yet - that's usually the one I hear
when a company
is
programming-phobic and wants a managed solution.  As far as
I understand
it,
their approach is primarily spamtrap-based and they mark
only mails that
they've seen elsewhere in spamtraps.  They have a good
reputation but I
worry that betting the farm on one technique is a long-term
risk, as
polymorphic and customised spams become more prevalent.

I've already started receiving spams where some of
the 'whitening' text
was
taken from my own web site, in order to get past my
Bayesian filters.
That's
pretty sophisticated, and I have to wonder why the spammers
bother,
because
if someone goes to the effort of installing a spam filter
you might
imagine
that they'd never respond to spam even if it did slip
through.

Graham
Theresa Rowe
Assistant Vice President
University Technology Services
www.oakland.edu/uts - the latest news from University Technology Services

Current thread: