Re: Cisco crapaganda

[Michael.Dillon () btradianz com]

> If not, once again, I'd ask you to cite sources rather 
> than make broad sweeping statements about what is already available. 
> Appealing to some anonymous authority in order to claim the sky is 
> falling is hardly endearing.

I think that people who specialise in security know what
I am referring to. I won't say any more publicly since
there are black hats reading this list. If they don't already
know about this stuff, I'm not going to help them.

If anyone wants to know what I am talking about, then
go to the security people in your company and ask them.
The company pays them to keep abreast of this stuff.

> That's a fairly bold statement. I'd also hesitate to label Lynn as a 
> black hat

I never labelled Lynn as a blackhat. I said that Lynn and
ISS and all other similar firms and researchers do the
same thing as blackhats. They monitor communications of
blackhats and learn from them. This activity does not make
someone into a blackhat.

> researchers of 
> any hat, in my experience, keep their secrets amongst a small group.

It is human nature to brag about what you have discovered and
for many blackhats, this is the only return they get for their
work. I agree that whitehats like Lynn are generally much more 
careful about their secrets which is why Lynn's presentation was
quite vague about many things.

> On the other hand, Lynn is exactly the sort of guru 
> you describe. Riley Eller said it best "If you put him and a (Cisco) 
> box in a room, the box breaks."

I'm sceptical about such rhetoric.

> It boils down to the following question: Do you think benefit or 
> releasing the source code for IOS, allowing independent researchers 
> access to the source code in order to locate flaws, outweighs the 
> costs of that release, allowing criminals access to the source code 
> in order to locate flaws and forfeiting trade secrets? In the case of 
> Cisco, I'm sure the latter weighs more heavily in their mind.

First, I don't think there will be any trade secrets of great value
revealed by the source code. Software and systems have a long history
and people continue to reinvent wheels that were first invented two 
or three generations ago. In any case, people looking for trade secrets
simply acquire the boxes and reverse engineer.

Second, I don't suggest that Cisco suddenly release their code. But
I can imagine a phased approach where they release the code to an
ever widening circle of people, and then finally make it completely
open. Or they could phase in a new codebase using Open Source as the
foundation.

--Michael Dillon