Re: [POSSIBLE GRAVE SECURITY HOLD]
Pierre Beyssac <beyssac@enst.fr> writes:
> On Wed, Feb 02, 2000 at 11:06:49AM -0600, John Goerzen wrote:
> > Your attempt to take my argument to the logical extreme has failed. I
> > suggest that we should make the system as secure as possible while
> > keeping it usable.
>
> And my answer is that your argument is flawed in that particular
> case.
No it's not, because the case you suggested was not one that ever
existed.
>
> I'd like to know what your answer to the following questions is:
>
> - what is the purpose, in terms of system usability, of
> this MBR, other than bypassing BIOS and Lilo controls,
> which hardly qualifies by my book?
Uhmm, is this not inherently obvious? If you don't want LILO in the
MBR, then you have to have SOMETHING there to boot the box. Not
everyone had DOS on the machine previously.
What about thsoe that don't use LILO? Maybe they use syslinux or some
such. Still need a boot record. And if they can fit a partition
selector into there too, great! this way, even if you repartition
your disk, you can still select which partition to boot.
> - what is the purpose, in terms of system usability, of
> NOT EXPLICITLY DOCUMENTING that behaviour in the install
> process?
It is documented. As I already acknowledged, perhaps a help button in
dinstall would be usefull, but let's stop this over-reaction and
FUD-spreading please. It's not a "GRAVE SECURITY HOLD" issue.
> - what is the purpose, in terms of system usability, of
> not issuing an advisory to warn vulnerable sites?
Of what?
Reply to: