Re: Your Opinion
Mark Litchfield wrote:
> I have heard the comment "It's a huge conflict of interest" for one
> company to provide both an operating platform and a security platform"
> made by John Thompson (CEO Symantec) many times from many different
> people. See article below.
>
> http://www2.csoonline.com/blog_view.html?CID=32554
>
> In my personal opinion, regardless of the vendor, if they create an
> OS, why would it be a conflict of interest for them to want to protect
> their own OS from attack. One would assume that this is a responsible
> approach by the vendor, but one could also argue that their OS should
> be coded securely in the first place. If this were to happen then the
> need for the Symantec's, McAfee's of the world would some what diminsh.
I've done both: sold a security enhancement for someone else's OS
(Immunix) and now I'm responsible for that same technology as part of
SUSE Linux (AppArmor).
I have no idea how Thompson gets his conflict of interest. It makes no
sense to me. I agree with Litchfield that it is an OS vendor's
responsibility to secure their OS as best they can, and using intrusion
prevention technologies is perfectly fair game.
However, Microsoft is a special case, because they have been legally
found to be a monopoly, and so special laws apply. So what Microsoft can
legally do may be different from what Red Hat, Novell, or Sun can do. I
am not a lawyer, so I won't speculate on what those differences might be.
Is Thompson talking about OS vendors in general having a conflict of
interest? Or just referring to Microsoft's monopoly status? I can't
tell, but it sounds like the former, and that sounds wrong.
Crispin
--
Crispin Cowan, Ph.D. http://crispincowan.com/~crispin/
Director of Software Engineering http://novell.com
AppArmor Training at CanSec West http://cansecwest.com/dojoapparmor.html