Re: REM_ote

At 11:32 PM 2/23/96, Alex Strasheim wrote:
>> Marianne Mueller, Java security engineer, also said the chances of such
>> hacking occurring are "remote."
>
>This is the sort of bullshit that gets companies in trouble.  Netscape has
>a good record of responding to and fixing security problems.  Why should
>they feel the need to do spin control?  This borders on lying.

Might want to be careful calling Marianne a borderline liar. She's our host
for Cypherpunks meetings at Sun, where's she's in the Java group. The
article didn't make it clear that she's with Sun and not Netscape. She's
also been coming to Cypherpunks meetings since the beginning, and posts
here occasionally.

I'm sure she can speak for herself, but she may not see this comment for a
while, hence my comment here.

As for the substance of her remarks, best to let her elaborate. Though,
knowing journalists, it's quite possible that her "remote" remark was
embedded in a much longer comment, which the reporter chose to cut.

--Tim may

Boycott "Big Brother Inside" software!
We got computers, we're tapping phone lines, we know that that ain't allowed.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
W.A.S.T.E.: Corralitos, CA  | knowledge, reputations, information markets,
Higher Power: 2^756839 - 1  | black markets, collapse of governments.
"National borders aren't even speed bumps on the information superhighway."

> Might want to be careful calling Marianne a borderline liar. She's our host
> for Cypherpunks meetings at Sun, where's she's in the Java group. The
> article didn't make it clear that she's with Sun and not Netscape. She's
> also been coming to Cypherpunks meetings since the beginning, and posts
> here occasionally.

I apologize for the remark, it was out of line.  I don't know who she is,
or what she actually said, for that matter.

But the fact remains that these sorts of security problems were predicted
well before Java was widely deployed.  They're serious, and this isn't
going to be the last one.  An awful lot of people aren't going to patch
their copies of Netscape any time soon, either.

(A useful feature for Netscape might be a facility that checks
periodically to see if a security patch is in order, and displays a
warning if it is.)

Problems with security are a fact of life.  I've made embarassing mistakes
that compromised security for some of my users.  When that happens you
have to come clean, tell the truth, and fix the problem.  Don't try to
convince people that you didn't screw up, that the problem isn't serious. 
Don't say things that will encourage users to put off installing a
security patch.  And don't underestimate the ability of your attackers.

Alex Strasheim wrote:
> (A useful feature for Netscape might be a facility that checks
> periodically to see if a security patch is in order, and displays a
> warning if it is.)

  Yes, we have thought of adding such a facility, not just for security
patches, but for general release updates as well.  However some folks may
remember some discussion (I think it was mostly in other forums) about
the possibility that Netscape was "phoning home" to deliver to us information
about your browsing habits.  Of course we have never done this, but if we
were "phoning home" periodically to check for new releases it might raise
some suspicion among the more paranoid.

  I guess we could make it an option...

	--Jeff

-- 
Jeff Weinstein - Electronic Munitions Specialist
Netscape Communication Corporation
jsw@netscape.com - http://home.netscape.com/people/jsw
Any opinions expressed above are mine.

> about your browsing habits.  Of course we have never done this, but if we
> were "phoning home" periodically to check for new releases it might raise
> some suspicion among the more paranoid.
> 
>   I guess we could make it an option...

	I don't think you need to "phone home". Just make it happen
whenever someone hits the Netscape web site. some monstrous percentage
of Netscape users haven't changed the default home page, and even
those who have do go to the Netscape page every now and then.

-- 
Sameer Parekh					Voice:   510-601-9777x3
Community ConneXion, Inc.			FAX:     510-601-9734
The Internet Privacy Provider			Dialin:  510-658-6376
http://www.c2.org/ (or login as "guest")		sameer@c2.org