Re: Root exploit for FreeBSD

On Thu, Dec 10, 2009 at 10:21 AM, Anton Shterenlikht <mexas_at_bristol.ac.uk>wrote:

> Perhaps I should start putting together
> some statistics to make my case more forcefully.
>

I fought the same battle at the Univ. I attended (as a student).  They were
an M$ shop as well and had issues with me running OpenBSD.  I stuck to it
and finally got a "straight" answer from the Dean of CS:  "I don't know
anything about OpenBSD...please just use Windows and be like everyone
else!".

Odd, I thought that one role of higher education is to teach critical
thinking, which by definition means disagreements will (and should!) occur.
Apparently I was wrong.

I later took a independent study at the same Univ.   I wanted to compare
security records for various OS's (FreeBSD and OpenBSD being listed in
there).  This was rejected in favor of me doing security research for
Windows...so I wrote a program to demonstrate why Admins shouldn't blindly
trust even system code (Windows Server 2003...stuff like netstat and task
manager) and demonstrated that to the graduate level network security class
(I was an undergrad at the time).  I completely gave up when the grad
students followed suit with the dean and tried arguing with me that my code
was "hacked together specifically to exhibit the behavior I was trying to
demonstrate"...as if it wasn't *real* and it couldn't be used to a malicious
user's advantage.

I guess it doesn't exist in the security world (according to the previously
mentioned grad students) if it's not "mainstream thinking"...I feel sorry
for the companies that depend on those idiots for security.

If they've bought into M$ FUD, no amount of statistics/code/demonstrations
will help.  I'd skip the statistics in favor of putting together a resume.