, 2002-04-03
We all know that outdated network software is security hazard. The solution: hard-wired expiration codes that self-destruct an old program when it's past its prime.
Expand all |
Post comment
Death to Old Software
2002-04-03
Steve (1 replies)
Steve (1 replies)
Death to Old Software
2002-04-03
Anonymous (1 replies)
Anonymous (1 replies)
A really bad idea: The solution is better placed elsewhere
2002-04-03
Robert A. Klahn (rklahn@acm.org) (1 replies)
Robert A. Klahn (rklahn@acm.org) (1 replies)
I STILL have the original (4.?) sendmail running on SunOS 4.0.2 on a 3/260, not because I want it, not because I'm lazy, but because the machine is in charge of a very large medical device, and has been for 11 years.
ANY configuration change to this paticular machine is followed by 10s of thousands of dollars in patient safety certification. A forced upgrade of statd could cause millions of lost dollars in downtime, if there was a bug in a newer version that caused changes in the operations of the embedded systems that use rpc to talk to this box.
It lives on a private network, not reachable to the internet at large, and yes, it mails daily reports to medical personal daily. Forcing a software change on a machine like this (and there is more than just this one in the world even today) is just a stupid idea.
All old or broken software is not necessarily a security risk. Or even hackable. If the machine's not reachable, it's not a problem.
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/72/11636#11636