chris <chris-nospam@tridac.net> wrote:
>>
> I think we are making too much of this. OS security is just one plank
> in the process. A single or even collection of decnet connected nodes
> not connected to other networks in any way, would still be perfectly
> secure, vax, alpha or even X86, from the most common forms of
> intrusion. Probably many vax and alpha systems running today and have
> done for years under such conditions...

False. While not being connected to any network conveniently removes
remote network based attacks as a security concern, there are still
plenty of possible attack routes: local access to terminal(s), storage
systems etc. And of course the often overlooked insider attacks.

Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison

On 08/11/22 12:26, Alexander Schreiber wrote:
> chris<chris-nospam@tridac.net> wrote:
>>>
>> I think we are making too much of this. OS security is just one plank
>> in the process. A single or even collection of decnet connected nodes
>> not connected to other networks in any way, would still be perfectly
>> secure, vax, alpha or even X86, from the most common forms of
>> intrusion. Probably many vax and alpha systems running today and have
>> done for years under such conditions...
>
> False. While not being connected to any network conveniently removes
> remote network based attacks as a security concern, there are still
> plenty of possible attack routes: local access to terminal(s), storage
> systems etc. And of course the often overlooked insider attacks.
>
> Kind regards,
> Alex.

Obviously, already covered that...

Chris

On 8/11/2022 7:29 AM, Alexander Schreiber wrote:
> Arne Vajhøj <arne@vajhoej.dk> wrote:
>> On 8/10/2022 5:35 PM, Dave Froble wrote:
>>> On 8/10/2022 8:18 AM, Arne Vajhøj wrote:
>>>> On 8/10/2022 7:32 AM, chris wrote:
>>>>> On 08/10/22 05:10, jimc...@gmail.com wrote:
>>>>>> It's unwise to assume that the best practices that DEC displayed in
>>>>>> the 1980s
>>>>>> are still relevant in protecting customers running OpenVMS in 2022.
>>>>>>
>>>>> I think we are making too much of this. OS security is just one plank
>>>>> in the process.
>>>>
>>>> That is true. Standard software components, libraries, custom
>>>> application logic is where the most vulnerabilities are found.
>>>>
>>>>>           A single or even collection of decnet connected nodes
>>>>> not connected to other networks in any way, would still be perfectly
>>>>> secure, vax, alpha or even X86, from the most common forms of
>>>>> intrusion. Probably many vax and alpha systems running today and have
>>>>> done for years under such conditions...
>>>>
>>>> Not perfectly secure.
>>>>
>>>> Vulnerable to insider attack.
>>>
>>> If you got the SYSTEM password,
>>
>> True.
>>
>>> or, physical access to the hardware,
>>> you're always vulnerable ...
>>
>> On VMS yes. Other systems are better in this regard.
>>
>> But the problem I was thinking above was network sniffing
>> of unencrypted network traffic (revealing maybe the
>> SYSTEM password).
>
> If one is sending these kind of credentials over the network in
> clear text, then one _deserves_ to be 0wned.

This entire subthread started about set host/DECnet copy/telnet/ftp
vs ssh/sftp and the risks of using non-encrypting network
protocols.

Arne

On 8/11/2022 7:29 AM, Alexander Schreiber wrote:

> If one is sending these kind of credentials over the network in
> clear text, then one _deserves_ to be 0wned.

Nobody "deserves" to have anything bad happen.

Isn't that a bit like saying the girl deserved it because of the way she dressed?

--
David Froble Tel: 724-529-0450
Dave Froble Enterprises, Inc. E-Mail: davef@tsoft-inc.com
DFE Ultralights, Inc.
170 Grimplin Road
Vanderbilt, PA 15486

In article <td361g$26rrm$1@dont-email.me>,
Dave Froble <davef@tsoft-inc.com> wrote:
>On 8/11/2022 7:29 AM, Alexander Schreiber wrote:
>
>> If one is sending these kind of credentials over the network in
>> clear text, then one _deserves_ to be 0wned.
>
>Nobody "deserves" to have anything bad happen.
>
>Isn't that a bit like saying the girl deserved it because of the way she dressed?

While I agree with the sentiment, this particular
example feels hyperbolic. I mean, no one deserves
to have their car broken into, but if you leave the
doors unlocked and the windows down, don't be too
surprised if you come back and the laptop that was
sitting on the passenger seat is missing. But that
is qualitatively very, very far from someone trying
to excuse assault or harassment.

- Dan C.

On 2022-08-11 00:30:28 +0000, chris said:

> Suspect a lot of legacy system operators have no choice but to stick
> with what they have, due some app or other, or industrial control
> custom hardware. The cost involved to replace all that might be beyond
> the company resources, as well as great risk in terms of all aspects of
> the replacement system. Easy to understand why they would stick with
> what they have for as long as possible.
>
> Just need different strategies to make it as secure as possible...

If those sites haven't done maintenance or refactoring in ~thirty
years, whether "fixed in next factory" or whatever, that's on site
management.

Y'all have management that want to keep using FTP or DECnet or CC
/STANDARD=VAXC or whatever else, have at.

The bill for those savings does come due eventually. If you're the
boss, hopefully that bill comes due after you got yours and got gone.

--
Pure Personal Opinion | HoffmanLabs LLC

On Friday, August 12, 2022 at 4:49:07 AM UTC-7, Dan Cross wrote:
> In article <td361g$26rrm$1...@dont-email.me>,
> Dave Froble <da...@tsoft-inc.com> wrote:

(snip)

> >Isn't that a bit like saying the girl deserved it because of the way she dressed?

> While I agree with the sentiment, this particular
> example feels hyperbolic. I mean, no one deserves
> to have their car broken into, but if you leave the
> doors unlocked and the windows down, don't be too
> surprised if you come back and the laptop that was
> sitting on the passenger seat is missing.

And if you sign a law making mishandling of classified information
a felony, and then get caught mishandling classified information?

In article <32fe9fe1-88bd-44a2-8271-c3dcb5e18077n@googlegroups.com>,
gah4 <gah4@u.washington.edu> wrote:
>On Friday, August 12, 2022 at 4:49:07 AM UTC-7, Dan Cross wrote:
>> In article <td361g$26rrm$1...@dont-email.me>,
>> Dave Froble <da...@tsoft-inc.com> wrote:
>
>(snip)
>
>> >Isn't that a bit like saying the girl deserved it because of the way she dressed?
>
>> While I agree with the sentiment, this particular
>> example feels hyperbolic. I mean, no one deserves
>> to have their car broken into, but if you leave the
>> doors unlocked and the windows down, don't be too
>> surprised if you come back and the laptop that was
>> sitting on the passenger seat is missing.
>
>And if you sign a law making mishandling of classified information
>a felony, and then get caught mishandling classified information?

That's just called "karma."

- Dan C.

In article <tcdodh$277ja$1@dont-email.me>,
clubley@remove_me.eisner.decus.org-Earth.UFP (Simon Clubley) wrote:

> On 2022-08-02, John Dallman <jgd@cix.co.uk> wrote:
> > I've seen a development group manager complain about being
> > "blackmailed" by only being given 90 days to release fixes
> > before vulnerabilities are disclosed. He gradually came to
> > accept the idea that you should make use of the reports
> > you get, because there are also people who sell the
> > vulnerabilities they find on the dark-grey market.
>
> I can believe that's way possible for more bespoke software
> development.

This was a development group that only supports Windows. He accepted
getting monthly security patches for Windows, but seemed to feel that his
applications should not have externally-imposed deadlines to fix security
bugs.

> However, in other operating systems (Windows, Linux, Apple,
> Android, etc) the protocols around management of security
> issues follow well established industry standards and are
> accepted by everyone, including the users.

However, there are also organisations offering much larger sums for
unreported security vulnerabilities. The highest offers I've seen are at
<https://zerodium.com/program.html> and I'd expect real payouts are lower,
but nobody is offering this kind of money without either criminal or
intelligence-service objectives. The two are indistinguishable for
software defence purposes.

John

воскресенье, 24 июля 2022 г. в 17:07:37 UTC+3, rgrea...@gmail.com:
> Hello,
>
> I am currently working on restoring a Microvax 3100 Model 40 to operating condition and have downloaded OpenVMS version 7.1. At this point, I am trying to find out how to obtain a license for this version. I have sent messages to HPE, and VMS Software but neither has been able to assist me. My 3100 Model 40 will be used for strictly personal use, no business use. Can anyone here guide me on how I can accomplish this? Any help at all will be greatly appreciated.
>
> Thanks

Just is puzzled as so many people cannot use google to get VMS related stuff ...

On Sunday, July 24, 2022 at 7:07:37 AM UTC-7, rgrea...@gmail.com wrote:
> I am currently working on restoring a Microvax 3100 Model 40 to operating condition and have downloaded OpenVMS version 7.1.

I am not sure by now which version of VMS would, at the time it was sold, be used for the 3100/40.

It does occur to me, though I don't remember it being mentioned, that at about that time, it was not rare to run Unix on VAX.

The development of what we today know as Unix, was mostly done on VAX.

It seems that some of that is available, if one was interested:

https://gunkies.org/wiki/BSD_on_VAX

Much of what we today know as TCP/IP was done on VAX/Unix at Berkeley.

Since you ask about VMS 7.1, maybe you aren't so interested in VAX history,
but then again, why run a VAX at all, if not for historical reasons?

As well as I know, some of the more recent versions, such as NetBSD, were back
ported later. (I don't know NetBSD all that well, though.)

Original SunOS is based on BSD Unix, and might have reduced the desire for
running Unix on VAX by that time.

On Sun, 24 Jul 2022 15:29:03 +0100, Andy Burns <usenet@andyburns.uk>
wrote:

>Robert Grear wrote:
>
>> I am trying to find out how to obtain a license for this version.
>
>Hobbyist licences for VAX VMS are over.

comp.os.vms collegiates,

An aperiodic reminder, and community serice announcement, IPL 31:

*** No VAX/VMS, or AXP/VMS, shop ever has to shut down ***

Perpetual Licensing Guaranteed.

Semper VAX/VMS, Semper AXP/VMS, Semper DEC.

Preserving the Glory that was the Digital Equipment Corporation.

Vernon might be the mascot of VMS, but the spirit, totem, animal of
VMS is, undoubtedly, dear Balthazar:

https://en.wikipedia.org/wiki/Au_Hasard_Balthazar

Carry on, good VMSmen, carry on:

https://pastebin.com/SncTKj9m

As always, standard protocol: If you understand and appreciate what
the VLF do, and why, then there is no need to pass commentary.

If you do not understand, or do understand, and do not appreciate what
the VLF do, and why, then, again, there is no need to pass commentary
- rather focus your attention, energies, and intelligence on
encouraging, and guiding, VSI, VMS Software International, to deliver
a thriving, VMS computing ecology, for seven generations, and beyond.

Thank you for your attention.

Best regards,
VLF: The VMS Liberation Front

In VMS We Trust

$!-------------------------- damn straight -----------------------!$
$ opprobrium/level=kittens/mode=conniptions/input=VLF:/output=NL: !$
$!--------------------------- enough said ------------------------!$

In article <ad897b74-cfab-4111-bed7-70b1fde6acd5n@googlegroups.com>,
gah4@u.washington.edu (gah4) wrote:

> As well as I know, some of the more recent versions, such as
> NetBSD, were back ported later. (I don't know NetBSD all that > well, though.)

Current NetBSD supports many VAX models:
<https://wiki.netbsd.org/ports/vax/>

FreeBSD and OpenBSD don't support VAX.

John

On 2022-08-24, John Dallman <jgd@cix.co.uk> wrote:
> In article <ad897b74-cfab-4111-bed7-70b1fde6acd5n@googlegroups.com>,
> gah4@u.washington.edu (gah4) wrote:
>
>> As well as I know, some of the more recent versions, such as
>> NetBSD, were back ported later. (I don't know NetBSD all that > well, though.)
>
> Current NetBSD supports many VAX models:
><https://wiki.netbsd.org/ports/vax/>
>
> FreeBSD and OpenBSD don't support VAX.
>

Not currently, but OpenBSD used to support VAX until version 5.8 (IIRC).

I ran both just for fun before I deleted my VAX simh installations.

SSH server key generation under simh took "a while". :-)

Simon.

--
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Walking destinations on a map are further away than they appear.