Subject: Re: ANNOUNCE: ISOC Netw. & Distr. Sys. Security Symp. (NDSS'02)

From: Jeffrey Hutzelman <[email-masked]>
Date: Sat, 1 Dec 2001 11:41:37 -0500 (EST)

On Fri, 30 Nov 2001 [email-masked] wrote:

> 2002 NETWORK AND DISTRIBUTED SYSTEM SECURITY SYMPOSIUM (NDSS'02)

> THIS YEAR'S TOPICS INCLUDE:
> * Wireless Security
> * Analyzing the Anonymity of Anonymous Networking Protocols
> * Intrusion Detection and Defending Against Network Attacks
> * Detecting Steganographic Content on the Web
> * Server-Aided Digital Signatures
> * PKI, Certificates and Privilege Management
> * Various Aspects of Transport Layer Security/TLS
> 
> PRE-CONFERENCE TECHNICAL TUTORIALS:
> * Major IETF Security Standards:  PKIX, IPsec, SSL/TLS, Dr. Stephen Kent
> * Crash Course in SSL and TLS, Mr. Eric Rescorla
> * Building Secure Software, Dr. Gary McGraw
> * Wirelss LAN Security:  Problems & Solutions, Dr. William Arbaugh
> * Group Security, Dr. Thomas Harjono and Mr. Hugh Harney

Hm.  As someone who works at a site that has been operating a distributed
computing environment since the mid-80's and takes security fairly
seriously, I'm somewhat dismayed that these folks don't even touch on some
of the technologies that have been essential to us.

I also find it interesting that this announcement was posted to the
mailing list of the Kerberos working group, but they don't seem to
consider Kerberos, GSSAPI, or SASL to be "major IETF security standards".

Perhaps this should be called the "TLS and Public Key Security Symposium".

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: "Tim Bass" <[email-masked]>
Date: Sat, 1 Dec 2001 16:07:52 -0500

Niec comment Jeff...  a casual reply follows as a sidebar:

That's because the majority of the network security community
continually exhibits the predominate characteristic of avoiding
any protocol they can't explain in a few sound bites.  The news
media plays here as well and, let's face it, many just are not
comfortable with complexity.   There is still a large crowd that
thinks PKI brings world peace and solves every future security
problem imaginable.  They still exist, believe-it-or-not!!

In a way it like UNIX.   Slowly over a 10+ period, the Microsoft
kernel is beginning to look like UNIX.  However, the users were
seduced by the mirage of simplicity because the application of
anything more than superficially complex was used as anti-UNIX
propaganda.     The world would have been so much more productive
if Microsoft had  taken the leadership as Apple is doing and just
adopt an open standards, open source UNIX kernel and shift
the value proposition to the user interface level and application
level.   We all know that Microsoft's kernel is slowly evolving
to the same architecture as the early UNIX philosophy.

Vendor battles at the kernel, network protocol, and security middleware
part of the IT stack is primitive intertribal warfare.   Kerberos is many
years ahead of its time as a cross-realm authentication protocol.......

Just an off topic sideline reaction.... worth about 0.02 kyat....

Finest Regards, Tim

www.silkroad.com

---

From: Dan Geer <[email-masked]>
Date: Sat, 01 Dec 2001 23:58:13 -0500

You're always welcome at USENIX; http://www.usenix.org/events/sec02/cfp/

--dan, who is anything but unbiased

-------- Original Message

    

    

------- End of Forwarded Message

---

From: Marcus Watts <[email-masked]>
Date: Sun, 02 Dec 2001 01:33:53 -0500

> Just an off topic sideline reaction.... worth about 0.02 kyat....

"the Microsoft kernel is beginning to look like UNIX".  *Cough*.
This statement greatly oversimplifies things.

To start with, MicroSoft has more experience than you might
think with Unix.  They were playing around with Unix in the mid 80's.
At one point, their flavor of Unix, Xenix, had *The* largest slice
of the Unix market that then existed.  Admittedly, they didn't
quite grasp what "open source" meant, then again, neither did AT&T.
In addition, at that point in the mid 80's, all their *serious*
development was done on Xenix machines.

That phrase, "Microsoft kernel", is itself suspect.  To start with,
there have been *several* distinct generations of "kernel"
underpinnings.  There was the original MS-DOS platform, basically
warmed over CP/M.  There were several additional generations borrowing
ideas from Unix, including that of an enviornment, hierarchical
directories, device drivers, etc.  None of these did any form of
process scheduling.  Then there were at least 4 distinct generations of
task time-sharing; OS/2, 16-bit Windows (thrug 3.1) 32-bit Windows
(95,98,ME) and Windows NT (NT,2K,XP).  16 and 32-bit Windows had a
decreasing % of of MS-DOS hidden in the underpinnings.  In fact, MS
never did figure out how to produce a true protected mode executive.
IBM took over OS/2 and made it work.  For NT, MS hired a bunch of
programmers and their software away from DEC; and I understand there
was an interesting law suit when it turned out bits of Windows NT still
had DEC copyrights in it.

It's certainly no accident that Windows NT looks "more like Unix".  It
came out of a rich array of timesharing experience at DEC, from TOPS-10
to VMS.  All that work, in turn, can be tied back to CTSS.  In fact,
CTSS can be seen as the clear ancestor of *all* serious time-sharing
efforts since then.  Unix did not spring out of isolation either; it
clearly has its roots in Multics, and one of the 3 original partners in
Multics was the original developer of CTSS.  A 3rd organization that
deserves credit is IBM -- with OS/360, MVS, and more, they were also
early pioneers in fields such as dynamic linking, and shared memory.  I
believe that almost every major concept in NT that you credit "to
unix", can in fact be traced back to either Multics, OS/360, or
TOPS-10, if not in some cases all 3.  The only exception I can think of
would be networking; I suppose we can blame Sun for winsock, although
really they deserve credit for standardizing what had been a looming
nightmare in Windows.  I'm sure I don't need to name the organization
that was behind CTSS and one of the 3 original players in Multics.

Those "kernel" underpinnings also don't really capture the "Microsoft
experience".  The *valuable* part of Windows "*" is not process
scheduler, filesystem, or VM handler.  Those are all replaceable, as
witnessed by the migration from 32-bit windows (98,ME) to NT, or in
more incomplete form, by WABI and WINE.  The *valuable* part is the
graphics environment, and even more so, and the *huge* array of
"middleware" consisting of DCOM, etc., that go in the middle between
the application and the core OS.  If the justice department had
succeeded in breaking MicroSoft into "OS" and "application" divisions,
it would have been interesting to see where all the middleware went.  I
suspect, for instance, that MicroSoft could have easily ported their
middleware to run on top of Linux, or as easily spun off the "kernel"
division into an open source .org, and kept right on doing "business as
usual" while treating the kernel part as an extension of the PC
hardware platform.  Indeed, it's almost surprising that they haven't
done either.

Open source software also has its roots back in the 60's.  Back then,
you couldn't copyright software, and it wasn't clear to everyone that
software was something you could or should sell.  A lot of software was
pretty openly traded, both between academic and research organizations,
and commercial outfits.  It was only in the 70's that people started
clamping down on this stuff and trying to make money off of it, and
the BSD license was very much a reaction to this turn of events.

The evil part about MicroSoft is not their technology.  They're merely
great borrowers, and that *should* be fair game.  After all, isn't that
what open source is all about?  The evil part about MicroSoft is their
*marketing* efforts.  It's a good thing when MicroSoft uses winsock and
kerberos.  It's a bad thing when MicroSoft uses technology to leverage
marketing, as in their efforts to co-opt Java, HTML, and when they
invent secret kerberos authorization data.  If we're going to beat
MicroSoft up, let's beat them up for the evil things they deserve to be
beat up about.

				-Marcus Watts
				UM ITCS Umich Systems Group

---

From: Derek Atkins <[email-masked]>
Date: 02 Dec 2001 13:20:04 -0500

I should point out that the "pre-conference technical tutorials" are
not necessarily the focus of the conference.  In particular, you
should be aiming your comments at Steve Kent, not at Dave Balenson.
And frankly, Steve doesn't like Kerberos, GSSAPI, or SASL, so of
course he's going to down-play their importance.

In years past there have been a number of good papers based on
Kerberos technology.  However the NDSS conference tends to be more
architectural in nature rather than focusing on implementation.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       [email-masked]                        PGP key available

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 03 Dec 2001 10:54:10 -0600

I Should point out the Cliff Neuman is the Gerneral Chair, and has given
Kerberos tutorials at pass sessions. 

Its a good conference. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444