Wouldn't it be wonderful if we could have this discussion without mentioning the M-word?
It seems to me that the OS vendor's ethical obligation is to produce the most secure platform they reasonably can and to fix any and all problems in it for free. Beyond that, lots of security problems exploit weaknesses in things other than the OS (like, say, the users) and there will always be a place (market?) for protection against those things regardless of how secure the OS platform is. Further, I'd bet that most of us are fans of defense in depth. Even if an OS was as secure as it could be and patches were free and ubiquitous, wouldn't it be prudent to layer something on top of that? If the OS vendor is acting ethically, following the obligations mentioned above, what difference could it make who produces the layered security product? The so-called conflict of interest arises from the perception, rightly or wrongly, that the OS vendor might be tempted to act in a less than ethical manner. If we presume ethics always and punish severely ethical lapses (which we should do regardless), it doesn't matter who produces the security platform. It would be most interesting to have a poll on this subject, both of the security community and the public at large. Scott -----Original Message----- From: Mark Litchfield [mailto:[EMAIL PROTECTED] Sent: Friday, March 16, 2007 2:49 PM To: bugtraq@securityfocus.com; [EMAIL PROTECTED]; full-disclosure@lists.netsys.com Subject: Your Opinion I have heard the comment "It's a huge conflict of interest" for one company to provide both an operating platform and a security platform" made by John Thompson (CEO Symantec) many times from many different people. See article below. http://www2.csoonline.com/blog_view.html?CID=32554 In my personal opinion, regardless of the vendor, if they create an OS, why would it be a conflict of interest for them to want to protect their own OS from attack. One would assume that this is a responsible approach by the vendor, but one could also argue that their OS should be coded securely in the first place. If this were to happen then the need for the Symantec's, McAfee's of the world would some what diminsh. Anyway I am just curious as to what other people think. Thanks in advance Mark
