Re: [cobalt-users] Cobalt to provide compensation for server hack?

[Colin Smith <colin@xxxxxxxxxxxxxxxxxxxx>]

On Sat, 17 Feb 2001, System Admin wrote:

> One of our RAQ3 servers was a victim of the recent hack. Has anyone taken up
> the issue of compensation for this incident with Cobalt? Surely they must be
> liable as they failed to provide sufficient server protection. We had all
> patches loaded and security was still compromised.


Um, do Cobalt say that their boxes are uncrackable? Nope. Is it *your*
responsibility to make sure that your network remains uncompromised? Yes.

Cobalts are a doddle to set up and get on a network. The do pretty much
exactly what it says on the tin. If you drop those boxes onto the Internet
without really understanding what's required to harden vanilla boxes then
I don't see how it can be Cobalt's fault.

It's one thing to run an easy to use vanilla server appliance on a secure
network, it's quite another to run a hardened server on the Internet.
Being competent to do the first does not make you competent to do the
second.

Your time would be better spent auditing your systems. You're on the
various security mailing lists? You're a member of a reputable
professional computing body?

-- 
regards,
Colin.