Re: Informix and trusted host access

First, let me say "GOOD GOD! What the heck is going on here?" I just can't believe the responses that are bouncing around about a simple net comment I made. I thought this place was an open forum where people were allowed to exchange ideas. A followup I posted to Jonathan Leffler's comments on trusted host access have been totally blown out of proportion. I hope some of the people who have posted here do a better job of reading manuals and such than they do at reading netnews before the reply. Granted, I haven't gotten a swamp of personal mail here, but there seem to be a whole lot of people jumping to the aid of a person who wasn't attacked and one poor soul who mistook a few simple comments for a personal bashing! If anyone wants to followup on this one, please read it thoroughly! First, we have the original post which was about trusted host access using Informix-NET. Granted, although I am an Informix user I don't use Informix-NET, so I wasn't completely clear about specifics of the product. However, there were some statements made in the discussion that I felt treated security in general very casually. The whole concept of either disabling pieces or security through obscurity botherecd me. I realized that these comments Jonathan was making were personal opinion, so noted with a disclaimer (as I include myself), and NOT company policy. Still, I thought it was my right to comment, was it not? Anyhow, I posted the followup and maybe made a couple of tongue-in-cheek comments, but nothing I felt was offensive or intentionally hurtful. I really was trying to be constructive and point out holes and misconceptions (as I saw them anyhow). Then. . .BANG! This post comes out. In <1rjkjpINN4nr@emory.mathcs.emory.edu> obelix.informix.com!johnl@emory.mathcs.emory.edu (Jonathan Leffler) writes: >Dear Reader of comp.databases.informix, >It has been made abundantly clear to me that I do not understand sufficient >of the problems of secure access from untrusted hosts to be able to comment >usefully on the subject to the net. I never said that Jonathan and if that's the way you read it I am sorry, not for the comments, but for the misunderstanding. Besides, my comments were mainly dealing with opinions, not your understanding of security. >I therefore unreservedly withdraw any comments I have made during the last >month or so explaining the hows and whys of Informix-Net and Informix-Star >operation in such circumstances, and I apologise for wasting people's time. Good GOD Again! I sure hope your boss made you do this and it wasn't your own idea. If it is some kind of stupid management staff that coerced you to post this followup, then I understand and they should be shot :-) (again, tongue-in-cheek). If it was your own idea then your making entirely too much of this. >I would also like to take this opportunity to remind the net that although >I work for Informix, I do not speak on the net in ANY official capacity -- >the "#include <disclaimer.h>" in my .sig is not there for because I like it >(though I do), but because I have no official capacity when I utter and >therefore my comments do not represent official Informix policy. There are Most of us on the net carry this same disclaimer in one form or another. Besides, I thought they were virtually implied anyhow. I realized this when I posted the followup, and referring to it now (yes, I went back and saved my original posting to cover my BUTT), I made no comments implying that this was official Informix policy or the attitude of the company. In fact, in the original, I posted the following: >>Yours, >>Jonathan Leffler (johnl@obelix.informix.com) #include <disclaimer.h> > >I'm sure you contributed lots of useful stuff here and I'm always glad >to see vendors on the net. Don't take the responses wrong, I'm just a >bit disappointed in the casual attitude to security and versatility from >the employee of such a well known vendor. >-- >-----------------------+--------------------------------------------------- >Charles "Chip" Yamasaki| The opinions expressed here are my own and are not >chip@osh1.OSHA.GOV | supported or even generally accepted by OSHA. :-) >-----------------------+--------------------------------------------------- Note Jonathans careful placement of the disclaimer statement, informing me that he, in fact, does not speak for Informix, but is simply voicing his own opinions and sharing his knowledge. Also note his E-Mail address, johnl@obelix.informix.com, indicating that he is AT (@) Informix, not that he IS Informix. Then note that I started by acknowlegded his contributions and that I was glad to see vendors on the net (I really am). Also note that I started the very next sentence with "DON'T TAKE THE RESPONSES WRONG", which he, June Tong at Informix (via E-Mail), and many netters proceeded to do. Also note that I said I was disappointed at the attitude of an employee, NOT THE COMPANY. Finally, note the careful placement of my disclaimer (to the right of my name in the sig), stating that, not only do I not speak for OSHA, but that others often disagree with me. (although they're wrong :->) All-in-all, an effective exchange of communication, I thought. I guess. . .NOT! >a number of areas where I do know the answer (or, at any rate, I think I >know AN answer) to the problems; there are also some where I don't. The >team of Informix employees who answer your questions are volunteers who use >their accumulated technical knowledge to help you. As far as I am aware, >none of us work in R&D. I don't care if you are a custodian in a building next door to Informix, if you have something to say, useful or not, right ow wrong, you should be able to on the net. I think people should view the E-Mail address and organization header in the posting more as interesting tidbits of background info than as an implied spokesmanship (spokespersonship?). >Yours apologetically, >Jonathan Leffler (johnl@obelix.informix.com) #include <disclaimer.h> No neeed to appologize, that's the whole point. I though it would probably be enough to let this one lie, but NO! I get a E-Mail message from June Tong of Informix which virtually acused me of making "an indictment of Informix's attitude to security" and said "I'm sorry THAT Jon and Informix products have failed to satisfy your concerns about security". Hmmmm. Did I say that? NOT! (again) Wait, it gets better. Then I see a slew of postings that amused me to no end. I have this one from Mark Heringslake: > I feel obligated to add my few cents worth regarding the apparant putdown >of anyone on this network, specifically Jonathan Leffler.... > I didn't "put him down". I used no personal derrogatory terms, no name calling, no foul language, etc. I simply expressed my oppinions. I thought it was my right, right Mark? Or did you just not know the background behind the event on which you were posting? Then he goes on with the painfully obvious, saying: > 1) The opinions expressed on this network are just that - opinions. > The values expressed are useful a