Commentary: If only Cisco code had been open source, May 18, 2004

The 15 May 2004 theft and publishing of the source code for Cisco's IOS router firmware could mean a wave of exploits against the critical router infrastructure of the Internet will be on its way. If that happens, it will be because Cisco ignored one of the iron rules of network security -- and experts the world over will be muttering "if only IOS had been open source."

The iron rule is Kerckhoffs' Law, which states, "A cryptosystem should be designed to be secure if everything is known about it except the key information." Now that the source code of IOS is circulating in the cracker/phreak underground, we're going to find out if IOS followed that rule. If it didn't, we'll find out the hard way.

A SCO Group insider has leaked an internal company memorandum discussing its relationship with Microsoft, and it reveals that SCO is apparently collecting a lot bigger payoff from attacking Linux than anybody knew.

I've just gone through the experience of trying to configure CUPS, the Common Unix Printing System. It has proved a textbook lesson in why nontechnical people run screaming from Unix. This is all the more frustrating because the developers of CUPS have obviously tried hard to produce an accessible system — but the best intentions and effort have led to a system which despite its superficial pseudo-friendliness is so undiscoverable that it might as well have been written in ancient Sanskrit.