Hi Cyrus,
>When you post a security problem here, what guarantee's do you have that Mitel
>will even notice it? When you send it to Mitel, you get a tag number and
>confirmation that they have recieve it and will be looking into it as soon as they
>can.
Actually, I have a long held belief that there should be another forum topic specifically for security and/or bugs. So then, instead of posting to general or exp. users forum, they should post it there. This then should be a Mitel monitored forum (which by the way, I believe all the current forums are monitored, just not necessarily often enough or responded to).
>Also you might send into panic all the users who aren't so technically inclined
>into posts on wether a posted problem has been fixed or not, when sometimes
>the problem did not affect SME in the first place.
I also believe, if you have a forum dedicated to these issues (that has been presented correctly), you will also go a long way in quelling any "panic attacks" and fears that might arise. Eg. Look at the Symantec (or any other major AV vendor's) web site. If there is a new or potentially dangerous outbreak, there's always an entry on the main page telling you about it. And if a fix or repair tool is available, then you can download it. The same should apply in SME. If a problem is identified and noted visibly on the correct forum, then anyone going to that page will be able to see that it has already been brought up, addresses or being looked into. If a fix is available, MAKE it available for download, much like a M$ "hotfix" update. Then, there will be less of a need to tell people "Search first and you will find ...." especially if it is a current topic (like the current Samba issue).
>I have no problems with people posting security issues, just as long as they
>have contacted Mitel first and then if they are either not happy with that responce
>or need more information, then post here with Mitel's reponce and then we all
>know where Mitel stands on the certain problem, does that not make more
>sence then stiring up a hornets nest sometimes for nothing?
I would not call bringing up security issue awareness "stirring up a hornets nest for nothing". Becoming complacent about security is worse. However, even if you send a bug / security request to Mitel, it could be sometime before you hear back from them, as we are not paying customers, and are thus attended to with lower priority. However, paying customer or not, most bug issues can and do affect their server product and a fix for us is also a fix for them, and the sooner the better.
I respect your opinion on this and am very aware of your point of view (been around computers long enough !) and believe me, I'm not offended in any way at all. I've said in my original posting that this is a double edged sword. Everyone life experiences help shape his or her own thinking and opinions.
> Noone bothered to answer the poor man's question.
No should really have to because this comes down to poor documentation. Yes, the source is there, blah.. blah.. blah.. Not everyone who uses SME should be expected to be Linux proficient. Ideally, SME users should not even need to go near a command prompt. Lots of Windows users I know don't know about a command prompt at all but they get by everyday and get work done. It really irks me that no documentation exists for :-
a) Major component versions in use for a particular SME release
(Mitel is proud to announce the release of SME Version ......
This is a major update to .....
This version is based on :
Redhat Version aaa.bbb
Samba Version nnn.mmm
MySQL Version fff.ggg.....)
b) What are the templates / events / databases in use, what are the values, settings, what do they do, which template does what which affects what (a flowchart helps) and so on.
Kelvin
9 Replies
648 Views