Agent security token again

Heiko W.Rupp hrupp at redhat.com
Wed Apr 11 12:56:07 UTC 2012


Am 11.04.2012 um 14:53 schrieb John Mazzitelli:

> Well, for this specific error condition, what we are rejecting is the possibility of someone trying to hack the system and steal another (already registered) agent's identity. In this case, I don't think we want to be overly helpful and friendly :)
> 
> If you are a developer and you get this, you obviously aren't hacking, but then, you should know how to fix it.
> 
> In production and you get this - while we cannot be 100% certain, it is POSSIBLE that you are trying to hack the system and steal the identity of another agent (we should assume you are to be on the safe side)  - in this case, boo to you :-)

Adding "Please use -Dblabla" to fix this, will help people and bad guys would find that option anyway. Security by obscurity has never worked.



More information about the rhq-devel mailing list