[289] in Coldmud discussion meeting

Re: time in the log

daemon@ATHENA.MIT.EDU (Fri May 20 19:16:50 1994 )

Date: Fri, 20 May 1994 15:56:26 -0700
From: rayn@q.crossaccess.com (Ray Nawara jr.)
To: coldstuff@MIT.EDU
In-Reply-To: <199405202252.PAA18068@netcom.com> (deforest@netcom.com)



   > I definitely dont think time should be made in-db. That makes it
   > modifiable from the db, and therefore prettymuch invalid as a logging
   > tool security-wise.

   It is a $sys-only builtin at the moment, so security is not an issue.

That is exactly WHY it's an issue. I'm talking about when an admin
account is hacked. It may be that your only way of detecting this is
via the logs, and if time isnt in the logs, then thats one less clue.
anything that can be changed in-db is not strictly secure
serverwise. (ignoring the in db-security, which may be perfectly
adequate). I dont consider the DB's time function as a trusted thing,
only the server's call to unix, and if time were moved to the db, i'd
be miffed ;) on the other hand, I'd still live, so this is just the
opinon of a currently extremely paranoid individual :)

	Ray / Ash