Date:	Fri, 8 Jan 1999 15:41:14 -0800
From:	Jon Speer <speer@TRIPWIRESECURITY.COM>
Subject:      Re: Tripwire mess..
To:	BUGTRAQ@NETSPACE.ORG

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I would add as well that we have every intention of occasionally
dedicating resources to updating the "Academic Source Release" based
on feedback from the user community and keeping it a no-cost license.
Please feel free to submit requests for features or fixes to myself,
support@tripwiresecurity.com, or through the bug reporting form on our
web site.  While we are building a company around the commercial
release, we do not want the spirit or functionality of the academic
version of Tripwire to die.

Jon Speer
Product Manager

Tripwire Security Systems, Inc.
615 SW Broadway, Suite 200
Portland, OR  97205

Phone: 503.223.0280
Fax: 503.223.0182

http://www.tripwiresecurity.com

- -----Original Message-----
From: Bugtraq List [mailto:BUGTRAQ@NETSPACE.ORG]On Behalf Of Gene
Spafford
Sent: Thursday, January 07, 1999 6:40 PM
To: BUGTRAQ@NETSPACE.ORG
Subject: Re: Tripwire mess..


The patches for the old version of Tripwire with the 8-bit problem
have been in circulation for a while, and the source code is
available.   If someone wants more than that, the commercial version
is available (as Austin noted).

Tripwire 1.2 was released in August of 1994.  Other than systems
coming along after that so that the 1.2 distribution didn't have
config files, there were only 2 significant bugs or problems reported
in over 4 years: the timing problem, and the 8-bit filename problem.
We posted a fix for the timing problem, and the 8-bit fix has been
floating around mailing lists and newsgroups for years, and the fixed
version was being shipped with RedHat at one point.

We do research here at the university -- not product support.  When
Gene Kim's company offered to license Tripwire, maintain it, and
enhance it, we were happy to turn it over to them.  Not only was Gene
the original author, but we were happy to hear that it would get
ported to a Windows environment and enhanced in other ways, too.

Thus, for the community happy with freeware and source code, you have
TW 1.2 for Unix, and you can patch it or extend it as you wish, so
long as you respect the copyright and trademark restrictions.

For the people who want a formally-supported product or new features
or new platform support, contact the folks at Tripwire and see what
they have to offer.

In either case, I would argue that the code is being properly
maintained, as Austin noted.

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.0.2

iQA/AwUBNpaXmQaEFQl7sSAMEQLD6QCgjDcvqTKq4f5LwV099RMLVEE5sL8An2if
Dkq533TYICoEQjVCVywO+qor
=W2p0
-----END PGP SIGNATURE-----