vendor incompetence

[Dan Hollis <goemon@anime.net>]

if anyone thinks the current opsec draft is too harsh, i would argue it's 
not harsh enough.

http://www.cs.wisc.edu/~plonka/netgear-sntp/

We need to make sure the opsec rfc prevents vendors from 'pulling a 
netgear'.

I also did some thinking on the issue of embedded default passwords and 
came upon a solution: if a vendor chooses to use an embedded default 
password in their product, the password MUST be no less than 24 characters 
long, consisting of at least 25% numeric characters, and no more than 3 
consecutive alpha characters.

the idea is to make the embedded default password annoying enough that the 
user will be compelled to change it from the default. (Rationale: a poorly 
chosen custom password is at least more secure than a globally known 
default password)

we could provide a reference algorithm in C to generate random default 
passwords.

-Dan