Slashdot Mirror

Blame firefox for this. A quick google search reveals a large number of extensions for firefox must be uninstalled manually. These include vendors such as Skype, AVG, Sun Microsystems, etc.

http://www.howtogeek.com/howto/internet/firefox/manually-remove-skype-extension-from-firefox/
http://www.technipages.com/firefox-3-cant-uninstall-avg-safe-search-extension-because-uninstall-is-grayed-out.html

I think it's bad design that it's possible. But "Wasn't there some laws being pushed that made this sort of covert install procedure illegal"? Are you high? It's a bootstrapper for clickonce, a feature that comes with .NET, not some extension that's gonna log your bittorrent usage or shoot your baby.

> Do you really expect us to believe that the only secure way of accessing an Office Doc is to quarantine it.
> I thought you had the system totally locked down and AV on all desktops?

As far as I'm concerned, yes. There are far too many vulnerabilities in office docs, and no way for me to lock those programs down. The primary aim of our security practices is to stop malware coming into the building, once it's in we're pretty much screwed. AV is the last line of defence, and one I don't particularly trust these days.

Blocking executable viruses and securing the web browser is easy. Securing Outlook and Office programs is a pain, but fortunately it's not proving too much hassle to manually vet these and we catch 5-6 documents a week that aren't caught by the AV scanning on our email gateway.

I just don't trust AV scanning these days, there's always a window of opportunity for any new virus, and too many viruses are sneaking in under the radar. In the last 18 months I've submitted four previously unknown viruses to the AV companies, two of which weren't detected at all by either Sophos, Symantec or AVG after booting from recovery CD's.

> What are those specialist apps. Do you mind telling me what sector your business is in?

Our sector - structural steelwork, and off the top of my head a quick list of some of our specialist software would be: AutoCAD, Design Review, Strucad, Xsteel, GoData, Farm Design, Multisuite, Procad, Fabtrol, Dema, Union2, Fastrak, Tedds.

None of these are minor, most are absolutely core programs that are vital to our business. To the best of my knowledge, *none* are available under Linux, and at least 4 require some serious graphics capabilities that rule out virtual machines or wine.

> http://www.linuxjournal.com/article/6266 [linuxjournal.com]
> http://en.wikipedia.org/wiki/OpenLDAP [wikipedia.org]
> http://www.bayour.com/LDAPv3-HOWTO.html [bayour.com]

Ok, you've got open LDAP authentication. Now make it as easy to use as Active Directory Users & Computers, with all the functionality (we use a *lot* of it - have you got support for Microsofts IAS there?). You're also missing Group Policy. That sets all our security policies, it configures our computers, and installs all our software.

> http://www.howtogeek.com/howto/ubuntu/configure-how-often-ubuntu-checks-for-automatic-updates/ [howtogeek.com]

Ok, you can do security updates. How about deploying software? What about configuring policies for things like disabling CD-ROM drives, enforcing screensaver timeouts, etc.

> I am surprised as my personal experience is a bit different

I've been doing this a while :) Most of this lot is second nature to me.

> What else do you do apart from locking down and patching?

Everything :-) I'm your proverbial jack of all trades, responsible for:
Servers, Databases, Intranet, Security, Backups, Software Development, Helpdesk, Software Installation, Printers (up to A0), Fax machines, Scanners

We have 13 servers and over 100 individual pieces of software on this network. There are also a further 20+ legacy in house applications in use (mainly visual C++ v5, with the odd visual basic v5 one), and about half a dozen modern ones (developed with visual studio .net or 2005). We have five database servers, a wiki, an intranet, an email server, two firewalls. We run Windows (NT - 2003), Linux, OpenSolaris and ESX, with the Citrix server having been retired.

And believe me, I've simplified things wherever possible. This network is horribly, horribly complex. It took me nearly two years to familiarise myself with it, and we really do use everything I've

'all Office Documents are quarantined before manual release'

Do you really expect us to believe that the only secure way of accessing an Office Doc is to quarantine it. I thought you had the system totally locked down and AV on all desktops?

"it would take a lot longer to get this network working under linux than windows"

I thought Linux did networking as well as Unix, what do your servers/routers/switches/firewall run on?

"the couple of dozen specialist apps that simply don't exist in Linux"

What are those specialist apps. Do you mind telling me what sector your business is in?

"I'm not aware of anything that as easy to use and effective as group policy for securing computers and deploying software"

http://www.linuxjournal.com/article/6266
http://en.wikipedia.org/wiki/OpenLDAP
http://www.bayour.com/LDAPv3-HOWTO.html

http://www.howtogeek.com/howto/ubuntu/configure-how-often-ubuntu-checks-for-automatic-updates/

"I think you'd be surprised just how low maintenance this lot is"

I am surprised as my personal experience is a bit different

"patching software is something we can do in our own sweet time"

What else do you do apart from locking down and patching?

So do it. Keyboard shortcuts are pretty flexible with the right tools.

Personally, I don't see the problem with using either the mouse or the arrow keys. There are Mac utilities to do it, and it's pretty damn easy for Windows users: http://www.howtogeek.com/howto/keyboard-ninja/keyboard-ninja-assign-a-hotkey-to-any-window/. KDE provides a pretty decent keyboard shortcuts configuration tool, khotkey.

You can use that key for other things:
http://www.howtogeek.com/howto/ubuntu/use-the-windows-key-for-the-start-menu-in-ubuntu-linux/

if you are so inclined

Where I work (large financial company), *no* USB drives are allowed without exceptions. If employees need remote access, they are given laptops and VPN access. All laptop hard drives are encrypted. There is a registry key that allows to disable write access to USB drives, and in most cases users are not given admin rights to their computers - so you don't really need to maintain a list of approved device IDs.

Here are the keyboard equivalent of 'up' in Vista's explorer:

http://www.howtogeek.com/howto/windows-vista/up-keyboard-shortcut-for-windows-vista-explorer/

I wouldn't call it laughing. "You are coming to a sad realization. Cancel or allow?"

"If you've used Windows Vista for more than 3.7 minutes, you know what UAC (User Account Control) is.. it's the obnoxious, nagging popup window that will be your life for the next 3-5 years... Note: Disabling UAC will lead to a less secure system, so be warned. -- The How-to Geek

I hope you're not implying that you need a DX10 card to run Aero. Most cards released in the last few years will run Aero Glass just fine, with transparency and the works. It ran beautifully on my Radeon 9700 Pro which I bought in Dec 2002. That might actually be the earliest card that will run it. The basic requirements are DX9 driver support, pixel shader 2.0, and at least 64MB of memory on the card. http://www.howtogeek.com/howto/windows-vista/under standing-windows-vista-aero-glass-requirements/

Hmmm - saying it it's as simple as apt-get update-all would almost be as moronic as stating that linux is even harder to keep patched automatically. Seems pretty much the same to me - click the automatically check for updates/automatically install security updates boxes.

http://www.howtogeek.com/howto/ubuntu/configure-ho w-often-ubuntu-checks-for-automatic-updates/

One of the nicest features of Ubuntu Linux is the automatic update feature, which helps you keep your computer updated with the latest software and security updates. There's also a nice GUI tool that helps you configure how often updates are checked, and can even automatically download the new updates.