Slashdot Mirror

For my browser choice, a few fractions of a second rendering doesn't make me feel warm and fuzzy. I get my cyber jollies from using a browser that has the least number of vulnerabilities. Afterall, those few milliseconds don't add up to the all the down time you might otherwise be stuck with.

I found this on SecurityFocus: Microsoft Windows XP Explorer.EXE TIFF Image Denial of Service Vulnerability. Looks like Symantec is proactive, but then that is what their Bloodhound stuff is for.

I guess my posting of this wasn't good enough for the editors so I am going to add a related article that shows how the US could go after any security expert who aids offshore gambling sites. Can read all about it here Very interesting theories for the security people here to think about.

Still, despite the obvious comical aspects, I'd hate to see this sort of thing come into being, and I expect these people to agree with me on that.

--
(with thanks to subgeek)

Nah, Boba utilizes his honeypot at bobafett.org.
He read securityfocus's article about making one here: securityfocus.org/infocus/1747
(note, I've been getting some connection problems, here is the google cached version.)

....your Microsoft O/S is completely secure.

Red Carpet makes all other package management systems look silly, including rpm, and up2date.

In a world like ours with Joe and Bob trying to unify/standardize their linux (United Linux, LSB), and Fred and Sam trying to stabalize theirs (Debian GNU/Linux), users are left to figure out what might be best, safest, easiest to use.

If your a newbie, do yourself a faver and use Ximian Gnome, red-carpet in particular. I use KDE, but still use red-carpet to keep my system up to date when a new security hole needs patching, or to do cool stuff like install ruby.

There is life beyond apt.

Doesn't my hometown have beatiful girls?

For more info on exactly what is going on, see these following links:

http://www.securityfocus.org/archive/1/211663

I could say the same to you... Research...

Remember the hole in BIND from the beginning of this year? Big as a truck? If I recall correctly it was a TSIG related buffer overflow that made it possible to run code at the same priviledge as BIND (often root)...

A system with that problem was remotely available.

Go check http://www.isc.org/products/BIND/bind-security.htm l and, as always, Securityfocus is a great resource to use when investigating security flaws.

You are (thus far) right about BIND 9 though.

But the linux kernel is not reentrant and interruptable (though progress is being made in that direction I believe). Remember this bug reported not too long ago? This bug would never have occured on BeOS.

His nominee as replacement for Janet Reno was one of the few people fighting FOR the rights of individuals to be able to encrypt data without being forced to turn over keys to government agencies.

Of course you won't see this on the slashdot front page, as just about everyone with editorial control has some kind of irrational fear of republicians in general and Bush in particular.

I think it all comes down to whether Republicans want to be more friendly to the big business of entertainment or the big business of consumer electronics. Which group gave more money to the party?

I work for money. I choose to use some of that money to contribute to organizations that share my goals and philosophies, and expect them to lobby on my behalf. I don't begrudge companies that do the same, so long as they are not a monopoly (in the legal sense, in which case they have some pretty tight limits on what they are allowed to do).

IMHO... Bill

I think you want securityfocus.org.