Slashdot Mirror

As the Month of Apple Bugs (as well as others) prove, OhitSuX appears to be defective by design.

MOAB proved security through obscurity is not security. I would look forward to a "Month of Linux Bugs"... but it seems EVERY month is given that honor.

As the Month of Apple Bugs (as well as others) prove, OhitSuX appears to be defective by design.

MOAB proved security through obscurity is not security. I would look forward to a "Month of Linux Bugs"... but it seems EVERY month is given that honor.

Seeing how many Lunix servers are on the net, this is a pretty reasonable claim.

Lunix: got r00t?

55 'sploits in 2007, and dis pauty iz jus gettin stauted in hea!

Oh, by the way... how is the "Month of Apple being proven the security train wreck it really is" working out? Only 28 more flaws left in the month!

People who live in glass operating systems shouldn't throw stones.

Apple!!! Lunix!!! pwnt!!!

Oh, by the way... how is the "Month of Apple being proven the security train wreck it really is" working out? Only 28 more flaws left in the month!

People who live in glass operating systems shouldn't throw stones.

Apple!!! Lunix!!! pwnt!!!

This isn't the usual anti-Microsoft story

Yes... yes, it is. It is quite the usual anti-Microsoft FUD story, which we can always rely on Slashdot provide. Oh.. and hey! The story is on The Inquirer... which is as rabidly anti-MS and fact challenged as Slashdot is!

File this under "OS Penis Envy", along with every other zealot post by Lunix people wishing their OS were as good as Windows. People who live in glass operating systems shouldn't throw stones.

Windows is on almost every PC in China... but only about 15% of computers in China are legitimately licensed. If Windows is such a horrible operating system, why aren't people using Lunix?

All you need is to get someone to type an administrator password and you can replace or modify vital system files: Software Update does it all the time. Even easier than that, if there's another bug lurking that bypasses sudo authentication or allows privilege escalation.

(Follow that second link and get a chuckle. The vulnerability is in an antivirus program).

If your company isn't using a browser other than IE, please let me know who you work for. I want to be extra careful with any of your products before I consider them for use.

Mmm, mmm mmm.

If you use Windows, go get the vmware browser appliance and use it - connecting to the internet through a virtual machine is like wearing gloves in the OR - it's just common sense.

Since the Browser Appliance Virtual Machine was one the products open for exploit of the underlying OS, I would rather describe this action as handling molten lava using mittens :)

Far be it from Slashdot to let a few facts get in the way:

1. IE Vulnerabilities
2. Safari
3. Firefox
4. Opera

Seems none of them are bastions of secure computing. People who live in glass houses, and all that.

Far be it from Slashdot to let a few facts get in the way:

1. IE Vulnerabilities
2. Safari
3. Firefox
4. Opera

Seems none of them are bastions of secure computing. People who live in glass houses, and all that.

Far be it from Slashdot to let a few facts get in the way:

1. IE Vulnerabilities
2. Safari
3. Firefox
4. Opera

Seems none of them are bastions of secure computing. People who live in glass houses, and all that.

Far be it from Slashdot to let a few facts get in the way:

1. IE Vulnerabilities
2. Safari
3. Firefox
4. Opera

Seems none of them are bastions of secure computing. People who live in glass houses, and all that.

Start?

> patched with in a week

http://www.securitytracker.com/alerts/2005/Feb/101 3087.html

Yeah, that Firefox is pretty bulletproof in it's security...

Pat, I love ya, but you really need to get some more people on board. You can't be trying to do everything.

What's up with 10.0? There has not been a security update for a long time. Good to see you've upgraded to 2.4.29 for current, but the poor schmucks who are still running slack 10.0 might not know about this bug which allows local users to become root. I tried it myself on my slack 10, and it works (not every slack 10 box can reproduce the exploit, but I, for one, could). There are other bugs in 10 which really do call for a notice, but that one was enough to make my point.

I guess the fact that there are no longer any security bulletins should clue everybody in. Either stay current, or don't use slackware, for the time being.

Seriously - when was the last time you heard of an exploit that used straight HTML? All of the recent exploits in ALL browsers, IE included, have been in either Javascript or Active-X, not in the core HTML rendering.

Actually, I remember recently seeing exploits in the image format engines for both Mozilla (See item number 6 in link) and IE.

You mean the same routers that ship with remote administration enabled by default ? Even just telling people to plug their comps into a router still leaves them vulnerable in other ways if they just so happen to end up with the routers that ship with broken settings by default. With routers shipping with such badly configured default settings, it isn't too hard for the next worm to auto-probe for those specific routers and then do a full port scan of people behind the very router that they thought was protecting them.

So, by this equation, it is clearly easier to 0wn Linux. Take that, Microsoft!

So, by this equation, it is clearly easier to 0wn Linux. Take that, Microsoft!

So, by this equation, it is clearly easier to 0wn Linux. Take that, Microsoft!

It's worth mentioning that Linux and Mozilla have occasional exploits as well.

No it isn't. Linux isn't an email client, and one isn't occasional.

"... as if "being better than Outlook Express" were a redeeming quality."

In a sense, it is.

Again, no it's not redeeming.

One would think that those basions of error free programming, Linux and PalmOS, were immune to viruses. Such does not appear to be the case, however.

One would think that those basions of error free programming, Linux and PalmOS, were immune to viruses. Such does not appear to be the case, however.

Come on guys, get a grip. The alternatives have just as many flaws. But amazingly, Slashdot turns a blind eye to them.

I guess its true that Slashdot only deals out anti-MS FUD.

Come on guys, get a grip. The alternatives have just as many flaws. But amazingly, Slashdot turns a blind eye to them.

I guess its true that Slashdot only deals out anti-MS FUD.

Come on guys, get a grip. The alternatives have just as many flaws. But amazingly, Slashdot turns a blind eye to them.

I guess its true that Slashdot only deals out anti-MS FUD.

Come on guys, get a grip. The alternatives have just as many flaws. But amazingly, Slashdot turns a blind eye to them.

I guess its true that Slashdot only deals out anti-MS FUD.

you are correct, Microsoft Internet Explorer Integer Overflow in Processing Bitmap Files Lets Remote Users Execute Arbitrary Code

My mail client (mutt) does not run under an account that has full access to the entire system. Instead, it runs as me, and cannot replace parts of the OS even if it wants to. So it can't do things like replace part of the TCP/IP stack

Oh yes, so secure.

I'll take Postfix, thanks.

Exactly how is "Windows Source available on the internet" more dangerous than "Linux source available on the internet" ?

• Somebody,
• please, monitor this bug (or teach me how to monitor it)

Then use this one.

That wouldn't work in this case. Overflowing a signed integer so that it wraps around to negative won't be picked up by checking if the value is greater. Using the correct datatype (unsigned int) would have been better.

(in fact, looking at the code snipped in the vulnerability notification, they do check against Offset > size of buffer)

Ok, now its obvious this guy doesnt know his ass from a hole in the ground, security-wise. Some may not see it as quite so secure. At least, not out of the box...

How many r00t vulnerablilities did linux have in the past three months? How many Linux vendors got hacked because of undisclosed, in the wild exploits? How many of these effected Linux systems? I think Linux has enough to worry about with their own glass house, and should worry less about throwing rocks at other OS's.

Perhaps you should take some classes in biology - then it will make more sense to you, and you'll have a more rounded education.

Ah, the old analogy straw man. How about you take some computer classes? Because like all analogies, yours is flawed. A man-made construct is very different from a biological system. If biodiversity is so great, why do they sterilize surgery rooms? Answer- because they WANT a controlled monoculture.

Please compare this and this. To be blunt, neither of them appear to be the apex of computer security; people need to stop kidding themselves about how secure Linux is, or it will never get better.

Please compare this and this. To be blunt, neither of them appear to be the apex of computer security; people need to stop kidding themselves about how secure Linux is, or it will never get better.

Who was it at MS who basically made that statement that regarding security, they ALL suck? What Linux really needs is somebody to tell their community the same thing, instead of continuing to burry their heads in the sand.

Linux (ANY)

and

Windows XP

But even this is unfair... It should be Windows (ANY), if you're going to compare any flavor of Linux to any flavor of Windows.

Linux (ANY)

and

Windows XP

But even this is unfair... It should be Windows (ANY), if you're going to compare any flavor of Linux to any flavor of Windows.

Linux (ANY)

and

Windows XP

But even this is unfair... It should be Windows (ANY), if you're going to compare any flavor of Linux to any flavor of Windows.

Looks like your second link is for Windows (any). The link for Linux is here.

Here is Windows XP

Here is Linux

As you can see, WinXP has far less problems than Linux. Its just that Linux users want the sizzle, not the steak, so they just keep sizzling about how secure their OS is. Instead of bragging about how secure they are compared to MS, they need to start tightening up their code. But I suppose that isnt as much fun as creating yet another web browser.

Here is Windows XP

Here is Linux

As you can see, WinXP has far less problems than Linux. Its just that Linux users want the sizzle, not the steak, so they just keep sizzling about how secure their OS is. Instead of bragging about how secure they are compared to MS, they need to start tightening up their code. But I suppose that isnt as much fun as creating yet another web browser.

Ya, I mean, look at all these! What a frickin' insecure P.O.S. it is! Oh wait, thats not Windows...

Also, I hate how people say "oh, well, it was only a local exploit..." It shows they dont understand the methodology used by malicious hackers. You use one flaw to give you remote access, then leverage that remote access into exploiting the local access flaw.

How else do you think Debian was hacked with a mere local access exploit?

1. On laptops.
2. When someone had sudo running in Terminal.
3. When the computer was put to sleep.
4. For 10-20 SECONDS after the computer was woken up, but before the clock was updated, someone with physical access to the computer could execute code.

They both forgot to mention this page...