Domain: tripwire.com
Stories and comments across the archive that link to tripwire.com.
Comments · 42
-
Re:I admit I'm curious
Time off and mentoring isn't exactly the full ride and 40k stipend women get for showing up and having a 3.3 GPA in my field.
I'd love to see links to these male-only veterinary programs for comparison.
-
Re:How to avoid these vulnerabilities
-
Eat your words: Cryptowall's from malvertising
Zedo specifically & malvertising stopping's a HUGE PART of what my program prevents infection from - C&C list to stop it versions 1.x-4.x:
1.x (source https://barracudalabs.com/2014... )
hindustantimes.com, bollywoodhungama.com, one.co.il, codingforums.com, mawdoo3.com, zedo.com, c1.zedo.com, c2.zedo.com, c3.zedo.com, c4.zedo.com, c5.zedo.com, ss1.zedo.com, static.rcs7.org, xenon.asapparts.com, rcs7.org, asapparts.com
2.x-3.x (source http://blogs.cisco.com/securit...):
paytordmbdekmizq.tor4pay.com, tor4pay.com, paytordmbdekmizq.pay2tor.com, pay2tor.com, paytordmbdekmizq.tor2pay.com, tor2pay.com, paytordmbdekmizq.pay4tor.com, pay4tor.com,
eportfolio.ccpullman.ca, ccpullman.ca, www.mg-unterburg.ch, mg-unterburg.ch, www.sportantiques.co.uk,
sportantiques.co.uk, www.drk-wettringen.de, drk-wettringen.de, www.rock-times.com, rock-times.com, www.footstepphotography.co.uk, footstepphotography.co.uk, www.choosingcruising.co.uk, , choosingcruising.co.uk, www.felixwoman.com, felixwoman.com, www.projetorideal.com, projetorideal.com,
www.jimcole.be, jimcole.be, www.jes.or.at, jes.or.at, or.at,
artpartner.cz, www.meihuainfo.com, meihuainfo.com, www.grekiskaforeningen.com, grekiskaforeningen.com, www.cup-neumann.de, cup-neumann.de, ww.areaverda.com, areaverda.com, , www.yemekyapmak.com, yemekyapmak.com4.x (source http://www.tripwire.com/state-... ):
abelinda.com, purposenowacademy.com, mycampusjuice.com, thegingod.com, yahoosupportaustralia.com, successafter60.com, alltimefacts.com, csscott.com, smfinternational.com,
lexscheep.com, posrednik-china.com, ks0407.com, stwholesaleinc.com, ainahanaudoula.com, httthanglong.com, myshop.lk, parsimaj.com, kingalter.com, shrisaisales.com, cjforudesigns.com, mabawamathare.org, manisidhu.in, adcconsulting.net, frc-pr.com, , localburialinsuranceinfo.com, smfinternational.com, 3wzn5p1ylumh7ak.j.paypartnerstodo.com, j.paypartnerstodo.com, paypartnerstodo.com, 3wzn5p1ylumh7ak.j.allepohelpto.com, j.allepohelpto.com,
allepohelpto.com, 3wzn5p1ylumh7ak.j.barklpaypartners.com, j.barklpaypartners.com, barklpaypartners.com, 3wzn5p1ylumh7ak.j.maverickpaypartners.com, j.maverickpaypartners.com, maverickpaypartners.com,* What's that you said that my program doesn't stop "Common Ransonware Threats"?
APK
P.S.=> My last post also puts down another 'variant' of it in CryptXXX / Locky... want JAKU too? apk
-
Re:Owner
It seems reasonable to me that San Bernardino county could ask Apple, politely, to please break the encryption. No warrant, no lawsuit, no precedent. Just a customer request.
They've done that, Apple said no. A judge told Apple to do it, Apple said they would challenge it in a higher court.
Look at the timeline:
http://www.tripwire.com/state-...This is total PR bullshit on Apple's part, who never gave a shit about privacy or confidentiality in the past. That corporation, which is rotten to the core, is just a disgusting marketing machine and that's just the latest example. Fuck Apple.
-
Pentagon doesn't say $$$
None of the articles I Googled showed numbers. I'm skeptical the public side of the government can compete with the private business sector. Facebook split $900k over 210 people (or a whopping $4,300k per person) for their bug bounty program, and I can't believe that many people put that much effort into cracking top-notch security at Facebook for that little. In contrast, "black market" (I'm pretty sure vulnerability disclosure isn't illegal, yet) prices for an iOS RCE are $1m+, and I bet our government would pay more for it. http://www.tripwire.com/state-...
-
Half the marketing departments I've seen
Roughly half the marketing departments at companies I've worked for have used half-baked surveys to gather statistics so the company name and the statistic get repeated in the industry over and over again.
This often happens like this: "At (industry conference) this year, let's pass out a survey asking whether or not someone has every heard of a coworker getting hacked by (whatever threat our product purports to mitigate). Survey goes out to already half-paranoid people walking by, and the entire marketing and sales department fills one out that says 'yes I have'. A week later a press release goes out that says "(company) surveyed (# of people) IT managers and other attendees at (conference) and found that (high percentage) had direct knowledge of a coworker getting hacked by (threat)." Very often this stuff gets picked up by the press, bloggers and even other competitors, and the essentially made-up stat gets repeated and repeated until some people even think its true.
Examples:
- http://www.tripwire.com/compan...
- http://www.prnewswire.com/news...
- https://www.voltage.com/breach... -
Re:my submission was plagiarised.
my words were stolen to promote a poorly written substitute to the story that i quoted and that i intended to share. if the plagiarist wanted to promote a different story, then that person should never have used MY NAME nor MY WORDS to do so. this bait-and-switch plagiarism should not be allowed to stand on this, or any, reputable site.
First off, calm down. Bait and switch - I do not think it means what I think you think it means. And given that the folks who make those decisions have been catching a load of bad feedback from references to Forbes.com, they did think your story was interesting enough to search out an alternative link.
That's all. I do suspect that you will never again have to worry about them "plagiarizing" any submission of yours in the future.
FYI: here's the link to the story that i shared: http://www.forbes.com/sites/gr...
i am sure you'll agree that the piece i shared is far superior to the bait-and-switched australian geographic story.
I'll never know, because I won't ever see that article, because I won't disable my adblocker. By the way, this isn't just petulance upon the part of many Slashdotters http://www.tripwire.com/state-...
https://adland.tv/adnews/forbe...
http://www.networkworld.com/ar...
Angler Exploit Kit and CryptoWall ransomware https://nakedsecurity.sophos.c...
Befause Forbes is such a noted provider of these malware exploits, and demand you enable the mechanism to allow them installed on your computer in order to see their content - Naaahhh ain't happening.
Regardless - you cured your own problem with your outrage.
-
Re:Awesome ...
-
Re:This is pretty common.
So you are bragging you are running Linux which has more vulnerabilities than Windows while being "forced" to run Windows for games? Aww poor baby!
Shellshock, Heartbleed, the assraping of Linux is just starting and its gonna get a HELL of a lot worse. While MSFT has had a big ass bullseye painted on them for years to drive them to increase their defenses Linux has been coasting on security by obscurity, well those days are over friend. Android is getting pounded by nasties and Linux is just getting beaten up as you can see and another Shellshock on the way there are even calls for a security audit in light of the constant pounding its gotten.
Frankly the FOSSie faction should be getting scared right about now, MSFT has been hardening their OS and getting their lessons in a war with the malware writers, now you have Low Rights Mode, ASLR and DEP, Secure Boot, Windows isn't the easy target anymore....Linux is. Between the coasting on security by obscurity, an OS made up of teeny tiny fiefdoms that don't collaborate or care, and oh yeah...a new spreading mess known as Systemd spreading tendrils in more and more critical systems while being run by a guy that blogs such "wisdom" as "can't get systemd running on ARM, shipping it anyway" the low hanging fruit? Its Linux and Android.
So get ready for it, because it looks like in less than 24 months you'll be posting "I HAVE to run Linux on one system for a program I need, the rest are running Windows". And when that day comes? You can thank Torvalds and all the other arrogant old guys that can't see beyond their own little gardens that have let Linux become a weak walled buggy mess.
-
Re:Closing the Barn Door...
Nice Try but no:
Target runs most of their systems on Microsoft (except for the pharmacy app which runs on Linux in a VM). In each store Microsoft System Center provides the distribution point for application updates and security patches to 170+ devices per store including the point-of-sale register systems.
-
Re:So...
First, it's Trapwire. But that's a good question. I don't suppose they will offer a formal answer any time soon, so I will assume it's all connected -- and then some. You might also note that the DHS is quite involved with this NGI thing too. It''s an epic party for the voyeuristic elite and the citizenry aint invited -- a Closed Circuit (Sneak Preview) Authoritarian Freak Feature Presentation.
PS: Although you likely did not intend to refer to Tripwire -- a company involved in IT security -- in regard to the Strafor leaks, it is indeed Trapwire . -
Tripwire
I believe Tripwire grew out of an academic environment. (Purdue? I think.)
-
Re:Ghostbuster is different and FIRST...
I hadn't realised that Rootkit Revealer was copied from Ghostbuster and written in only a week to boot. Makes you wonder why MS went to the bother of buying Sysinternals. But didn't similar functionality exist previously in Tripwire.
-
Re:And if you use those codecs with MPlayer on Lin
and there are no "automatic" tools to sweep it clean
meh...not sure I entirely agree with you here, although I will concede that many Linux users don't know what tools are available and even less use those that are available on a regular basis.
Tools that I use regularly to keep tabs on my boxen:
1) http://www.chkrootkit.org/chkrootkit: can be run from cron to look for suspicious files and rootkit signatures;
2) netstat -ep: to show what processes are using network connections;
3) lsof: to show what files on your system are open, who opened them and with what process they were opened;
4) http://www.tripwire.com/Tripwire or http://www.gecko-ak.org/Sentinel/my own, open-source, much less functional, still really in development Tripwire-like file system auditor: to check for changes in binaries, config files or anything else on your file system that you would like to keep tabs on;
5) http://www.insecure.org/nmap: to remotely scan computers on your network for open ports, and to audit the services using these open ports;
6) http://www.nessus.org/nessus: like nmap, only different;
7) tcpdump/ethereal/wireshark: to monitor packets in or out of your computer;
8) http://www.snort.org/snort: okay, I haven't (yet) used this one, but it's the open-source standard for IDS;
9) http://www.bitdefender.com/bit defender: anti-virus for Linux--we had to use this once at work to remove a Windows virus that had infected our Samba shares (note: the Samba server wasn't infected, but the Windows machines that were mounting shares from the Samba server were--and they kept rewriting infected Windows executables to the server).
So, no most of these aren't automatic, and most of these won't clean your Linux PC's, but there are a host of tools that you can use to detect problems on your Linux computers. And, if you're really paranoid, there are several vendors that provide anti-virus software, just like what you find on your Windows machines. -
Re:Offline rootkit scanner?
You mean like Tripwire? http://www.tripwire.com/products/enterprise/serve
r s_desktops.cfm
Tripwire, btw, says that it "can monitor Windows alternative data streams to detect and log changes, additions, and deletions. FS and DT components help prevent negative impact from hidden, unknown, or malicious configuration data to improve baseline control." So it would be able to detect this. -
Re:Tripwire+CFEngine
-
Tripwire+CFEngine
-
TripwireSurely Tripwire would catch any attempts to move the OS into a VM ?
I don't think you can move a running OS into a VM so there would have to be a reboot, at which point Tripwire would start screaming at you. Unless they find a way around the key based access that Tripwires dbase uses.
Tripwire is included in FC4s Extras repository BTW.
-
Tripwire
Actually you can get this functionality already in a long standing Unix utility called Tripwire.
http://www.tripwire.com/
http://sourceforge.net/projects/tripwire/
There is even a Mac OS X version now it seems:
http://www.macguru.net/~frodo/Tripwire-osx.html
Of course you'd probably then want an OS that implements some form of relevant Mandatory Access Control / POSIX.1e (e.g. LIDS for Linux, Trusted Solaris, or Argus Pitbull (Linux/Solaris)) to help prevent the intruder from interfering with Tripwire itself. -
Re: ITIL - some addition considerationsITIL is a good starting point - another good summary of ITIL can be found at: What is ITIL?
Another closely related methodology is "Visible Ops" from the Technology Process Institute. Also have a look at their TWiki site which is quite valulable: ITPI TWiki. Tripwire has also been supporting this methodology and has some good information about it on their "IT Best Practices" web site.
One real problem with ITIL is that it primarily focuses on what how to structure organizations and procedures but not on the nuts and bolts on how to actually implement the methodology in a particular situation. The "Visible Ops" methodology listed above tries to address some of these shortcomings with ITIL.
Ultimately, it is not the strict application of a particular methodology itself that is going to solve any such problems. That is really only going to happen when experienced management working with competent staff appropriately apply these techniques to their own organization. Certainly watch out for any pronouncements of a single "Silver Bullet" methodology!
-
Re: ITIL - some addition considerationsITIL is a good starting point - another good summary of ITIL can be found at: What is ITIL?
Another closely related methodology is "Visible Ops" from the Technology Process Institute. Also have a look at their TWiki site which is quite valulable: ITPI TWiki. Tripwire has also been supporting this methodology and has some good information about it on their "IT Best Practices" web site.
One real problem with ITIL is that it primarily focuses on what how to structure organizations and procedures but not on the nuts and bolts on how to actually implement the methodology in a particular situation. The "Visible Ops" methodology listed above tries to address some of these shortcomings with ITIL.
Ultimately, it is not the strict application of a particular methodology itself that is going to solve any such problems. That is really only going to happen when experienced management working with competent staff appropriately apply these techniques to their own organization. Certainly watch out for any pronouncements of a single "Silver Bullet" methodology!
-
Re:Microsoft being inovative again?
I am not sure if you grew up in a country with Sesame Street, but they used to sing this little song called, "One of these things in not like the other, one of these things doesn't belong, Ooohhh one of these things is not like the other. Which one of these things could it be?"
It's pretty sad when security comes down to running checksums and diffs. Why not install TRIPWIRE on all your boxes after you build them and just keep an eye on the reports? That way you don't have to boot from CD and run cumbersome tools. :)
Security is an Illusion. -me -
Wikipedia?? Why not link to tripwire.com?
There are certainly hundreds of cases of prior art, and Tripwire is probably one of them. It computes and maintains a database of hashes for all the files on a file system to check for intrusions and corruption. The wiki entry says it first surfaced in 1992
This is [to me] the most irksome characteristic of wiki-people: even when there is an obviously better link , e.g. this page (which also provides the 1992 date), they insist on linking to a non-vetted, potentially spurious source like wikipedia.
There is also Tripwire.org for those people that get hives reading about commercial products. -
Wrong! Only one tier approach ever neededThe best approach to all of those dastardly h4x0r deeds is a single-tiered single-solution approach: IEEE 2200-200x, Standard for Baseline Operating Systems Security© (BOSS©).
Kinda like Tripwire , Symantec Anti-Virus, RedHat Enterprise Linux's dymanic relocatable address to fight worms, OpenBSD StackGhost and ZoneAlarm Firewall all rolled in one.
Once implemented, we should see a dramatic change in the network security world; less IDS/IPS/IDPS business model.
The last frontier would then be the social hacking engineering prevention.
Mark Mah Words
-
Open source can be profitableJust because it's something you enjoy doing doesn't mean it's not work. There's a famous quote by someone or another that says: "find a job you love and you'll never work a day in your life". Yeah, it's corny, but true, and if working on something you believe in gives you happiness and makes money go for it. It's not like open source has no revenue, look at Red Hat etc. They're making money off of open source. A good example(And it is somewhat on topic), is Tripwire. They built it funded through whoever in Computer Security, and then one of the Grad students who worked on it started a company off of it. They offer support etc. for the product and a free version for the open source community which also helps them get it improved. I'm sure there are numerous other examples of money making open source projects, but that's all I could think of since I'm at Purdue. Here's a nice article about Tripwire just got 8.3 Million dollars of funding. So I don't know what your definition of work is, but to me it's doing a service that people will pay you for.
BTW: Communism is where the government evenly distributes wealth, not when alot of people work together on a project. Might be helpful if you have to go through a high-school history course again
;) -
Re:Ahhh, the perfect security
Indeed, tripwire has some posters that reference security holes and what ITs do to protect the network.
Microsoft's strategy, however:
SECURITY EXPLOIT(S): Using a known server name
FIX: Move to different server
Brilliant, Microsoft.
-
Re:I am surprised ...> I am surprised that aide was not listed.
AIDE only received 4 votes, while 10 were needed to place #75. But I agree that it is a useful free tool that potential Tripwire users should know about. And so I have added an AIDE link to that entry.
Thanks,
-Fyodor
Concerned about your network security? Try the free Nmap Security Scanner -
Re:Scientists out of touch with the economy.
Spaff is pretty well known in the Internet, but I am affraid I can't think of a major contribution to computer security from him since tripwire.
You mean other than his books (Practical UNIX and Internet Security, Web Security, Privacy and Commerce, Computer Crime: A Crime-Fighters Handbook (contrib ed.)), being the director of CERIAS and founder of Purdue CERT, chainmen of ACM U.S. Policy Committee, advisory board member of Tripwire Inc, and the winner of umpteen awards in computer security and computer science. -
Re:Scientists out of touch with the economy.
Spaff is pretty well known in the Internet, but I am affraid I can't think of a major contribution to computer security from him since tripwire.
You mean other than his books (Practical UNIX and Internet Security, Web Security, Privacy and Commerce, Computer Crime: A Crime-Fighters Handbook (contrib ed.)), being the director of CERIAS and founder of Purdue CERT, chainmen of ACM U.S. Policy Committee, advisory board member of Tripwire Inc, and the winner of umpteen awards in computer security and computer science. -
Re:ah, but "root" not required
How would you know when your OS has been modified (without your approval), replaced (without your approval) or worse yet modified in a way which you were not informed.
Run an intrusion detection program from a physically remote computer. Such a program compares a snapshot of the system (stored on the remote computer) to the current system. A reinstallation will be detected and reported. In order to defeat this system, the intruder needs to physically compromise two machines at once. You can even set up intrusion detection from several remote mahines to guarantee that physical access isn't a risk. Problem solved.
Frankly, I don't see how your "source modification and reinstallation" attack is a risk specific to open source systems. There are utilities that can accomplish the sort of things you're talking about without modification of source code, and if an attacker has physical access to a machine, they'll be able to get in regardless of what OS you're running. -
Re:Viral GPL
argh... hit "submit" instead of "preview" (no caffeine yet today)... to continue:
What you seem to have missed about the GPL is that it is a license, not a law. That is, it is an agreement between the licensor and the licensee. It affects only what the licensee can do with the licensor's code in the future.
There is nothing about the GPL that prevents the company from turning around and licensing the code they wrote to someone else (or themselves) under a different, closed-source license.
What they can not do is take someone else's new, GPL-ed contributions to their now GPL-ed code and re-license them to someone else. Why? Because those independent contributions are not their code. That's one of the beautiful things about the GPL. I am unlikely to spend my own time debugging and fixing a program for a company if that company is going to turn around and try to sell my own code back to me. If they're not GPL'ed they can write their own damn code.
GPL-ing one's code, then, can (if one wishes to think of it this way) represent a sort of code fork, after which point the open- and closed- versions of the code assume lives of their own. However, in practice, since we're talking about supposedly-obsolete code, there would be little reason for any consumer to buy the closed-source version, unless the company later made modifications to it to make it more attractive than the GPL-ed version, like Tripwire has done.
To answer your question more specifically, Microsoft could GPL Win95 and continue to sell WinXP as a closed-source product. They could not take someone else's GPL-ed modified version of the GPL-ed Win95 and apply the changes therein to the closed WinXP (unless they made specific arrangements to re-license the code of the modifications from their author or authors), but if they didn't GPL Win95, there would be no such patch in the first place, so that's not really something to complain about. In fact, Microsoft could GPL WinXP and continue to sell and develop WinXP under a close-source license, though it is questionable whether anyone would buy it.
One reason for a company not to make their software public domain or BSD-licensed is that it might allow a competitor to start selling a modified version of the software and put them out of business (or, in Microsoft's case, force them to acquire the competitor). That's that advantage of the GPL again -- it prevents people from running off with your code and trying to sell it back to you.
Finally, let me direct you to this portion of the GPL FAQ, which also addresses these issues.
Don't believe the FUD. -
Re:How do I tell if my machine is cracked?
Are there tools to detect changes made by crackers? One of my nightmares is a rooted zombie server that looks perfectly normal to me, but had several backdoors inserted...
An integrity checker such as Tripwire is what you want, and !Squalus pointed out that there is a version of Tripwire for routers.
The idea is this: generate secure hashes of all critical files, using a secure, one-way hashing algorithm such as SHA-1 or MD5. If those files are changed, hacked, or even damaged by hardware failures, comparing the old hashes will reveal that the files have been altered.
In practice, it's a little more complicated. Many files will change, or be changed, in the normal course of operations of a system. Imagine, for example, a clueless sysadmin who ran an integrity checker against all files on a system, and then freaked out because the log files had changed. So it is necessary to have clueful admins who will be able to understand which files are critical and can distinguish between proper, permitted changes and hacker intrusions.
As I'm sure you know, such clueful sysadmins are in short supply.
Another issue in some cases, like virus detection, is that the operating system itself must be trusted while the hashing is taking place. There are stealth viruses that can intercept reads to infected files, and make them appear clean. Or at least, there were, back in the days of DOS. In theory, the same thing could be accomplished by hacking a unix kernel.
For more information on secure hash algorithms, the best reference is Applied Cryptography, 2nd ed. by Bruce Schneier. I'm sure Tripwire has plenty of info on their web site, and a search for "integrity shell" or "secure one-way hashing" would, no doubt, turn up scads of resources and references.
-
Routers can be secured...
Tripwire makes Tripwire for Routers - Tripwire has been in the business of ensuring integrity for your systems for some time. Thet even make the Open-Source version of Tripwire for Servers, Web Pages (Apache) and have a Linux-capable Tripwire Manager (management system for reports) available as well. Definitely worthy of investigation.
P.S. - I don't work for Tripwire, but I do like their products. 8-)
-
Useful tools...If you want a list of modified files, you could use checksumming utilities such as Tripwire or Aide.
If you want to see what filehandles are open - as in, files & sockets - lsof is useful.
The checksummers take a couple of minutes to check timestamps, and at least a few minutes for checksumming; lsof could be scripted to run in a loop, I guess. These are tools for use at intervals. If you want to get a continual log, look at strace. If you want to be able to reverse the changes, you could try chroot, or back up your system, or use a test system.
-
Integrity CheckersThere is probably major prior art from Tripwire and other file-integrity checkers. Basically the exact same idea, with the purpose of detecting when important files have been altered through a breakin.
--- -
Re:used to be free, didn't it?
It's called Tripwire "Academic Source Release", and is at version 1.3.1. http://www.tripwire.com/downloads/
-
Endemic
This is endemic to Microsoft. Take this quote for example:
"Thursday, people familiar with the case said the company was meticulously examining every computer file on the compromised network that was modified for any reason during the preceding three months."
And exactly how would one know which files had been changed within the last three months? If a system is compromised, one must assume that ALL files have been maliciously modified unless they have some sort of secure checksum app like Tripwire. Backup tapes should not be trusted either. Who knows if you were backing up altered data...
--
*Condense fact from the vapor of nuance*
25: ten.knilrevlis@wkcuhc -
Source was available before this, tooTripwire was originally released under what they referred to an Academic Source liscense. They have a history of providing source code to people using the products, so this isn't a suprising announcement.
Of course there have been a number of significant improvements since they started selling a closed source version, and I'm glad they ditched that path in favor of a true OS release. Probably the most welcome addition from the version I currently use is the ability to customize object blocks for directory recursion and improved email reporting
BTW, if you're interested in the Academic release it can still be downloaded here, but now that 2.2.1 is available for Linux (Intel only) I really don't see the point unless you're on one of those other platforms
;) -
Source was available before this, tooTripwire was originally released under what they referred to an Academic Source liscense. They have a history of providing source code to people using the products, so this isn't a suprising announcement.
Of course there have been a number of significant improvements since they started selling a closed source version, and I'm glad they ditched that path in favor of a true OS release. Probably the most welcome addition from the version I currently use is the ability to customize object blocks for directory recursion and improved email reporting
BTW, if you're interested in the Academic release it can still be downloaded here, but now that 2.2.1 is available for Linux (Intel only) I really don't see the point unless you're on one of those other platforms
;) -
Re:Sign if you want code undefended
The assignment of rights allows them to indisputably claim ownership of the code when and if the need to defend the copyright.
You seem to be assuming that if the FSF has the right to defend the copyright, that they will do so. History has shown that signing over ownership just allows the FSF to sit on their asses as even more copyright violations of GPL and LGPL code takes place. I have heard of several cases of violation of the GPL and LGPL but I have yet to hear of a single case where the FSF has taken a company to court to get the problem resolved.
Take Tripwire Security for example. Since Janurary of this year, they have made a demostration of violating the Lessor General Public License (LGPL). Despite the fact that the LGPL has less demanding terms for redistribion of resulting binaries than the GPL does, Tripwire has refused to honor those terms and the FSF has failed to alter Tripwire's behavior.
Please consider the following issues:
LGPL requirements
..............| Tripwire Security
--------------------------------+----------------- --------
Must give prominent notice .....| No notice is provided
with each copy of the work .....| that the GNU libc is
that the Library is used in ....| included or that any
it and that the Library and ....| part of the Tripwire
it's use are covered by this ...| package is covered by
License. .......................| the LGPL ................................
--------------------------------+----------------- --------
Must supply a copy of the ......| None of the files in
LGPL. ..........................| the Tripwire package ................................ | contain the texts of ................................ | the LGPL ................................
--------------------------------+----------------- --------
Must include the Library .......| Tripwire executiable
copyright notice if during .....| display a copyright
execution any copyright ........| as part of a banner
notices are displayed. .........| but the Library copy- ................................ | right is excluded. ................................
--------------------------------+----------------- --------
The complete corresponding .....| Tripwire Security has
source code for the Library ....| not provided the source
must accompany the program, ....| code, reference to the
or a written offer for the .....| source code or even the
source code. ...................| version number of GNU ................................ | libc used. ................................
--------------------------------+----------------- --------
If the program is an ...........| The Tripwire programs
executable linked with the .....| are statically linked but
Library then complete object ...| the object files or
code and/or source code must ...| source code is not
be provided so that the user ...| available even when the
can modify the Library and .....| company is requested in
then relink to produce a .......| writting to provide one
modified executable. ...........| or the other. ................................
--------------------------------+----------------- --------
When a program is combined .....| Tripwire EULA states:
or link with the Library and ...| "You may not reverse
distributed under different ....| engineer, decompile,
terms, those terms must ........| translate, or disassemble
permit the modification of .....| the Software..."
the work for the customer's ....|
own use and reverse ............|
engineering for debugging ......|
such modifications. ............| ................................
--------------------------------+----------------- --------
With each redistributed ........| Tripwire only supplies
copy of the Library, the .......| the LGPL work as linked
recipient automatically ........| with their programs.
recieves a license from the ....| The EULA states that it
original licensor to copy, .....| may only be copied
distribute, link with or .......| for backup or archival
modify the Library... ..........| purposes. ................................
--------------------------------+----------------- ---------------
As I said before, each of these issues have been going uncorrected since Jan 2000. Since not a single issue has been addressed regarding this blantent demostration of disregarding LGPL redistribution requirements, I find it highly unlikely that the FSF has the resources to enforce their existing GPL packages (which has even more strict redistribution terms than the LGPL), and as such can not provide copyright defense for even more GPL packages signed over to them. Unfortantly, if you want your GPL terms defended, you will have to do it yourself!
-
Re:Sign if you want code undefended
The assignment of rights allows them to indisputably claim ownership of the code when and if the need to defend the copyright.
You seem to be assuming that if the FSF has the right to defend the copyright, that they will do so. History has shown that signing over ownership just allows the FSF to sit on their asses as even more copyright violations of GPL and LGPL code takes place. I have heard of several cases of violation of the GPL and LGPL but I have yet to hear of a single case where the FSF has taken a company to court to get the problem resolved.
Take Tripwire Security for example. Since Janurary of this year, they have made a demostration of violating the Lessor General Public License (LGPL). Despite the fact that the LGPL has less demanding terms for redistribion of resulting binaries than the GPL does, Tripwire has refused to honor those terms and the FSF has failed to alter Tripwire's behavior.
Please consider the following issues:
LGPL requirements
..............| Tripwire Security
--------------------------------+----------------- --------
Must give prominent notice .....| No notice is provided
with each copy of the work .....| that the GNU libc is
that the Library is used in ....| included or that any
it and that the Library and ....| part of the Tripwire
it's use are covered by this ...| package is covered by
License. .......................| the LGPL ................................
--------------------------------+----------------- --------
Must supply a copy of the ......| None of the files in
LGPL. ..........................| the Tripwire package ................................ | contain the texts of ................................ | the LGPL ................................
--------------------------------+----------------- --------
Must include the Library .......| Tripwire executiable
copyright notice if during .....| display a copyright
execution any copyright ........| as part of a banner
notices are displayed. .........| but the Library copy- ................................ | right is excluded. ................................
--------------------------------+----------------- --------
The complete corresponding .....| Tripwire Security has
source code for the Library ....| not provided the source
must accompany the program, ....| code, reference to the
or a written offer for the .....| source code or even the
source code. ...................| version number of GNU ................................ | libc used. ................................
--------------------------------+----------------- --------
If the program is an ...........| The Tripwire programs
executable linked with the .....| are statically linked but
Library then complete object ...| the object files or
code and/or source code must ...| source code is not
be provided so that the user ...| available even when the
can modify the Library and .....| company is requested in
then relink to produce a .......| writting to provide one
modified executable. ...........| or the other. ................................
--------------------------------+----------------- --------
When a program is combined .....| Tripwire EULA states:
or link with the Library and ...| "You may not reverse
distributed under different ....| engineer, decompile,
terms, those terms must ........| translate, or disassemble
permit the modification of .....| the Software..."
the work for the customer's ....|
own use and reverse ............|
engineering for debugging ......|
such modifications. ............| ................................
--------------------------------+----------------- --------
With each redistributed ........| Tripwire only supplies
copy of the Library, the .......| the LGPL work as linked
recipient automatically ........| with their programs.
recieves a license from the ....| The EULA states that it
original licensor to copy, .....| may only be copied
distribute, link with or .......| for backup or archival
modify the Library... ..........| purposes. ................................
--------------------------------+----------------- ---------------
As I said before, each of these issues have been going uncorrected since Jan 2000. Since not a single issue has been addressed regarding this blantent demostration of disregarding LGPL redistribution requirements, I find it highly unlikely that the FSF has the resources to enforce their existing GPL packages (which has even more strict redistribution terms than the LGPL), and as such can not provide copyright defense for even more GPL packages signed over to them. Unfortantly, if you want your GPL terms defended, you will have to do it yourself!
-
Re:Teach Me How To Be SecureAny pointers or links would be highly appreciated, by myself and others.
Apart from the other recommendations made (Essential Sys Admin and Practical Unix Security are must-haves), I would suggest:
- Install TCP Wrappers and configure it appropriately. Block anything that you don't need, log everything else.
- Read the corresponding tech tips from CERT, depending on what you need (e.g. if you want to set up an FTP server, read the "Anonymous FTP Configuration guidelines")
- Read the WWW security FAQ if you are planning on running a web server.
- Use Tripwire. They have a commercial version, but you can always use the free version (1.3). I think they also give the newer version for Linux for free.
- Read other documents at http://www.cert.org/nav/securityim provement.html and http://xforce.iss.net/library/faqs/.
- Be always alert for anything strange that happens on your system. There is no substitute for an alert and informed sysadmin.