Slashdot Mirror

1995? That may have been when you first used it, but the RFC's (http://www.wu-ftpd.org/rfc/) date back to 1971.

Finally, a patch is available from the wu-ftpd.org website.

"Security through obscurity is bad!" What other forms _are_ there? Passwords and encryption _is_ the same as obscurity.

Huh? You obviously thought long and hard about this one. Let me try to keep it simple.

* Security through passwords - there is something hard to guess which you and your computer know. If anyone else guesses this, they get access.

* Security through 'obscurity' with exploitable software - there is something which anyone can download which contains the information required to access your system without guesswork.

* Not telling someone when there's a hole that $BADGUY knows of a piece of software they're running (until the patch gets out),

IS LIKE

* not telling someone that you've discovered that $BADGUY knows their password (until you kill $BADGUY).

Seriously, if you know that someone's password is compromised, you tell them immediately so they can disable the account or change their password. If you know that someone's software is compromised, you tell them immediately so they can disable the server or change their software .

*plink*

Not a single mention on the wu-ftpd.org web site. What about us folks who have this compiled on a real genuine (read: proprietary) UNIX(tm) box and not some Linux distro?

Anyone know where there are source patches or a new source rev of wu-ftpd around?

Latest on their ftp server...

-r--r--r-- 1 wuftpd wuftpd 341520 Jul 1 2000 wu-ftpd-2.6.1.tar.gz

Anyone using wu-ftpd has only themselves to blaim if anything happends to their servers. This application has a bug history making Microsoft look like what OpenBSD claims to be. There are many free and secure and certainly more extensible options available, so why distros still stick with wu is beyond my understanding.

It would have been nice if Redhat had given the AUTHORS of wu-ftpd notice that they were going to post this! This wreaks. I'm browsing around www.wu-ftpd.org and ftp://ftp.wu-ftpd.ord and I can't find any mention of this.

Crap - where am I supposed to get the fix in a non-Redhat-proprietary, non-rpm, source code form? All that's listed in the advisory are a bunch of links to binary downloads at updates.redhat.com, the bastards.

It would have been nice if Redhat had given the AUTHORS of wu-ftpd notice that they were going to post this! This wreaks. I'm browsing around www.wu-ftpd.org and ftp://ftp.wu-ftpd.ord and I can't find any mention of this.

Crap - where am I supposed to get the fix in a non-Redhat-proprietary, non-rpm, source code form? All that's listed in the advisory are a bunch of links to binary downloads at updates.redhat.com, the bastards.

This simply isn't true. RH7 shipped with wu-ftpd 2.6.1. According to WU-FTP the bug only effects before 2.6.0. It also has 2.6.1 as te latest release.

1.) Start Linux/Unix User Groups and clubs on your campus. This is a great way to help students get started learning Unix and to show them that they do have freedom of choice. Lots of students have heard about Linux through various media, but don't know where to begin. Show them your Linux desktop, let them poke around, help them install Linux on their machine. Have weekly meetings where you can do installations, field questions, take on projects, etc.

2.) Get involved (if possible) with managing the workstations and servers on your campus. There are usually opportunties to help out in this area, and if you get involved, you will have a better forum for voicing your opinion.

3.) Sign petitions, make phone calls to the network admins, and do anything else you can to show the people who make the decisions, that you want freedom of choice. This may not seem like it can make a difference, but it can. If those in charge of making platform decisions hear students and faculty members voicing their opinions about freedom of choice in platforms, they will at the very least think twice about going the NT route.

As for the state of things, at WashU, I'm very fortunate to be going to a school that has long been a player in the world of Unix development. WU-FTPD, the most popular ftp daemon on the 'net began development at WashU. Most of our servers are Unix-based. We have a rather large sparc station lab. We do of course have NT labs as well, but I don't see the Unix element going away anytime soon. There is too much Unix development that goes on here. I've had a number of professors encourage us to get Linux installed on our home computers so that we can gain invaluble experience working on that platform, and so we can do the projects at home that we would ordinarily have to do in the sparc lab. There are dozens of students in the CS department (and other departments) who have Linux servers running on their ethernet dorm-room connections. It's been a lot of fun to watch the growth on campus.

--Jamin Philip Gray
jamin@DoLinux.org