Slashdot Mirror
Red Hat & Dell Host Open Source Security Summit
wishus writes "Red Hat and Dell said they would co-host an Open Source Security Summit. 'Join Red Hat, Dell and experts in enterprise security from around the world for a summit on securing infrastructures with open source software.'"
when can I get an easy-to-use-and-configure, secure network file system ?
I think this is a very good thing, considering that to most people the idea that something designed in such an open manner is secure seems preposterous. I may even drag my Controller along in an effort to help to open her eyes to the fact that we don't have to pay big money for good security.
"Herbivores eat well cause their food never, ever runs."
Imagine ads with "Steven" saying, "Dude, you're compiling a kernel."
*shudder*
/^[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,4}$/i
A feeling of having made the same mistake before: Deja Foobar
When I read that title, I thought I would be getting coverage of something already completed.
Since the arrest of the author of T0Mkit, (albeit by the British), I am concerned about how this event will be treated by the feds.
Will there be fibbies running around with cameras and notepads?
How can we possibly write code to test/implement security, without looking over our shoulders?
In this case, I think I'll settle for closed source. Thanks for the thought anyway, Dell.
s200.org - visit it (me), love it (me).
RedHat has made great strides in the user-friendly install... At least making easy for Windows users to "try out its features".
The problem is, so much of the strong reasons for switching to Linux (aka security) are hard to realize in a user friendly sort of way.
For instance, getting OpenSSH up and running to integrate a Windows box to be able to ftp from/to the secure Linux install takes alot of work, and fishing around. It's an immediate turn-off.
Then there's wireless networking. Oh by the way, you have to become a kernel compile afficianado to get these wireless drivers workers.
If we're talking RedHat/ here and security in the same breath, then why not focus on a user friendly install for security. Including a side howto on how to possibly go get Putty up and running. And how you're going to need to generate your keys with ssh-keygen type 2 rsa and then load them into puttygen which will convert them. And oh by the way, the converted private key will also work under SecureNetTerm. Don't forget something like this for your private keys in you $home/.ssh dir:
chmod 600 id_rsa
cp id_rsa authorized_keys2
It wasn't that easy, but it should be, and it could be.
Microsoft Issues Windows Security Warning
gotta love it
My beliefs do not require that you agree with them.
The risks,issues and solutions for providing a more secure operating and application enviroment have been known for decades. Those who do not already comprehend the issues and are willing to learn, should take some time out to listen to some of the speeches at Dr. Dobbs Journal's Technetcast security archives, starting with Meeting Future Security Challenges by Dr. Blaine Burnam, Director, Georgia Tech Information Security Center (GTISC) and previously with the National Security Agency (NSA)
The "security rules" for Unix based system and application development are well known, although not widely taught. See Secure Programming for Linux and Unix by David Wheeler. Although Microsoft's NT,2000 and XP are not Unix based, a lot of the core above "rules" apply or have direct or indirect equivalents
Because some developers ignore similar above rules, the design and implementation of some applications and servers are just too unsafe to use in the "open ocean" of the internet.
Numerous security experts have railed against Microsoft's lack of security, best summed up by Bruce Schneier Founder and CTO Counterpane Internet Security, Inc who rightly stated
However Microsoft's products are not alone in the presence of vulnerabilities, this is a major issue for Linux/BSD and Unix as well as any other OS and vendor.
In a recent speech Fixing Network Security by Hacking the Business Climate Bruce Schneier claimed that for change to occur, the software industry must become libel for damages from "unsecure" software, however historically, this has not always been the case, since most businesses can insure against damages and pass the cost along to the consumer.
The Ford Pinto and more recently the Ford Explorer's tires are two examples of public and media pressure being more successful than just threat of lawsuits. Even so, eventually though public pressure the governments around the world have to step in and pass regulations that set up a minimum set of requirements an automobile has to meet to be deemed "road worthy". This includes crash testing as well as the inclusion of safety equipment on all models. The requirement are not constant and change to meet the expectations and demands of the public and lawmakers.
The onus is not only on the automotive industry itself but also on the users. Most countries require that all automobiles undergo regular inspection and maintain an up to date "Warrant of Fitness".
In the same way, if you want a secure IT infrastructure, eventually the software design, implementation and each deployment will have to undergo the same type of regulation and scrutiny.
For paid software distributions, this could mean just a tick list of security features and security tests to the other extreme of requiring the source code to be fully audited for government/secure deployments.
For users, this would require running a program that checks to make sure that all the required software security update/patches have been installed to the other extreme of requiring an audited deployment for government/secure deployments.
Users and vendors should be taking a more active approach, including lobbying government, to
1) set up a minimum set of expectations, in the design and implementation of internet "accessing" software ; and
2) ensure that all deployments are more securely implemented ; and/or
3) remove inherently unsecure products from the marketplace.
IMO the above three are preferable to all software vendors, including Microsoft, than attempts to allow liability lawsuits against vendors for deployments which the software vendors have very little control over.
You're being rooted!
Under RedHat 7.3 I plugged in my Orinoco card and it just worked. That's it. Nice and simple. It's a different story if you want to use RF Monitor mode (needed only for utilities like Airsnort and Kismet), but since Kismet and Airsnort are by no means "end-user" tools that doesn't really matter.
What's all that crap you're going through with ssh?
I haven't done a *SINGLE* thing to the SSH config on my desktop 7.3 box and I can SSH into it from work with no problem using TeraTerm. The only config issues I had to deal with were port forwarding on my wireless AP/router, but that had absolutely nothing to do with RedHat.
I don't know how you got Score: 5 - It should be -1 Troll.
retrorocket.o not found, launch anyway?
How many people here remember the older versions of SCO UNIX? It used to be, when you got drivers for an add-in card, you received only the source or a library file and headers. You'd have to recompile the kernel just to get that old NetCom X.25 card working.
Thankfully, they had an interface to automate that. It was a CUI, of course, because few people had the luxury of enough memory to run X11.. (Ack! I sound like my dad.. "I had to walk to school! Up hill; both ways!) But, all you had to do was run a script. Perhaps more than "./configure; make; make install," but not too involved. An entry-level sys-admin could do it. Of course, they had dead-tree instructions to guide them too; something that's missing all to often today.
Some of you may be thinking there's no need to recompile the kernel if you can just use insmod. Have you heard of the module-based rootkits? My hardened system has loadable modules disabled. If I need to compile something, I do it on another system. A little paranoia pays off in this world.
There are many things to do yet that would help people who aren't gurus create secure, hardened Linux installs. I foresee only good things coming from summits like this.
On the one hand they're Microsoft's little bitch and make it hard as hell to buy systems with Windows on them, on the other hand they pull crap like this.
I am confused
Dude, those are a crapshoot even under Windows.
I tried no less than *two* different PCI WLAN approaches in my desktop. One was a D-Link DWL-520 (Basically identical to Linksys' offering) - 50%+ packet loss under Windows if it even ran at all, 25%+ under Linux. Prism2 based PCI solutions *SUCK* and it's unfair of you to blame that on Linux when it's even more difficult under Windows.
I also tried an Orinoco PCI. Worked flawlessly under Linux with no trouble whatsoever, it NEVER worked under Windows. (98 or 2000, multiple reinstalls of each) It would show 100% signal strength, but never was able to send/receive data.
(I gave up and ran a Cat5 cable downstairs until I found out about the Linksys WET11 a month later)
retrorocket.o not found, launch anyway?
On the one hand they're Microsoft's little bitch and make it hard as hell to buy systems with Windows on them, on the other hand they pull crap like this.
What? Did you mean WITHOUT? If you didn't, then you surely have three hands, because you're talking about three different viewpoints, plus that's just not true. If you did, did you see THIS article? Hmm? Didja?
Also, what's this crap about "crap like this"? I dont' think hosting an OS conference is crap.
--- What
Well its about time... the two most insecure products in their class, Red Hat being the most insecure of Linux distros, and Dell for shipping the most default configured Win2k Servers, seek help in their security... For Red Hat I have this advice, dont, by default, start so many damned sevices with default configurations (sendmail, RPC, ect). And Dell, dont ship standard configured servers to no tallent admins, and kill that annoying Steven kid.. All and all this is a good thing, unless mass rioting breaks out nothing bad can come from a security conference. Im not sure how much different from other security conferences this one will be. One thing did occur to me though, didnt Dell stop shipping Linux on their servers??
www.dell.com/linux
OK, Id read an article a while back saying that Dell was to discontinue shipping Linux on its servers, its good to see that isnt the case.
and experts in enterprise security
Does that mean a couple of red-shirts will be there?
So when are they going to send one west of the Rockies?
I mean really, some of us only have so much money in our travel budgets...
hmmmm?
No, it means Worf will be there...
Linux and security are two things that do NOT go together.
Linux is the Windows of the unix world.
Sounds great! But if that Steven (The Dell Kid) shows his face at the conference I think he should be Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp. Severely beaten to a pulp.
First of all, you can avoid the mounting insanity at U.S. and disorganization airports. Second, non-U.S. security experts would be able to attend without worrying if the door prize is a matching pair of metal bracelets. Lastly, U.S. security geeks can get some time in some nice cities.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
In America today ... we have Woody Allen, whose humor has become so
sophisticated that nobody gets it any more except Mia Farrow. All those who
think Mia Farrow should go back to making movies where the devil gets her
pregnant and Woody Allen should go back to dressing up as a human sperm,
please raise your hands. Thank you.
-- Dave Barry, "Why Humor is Funny"
- this post brought to you by the Automated Last Post Generator...