Slashdot Mirror
Novell OpenSUSE Server Hacked
abelikoff writes "Both LinuxWorld Australia and SuSE Linux Forums report that OpenSUSE website got hacked last night." This story was submitted quite a number of times.
← Back to Stories (view on slashdot.org)
People always try to blame the software right away but usually it's poor administration.
Linux is near-flawless in terms of security.
If you "get" pointers add me as a friend (116)!
I still will never understand why people do stupid things like hack websites.
They could just run OpenBSD.
How does hacking this website help to put your voice ? Other than geeks, how many people check that website. If they had hacked CNN or BBC, it would have been noticed significantly. Soon this would go into oblivion. Makes me wonder what has nuclear progam to do with open source linux ?
Looks like they were quick to fix it -- I just checked out the site now and it looks as though nothing ever happened.
The Iranian hackers should first learn English. I was banging my head on the table reading that grammatically incorrect junk.
Of corse this had to happen just a few days before OpenSuSe released the latest version 10.0 final. Now I'm assuming that there will be a delay there to make sure nobody added any "extra" software. I've been waiting for it to come out since I tried beta 1 of 10.0.
The US and EU better let Iran develop a nuclear energy program or these senseless acts of web terrorism will never stop!
Without knowing what was exploited we really don't know who to blame.
http://wiki.novell.com/
Site is currently down.
So lets help them out more by spreading their message all over one of the most popular news sites on the internet.
People always try to blame the software right away but usually it's poor administration.
Was this a targeted attack? Did they just fall victim to a script? Unpatched vulnerability? Weak password? what? Im just asking cause none of the links provided answer this.
If something exists that does not need a creator (god) then why must the cosmos need one?
Just goes to show you that any jackass can type "./the_great_script" and replace a home page. More evident that Iran has its fair share of jackasses like the rest of the world.
I see these attacks all the time on all Internet facing servers.
There are two kinds of sysadmins: paranoids and losers. I'm both kinds.
The LinuxWorld Australia story is actually about an earlier break-in of a Novell system that was being used for World of Warcraft related stuff, not the OpenSUSE site at all.
Steven
Dude most of the stuff online is worse than that...that psp MPH downgrader for instance! That message wasnt half that bad! I get mad flamed on geek.com just for slightly miss spelling tough words! Those people are nazi or just can't think of better comebacks (MS people hehe).
I tip toe like rats on vouge runnways.
That organization is mentioned in the article, yet has no web presense that I can find.
There are some old usenet postings also wondering the same thing. Sounds like an imaginary company to me, wonder why the folks who reported the story didn't do a better job of checking their sources.
..give them all the nuclear energy they desire. Captian.. Ready the Minute-Man missles..
Or is it? If a site running Windows Server 2003 was hacked, would it make the front page of /.?
The server was running on netware the one that got hacked, so it could be poor administration, or it could be a vulnerability in novell netware. Linux is free from blame
Ummm, what happened to 'Linux Secure By Design'? I'm not saying MS Windows is more secure here but maybe some of the pro-Linux stuff has been overdone a tad.
Ed Almos
The more corrupt the state, the more numerous the laws. - Tacitus, 56-120 A.D.
Novell is ready for Linux Servers
The open SuSE website wasnt hacked, it was a damn gamming machine they had on their network.
From TFA:
"The employees that set it up apparently had no idea of security," Brandon said. "But what is really surprising is that Novell would allow employees to set up game servers on their corporate network and then allow the public to access it."
"There was no major breach of security here," Barney said. "Needless to say, we are taking the appropriate steps" to address the situation.
TruePunk | Games
Looks like that SSH login/password brute force scanning attack that's been going for the past year or so. So some employees setup an easily SSH login on a gaming server? So what. Only part I can't figure out is why was the box public?
This guy is way out there
"Let's annoy the Linux community to hell. Then the world's governments will take us seriously!"
Nobody's gay for Mole-Man.
I love that hack. You have this apparently politically motivated hack. And what's the title they leave behind? "IHS ownd U". Sweet.
Goes to show that you always need to check your machine. I had no need for remote ssh access so why did I leave it enabled.
Oh well, luckily I have no business with the arab nations so they are now all banned. Blame the ISP in question for not reacting.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
People always try to blame the software right away but usually it's poor administration. Windows is near-flawless in terms of security. Sound familiar?
Your logic and reason are not welcome here.
This would not have happened if the people at Novell had used Ubuntu Linux. :)
Linux Help
for all things on Linux
Do trolls even try anymore?
Comparing it to Windows will be a moot point, since El Dorado is going to have a 40% larger code base than XP.
rc28@linux:~> ps -eaf | grep ncsd
rc28 27377 7202 0 12:44 pts/0 00:00:00 grep ncsd
rc28@linux:~>
wtf are you talking about?
From: yourfriendly neighborhood Suse 9.3 user
Just because you don't prefer suse doesn't mean it sucks. I love to recommend suse to all the beginners that want to go to linux as i personaly have had the best luck with them using it and sticking with suse vs other distros.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
the hacker team has a website to add to that, its likely being hosted in iran so no one can do jack shit
Viable Slashdot alternatives: https://pipedot.org/ and http://soylentnews.org/
That organization is mentioned in the article, yet has no web presense that I can find.
There are some old usenet postings also wondering the same thing. Sounds like an imaginary company to me, wonder why the folks who reported the story didn't do a better job of checking their sources.
nano /etc/ssh/sshd_config
step 2
PermitRootLogin no
The OpenSuSE server has been sucking wind for weeks, and i know for a fact that trouble tickets have been submitted about it within Novell.
Maybe they were just trying to lend a hand with the administration . . . .
This is just like television, only you can see much further.
He is a movie fan and was just accepted to a university.
Some bits of information can be found here:3 90/
http://www.zone-h.org/en/defacements/view/id=2917
Besides the OpenSuSE website they also hacked into wiki.novell.com and forge.novell.com.
Too bad that the Iranian hackers used OpenSuSE for their political stuff. It seems a bit misplaced, what does a linux distribution has to do with the question whether Iran should have nuclear stuff or not?
I had told novell not to run their websites on Windows OS. They wont listen. See now
[satire] that Novel has screwed up Linux! Of course the user name was "administrator" and password "linusrules" I only hacked it to show that strong passwords are better. Strong like user: admin6traitor password: billgatessucks69.
Help end the use of Sigs. Tomorrow
Pardon my obvious post-placement, trying to get this near the top and visible, but I suspect this is an important question for people to see, assuming answers are posted:
What is the practical upshot of all this? Is the damage limited to the "Give us nuclear rights" web defacement, or was that just a front to make people think nothing else was damaged?
I'm running SuSe 9.3, and this morning, I let the automated update program do it's thing. Did I download and install any breached files?
TFA don't say anything. One is dead already, and the other is useless.
I mean, I understand that there's a lot to discuss regarding security policies and server operating systems, but there are people who could be immediately affected here.
Procrastination -- because good things come to those who wait.
How long is it before MS uses this for another FUD campaign?
"The end result will be a greater signal:noise ratio..."
/. in a way that I can understand.
Finally, someone explains
Dear Hackers,
If you're going to hack websites, don't try to justify your idiotic hobby by turning it into a political posterboard. It has the opposite effect you're looking for. The thing that scares people most is unpredictable behavior. If Iran were calm, clear in stating there intentions, and followed all the diplomatic protocols with a smile there would be no way for anyone to stop them from builting reactors (wheather it be for processing fuel for weapons or not). But stupid stuff like this make Iranians look like evil subversives. Just look at the graphic they posted. It looks like the shadow of some kind of daemon with horns. This is not a good image for Iran.
Or if it's a different group impersonating iranians, you're just losers.
Easy enough.
Allowing "users" to setup their own box, on your network, outside your firewall, using your IP address IS a breach of security.
No modern OS is flawless. Due to feature creep and the massive amounts of code involved, none can really be considered 'near flawless'. ( agreed, some are better then others )
Its the job of the administrators to mitigate and compensate for known, and unknown, security flaws.
---- Booth was a patriot ----
let me guess, iptables not enabled, no firewall service up, no bfd, SSH was up unfiltered and the root pass was a 3 letter word like god, to quote the movie "hackers" with angelina jolie. Hack the gibson. Hack the planet. Go Iran. Just kidding.
Alot of people are reluctant to use a firewall, even though you can easily do it with SuSE and YaST2.
I have the pay version of SuSE9.3 Pro, which is well worth the $99 price tag.
I mostly run fedora core boxes though, and this is a really good alternative to other iptables interfaces.
http://www.webhostgear.com/60.html
http://www.webhostgear.com/61.html
Get yourself those, make sure non of your dir's are 777, have strong 20+ char long passwords, don't RPM fetch from shady repositories, and you're on your way!
You do not want to work for VA Software (OSTG). The company is mostly comprised of ass-kissing managers and ass-kissing underlings that get promotions and raises. Your entire OSTG career will be about how much abuse you take from the low-level managers without speaking up about it. It is not about doing good work.
Again, for clarity: OSTG is not about doing good work. It is about kissing manager ass. Does that explain the Slashdot dupes, Linux.com crappiness, and dumb NewsForge stories for you? You don't have to be good. You have to act like Rob and Robin are your heroes.
Best. Webhost. Ever. Dreamhost.
Is it just me or is it a bit off kilter for a hacker or anyone to related to a hacker to actually have his personal information online. I managed to get the name of of an Iranian by performing a whois search.
Ooo man the floppy drive is broken. No wait. The computer is just upside down.
I think it is time for the open source community, as a whole, to better consider its public image. Incidents like this, involving one of the premiere Linux vendors, do unfortunately tarnish the image of our community quite badly. And then you have rogue open source developers publically insulting users. Such incidents make people remember open source software for all the wrong reasons.
Now, perhaps this is just a case of amateurs being allowed to join a community that mainly consisted of academics and professionals. The high standards that the open source community once enjoyed are being degraded on a daily basis by developers who cannot write secure code (ie. many PHP developers), by developers who blatantly insult and ridicule their users (ie. the KOffice example earlier in this post), or companies that provide insecure, open source-based products.
Is there much that can be done about this? I'm not sure.
Cyric Zndovzny at your service.
http://forums.suselinuxsupport.de/index.php?showto pic=20645
Sure, recommend SuSe to them because it has a slick user interface that unfortunately is extremely broken. Configuring LDAP? Bad. Setting up views in BIND? Broken. Adding kernel modules to the kernel bundles? Extremely broken. Putting kernel modules as not-quite-integrated chunks of separate huge software bundles like XFree86, so that to update that module you have to either over-write the RPM files or recompile the entire RPM from scratch, rather than putting them in a small separate package? Yup, they've completely mucked that up. Crippling those same SRPM's so they don't recompile without hand-editing to remove dependencies on packages that they refuse to publish, such as the kernel-spec and ghostlib-mini packages? Check, they're doing that. Insisting that all standard X login selections publish the namem of every valid user account on the machine so you can just scroll down it to guess at valid users? Check, that's enforced and attempts to disable it break the update system. Fake a chroot cage for BIND, DHCP, and other services that is not only intermingled with the file sources, but absolutely relies on symlinks *OUTSIDE* of the chroot cage? Check, that security stupidity is absolutely present. Break grub-install so that the only way to re-install a grub-based boot loader is their rather broken interface that auto-flushes all added on boot variants? Yup, been doing that for at least 3 releases.
SuSE is very glossy, but they've followed the unfortunate model of not only tweaking things to match their models, but ignoring the software author's models and breaking them, badly. That may be OK if the SuSE authors had the experience of the software authors, but when it comes to BIND and DHCP and grub, they really don't.
It's not being hosted in Iran. It's hosted in the US by Virtuoso Net Solutions inc. I sent this email to abuse@virtuosonetsolutions.com yesterday about 7 PM (I sent them my real info, obviously):
Dear Sir/Madam:
The OpenSuSE website was defaced either today or yesterday by an Iranian
hacker clan whose website is located on your servers. I checked the
whois data for the hacker clan's domain (ihsteam.com):
Majid NT
Bl Sajjad-milad 7 no. 12
Mashhad 8735452575
Iran
IP of the website (according to whois records of the ip, it is owned by
your company):
147.202.64.138
References:
http://www.opensuse.org/
http://www.ihsteam.com/
In case the sites above have been changed, I've attached an compressed
archive saves of their main pages. I hope you'll see that ihsteam.com
is in direct violation of your AUP.
Sincerely,
Name
Phone
Email
They haven't replied yet, and the website is still up. But it IS a weekend.
I pretend to know more than I really do by mooching off google and wikipedia.
Hey good call how many home users need to do any of things you mentioned. We are talking fred average who wants to check his email and type word documents and is tired of windows.
Well, it's much easier to hack an open-source OS, because the code is right there for you to use!
wow! i think it's just a biggo conspiracy. no iranian hacker broke tht site. ... sad to be an american now, sure!
it is more likely that this is the result of some black-ops cia/nsa mission.
oil is getting really expensive and it will continue to get more expensive,
without anybody doing anything about it. i meann everybody knows since
ages that this is going to happen. fear is a great motivator. the us
goverment is now pushing this idea that nuklear could/can solve our
future energy needs, but not thru a direct lobbying in the ownz
country because of congress. no it is better to dump the signular
idea on a "hacked" webpage under the guise of a iranian hacker.
the iranian hacker just voices what cheap-o politician in the
us have been progagating for the last fwe years; only in america
it was soled under the banner of the "hydrogen economy".
think again!
remeber the weapons of mass distruction in iraq?
remeber how this war against nuclear weapons now has the WHOLE
world in the grip of super expensive gasoline?
internal american bolletiks is very nasty with people with power
without any understanding for real reality, but only human made
economic reality
Vanity: Empty pride inspired by an overweening conceit of one's personal attainments or decorations.
Source: 1913 Webster
With SuSE 10.0, you get your choice of 5 different rootkits.
might wanna work on your syntax a bit before posting suggestions like that.my machine responds with: PermitRootLogin ermitRootLogin no /etc/ssh/sshd_config now with something like: echo "PermitRootLogin no" >> /etc/ssh/sshd_config maybe you'll get the job done. but then again, maybe not.
It is incredibly unlikely that the Rug-Pee-ers (Iranians) did this. People in the West are afraid of Iranians/Iraqis/Pakistanis/Afghanis/etc. We don't understand them and know very little about them (in general, yeehaw). In order to increase the panic caused by this stupid web-'attack', the perpetrators assume the identity of these scary boogeymen instead of "Moe and Mitch" from Huntsville, Wisconsin.
It's an old trick, designed to garner attention.
I don't know how the hackers hacked, but OpenSUSE is a very young outfit and this may serve as a useful wake up call so that by the time they get to be big and flourishing they'll have things locked down real tight. It must be hard locking down php scripts like MediaWiki, though. Php seems to run Microsoft Windows close as a great way to get hacked.
Anyway, as one of the main contributors to the OpenSUSE project pointed out, a few script kiddies planting half-baked slogans on a site not even appropriate for them palls beside the things elsewhere in the world that happened overnight, such as the dreadful loss of life in Bali. It's a sign of the sheer immaturity of the hackers that they should think what they're doing is important. So in hoping to publicize their cause, they're in fact just making it a laughing stock.
Which makes them two-time losers in my book. If they are who they claim to be, of course.
Las qué passoun
tournoun pas maï
Wrong. In most states, ex-convicts are not allowed to own guns as they have proven they are not trustworthy individuals.
Iran, as a state sponsorer of terrorism, has proven itself to be an un-trustworthy state. If they build a reactor, we should turn it into a parking lot before it is even close to operational.
-- I ignore anonymous replies to my comments and postings.
Anyone else find this hilarious? You obviously have no idea what your talking about if you think that linux has nearly flawless security. Go home please.
Aren't they sitting on top of a shitload of oil?
"They would be a lot more stable if our CIA wasn't fucking with them all the time. The only reason they had their rebellion all those years ago was to throw off a puppet regiem that the united states put in after assassinating their elected leaders." - by Anonymous Coward on Sunday October 02, @02:53PM
Agreed 110%... Ah, again, sometimes? Man, It makes me sad to be a human being... especially a U.S. citizen based one on this earth, right now.
Especially when a VERY thinly veiled layer of shit, is attempted to be hidden by perfume (spins on the subject matter @ hand): That subject being was the U.S. gov't CORRECT in attacking IRAQ & imo? No f'ing way...
I'm with you on some of the actions our gov't. brings upon itself - again, my prime example being that the entire "WMD" fiasco turned up to be 100% b.s. & then our 'fearless leaders' in the President, Vice President, & congress/house (senate) suddenly now say:
"We misinterpreted the data given us"
& point the fingers @ our CIA/FBI/NSA/ATF, etc., because to me? That's 110% BULLSHIT! We should have pulled out of there, right then, & apologized to the planet for it.
And, those "men of steel, men of power are losing control by the hour" (quoting Phil Collins) in the CIA/FBI/NSA etc.?
Again - They don't make the actual decisions to pull triggers, they only provided them data... & they do what they are TOLD, that is all.
Data (again) which was "allegedly misinterpreted" & when the 1st lady herself says on T.V. here that her husband isn't much on the literacy front?
The very person (president) who has to interpret said reports from law enforcement agencies &/or intelligence agencies the U.S.A. utilizes??
Shit - To other U.S. Citizens, I have 1 thing to say:
People: We have a maniac @ the helm. A child with firearms put into his hands... one that hit someone (Saddam Hussein), w/out investigating fully or properly no less... & the saddest part?
Uh, again: Refresh my memory - wasn't it Osama Bin Laden who drove the jets into our buildings here? NOT Mr. Hussein??
(E.G.-> And, the 'alleged ties' Hussein may or may not have had to Bin Laden? Pure speculation - I may have talked to Bill Gates, but does that make ME responsible for Windows holes? No, by no means!)
However, proving the Bush family has had business dealings & ties with the Bin Laden clan for over 50 years++ now? Easy to do, verifiable & concrete.
No, there's more going on people, than most people have info. on, far more... use your heads, look thru the crap & know what is what I think!
I don't like what I see, & am ASHAMED of our gov't. in many ways... and, mostly of ourselves as U.S. Citizenry for putting up with his shit THIS LONG!
You LIKE funding his 'war'? You like skyrocketing gas prices?? You like outsourcing running rampant & sticking you in shitty pay jobs???
I am sure you don't. BUT, here we are - under Darth Bush & Darth Cheney's kingdom basically, complete with "patriot act" level of fear imposed on ALL in their way.
APK
P.S.=> I.E.-> "Good Ole' Boy" Georgie, couldn't run businesses, how can he run a nation properly, which is a MUCH larger & complex body to attempt to govern... seriously people - look @ the economic & political mess this lunatic incompetent has created in our country, & realize 1 thing: The rest of the world either pities us, or is laughing their asses off @ us, & either one? We merit... like it or not, after all, we "elected" them (another questionable resultset from anything BUSH, or need I remind folks of the Florida fiasco in his 1st term election, & also the Ohio fiasco of tons of voting machines breaking down - always in KEY states no less, each time... and the "electoral college"? Give me a break - b.s. in & of itself & unneeded. Heck, a 486 PC could count the vote with ease, SO why use the electoral college period still? Because, imo, it's easy to 'twist the arm' of some district rep, compared to twisting the arm of EVERY registered voter is why...) apk
1. Their website does not mention *anything* about the break-in
2. The first link thrown up by a Google search for "opensuse hack" is a thread on suselinuxsupport.de that, apparently, has been deleted!
Nandz.
Linux is a great operating system, my favorite in fact. But that doesn't mean I'm one of those dipshits who believes that Linux is the one true OS and never passes up a chance to proselytize. I don't see much difference between a Linux enthusiast who goes around saying "Linux is great, Linux is great! Windows sucks, Windows sucks!" and some raghead chanting "God is great, God is great! death to the infidels, death to the infidels!" Brain dead ideology is noxious in all its forms.
Just a note. Anything can be hacked given enough patience, enough time, enough resources, and enough basic knowledge. There is no such thing as a 100% secure system, unless you are talking about a system that has been unplugged, encased in concrete, and sunk to the bottum of the ocean. Even then, I wouldn't be too sure. In other words, best that can be done is to make it a challenging thing to do. There is no system that cannot be penetrated by a talented hacker. This one, evidentally, from what I've read, was fairly talented...not your average script kiddie.
So lay off alright?
it could be an Alias.
-William
God is everything science has yet to explain.
OK - What if you're not an Ex-Con?
According to the rules, I agree... but, telling others who are NOT "known offenders" they cannot keep & bear arms (which is something being attempted in our nation time & again) is WRONG!
Its one of the unalienable rights you are given as a U.S. Citizen. I have seen FAR larger criminals who are considered "respectable" in my time, than street thugs, felons, etc. (enron execs, or tycho execs anyone?)...
It's all a matter of your perspective here.
Now above all - If anyone or any gov't. body is guilty of using WMD's? It's us!
(Or, has the the Nagasaki & Hiroshima bombings escaped your memory??)
Sure, we warned them, & even gave them a demo of them iirc, & I mentioned it last post of mine... but, does it make it right actually USING those weapons (Atomic bombs)?
I still think not. No way...
APK
P.S.=> IRAQ is untrusthworthy? WELL, Who says so??
Our "fearless leaders" in the House/Senate (Congress) & President + Vice President??
Hmmm, wasn't it our gov't. (who pointed the finger UNFAIRLY @ the "intelligence community" (CIA/NSA/FBI etc.)) the ones who proved "untrustworthy" by 'misinterpreting' (admittedly on their part) the info. on WMD's?
Yes, it was... they f'd up, huge.
No questioning it, they publicly admitted to it... to the rest of their prowess in governing a nation? I have to say 1 set of things:
1.) Do you like financing this 'righteous' (sarcasm) war?
2.) Do you like skyrocketing gas prices??
3.) Do you like an economic climate that breeds pestilence (e.g.-> Crime because people who are working class turn to drug dealing & such out of desperation (not always, but many times so)) & outsourcing runs rampant taking away GOOD paying jobs from American workers??
Nobody can tell me in regard to point #3, that American workers are "lazy" & overpaid - we work harder & longer hours than ANYONE on the planet... I know so, I am one of that bunch! apk
Linux hacked more often than Windows - the title of an article posted on ZDNet (http://www.zdnet.com.au/news/software/0,200006173 3,39116229,00.htm)
Sorry to breach the bad news guys.
How'd that moderation get past the Ubuntu Mafia?
Two separate issues. Two different servers. www.opensuse.org was not on the gaming server which had been used to scan other hosts.
RE: (Or, has the the Nagasaki & Hiroshima bombings escaped your memory??)
I suppose you would like to go the memorial services each year Nagasaki & Hiroshima? Do you ever think about the Nanking massacre? How about Japanese war crimes? A quote from the article:
I don't care how or why Hussein was removed from power... I am just glad he was. Same will go for Iran's reactors if they build them... and Iran itself... if they build a bomb.OK... I'll stop feeding the troll now... I... just... couldn't... help... it.
-- I ignore anonymous replies to my comments and postings.
Just a reply to all the replies I've seen thus far to the parent. Your comparisons are poor for a few reasons.
Murder and bank robbery always negatively affect someone. Removal of life and removal of property and all that. Hacking/cracking/whatever-you-want-to-call-it sometimes involves property damage of a sort, if the hacker actually does do any real damage.
A much better comparison would be "people that break into your house". If real life reflected cyberspace, there would still be essentially murderers and thieves trying to break into places, and there would also be people hopping through your window at night to leave a sticky-note on your coffee table that reads, "Window latch is broken, you really oughta fix that." People that, for fun, are trying to circumvent the security of others, simply for the thrill and opportunity to improve said security.
So, let's come around to, "if nobody hacked, we wouldn't have this problem!" Seriously. In reality, there will always be an incentive to break into stuff, to steal, to cause various sorts of trouble. This incentive will create a certain type of hacker; it's not as if all the "bad" hackers were once "good" and then realized all the harm they could be doing. The bad apples were created in exactly the same way most criminals are created. Some guy with a passion for computer security is a differed breed of "hacker" than an organized crime syndicate. Don't confuse the former with the latter, and don't act like they're part of the problem.
They're not.
If other reasons we do lack, we swear no one will die when we attack
seems the dates on the articles are 9/29/05, the post is 10/02/05, thats hardly last night. i guess the mods/posters, cant read(dupes), tell time, or do basic math...
...The poor children.
> Novell OpenSUSE Server Hacked, said CmdrTaco
Actually the header is incorrect. A serve belonging to Novell got havked - not the official OpenSUSE site. A big difference you would agree, CmdrTaco.
hmm... wired.
It's a reasonable question to ask.
Yes, fundamentally it's true that configuration management has a significant effect on security. To be precise, this is not a flaw, but a characteristic. A site which is in full control of system configuration will have formal security advantages over one which isn't, and this is universally true regardless of platform.
However, the story is told from a much different perspective when it comes to evaluating the security of a given platform. Configuration remains a major factor in security, but it has to be weighed in light of platform capability. So, for example, a very simple network appliance with a very small configuration space has the prospect of being very secure. An ideal appliance cannot be configured insecurely. In practice, that may or not be the case, depending as always on design tradeoffs and correctness of implementation.
Apart from pure appliances, all computing platforms must, for reasons of generality, offer configuration possibilities that put some security tradeoffs in the hands of site administrators. Such is the case for both Linux and Windows, so indeed poor administration can always result in poor security on a sufficiently general platform.
The practical focus, therefore, has turned to how securely these platforms are configured by default. Interestingly, even though Windows is marketed for nonexpert use, it has a long tradition of being configured insecure by default, exactly the opposite of what would be appropriate for a nonexpert market. It also, in my opinion, embodies a lot of fundamentally insecure design tradeoffs, neglecting principles such as modularity, containment, and least privilege, for example. These are extremely deep design problems, not easily fixed.
Linux and Unix, although designed by developers for developers, and therefore intended for expert use, have a record of delivering much better security by default. I can think of lots of particular exceptions, but they have tended to be minor design tradeoffs that could be, and were, easily corrected. Security incident statistics seem to reinforce these observations very strongly.
In my line of work, I get to see what goes on behind the scenes at a lot of sites. It's not often that I come upon a site which is not suffering to some significant degree from a chronic neglect of configuration management. All discussion of platform characteristics aside, this is a real problem on the ground for security.
The issue, in terms of value for effort, then becomes to identify which of these sites is (a) at most immediate risk, and (b) has the best potential of improvement. In the former case, I find that the answer is Windows, and in the latter, it's Linux.
Parity: What to do when the weekend comes.
I don't blame them though
Yeah, my bad. Slashcode considered my "greater than" > > as some sort of html tags and deleted it.
And the Catholic Church incinerated around seven million women during the Inquisition. Shall we round them up too?
(I'm not saying the modern Catholic Church is just as bad; if you like that kind of logic - oh, you ARE in the right forum! never mind)
"Why do people like you always back the criminals?" - by theshowmecanuck (703852) on Sunday October 02, @05:33PM
:)
Funny how people like you are easily duped by the TRUE criminals... You know:
The ones that CONVENIENTLY 'misinterpreted' data given them by agencies of law enforcement (and admitted to it, but did not have the grace & conscience to withdraw from IRAQ once having admitted their mistake publicly) in the CIA/NSA/FBI etc., here in THIS nation, & continue to profit by their "righteous" war, that tells others how to live etc. & what "Freedom" is...
Very funny!
"OK... I'll stop feeding the troll now... I... just... couldn't... help... it." - by theshowmecanuck (703852) on Sunday October 02, @05:33PM
Ahem, yea! OK, I agree - same to you. I wonder if you also went to those memorials? If so, great, I have not had the opportunity myself, though having travelled fairly extensively.
Also funny from you?
How you just "glossed over this" from my first post you replied to, a quote of mine:
"(That is, unless they have a proven trackrecord of wrongdoing on YOUR part in your neighbors in YOUR community, dangerous wrongdoing to others on YOUR part (this is purely relative too, depends on who's looking) but the point's there imo @ least)." - by Anonymous Coward on Sunday October 02, @02:19PM (ME)
LOL! I laugh, because I cover this point of yours below with that above from myself, but you conveniently skimmed over it:
"Wrong. In most states, ex-convicts are not allowed to own guns as they have proven they are not trustworthy individuals." - by theshowmecanuck (703852) on Sunday October 02, @03:49PM
Did I, or did I not, cover THAT in my init. posting (see the quote above yours)? Who the HECK did you think I meant in my quote above, anyhow??
Read 'em & weep!
*
READ CLOSER NEXT TIME, ok? I covered your initial point, right off the bat - skimming only did you in!
APK
P.S.=> Heck - You're just like "Good Ole' Boy" Georgie Jr., & Darth Cheney (as well as the Congress (House/Senate)):
RATHER conveniently overlooking data I provided, or otherwise misinterpreting it, with that statement from you initially in reply to myself as you have.
OR, are those NOT your words in reply to my own? Seems to have YOUR name attached to that 3rd quote now, doesn't it??
As you see, your init. point?? COVERED well by myself - I already stated that anyone that's dangerous (inclusive of felons & such or other violent crime offenders (ESPECIALLY THE LATTER & only if they started things, quite another story if they really didn't imo) though I didn't state that specifically) shouldn't have a gun...
Again - it's VERY convenient for you to overlook that quote of mine too isn't it?
Perhaps you have ADD?? Do you?? apk
I don't understand why many people now-a-days seem to side with the criminals and not the victims. Why else would the OP seems to try to raise sympathy for Iran (sponsors of Hezbollah) by trying (boo hoo) to show how one of the most brutal war-like societies in modern history (Japan of the 30's and 40's) was sooooo hard done by. I suppose you think that Japan was just misunderstood? Maybe they were all abused as children and it wasn't their fault they raped, tortured, murdered millions of Koreans and Chinese and Filipinos and ... Or maybe Iran is just having some fun supplying explosives to brainwashed college kids to strap on and blow up Israelis with? But maybe we can't see that because we're from another culture and are just too narrow minded to understand? Come on, enough with political correctness already. All you need to understand is that until Iran moves their human rights to the 21rst century, they have no business having nuclear programs. Political correctness is ridiculous in these circumstances. If I have a choice of generalizing, not letting them have nuclear power, and for sure not being nuked by a terrorist; or giving a state with a known track record of terrorism the capability of building a nuclear bomb, I will generalize night and day... and support those who want to keep nuclear capability out of their Iran's hands.
-- I ignore anonymous replies to my comments and postings.
The U.S. government dropped two atomic bombs on cities filled with civilians. They dropped toxic chemicals on Vietnamese villagers. They've propped up fascist dictators across the planet. They're raping young children in Iraqi jails.
Yeah, that's exactly who *I* want to have nukes.
Let's face it, the United States is a major problem. It has been for decades.
What kind of backwards logic is that?
If we didnt have hackers, we wouldnt need "things such as online shopping and ssh encrpytion etc".
Ofcourse this is no perfect world, and we do have hackers... but thats quite a stretch, trying to justify their existence.
My hand touched her hand. Her hand touched her boob. By the transitive property, I got some boob! Algebra is awesome!
In the spirit of openness, I hope that Novell releases information about the crack. How it happened, what was compromised, what information can lead to the perpetrators.
Now that they've already been "hacked", as much information as can be gleaned should be disseminated so we would know how to avoid this. If we're using OpenSUSE products, we'd like to know how to protect ourselves and provide a test that would hack into our systems to make sure any solutions are really working.
I would suggest "WideOpenSuSE"
Tubby or not tubby. Fat is the question
The United States, as a state sponsor of terrorism, has proven itself to be an untrustworthy state. Since the US already has many reactors, should it be turned into a parking lot?
I once had a signature.
Put yourself in the president's position; because of the past president the international community doesn't take you seriously when you threaten action. Most everyone, including your own advisors and intelligence agency, (and need I mention- the country in question), claim that a *certain country* has biochemical wmd's and are willing to use them. There is even past evidence of wmd's and past use of them on that country's own civilians. The past president and the UN threatened military actions against that country if they did re-start their wmd programs or continue human-rights violations, both of which they have done, largely with impunity; failure to enforce this promise on your part will cripple your ability to enforce international policy in the future.
There is more, but I will not bore you. Looking at this information and knowing that leaders MUST make decisions before they know all the facts, (if they ever do); what would you do?
As for the atomic bombs, most of the radiation dissapated quickly because it was an air-burst explosion, and there was interesting circumstances on that one too. The Japanese were actively training their civilians to fight, (women, children, anyone able to hold a knife or stick - anyone able to kick, bite, hit). Remember, these are people with a fierce honor system and religious loyalty to the emperor, (who was seen as the son of god by them). the president saw casualty estimates and decided to act. Personally, I would probably do the same. Was it horrible? Only the devil could answer no. Of course it was.
I am not advocating or endorsing war or nuclear holocaust of any kind, but I also know how worth while the 'monday-morning quarterback' is and it is just about as much as the duke I flush every day.
The fact is, these both happened. Learning from history is important, yes, but let's get out of the situation before we tear the nation apart. Protest is great. Dialogue is great, just don't cripple the war effort and the support for our troops. Your brother may be home, but so many others are not. Remeber; they read our media and react to the encouragement they find there. (ie:Bush Approval ratings Hit Basement! Iraq War A Loosing Battle, Thousands of Troops Die!)
The number one rule in international polotics is cover your own ass first. If you are eradicating starvation in Africa, but your own people are killing each other, it will do you no good. Think of it another way; the best defense is a good offence, right? How many terrorist attacks have happened on US soil since we attacked Afghanistan and Iraq? Right, now how many happened in the eight years prior to that? Yeah. Makes sense, doesn't it?
The bottom line is this; Not only do I care about the people suffering over there, but I CAN care, and I am STILL HERE to care. Not only that, but this post and yours have NOTHING to do with the above article... why did I write this here???
"Our Constitution was made only for a moral and religious people. It is wholly inadequate to govern any other" -John Ada
Hilarious! My new sig has arrived!
I don't always use unix-like operating systems; but when I do, I prefer FreeBSD.
Oh, yeah?
Try telling that to SCO.
They seem to be doing just fine running Linux. Hope they don't accidentally involve themselves in their automatic lawsuit machine...
1: change default ssh port
Security through obscurity doesn't work. A port scan would find your sshd soon enough.
But an automated worm would miss you. And that's the point.
Sincerely,
Pan Tarhei Hosé, PhD.
"Homo sum et cogito ergo odi profanum vulgus et libido."