Slashdot Mirror
Microsoft Says "War on Terror" is Overblown
SlinkySausage writes "The endless security measures imposed on society as a result of the "war on terror" have become overblown and intrusive, according to Microsoft Redmond senior security analyst Steve Riley. He made the comments in a talk at day one of Tech.Ed Australia about software security. Riley also fessed up that Microsoft cocked up XP from a security perspective. "We let you down with XP," he said.
Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS. Think Virtual PC or VMware, but instead of virtualising an OS, just a single application is virtualised."
From TFA: Steve's approach to security spans all horizons, not just information technology. He elaborated on this theory in an afternoon session today at Microsoft Tech.Ed entitled "Making the Tradeoff: Be Secure or Get Work Done". You are trying to get work done. Allow or Deny?
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
Too bad you have to read him - not see him in person.
Oh, and a pity he makes the fron page at Slashdot for stating the obvious!
"Flyin' in just a sweet place,
Never been known to fail..."
Or think Crossover: http://www.codeweavers.com/products/
-- lol pwned
In the United Kingdom we lost fifty or so people in the carnage of bombings last-year, in the United States you lost four or so thousand.
I don't for a second want to say that the loss of these lives through an unspeakable act of senseless violence is a trivial matter, but we need to put these figures in perspective. In the United Kingdom, more are killed in road traffic accidents in a couple of weeks than were in the July 7th bombings. In the United States roughly three times as many people are killed in gun accidents per year than 9/11.
Somebody even said to me that more people were killed putting their socks on in the United Kingdom than by terrorists last-year. It's probably true. This stuff is right in the noise level of the threats we encounter each day. It's dramatic when we see some idiots attempt to blow a car up at Glasgow airport but in terms of actual risk, these people are up there with being struck by lightning or having a bad reaction to asprin.
So why is there talk about trading liberty for security? Even though the security vs liberty argument is as flawed as the mythical man month, the point still remains - why do I need this extra security anyway? It's expensive, it costs me my rights and it's ineffective.
It feels like that we've forgotten what it is really like to be a nation threatend with annihilation. In the 1940s our country nearly didn't make it and we have the United States to thank for that as much as our own heroic airmen. That was a time where the agressors really could have destroyed our way of life. Yet we did not yield in the face our adversity. We held our resolve!
And we should hold our resolve now. In comparison to the Nazis these modern day terrorists are like flies trying to stare down a tank. I don't know whether to laugh or cry why we even take them so seriously. We should not give a shred of our liberty to these people - they are pathetic and worthless; you only need to look at the Glasgow "terrorist" attack to see this for yourselves.
Simon
its much like citrix, basiclyy allows you to have Backend farm of app servers and serve stuff up form the backend. greate for enterprises with lots of apps.
-b.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
Microsoft didn't issue a press release, one guy voiced his opinion.
Mod parent up insightful for this comment.
It feels like that we've forgotten what it is really like to be a nation threatend with annihilation. In the 1940s our country nearly didn't make it and we have the United States to thank for that as much as our own heroic airmen. That was a time where the agressors really could have destroyed our way of life. Yet we did not yield in the face our adversity. We held our resolve!
Not to mention knowing what to do with foreign agents when caught. Don't stick them in prison -- either shoot them or "turn" them whenever possible and use them to feed the enemy with disinformation.
-b.
They say this now, when there is Vista to buy. It's just part of Microsofts standard strategy... Release new operating system, try and make the old one look bad.
Open Your Mind. Open Your Source.
Microsoft is going to have a problem with anything that makes it harder to import labor, whether the security measures make us safer or not. Because they aren't in business to keep America safe.
I'd rather deal with airport security than install programs on my girlfriend's vista laptop...
An I.T. motto in the hands of an idiot is a dangerous thing...
Uh... on a real operating system that's called a "process". The only reason they need to think in these terms at all is because there is so much broken design in the basic OS. If everything wasn't welded inextricably from everything else, apps wouldn't take down other apps, nor the system when they misbehave, and you wouldn't need to "virtualize just the app! OMG! What a concept!"
Here's a little concept I've been working on. Why don't we use a real OS?
If you mod me down, I shall become more powerful than you could possibly imagine.
single application is virtualised.
Windows NT 3 could do that, except that screwed OCX technology makes it almost impossible to install 2 different versions of one application at the same time. This new "virtual applications" will address this problem by adding one more layer of complication (separating registry for each version of application) instead of getting rid of broken OCX thing.
839*929
It depends on how you define "virtualization" but Vista already uses fairly extensive virtualization, eg the UAC system redirects file system stores to user profile areas of disk. And IE7 protected mode (for Vista) is an example of exactly what is mentioned... I think this "talk" is just on already released "innovations." Though I suppose the comment about the paranoia is of note.
For all this time, I thought Bush was talking about "War on Tar"... I was trying to figure out how Tar was affecting our lives and how Tarrist (creators of Tar) were creating Tar here. When did it become "War on Terror"?
They let us down with XP?! I think that means they totally screwed us with Vista!
The game.
The war on terror is overblown. It's not like Muslim extremists are going to take over USA anytime soon... (Don't laugh, a lot of Americans think that this will happen if they pull out of Iraq...)
The war on terror is really a war against your rights, so be ware. This is much worse than even MS ME II.
Microsoft finally invent chroot
SoftGrid isn't new, nor is it a particularly close relative of WINE as some Linux enthusiasts suggest. It was a Microsoft acquisition, the former product name being Softricity. It's not just virtualization, it's packaging, so a single file, streamed from a server as needed, encompasses the program and all of its settings, creating a layer over the regular file system, registry, etc. with copy on write functionality; if the program tries to change the host OS in any way, it just adds to the shell of program specific settings within the single packaging file. Extremely handy for network admins who need to distribute programs, and want the performance of local apps (once the whole package is streamed, it runs locally, with the streaming order prioritized based on what the user is doing), but want the simplified administration of centralized programs with standardized configuration.
Consider what we COULD be doing with the money spent on this.
The Cold War ended. The world was as close to Peace as it has ever been. We could have been investing in so many things to help the human race as a whole.
Instead we're spending trillions of dollars "fighting" a few thousand nutcases who can't do any more damage to the world than we do to ourselves, every year, in traffic accidents.
How many AVERAGE Americans actually feel that the changes to security have affected them at all?
I mean, okay, I've waited an extra half-hour for a flight. I really can't think of anything else. It's easy for alarmists and those opposed to our government personally to attack, but I can never seem to get an answer to this question.
Now, understand - there is always someone inconvenienced. I'm not talking about a perfect system. I'm literally asking, does the average American (or Brit, etc.) really feel that they've lost something specific?
-- I really need to bleed off some of this
It's large-scale immigration from countries that don't share British or American values. Both countries are taking in a lot of immigrants who don't want to integrate. That poses future problems for the culture in our respective countries. Even more so in Britain where it is primarily people from Islamic countries who are convinced that British culture can go to hell as far as they're concerned.
With immigration, we have too much of a good thing. Immigration is good, but only when it is limited to people who actually want to **abandon** their old culture in favor of the new one. Multiculturalism is bullshit. If you like the way it was done back home, then stay there.
Thanks for the security advice, Microsoft. You are the experts. We need your wisdom. Who better to advise us on security.
I guess we can only hope to be a safe from attack as Windows is.
Then OS virtualization is something that you really should not need. It would just be a way of installing something that would be hidden from the OS, meaning that Windows does not have full control of the machine. Can't possibly want that.
SoftGrid has been around for a while and was bought last year by Microsoft. We've been using it in our labs for a few years. Our base image is XP with antivirus and DeepFreeze, then SoftGrid provides the apps. It streams the apps to the desktop without them actually being installed on the system. It has reduced downtime due to reghosting, and the size of our Ghost images considerably.
-- "Freedom is the right of all sentient beings" -Optimus Prime
The security craze has also been a vehicle for agendas that actually are about security, except it's overreaching, excessive, broken, and dysfunctional security for intellectual property owners against MS's customers. Defective by design "security" both for MS themselves (Windows Genuine Advantage), and for the entertainment industry. Any mention of Vista's shortcomings alongside the bit about XP being a security letdown?
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
"We let you down with XP,"
No you didn't, that implies that we had expectations of you.
http://www.altiris.com/Products/SoftwareVirtualiza tionSolution.aspx
Microsoft attacking Symantec on another front?
Thinstall (http://www.thinstall.com)
Xenocode (http://www.xenocode.com)
Sandboxie (http://www.sandboxie.com)
How about the fact that you can't wear Kerry buttons within five miles of a Bush event without getting arrested? It's for "security."
What about the war on Piracy?
Money is the root of all evil?
MS bought out softricity I think last year. In theory the system is great from an enterprise management perspective because it basically streams one instance of an application to many desktops.
:) )
We actually use softgrid for citrix(softgrid steams to citrix, citrix streams to remote user). We've had some issues with it but very few compared to our regular problems across our citrix environment.
Now the interesting part of softgrid is it's ability to sequence and stream a small set of the app. For instance after evaluating visio, we discovered most of the users only used 20% of the app, so softgrid only deployed that small footprint. Neat technology, and we will be using it next year when we move to XP for my environment of 7000+ desktops. (We're slow moving to new OS's
In the United States roughly three times as many people are killed in gun accidents per year than 9/11.
Um, no, there weren't. I'm not arguing with your overall point but you really need to get your numbers straight before you start spouting stuff.
There were only about ~700 accidental gun deaths in the U.S. in 2004. It was slightly higher in 2001, but still only 802. That's slightly more than a third of the number of people killed on 9/11.
(Sources: for accidental gun deaths go to the very slick CDC Fatal Injury Reports Calculator and put in "Unintentional," "Firearm," and the year of your choice. 9/11 casualties are from NyMag's "September 11th By the Numbers".)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Thinstaller is a product that lets you package portable apps. It snoops that OS during product install to see registry changes, dll installs, etc. It provides a virtual sandbox that the app can use to make API calls even when said APIs are not on the host. Apps can run with no registry interaction and you can deploy .net apps without have .net on the host. I am typing into Office 2007 as we speak on a machine that has 2003 installed.
Any stuff that relies on shell integration is missing, like file associations, but any malware that might target an Office 2007 install will find nothing to attack. Apps can be copied with a single exe copy or run from USB. Ive been betting MS might see this as good especially for corporate users. The only problem Ive seen is with licensing/activation issues (which can by bypassed in the built portable app) and the trend for MS to use those hosts API as a lever to force an unwanted OS upgrade. Really portable apps are immune to such nonsense as you can bundle any needed API in the package.
What's the big security problem with XP? It installed by default with a firewall that denied inbound connections. It allowed people to easily give the kids and the wife non-admin access to a shared system. It automatically tells me when new security patches are available from Microsoft, and it always installs them without incident. It even complains (through a tray icon) when my virus-checker's images were getting out of date. I've been running the same XP system on my laptop now for about three years; I haven't had any spyware, viruses or worms yet, and the system still boots as fast as the day I got it. So...what's the beef with security?
...does WINE run on windows?
I find this statement odd coming from a company which routinely propagates FUD to the general public...
Since when does a *software company* get to comment on global issues such as this? Are they trying to assume the role of the federal government now?
Don't we have a new rule in place that if you are 'in the way' of the war you get sent to jail? Can we send these idiots away now? I don't care if they are right or wrong, they are an American company and should support the country they owe their existence to..
---- Booth was a patriot ----
You need strong competition to spur you on to even greater things, and with the number of brilliant people they hire, it's not surprising that some truly great ideas come out of Redmond. I'm very relieved to see MS corporate culture is admitting the problems with security, caused by (as one poster here noted) the browser-OS integration that makes writing viruses so easy and fun. Maybe they'll learn from this with Vista, which when it is working will provide a full-on technological challenge to Linux with its new methods of handling screen fonts, data and threads.
technical writing / development
The world's burning. Moped Jesus spotted on I50. Details at 11.
Pretty self-explanatory. What is it with slashdot?
"intrusive" = interfering with M$'s bottom line
He's giving a lecture called:
Making the Tradeoff: Be Secure or Get Work Done.
With reasonable design choices, I get both. With sftp and konqueror, I can transfer files without worry. With real user and process separation, I can do a lot of other things without fear. If he's forced to chose between security and convenience, his system offers neither.
Friends don't help friends install M$ junk.
It's just a sandbox for apps, not virtualization.
.... its all just words to try and get people to buy Microsofts next product...
"In comparison to the Nazis these modern day terrorists are like flies trying to stare down a tank. I don't know whether to laugh or cry why we even take them so seriously."
This statement completely ignores the fact that as technology advances, the ability for one person to kill more and more people as time goes on also greatly increases. You should take the double-edged sword of technology and it's empowerment seriously -- Einstein sure as hell did. Though that speaks little towards the actual specifics of what to do about it.
I love that false choice. If you have to chose between the two, you don't have either.
Friends don't help friends install M$ junk.
But now we have something *new* that fixes all those problems! Really! So hand us more money, now!
Chris Mattern
This SoftGrid thing looks interesting but I'm guessing the foundation for it is more accurately termed an application sandbox rather than virtualization. Well, guess what, Leopard includes a new sandbox function.
I think that's possible. They mentioned Vista's built-in firewall (which in XP didn't allow fine control over outbound connections) as something they wished they did better.
Microsoft didn't issue a press release, one guy voiced his opinion.
If they fire him, they disagreed.
Friends don't help friends install M$ junk.
...if you consider that most of these radicalized muslims we are fighting now were our creations and proxies fighting against the Soviets. This is just more blow back in our historic global meddling.
There already exist Windows software for virtualising applications; these are called sandboxing applications. Sandboxie is a great example. Sandboxie is gratis, but you are encouraged to register/pay. Only drawback with Sandboxie is that it isn't Open Source - although I seriously doubt that "SoftGrid" will be Open Source either...
SIG: TAKE OFF EVERY 'CAPTAIN'!!
I live in Baltimore. The murder rate is going over 300 for this year. The biggest threat to me is that robber armed to the teeth getting ready to hold me up. I don't look up in the sky dreading that terrorist who going to hijack a plane and fly it into my house. Yet, my elected officials think that the terrorist is my biggest concern and voted to expand the Patriot Act to include warantless wiretapping. Gee, thanks guys. I feel safer. If people thinks the "war on terror" is overblown is obvious, then I think we need to explain that to the politicians. They don't have a clue.
You don't have to be smart to use a Mac, you just have to be smart enough to buy one
No more Pork for you!!
May the Maths Be with you!
How? In both instances you're dead. It just differs to the people who see it on the news. If we saw someone everyday on the news dieing from cancer or heart disease or a traffic fatality; which according to the odds is the way we will die, we all would have a much different perspective about the risks from terrorism. And I don't know about you, but spending months in the hospital dieing from cancer (very painful so I'm told) scares me much more than dieing instantly in a terrorist attack. The media is completely distorting risk in people's minds.
You may as well console someone who gets mugged by saying "well, you know, people accidentally lose money every day."
Being mugged is having money forcibly taken away and it's not losing money. So, of course you couldn't console someone that way. Perhaps you meant "People are robbed everyday, so don't take it so hard." ?
I prefer Flambe as apposed flamebait.
Calling the Islamic Terrorist threat overblown is burying one's head in the sand. Just yesterday alone:
8/7/07 ( Gaza, Pal. Auth. ) - Two Gaza children, ages 6 and 8, are killed by a rocket fired at Israel by a Palestinian Islamic group.
8/7/07 ( Yala, Thailand ) - A man is murdered and his body burned by Islamic separatists.
8/7/07 ( Pattani, Thailand ) - A roadside bombing by Muslim radicals leaves two Thai soldiers dead.
8/7/07 ( Banadir, Somalia ) - A mother and her 11-year-old daughter are killed when Islamists detonate a roadside bomb.
8/6/07 ( Pulwama, India ) - A civilian is abducted four days earlier and murdered by the Mujahideen.
8/6/07 ( Yala, Thailand ) - Muslim terrorists gun down a 61-year-old civilian on his way home.
One week of terrorist attacks (July 28 to August 3):
Jihad Attacks: 64
Dead Bodies: 354
Critically Injured: 514
And for the month of July:
Jihad Attacks: 322
Countries: 17
Dead Bodies: 2211
Critically Injured: 2674
These killings have been going on for years and are getting worse. The stated objective of the Islamic Terrorists is the total subjugation of all western society. It's a holy war, but we didn't start it. Just as we didn't start the Crusades (read your history). These are not the actions of a religion of peace. These are the actions of evil, murdering fucktards who consider mercy a weakness. They don't have any problems murdering women and children. Any action is justified if it's for "Allah".
I say to the Muslim world, get your fucking world in order and deal with these bastards before western society wakes up. Because when we do wake up and realize what the hell is going on, we are going to terminate you with extreme prejudice and we won't be making any distinction between extremist and moderates (especially since moderates don't seem to exist).
I expect this to be moderated down as flamebait. Some people don't wish to face reality.
-- Will program for bandwidth
I agree with parent, especially if your browser scripts are off. What they're actually doing is just down-playing the security of XP so they can get a few more people to move to Vista. They're actually playing to the fears of people afraid for their safety.
It's just part of Microsofts standard strategy... Release new operating system, try and make the old one look bad.
The solution is to live in the future, not the past. That way you always know that the current version of Windoze is easy to 0wn, rather than mistakenly believing what they told you about the last version.
Friends don't help friends install M$ junk.
I work for a medium-large sized healthcare organization and we use it to deliver the majority of our 500+ applications. It's not perfect, but we can package about 80+ percent of our apps using Softgrid. Complex licensing models and drivers tend to break it though (think phone-home registrations and VPN software).
Anyone who goes for this "War on Terror" crap needs help. I guess some MS employees aren't that stupid. I don't see them making that much difference in ending such a non-productive idea as a false war. Still my opinion has raised a bit. As far as any new technology in the suggested reading, we've been using it for years. Somehow Microsoft can't admit they have fallen behind, but they certainly drop many hints.
If I had the burden of MS, I'd sell off every division except 'Office' and maybe the re-branded hardware. Microsoft cannot make a true 64bit OS and more importantly, they've never turned a profit on anything but Office and perhaps mice. If it doesn't make a profit: Sell it!
XP is probably the best Win32 system since W2000 it may be slow, hard to use and full of bugs, but bashing it internally is only admitting to the failure Vista is. This is confirmed by their own statement another 'OS' is in the works. Perhaps if they 'opened it up', they'd make their code more understandable. I'd also hope they would remove those sometimes nasty and often irrelevant comments. The amount of BSD code is astounding, nothing wrong with that, just make it better.
if they made you agree with M$, the terrorists have won. (end sarcasm)
Power to the Penguin!
Yet, hackers have been '0wn'ing *nix systems since before Linus was a gleam in his fathers eye. Your point being?
because I just found myself agreeing with Microsoft ...
People might get the wrong impression that I think all Muslims are murdering terrorists. Not so. There a lots of them who find the actions of the extremists repugnant. The problem is we rarely, if ever, here from them. Print a comic "insulting Mohammad" and there is rioting in the streets. An Islamic extremist murders a bunch of children and the silence is deafening. This MUST change.
-- Will program for bandwidth
are you saying more people die from choking each year than from terror attacks? Hm...sounds like a new kind of bio-weapon may be responsible...maybe they aren't accidents at all...
Softgrid? Is it little more than a chroot?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
> You hit the nail right on the damned head, and so many people are so pathetic at math and are afraid of stupid things noone can
> seem to change our course of paranoid overreaction.
No, you want desperately to believe we still live in a world where we aren't at war with Radical Islam. Some of us have seen it coming since the fall of the Shah of Iran and nasty events that happened afterwards. More still understood it by the time of their first attempt on the WTC. Only an idiot could fail to take the hint after 9/11.
Just because we have incredible LUCK doesn't mean we don't have enemies. 9/11 could have easily had a bodycount 5-10 times what happened. We got lucky. Much like the collapse last week of the I35W bridge. Rush hour traffic, including a packed school bus and it all goes splat into the Mississipi river. Single digit bodycount so far. Luck. Give praise to whatever higher being you prefer when it happens but if you expect yer invisible friend to make it happen like that every time you are eventually going to get the piss shocked out of ya. After all, God helps those who help themselves.
But forget all that, 9/11 wasn't about the bodycount. The point of terrorism isn't to KILL, it is to TERRORIZE and 9/11 succeeded beyond UBL's wildest deranged dreams. Be thankful we had a Republican President AND Congress who had the balls to ram a tax cut over the wails of the Dems or the economic shock would likely have thrown us into a full scale depression. If the same number had died in some horrible accident it would have had little effect on the country at large.
That is the difference. We can withstand accidents and natural disasters. We learn from them, our engineers build to avoid the same thing in the future and we go on. But intentional acts of War aimed at random have the potential to end our Civilization. The are only two ways to deal with that threat, end it at the source or become a Security/Police State. As a sane person I of course prefer ending it at the source.
> but it shows without a doubt that "all terrorists are muslim" is such a load of horse shit, and the most of the major
> terrorist attacks up until recently were in fact not muslim at all
Not really. Since the end of the IRA name one major terrorist organization that isn't composed of adherents to the "Religion of Peace"? Ok, lets pretend you aren't a total loss and you could think of a couple of regional ones like the Tamil Tigers or Shining Path. Now name one playing on the world stage and/or launching attacks into the 1st World. (i.e. anything the US need worry about) Name one major terrorist attack, successful or unsuccessful, in the last decade that didn't involve the Religion of Peace. It is hard enough to name an attack of any scale that didn't involve someone named after their "Pedophile Prophet".
Not all Muslims are terrorists, but damned near all terrorists ARE Muslim. And most of the non-terrorist Muslims are either afraid of the terrorists are agree with them to a degree, only lacking the personal courage to join the Jihad or agreeing with their goals but disliking their methods. It's a serious problem. We had better face it head on and find a better way of dealing with it than the default answer we will end up being left with if we don't. Because in the end, Ann Coulter's "Invade their countries, kill their leaders and convert them to Christanity" would WORK and if we get panicked into it by a few more successful attacks we will probably do it. We would regret it a generation or two later but ask the Native Americans how much that regret that worked out in tangible benefits.
And now back ontopic.
It figures that the Corporation most identified with cluelessness regarding security would be the first to retreat into a pre 9/11 mindset. Me, I'm more "Mad Eye Moody" in my outlook towards security. Constant Vigilence!
It isn't paranoia when they ARE out to get ya. The only sphere where Microsoft should be addressing security i
Democrat delenda est
After reading the blurb on this, it sounds an awful lot like "Solaris Zones" -- which is similar to BSD Jails or OpenVZ on Linux.
It's a kernel level partitioning of resources, to create virtualized hosts with low overhead. They all use the same kernel (so you couldn't have Linux/Windows/Mac virtual machines), but each system/app is unaware of the others.
That way, you can have two virtual instances, each running Apache, but with different/conflicting middleware below it -- and no worries about them crapping on one another.
The example they give in the article is being able to run Office 2003 and Office 2007 on the same machine. The concept behind it is cool. But, doesn't that example illustrate a lot of what is wrong with Windows -- they need an all new virtualization technology just to install two versions of Office on your PC?!?
Has anyone else noticed that "Microsoft Says 'War On Terror' is Overblown" came 36 minutes after "Storm Worm Rising."
They say that timing is everything...
Stop the Slashdot effect! Don't read the articles!
Microsoft security sucked and sucked bad long before there even was a "War on Terror". Blaming that for their shitty security performance is stupid. Almost as stupid as the Slashsheep who are lapping up the Koolaid because it panders to their ignorance and Bush Derangement Syndrome.
:-P
Basically, he's saying Microsoft has failed at security because the War on Terror has caused the government to actually have security standards for computers, and those standards are too high for Microsoft to meet.
And the Slashsheep are cheering him on.
I'm no fan of Micro$oft, but I do commend them for stating the obvious -- and very eloquently, at that. This is basically the modern business world take on Benjamin Franklin's quote about how those who would give up liberty for security deserve neither. Specifically, security (from an economic standpoint) is all about cost reduction. Every risk and threat can be expressed as a potential cost. When the costs associated with preventing a risk are higher than the costs of the risks themselves, the cure is worse than the disease.
With all this Security Theater, we've managed to go from having nearly the entire world on our side (9/11/01) to being the neighborhood bully. It's time we started acting more like the great democratic (and free-market) society that we're supposed to be.
Yeah, yeah, I know. -1:Flamebait. But M$ has a good point for once, and they deserve to be praised for it.
Paleotechnologist and connoisseur of pretty shiny things.
Sounds like Microsoft is expecting some flak over their insecure operating systems. Probably related to those millions of Windows systems pwnd by .. somebody, and available for launching attacks.
There's a current worry in the security community that somebody is building up assets of pwnd systems. Somebody is acquiring the capability to do something big. But who, or why, isn't known. The assets being accumulated are more than a spammer needs.
Lots of UNIX systems use per-application virtualization; OLPC security, for example, is built on it. It's also closely related to capabilities systems.
-mcgrew
"How? In both instances you're dead."
Accidents, diseases, etc., will always take lives; death is inevitable; murder (and mass-murder) is not.
It differs because of the power involved. How much time / effort / cost was spent during the Cold War because a handful of people could kill millions with the press of one button?
There's a morality play on stage every night on the news; warning signs about what happens with the double-edged sword that is technology and individual empowerment.
Road accidents, cancer, etc. have no political agenda to push, they have no morality to pursue, they have no psychosis to feed, nor a death wish to pursue.
It is not solely about you and you alone; it's about us as a whole.
Isn't denigrating your own previous products to sell more of the current considered a very poor sales approach?
This is not an official release or opinion from Microsoft, per se. This is the opinion of Steve Riley who, in my opinion, has a tenuous grasp on security to begin with. That the "War on Terror" is overblown: in what sense? That is a pretty broad statement. I do not believe that we will ever see a "Cyber Jihad" because the worst I've ever seen come out of the Salafi Jihadists is flaming posts on message boards. Piss those guys off and they'll type in all-caps then figure out a way to blow themselves up.
Does this mean we ignore software security? Uh, no.
I started questioning Steve Riley's advise when he stated that explaining that ROI == economics in information security. While easily confused by some, economics is quite different than accounting. Now, perhaps I can see the difference because I've been studying the issue with colleagues that have PhD's in economics. Nevertheless, this tells me that he is not an expert in these issues and has not studied them.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
After reading the description of the SoftGrid technology, I can see why people who have no exposure to basic Linux architecture might think this is new and exciting. Because of how Windows is fundamentally designed, apps need to be run on a desktop. Linux as been able to do this elegantly since VMs started running images of Linux w/ X11. With the client/server model of X, you start a VM, then just run applications in your VM on your local X display.
The endless security measures imposed on society as a result of the "war on terror" have become overblown and intrusive, according to Microsoft Redmond senior security analyst Steve Riley.
I agree with Microsoft on something. Great, just perfect. Now I have to get ready for the 4 horsemen, a rain of fire and the end of time.
On the plus side that means I won't have to mow this week.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Softgrid's been around for at least a couple of years (as Softricity's Softgrid). M$FT acquired the company and is rolling the product into the "Desktop Optimization Pack".
.dll or OS version levels or cannot play nicely with other apps. It is also a great solution for a Citrix environment - apps are deployed quickly and they are not natively installed on the servers.
0 6/07-17SoftricityPR.mspx
We implemented Softgrid in our company a few years ago - works like a charm. It's wonderful for those awful apps that are extremely sensitive to
http://www.microsoft.com/presspass/press/2006/jul
There are competing products (Altiris SVS for example) but Softgrid was our preference.
BTW I have no financial or other connection with any of the companies I've mentioned.
I remember SoftGrid from the first time I saw it... 20 years ago when it was called X Window.
I don't see that under 'Start'.
You are being MICROattacked, from various angles, in a SOFT manner.
You MIGHT be right (I can see that from MS "business perspective on it", but you truly CAN secure Windows, & to such a level, even *NIX folks I challenged could not beat it)... read on, I guarantee, you'll be GLAD YOU DID (especially if you use what is in this post, from another URL I authored, on how to do so)):
/., they "ran", or evaded the test with b.s. (why not take it? I am fairly CERTAIN many did but did NOT like the results they saw, & that their systems were not as "(insert *NIX variant here) is more secure than Windows" was proven WRONG):
"They say this now, when there is Vista to buy. It's just part of Microsofts standard strategy... Release new operating system, try and make the old one look bad." - by chatgris (735079) on Wednesday August 08, @12:18PM (#20157973)
Per my subject-line/title above, & your quoted response? No problem, take a peek @ the URL below, & exercise its suggestions:
APK 12 step program for securing Windows NT-based OS of modern varieties (2000/XP/Server 2003/VISTA):
http://forums.techpowerup.com/showthread.php?s=f34 39c6a16f6f140e10d4d6d191c34e0&p=375355#post375355
Do what's in that URL?
And, w/in 1-2 hours of your time, you'll have YEARS of uptime, more speed, & stability, AND BE FAR MORE SECURE ONLINE!
Proof?? See this photo from the multiplatform test, CIS Tool, by THE CENTER FOR INTERNET SECURITY for my resulting score of 84.735/100 possible (default setups scores on say, XP? Will be WAY lower):
http://img.techpowerup.org/070618/APK14SecurityPoi ntsCISToolResult84735.jpg
That's as HIGH a score as I can achieve, & STILL be able to go "online" & do what's needed, & NOT get "bugged/hacked/cracked", &, IT WORKS!
How well?
Well, so much so, that everytime I have challenged the various users of various "flavors" of *NIX here @
http://slashdot.org/comments.pl?sid=254685&cid=199 85487
http://it.slashdot.org/comments.pl?sid=240571&cid= 19630923
http://slashdot.org/comments.pl?sid=240283&cid=196 31141
http://linux.slashdot.org/comments.pl?sid=240501&c id=19630965
http://it.slashdot.org/comments.pl?sid=241957&cid= 19662703
http://it.slashdot.org/comments.pl?sid=241913&cid= 19662485
http://bsd.slashdot.org/comments.pl?sid=238993&cid =19578849
http://it.slashdot.org/comments.pl?sid=243071&cid= 19690705
http://it.slashdot.org/comments.pl?sid=243071&cid= 19691091
http://slashdot.org/comments.pl?sid=240283&cid=196 22485
http://it.slashdot.org/comments.pl?sid=244821&cid= 19736881
http://it.slashdot.org/comments.pl?sid=245695
Rude dude, The Bungi, points to the employee's complete and utter submission to being fired for taking a photograph that offended His Gateness. He then goes on to call me a "half brain" and other names. Here's what I see in that blog:
I made a mistake This has been pointed out many times, sometimes more politely than others.
People were rude to him for what he did. You might not have a problem with that, but I do.
Microsoft ... decided ... to just cut me loose before I could do any more damage.
Only a person who works for M$ would consider telling the truth to be "damage". You might be OK with the way he was treated, but I think it sucks. I brought up the point to show what happens to people who violate M$'s PR. Your advocacy of such bad behavior only goes to prove what I said is true.
The man seems to have recovered from the vicious smearing he got for his entirely innocent actions. Most people like him and he seems to have gotten back enough self esteem to be critical of M$. It's also a sign that he's no longer afraid of them, so we might imagine he's got himself a nice job away from the asshole's reach.
Friends don't help friends install M$ junk.
While I agree with you in principle, all but the auto accidents could be attributed to "choice". Not necessarily all cases, but a good portion of them could/are. As for smoking...you could make a brand called 'Cancer Sticks', make the package black with a skull and crossbones on them with the warning 'you will die' and people will still buy them.
(Kudos if you recall where I got that from.)
"Now you know, and knowing is half the battle!"
"It's mainly the tight integration of the browser with the OS that is/was an issue. Don't use IE and don't run executables from unknown sources and 95% of the security issues go away. SP2 is actually a pretty decent OS." - by b0s0z0ku (752509) on Wednesday August 08, @12:13PM (#20157893)
/., they "ran", or evaded the test with b.s. (why not take it? I am fairly CERTAIN many did but did NOT like the results they saw, & that their systems were not as "(insert *NIX variant here) is more secure than Windows" was proven WRONG):
Want to make more "security issues", go away, in 12 easy steps (and, I think you'll find this article below FAR MORE COMPREHENSIVE in that URL below, than most any you've SEEN online in 1 spot for securing a Windows OS, especially online NOWADAYS):
Per my subject-line/title above, & your quoted response? No problem, take a peek @ the URL below, & exercise its suggestions:
APK 12 step program for securing Windows NT-based OS of modern varieties (2000/XP/Server 2003/VISTA):
http://forums.techpowerup.com/showthread.php?s=f34 39c6a16f6f140e10d4d6d191c34e0&p=375355#post375355
Do what's in that URL?
And, w/in 1-2 hours of your time, you'll have YEARS of uptime, more speed, & stability, AND BE FAR MORE SECURE ONLINE!
Proof?? See this photo from the multiplatform test, CIS Tool, by THE CENTER FOR INTERNET SECURITY for my resulting score of 84.735/100 possible (default setups scores on say, XP? Will be WAY lower):
http://img.techpowerup.org/070618/APK14SecurityPoi ntsCISToolResult84735.jpg
That's as HIGH a score as I can achieve, & STILL be able to go "online" & do what's needed, & NOT get "bugged/hacked/cracked", &, IT WORKS!
How well?
Well, so much so, that everytime I have challenged the various users of various "flavors" of *NIX here @
http://slashdot.org/comments.pl?sid=254685&cid=199 85487
http://it.slashdot.org/comments.pl?sid=240571&cid= 19630923
http://slashdot.org/comments.pl?sid=240283&cid=196 31141
http://linux.slashdot.org/comments.pl?sid=240501&c id=19630965
http://it.slashdot.org/comments.pl?sid=241957&cid= 19662703
http://it.slashdot.org/comments.pl?sid=241913&cid= 19662485
http://bsd.slashdot.org/comments.pl?sid=238993&cid =19578849
http://it.slashdot.org/comments.pl?sid=243071&cid= 19690705
http://it.slashdot.org/comments.pl?sid=243071&cid= 19691091
http://slashdot.org/comments.pl?sid=240283&cid=196 22485
http://it.slashdot.org/comments.pl?sid=244821&cid= 19736881
http://it.slashdot.org/comments.pl?sid=245695&cid=
They say this now, when there is Vista to buy. It's just part of Microsoft's standard strategy... Release new operating system, try and make the old one look bad.
So in the long view, all of Microsoft's operating systems have sucked blue whale, and Microsoft themselves have said as much.
My other car is a 1984 Nark Avenger.
Now security and functionality can be achieved but make no mistake, security is not convenient, always has, and always will take a lot of work to maintain both in the physical world and in the electronic one. [several false analogies follow]
Like liberty, security is always easier than the alternative. A free and secure system works for me rather than the other way around.
With software, however, it's the programmer that has to put forth the effort, not the user and these don't have to turn up in the interface. When programmers share that effort, like they do with free software, the individual's work load is greatly reduced. It takes me less effort to use a nice free browser on a free system than it does for me to repair an insecure non free system because it's browser has gaping problems.
The kind of "security" M$ has to offer is little more than inconvenience designed to make the user think everything is their fault.
Friends don't help friends install M$ junk.
I think every shop assistant when seeing a customer attempting to buy Vista should go "You are about to shell out money for Windows Vista. Allow or Deny?"
Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS. Think Virtual PC or VMware, but instead of virtualising an OS, just a single application is virtualised.
Back in January I was at a VMWare User Conference and the main speaker talked about how VMWare was working with Oracle and other software vendors to do this very thing. Their take was to have a VMWare server running enterprise apps without the guest OS, which would speed up the host by not having the OS overhead. I gather that the apps have very basic drivers to handle video, network and such (if needed) with not much else, and because they will run on VMWare the drivers will be a minimal standard. I haven't seen anything official about this yet but I gather it is on it's way.
The terrorism is a 'choice' just as well. The choice of supporting Israel without criticism, to suppress the Palestines, to interfere in countries that have a different culture and are not waiting for someone to bring them "democrazy" etc etc is all a choice. A choice that has terrorism as a result.
From the little I read, it reads as though they took Solaris's container idea and monkeyed with Windows until it worked as close to it as possible.
Who is general failure, and why is he reading my hard drive?
The great Dr. Yamulka of Kazhakstan Ministry of Health has concluded that women have-a the brain the size of-a squirrel brain. (paraphrased from Borat, don't downmod me for being sexist)
in other words...
wha???
Insert offensive troll-style sig here. Please mod or respond appropriately.
I think I even read the article here on slashdot, Altiris SVS. It will virtualize any program you want, it basically records the installation process, and instead of putting everything where the installer wants it to go, it wraps everything up in its own package/layer. When the layer is turned on, the program is installed and operates as though it were natively installed. Disable the layer, however, and it is as though the program never was installed. Re-installing is also nearly instantaneaus.
This means if you have a program installed, and want to try out a new version of the same program, you can simply disable the old version, install the new version as a new layer, and switch between the two at will. Also, if a program is causing problems, you can uninstall it instantly, and if it really wasn't that program causing the problems, reinstall it just as fast. It's a great little program.
If anyone would know about "overblown and intrusive security measures", it would be Microsoft... Activation and WGA anybody?
Is that supposed to be witty? I bet you use the word "sheeple" as well.
If I use the word "Asshat" can you guess who I would be refering to?
"Run As" is no solution at all. It is the Windows version of sudo, which is fine for things that SHOULD REQUIRE admin access.
But why should I require admin access to change file associations? Or to install a print driver?
"Run As" is just a crutch around poor design.
Except, the immigrants of old, did not come to your country, and want to out and out destroy it and replace it with a theocracy.
Nah, you had to look at home grown movements for that sort of thing. Violent theocratic movements have long been a part of the American political landscape. Some were born that way like the modern Dominionist movement, and others were made that way through persecution like the LDS church's early days.
For the most part, though, it's worth mentioning that a desire to tear down American and replace it with a theocracy is extremely rare in immigrants and is no justification for actions taken against the immigrant population as a whole.
They also pretty much immigrated legally...
In those days, immigration was pretty much trivial. You got on a boat, and you did some paperwork when you got off. Immigration control didn't really start until after the Civil War (mostly as a means of protecting US workers' jobs from people who were willing to work for less). The Federal Government didn't really get deeply involved until 1891. Quotas didn't really start until after WWI to stop the flood of European refugees.
Back before that, anti-immigration sentiment was primarily expressed through discriminatory laws once you got here. Turning people away is a pretty recent thing in US history.
So, let's compare apples to apples here. Immigrants trying to imigrate today face legal barriers that their predecessors did not. Saying that they all immigrated legally is like saying that no one broke highway speed limits back in the early 19th century when there weren't cars.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
This particular section of Steve's presentation dealing with the War On Terror doesn't appear on the US-developed Tech.Ed DVDs -- it was censored and removed.
Why? We need an open discussion and censoring based on policy only illustrates an agenda that creates more questions.
The only reason XP seems passable, in terms of security, is because the bar is set so low. In general, modern operating system security is absolutely terrible. In fact, the concept of computer security barely even exists outside dedicated server systems. We accept it is both because we have become used to this state of affairs, and because good security is extremely difficult for a layperson to judge. If Microsoft says something is secure, how is the general public to know any different?
For instance, if a user executes an email attachment purporting to be a screensaver, we expect the operating system to be compromised. Why? Anything claiming to be screensaver should not be allowed to do anything but draw pictures on the screen. Goatse should be the worst it's capable of. And yet we live in a world where running a screensaver can root your machine, log your keys and mouse movements, and hand your bank account details to any script kiddie with two braincells. That's not just bad: it's absolutely god-awful.
I wonder why nobody else has ever thought of virtualization for only one process. That is an amazing idea. Do programs exist that can do this yet? In Linux? I hate to admit it, but Microsoft has a wonderful idea there.
Suspect still at large.
has anyone seen sandboxie ?
It is sort of virtualization of individual applications.
A first principle of information security is physical security.
At many corporations, and not just ones you get deranged over, pictures of the loading dock are at the top of a slippery slope to "casing the joint", and thus are prohibited.
If it was any other company, you'd consider it sound security policy. But since it's the one company on planet Earth that drives you batshit crazy at the mere sound of its name, you "blame the victim" for not standing on *your* soapbox.
WGA is pretty overblown and intrusive guess he missed that. Seriously I have been using MS stuff since 1991 and I am so done with there lame asses. They used to be customer focused when they were fighting big bad blue. Now they are far worse than big blue was. Total loss of customer focus. Trying to lock customers into bad license subscription deals. Treating all their customers as potential criminals EVERYTIME you download something from them. Vista promised a lot delivered little and is only incrementally better than XP. Basically a company that is so overgrown and bureaucratic that it takes a group of some 43 http://moishelettvin.blogspot.com/2006/11/windows- shutdown-crapfest.html people working together to munge the shutdown submenu on Vista. lame lame lame Screw Microsoft from an MCSE going back to NT 4.
What is your source for this comment?
"Here in the US, in *most* (but not all) places, homosexuality is illegal. It's a technical matter that no one is ever prosecuted on, of course, but that doesn't make it legal -- there are sodomy laws all over the books here."
Because, despite the fact that you claim it as so, it is not so.
Those laws that you think make being homosexual illegal were declared unconstitutional. Four years ago.
http://www.cnn.com/2003/LAW/06/26/scotus.sodomy/
The rest of your post is just as ignorant, but the part about honor killing was especially grievous. Simply put, you don't know what the fuck you're talking about.
http://en.wikipedia.org/wiki/Honor_killings
A woman can be killed because she was raped, and in allowing herself to be raped, dishonored the family. It takes a a special kind of ignorant to equate that with capital punishment in the US.
I only go to buffets for the unlimited soft serve.
The War on Terror is phony neo-con rabble rousing. These neo-con/zionist puppets do the bidding of Tel Aviv. Only Israel benefits from these endless Middle East wars. Iraq is the beginning. As we commit war-crimes in Baghdad, the US gov't commits treason at home by opening mail, eliminating habeas corpus, using the judiciary to steal private lands, banning books like America Deceived (book) from Amazon and Wikipedia, conducting warrantless wiretaps and engaging in illegal wars on behalf of AIPAC's 'money-men'. Soon, another US false-flag operation will occur (sinking of an Aircraft Carrier by Mossad) and the US will invade Iran.. Then we'll invade Syria, then Saudi Arabia, then Lebanon (again) then ....
Seconded, SVS is excellent. It enables you to cleanly uninstall anything it manages since it tracks where everything goes, to switch off apps as if they were never installed and to use applications which aren't compatible together easily (switch one off, turn on the other and reverse at will).
The download page says "120 days evaluation" but when you install it asks if it is for personal use and offers a free license.
I wouldn't install anything on XP anymore without it. I wonder how it works on Vista.
Slashdot anagrams to "Sad Sloth"
is this spider-hole AND Congress.
"Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS."
redhat has already been doing this with xen so this is nothing new or anything they invented.
but of course we all know that if apple or microsoft didn't invent it it never existed before.
There are actually designs that allow for running untrusted code in the same address space as everything else, even ring 0.
I believe they are old designs, but I would like to see a new implementation. I bet it'd be a lot faster than a modern OS.
But I do agree with you -- the modern operating system does virtualize, and it does so efficiently. I'd much rather stick with that than have a whole architecture emulated just to make absolutely sure an app doesn't do anything bad -- the only time I see a need for that is things like DOSbox, for apps which assumed they had the whole architecture to themselves.
Don't thank God, thank a doctor!
http://en.wikipedia.org/wiki/Files_transferrer_ove r_shell_protocol
It's easy to drag and drop stuff within a domain in Windows. But how easy is it to do it across domains?
I didn't think the house band in Hell would play this badly.
"In the United States roughly three times as many people are killed in gun accidents per year than at Pearl Harbor."
There, fixed it for you. The attack at Pearl Harbor has a lot of similarities to the 9/11 attack including the fact that there were other greater causes of death at the time it occurred.
I agree that there is no comparison between the Nazis and the current threat. What are a few million Nazis compared to the 100s of millions of Muslim extremists that either participate in terrorism or condone its use. At least a majority the German people were ashamed to find out what their former leaders were capable of and then renounced that behavior.
Name one right or liberty you had in the past that you no longer have. You can't, because your liberty has not been diminished one bit. It is all just rumor and hearsay and a claim on something that was never yours in the first place. Try to find annonymity or privacy in the constitution or bill of rights. Try to find a right to sedition.
It's a shame that you have to wait in line at the airport. Get over it.
Oh, so it is with XP that MS let us down?
Thank god for Vista then!
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
Softgrid is hardly "new" and it's something Microsoft bought. I've seen it and used it on Citrix. Basically it maske program packages so you can run multiple versions for example of a application at the same time and deploy them easily.
;)
If Windows was any good, without that stupid registry and dll-files Softgrid would be unessasary. If you would just put an application in one place and run it from there, it would be unesseary to vitulize the applications.
One funny thing, you can virtualize Firefox and run multiple versions of it, but you can't virtulize IE because it's tied to hard into the OS... so Microsoft can still learn some things about writing good Windows programs from the opensource community
I think Windows 2000 SP4 is even better. Not bloated, no DRM, fast, low requirements in today's systems, stable, etc.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Sigh, either you missed the point or I was not clear enough. Choice for one's self. I choose to eat that burger with enough grease to give me a heart attack, I choose to smoke even though it gives me cancer, those are personal choices against oneself, not against others. That was my point. The only moral reason to prevent others actions is if they impact someone besides themselves. All law and all moral systems are built around that simple premise. (Though ironically suicide is illegal in the US, still not too sure about that one.) The reason we interfere abroad is because whether you like it or not what happens elsewhere can have very real consequences here. While it's very easy to point fingers and tout conspiracy theories and over-simplify complex ideas, it is very hard to accurately predict the outcome of every global action, thus it is a good idea to try and stack the odds in your favor when possible.
"Now you know, and knowing is half the battle!"
Homicides and suicides (and 'legal interventions,' the polite term for police shootings) are not "accidental."
(Not sure if I'm misunderstanding your post though, in terms of who you're agreeing or disagreeing with.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
He was whining about the Symantec report showing that Vista's network stack had been vulnerable to classes of attacks that older TCP/IP stacks had long been fixed against. Afterward, I asked him why that sort of disclosure was so horribly irresponsible as he had asserted in his presentation. His reply was to ask me if I had kids? WTF? Basically he was trying to illustrate that it hurt Microsoft's feelings, and that ripping on Vista's early lackluster security was tantamount to insulting his children. Uh huh.
Overall, I wasn't that impressed by Steve Riley. He'd be a good gospel preacher. He's very charismatic. Unfortunately, I just wasn't impressed by the religion he was selling. Then again I tend to be more impressed by security scientists rather than security evangelists.
. Penguins Surely Ca
In other words, Microsoft realise that an overall hightened security effort will also result in much higher demands on IT security. Especially in governmental situations. If anyone is really serious about security they wont use a system so plagued by virus, trojans and security issues no matter what security rating it has on paper. IRL it just has to be secure and not just in the latest sales material. I highly suspect Microsoft would be turned down much more often if security gets a higher significance.
HTTP/1.1 400
Is tin foil on sale at the Dollar Store?
Scruting the inscrutable for over 50 years.
On the flip-side, Microsoft is hardly an expert on security and the last thing they need is for customers to require it. It would totally devastate their market.
So although both sides make good points, neither side can afford to let people weigh them.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
"Microsoft continues to go to the bank on the basis of "You CAN fool MOST of the people ALL of the time."
How much longer will this formula work for them?"
Answer: Forever. Refer to tobacco, drugs, alcohol, religion and the 9/11 Truther Movement.
Shouldn't you be in high school class right now?
Come back when you learn English, kid.
Submitter shows he/she doesn't work in a data centre with Windows machines.... It's called Softricity. Or it was before MS bought them. It's good stuff; but it's definitely not new stuff.
Insecurity Is Better Than NO Security ... Maybe...
'Nuff Said.
Islam lost the lead in science when it was decided that looking for root causes was sacreligous. If an apple falls from a tree, it isn't gravity causing it to fall, it is the will of Allah. Saying otherwise is an affront to the prophet.
We should use this same logic. Invasion of Iraq, will of Allah. Nation of Israel, will of Allah. Nuking mecca, will of Allah, baby.
>>Release new operating system, try and make the old one look bad.
Not a lot of work involved there.
Well, not with the second part anyway. First part took them quite a few years, IIRC.
I stole this sig from someone cleverer than me.
Can't believe that anyone would be stupid enough to equate female circumcision to male circumcision.
Do you even know what function the clit fulfills?
Okay okay, I'm on slashdot, so most people probably don't have hands on experience. Those that do are probably female.
Without the clit, it's going to be real hard for a woman to reach orgasm. The worst side effect to male circumcision is that it makes your schlong more long.
You are welcome on my lawn.
Microsoft Windows has had critical problems from the start with the way applications are forced to work in a single flat namespace, making it unreasonably difficult to install multiple instances of an application on a single computer. That's what's really been driving virtualization... most of the problems virtualization solves have much simpler and more efficient solutions on UNIX... or virtually any other serious operating system.
Most of them are based simply on taking advantage of the hierarchical file system and the process hierarchy.
All a well behaved UNIX application needs to run isolated from its incompatible brothers is to inherit an environment from its parent that tells it where to find its configuration parameters and files. This can be as simple as running out of a particular directory or using an environment variable, or as complex as a "chroot" environment.
This has been standard in UNIX since it was created, and Microsoft knew about it... they had the most popular UNIX variant in the world in the early '80s, before they followed apple down the cul-de-sac by designing an OS around the GUI instead of making that simply another resource that the OS manages. Now, they're coming up with an inefficient solution that will let some small portion of their users get a fraction of the capabilities they would have had if they'd stuck with Xenix as their premier OS.
The hardest thing to do as an unprivileged user is to change your monitor power settings. The effects of this setting is VERY visible to the user, and very annoying if it is not set correctly. It gets more annoying when you can't change the settings, because you don't have high enough privileges.
So, you log out, and then login as an administrator, make the change to the power settings, log off and then log back in as your unprivileged user only to find out that the changes that you just made as an administrator only affect the administrator's user profile.
Sigh.
OK, Logout, login as administrator, grant your unprivileged user rights so he can change the power settings, logout, login as your new super user, change the power settings, remove the privileges so you are an unprivileged user again, log out, and then login as the unprivileged user once again.
Thankfully, there are ways to deal with this.
"Can't believe that anyone would be stupid enough to equate female circumcision to male circumcision."
That's nothing, I can't believe anyone would be stupid enough to endorse elective surgery on an infant's genitalia at all.
"The worst side effect to male circumcision is that..." the surgery goes bad and you lose your penis.
Frankly, sir, you're an idiot.
I only go to buffets for the unlimited soft serve.
Being a realist, I'm am perfectly willing to admit the many failings of America and the ways in which the U.S. could learn from the folks across the pond. But this is one case where both historically and currently we do a much better job than Europe.
We have had waves and waves of immigration that have changed our demographics entirely. While at first they try to isolate themselves in their own communities, and are largely ostracized by those already living in the country, it doesn't take very long for them to become largely assimilated. In a large part because of our attitude which is open to immigrants. We see our country as a land of opportunity and someone coming here to live is as much a vindication of that promise as it is a threat.
The result? While there are cases of poorly-integrated immigrants, and non-immigrants (or rather non-1st-generation immigrants) who hate the people coming over, to a large degree they are accepted, and by virtue of that acceptance the immigrants come to see this country as their home.
Quick: Give the name, nationality, and ostensible religion of the last even modestly successful domestic terrorist. Times up, it's Timothy McVeigh, U.S., and Roman Catholic.
The ones most likely to conduct what we might call "terrorism" or just hate-based extremist violence are the anti-immigrant racist groups and fringe militias which often amount to the same thing.
Europe, on the other hand, seems to take a harsher attitude towards their immigrants and keeping them distinct from "natives". France in particular seems to go out of their way to make sure that all the Muslim immigrants are aware that they Are Not French. And gee, the Muslim immigrants go "You're right, fuck France".
Immigration is not the problem. Intolerance is the problem. And just like with any such situation, it's when the native majority is intolerant of the immigrant minority that the big problems arise.
With immigration, we have too much of a good thing. Immigration is good, but only when it is limited to people who actually want to **abandon** their old culture in favor of the new one. Multiculturalism is bullshit. If you like the way it was done back home, then stay there.
It would be a fun exercise to try to list every cultural influence from immigrant populations in just the last couple hundred years that is now considered to be a normal part of American culture, but we've both got better things to do. Suffice to say that multiculturalism is the parent of new culture, and is how American culture became what it is today.
Immigration isn't good when the immigrant abandons their old culture. Immigration is good when the immigrants adapt their culture to the native one, which requires that the native culture be tolerant of the immigrant's culture. When they feel accepted, they will accept us, and end up becoming one of us.
Placing a great divide between us and them and saying "you are not welcome unless you leap this divide and abandon all you knew" is a great way to end up with France-like situations.
The enemies of Democracy are
I took a look at the most recent US NIH annual, curious as to just *how many* 9/11s worth of people had died in the past 6 years of preventable cardiopulmonary disease, respiratory disorders from smoking, type II diabetes... I forget the exact numbers, but it was just astounding. The numbers themselves, certainly, but the *proportion* to which my country is expending massive resources dealing with an amazingly minor threat, versus what they could be doing with those billions... It boggles the mind. Many times.
Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
Didn't OS/2 do that way back when?
Virtual machines per application?
So next they will want to save RAM and speed things up with pass-thru hooks like what is already done with the virtual network interfaces but taken to the next level... It seems like a bad progression towards an actually working OS... How about we get the OS to WORK with the memory protection and better manage abstracted hardware??
Am I the only one who sees virtual machines as a solution to problems that mostly shouldn't exist or at least not to the severity that one would seriously consider that a solution?
Democracy Now! - uncensored, anti-establishment news
"We let you down with XP"
Translates to:
"Buy Vista"
Don't fall for it. There is nothing in either operating system that is actually secure, just varying degrees of appearing that way.
Steve's an interesting guy to listen to.
Worth the time to sit and listen to him.
"Consider how lucky you are that life has been good to you so far. Alternatively, if life hasn't been good to you so far
Deciding that you have an unbelievably safe system based on lack of challenge and an arbitrarily defined scale is...stupid.
You don't even understand what we're talking about when we say "Administrator." Yes, we're all aware that there's a (semi-)hidden account called "Administrator." No, that's not what we're talking about.
The obvious issue here is that this test is not "multiplatform" in the way you think it is. A score on your system is as comparable to a Linux system as the SAT is to the ACT. For crying out loud, there's even a MySQL benchmark; it's not even an OS.
http://it.slashdot.org/comments.pl?sid=243071&cidLet's take a poke at the reply: Which is what I said. It seems you have either ignored the post and are calling it BS (why not reply to it? I am fairly CERTAIN [why did you capitalize this word?] you did but did NOT like your total inability to come up with an answer because you were proven WRONG).
By the way, I noticed that, for the first two items, you passed 0/1 major service pack and hotfix requirements and passed 1/1 minor ones, earning you a score of 12.5/25.
And finally, it failed to run on my system. After pointing it to the location of my java.exe, it gave a NoClassDefFoundError. Besides, I'm running XP Home. http://members.cisecurity.org/kb/article.php?id=01 3
Maurice Wilkes, debugging, 1949
Microsoft cannot reasonably presue individual end users for license fees by legal means. They have preferred to profit from bulk licensing and latterly patent cross-licensing. Collecting money from end users is expensive: a technological solution is preferable to legislation (which at best can only secure revenue within national boundaries).
Microsoft needs a way of delivering its products to end users in a way that guarantees them revenue; the best way is to own the software but an EULA doesn't provide enough guarantee and forced upgrading is expensive. They need a self-contained (so as to avoid lawsuits) way of delivering their software to multiple platforms: people won't just run them on PC's.
Microsoft will sell some of these devices, will have licensing/cross-licensing deals with the manufacturers of others. Even if they run Linux.
> Yeah, because that had nothing to do with the Shah being a despot who tortured
> and killed political dissidents.
No argument the Shah was a real piece of work by our standards but probably above average for the region. History will eventually decide whether Cold War "Realpolitik" justified propping him up. It was a different age. But before stamping 'villian' on him now consider this:
There is a substantial 'pro-western' minority in Iran almost three decades after the Shah fell and the mad mullahs took over anything 'western', dress culture, ideas, etc. Have you considered the possibility that those folks learned of us and were exposed to our ways under the Shah's rule? Exposed hard enough that after all these years the imprint hasn't wore off?
But more to today's discussion the fall of the Shah gave the Islamic Radicals their first nation state and the ability to put Sharia back into practice. All the other countries in the region were either Soviet client states who were more prone to Bathist (Islamic Socialism, an oxymoron) systems or just pure dictatorships. Our client states tended towards pure dictators, but our puppets at least paid lip service to human rights and some like the Shah actually encouraged things like women's rights and education, including sending large numbers of his subjects here for a western style education. Now you get to make the argument you seem to be implying that the Mad Mullahs were an improvement.
> Firstly, quoting Ann Coulter, let alone saying she is right, kills almost any chance you had
> of being taken seriously as an intellectual.
Reading is Fundamental people, and just learning the words isn't enough, ya have to move on to reading comprehension.
Try rereading what I actually said. I'm saying Ms. Coulter's rather extreme solution would WORK. And even worse that if we got hit really bad a couple more times we might get panicked/angry enough to actually do it. But it should have been pretty clear from this line right before that I didn't think it would be a very good idea long term:
> We had better face it head on and find a better way of dealing with it than the default answer
> we will end up being left with if we don't.
If a critical mass say "screw it, it's them or us and it ain't going to be us" we will do something mega violent. And yes we COULD do it and it would WORK. And the side effects would set up yet another problem a generation later. So we need to be find a better answer. Not sure what it is, not even sure there IS a better one, only that we really need to be working on the problem NOW instead of waiting until we run out of time to do anything other than be driven by events.
The problem is Islam is stuck in the dark ages. Christanity evolved (fundies would say became corrupted and debased but screw em) during the enlightenment because it had to, thus it became compatible with the key ideas underlying modern civilization. Islam didn't have that advantage. And as it exists today it is totally incompatible with our civilization. The radicals AREN'T the ones misinterpreting Islam. Their book has all the nasty bits in it that ours does, maybe more, we just choose to ignore the incompatible bits and they don't. So we are faced with four choices:
1. Surrender, Adopt Islam and Sharia law. Over my cold dead body.
2. Invade their countries, kill their leaders and convert them to Christianity. Seriously. Trying to yank em all the way to harmless Godless European Socialists probably wouldn't be possible. But just switching em to a different holy book probably would be given a willingness to use over the top mega violence. (That would probably destroy our civilization in the end, unintended consequences.....)
3. If you didn't like #2 you really won't like this one. Kill em all and let God/Allah sort em out. End the threat by ending Islam. Practice of Islam punishable by death. Anyone suspected required to publicly curse the name of Allah
Democrat delenda est
One interesting thing is that I can virtualize IE, thanks to IEs4Linux. Downside: IE7 isn't actually run; they use IE6 with the IE7 rendering engine. Upside: You get four separate versions of IE on the same machine -- you can probably even run them simultaneously.
By the way: You don't need virtualization to run apps off the network. You just need a fileserver and an app which doesn't insist on being installed on a physical hard drive. (For example, Steam will refuse to run if you attempt to install it on a network drive.)
Don't thank God, thank a doctor!
If your goal is to virtualize all apps, and you can get all of them to work on Wine, then you can just run Linux on the desktop, save some money on Windows licenses.
And yes, you can probably coax Wine to run on Windows via Cygwin or something, but that would be pretty slow and pretty ugly. You might even get it to work with the Windows port of the Linux kernel, if that even exists anymore -- or by compiling UserModeLinux for Cygwin -- but that would be even uglier and slower.
Don't thank God, thank a doctor!
Haven't seen this mentioned in the discussion yet, but we've been playing around with / testing softgrid in the lab, and it's kinda just the same as publishing applications through citrix...
...I see what you did there.
Informatus Technologicus
Muslims have jobs, families, hobbies, STUFF TO DO. Like everybody else.
How about you just assume that your run-of-the-mill Abdullah is outraged and shocked by anything that shocks your run-of-the-mill john doe?
I don't feel guilty anytime a white person kills children and I feel no need to write letters to the editor condemning their actions or going out in the streets chanting "STOP KILLING THE CHILDREN!".
You have to stop thinking of muslims as some sort of borg collective that has decided to remain quiet about the actions of a statistically insignificant amount of crazies.
By your standards, the U.S citizens that elected, re-elected this U.S administration and have not, after almost 5 years, stopped the war in Iraq are even more guilty (count the deaths of muslims and those of americans, guess who wins?) I'm pretty sure that's a classic terrorist argument to justify killing civilians.
Stop judging people so rashly. Stop insulting the billion muslims who condemn terrorism. Kthx.
Either you're trolling or astroturfing, or you're sadly misinformed. I suspect the former:
So, if benchmarks are not everything, then be more specific -- say that your Windows is secured relative to one benchmark to where no one else can beat it. Don't say that we can't beat your security -- that's pure bullshit. If I'm insecure, root me. Go on -- you can start with my mailserver. Shouldn't be too hard to find. If you're smart, you can even jump from there to my desktop -- they're connected via a gigabit crossover cable.
Oh, and get yourself a Slashdot account. Many people don't even bother to reply to Anonymous Cowards.
But let me try to take you seriously for a moment...
You posted a screenshot, which as we all know, should not be accepted as "proof" of anything. Your screenshot is bullshit unless I can get the tool and verify it myself. So try providing a link, at least.
Oh, is this what you were talking about? First, there's no tool for the most popular Linux variant today: Ubuntu. (My desktop is Kubuntu, but that shouldn't be a major obstacle, when you can "upgrade" from one to the other and back.)
But let's suppose I had RedHat or Suse or some such. It's still a huge, annoying hassle to even get to the file -- I'm very skeptical of anything that makes me FILL OUT A SURVEY, not to mention agree to some legalese, before I can even download the file. Included in that legalese is the requirement that I can't redistribute -- doesn't sound particularly open to me.
Once downloaded, I have a big tarball. Unpacking it, I find a jar file and a readme. Which means, the entire tool is proprietary. I'm not sure if it can be run as a normal user, however, I am running Linux partly because I do not trust proprietary software. And now you're asking me to run one from this random website as root?
(I suppose I could setup a separate account to test it under, but I'm too lazy, especially when... but read on.)
Even if I had source code, where's the md5sum? The PHP signature? Where's my guarantee that the file I downloaded actually did originate from this server, and hasn't been modified in transit?
Never mind all that -- the readme file itself admits that the installation of the tool is not secure:
I'm sorry, no. Absolutely not. I will not take a benchmark intended to measure my security when the tool itself is that fucking insecure, and you shouldn't either. Not even on Windows.
However, you're welcome to point me to any tool which attempts penetration testing from the Internet -- in other words, a website where I can click a "hack me" button to test my browser, or to have their server attempt to exploit me over the network. I imagine it would be inconclusive -- it would probably find absolutely nothing to exploit on either of our machines. It might find something wrong with some conscious decisions I've made -- for instance, responding to a ping -- but then it becomes a difference of opinion, rather than "proof" of anything. (Unless we're both wrong, and it's able to root one of us...)
Don't thank God, thank a doctor!
Whoops.
Sorry about that.
Don't thank God, thank a doctor!
While the on-topic point you're making is fine, I'd like to note, slightly off topic, that the giant burger image next to "heart disease" is a little misrepresentative. "Heart disease" is what's usually put down as cause of death if nothing else gets you first and you just "get old and die". There is no cause of death called "old age" - something specific fails, and that's usually your heart, so most people who live long healthy lives and then keel over in their 70s, 80s, or 90s get lumped in under "heart disease". Thus, the heart disease statistics are greatly inflated beyond what you'd see if it only included people dying in their prime due to bad diet, etc.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
Since 'insight' is kinda related to experience, and since I haven't met anyone who's been to 3027 A.D.... why was this modded 'insightful'? Funny, hell yes, but Insightful? Maybe I should just shut up and let the MetaModerators do their thing.
runas does not help when you want to run software which uses a copy protection scheme which involves loading a driver. Not without a *lot* of gymnastics and deep understanding of the system.
In the free world the media isn't government run; the government is media run.
So why is there talk about trading liberty for security?
The true meaning of the phrase is trading *your* liberty for the security of the *government*.
In the free world the media isn't government run; the government is media run.
Opportunists get mistaken for conspirators by those that think an organisation is omnipotent and not a barely competant seething mass of different agendas pulling in different directions with outright criminals finding their way in through the cracks. All we can do is try to ignore these people or ask them to pay more attantion - circular logic even adds in stuff like people pretending to be incompetant to give us a false sense of security.
OK, if XP is so bad, does he wants us to go back to Windows 2000. Probably not, so this is just another marketing push to get us from XP to Vista. Yep, it all sounds very embracing, and "we are sorry", but funny coincidence that this talk happens at the same time a new version (which brings in new money) is just released. Duh, isn't this normally called product promotion and shouldn't it happen with Leno or Letterman :-) instead of down-under?
Browsers shouldn't have a back button!! It's all about going forward...
This is exactly what makes a moderate a moderate. The fact that they aren't out in the streets chanting or burning effigies. They are ordinary people with ordinary lives, the minute they take a strong public viewpoint (even against extremism) they stop being moderates. The average Muslim wants all their troubles to go away as much as the average westerner, but much like the average westerner the average Muslim does not want to risk their family or livelihood to do it.
I sincerely doubt most Americans would give on cheeseburgers in order to fight "teh evil terrorists(tm)". I sure as hell wouldn't, the trade off just isn't worth it.
Calling someone a "hater" only means you can not rationally rebut their argument.
Does it make a sound?
Send lawyers, guns, and money!
If you get "Allow or Deny" messages when you try to work done, you're probably working incorrectly (outside your userspace).
I run a gemtpp box, hardly anything to do with MS, and if I stray from my userspace, it asks me exactly the same. I can either sudo, or not be allowed access. Nevertheless, once the proper working habits are adopted, routine work rarely requires you do this. All you're doing is bitching about your own incorrect working habits.
When will you clueless idiots stop bashing MS for doing what is pro'lly the best thing they did in Windows in the last decade, which is moving the home user (or, any use that does not have a policy applied to him) from a work-as-root model to work-as-user+sudo model? No, it doesn't make the box bulletproof, much as it doesn't make my gentoo box bulletproof, but it's a darn good thing, even if it's 20 years late. In fact, it's one of the biggest things we were bashing them about for said 20 years.
-
"And finally, it failed to run on my system. After pointing it to the location of my java.exe, it gave a NoClassDefFoundError. Besides, I'm running XP Home" - by raylu (914970) on Wednesday August 08, @06:43PM (#20163421)
/etc for instance, or other files that store state on *NIX for the OS & programs & daemons that run on it, to fit your example you question as others had, but I seriously think that is b.s., & another evasion - anyone who knows both OS knows BOTH have files that maintain state as I describe, & I cannot see the people who wrote this test only testing access to ones on NT based OS, but not on the *NIX versions - let's see the photo of your score to anyone who has enough saavy to install & run it, along with a JAVA layer on a *NIX please... thanks!)
.ini files, but binary reads from the registry in some data is faster than text file formatted reads, so the registry has both data types)...
Uhm... can I get someone competent enough to properly install a program, & install a SUN JAVA RUNTIME engine, from the *NIX world, to run this test, & post a photograph of their score & the test chart settings as I had in the post parent to the one I am replying to?
"Next!!!"
(Thanks!)
QUESTION: *NIX's have files that maintain state, do they not, since you brought up what the other fellow did from one of the posts in trying to evade taking this test, saying it was SAT to ACT, lol... wrong!
HOW CAN I SAY THAT, & WHY?
Well... First, run this test, & see if its tests access to the files that maintain state on your *NIX!
(Like ones under the
SELinux would help here imo, immensely, to see if analogs are tested in *NIX that are like ones in Windows (like the registry, for instance (Windows used to use
APK
P.S.=> LOL, honestly though, imo? This evasion's is the biggest line of bullshit, lol, I HAVE EVER SEEN in evading taking a test, or rather, lol... posting a LOWER SCORE ON IT, than my own, to date from a *NIX person... apk
I've been gone for months and the first thing I run into when I load up Slashbork is your usual crap FUD, lies and deficient prose in prosecution of "Micro$haft Windoze".
Not having you around was nice, except your dedazo and Macthorpe sock puppets were still here using identical language. If you really hate "Slashbork" why don't you do something better with your time? Hopefully you will return to the technical limitations of Windoze or Slashdot IP ban that kept you occupied since June.
Friends don't help friends install M$ junk.
The creators of VISTA say that the current state of 'security' is overblown?
I don't know which meter is going to blow up, the irony-o-matic or the oh-shit-we're-fucked-o-tron...
I don't know if these http://www.scienceandsociety.co.uk/results.asp?txt keys1=Death+cigarettes are still available, but I bought some at a Rock Festival once and I still have the empty packet.
I'm posting from a corporate network with limited credentials. Whether our accounts are set as 'power user' or just 'user' I can't currently tell. However my base account isn't given full privilege over the file system, etc. Limited user a/c as far as I can tell.
/user:(admin account) cmd.exe
/user:(admin account) "c:\program files\internet explorer\iexplore.exe c:"
However, setting up and changing file associations using assoc / ftype is perfectly permissible.
And as others have said, runas is perfectly adequate for you to get access to elevated privileges. For the record, the following may come in handy:
runas
Command prompt shell which will do about 90% of what you want to do, including the ability to spawn processes with admin privilege
runas
Spawns a shell under admin privileges for anything you can't do with command prompt.
F_T
Hey everyone, it's APK. I'd just like to admit that I am a Microsoft whore. I exist for no higher purpose than to suck Bill Gates' cock.
... and lick Steve Ballmer's balls. Mmmm...
Who needs permanent IDs? I'll just be anonymous, where anyone can pretend to be me:
APK
P.S.=>
" ... We blew it with Windows 98, but trust us with Windows XP. This is it!!"
Doesn't someone from Microsoft say something like that every time the come out with a new OS? "This is the ultimate!! That stuff we sold you the last time - that's dreck."
Research shows that 67% of those who use the term "research shows", are just making shit up.
A user-mode program should not have write access to binary executables in the first place.
A virus could never propagate via this fashion in a Linux system. Once the original was deleted it would be gone.
Trashing your user account is bad enough. After all, most of the system stuff can be replaced easily, you don't even need to do backups for those - reinstall, update.
The functionality _is_ available in Windows, and many places use it. Not hypothetical at all. I set up my uncle and aunt's notebook PC that way and so far I haven't noticed them complaining that their user account isn't admin. In fact they're asking me to help set up another one for my cousin now.
The thing is, nowadays it makes very little difference in practice - most attackers want zombie machines. You do NOT need root/admin to turn a machine into a zombie.
And that leads us to what bugs me: after so many decades of O/Ses, "Aunt May" running random executables should not automatically cause her to lose that much control over her computer.
It's pathetic that Microsoft spends many years and billions, and all they can produce for "security" is "UAC". And the Linux distros and Apple aren't doing anything much better.
Why should a user have to _predict_ whether a screensaver is really a screensaver? Or some game is really a game? Or some "birthday greeting" is really one? Or some perl script is safe to run?
I'm expecting at least something like _user_friendly_ "security template" system. Applications request a security template and the user decides whether to allow the app to run with that template (popup doesn't appear if it's a default minimal privilege one).
Apple and Microsoft have enough clout to enforce stuff like this.
e.g. "Britney Screensaver requests 'Default Screen Saver Install' privileges to run, Allow Y/N? (checkbox: remember choice)" etc. If the user says yes, the screensaver can only do screensaver stuff. No eavesdropping with the microphone and sending data out over the network, no peeking at your Documents, or browser history/cache/cookies.
It's a lot easier to tell someone to NOT ever run anything that requests "Full System Privileges" (with "danger" red background etc), unless it one of a small list of apps (preferably signed by a trusted party, or a party you have no choice but to trust anyway).
You know it can be done and things can be so much better, but all we get is stuff like UAC aka "Allow Microsoft to blame you for security problems Y/N", or "run make install as root and hope you don't get pwn3d" (like you look through every line of source all the time AND have a good chance of spotting nasties/backdoors).
Forgive my ranting, it's just I'm a bit tired of hearing that one piece of crap is so much better than another piece of crap.
That's "real cool" guys: Impersonating me... give me a break!
As the saying goes: "SHEESH!"
(I'm surprised @ such juvenile behavior here, of ALL sites this could occur @, & that this place might be a "cut above" on that account (maturity & yes, intelligence - see my "p.s.", below as to why I state the latter 'note' on smarts)).
Point-of-fact: I could track anybody here who is registered, for instance, & post stuff like YOU JUST HAVE, far more easily (plus, trolling/flaming them in the doing of it if I wished) BECAUSE THEY ARE REGISTERED! That's the "why" I why I won't go for registering here, unfortunately (as I don't need that in my life or posts here, that easily & directed MY way).
APK
P.S.=> The REAL apk, myself, is replying now... You know - the one whose IP address the mods/admins here can check & see my original IP address here, and verify that for me... then, running my IP thru for example, a pretty cool Win32 tool called "Visual Traceroute" (not sure if *NIX's have an analog here), I can determine WHERE they are posting from on the planet (&, so can the mods IF need be/the need ever arose)
(Pretty lame, whoever did that, give us a break (if you want mods/admins here to see you are lame doing that, fine by me - they can always verify who is WHO, here, in case you did not know that, because of IP address info. on posts))! apk
You mean just like the JAVA virtual machine, the one MS hacked Windows to make not work.
.. Hard-code support for these features into Win3.1 and Mac versions of IE, including VB script"
"it becomes clear to me that the Java OS will try to conquer the embedded marketplace from palm pilots over game machines to low-end terminals, while infesting all other computing"
"Instead of beating our heads against the wall trying to produce a portable executable + run-time library solution to compete head-on with Java, we decided to do the following:
davecb5620@gmail.com
"Windows XP was released with no effective firewall software, leaving users exposed in an online world. The situation was eventually remedied with the inclusion of Windows Firewall in XP Service Pack 2. This application in an of itself wasn't considered the best client firewall out there, but it did (and does) effectively stop incoming traffic"
A software filewall is next to useless as it can be disabled by the malware. You need a standalone embedded solution like what comes on the average ADSL router. Blocking outgoing traffic is also considered de rigueur as it prevents the malware from contacting its host, when the machine invariably gets infected with the next virus.
davecb5620@gmail.com
Agreed. In fact I just set the .EXE extension to be associated with Winzip. Let's see what happens.
How do we know MS hasn't been feigning incompetence all these years? They've practically delivered the world's population (of Windows users) to government and industry. 20 minutes average to own a Windows computer? From the user's standpoint it is utter failure but from another perspective it is total success.
"When did I say that? No, I don't have it compiled or installed. And since I don't normally run programs I don't trust, I see no reason to compile it and learn its intricacies (and very possibly cripple the rest of my system) just to satisfy your curiosity" - by SanityInAnarchy (655584) on Thursday August 09, @10:34PM (#20178127)
You ought to, for your own securities' sake...
"I could setup a chroot jail, or something similar. However, chroot jails can be broken out of, and they are a hassle to setup -- and I actually know how to do those. I don't know how to do SELinux." - by SanityInAnarchy (655584) on Thursday August 09, @10:34PM (#20178127)
Well, if you can do it, I am surprised you won't (suddenly though, those chroot jails don't sound all that secure, along with Linux's native security though)...
"If you are so curious, it is not difficult to download and install Ubuntu, and you can probably even find a Qemu image to use." -
I could say the same about SELinux on your end... & I find it tough to believe it is any more difficult to compile in & setup than it would be to do Group Policies + security work on Windows Server 2003 (then again, the "user friendliness" & "ease of use" of LINUX is in question here @ this point it seems, from your feedback here on its security mechanisms, as well as their reliability per your quotes above I cite now here in this reply).
"At least be honest with that big cut-and-paste troll. Stop calling it "proof" of anything." - by SanityInAnarchy (655584) on Thursday August 09, @10:34PM (#20178127)
LOL... I am not the one talking about faking a result here (and, if my photograph was a fake, why wouldn't I just post a 100/100 score?)
APK
P.S.=> You're not fooling anybody here with your evasions!
Plus, @ this point? I truly DO think you have already TRIED CIS TOOL on your LINUX rig & could not beat my 84.735/100 score I posted... &
(& YOU DON'T HAVE ENOUGH IN PLACE, security-wise (SELinux kernel hook addons) TO EXCEED THAT SCORE, period!)
Imo, you are also too lazy + apparently unskilled to do so anyhow to add it onto your LINUX setup: Would I trust a result from you @ THIS POINT? No, probably not, after your "work arounds" to post a faked result... apk
As far as setting up UBUNTU, & doing this test here already? HOW DO YOU KNOW I HAVEN'T?? You don't... I may just be looking for someone more "expert" in LINUX security methods than myself to post a result is all...
Apparently, based on the quotes of yours below & work-arounds OR details I give you (me, the "windows guy", not a "linux expert" here by ANY means)? You are NOT THE PERSON I AM LOOKING FOR - read on:
"(This also would not have prevented it from sending spam, now that I think of it -- shouldn't have even gone that far.)" - - by SanityInAnarchy (655584) on Friday August 10, @12:52AM (#20178969)
Ok, lol... & YOU CALLED ME. the "Windows guy here" a "NEWBIE" (but, I am constantly the one here pointing out the actual tools/details of setting up your "sandbox" for you, & more... read on:)
Can't you setup "iptables firewalling rules" against that on your end? SELinux gives you SOCKETS LEVEL ACCESS CONTROL TOO, mind you... you have ways around that "potential complaint" too here, mind you!
(Hell, there is even ipchains on LINUX, but haven't used them myself AND PACKET FILTERING (a technique I use here on Windows & have for more than a decade too) is built into your LINUX kernel as well)
IN FACT? I show Window users how to do all that, via analogs in modern Windows versions (2000/XP/Server 2003 & VISTA) here, in an EASY 12 step program:
http://forums.techpowerup.com/showthread.php?s=67a 42847a48f0b563e321121355dd438&p=375355#post375355
(SO, if Windows folks can do it, like I have & others have? Are you saying LINUX folks, can't??)
IF this is all "too much for you", though YOU called ME "newbie" and prove who the noob here is??
(OR, is that setting up SELinux. IPChains, Packet filterings, OR IPtables "too hard" or too un-userfriendly, like setting up & configuring SeLinux would be for you too?? These complaints of yours, do NOT 'bode well' for userfriendliness/ease of use, on Linux, period... that, or your skills are weak, & YOU CALLED ME A NOOB, as regards security & setting it up right?? Please...)
BOTTOM-LINE - Can't you just run it, without being online IF NEED BE as well, @ least as a test??? Is this beyond you for a test???? IF IT FAILS TO RUN THIS WAY - there are always the techniques & tools listed above, as well as further onwards below.
"Alright, correction: I do, in fact, have selinux installed. Apparently it comes out of the box on Ubuntu, along with ACLs and all the rest. It's still not something I look forward to learning about, for a single-user system." - by SanityInAnarchy (655584) on Friday August 10, @12:52AM (#20178969)
Do you, OR don't you? Make up your mind man... I strongly suggest that IF you do? Learn it then. Until you set it up right?? You won't score as high as you can, & you certainly are not as secure as you might think, period.
First of all: Access Control Lists (ACL's) & ACE's (Access Control Entries) are terms used on Windows (VMS variants, & Mac too iirc)... SELinux calls this "label based security", & via MAC (mandatory access control (still just POSIX ACL stuff though, how do YOU like the 'word semantics' game played on YOU, by the way?)).
STILL - They are the SAME base idea though, regardless of the terms being used, but being specific for YOU, by OS types & terms typically assigned them BY THE OS PLATFORM in question, here is all.
(Why bother even test security scores vs. you, especially after you said you might fake a test score result & accused ME of it (I would have put up a perfect 100/100 if so, think about it & made myself UNBEATABLE, period))
Bottom-line, based on your statements:
YOU ARE NOT SECURED FULLY ANYHOW & apparently, though YOU called me a "noob", you don't even understand your OS' potentials for sec
EVERY ONE OF YOUR POINTS/OBJECTIONS, noted below, & COUNTERED!
(Via your own shortcomings/words, & YES, those of LINUX/SeLinux, in useability, especially)
"FORREST" (lol)? Here goes:
"This was meant to be an object lesson for you." - by SanityInAnarchy (655584) on Thursday August 09, @07:14PM (#20176577)
Then, "here endeth the lesson", lol... for YOU (with evidences of that below in the 2 url's posted):
Right here below, because you SanityInAnarchy, can't even setup your system using SELinux(or chmod/chown/chroot + IPTables/IPChains usages) IN LAYERED SECURITY, for securing yourself, evidenced ESPECIALLY with details, here:
http://slashdot.org/comments.pl?sid=264303&cid=201 82847
& here also, vs. your objections in both places, & overcoming them via showing you methods of securing LINUX in layered security methods no less on many levels
(Mainly SELinux layered security control over sockets, folders, files, etc. & via its MAC (mandatory access control based) control of them, layering it in, ontop of std. chroot/chmod/chown + IPTables/IPChains methods in most *NIX's & certainly LINUX with SELinux added for layered security)):
http://slashdot.org/comments.pl?sid=264303&cid=201 80939
Where you tried to apply a SINGLE method of security only & I KNEW YOU WOULD, & I also KNEW & stated what the faults are in it, programmatically via a technique commonly referred to as impersonation (programmatic impersonation & privelege level escalation thereof)!
(That being chroot jails which I had to suggest to you no less as a detail of your 'sandbox', & I KNEW NO LESS HOW THEY ARE BROKEN PROGRAMMATICALLY (via using "impersonation" knowing you'd try only a SINGLE LAYER of security vs. layered no less) & that you'd 'fall into that trap' as I knew you would!)
All that, vs. your only saying "sandbox" no less + other methods of "layered security" (the BEST way) for LINUX I had to suggest to you, to overcome your objections (running from a fair test gauge of online security on a multiplatform test of it no less)?
BAD MOVES, On your part - In name tossing, impersonating me here, insinuating you'd post a fake result image photo, not knowing how to secure your rig vs. nearly ANYTHING no less, & YES, insecure, because of a lack of layered security in place on your LINUX/SeLinux equipped rig.
Nuff said!
Especially when I can show Windows folks how to do a LAYERED SECURITY SETUP, and IN DETAIL via an easy to use & implement 12 step guide here that WORKS for an 84.735/100 score on a multiplatform security test gauge in CIS Tool 1.x (by the center for internet security):
http://forums.techpowerup.com/showthread.php?s=67a 42847a48f0b563e321121355dd438&p=375355#post375355
Well... proof's in the pudding!
I.E.-> I was talking to the WRONG MAN FOR THE JOB in you, in those 1st 2 URL's above (in my being a "windows guy" having to point out what secures what & HOW in a layered security method/pattern, on LINUX no less, from me for you) & especially evidenced by the 1st URL I posted in this reply, above... no doubt about it @ this point.
----
"And your "visual traceroute" won't cover anonymizing proxies" - by SanityInAnarchy (655584) on Thursday August 09, @07:14PM (#20176577)
LOL! Ummmm - when it shows one post coming from USA (mine, & the REAL ME, because I am in the states), & say, another from Brazil, not even a few minutes later?
OH, I think otherwise, lol...
NO administrator worth his salt would be fooled by THAT first of all!
(but, IP address AND Media Access Control (MAC), in combination
They can only be broken out of by root, which is why I won't run this program as root, even chroot'ed.
No, you're just the one who may have faked it. I wouldn't call something so easily faked "proof", would you?
Think back to my impersonation of you. That's proof you're homosexual, right?
Oh wait -- it's not proof of anything. It was faked.
To make it more believable.
Yes, and how goes that spyware I told you to install?
Don't thank God, thank a doctor!
LOL, pretty "pi$$-poor defense", against this:
1 82847
http://slashdot.org/comments.pl?sid=264303&cid=20
WE REFER YOU, lol, TO YOUR OWN NUMEROUS BLUNDERS ON THIS SUBJECT!
(Albeit, with greater detail, lol, it's needed, for humor's sake)!
APK
P.S.=> Numerous HUGE mistakes, lol... apk
"I did not know I had any kind of SELinux in place, because I had never installed it, and certainly never checked for it. Now I know it comes by default with Ubuntu." - by SanityInAnarchy (655584) on Saturday August 11, @02:56PM (#20197089)
Didn't you state this:
----
"Alright, correction: I do, in fact, have selinux installed. Apparently it comes out of the box on Ubuntu, along with ACLs and all the rest. It's still not something I look forward to learning about, for a single-user system" - by SanityInAnarchy (655584) on Friday August 10, @12:52AM (#20178969)
http://slashdot.org/comments.pl?sid=264303&cid=201 78969
----
AND LATER, THIS:
----
"When did I say that? No, I don't have it compiled or installed. And since I don't normally run programs I don't trust, I see no reason to compile it and learn its intricacies (and very possibly cripple the rest of my system) just to satisfy your curiosity" - by SanityInAnarchy (655584) on Thursday August 09, @10:34PM (#20178127)
http://slashdot.org/comments.pl?sid=264303&thresho ld=1&commentsort=0&mode=thread&cid=20178127
----
?
That's not contradicting yourself? That's not 'changing horses in midstream'??
Hmmmm... sure looks like it is to myself @ least, lol!
"And that is correct -- I do not want to learn its complexities." - by SanityInAnarchy (655584) on Saturday August 11, @02:56PM (#20197089)
Then, you will continue to be less secure than you possibly CAN be... by NOT using "layered security" & then falling into the trap you already have, depending on chmod, only... chroot/chmod/chown are NOT ENOUGH!
SeLinux usage also would give you more ontop of THAT!
SeLinux gives you more than IPChains &/or IPTables work for control of "things internet" too (AND THERE ARE DIFF.'s between those as well, mind you, per proof below, despite what you stated earlier as well) because SeLINUX kernel hook addons to LINUX give you SOCKETS LEVEL CONTROL also, for layered security ontop of IPTables &/or IPChains usage, just like it gives you layered security over chmod/chroot/chown usage @ the filesystems userrights level!
Here, take a read:
FOR YOUR REFERENCE, THINGS THAT ARE DIFFERENT IN IPCHAINS vs. IPTABLES in LINUX:
http://tldp.org/HOWTO/IP-Masquerade-HOWTO/iptables -vs-ipchains-vs-ipfwadm.html
(That way, you will be better informed on THAT ACCOUNT, as well)
Pretty funny me the "Windows Person here", has to show YOU, the "LINUX person" those differences, & what SELinux GIVES YOU, that overcame all of your objections (ontop of my having to point out to use chroot/chmod/chown as the tools & details to use for layered MAC/ACL type filesystem security control as well).
"There's no contradiction there. You're just trying to find contradictions to "trap" me and make me look bad, rather than address the actual issues I've brought up." - by SanityInAnarchy (655584) on Saturday August 11, @02:56PM (#20197089)
I BEG TO DIFFER (quite the contradiction IS present, & in your OWN words no less)... YOU TRAPPED YOURSELF!
By the way? I addressed EACH OF YOUR OBJECTIONS POINTS, here (point by point, quoting them):
http://slashdot.org/comments.pl?sid=264303&thresho ld=-1&commentsort=0&mode=thread&cid=20185057
"There's no point in bringing them up again if you're just going to pretend not to understand, or evade them again. For example, the race
Deliberate or not, I'm tired of these mistruths from you:
Yes, I did say that.
No, that was earlier. You're the one who brought up modification times, though they're insufficient. Go ahead and look at the post times on those. Here's the timestamp from the first one you quoted:
And here's the second:
I'm not even looking up the quotes -- by your own admission (you copied and pasted those timestamps into your own post), the second one, which you claim was "later" than the first, is actually earlier by at least three hours.
Don't thank God, thank a doctor!
Does it matter WHEN you said it? You SAID IT!
/. articles?)
m mand=viewArticleBasic&articleId=9018362&intsrc=hm_ list
e s.php?vol=9&issue=36#sID302
... & all your other objections were overcome by tools present in the *NIX realm natively like chroot/chmod/chown which I pointed out no less)
LOL - first you didn't have SeLINUX in place, & then later, you did... sure looks like a contradiction to me, OR that you don't even know your distro's capabilities + init. setup either...
After all - YOU ASKED FOR WHERE YOU CONTRADICTED YOURSELF, didn't you, OR you said you never contradicted yourself, & yet? You clearly did!
NOW, above ALL else?
Didn't you TRY to evade taking CIS Tool as a test, period, saying it is "malware" etc., more-OR-less? Well, "new NEWS":
SANS & COMPUTERWORLD EVEN NOTE THE MULTIPLATFORM CIS TOOLS' USES FOR SECURITY!
(Reputable sources for security & computer stuff, wouldn't you say, as they are often referred to in
COMPUTERWORLD - CIS tool aims to help federal agencies check Windows security settings:
http://www.computerworld.com/action/article.do?co
SANS - CIS to Release Windows Configuration Assessment Tool: (May 1, 2007)
http://www.sans.org/newsletters/newsbites/newsbit
APK
P.S.=> Your initial argument is shot, it's NOT "rogueware/malware" of ANY kind apparently, yes?
And, hey: "More New NEWS" - Other folks from the *NIX world as shown as trying it, in a FreeBSD guy in my post parent to yours @ its termination as well!
(
Though, how WELL they work? Questionable, by ALL means now @ this point! NOT in favor of *NIX there, wouldn't you say?? An extremely penetrable defense...
(E.G./I.E.-> Chroot jails via impersonation methods in code don't sound that impervious, w/ out SeLinux in place as layered security over them (for BOTH sockets &/or filesystem control via MAC, which YOU refuse to run, & thus? You are NOT as secure as I'd like to see in a setup vs. my score on this multiplatform gauge of security, especially online today! I said it before here, early on, & I'll say it again - You're the wrong person for this job in this case because of that, mainly. I'd like to see a seriously hardened for security *NIX rig user, take this test, & to see a screenshot of their score))... apk
It does matter when you say "AND LATER THIS", in caps, as if it does matter.
Do you understand what it means to contradict ones self?
I said one thing, which was not true -- it was a mistake, and also quite a ways back in the discussion.
I then discovered that it was not true, and corrected myself. (That's why the second post was later -- between the two posts, I discovered I was wrong.) But rather than you saying I should get modded up for being so honest, this time, you bashed me for contradicting myself. I didn't.
"Evade" is simply not true here. I chose not to take it. Were it a completely bulletproof test, ridiculously easy to take, and verified by God himself that it would not harm my computer, I might still choose not to take it.
But you insisted on a reason, so I gave you some.
It's a bit like saying "Here, have a smoke." If I say "no", that should be enough. If you want reasons, I can say "Because my lung capacity will drop like a rock, because they'll eventually kill me, because it doesn't even taste that good, and because I already get a high from caffeine." But the reasons are irrelevant -- they're just to get you to shut the hell up and go away.
They are not "evasions".
As for malware? I said it could be malware, which you must admit is true -- it is possible -- unless you have analyzed every single byte of its bytecode yourself.
Why should I trust them any more than I trust CIS?
It's a basic concept you seem to be missing -- security starts by assuming no trust at all. You then trust the absolute minimum number of entities that you reasonably can in order to get the job done. You do this because trust is a weakness -- every act of trust, in security, is a potential avenue of attack.
In fact, that's pretty close to the definition of the word "trust" as used in security: The act of "trusting" an entity means I am granting that entity the ability to compromise me in some way.
I've got absolutely no evidence from any entity I trust that it's not.
It may be perfectly reasonable for me to trust the sources you give, but why should I if I don't have to?
I still don't have a single good reason for running your program in the first place, other than to get you to shut up.
In that same link, someone is quoted as saying: "I tried it some weeks ago on 5.3-RC1. It's a good tool to use as a checklist but don't use the score to rank your systems."
As for the "proof", there's even less here than your screenshot -- someone simply posted their score, in plaintext. But let's forget that for a moment...
Once again, you're assuming I refuse to take the test because I'm afraid of getting a bad score. I don't believe the scores it gives are particularly meaningful, except measured against the same system -- as he said, he started at 5.88 and increased his score to 8.0.
THAT is a fair comparison -- assuming the tool measures things that are worth measuring, an 8.0 on BSD is better than a 5.88 on BSD. But that's not an indicator that 8.0 on BSD is better or worse than whatever score you got on Windows.
Kindly giv
Don't thank God, thank a doctor!
First off & bottom-line:
/. & THEY even note it is a legit program!)
You're the WRONG KIND OF PERSON I WANT TO RUN THIS TEST, as you don't & WON'T use SeLinux + tune it for MAXIMUM security possible on your end!
(Thus, imo? You don't really value your security setup enough, because you don't use "layered security" to even want me to see your score (which I'd almost wager would be less than mine has been shown to be, on a Windows based system no less!))
Once again, you're assuming I refuse to take the test because I'm afraid of getting a bad score." - by SanityInAnarchy (655584) on Monday August 13, @12:45AM (#20208459)
I am, absolutely, for those reasons YOU state yourself: Pretty simple!
(I say this, because it is some of the BIGGEST B.S. I HAVE EVER HEARD, & A COP OUT... plain & simple, thinking the multiplatform CIS TOOL security test is malware or your trying to SAY it is. SANS.ORG is pretty respected & often cited here @
APK
P.S.=> By the way:
"Kindly give me an example of how a non-root user can break out of a chroot jail" - by SanityInAnarchy (655584) on Monday August 13, @12:45AM (#20208459)
Look up "impersonation" or "programmatic impersonation" alongside "buffer overflow" online:
GOOGLE THIS -> "buffer overflow" and "impersonation"
(... & understand the idea/technique + mechanisms used, & you'll see how a chroot can be broken out of, because even IF you don't run as root & spawn this process as ROOT user context? It can privelege escalate ITSELF, via impersonations & this is not, afaik, restricted to Windows (why you pursue this, I don't know - don't run as ROOT/SUPERUSER if possible, & I recommended that))!
ANYHOW - 1 possible way, programs CAN find buffer overflows in apps too, mind you, that allow for this possibility (EVEN IF AN APP IS NOT RUN BY THE ROOT/SUPERUSER)... ok?
Verify it, you'll it is is TRUE, & possible! apk
Please stop putting words in my mouth.
I said that it could be malware. I don't think it is, and I don't think it isn't. I simply have no reason to believe anything about it, one way or the other.
That's one blatant misconstruction here, so I'm ignoring the rest of your post. You know the drill.
Don't thank God, thank a doctor!
"Please stop putting words in my mouth." - by SanityInAnarchy (655584) on Monday August 13, @02:31AM (#20208971)
LOL - You're one to talk!
NOW, since you said I said it wrong -> What is it about "race conditions" that I had wrong, per what I had stated in regards to them??
QUOTE WHAT I SAID, WHERE I SAID IT, & WHAT WAS INCORRECT ABOUT IT... This, I have to see.
APK
P.S.=> "I said that it could be malware." - by SanityInAnarchy (655584) on Monday August 13, @02:31AM (#20208971)
That's nice: However? SANS & COMPUTERWORLD think it's legitimate enough & for GOOD purposes... I wonder who's the more credible - they, vs. you?? apk
I already did that, simply and plainly, in the grandparent to this.
You keep saying that I "think it's malware" or I "said it's malware", which is not true. I said it could be malware.
If you can't understand that distinction, it's a wonder anyone trusts you with their security.
They are claiming to know something. I am not.
It's not a question of credibility. Anyone can verify that something might be malware through a simple process of logic. It takes trust (blind faith?) to believe that something is not.
Don't thank God, thank a doctor!
"But again, here's a lie from you, so this post stops here, until you learn the difference between "felt that it was" and "knew that it might be"." - by SanityInAnarchy (655584) on Monday August 13, @04:20PM (#20216233)
0 03_014_lprold.html [novell.com]
A lie? No lie @ all... you just do NOT want to face up to your inadequacies & mistakes here is all, of:
1.) Didn't you state what I stated about "race condiritions" was false also?? Please - quote what I said, & show what is wrong with it... thanks & GOOD LUCK (You will need it on that account).
2.) Didn't you state that your Ubuntu distro did not have SeLinux in place & later, you said it did???
3.) Didn't you ask me to show you an example of apps being able to use "privelege escalation, via impersonation analogs on *NIX & buffer overflows" to have an app escape a chroot jail via those machinations, & I provided you the info. to look for?? Here is a specific one:
http://www.novell.com/linux/security/advisories/2
(You felt it could not be done, UNLESS done via the web... I am showing you differently, as per usual in this exchange!)
4) AND YES - YOU Felt the multiplatform test of security CIS TOOL, by the center for internet security, might be 'malware'?
(Funny - SANS & COMPUTERWORLD showed otherwise)...
So much for that, & it was YOUR MAIN DEFENSE IN AVOIDING TAKING THIS TEST! So much for all of your b.s. really!)
APK
Answer these (quit the partial quoting too, you are using my quotes in partials only, not finishing them (you are WEAK & LAME because of that)):
----
1.) Didn't you ask me to show you an example of apps being able to use "privelege escalation, via impersonation analogs on *NIX & buffer overflows" to have an app escape a chroot jail, EVEN IF YOU DID NOT RUN IT UNDER ROOT/SUPERUSER PRIVELEGE CONTEXTS (which I did recommend against & to run it as non-root IF POSSIBLE) via those machinations, & I provided you the info. to look for??
Here is a specific one:
http://www.novell.com/linux/security/advisories/20 03_014_lprold.html
(You felt it could not be done, UNLESS done via the web... I am showing you differently, as per usual in this exchange!)
----
2.) Didn't you state that your Ubuntu distro did not have SeLinux in place & later, you said it did???
Ha - YOU DON'T EVEN KNOW THE CAPABILITIES & FEATURES OF THE LINUX DISTRO YOU USE!
(& your refusal to use SeLinux as layered security over IPTables (since SeLinux has SOCKETS CONTROL) & also your refusal to learn & use SeLinux as ayered security over chmod/chown/chroot for additional security control @ the filesystem + userrights levels (which I had to mention the specifics on here no less, NOT YOURSELF)? You are NOT A PERSON I WOULD TEST AGAINST ANYHOW, because you don't use layered security, period! It would be TOO EASY to win vs. your setup I suspect @ this point & I think YOU KNOW IT!)
----
3.) Didn't you state what I stated about "race conditions" was false also??
Please - quote what I said, & show what is wrong with it, specifics... & GOOD LUCK (You will need it on that account).
----
"You keep saying that I "think it's malware" or I "said it's malware", which is not true. I said it could be malware." - by SanityInAnarchy (655584) on Monday August 13, @04:44PM (#20216543)
AND, especially THIS one, answer it:
4.) Didn't you state the multiplatform test of security CIS TOOL, by the center for internet security, might be 'malware'?
(Funny, SANS & COMPUTERWORLD showed otherwise - I trust them before I trust you, & I am certain others consider SANS especially more of an authority on security than yourself as well!)
----
No, it's clear that YOUR motivations here now are to either:
A.) STALL, to TRY to learn to use SeLinux capabilities PROPERLY... & thus, to try to reinforce your system up to a score that is higher than mine of 84.735/100 on the multiplatform CIS TOOL test for security!
OR
B.) I'd almost wager you found you cannot exceed my score on CIS TOOL's multiplatform testing (& are trying to avoid taking this test, lol, with PURE B.S. REASONS!)...
APK
P.S.=> So much for that & the rest of your b.s. (answer these questions, quit avoiding them... I know WHY you do though - they show your arguments to be QUITE inadequate & you are unwilling to face your mistakes, period!)...
All this 'playing around' on your end is NOT putting up a score that is better than mine of 84.735/100 on a legitimate test of security that is multiplatform (runs on *NIX's & Win32 platforms) called CIS Tool, which is noted by SANS + COMPUTERWORLD as a legitimate test of security... my guess is you ran it OUT of a chroot jail, put up a much lower score than mine, & are scrambling/stallng to try to get time to TRY TO PASS IT.
Good luck, lol...
AND, above all else?
CIS Tool is NOT a malware like you said it might be!
(Thus, your main defense to avoid putting up a score less than my own of 84.735/100 with myself scoring that on Windows Server 2003 on the multiplatform CIS TOOL, while you run your *NIX not NEARLY AS SECURE AS IT CAN BE, because you avoid using SeLinux OR le
You have completely evaded the point I made there, and instead simply copied and pasted your responses.
I will happily address those -- and yes, I can -- AFTER you address your mistake here. It will take more than "No lie @ all".
But hey, you can copy and paste, and so can I:
Learn the difference between "felt that it was" and "knew that it might be". Otherwise, this conversation is over.
Don't thank God, thank a doctor!
B.S., pure b.s., lol... you won't face up to your mistakes, here:
/. no less, note the CIS TOOL as well, & it is NOT "malware", heck, it is "ANTI-MALWARE" IF ANYTHING, lol... for Pete's sake!)... period!
http://slashdot.org/comments.pl?sid=264303&thresho ld=1&commentsort=0&mode=thread&cid=20218887
Let's reiterate them:
====
1.) Didn't you state what I stated about "race condiritions" was false?
Please - quote what I said, & show what is wrong with it... thanks & GOOD LUCK (You will need it on that account).
----
2.) Didn't you state that your Ubuntu distro did not have SeLinux in place & later, you said it did??
Hey - YOU AREN'T EVEN AWARE OF THE CAPABILITIES OF YOUR DISTRO of LINUX YOU USE (and you certainly are not willing to use "layered security" via SeLinux, per your own words, regardless of #3 no less below!)
I.E.-> SeLinux can be used to secure things (& acts as layered security) @ A SOCKETS LEVEL, to aid IPTables (which I had to mention as far as specifics) usage, & also @ a filesystem & userrights ACL level (via MAC) supplementing & reinforcing chmod/chroot/chown (which I had to mention as far as specifics to use no less, NOT YOU)
----
3.) Didn't you ask me to show you an example of apps being able to use "privelege escalation, via impersonation analogs on *NIX & buffer overflows" to have an app escape a chroot jail via those machinations even IF YOU DO NOT RUN IT AS A ROOT/SUPERUSER's context, & I provided you the info. to look for??
Here is a specific one:
http://www.novell.com/linux/security/advisories/20 03_014_lprold.html
(You felt it could not be done, UNLESS done via web apps)...
Well - NOW, I am showing you differently, as per usual in this exchange!
"Programmatic impersonation" is possible on *NIX's, via buffer overflow exploits, and you do NOT have to be online or use online tools as you stated, for this to occur (& thus, even IF you DO NOT RUN a program as ROOT/SUPERUSER, it can still escape chroot jails via these machinations, period!)
AND, on that note? So much for their efficacy vs. a machination of that nature... @ least by themselves, that is, hence why layered security ROCKS! Beat one? You hit another (& the limit is only that of your imagination, if you can code to create more ONTOP of it, logging things OR cleaning things, lol, once the std. tools run out OR do not fit a specific purpose you need).
----
4) AND YES - YOU Felt the multiplatform test of security CIS TOOL, by the center for internet security, might be 'malware'?
(Funny - SANS & COMPUTERWORLD showed otherwise)...
So much for that, & it was YOUR MAIN DEFENSE IN AVOIDING TAKING THIS TEST! So much for all of your evasions in posting a score from this test really!
APK
P.S.=> Long & Short of it? I think you are either:
----
A.) Scrambling to TRY to learn SeLinux & raise your score on the multiplatform CIS Tool test, & finally post a score on it via your *NIX rig setup, as good as the 84.735/100 I can gain on Windows Server 2003 SP #2 fully hotfix patched & custom hardened by myself...
OR
B.) YOU KNOW YOU CANNOT EXCEED THAT SCORE @ this point, you cannot answer those simple questions above, & your body of objections appear to be overcome (such as SANS + COMPUTERWORLD articles, sources who are often cited @
====
Either way, you are running from simply installing & taking this test of security, in a competition between myself as a Windows user, & you as a *NIX user, on a multiplatform test that runs on them both (variants thereof, & its not Windows
Let's not. How about you go answer my other post? Or should I copy and paste that here?
Now I know why you don't want Slashdot tracking you -- people would find out right away just how many of your posts are literally copied and pasted.
Don't thank God, thank a doctor!
http://slashdot.org/comments.pl?sid=264303&thresho ld=1&commentsort=0&mode=thread&cid=20219969
"Too easy... TOO EASY!!!"
APK
UBUNTU SERVERS HACKED/CRACKED (08/15/2007):
2 35261
http://it.slashdot.org/it/07/08/15/1341224.shtml
Might as well add "insult to injury" per this earlier reply of mine, here in this thread:
http://slashdot.org/comments.pl?sid=264303&cid=20
Which was in reply to yourself (and, a challenge I issued & have issued here repeatedly which NO *NIX USER HAS MET, mind you, including yourself) AND overcame your objections, including your MAIN one, that insinuated that CIS TOOL was somekind of possible "malware" & I post links from SANS + COMPUTERWORLD which note it is ANYTHING BUT THAT, no less!
APK
P.S.=> Ubuntu, even left like YOU have it, in not using + UNDERSTANDING & CONFIGURING SeLinux (or, other apps) for layered security over chmod-chroot-chown &/or IPTables usage (since SeLinux offers ACL/MAC for filesystems + userrights & SOCKETS LEVEL CONTROL over IPTables alone)?
Well - there you have it: Lack of layered security AND THE RIGHT MAN FOR THE JOB @ THE WHEEL SECURING THEM?? Makes all the difference... see the above!
AGAIN: This is the reason you ought to NOT take this test as I said before - YOU ARE NOT THE RIGHT MAN FOR THE JOB, & just like the admins of that UBUNTU rig were (not using layered security sufficiently apparently, & not config'ing their systems + apps for it, like you are resistant to regarding SeLinux, per your own words in this exchange!).
(All because you literally said you "don't want to learn the complexities of SeLinux" & thus, layered security it offers - Heck, in your "CORRECTION" post? You had to realize that UBUNTU had SeLinux in place, & you did not even KNOW that!)...
In fact - I showed you HOW apps, via buffer overflow privelege escalation exploitation & even IF an app IS NOT run as ROOT/SuperUser, can escape chroot jails (the single layer of security I KNEW YOU'D RESORT TO & that alone)... layered security? Matters, as well as GOOD SOLID CONFIGURATIONS, all the way from the OS itself, into apps too that run on it! apk
I don't know much about the Windows filesystem API, but I know that the UNIX/POSIX API is not rich enough, by itself, to support the kind of filesystem I'd like to write -- or at least, the kind I think should be written. What I'd love to see is a solid transaction API on top of it, instead of all this laziness of calling sync or fsync whenever we need to make sure one thing hits the disk before another, or to implement a pseudo-transaction via tempfiles which can be "rolled back" by deleting said tempfiles.
An API like this would let us do things like... oh... atime updates on flash media, without destroying the media. Or actually delay full transactions, not even allocate the disk space, until memory pressure forces a write -- so people don't need tmpfs or ramdisks for temporary files anymore, as there's a good chance the file will never hit the disk.
But I've got a lot of ideas like this, and right now, I'm sticking to the ones that can get me work.
(A simple example: I think an entire OS could be created without... I think it's called memory segmentation. All programs, even untrusted ones, could share the same address space, technically, yet the system would be secure. If you're interested, we can go off on a tangent about that, but it's not relevant to this discussion, I think -- this discussion is about the security of existing real OSes.)
Don't thank God, thank a doctor!
?But the problem isn't whether an app can suggest that a write be deferred/lazy, but whether it can do so safely (transactions)" - by SanityInAnarchy (655584) on Friday August 17, @07:51PM (#20269653)
/. post could hold it all...
Well, the I/O mgt. subsystems work I noted above? It's the "best" we have, CURRENTLY, on Windows on that note, & it works, + on a GREAT filesystem in NTFS (plus, Windows allows for IFS (installeable filesystems, but I do not believe they are bootable))...
WinFS (an omitted part of VISTA) was SUPPOSED to do that... a DB driven filesystem, based on the SQLServer engine... more on that below, from IBM...
ANYHOW - & it's NOT THAT DIFFERENT on other Os' too, how layered subsystems manage & "QUEUE" read/write to disk!
(In fact, I noted earlier on in our exchanges here, that "little original thought exists" today in comp. sci. & yes, OS design... mostly incremental small improvements on existing ideas, but nothing "radically different", @ least not in the mainstream... Reiser FS might be one of the more radical vs. other filesystems, but I am not an expert on it!)
By the way - my example on NtRead? It's NOT MUCH DIFFERENT than for writes, even cached ones... (just think "in reverse" of my read example. I used a read example because you stated READ first, before WRITE per what I quoted...)
So, I am finishing that off now & addressing your point from a tech perspective:
Writes are ALMOST JUST LIKE the Reads (NtRead): Instead of the cache mgr. calling CCopyRead? It calls CCCopyWrite ("CC" calls are cache mgt. function calls, NT/ZwAPI native mode stuff in RPL0/Ring0/kernel mode iirc)...
So, instead of copying data from the cache to an app's buffer/memory space on a write (if data is NOT cached)?
It calls the 'reverse': It copies data from the app's buffer INTO THE CACHE (if the data is marked as CACHEABLE, sometimes, as in benchmarks, it's not OR rather, can be marked that way).
Caching FIFO, or whatever type? It's all going to hit disk though, sooner or later... once changes appear in the cache data map, or rather, SHARED Cache data map, marking them as "DIRTY"? Then, it's ONLY A MATTER OF TIME, before they hit disk again... to keep the state of the data, as current as possible of course.
This stuff? Again - imo?? It is the MOST complex topic there is in computer OS architecture... caching, & memmgt. & HOW THEY INTERACT WITH ONE ANOTHER, especially & how/why/when.
I am omitting HUGE details here too... if I went "into it" more? I don't think a std.
(You want instant commits though, & on Windows? As I said in my other reply to you: I can do this for the REGISTRY, easily (API has an instant commit call, but it has overheads of Open/Write/Close registry hives of course, based on the IO management model I illustrated in my parent reply to yours)... & for other diskbound I/O?? Well, benchmarks do it - they mark data as "non-cached", & it works (to stop caching performance advantages say, on "raw disk performance oriented benchmarks" etc.).
"Right now, databases and such, like MySQL and PostgreSQL, can be built on top of a Unix filesystem, but essentially, they have to duplicate a lot of the effort of the filesystem in their own code. They have to implement their own transactions, sync them properly, do journaling, and so on." - by SanityInAnarchy (655584) on Friday August 17, @07:51PM (#20269653)
Agreed here, & iirc, this is WHY say, SQLServer has its OWN memory & devices space on disk and in RAM - to manage its OWN read/write cycle, much as how the pagefile.sys in Windows is "raw written", bypassing the filesystem, completely (and, faster too).
"But I want this in filesystem operations" - by SanityInAnarchy (655584) on Friday August 17, @07:51PM (#20269653)
You want what I mentioned IBM has working on Os/400 - zOS series, in a DB/2 driven database managed filesystem... looking into THAT design (solid, works, & proven for more than a decade++ now iirc) MAY lend you additional insights.
Good luck, nice discussion (even though we got sort of "stupid" on one another @ points)...
APK
Ontop of the Os400-zOS DB/2 Driven Filesystem I suggested you look @:
t hesis06.pdf
(As well as how pagefile.sys uses "raw writes" to bypass filesystems (iirc that is, could be wrong here on SQLServer as well, since I do know that in RAM it maintains its OWN "filesystem for devices"))
For your research?
CHECK THESE OUT! ZFS & after that, "IRON FILESYSTEMS" in the 2nd URL below:
http://blogs.zdnet.com/storage/?p=123
(A great read, & great model for a filesystem (I like the fact you do NOT have to "manage disks" anymore in it, & have a "storage pool", singular one... which is PROBABLY WHY spanning & striping is SO EASY in it...))
Yes - MacOS X users have a treat coming... @ least on the server models!
(Perhaps, later on, maybe even on end-user/home models too, but I don't even KNOW if there are distinctions like that on MacOS X, though I have used it & actually LIKE IT, quite a lot, I do not do much research into them (market share & all that - have to go where the dollars are made, to live, & that my friend...? Is WINDOWS!)
BETTER YET, GET A READ FROM THIS FELLOW (PhD) on "IRON FILESYSTEMS":
http://www.cs.wisc.edu/wind/Publications/vijayan-
This one? I think you will LOVE, a great deal... & good luck on your quest/researches into it... this guy? HE HAS THE RIGHT IDEA!
(Combine it with ZFS features, + the possibility of bypassing filesystems drivers, even if ONLY @ TIMES (such as SQLServer does, maintaining its OWN devices in RAM & on DISK iirc, doing so, much as pagefile.sys read/write does, & faster than normal read/write I-O by far too) & man... WoW!)
On a related note - you KNOW somebody is a "nerd/geek", when they get excited about filesystems... lol!
APK
P.S.=> And, on the thing that MIGHT NOT exactly have you "too enthusiastic"?
I have my score on CIS TOOL now up to 85.185!
(Exceeding in fact, the "theoretical max" on this test MOST folks have obtained (around 84/85 range, & in fact, the BSD user who has tried it I cited earlier on here was told, iirc, that is the "usual max"... so much for THAT!)... apk