Slashdot Mirror
Microsoft Says "War on Terror" is Overblown
SlinkySausage writes "The endless security measures imposed on society as a result of the "war on terror" have become overblown and intrusive, according to Microsoft Redmond senior security analyst Steve Riley. He made the comments in a talk at day one of Tech.Ed Australia about software security. Riley also fessed up that Microsoft cocked up XP from a security perspective. "We let you down with XP," he said.
Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS. Think Virtual PC or VMware, but instead of virtualising an OS, just a single application is virtualised."
From TFA: Steve's approach to security spans all horizons, not just information technology. He elaborated on this theory in an afternoon session today at Microsoft Tech.Ed entitled "Making the Tradeoff: Be Secure or Get Work Done". You are trying to get work done. Allow or Deny?
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
Too bad you have to read him - not see him in person.
Oh, and a pity he makes the fron page at Slashdot for stating the obvious!
"Flyin' in just a sweet place,
Never been known to fail..."
Or think Crossover: http://www.codeweavers.com/products/
-- lol pwned
In the United Kingdom we lost fifty or so people in the carnage of bombings last-year, in the United States you lost four or so thousand.
I don't for a second want to say that the loss of these lives through an unspeakable act of senseless violence is a trivial matter, but we need to put these figures in perspective. In the United Kingdom, more are killed in road traffic accidents in a couple of weeks than were in the July 7th bombings. In the United States roughly three times as many people are killed in gun accidents per year than 9/11.
Somebody even said to me that more people were killed putting their socks on in the United Kingdom than by terrorists last-year. It's probably true. This stuff is right in the noise level of the threats we encounter each day. It's dramatic when we see some idiots attempt to blow a car up at Glasgow airport but in terms of actual risk, these people are up there with being struck by lightning or having a bad reaction to asprin.
So why is there talk about trading liberty for security? Even though the security vs liberty argument is as flawed as the mythical man month, the point still remains - why do I need this extra security anyway? It's expensive, it costs me my rights and it's ineffective.
It feels like that we've forgotten what it is really like to be a nation threatend with annihilation. In the 1940s our country nearly didn't make it and we have the United States to thank for that as much as our own heroic airmen. That was a time where the agressors really could have destroyed our way of life. Yet we did not yield in the face our adversity. We held our resolve!
And we should hold our resolve now. In comparison to the Nazis these modern day terrorists are like flies trying to stare down a tank. I don't know whether to laugh or cry why we even take them so seriously. We should not give a shred of our liberty to these people - they are pathetic and worthless; you only need to look at the Glasgow "terrorist" attack to see this for yourselves.
Simon
its much like citrix, basiclyy allows you to have Backend farm of app servers and serve stuff up form the backend. greate for enterprises with lots of apps.
-b.
There is no "I disagree" mod for a reason. Flamebait, Troll, and Overrated are not substitutes.
Microsoft didn't issue a press release, one guy voiced his opinion.
They say this now, when there is Vista to buy. It's just part of Microsofts standard strategy... Release new operating system, try and make the old one look bad.
Open Your Mind. Open Your Source.
I'd rather deal with airport security than install programs on my girlfriend's vista laptop...
An I.T. motto in the hands of an idiot is a dangerous thing...
Uh... on a real operating system that's called a "process". The only reason they need to think in these terms at all is because there is so much broken design in the basic OS. If everything wasn't welded inextricably from everything else, apps wouldn't take down other apps, nor the system when they misbehave, and you wouldn't need to "virtualize just the app! OMG! What a concept!"
Here's a little concept I've been working on. Why don't we use a real OS?
If you mod me down, I shall become more powerful than you could possibly imagine.
single application is virtualised.
Windows NT 3 could do that, except that screwed OCX technology makes it almost impossible to install 2 different versions of one application at the same time. This new "virtual applications" will address this problem by adding one more layer of complication (separating registry for each version of application) instead of getting rid of broken OCX thing.
839*929
It depends on how you define "virtualization" but Vista already uses fairly extensive virtualization, eg the UAC system redirects file system stores to user profile areas of disk. And IE7 protected mode (for Vista) is an example of exactly what is mentioned... I think this "talk" is just on already released "innovations." Though I suppose the comment about the paranoia is of note.
The war on terror is overblown. It's not like Muslim extremists are going to take over USA anytime soon... (Don't laugh, a lot of Americans think that this will happen if they pull out of Iraq...)
The war on terror is really a war against your rights, so be ware. This is much worse than even MS ME II.
Microsoft finally invent chroot
SoftGrid isn't new, nor is it a particularly close relative of WINE as some Linux enthusiasts suggest. It was a Microsoft acquisition, the former product name being Softricity. It's not just virtualization, it's packaging, so a single file, streamed from a server as needed, encompasses the program and all of its settings, creating a layer over the regular file system, registry, etc. with copy on write functionality; if the program tries to change the host OS in any way, it just adds to the shell of program specific settings within the single packaging file. Extremely handy for network admins who need to distribute programs, and want the performance of local apps (once the whole package is streamed, it runs locally, with the streaming order prioritized based on what the user is doing), but want the simplified administration of centralized programs with standardized configuration.
Consider what we COULD be doing with the money spent on this.
The Cold War ended. The world was as close to Peace as it has ever been. We could have been investing in so many things to help the human race as a whole.
Instead we're spending trillions of dollars "fighting" a few thousand nutcases who can't do any more damage to the world than we do to ourselves, every year, in traffic accidents.
Spies and saboteurs aren't covered by Geneva. It's perfectly legal to punish them (up to death) if caught on your country's territory.
-b.
It's large-scale immigration from countries that don't share British or American values. Both countries are taking in a lot of immigrants who don't want to integrate. That poses future problems for the culture in our respective countries. Even more so in Britain where it is primarily people from Islamic countries who are convinced that British culture can go to hell as far as they're concerned.
With immigration, we have too much of a good thing. Immigration is good, but only when it is limited to people who actually want to **abandon** their old culture in favor of the new one. Multiculturalism is bullshit. If you like the way it was done back home, then stay there.
Thanks for the security advice, Microsoft. You are the experts. We need your wisdom. Who better to advise us on security.
I guess we can only hope to be a safe from attack as Windows is.
Then OS virtualization is something that you really should not need. It would just be a way of installing something that would be hidden from the OS, meaning that Windows does not have full control of the machine. Can't possibly want that.
from a security standpoint, what shortcomings does it have?
SoftGrid has been around for a while and was bought last year by Microsoft. We've been using it in our labs for a few years. Our base image is XP with antivirus and DeepFreeze, then SoftGrid provides the apps. It streams the apps to the desktop without them actually being installed on the system. It has reduced downtime due to reghosting, and the size of our Ghost images considerably.
-- "Freedom is the right of all sentient beings" -Optimus Prime
The security craze has also been a vehicle for agendas that actually are about security, except it's overreaching, excessive, broken, and dysfunctional security for intellectual property owners against MS's customers. Defective by design "security" both for MS themselves (Windows Genuine Advantage), and for the entertainment industry. Any mention of Vista's shortcomings alongside the bit about XP being a security letdown?
Intellectual Property is a monopolistic, selfish, and defective concept. It is "tyranny over the mind of man"
Thinstall (http://www.thinstall.com)
Xenocode (http://www.xenocode.com)
Sandboxie (http://www.sandboxie.com)
MS bought out softricity I think last year. In theory the system is great from an enterprise management perspective because it basically streams one instance of an application to many desktops.
:) )
We actually use softgrid for citrix(softgrid steams to citrix, citrix streams to remote user). We've had some issues with it but very few compared to our regular problems across our citrix environment.
Now the interesting part of softgrid is it's ability to sequence and stream a small set of the app. For instance after evaluating visio, we discovered most of the users only used 20% of the app, so softgrid only deployed that small footprint. Neat technology, and we will be using it next year when we move to XP for my environment of 7000+ desktops. (We're slow moving to new OS's
None. But I wouldn't sacrifice nearly all usability and control over the OS in the name of security. The fact that I can delete the Recycle Bin and get it to consistently throw the BSOD just by plugging in my digital camera and the fact that Vista takes the admin's right to admin away, really puts a sour taste in my mouth.
The game.
In the United States roughly three times as many people are killed in gun accidents per year than 9/11.
Um, no, there weren't. I'm not arguing with your overall point but you really need to get your numbers straight before you start spouting stuff.
There were only about ~700 accidental gun deaths in the U.S. in 2004. It was slightly higher in 2001, but still only 802. That's slightly more than a third of the number of people killed on 9/11.
(Sources: for accidental gun deaths go to the very slick CDC Fatal Injury Reports Calculator and put in "Unintentional," "Firearm," and the year of your choice. 9/11 casualties are from NyMag's "September 11th By the Numbers".)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
What's the big security problem with XP? It installed by default with a firewall that denied inbound connections. It allowed people to easily give the kids and the wife non-admin access to a shared system. It automatically tells me when new security patches are available from Microsoft, and it always installs them without incident. It even complains (through a tray icon) when my virus-checker's images were getting out of date. I've been running the same XP system on my laptop now for about three years; I haven't had any spyware, viruses or worms yet, and the system still boots as fast as the day I got it. So...what's the beef with security?
I find this statement odd coming from a company which routinely propagates FUD to the general public...
When the lock on your luggage was broken and your belongs have obviously been gone throuhg, yes you have lost something. Namely the right to be "secure in your person and belongings." It is very violating.
I've also lots a fair bit of money via taxes. So yes, it does feel like I've lost something everytime I see my paycheck.
You need strong competition to spur you on to even greater things, and with the number of brilliant people they hire, it's not surprising that some truly great ideas come out of Redmond. I'm very relieved to see MS corporate culture is admitting the problems with security, caused by (as one poster here noted) the browser-OS integration that makes writing viruses so easy and fun. Maybe they'll learn from this with Vista, which when it is working will provide a full-on technological challenge to Linux with its new methods of handling screen fonts, data and threads.
technical writing / development
The world's burning. Moped Jesus spotted on I50. Details at 11.
Pretty self-explanatory. What is it with slashdot?
"intrusive" = interfering with M$'s bottom line
He's giving a lecture called:
Making the Tradeoff: Be Secure or Get Work Done.
With reasonable design choices, I get both. With sftp and konqueror, I can transfer files without worry. With real user and process separation, I can do a lot of other things without fear. If he's forced to chose between security and convenience, his system offers neither.
Friends don't help friends install M$ junk.
Last time I looked we have a First Amendment here in this country. It applies to companies as well. Questioning the governement's actions doesn't equate to dissing the country. Your comment on the new rule leads me to believe you are being tongue in cheek, but figured I'd be safer than sorry.
It's just a sandbox for apps, not virtualization.
.... its all just words to try and get people to buy Microsofts next product...
I love that false choice. If you have to chose between the two, you don't have either.
Friends don't help friends install M$ junk.
When they are a global software company that does business just about everywhere there is technology?
GetOuttaMySpace - The Anti-Social Network
But now we have something *new* that fixes all those problems! Really! So hand us more money, now!
Chris Mattern
I think that's possible. They mentioned Vista's built-in firewall (which in XP didn't allow fine control over outbound connections) as something they wished they did better.
Sir, I suspect that one of the reasons why you don't hear an answer is that some of your interlocutors are frozen in disbelief.
Although the USA may try valiantly, not everyone who displeases the government can be incarcerated. People think Guantanamo is bad; the US prison system is a systemic Guantanamo fit to burst with the highest percentage of incarceration in the world.
Do all the people who are not incarcerated have any reason to be concerned? If the government is above the law and there is no law to protect them, the only protection they have is their sleepy ignorance of their vulnerability.
You would call their sleepy ignorance proof that they have no cause for worry. Coincidentally, there's a group of men in the White House who agree with you.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Microsoft didn't issue a press release, one guy voiced his opinion.
If they fire him, they disagreed.
Friends don't help friends install M$ junk.
There already exist Windows software for virtualising applications; these are called sandboxing applications. Sandboxie is a great example. Sandboxie is gratis, but you are encouraged to register/pay. Only drawback with Sandboxie is that it isn't Open Source - although I seriously doubt that "SoftGrid" will be Open Source either...
SIG: TAKE OFF EVERY 'CAPTAIN'!!
I live in Baltimore. The murder rate is going over 300 for this year. The biggest threat to me is that robber armed to the teeth getting ready to hold me up. I don't look up in the sky dreading that terrorist who going to hijack a plane and fly it into my house. Yet, my elected officials think that the terrorist is my biggest concern and voted to expand the Patriot Act to include warantless wiretapping. Gee, thanks guys. I feel safer. If people thinks the "war on terror" is overblown is obvious, then I think we need to explain that to the politicians. They don't have a clue.
You don't have to be smart to use a Mac, you just have to be smart enough to buy one
No more Pork for you!!
May the Maths Be with you!
How? In both instances you're dead. It just differs to the people who see it on the news. If we saw someone everyday on the news dieing from cancer or heart disease or a traffic fatality; which according to the odds is the way we will die, we all would have a much different perspective about the risks from terrorism. And I don't know about you, but spending months in the hospital dieing from cancer (very painful so I'm told) scares me much more than dieing instantly in a terrorist attack. The media is completely distorting risk in people's minds.
You may as well console someone who gets mugged by saying "well, you know, people accidentally lose money every day."
Being mugged is having money forcibly taken away and it's not losing money. So, of course you couldn't console someone that way. Perhaps you meant "People are robbed everyday, so don't take it so hard." ?
I prefer Flambe as apposed flamebait.
Calling the Islamic Terrorist threat overblown is burying one's head in the sand. Just yesterday alone:
8/7/07 ( Gaza, Pal. Auth. ) - Two Gaza children, ages 6 and 8, are killed by a rocket fired at Israel by a Palestinian Islamic group.
8/7/07 ( Yala, Thailand ) - A man is murdered and his body burned by Islamic separatists.
8/7/07 ( Pattani, Thailand ) - A roadside bombing by Muslim radicals leaves two Thai soldiers dead.
8/7/07 ( Banadir, Somalia ) - A mother and her 11-year-old daughter are killed when Islamists detonate a roadside bomb.
8/6/07 ( Pulwama, India ) - A civilian is abducted four days earlier and murdered by the Mujahideen.
8/6/07 ( Yala, Thailand ) - Muslim terrorists gun down a 61-year-old civilian on his way home.
One week of terrorist attacks (July 28 to August 3):
Jihad Attacks: 64
Dead Bodies: 354
Critically Injured: 514
And for the month of July:
Jihad Attacks: 322
Countries: 17
Dead Bodies: 2211
Critically Injured: 2674
These killings have been going on for years and are getting worse. The stated objective of the Islamic Terrorists is the total subjugation of all western society. It's a holy war, but we didn't start it. Just as we didn't start the Crusades (read your history). These are not the actions of a religion of peace. These are the actions of evil, murdering fucktards who consider mercy a weakness. They don't have any problems murdering women and children. Any action is justified if it's for "Allah".
I say to the Muslim world, get your fucking world in order and deal with these bastards before western society wakes up. Because when we do wake up and realize what the hell is going on, we are going to terminate you with extreme prejudice and we won't be making any distinction between extremist and moderates (especially since moderates don't seem to exist).
I expect this to be moderated down as flamebait. Some people don't wish to face reality.
-- Will program for bandwidth
Agreed. After SP2 came along XP became a fine little OS that was reasonably strong and secure for those who had been paying attention to the state of the world for the last 10 years or so.
It's just part of Microsofts standard strategy... Release new operating system, try and make the old one look bad.
The solution is to live in the future, not the past. That way you always know that the current version of Windoze is easy to 0wn, rather than mistakenly believing what they told you about the last version.
Friends don't help friends install M$ junk.
Anyone who goes for this "War on Terror" crap needs help. I guess some MS employees aren't that stupid. I don't see them making that much difference in ending such a non-productive idea as a false war. Still my opinion has raised a bit. As far as any new technology in the suggested reading, we've been using it for years. Somehow Microsoft can't admit they have fallen behind, but they certainly drop many hints.
If I had the burden of MS, I'd sell off every division except 'Office' and maybe the re-branded hardware. Microsoft cannot make a true 64bit OS and more importantly, they've never turned a profit on anything but Office and perhaps mice. If it doesn't make a profit: Sell it!
XP is probably the best Win32 system since W2000 it may be slow, hard to use and full of bugs, but bashing it internally is only admitting to the failure Vista is. This is confirmed by their own statement another 'OS' is in the works. Perhaps if they 'opened it up', they'd make their code more understandable. I'd also hope they would remove those sometimes nasty and often irrelevant comments. The amount of BSD code is astounding, nothing wrong with that, just make it better.
Do you not understand the concept of a "slippery slope"?
Do you not realize that treating our fellow citizens with such severe suspicion causes much more damage than the "1/2 hour of lost time"?
The terrorists did not win at the moment the planes hit the buildings, the terrorists only won when Bush announced his war on terror and we sent troops over to Iraq. They continue winning each time someone takes off a shoe because "ooooo, if we don't do this, I might get bombed out of the sky!!!!!"
DON'T ignore the pattern of government abuses! Don't trivialize what's happening. Riley hits the nail on the head when he points out that cost is unaccountably high, and benefit is un-measurably low. Just say no!
"We think people rightly feel that once they buy something, it stays bought," --Suw Charman, Open Rights Grp
When I can't buy certain products because they are now placed on restriction lists, can't read certain materials because they will place me on a terror watch list and my child's education is stifled because once common knowledge is now classified as sensitive state secrets then yeah, my rights have been violated and I notice it.
if they made you agree with M$, the terrorists have won. (end sarcasm)
Power to the Penguin!
because I just found myself agreeing with Microsoft ...
People might get the wrong impression that I think all Muslims are murdering terrorists. Not so. There a lots of them who find the actions of the extremists repugnant. The problem is we rarely, if ever, here from them. Print a comic "insulting Mohammad" and there is rioting in the streets. An Islamic extremist murders a bunch of children and the silence is deafening. This MUST change.
-- Will program for bandwidth
Softgrid? Is it little more than a chroot?
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
How many AVERAGE Americans actually feel that the changes to security have affected them at all?
They have affected the ratio between the tax I pay and the government service I get in return.
I am paying extra taxes for things which benefit nobody.
That TSA screener may not be inconveniencing me that much, but the pothole he's not fixing because he wasn't hired as a construction worker instead may be.
After reading the blurb on this, it sounds an awful lot like "Solaris Zones" -- which is similar to BSD Jails or OpenVZ on Linux.
It's a kernel level partitioning of resources, to create virtualized hosts with low overhead. They all use the same kernel (so you couldn't have Linux/Windows/Mac virtual machines), but each system/app is unaware of the others.
That way, you can have two virtual instances, each running Apache, but with different/conflicting middleware below it -- and no worries about them crapping on one another.
The example they give in the article is being able to run Office 2003 and Office 2007 on the same machine. The concept behind it is cool. But, doesn't that example illustrate a lot of what is wrong with Windows -- they need an all new virtualization technology just to install two versions of Office on your PC?!?
Has anyone else noticed that "Microsoft Says 'War On Terror' is Overblown" came 36 minutes after "Storm Worm Rising."
They say that timing is everything...
Stop the Slashdot effect! Don't read the articles!
I'm no fan of Micro$oft, but I do commend them for stating the obvious -- and very eloquently, at that. This is basically the modern business world take on Benjamin Franklin's quote about how those who would give up liberty for security deserve neither. Specifically, security (from an economic standpoint) is all about cost reduction. Every risk and threat can be expressed as a potential cost. When the costs associated with preventing a risk are higher than the costs of the risks themselves, the cure is worse than the disease.
With all this Security Theater, we've managed to go from having nearly the entire world on our side (9/11/01) to being the neighborhood bully. It's time we started acting more like the great democratic (and free-market) society that we're supposed to be.
Yeah, yeah, I know. -1:Flamebait. But M$ has a good point for once, and they deserve to be praised for it.
Paleotechnologist and connoisseur of pretty shiny things.
Sounds like Microsoft is expecting some flak over their insecure operating systems. Probably related to those millions of Windows systems pwnd by .. somebody, and available for launching attacks.
There's a current worry in the security community that somebody is building up assets of pwnd systems. Somebody is acquiring the capability to do something big. But who, or why, isn't known. The assets being accumulated are more than a spammer needs.
Correct. Which is why it would more useful to spend money on controlling proliferation of nuclear materials instead of making people take their shoes off when getting on airplanes.
...richie - It is a good day to code.
It's legal? Well goody then. It's a good thing our great society has invented this thing called law so we can do away with annoying things like "morality", "ethics" and "values".
I hate printers.
Questions like yours are nearly always the result of bad editing, or a moronic story submitter.
In this case, Microsoft didn't say anything about the war on terror. One Microsoft employee, however, did. That's very, very different from what the headline says.
Comment of the year
Isn't denigrating your own previous products to sell more of the current considered a very poor sales approach?
This is not an official release or opinion from Microsoft, per se. This is the opinion of Steve Riley who, in my opinion, has a tenuous grasp on security to begin with. That the "War on Terror" is overblown: in what sense? That is a pretty broad statement. I do not believe that we will ever see a "Cyber Jihad" because the worst I've ever seen come out of the Salafi Jihadists is flaming posts on message boards. Piss those guys off and they'll type in all-caps then figure out a way to blow themselves up.
Does this mean we ignore software security? Uh, no.
I started questioning Steve Riley's advise when he stated that explaining that ROI == economics in information security. While easily confused by some, economics is quite different than accounting. Now, perhaps I can see the difference because I've been studying the issue with colleagues that have PhD's in economics. Nevertheless, this tells me that he is not an expert in these issues and has not studied them.
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
After reading the description of the SoftGrid technology, I can see why people who have no exposure to basic Linux architecture might think this is new and exciting. Because of how Windows is fundamentally designed, apps need to be run on a desktop. Linux as been able to do this elegantly since VMs started running images of Linux w/ X11. With the client/server model of X, you start a VM, then just run applications in your VM on your local X display.
The endless security measures imposed on society as a result of the "war on terror" have become overblown and intrusive, according to Microsoft Redmond senior security analyst Steve Riley.
I agree with Microsoft on something. Great, just perfect. Now I have to get ready for the 4 horsemen, a rain of fire and the end of time.
On the plus side that means I won't have to mow this week.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Softgrid's been around for at least a couple of years (as Softricity's Softgrid). M$FT acquired the company and is rolling the product into the "Desktop Optimization Pack".
.dll or OS version levels or cannot play nicely with other apps. It is also a great solution for a Citrix environment - apps are deployed quickly and they are not natively installed on the servers.
0 6/07-17SoftricityPR.mspx
We implemented Softgrid in our company a few years ago - works like a charm. It's wonderful for those awful apps that are extremely sensitive to
http://www.microsoft.com/presspass/press/2006/jul
There are competing products (Altiris SVS for example) but Softgrid was our preference.
BTW I have no financial or other connection with any of the companies I've mentioned.
I remember SoftGrid from the first time I saw it... 20 years ago when it was called X Window.
I don't see that under 'Start'.
You are being MICROattacked, from various angles, in a SOFT manner.
Rude dude, The Bungi, points to the employee's complete and utter submission to being fired for taking a photograph that offended His Gateness. He then goes on to call me a "half brain" and other names. Here's what I see in that blog:
I made a mistake This has been pointed out many times, sometimes more politely than others.
People were rude to him for what he did. You might not have a problem with that, but I do.
Microsoft ... decided ... to just cut me loose before I could do any more damage.
Only a person who works for M$ would consider telling the truth to be "damage". You might be OK with the way he was treated, but I think it sucks. I brought up the point to show what happens to people who violate M$'s PR. Your advocacy of such bad behavior only goes to prove what I said is true.
The man seems to have recovered from the vicious smearing he got for his entirely innocent actions. Most people like him and he seems to have gotten back enough self esteem to be critical of M$. It's also a sign that he's no longer afraid of them, so we might imagine he's got himself a nice job away from the asshole's reach.
Friends don't help friends install M$ junk.
While I agree with you in principle, all but the auto accidents could be attributed to "choice". Not necessarily all cases, but a good portion of them could/are. As for smoking...you could make a brand called 'Cancer Sticks', make the package black with a skull and crossbones on them with the warning 'you will die' and people will still buy them.
(Kudos if you recall where I got that from.)
"Now you know, and knowing is half the battle!"
> Name one major terrorist attack, successful or unsuccessful, in the last decade that didn't involve the Religion of Peace.
> It is hard enough to name an attack of any scale that didn't involve someone named after their "Pedophile Prophet".
how about the war against iraq? that was not a religious inspired terrorist attack but solely money, oil and power. and don't give me that freedom, weapons of mass destruction, war against terrorism propaganda bullshit i ain't american so you'd need to come up with something more than fake and wrong reports from the CIA, pentagon or whatever weirdo organization over there smokes pot and invents reasons for war.
They say this now, when there is Vista to buy. It's just part of Microsoft's standard strategy... Release new operating system, try and make the old one look bad.
So in the long view, all of Microsoft's operating systems have sucked blue whale, and Microsoft themselves have said as much.
My other car is a 1984 Nark Avenger.
Now security and functionality can be achieved but make no mistake, security is not convenient, always has, and always will take a lot of work to maintain both in the physical world and in the electronic one. [several false analogies follow]
Like liberty, security is always easier than the alternative. A free and secure system works for me rather than the other way around.
With software, however, it's the programmer that has to put forth the effort, not the user and these don't have to turn up in the interface. When programmers share that effort, like they do with free software, the individual's work load is greatly reduced. It takes me less effort to use a nice free browser on a free system than it does for me to repair an insecure non free system because it's browser has gaping problems.
The kind of "security" M$ has to offer is little more than inconvenience designed to make the user think everything is their fault.
Friends don't help friends install M$ junk.
If someone comes into a country with the intent of murdering large numbers of its citizens, they should really expect to be well treated. Yeah.
Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS. Think Virtual PC or VMware, but instead of virtualising an OS, just a single application is virtualised.
Back in January I was at a VMWare User Conference and the main speaker talked about how VMWare was working with Oracle and other software vendors to do this very thing. Their take was to have a VMWare server running enterprise apps without the guest OS, which would speed up the host by not having the OS overhead. I gather that the apps have very basic drivers to handle video, network and such (if needed) with not much else, and because they will run on VMWare the drivers will be a minimal standard. I haven't seen anything official about this yet but I gather it is on it's way.
From the little I read, it reads as though they took Solaris's container idea and monkeyed with Windows until it worked as close to it as possible.
Who is general failure, and why is he reading my hard drive?
The great Dr. Yamulka of Kazhakstan Ministry of Health has concluded that women have-a the brain the size of-a squirrel brain. (paraphrased from Borat, don't downmod me for being sexist)
in other words...
wha???
Insert offensive troll-style sig here. Please mod or respond appropriately.
If anyone would know about "overblown and intrusive security measures", it would be Microsoft... Activation and WGA anybody?
"Run As" is no solution at all. It is the Windows version of sudo, which is fine for things that SHOULD REQUIRE admin access.
But why should I require admin access to change file associations? Or to install a print driver?
"Run As" is just a crutch around poor design.
Except, the immigrants of old, did not come to your country, and want to out and out destroy it and replace it with a theocracy.
Nah, you had to look at home grown movements for that sort of thing. Violent theocratic movements have long been a part of the American political landscape. Some were born that way like the modern Dominionist movement, and others were made that way through persecution like the LDS church's early days.
For the most part, though, it's worth mentioning that a desire to tear down American and replace it with a theocracy is extremely rare in immigrants and is no justification for actions taken against the immigrant population as a whole.
They also pretty much immigrated legally...
In those days, immigration was pretty much trivial. You got on a boat, and you did some paperwork when you got off. Immigration control didn't really start until after the Civil War (mostly as a means of protecting US workers' jobs from people who were willing to work for less). The Federal Government didn't really get deeply involved until 1891. Quotas didn't really start until after WWI to stop the flood of European refugees.
Back before that, anti-immigration sentiment was primarily expressed through discriminatory laws once you got here. Turning people away is a pretty recent thing in US history.
So, let's compare apples to apples here. Immigrants trying to imigrate today face legal barriers that their predecessors did not. Saying that they all immigrated legally is like saying that no one broke highway speed limits back in the early 19th century when there weren't cars.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
Now, you may not do this personally, or you may just not admit to it, but 99% of the people I have talked to that say this kind of thing love to gloat when our own spies and such get caught and punished in other countries. Just a bit of a double standard.
That being said, things like treason and espionage have pretty much been illegal and often punishable by death with good reason from the dawn of government.
I don't agree with the super paranoia and "islamofacist" talk that has been going on lately, but that does not change the fact that there are sick and twisted people that come here, or even started here, with the intent of causing harm to us. Just to remove the typical cry of racism or whatever about our latest favorite enemy, lets talk about a different one. I think you will have a hard time finding anyone that would not have wished someone put a chunk of high velocity metal into ol Timmy McVeighs face before he was able to detonate his bomb.
The only change I can believe in is what I find in my couch cushions.
This particular section of Steve's presentation dealing with the War On Terror doesn't appear on the US-developed Tech.Ed DVDs -- it was censored and removed.
Why? We need an open discussion and censoring based on policy only illustrates an agenda that creates more questions.
The only reason XP seems passable, in terms of security, is because the bar is set so low. In general, modern operating system security is absolutely terrible. In fact, the concept of computer security barely even exists outside dedicated server systems. We accept it is both because we have become used to this state of affairs, and because good security is extremely difficult for a layperson to judge. If Microsoft says something is secure, how is the general public to know any different?
For instance, if a user executes an email attachment purporting to be a screensaver, we expect the operating system to be compromised. Why? Anything claiming to be screensaver should not be allowed to do anything but draw pictures on the screen. Goatse should be the worst it's capable of. And yet we live in a world where running a screensaver can root your machine, log your keys and mouse movements, and hand your bank account details to any script kiddie with two braincells. That's not just bad: it's absolutely god-awful.
There are no terrorists in the United States of America. They are not actively attempting to blow anything up in this country. How do I know?
1. Hurricane Katrina:
During the aftermath of Hurricane Katrina ALL of our resources were tied up. National Guard, Coast Guard, fire and rescue from all over the country. EVERYONE was dealing with that. If there was EVER a time that we were vulnerable to terrorist attacks, that was it.
2. Terrorism is Easy:
Groups of 3-4 people dropping pipe bombs in mall trashcans around the country would strike more terror into the average citizens heart than 9/11 did. The idea that *I* personally might die if I go to the mall would affect me much more than the idea that if I had been standing 1000 miles away from where I live I would be dead.
3. No suicide bombers:
Every other country plagued by radical islamic terrorists sees a suicide bomber EVERY SINGLE DAY. We have yet to see even one. I know for a fact that it isn't THAT hard to get enough explosives to blow yourself and a small cafe to smithereens.
So, no terrorists. If you want to worry about someone worry about the fascist leaning elements in our own government.
Check out JoshJitsu.info for Brazilian Ji
I wonder why nobody else has ever thought of virtualization for only one process. That is an amazing idea. Do programs exist that can do this yet? In Linux? I hate to admit it, but Microsoft has a wonderful idea there.
Suspect still at large.
has anyone seen sandboxie ?
It is sort of virtualization of individual applications.
WGA is pretty overblown and intrusive guess he missed that. Seriously I have been using MS stuff since 1991 and I am so done with there lame asses. They used to be customer focused when they were fighting big bad blue. Now they are far worse than big blue was. Total loss of customer focus. Trying to lock customers into bad license subscription deals. Treating all their customers as potential criminals EVERYTIME you download something from them. Vista promised a lot delivered little and is only incrementally better than XP. Basically a company that is so overgrown and bureaucratic that it takes a group of some 43 http://moishelettvin.blogspot.com/2006/11/windows- shutdown-crapfest.html people working together to munge the shutdown submenu on Vista. lame lame lame Screw Microsoft from an MCSE going back to NT 4.
What is your source for this comment?
"Here in the US, in *most* (but not all) places, homosexuality is illegal. It's a technical matter that no one is ever prosecuted on, of course, but that doesn't make it legal -- there are sodomy laws all over the books here."
Because, despite the fact that you claim it as so, it is not so.
Those laws that you think make being homosexual illegal were declared unconstitutional. Four years ago.
http://www.cnn.com/2003/LAW/06/26/scotus.sodomy/
The rest of your post is just as ignorant, but the part about honor killing was especially grievous. Simply put, you don't know what the fuck you're talking about.
http://en.wikipedia.org/wiki/Honor_killings
A woman can be killed because she was raped, and in allowing herself to be raped, dishonored the family. It takes a a special kind of ignorant to equate that with capital punishment in the US.
I only go to buffets for the unlimited soft serve.
If someone comes into a country and is falsely accused of having the intent of murdering large numbers of its citizens, they should really expect to have due process. You act like we can read peoples minds, and we never make mistakes.
Give me Classic Slashdot or give me death!
http://www.mhall119.com
Seconded, SVS is excellent. It enables you to cleanly uninstall anything it manages since it tracks where everything goes, to switch off apps as if they were never installed and to use applications which aren't compatible together easily (switch one off, turn on the other and reverse at will).
The download page says "120 days evaluation" but when you install it asks if it is for personal use and offers a free license.
I wouldn't install anything on XP anymore without it. I wonder how it works on Vista.
Slashdot anagrams to "Sad Sloth"
If you read me original post, I was talking about German spies in Britain during WW II. Those spies that were shot were executed after being convicted at a regular jury trial (held in secret, but still better than a military kangaroo court like the USA is trying to hold at Guantanamo).
And a lot of spies were given the option to turn their allegiance against the Germans and avoid trial entirely. Google "double cross system" for more info on that.
-b.
"Microsoft also showed a very interesting new desktop virtualisation technology called SoftGrid, which allows applications to be virtualised individually, rather than a whole OS."
redhat has already been doing this with xen so this is nothing new or anything they invented.
but of course we all know that if apple or microsoft didn't invent it it never existed before.
There are actually designs that allow for running untrusted code in the same address space as everything else, even ring 0.
I believe they are old designs, but I would like to see a new implementation. I bet it'd be a lot faster than a modern OS.
But I do agree with you -- the modern operating system does virtualize, and it does so efficiently. I'd much rather stick with that than have a whole architecture emulated just to make absolutely sure an app doesn't do anything bad -- the only time I see a need for that is things like DOSbox, for apps which assumed they had the whole architecture to themselves.
Don't thank God, thank a doctor!
http://en.wikipedia.org/wiki/Files_transferrer_ove r_shell_protocol
It's easy to drag and drop stuff within a domain in Windows. But how easy is it to do it across domains?
I didn't think the house band in Hell would play this badly.
"In the United States roughly three times as many people are killed in gun accidents per year than at Pearl Harbor."
There, fixed it for you. The attack at Pearl Harbor has a lot of similarities to the 9/11 attack including the fact that there were other greater causes of death at the time it occurred.
I agree that there is no comparison between the Nazis and the current threat. What are a few million Nazis compared to the 100s of millions of Muslim extremists that either participate in terrorism or condone its use. At least a majority the German people were ashamed to find out what their former leaders were capable of and then renounced that behavior.
Name one right or liberty you had in the past that you no longer have. You can't, because your liberty has not been diminished one bit. It is all just rumor and hearsay and a claim on something that was never yours in the first place. Try to find annonymity or privacy in the constitution or bill of rights. Try to find a right to sedition.
It's a shame that you have to wait in line at the airport. Get over it.
The answer for me, as an average American is: On September 10th I wasn't afraid of my government.
Oh, so it is with XP that MS let us down?
Thank god for Vista then!
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
Softgrid is hardly "new" and it's something Microsoft bought. I've seen it and used it on Citrix. Basically it maske program packages so you can run multiple versions for example of a application at the same time and deploy them easily.
;)
If Windows was any good, without that stupid registry and dll-files Softgrid would be unessasary. If you would just put an application in one place and run it from there, it would be unesseary to vitulize the applications.
One funny thing, you can virtualize Firefox and run multiple versions of it, but you can't virtulize IE because it's tied to hard into the OS... so Microsoft can still learn some things about writing good Windows programs from the opensource community
I think Windows 2000 SP4 is even better. Not bloated, no DRM, fast, low requirements in today's systems, stable, etc.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
Sigh, either you missed the point or I was not clear enough. Choice for one's self. I choose to eat that burger with enough grease to give me a heart attack, I choose to smoke even though it gives me cancer, those are personal choices against oneself, not against others. That was my point. The only moral reason to prevent others actions is if they impact someone besides themselves. All law and all moral systems are built around that simple premise. (Though ironically suicide is illegal in the US, still not too sure about that one.) The reason we interfere abroad is because whether you like it or not what happens elsewhere can have very real consequences here. While it's very easy to point fingers and tout conspiracy theories and over-simplify complex ideas, it is very hard to accurately predict the outcome of every global action, thus it is a good idea to try and stack the odds in your favor when possible.
"Now you know, and knowing is half the battle!"
Some of it goes to pay for real scientific research that's not pork. I like that too.
Some of it goes to pay for those folks who'll come by and put your house out if it catches on fire (at least around here). But the reality is that all you are all really saying is that you think better and smarter than everyone else. Maybe you do. Not than everyone else -- most of America agrees with me, according to polls. The current administration is in place precisely because the average American doesn't want to be treated like they are dumb. So stupid people are more electable because they make the average American feel smart?
Homicides and suicides (and 'legal interventions,' the polite term for police shootings) are not "accidental."
(Not sure if I'm misunderstanding your post though, in terms of who you're agreeing or disagreeing with.)
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
Dear Nannystate,
Please ban the sale and manufacture of foods larger than 1 centimeter in size. We could die!
Thanks,
The United Sheep of America
P.S.: This is urgent!! People are dying as we discuss this!
Buckle your ROFL belt, we're in for some LOLs.
He was whining about the Symantec report showing that Vista's network stack had been vulnerable to classes of attacks that older TCP/IP stacks had long been fixed against. Afterward, I asked him why that sort of disclosure was so horribly irresponsible as he had asserted in his presentation. His reply was to ask me if I had kids? WTF? Basically he was trying to illustrate that it hurt Microsoft's feelings, and that ripping on Vista's early lackluster security was tantamount to insulting his children. Uh huh.
Overall, I wasn't that impressed by Steve Riley. He'd be a good gospel preacher. He's very charismatic. Unfortunately, I just wasn't impressed by the religion he was selling. Then again I tend to be more impressed by security scientists rather than security evangelists.
. Penguins Surely Ca
In other words, Microsoft realise that an overall hightened security effort will also result in much higher demands on IT security. Especially in governmental situations. If anyone is really serious about security they wont use a system so plagued by virus, trojans and security issues no matter what security rating it has on paper. IRL it just has to be secure and not just in the latest sales material. I highly suspect Microsoft would be turned down much more often if security gets a higher significance.
HTTP/1.1 400
Is tin foil on sale at the Dollar Store?
Scruting the inscrutable for over 50 years.
On the flip-side, Microsoft is hardly an expert on security and the last thing they need is for customers to require it. It would totally devastate their market.
So although both sides make good points, neither side can afford to let people weigh them.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
"Microsoft continues to go to the bank on the basis of "You CAN fool MOST of the people ALL of the time."
How much longer will this formula work for them?"
Answer: Forever. Refer to tobacco, drugs, alcohol, religion and the 9/11 Truther Movement.
Shouldn't you be in high school class right now?
Come back when you learn English, kid.
I am unfortunately quite sure that the US government has ENABLED itself to throw dissenters in prison.
Whether it throws them all in prison depends on how much prison space the USA can afford to rent from the "Coalition Of The Willing" around the world.
Then you have no eyes. Or, possibly, a much larger organ normally situated directly behind them.
Rich And Stupid is not so bad as Working For Rich And Stupid.
Insecurity Is Better Than NO Security ... Maybe...
'Nuff Said.
>>Release new operating system, try and make the old one look bad.
Not a lot of work involved there.
Well, not with the second part anyway. First part took them quite a few years, IIRC.
I stole this sig from someone cleverer than me.
Can't believe that anyone would be stupid enough to equate female circumcision to male circumcision.
Do you even know what function the clit fulfills?
Okay okay, I'm on slashdot, so most people probably don't have hands on experience. Those that do are probably female.
Without the clit, it's going to be real hard for a woman to reach orgasm. The worst side effect to male circumcision is that it makes your schlong more long.
You are welcome on my lawn.
Microsoft Windows has had critical problems from the start with the way applications are forced to work in a single flat namespace, making it unreasonably difficult to install multiple instances of an application on a single computer. That's what's really been driving virtualization... most of the problems virtualization solves have much simpler and more efficient solutions on UNIX... or virtually any other serious operating system.
Most of them are based simply on taking advantage of the hierarchical file system and the process hierarchy.
All a well behaved UNIX application needs to run isolated from its incompatible brothers is to inherit an environment from its parent that tells it where to find its configuration parameters and files. This can be as simple as running out of a particular directory or using an environment variable, or as complex as a "chroot" environment.
This has been standard in UNIX since it was created, and Microsoft knew about it... they had the most popular UNIX variant in the world in the early '80s, before they followed apple down the cul-de-sac by designing an OS around the GUI instead of making that simply another resource that the OS manages. Now, they're coming up with an inefficient solution that will let some small portion of their users get a fraction of the capabilities they would have had if they'd stuck with Xenix as their premier OS.
The hardest thing to do as an unprivileged user is to change your monitor power settings. The effects of this setting is VERY visible to the user, and very annoying if it is not set correctly. It gets more annoying when you can't change the settings, because you don't have high enough privileges.
So, you log out, and then login as an administrator, make the change to the power settings, log off and then log back in as your unprivileged user only to find out that the changes that you just made as an administrator only affect the administrator's user profile.
Sigh.
OK, Logout, login as administrator, grant your unprivileged user rights so he can change the power settings, logout, login as your new super user, change the power settings, remove the privileges so you are an unprivileged user again, log out, and then login as the unprivileged user once again.
Thankfully, there are ways to deal with this.
"Can't believe that anyone would be stupid enough to equate female circumcision to male circumcision."
That's nothing, I can't believe anyone would be stupid enough to endorse elective surgery on an infant's genitalia at all.
"The worst side effect to male circumcision is that..." the surgery goes bad and you lose your penis.
Frankly, sir, you're an idiot.
I only go to buffets for the unlimited soft serve.
Being a realist, I'm am perfectly willing to admit the many failings of America and the ways in which the U.S. could learn from the folks across the pond. But this is one case where both historically and currently we do a much better job than Europe.
We have had waves and waves of immigration that have changed our demographics entirely. While at first they try to isolate themselves in their own communities, and are largely ostracized by those already living in the country, it doesn't take very long for them to become largely assimilated. In a large part because of our attitude which is open to immigrants. We see our country as a land of opportunity and someone coming here to live is as much a vindication of that promise as it is a threat.
The result? While there are cases of poorly-integrated immigrants, and non-immigrants (or rather non-1st-generation immigrants) who hate the people coming over, to a large degree they are accepted, and by virtue of that acceptance the immigrants come to see this country as their home.
Quick: Give the name, nationality, and ostensible religion of the last even modestly successful domestic terrorist. Times up, it's Timothy McVeigh, U.S., and Roman Catholic.
The ones most likely to conduct what we might call "terrorism" or just hate-based extremist violence are the anti-immigrant racist groups and fringe militias which often amount to the same thing.
Europe, on the other hand, seems to take a harsher attitude towards their immigrants and keeping them distinct from "natives". France in particular seems to go out of their way to make sure that all the Muslim immigrants are aware that they Are Not French. And gee, the Muslim immigrants go "You're right, fuck France".
Immigration is not the problem. Intolerance is the problem. And just like with any such situation, it's when the native majority is intolerant of the immigrant minority that the big problems arise.
With immigration, we have too much of a good thing. Immigration is good, but only when it is limited to people who actually want to **abandon** their old culture in favor of the new one. Multiculturalism is bullshit. If you like the way it was done back home, then stay there.
It would be a fun exercise to try to list every cultural influence from immigrant populations in just the last couple hundred years that is now considered to be a normal part of American culture, but we've both got better things to do. Suffice to say that multiculturalism is the parent of new culture, and is how American culture became what it is today.
Immigration isn't good when the immigrant abandons their old culture. Immigration is good when the immigrants adapt their culture to the native one, which requires that the native culture be tolerant of the immigrant's culture. When they feel accepted, they will accept us, and end up becoming one of us.
Placing a great divide between us and them and saying "you are not welcome unless you leap this divide and abandon all you knew" is a great way to end up with France-like situations.
The enemies of Democracy are
I took a look at the most recent US NIH annual, curious as to just *how many* 9/11s worth of people had died in the past 6 years of preventable cardiopulmonary disease, respiratory disorders from smoking, type II diabetes... I forget the exact numbers, but it was just astounding. The numbers themselves, certainly, but the *proportion* to which my country is expending massive resources dealing with an amazingly minor threat, versus what they could be doing with those billions... It boggles the mind. Many times.
Your mind is clear / The things that you fear / Will fade with how much you / Believe what you hear
Didn't OS/2 do that way back when?
Virtual machines per application?
So next they will want to save RAM and speed things up with pass-thru hooks like what is already done with the virtual network interfaces but taken to the next level... It seems like a bad progression towards an actually working OS... How about we get the OS to WORK with the memory protection and better manage abstracted hardware??
Am I the only one who sees virtual machines as a solution to problems that mostly shouldn't exist or at least not to the severity that one would seriously consider that a solution?
Democracy Now! - uncensored, anti-establishment news
Steve's an interesting guy to listen to.
Worth the time to sit and listen to him.
"Consider how lucky you are that life has been good to you so far. Alternatively, if life hasn't been good to you so far
Deciding that you have an unbelievably safe system based on lack of challenge and an arbitrarily defined scale is...stupid.
You don't even understand what we're talking about when we say "Administrator." Yes, we're all aware that there's a (semi-)hidden account called "Administrator." No, that's not what we're talking about.
The obvious issue here is that this test is not "multiplatform" in the way you think it is. A score on your system is as comparable to a Linux system as the SAT is to the ACT. For crying out loud, there's even a MySQL benchmark; it's not even an OS.
http://it.slashdot.org/comments.pl?sid=243071&cidLet's take a poke at the reply: Which is what I said. It seems you have either ignored the post and are calling it BS (why not reply to it? I am fairly CERTAIN [why did you capitalize this word?] you did but did NOT like your total inability to come up with an answer because you were proven WRONG).
By the way, I noticed that, for the first two items, you passed 0/1 major service pack and hotfix requirements and passed 1/1 minor ones, earning you a score of 12.5/25.
And finally, it failed to run on my system. After pointing it to the location of my java.exe, it gave a NoClassDefFoundError. Besides, I'm running XP Home. http://members.cisecurity.org/kb/article.php?id=01 3
Maurice Wilkes, debugging, 1949
Microsoft cannot reasonably presue individual end users for license fees by legal means. They have preferred to profit from bulk licensing and latterly patent cross-licensing. Collecting money from end users is expensive: a technological solution is preferable to legislation (which at best can only secure revenue within national boundaries).
Microsoft needs a way of delivering its products to end users in a way that guarantees them revenue; the best way is to own the software but an EULA doesn't provide enough guarantee and forced upgrading is expensive. They need a self-contained (so as to avoid lawsuits) way of delivering their software to multiple platforms: people won't just run them on PC's.
Microsoft will sell some of these devices, will have licensing/cross-licensing deals with the manufacturers of others. Even if they run Linux.
The rest of the world had been bloody terrified of your government since the end of 2000. It was only a matter of time before Bush found a pretext to go on the warpath; if it hadn't been the terrorist thing, it would have been something else. Some diplomatic affront, some no-fly-zone violation, some extremely dubious intelligence about yellowcake, anything to provide the casus belli for the Middle Eastern campaign he and his cronies had been planning from the start.
Real Daleks don't climb stairs - they level the building.
> Yeah, because that had nothing to do with the Shah being a despot who tortured
> and killed political dissidents.
No argument the Shah was a real piece of work by our standards but probably above average for the region. History will eventually decide whether Cold War "Realpolitik" justified propping him up. It was a different age. But before stamping 'villian' on him now consider this:
There is a substantial 'pro-western' minority in Iran almost three decades after the Shah fell and the mad mullahs took over anything 'western', dress culture, ideas, etc. Have you considered the possibility that those folks learned of us and were exposed to our ways under the Shah's rule? Exposed hard enough that after all these years the imprint hasn't wore off?
But more to today's discussion the fall of the Shah gave the Islamic Radicals their first nation state and the ability to put Sharia back into practice. All the other countries in the region were either Soviet client states who were more prone to Bathist (Islamic Socialism, an oxymoron) systems or just pure dictatorships. Our client states tended towards pure dictators, but our puppets at least paid lip service to human rights and some like the Shah actually encouraged things like women's rights and education, including sending large numbers of his subjects here for a western style education. Now you get to make the argument you seem to be implying that the Mad Mullahs were an improvement.
> Firstly, quoting Ann Coulter, let alone saying she is right, kills almost any chance you had
> of being taken seriously as an intellectual.
Reading is Fundamental people, and just learning the words isn't enough, ya have to move on to reading comprehension.
Try rereading what I actually said. I'm saying Ms. Coulter's rather extreme solution would WORK. And even worse that if we got hit really bad a couple more times we might get panicked/angry enough to actually do it. But it should have been pretty clear from this line right before that I didn't think it would be a very good idea long term:
> We had better face it head on and find a better way of dealing with it than the default answer
> we will end up being left with if we don't.
If a critical mass say "screw it, it's them or us and it ain't going to be us" we will do something mega violent. And yes we COULD do it and it would WORK. And the side effects would set up yet another problem a generation later. So we need to be find a better answer. Not sure what it is, not even sure there IS a better one, only that we really need to be working on the problem NOW instead of waiting until we run out of time to do anything other than be driven by events.
The problem is Islam is stuck in the dark ages. Christanity evolved (fundies would say became corrupted and debased but screw em) during the enlightenment because it had to, thus it became compatible with the key ideas underlying modern civilization. Islam didn't have that advantage. And as it exists today it is totally incompatible with our civilization. The radicals AREN'T the ones misinterpreting Islam. Their book has all the nasty bits in it that ours does, maybe more, we just choose to ignore the incompatible bits and they don't. So we are faced with four choices:
1. Surrender, Adopt Islam and Sharia law. Over my cold dead body.
2. Invade their countries, kill their leaders and convert them to Christianity. Seriously. Trying to yank em all the way to harmless Godless European Socialists probably wouldn't be possible. But just switching em to a different holy book probably would be given a willingness to use over the top mega violence. (That would probably destroy our civilization in the end, unintended consequences.....)
3. If you didn't like #2 you really won't like this one. Kill em all and let God/Allah sort em out. End the threat by ending Islam. Practice of Islam punishable by death. Anyone suspected required to publicly curse the name of Allah
Democrat delenda est
One interesting thing is that I can virtualize IE, thanks to IEs4Linux. Downside: IE7 isn't actually run; they use IE6 with the IE7 rendering engine. Upside: You get four separate versions of IE on the same machine -- you can probably even run them simultaneously.
By the way: You don't need virtualization to run apps off the network. You just need a fileserver and an app which doesn't insist on being installed on a physical hard drive. (For example, Steam will refuse to run if you attempt to install it on a network drive.)
Don't thank God, thank a doctor!
If your goal is to virtualize all apps, and you can get all of them to work on Wine, then you can just run Linux on the desktop, save some money on Windows licenses.
And yes, you can probably coax Wine to run on Windows via Cygwin or something, but that would be pretty slow and pretty ugly. You might even get it to work with the Windows port of the Linux kernel, if that even exists anymore -- or by compiling UserModeLinux for Cygwin -- but that would be even uglier and slower.
Don't thank God, thank a doctor!
Haven't seen this mentioned in the discussion yet, but we've been playing around with / testing softgrid in the lab, and it's kinda just the same as publishing applications through citrix...
...I see what you did there.
Informatus Technologicus
Muslims have jobs, families, hobbies, STUFF TO DO. Like everybody else.
How about you just assume that your run-of-the-mill Abdullah is outraged and shocked by anything that shocks your run-of-the-mill john doe?
I don't feel guilty anytime a white person kills children and I feel no need to write letters to the editor condemning their actions or going out in the streets chanting "STOP KILLING THE CHILDREN!".
You have to stop thinking of muslims as some sort of borg collective that has decided to remain quiet about the actions of a statistically insignificant amount of crazies.
By your standards, the U.S citizens that elected, re-elected this U.S administration and have not, after almost 5 years, stopped the war in Iraq are even more guilty (count the deaths of muslims and those of americans, guess who wins?) I'm pretty sure that's a classic terrorist argument to justify killing civilians.
Stop judging people so rashly. Stop insulting the billion muslims who condemn terrorism. Kthx.
Either you're trolling or astroturfing, or you're sadly misinformed. I suspect the former:
So, if benchmarks are not everything, then be more specific -- say that your Windows is secured relative to one benchmark to where no one else can beat it. Don't say that we can't beat your security -- that's pure bullshit. If I'm insecure, root me. Go on -- you can start with my mailserver. Shouldn't be too hard to find. If you're smart, you can even jump from there to my desktop -- they're connected via a gigabit crossover cable.
Oh, and get yourself a Slashdot account. Many people don't even bother to reply to Anonymous Cowards.
But let me try to take you seriously for a moment...
You posted a screenshot, which as we all know, should not be accepted as "proof" of anything. Your screenshot is bullshit unless I can get the tool and verify it myself. So try providing a link, at least.
Oh, is this what you were talking about? First, there's no tool for the most popular Linux variant today: Ubuntu. (My desktop is Kubuntu, but that shouldn't be a major obstacle, when you can "upgrade" from one to the other and back.)
But let's suppose I had RedHat or Suse or some such. It's still a huge, annoying hassle to even get to the file -- I'm very skeptical of anything that makes me FILL OUT A SURVEY, not to mention agree to some legalese, before I can even download the file. Included in that legalese is the requirement that I can't redistribute -- doesn't sound particularly open to me.
Once downloaded, I have a big tarball. Unpacking it, I find a jar file and a readme. Which means, the entire tool is proprietary. I'm not sure if it can be run as a normal user, however, I am running Linux partly because I do not trust proprietary software. And now you're asking me to run one from this random website as root?
(I suppose I could setup a separate account to test it under, but I'm too lazy, especially when... but read on.)
Even if I had source code, where's the md5sum? The PHP signature? Where's my guarantee that the file I downloaded actually did originate from this server, and hasn't been modified in transit?
Never mind all that -- the readme file itself admits that the installation of the tool is not secure:
I'm sorry, no. Absolutely not. I will not take a benchmark intended to measure my security when the tool itself is that fucking insecure, and you shouldn't either. Not even on Windows.
However, you're welcome to point me to any tool which attempts penetration testing from the Internet -- in other words, a website where I can click a "hack me" button to test my browser, or to have their server attempt to exploit me over the network. I imagine it would be inconclusive -- it would probably find absolutely nothing to exploit on either of our machines. It might find something wrong with some conscious decisions I've made -- for instance, responding to a ping -- but then it becomes a difference of opinion, rather than "proof" of anything. (Unless we're both wrong, and it's able to root one of us...)
Don't thank God, thank a doctor!
Whoops.
Sorry about that.
Don't thank God, thank a doctor!
While the on-topic point you're making is fine, I'd like to note, slightly off topic, that the giant burger image next to "heart disease" is a little misrepresentative. "Heart disease" is what's usually put down as cause of death if nothing else gets you first and you just "get old and die". There is no cause of death called "old age" - something specific fails, and that's usually your heart, so most people who live long healthy lives and then keel over in their 70s, 80s, or 90s get lumped in under "heart disease". Thus, the heart disease statistics are greatly inflated beyond what you'd see if it only included people dying in their prime due to bad diet, etc.
-Forrest Cameranesi, Geek of all Trades
"I am Sam. Sam I am. I do not like trolls, flames, or spam."
Since 'insight' is kinda related to experience, and since I haven't met anyone who's been to 3027 A.D.... why was this modded 'insightful'? Funny, hell yes, but Insightful? Maybe I should just shut up and let the MetaModerators do their thing.
runas does not help when you want to run software which uses a copy protection scheme which involves loading a driver. Not without a *lot* of gymnastics and deep understanding of the system.
In the free world the media isn't government run; the government is media run.
So why is there talk about trading liberty for security?
The true meaning of the phrase is trading *your* liberty for the security of the *government*.
In the free world the media isn't government run; the government is media run.
Opportunists get mistaken for conspirators by those that think an organisation is omnipotent and not a barely competant seething mass of different agendas pulling in different directions with outright criminals finding their way in through the cracks. All we can do is try to ignore these people or ask them to pay more attantion - circular logic even adds in stuff like people pretending to be incompetant to give us a false sense of security.
OK, if XP is so bad, does he wants us to go back to Windows 2000. Probably not, so this is just another marketing push to get us from XP to Vista. Yep, it all sounds very embracing, and "we are sorry", but funny coincidence that this talk happens at the same time a new version (which brings in new money) is just released. Duh, isn't this normally called product promotion and shouldn't it happen with Leno or Letterman :-) instead of down-under?
Browsers shouldn't have a back button!! It's all about going forward...
This is exactly what makes a moderate a moderate. The fact that they aren't out in the streets chanting or burning effigies. They are ordinary people with ordinary lives, the minute they take a strong public viewpoint (even against extremism) they stop being moderates. The average Muslim wants all their troubles to go away as much as the average westerner, but much like the average westerner the average Muslim does not want to risk their family or livelihood to do it.
I sincerely doubt most Americans would give on cheeseburgers in order to fight "teh evil terrorists(tm)". I sure as hell wouldn't, the trade off just isn't worth it.
Calling someone a "hater" only means you can not rationally rebut their argument.
Does it make a sound?
Send lawyers, guns, and money!
If you get "Allow or Deny" messages when you try to work done, you're probably working incorrectly (outside your userspace).
I run a gemtpp box, hardly anything to do with MS, and if I stray from my userspace, it asks me exactly the same. I can either sudo, or not be allowed access. Nevertheless, once the proper working habits are adopted, routine work rarely requires you do this. All you're doing is bitching about your own incorrect working habits.
When will you clueless idiots stop bashing MS for doing what is pro'lly the best thing they did in Windows in the last decade, which is moving the home user (or, any use that does not have a policy applied to him) from a work-as-root model to work-as-user+sudo model? No, it doesn't make the box bulletproof, much as it doesn't make my gentoo box bulletproof, but it's a darn good thing, even if it's 20 years late. In fact, it's one of the biggest things we were bashing them about for said 20 years.
-
I've been gone for months and the first thing I run into when I load up Slashbork is your usual crap FUD, lies and deficient prose in prosecution of "Micro$haft Windoze".
Not having you around was nice, except your dedazo and Macthorpe sock puppets were still here using identical language. If you really hate "Slashbork" why don't you do something better with your time? Hopefully you will return to the technical limitations of Windoze or Slashdot IP ban that kept you occupied since June.
Friends don't help friends install M$ junk.
I do.
I consider myself a fairly smart guy, but if somebody running for office makes me feel smarter than them, now that is where I have a problem.
We're talking about powerful people here. In the case of the president, we're talking about quite possibly the single most powerful man in the world. I want him to be a fucking genius. I want him to be the smartest man that ever lived. I want to believe that when he decides something, it is because he sat down, listened to equally smart people, considered both sides and chose what he thinks is the best option. Or if all options sucked, and it was feasible to do so, that he actually decided NOT to decide just so he can look busy.
Maybe it's naive to assume that politicians ever have done or ever will do that, but the absolute first thing I look for in any candidate is whether they come off as smart enough to do the job well. I don't want average Americans running the country. I want the best we can churn out. To borrow a line from an episode of West Wing, "before I look for anything, I look for a mind at work."
Being a strong leader is important. Standing by your convictions is important. More important than both, however, is where you are leading and what convictions you are standing by. It's not an absolute rule that more intelligent people will make better decisions, but it's probably better than 50-50 odds, and it's certainly a good starting point.
That other Americans apparently vote for idiots because they make them feel better about themselves is only sad.
The creators of VISTA say that the current state of 'security' is overblown?
I don't know which meter is going to blow up, the irony-o-matic or the oh-shit-we're-fucked-o-tron...
I'm posting from a corporate network with limited credentials. Whether our accounts are set as 'power user' or just 'user' I can't currently tell. However my base account isn't given full privilege over the file system, etc. Limited user a/c as far as I can tell.
/user:(admin account) cmd.exe
/user:(admin account) "c:\program files\internet explorer\iexplore.exe c:"
However, setting up and changing file associations using assoc / ftype is perfectly permissible.
And as others have said, runas is perfectly adequate for you to get access to elevated privileges. For the record, the following may come in handy:
runas
Command prompt shell which will do about 90% of what you want to do, including the ability to spawn processes with admin privilege
runas
Spawns a shell under admin privileges for anything you can't do with command prompt.
F_T
" ... We blew it with Windows 98, but trust us with Windows XP. This is it!!"
Doesn't someone from Microsoft say something like that every time the come out with a new OS? "This is the ultimate!! That stuff we sold you the last time - that's dreck."
Research shows that 67% of those who use the term "research shows", are just making shit up.
A user-mode program should not have write access to binary executables in the first place.
A virus could never propagate via this fashion in a Linux system. Once the original was deleted it would be gone.
Trashing your user account is bad enough. After all, most of the system stuff can be replaced easily, you don't even need to do backups for those - reinstall, update.
The functionality _is_ available in Windows, and many places use it. Not hypothetical at all. I set up my uncle and aunt's notebook PC that way and so far I haven't noticed them complaining that their user account isn't admin. In fact they're asking me to help set up another one for my cousin now.
The thing is, nowadays it makes very little difference in practice - most attackers want zombie machines. You do NOT need root/admin to turn a machine into a zombie.
And that leads us to what bugs me: after so many decades of O/Ses, "Aunt May" running random executables should not automatically cause her to lose that much control over her computer.
It's pathetic that Microsoft spends many years and billions, and all they can produce for "security" is "UAC". And the Linux distros and Apple aren't doing anything much better.
Why should a user have to _predict_ whether a screensaver is really a screensaver? Or some game is really a game? Or some "birthday greeting" is really one? Or some perl script is safe to run?
I'm expecting at least something like _user_friendly_ "security template" system. Applications request a security template and the user decides whether to allow the app to run with that template (popup doesn't appear if it's a default minimal privilege one).
Apple and Microsoft have enough clout to enforce stuff like this.
e.g. "Britney Screensaver requests 'Default Screen Saver Install' privileges to run, Allow Y/N? (checkbox: remember choice)" etc. If the user says yes, the screensaver can only do screensaver stuff. No eavesdropping with the microphone and sending data out over the network, no peeking at your Documents, or browser history/cache/cookies.
It's a lot easier to tell someone to NOT ever run anything that requests "Full System Privileges" (with "danger" red background etc), unless it one of a small list of apps (preferably signed by a trusted party, or a party you have no choice but to trust anyway).
You know it can be done and things can be so much better, but all we get is stuff like UAC aka "Allow Microsoft to blame you for security problems Y/N", or "run make install as root and hope you don't get pwn3d" (like you look through every line of source all the time AND have a good chance of spotting nasties/backdoors).
Forgive my ranting, it's just I'm a bit tired of hearing that one piece of crap is so much better than another piece of crap.
You mean just like the JAVA virtual machine, the one MS hacked Windows to make not work.
.. Hard-code support for these features into Win3.1 and Mac versions of IE, including VB script"
"it becomes clear to me that the Java OS will try to conquer the embedded marketplace from palm pilots over game machines to low-end terminals, while infesting all other computing"
"Instead of beating our heads against the wall trying to produce a portable executable + run-time library solution to compete head-on with Java, we decided to do the following:
davecb5620@gmail.com
"Windows XP was released with no effective firewall software, leaving users exposed in an online world. The situation was eventually remedied with the inclusion of Windows Firewall in XP Service Pack 2. This application in an of itself wasn't considered the best client firewall out there, but it did (and does) effectively stop incoming traffic"
A software filewall is next to useless as it can be disabled by the malware. You need a standalone embedded solution like what comes on the average ADSL router. Blocking outgoing traffic is also considered de rigueur as it prevents the malware from contacting its host, when the machine invariably gets infected with the next virus.
davecb5620@gmail.com
Agreed. In fact I just set the .EXE extension to be associated with Winzip. Let's see what happens.
This was meant to be an object lesson for you.
The point is, it was extremely easy to do, and ip addresses don't prove anything.
Also, from what I remember when I've had mod points, the mods can't check IP addresses at all. Only admins could, theoretically, assuming they're logged. But the admins aren't going to bother with a simple troll like that, meaning the majority of the users who see it may or may not know it was you, depending on how good the troll was.
If you don't want to be impersonated, it's really simple: Register, and no one can impersonate you.
Otherwise, don't complain about the consequences of anonymity.
But go ahead, tell me my IP address, if you can track me so easily. (Actually, you can find out from my email address, but I'm the exception there.)
And your "visual traceroute" won't cover anonymizing proxies. Being registered does not prevent you from using one of those.
Don't thank God, thank a doctor!
They can only be broken out of by root, which is why I won't run this program as root, even chroot'ed.
No, you're just the one who may have faked it. I wouldn't call something so easily faked "proof", would you?
Think back to my impersonation of you. That's proof you're homosexual, right?
Oh wait -- it's not proof of anything. It was faked.
To make it more believable.
Yes, and how goes that spyware I told you to install?
Don't thank God, thank a doctor!
I simply choose not to.
There's no need for more advanced SELinux than the default policy -- I simply don't let things into my computer which don't need to be there.
You also have no idea how iptables works -- and ipchains hasn't been the default since the 2.2 kernel. Come back when you do. (Short story? There's not an easy way to run untrusted software and deny it access to the Internet, without also denying access to the rest of my system. SELinux may allow for this, but SELinux is a much more complex approach that is simply overkill for the vast majority of systems.)
You really do have an ego trip going, don't you?
I know about chroot jails. I've had to deal with them when setting up Postfix, which ends up chrooting and dropping privileges for some twenty or so processes it runs, leaving an absolutely bare minimum running as root -- or even with access to the mail spool.
For that matter, I used to use Gentoo, which is installed via a chroot "jail" -- a very convenient way of doing it, by the way, as it means you can install from any Linux environment, not just Gentoo's own livecds.
Furthermore, I tried a chroot jail. It didn't work, because your tool doesn't like such a minimal environment. (Or hell, maybe it just had a bad hair day -- not my job to debug it, especially if they give no source code.)
The only reason I didn't start with a chroot jail is that it's a hassle to set one up for a program that isn't designed to run that way.
Where'd you state that they were broken, other than right here?
"Programmatic Impersonation" is a Windows technique, and from a quick glance, it looks to be similar to setuid -- and I have no insecure setuid apps, period, much less in that minimal chroot. Privilege escalation is not an exploit, it's a class of exploit -- that's like saying there might have been a buffer overflow, which is true. But I'm not likely to be vulnerable to either at all, much less inside that chroot jail.
I use a sandbox for programs I flatly do NOT trust. "Layered security" makes sense with things like postfix (which I described), but I feel no need to discuss them when they aren't relevant to being able to run your program.
It seems you throw "quotes" around "words" that you don't actually understand, and are just using because they are buzzwords that you read about somewhere.
Tell me, what capabilities did your testing program have when you ran it? Can you tell me what entities you had to trust in order to run it, and what capabilities you had to trust them with?
There are anonymizing proxies in the US. There are also people who surf Slashdot from Tor, using completely random IP addresses. I'm not one of them, but it's certainly possible.
Once again: Do you actually think the admins are getting involved? Do you actually think Zonk or CmdrTaco are going to come to your rescue and prove which post is yours and which isn't?
Don't thank God, thank a doctor!
Once again, you don't know what you're talking about. (ipchains IS packet filtering, and advanced mangling and routing and such. However, no one has used ipchains since the 2.2 kernel, probably five years ago or more -- we use iptables now.)
Also, iptables without something more (probably SELinux) is incapable of blocking based on user or application. It only operates on packets and hosts. So I could block my entire box from accessing the Internet, but it would take a much more complex policy to block a single sandboxed app.
No need. My other post explains why there's no need.
If I start to make a habit of downloading random executables from the Internet and running them with some sort of limited access, then I might put some effort into learning it. But until then, it makes life a lot simpler not having to deal with it.
Wow, you really don't know, do you...
If I remember right, chroot itself can only be called by root. The easy way for root to break out again is by doing things like creating device nodes and directly accessing the hard disk, among other things. But none of these are available to non-root users.
It's apparently not possible, at least within that chroot environment.
Well, I'm concerned about physical security, too. But I live in a small town, so I don't feel the need to have an alarm system.
I also don't own a gun. It's not that I'm opposed to guns, I just don't think I need that amount of security.
Now, if I was in an inner-city neighborhood, then I'd have an entirely different approach. Just as if I was running Windows primarily, and it was a server or some other really juicy target, I'd probably seek out advice like yours -- though maybe from another source -- and implement the tightest security I possibly could.
You weren't willing to try my "test" involving a random piece of spam, so why should I take yours?
I'd like to think that I'm a bit more than that. In fact, I'm not a good graphic artist at all.
Probably not unconfigured. All Ubuntu setups come with default SELinux policies.
So under what restrictions did this test run on your system? I bet it "made you insecure" also.
And you have the nerve to call me dishonest?
I don't think it was a trap at all. I think that, backed into a corner, your only defense is "I lost on purpose!" -- in other words, once I pointed out how insecure chroot alone is (compared to chroot with other forms of security), your only choice was to claim you knew all along, and just wanted to see if I knew.
Don't thank God, thank a doctor!
Yes, because of course I'd know exactly what size a file should be the instant it's created.
You do know date/time stamps can be modified, right? Manually set? You can also modify a file and avoid using these...
Or are you completely clueless?
Or -- don't tell me -- this was another "trap" for me?
Yes, good point. So please tell me where I can find checksums for this app? I can't even find a checksum for the installer.
I know it's hard, but please try to understand the difference between can't and won't.
Don't thank God, thank a doctor!
This one's not worth replying to, because you open with such a blatant misunderstanding. A deliberate one?
I did not know I had any kind of SELinux in place, because I had never installed it, and certainly never checked for it. Now I know it comes by default with Ubuntu.
And that is correct -- I do not want to learn its complexities.
There's no contradiction there. You're just trying to find contradictions to "trap" me and make me look bad, rather than address the actual issues I've brought up.
There's no point in bringing them up again if you're just going to pretend not to understand, or evade them again. For example, the race condition. Some of what you say about race conditions is wrong, some of it's good advice, and none of it addresses the race condition in this particular app.
"Safe" my ass.
Don't thank God, thank a doctor!
Deliberate or not, I'm tired of these mistruths from you:
Yes, I did say that.
No, that was earlier. You're the one who brought up modification times, though they're insufficient. Go ahead and look at the post times on those. Here's the timestamp from the first one you quoted:
And here's the second:
I'm not even looking up the quotes -- by your own admission (you copied and pasted those timestamps into your own post), the second one, which you claim was "later" than the first, is actually earlier by at least three hours.
Don't thank God, thank a doctor!
It does matter when you say "AND LATER THIS", in caps, as if it does matter.
Do you understand what it means to contradict ones self?
I said one thing, which was not true -- it was a mistake, and also quite a ways back in the discussion.
I then discovered that it was not true, and corrected myself. (That's why the second post was later -- between the two posts, I discovered I was wrong.) But rather than you saying I should get modded up for being so honest, this time, you bashed me for contradicting myself. I didn't.
"Evade" is simply not true here. I chose not to take it. Were it a completely bulletproof test, ridiculously easy to take, and verified by God himself that it would not harm my computer, I might still choose not to take it.
But you insisted on a reason, so I gave you some.
It's a bit like saying "Here, have a smoke." If I say "no", that should be enough. If you want reasons, I can say "Because my lung capacity will drop like a rock, because they'll eventually kill me, because it doesn't even taste that good, and because I already get a high from caffeine." But the reasons are irrelevant -- they're just to get you to shut the hell up and go away.
They are not "evasions".
As for malware? I said it could be malware, which you must admit is true -- it is possible -- unless you have analyzed every single byte of its bytecode yourself.
Why should I trust them any more than I trust CIS?
It's a basic concept you seem to be missing -- security starts by assuming no trust at all. You then trust the absolute minimum number of entities that you reasonably can in order to get the job done. You do this because trust is a weakness -- every act of trust, in security, is a potential avenue of attack.
In fact, that's pretty close to the definition of the word "trust" as used in security: The act of "trusting" an entity means I am granting that entity the ability to compromise me in some way.
I've got absolutely no evidence from any entity I trust that it's not.
It may be perfectly reasonable for me to trust the sources you give, but why should I if I don't have to?
I still don't have a single good reason for running your program in the first place, other than to get you to shut up.
In that same link, someone is quoted as saying: "I tried it some weeks ago on 5.3-RC1. It's a good tool to use as a checklist but don't use the score to rank your systems."
As for the "proof", there's even less here than your screenshot -- someone simply posted their score, in plaintext. But let's forget that for a moment...
Once again, you're assuming I refuse to take the test because I'm afraid of getting a bad score. I don't believe the scores it gives are particularly meaningful, except measured against the same system -- as he said, he started at 5.88 and increased his score to 8.0.
THAT is a fair comparison -- assuming the tool measures things that are worth measuring, an 8.0 on BSD is better than a 5.88 on BSD. But that's not an indicator that 8.0 on BSD is better or worse than whatever score you got on Windows.
Kindly giv
Don't thank God, thank a doctor!
Please stop putting words in my mouth.
I said that it could be malware. I don't think it is, and I don't think it isn't. I simply have no reason to believe anything about it, one way or the other.
That's one blatant misconstruction here, so I'm ignoring the rest of your post. You know the drill.
Don't thank God, thank a doctor!
A test that can be defeated more easily than your screenshot. Why did you even mention mtimes, if you knew they could be altered so easily?
Again, you show either a lack of knowledge, a lack of intelligence, or an unwillingness to really examine the matter.
Simply put: time & date, or ANY datestamp, is easily modified, so we cannot use these. Size and checksums (of which crc32 is only one possible checksum) would work, if I knew what size or checksum to start with. But your program does not come with this information about the files it installs, so I have no way of knowing if they were modified while they were world-writable.
It's really too bad... Scanning ahead, I see some interesting points I'd like to counter directly.
But again, here's a lie from you, so this post stops here, until you learn the difference between "felt that it was" and "knew that it might be".
Don't thank God, thank a doctor!
I already did that, simply and plainly, in the grandparent to this.
You keep saying that I "think it's malware" or I "said it's malware", which is not true. I said it could be malware.
If you can't understand that distinction, it's a wonder anyone trusts you with their security.
They are claiming to know something. I am not.
It's not a question of credibility. Anyone can verify that something might be malware through a simple process of logic. It takes trust (blind faith?) to believe that something is not.
Don't thank God, thank a doctor!
You have completely evaded the point I made there, and instead simply copied and pasted your responses.
I will happily address those -- and yes, I can -- AFTER you address your mistake here. It will take more than "No lie @ all".
But hey, you can copy and paste, and so can I:
Learn the difference between "felt that it was" and "knew that it might be". Otherwise, this conversation is over.
Don't thank God, thank a doctor!
Oh noes! I'm weak and lame!
Everywhere I've quoted you, I've quoted either enough to get the spirit of what you said, or enough to demonstrate the fallacy of it.
Or would you rather I copy and paste the entire thing? The "parent" link is available to both of us. (Do you really think anyone else is reading this thread?)
The specific example you cite is not relevant to my chroot jail. There is, in fact, no reason I can think of why I'd give your security tool access to my printer.
Yes, it is theoretically possible that a buffer overflow could be found. It's also possible that a flaw could be found in SELinux itself. Right now, there are no such known vulnerabilities in either SELinux or in the software which was available inside the chroot.
Quote me. I cannot remember saying that.
While you're at it, dig up one example of you showing me something that I did not know before. (SELinux in Ubuntu does not count, I discovered that on my own.)
Yes, I learned something. If you bring it up again, I'm going to simply not reply.
Learning something is a good thing, but from what I've seen in this thread, you're incapable of it.
If I knew every single feature of the software I use, I wouldn't be on Slashdot. I'd be single-handedly writing a new system, because I'd be a fucking genius. I'd be a god.
Here's one for you: Do you know that it's possible to run an NTFS filesystem with journalling disabled? GUESS YOU DON'T KNOW EVERYTHING THERE IS TO KNOW ABOUT WINDOWS!!!
Oh, by the way -- capslock is lame.
You first. Where, specifically, did I say that what you said about race conditions was false?
Yes, I said that. You still haven't addressed it -- and you continue to construe my position as being that this tool is malware, which is not true.
It's a fine point, but a very important one, and it's infuriating that you keep getting it wrong.
So finally, for once, you've gotten it right:
Yes. Emphasis on "might be".
Please look up agnosticism.
Well, let's start with ComputerWorld. They are doing truly fair and balanced reporting. Nowhere in here is a recommendation. Most of those statements aren't even by ComputerWorld, they are quoting someone else -- like, say, the president
Don't thank God, thank a doctor!
Let's not. How about you go answer my other post? Or should I copy and paste that here?
Now I know why you don't want Slashdot tracking you -- people would find out right away just how many of your posts are literally copied and pasted.
Don't thank God, thank a doctor!
Has to be an app which is already allowed to be run as root, yet initiated by a user. In other words, something with the setuid bit set.
I did make pretty certain there wasn't anything in that chroot that didn't have to be there, so basically, your argument is that sudo or su might have a vulnerability in it. The chroot is gone now, so I can't verify it, but I seriously doubt there's anything else there set as setuid root.
I said this because you didn't seem to understand the problem, which was: Unless I completely isolated the app such that it could not write to anywhere that anything else can read (chroot helps here), it's possible for the app to create files that are writable by other users. Your solution, to "chmod", has an obvious race condition in that between the app creating those files and either it or me reading them -- or me chmod'ing them to no longer be world-writable -- they could be modified by something else.
You see, on a multi-user system, race conditions aren't limited to databases or to thread management. They can occur between programs or between users; it can be a flaw in how you access the filesystem itself.
In fact, the default installation method of this program, as far as I can see, is to run as root on the "main" system to be tested, making this even more dangerous -- it now becomes a potential target itself for privilege escalation, and it doesn't necessarily need a buffer overflow.
You suggested checksums, mtimes, etc, and I believe you then crowed about how you knew they existed and I didn't. Yet again, your claims to know more about my system than I do fall short -- I know about checksums. In fact, I asked, very early on, where I could find a checksum for this program, so I know it hasn't been modified since I downloaded it from CIS? (Or even in-transit from CIS, given it's plaintext HTTP anyway.) But I can't even find that, let alone a checksum for the individual files that are unpacked.
Yes.
It doesn't. However, there are not always even analogous areas.
But even if it were completely accurate in the way in which you say, having a high score doesn't necessarily mean you have better security, because of the relative and economic nature of security. In fact, here's another quote from the SANS link you included -- it works now:
And another quote:
Sounds like spyware to me.
Check it back in your original quote. Maybe it's changed now, but when I clicked it there, I got taken to the URL which I pasted into my comment.
Given that it actually supports my position -- that at best, it's a useful tool, but still not a be-all and end-all, and it does send information about my system to a central database -- I can't see why I'd want to deliberately avoid that link. Thanks for posting a good URL this time, then!
You may have admined, but you cannot have been very involved in the security community if you believe that's sufficient, even if
Don't thank God, thank a doctor!
Either you are coming late to this exchange and reading a lot more than I would have, or you are APK, trying to appear more respectable. I'm assuming the former, benefit of the doubt.
First, you used completely jargon-y terms when you first brought it up -- "impersonation" or some other bullshit, which had nothing to do with buffer overflows or privilege escalation.
Second, and more importantly: I don't bring up things that I think are irrelevant, even if I know them.
For example, neither of us has brought up keyloggers. OMG YOU MUST NOT KNOW WHAT A KEYLOGGER IS, U NOOB! Or not.
Buffer overflow exploits are irrelevant to a minimal chroot, because there's so little other executable code that a program in a minimal chroot has access to, all of it highly-audited stuff. That's like saying that there might be a buffer overflow in SeLinux itself -- sure, there might be, but it's insanely unlikely.
You cite an example in which I asked for a specific quote. You quoted what was meant as a taunt...
...and he still hasn't addressed the race condition inherent in that software. It's so simple and obvious that it seemed unlikely he knew what a race condition was. It seems he knows about a few specific varieties of them, but maybe not the one in question.
Yep, sounds like APK.
In at least one of those links, there's a specific reference made to the CIS tool collecting information and sending it back to a central database.
Nowhere in its own readmes or documentation do I see a mention of this.
This is what is generally meant by "spyware" -- it collects personal data (in this case, the state of my system's security) and sends it back to someone else, without my knowledge or consent.
Furthermore, my objection is not that it is malware, although we both now know it's spyware. My objection is that it might be malware, and I don't have sufficient reason to want to trust any additional entity in order to run this software -- even if it meant trusting God Himself.
I can do that by reading about best practices, which would actually help me understand them. CIS provides PDF documents and such for this purpose.
But his purpose was never to help me understand anything, it was only to demand a score -- for what purpose, I don't know. I suspect he'd rather not have the score, because as you can see here, he's built an entire argument around no one being able to beat his score, and that falls apart if anyone can.
I would guess that I am a better man than someone who actively lies. I can point to specific posts if you like. But so far, the only "technical error" is "not knowing about something", when in reality, I simply didn't think it worth mentioning.
You are the only other person to have commented in this thread since the original post -- on which I see perhaps ONE comment by another user -- and the "object lesson" about anonymity.,/p>
But hey, it looks like anonymity helps you here. Here, you can pretend not to be APK. It's actually a lot nicer talking to you, APK or not, because at least here you aren't using "lol" or CAPSLOCK, or copying and pasting your entire argument. You've neatly summed it up, and actually reworded it, which helps.
Don't thank God, thank a doctor!
By "this exchange", I meant this exchange of posts. But hey, looks like you are APK, just didn't feel like signing that one for some reason.
Maybe to see if I'd respond differently to someone else? Kind of a cheap, deceptive tactic there.
Of course, if I really wanted to play dirty, I could point out that there are no good uses of ramdisks anymore (that I can think of) that aren't better served by tmpfs, which is not technically a ramdisk, or necessarily entirely RAM. On bootdisks, unionfs combined with tmpfs is even better. But that would be playing with semantics, and you'd whine about changing the subject, so let's just leave it at that. God forbid you should have to learn anything.
I'm very capable of actually fooling you, and everyone else, with a post like that. It was intended so that anyone who read that post could see that it was an impersonation, and also see my point about why anonymity (in the form of Anonymous Coward) is not a good thing.
You say you started with a score of 6, but suddenly, now you have a score of over 8??? YOU MUST BE LYING!!!
Learning is not evidence of lying. Please stop pretending that it does, and I will stop sarcastically implying that you hate learning.
And how about that test I sent you? Or those meaningful statistics you can't come up with? Are you stalling for time?
You accuse me of "spin" and "playing with words", yet you keep making strawmen about me as your main argument. Most intelligent people on Slashdot would simply ignore you, for that reason alone. I've had it happen to me -- "I was going to make a pointed reply, but I just can't get past the fact that you opened with a strawman." Since then, I've learned better -- but according to you, learning is bad.
Look, saying I might be trolling because of some way I could be acting is asinine, especially when you've got no evidence for it and significant evidence against it. I'm tempted to post a fake image (WITH A NOTE explaining that it's fake) simply to point out that, were I so untrustworthy, I could have ended this discussion days ago.
I wish I could believe you, but the way in which your original copy-and-paste troll is worded is still (fallaciously) claiming that no one has even posted a score, which is not true. I imagine if someone does post a better score, you'll simply ignore it -- it makes your own guide look more compelling that way.
...
Either you don't know what you're talking about, or you're not telling me the whole story.
I don't remember which, but the download from CIS was either a zipfile or a gzipped/bzip2'd tarball. These formats may actually support internal checksums, but there's nothing inherent about an internal checksum which proves nothing was changed in transit, or, indeed, that my entire connection wasn't redirected to somewhere other than CIS.
Don't thank God, thank a doctor!
First, this part is optional for the vast majority of most setups, at least at boot.
And second, it's not a ramdisk anymore. It all revolves around tmpfs.
tmpfs is a virtual memory filesystm. Basically, it expands or contracts in the same way that your filesystem cache would -- it essentially is a filesystem cache, only without the filesystem -- whereas Linux ramdisks actually emulate a physical disk, to some extent, in that they're a fixed size, and need another filesystem on top of them, which is hugely inefficient.
The initrd (initial ramdisk) system -- like I said, optional -- has been replaced with initramfs, which takes an optionally gzipped CPIO archive (loaded in by the bootloader) and unpacks it into a tmpfs filesystem, and uses that as its root filesystem for the first few seconds (or milliseconds) of boot. After it's done with whatever has to happen there -- which includes things like scripts running to set up RAID and such, and maybe even networking if you want to run off a network -- it switches to the real root filesystem, and drops the ramfs.
This gives it much more flexibility than (I think) Windows has, because you can do almost anything in that initial ramfs environment before you access the root filesystem. A very simple example: You could put your kernel, bootloader, and initramfs image on a USB stick and boot from that, then take it out -- enter a passphrase, which is then used to gain access to the hard disk. The ENTIRE hard disk can then be encrypted, and they have to physically get a hold of your USB key and your password in order to crack it. Or, they would have to take your USB key, modify the files on it, and give it back to you without you noticing.
Another example is boot CDs -- you want to keep your boot CD image as small as possible, so the ENTIRE thing, except for the kernel and the bootloader, can be compressed. The kernel and the bootloader are, altogether, less than five megabytes, probably around one or two.
Unionfs is a sort of copy-on-write filesystem, that's used for the install, and for LiveCDs. I'm not sure Windows has anything like it.
Basically, Unionfs takes two filesystems -- one read-only (or it accesses it read-only), one read-write. You then mount those two as the third "union" filesystem. Any reads from that filesystem that aren't satisfied by the read-write filesystem are passed on to the read-only filesysetm.
On a boot CD, this means that any file you don't change is simply read off the CD, and need not consume RAM. However, any file you write to, or even delete, causes some data to be saved in the tmpfs (ram filesystem).
This means that if you have enough RAM, you can, quite literally, do anything to a running boot CD you can do to a live system, short of rebooting. Ubuntu Linux now installs from this environment, but you can, in fact, try it out before installing, or even while it's installing. If you're running low on RAM, you can create swap space -- in fact, if you're doing an install, it will start using swap space as soon as you create it, and I think it will also detect any swap that was already on your system and use that. This is somewhat equivalent to the pagefile on Windows.
A useful example: The livecd I tried most recently did not support wireless cards out of the box. So, when trying to use wireless on a powerbook, I could boot off the CD, plug it in physically, download and install the packages I needed (through the package manager, no less), and pull the firmware out of the OS X partition that was already there. Then I could unplug and walk around, and have wireless internet on a laptop -- AS ITS OS WAS INSTALLED.
Don't thank God, thank a doctor!
I don't know much about the Windows filesystem API, but I know that the UNIX/POSIX API is not rich enough, by itself, to support the kind of filesystem I'd like to write -- or at least, the kind I think should be written. What I'd love to see is a solid transaction API on top of it, instead of all this laziness of calling sync or fsync whenever we need to make sure one thing hits the disk before another, or to implement a pseudo-transaction via tempfiles which can be "rolled back" by deleting said tempfiles.
An API like this would let us do things like... oh... atime updates on flash media, without destroying the media. Or actually delay full transactions, not even allocate the disk space, until memory pressure forces a write -- so people don't need tmpfs or ramdisks for temporary files anymore, as there's a good chance the file will never hit the disk.
But I've got a lot of ideas like this, and right now, I'm sticking to the ones that can get me work.
(A simple example: I think an entire OS could be created without... I think it's called memory segmentation. All programs, even untrusted ones, could share the same address space, technically, yet the system would be secure. If you're interested, we can go off on a tangent about that, but it's not relevant to this discussion, I think -- this discussion is about the security of existing real OSes.)
Don't thank God, thank a doctor!