Slashdot Mirror
L0pht Heavy Industries in NY Times Magazine
Billy Joe Bob writes "This Sunday's (10/03/99) New York Times Magazine features an article about L0pht Heavy Industries." Not a bad piece for a mainstream pub - good writeup about the personalities involved, how they work, etc. (free NYT reg. required to read.)
I think it would be preferable for L0pht to post a "Coming Soon..." article which identifies the vendor, product, and the general nature of the exploit, but stops short of providing full details. The complete details of the exploit could be sent to the vendor immediately and then added to the l0pht article after a warning period.
This approach has a few nice effects: First, it gives L0pht full credit for the hack without immediately giving the script kiddies access to it. Second, it gives vendors a fighting chance to get fixes made. Third, it gives (astute) users of the product fair warning about the coming exploit allowing them to contact (pressure) the vendor.
The warehouse brims with more than 200 computers ranging from state-of-the-art Sun and Digital workstations to nostalgia pieces like Commodore 64's and Apple IIe's. Black cables, yellow cables and jumbles of thin rainbow-colored wires drip from the ceiling, all jacked in to steel racks of oscilloscopes, radio transmitters, D.S.L. modems, I.S.D.N. modems, half-opened C.P.U.'s and a 50-foot roof antenna. The warehouse also contains several small-scale dummy computer networks.
Where do they get their financial backing for all of this hardware/service/location? Maybe they get a little advertising money and sell a few shirts, but how about the rest of the money? Does L0pht do paid consulting, or what?
That electicity bill must be through the roof.
-- "Complacency is a far more dangerous attitude than outrage." -Naomi Littlebear
Besides, as the NRA might say if they were a pro-hacker org - "Posted exploits don't hax0r systems, PEOPLE hax0r systems!"
Best new white rapper since Pimp Daddy Welfare... Pimp-T!
I'm glad that they replied "Yes" when asked whether they accepted that their approach had negative consequences as well as positive ones. That was honest and even-handed.
However, an analogy would have served them well. "Yes, our activities can have negative consequences. This is similar to the case of a kitchen knife manufacturer whose products can lead to domestic murder or to excellence in the kitchen. But you don't criminalize such a company for the negative use of its products, nor indeed do you praise it when you enjoy a well-prepared meal. The tool is neutral."
Likewise, a nuclear tipped missile can be used to deflect an Earth-destroying asteroid or to wipe out another country. The tool itself does not determine the morality of the people that use it.
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
'"their only victims are the little people that are customers" -- the people who purchase products like Windows 2000.'
Buying windows is already asking for being a victim.
"The obvious mathematical breakthrough would be development of an easy way to factor large prime numbers." Bill Gates,
If everyone does the same as the NYT and forces registration, we'll all have hundreds or thousands of registrations worldwide before long. The direction in which this is heading is completely untenable.
Somebody mirror the article for us, please, so that we can retain our sanity!
"The question of whether machines can think is no more interesting than [] whether submarines can swim" - Dijkstra
I know they are very big on their neutrality, but some of the attitudes seem irresponsible to me.
"We were trained by the vendors to go public," says Mudge, "to give them a black eye."
This was in relation to the coldfusion 'sploit. Not only did it give the vendors a black eye, but also a lot of customers who use coldfusion for whatever reason. They didn't deserve a black eye for it.
Hypothetical:
An ISP provided Coldfusion hosting for many high profile sites, these all got hacked due to this exploit and the ISP's reputation suffered. They went bust. Could happen. (Maybe it did?)
Surely the responsible action would have been to notify Allaire of the exploit and warn them that they were posting it in a week? This would have given Allaire time to fix it and notify their customers. Allaire's reputation suffers a little & only the lazy / stupid customers are damaged.
From comments later in the article it seems they may be heading in this direction. I hope they do.
stty erase ^H
Almost all websites have some of the "standard" guest accounts. Here is a list I try first before creating another (bogus) account. Please try to create one of these guest accounts if they don't exist yet. That will save all of use al lot of time and frustration:
username - password
test - test
testuser - testuser
test_user - test_user (This one works on the NYT)
test@user.org - test
test@user.org - testuser
cypherpunk - cypherpunk
cyberpunk - cyberpunk
Is 100% chock-full of bullshit.
Maybe he thinks security problems get fixed by pretending they aren't there, but I for one am *very* grateful to Mudge and the rest of the l0pht crew for providing the information I need to convince my clients to stay the hell away from MicroSquish products on systems they want to expose to the net.
EARTH TO MICROSQUISH: SECURITY MATTERS!
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
If so, I bet Jobs spent six months picking the perfect shade of blue.
--
QDMerge 0.21!
how to invest, a novice's guide
"You are performing a valuable service to your country," (Fred) Thompson added, "and we appreciate that and want you to continue."
(Ceck out IMDB if you don't know who Fred Thompson was, although they don't mention that he is now a Senator, go figure)
Anyway, just a quick question. To me, it seems that the Hacker Ethic and Open Source Philosophy end up at the same place. The simple idea that information shared is worth more, intrinsically, than information hidden. Can an *expert* (self-appointed would qualify) show me how the two differ?
+&x
You don't normally find articles that well-written on hacking in the "normal" press, so I'm pleased. The normal NY Times policy would be to have Markoff do a hatchet job.
That said, I think that the computing world needs L0pht, and they need the CDC, for that matter. Hacking should be an above-ground activity, and the information returned should be to help others pursue their knowledge of the systems. L0pht goes out and finds information, then they make it free to all. That's the Right Thing. CDC makes tools to exploit the dumb things vendors do - the tools themselves are not good _or_ evil, but the users may be.
The only negative that sometimes comes from the activities of these groups is the legions of script kiddies racing off to put their k00l d00dz signatures on websites before the holes get plugged. But on the other hand, the script kiddies will be therre regardless, and get in eventually, anyways - it's the Infinite Monkeys Theorem come to life.
- -Josh Turiel
-- Josh Turiel
"2. Do not eat iPod Shuffle."
It's sure hard to audit proprietary crap...
Maybe the hypothetical ISP should have considered this. Most of IBM's internal network runs on free software because security and IGS can sift through the code.
Maybe ISPs are in a competitive enough environment that a bad decision like that is enough to kill one. What do you think?
Remember that what's inside of you doesn't matter because nobody can see it.