Does this stop someone from placing a program in their startup?
No. Is ~/.profile writeable by the user?
Does this protect the user from getting spyware? Depends. If it's poorly written spyware, yes.
Does this stop someone from using that computer in a big DDOS bonetnet and UDP/connect() flooding ips?
No. Can non-root listen (above 1024)?
Does this stop someone from using that computer in a big SPAM botnet?
No. Can non-root listen above 1024 and write to 25?
Oh, and please no "iptables will stop it and can't be configured from non-root". Same is true for the Windows firewall, currently for listen, and SP2 for connect.
Since you're people use the domain names to find sites, or send e-mail, there is no visible benefit to keeping the same IP address. The guy sounds like an asshat with a chip on his shoulder.
Or a spammer that is trying further obfuscate his location.
Just because it wasn't used to *send* the spam doesn't mean it wasn't used in spamming.
You can send from compromised hosts with a reply address of the hotmail box, so you can't use "didn't send any e-mail" as a "didn't spam" indicator. Of course, that still doesn't excuse the lack of investigation by hotmail.
Sorry, but it is. Anything intended as a signature is. (Passed sometime during the Clinton administration IIRC. Something with "Digital Signature" in the title)
Calling it a recall is an excellent idea. Convincing MS and stores to handle things that way is something else entirely. Anything that cuts into margin just ain't going to happen.
Re:But why would non-geeks want to run Linux?
on
Linux for Non-Geeks
·
· Score: 0, Redundant
On dialup?
And how does a non-geek buy a computer, hook it up to the net, and download patches without getting compromised, even assuming that they know using AV and Windows Update is a prerequisite? The box will be owned in a matter of seconds.
Buy a new Windows computer and out of the box, it *cannot* be safely hooked up to the Internet to get the patches to make it safe to connect to the Internet. How do you resolve that Catch-22 for a non-geek?
Re:But why would non-geeks want to run Linux?
on
Linux for Non-Geeks
·
· Score: 4, Insightful
Unless one of those tools is a hardware firewall/router, it is an impossible task, especially for the non-geek.
My father is set up with Linux, and doesn't know squat about computers. He has no problems with it whatsoever (well, over and above the same PEBKAC ones that existed with Windows as well). Of course, he doesn't *maintain* that system, I do. He doesn't know what root is or even that it exists.
A HW firewall would have been a more expensive and difficult proposition in his case - dialup. How common are dialup routers (no, I don't mean "do they exist", I mean walk into Best Buy or Comp-USA and get one).
The average time between connection to the ISP and a Blaster hit was 8 seconds. Nimda was 2 and a half minutes. (Times are from a little less than a year ago) How is a non-geek going to protect a Windows system from that?
I wonder how much of the copy protection on software this is going to break. Gamers are probably going to be the loudest yelling demographic when this hits.
Treaties by definition can not be unconstitutional, any more than an amendment can be unconstitutional.
This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.
You need to read other parts of the Constitution as well. It will happen.
This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.
I guess you don't mind if I investigate you for say, Child Molestation then, asking all your neighbors if they've seen any children entering your house because you were thought to be a child molester by the computer?
Personally, I would lean toward having false positives. You can always run the results against other databases and find better/best matches. With some additional fact-checking implementation, I think they could rule out some false positives. It may be horribly inconvenient to be hassled with an investigation, but if people do their jobs (with gov't folks, sometimes that's all you can hope for!) then clearing your name shouldn't be too bad.
So much for Innocent until Proven Guilty.
You're making a huge assumption about "people doing their jobs". Just plain laziness, quotas, as well as simply trying to ruin someone for political reasons will all enter into this.
Slashdot Mirror
Does this stop someone from placing a program in their startup?
No.
Is ~/.profile writeable by the user?
Does this protect the user from getting spyware?
Depends. If it's poorly written spyware, yes.
Does this stop someone from using that computer in a big DDOS bonetnet and UDP/connect() flooding ips?
No.
Can non-root listen (above 1024)?
Does this stop someone from using that computer in a big SPAM botnet?
No.
Can non-root listen above 1024 and write to 25?
Oh, and please no "iptables will stop it and can't be configured from non-root". Same is true for the Windows firewall, currently for listen, and SP2 for connect.
It's not MS making it difficult to not run as root. Granted, they don't make it obvious when you are, which I do lay at their feet.
/etc instead of ~?
Who do you blame when a program writes its per user configuration to
Who do you blame when a program tries to load a kernel module no matter who's running it and fails if it doesn't load?
Who do you blame when someone runs as root?
That person or Linus?
Once done, however, almost any problem with IE becomes a root exploit.
Exploit yes, root exploit, no, not unless the user is running as an Administrator. IE still runs at the privileges of the logged on user.
The flaw in your reasoning is that most software never sees the market. It's all used internally.
Since you're people use the domain names to find sites, or send e-mail, there is no visible benefit to keeping the same IP address. The guy sounds like an asshat with a chip on his shoulder.
Or a spammer that is trying further obfuscate his location.
Just because it wasn't used to *send* the spam doesn't mean it wasn't used in spamming.
You can send from compromised hosts with a reply address of the hotmail box, so you can't use "didn't send any e-mail" as a "didn't spam" indicator. Of course, that still doesn't excuse the lack of investigation by hotmail.
Sorry, but it is. Anything intended as a signature is. (Passed sometime during the Clinton administration IIRC. Something with "Digital Signature" in the title)
What's this "doesn't do anything for security" crap?
It doesn't matter if secure code is exposed.
If it matters, the code isn't secure in the first place.
If you want to prove code that hasn't been changed, you host it yourself and/or provide signatures or hashes for tarballs at other locations.
Except that anything with "moral" in the title tends not to be. I can't think of any exceptions, so why is this one?
Content RBLs have been working fairly well for me
Calling it a recall is an excellent idea. Convincing MS and stores to handle things that way is something else entirely. Anything that cuts into margin just ain't going to happen.
On dialup?
And how does a non-geek buy a computer, hook it up to the net, and download patches without getting compromised, even assuming that they know using AV and Windows Update is a prerequisite? The box will be owned in a matter of seconds.
Buy a new Windows computer and out of the box, it *cannot* be safely hooked up to the Internet to get the patches to make it safe to connect to the Internet. How do you resolve that Catch-22 for a non-geek?
Unless one of those tools is a hardware firewall/router, it is an impossible task, especially for the non-geek.
My father is set up with Linux, and doesn't know squat about computers. He has no problems with it whatsoever (well, over and above the same PEBKAC ones that existed with Windows as well). Of course, he doesn't *maintain* that system, I do. He doesn't know what root is or even that it exists.
A HW firewall would have been a more expensive and difficult proposition in his case - dialup. How common are dialup routers (no, I don't mean "do they exist", I mean walk into Best Buy or Comp-USA and get one).
The average time between connection to the ISP and a Blaster hit was 8 seconds. Nimda was 2 and a half minutes. (Times are from a little less than a year ago) How is a non-geek going to protect a Windows system from that?
I wonder how much of the copy protection on software this is going to break. Gamers are probably going to be the loudest yelling demographic when this hits.
Yes, they do. That's why law enforcement likes getting stuff into treaties when they can't get it passed as a law.
Treaties by definition can not be unconstitutional, any more than an amendment can be unconstitutional.
This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.
You need to read other parts of the Constitution as well. It will happen.
This Constitution, and the Laws of the United States which shall be made in Pursuance thereof; and all Treaties made, or which shall be made, under the Authority of the United States, shall be the supreme Law of the Land; and the Judges in every State shall be bound thereby, any Thing in the Constitution or Laws of any State to the Contrary notwithstanding.
Problem is, we *can*.
The Constitution recognizes treaties as part of the supreme law of the land. It doesn't give a priority to it.
This is why when laws fail to pass or are thrown out, it's done through treaties instead.
Which sounds reasonable.
So why isn't that privacy policy included in the contract? If you read the terms on most e-commerce web sites, it is.
So what is the difference between a promise and an oral contract?
Vampire: Masquerade
Granted, it's dirty java with a bunch of JNI classes.
For a few admins, possibly. For the majority of users? No, it doesn't follow.
I guess you don't mind if I investigate you for say, Child Molestation then, asking all your neighbors if they've seen any children entering your house because you were thought to be a child molester by the computer?
Personally, I would lean toward having false positives. You can always run the results against other databases and find better/best matches. With some additional fact-checking implementation, I think they could rule out some false positives. It may be horribly inconvenient to be hassled with an investigation, but if people do their jobs (with gov't folks, sometimes that's all you can hope for!) then clearing your name shouldn't be too bad.
So much for Innocent until Proven Guilty.
You're making a huge assumption about "people doing their jobs". Just plain laziness, quotas, as well as simply trying to ruin someone for political reasons will all enter into this.