Since most enterprises have business partners who come in behind their firewall, host-based firewalls are still important. You can use them to allow specific people on your network specific access to specific resources.
Um.
That's one of the specific situations where client-based firewalls are of limited value. We have a DMZ for our customers, with its own firewall, and connections to customer networks are through VPNs that each have their own DMZ and a separate firewall on our side *and* on their side.
I can't see how a client based firewall, either on their hardware or on hardware they use long term but owned by us, would provide more than homeopathic levels of security. What am I missing?
What services that require network access can't be turned off?
A lot of them, on Windows. Which is why Windows firewalls are critical... because they're not a redundant layer of protection... they're the only layer of protection.
It's a good thing that Windows firewalls are getting better. And a firewall is a useful tool on any system. It's not, however, the kind of critical necessity elsewhere that it is on Windows.
Sometimes you need to provide access to a service on one network adapter and not another, and the software in question doesn't provide for that.
In that case your computer is part of the security boundary between two unequal trust domains, so your computer is a firewall. Multi-homed hosts are a different kind of flying altogether, but that's not the usual context where people go on and on about how great their Windows firewalls are and express astonishment that I don't maintain a client firewall in everyday use.
And I think you forgot the "threat from inside" angle.
A firewall can not prevent attacks from inside its own security boundary. Now I admit that OS X is better off than Windows here, in that you actually need to find a local privilege escalation attack before directly opening a port, but if I were writing a trojan or botnet client for OS X I wouldn't bother with that... I'd use one of the many stealth tunneling techniques that have been developed. IP over DNS is pretty much unstoppable without a proxy firewall, for example.
Some of us like to put our raincoats on before we step outside.
If SCO didn't price their Unix so expensive that no normal person could ever hope to afford it, there would of been no reason to start Linux in the first place...
Um, maybe, maybe not. Linus was using MINIX, which was pretty much free. One reason he developed Linux was because the license for MINIX didn't let him update and improve it except through patches... conceptually, though not genetically, Linux was started as "MINIX Improved".
Now he has said that if BSD had been ready a year earlier there woudln't have been a Linux, but I haven't run into this meme that he would have found SCO an acceptable alternate before.
Re:Why is stealth mode pointed out as special?
on
Tiger's 200 New Features
·
· Score: 3, Insightful
Client firewalls are of limited utility. I don't understand why people bother with them.
If you need to provide access to a service, then you have to open its matching ports anyway. If you need to protect a port/daemon/service/wakilix from attack, just don't run it. The only reason for a firewall is to protect you when you can't turn one off for some reason, and if that's the case then you're probably using Windows.
In fact, Windows XP SP1 with AVG *and* a software firewall ran office and home apps faster on my old C433/256 than Mandrake 9.2 *or* FreeBSD 4.3 with no A/V or firewall.
It's not hard to run Office faster than a platform that doesn't run it at all. You could try and be a LITTLE less obvious when you're trolling, eh?
Luckily, there's absolutely nothing that's actually forcing people to use Windows.
Setting aside the truth or falsehood of that statement... the amazing thing is it doesn't make a skerrick of difference to my point. Whether people are forced or merely "strongly encouraged" to use Windows, the way people have become used to its flaws is astonishing and (for those of us who find ourselves driven by an unfortunate sense of duty or charity into trying to help them) traumatic.
But Windows really does have truly horrific levels of fug (in the Pratchettian sense of 'air so full of toxic waste you can cut it with a knife') in it.
What's worse, though, is the people who think that kind of fug is inevitable and somehow desirable, and don't believe that other systems are less messed up.
I do not understand why setuid scripts are any different than setuid binaries?
You can't change the behaviour of binaries by tweaking environment variables that change the syntax of shell scripts, at least not in the general case.
I just finished reinstalling Windows because it had eaten its little brain.
Install Windows. Reboot. Install VIA 4-in-1 drivers. Reboot. Install Audio drivers. Reboot. Install Ethernet and USB drivers. Reboot. Install video card drivers. Reboot. 1 service pack. Reboot. 42 "security and critical updates". Reboot. 4 post service-pack updates. Reboot. DirectX. Reboot..NET. Reboot. Windows Media Player. Reboot. 7 reboots to bring Norton Antivirus up to date. 2 driver updates for the motherboard. 2 more reboots.
If I'd updated IE instead of using Firefox that would be 2 more reboots because you can't update IE at the same time as other applications.
Gee, where are the flames about "having to update all the time because of bugs"?
Well, I could update to Windows XP with its boobytrapped OS, but I'd rather not have a system decide I'm a pirate because I have to replace the motherboard. And I'd still have to do most of the same updates, so I don't think it's fair to flame about Windows 2000 that much. That's what you were talking about, right?
Seidenberg said private companies like Verizon, which already run data networks, are much better positioned than government agencies to offer high- speed Internet service.
But private telephone companies aren't doing it. Governments and enthusiastic hoppyists are. Private restaurants and bookstores are. Private phone companies are trying to get individuals to pay through the nose by the megabyte for 4G services and selling them data-enabled phones that they can't access their preferred data services from.
I have a Verizon phone. It's more powerful than my PDA, but I can't run any of my own software on it... in fact I can't run ANY software on it, except by paying exorbitant rates to Verizon for "Buy It Now". Verizon has a cash cow in their captive customer base, and they don't just milk it... they bleed it. Is it any wonder people don't see them as the natural providers of high speed data services, services... I note again... they they're not even providing.
"Why in the world would you think your (cell) phone would work in your house?" he said. "The customer has come to expect so much. They want it to work in the elevator; they want it to work in the basement."
You're selling me a telephone, and you tell me it's good enough to replace my landline. Why shouldn't I take you at your word?
AT least your coverage is better than T-Mobile. T-Mobile I had to walk to the other side of my street to get a signal. Hell with "in my house" how about "in my back yard"?
Last year, the California Public Utilities Commission ordered all phone companies to give customers 30 days to test a service without slapping them with hundreds of dollars in early cancellation fees.
A few years ago I had a nice PDA-phone combo. I went to the phone companies that were compatible with it, and tried to get it activated with the pre-paid card they were selling.
Them: "Credit card>" Me: "What for?" Them: "Deposit on the phone." Me: "It's my phone, all I want is an account." Them: "Oh, we provide you a phone." Me: "I don't want a phone, I have a phone. I just want the service." Them: "We still need a deposit in case you cancel early." Me: "A deposit on what? Why shouldn't I be able to cancel at any time, you're not risking anything but a bit of plastic and a number in a database." Them: "Well, if you don't want to give us a credit card, we can take a $200 deposit?" Me: "Deposit on what?" Them: "That's for the set up, the phone's free, you don't need to take it..." Me: "No, that's for the phone, it's not for setup. Setup on my landline phone was only $60 and they tested my wiring, ran a new cable from the pedestal, and installed three phone jacks. I don't believe that it costs you $200 to change one record in a database somewhere and give me fifty cents woth of plastic and silicon."
I didn't get far enough to find out about "early cancellation fees".
Open your books, mister Seidenberg, quit treating your customers as criminals and fools, and then maybe people will quit turning to government because the free enterprise system has failed them... because the cellphone market doesn't resemble anything so much as a parody of a soviet health-care program. Homeopathic levels of service and no accountability...
But given the price tag and the goals of the project, how much can this project actually help education? Has anyone out there in the high school level education field seen digital systems improve the classroom to the point that students actually learn more, or do they just tend to be fascinating distractions that detract from the classroom?
The second question answers the first one. Assuming the study is honest, if the answer to the last question is "the latter" then the study can potentially help education a hell of a lot.
Apple took the approach of separating the zones instead of limiting XMLHttpRequest access from file: URLs.
Note that Konqueror is already separating zones, and also allows file: URLs to use XMLHttpRequest to access local resources.
Stercus stercus stercus moriturus sum.
Microsoft has spent seven years proving conclusively that these kinds of zones are an unworkable approach to security. A web browser has to operate in a mandatory access control environment, and that means that rights once given up must never be granted again except by explicit request from a more trusted object. For example, calling it by "open" from the command line (since you can execute anything from the command line, the command line can be granted full local rights).
Zones don't work. You have to have inherited rights irrevocably discarded, there's no other way to guarantee there's no path from an untrusted object to a trusted one.
Not about the update itself, but what it implies about webcore.
Safari Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9 CVE ID: CAN-2005-0976 Impact: Remote sites could cause html and javascript to run in the local domain. Description: This update closes a vulnerability that allowed remote websites to load javascript to execute in the local domain. Credit to David Remahl for reporting this issue.
"local domain" sounds a lot like Microsoft's "local security zone". I had assumed that Apple would be smarter than Microsoft here, and rather than copying their dangerous idea of treating webpages differently depending on where they were loaded from it would use some irrevocable and inheritable rights control established by the application... and this there would be no code path available to a webpage loaded from Safari to do anything dangerous... no matter where the page was loaded from.
If that's not the case... Apple, before going any further down this path, please reconsider.
Okay, you think that you know so certainly what the furutre of this industry holds because you read a few rumor sites and talked it over with some other ignorant people in a/. forum
Well, that and I've had more than a few dealings with the cellular industry myself. There is no limit to how fucked up they're willing to make a phone if it'll give them a way to make an extra buck per transaction here or there.
To look to the future of the cellphone industry, you only need to look at the present of the cellphone industry.
However any dashboard that doesn't have cocoa or applescript parts will all run in Safari without any alteration (that I know of).
That's one thing I'd like to get more information about, actually. How exactly are they extending webcore and how much have they opened up for Safari. I'm worried that they're copying Microsoft's greatest mistake.
I've lost count of the number of articles, comparisons, and reviews of Longhorn I've come across in the last two years that tout some *advantage* over another OS (usually OS X).
Really? I haven't seen one advantage actually listed. Maybe you can help me figure out what they are supposed to be... I'm pretty much lost at sea here.
A control mechanism for use with a bathtub having a drain opening and an overflow opening, with the drain opening having a stopper moveable between open and closed positions.
Is this a hint? Will we have google bathtubs that automatically grow over time so they never overflow?
Without yellow box, the entire user base would be screwed on their existing investment in software.
Nonsense. They had Blue Box. What became Classic. I used Photoshop under Classic for quite a long time because on my computer it gave me better performance than the "real" Carbonized Photoshop, because Quickdraw bypassed all the double-buffering you got from Quartz.
Blue Box / Classic was a real, functional, effective, and efficient way forward for the short term. I'm sorry that you and other developers didn't believe it. I guess you were so used to the horrid OS that Apple had saddled you with that the idea that you couldn't believe emulation would give you better performance. But... it could, it did, with all the horrible passive-aggressive "cooperative multitasking" drivers gone performance actually improved... whether using SheepShaver under BeOS or Blue Box under Rhapsody.
And Adobe screwed Apple two ways. First, they rejected Yellowbox/Bluebox. Second, they refused to cut them a break on Display Postscript, forcing Apple to start over with Quartz.
Slashdot Mirror
Since most enterprises have business partners who come in behind their firewall, host-based firewalls are still important. You can use them to allow specific people on your network specific access to specific resources.
Um.
That's one of the specific situations where client-based firewalls are of limited value. We have a DMZ for our customers, with its own firewall, and connections to customer networks are through VPNs that each have their own DMZ and a separate firewall on our side *and* on their side.
I can't see how a client based firewall, either on their hardware or on hardware they use long term but owned by us, would provide more than homeopathic levels of security. What am I missing?
Well, yours is an optomistic view. Refreshing :-).
Realistic, not optimistic. Client firewalls are a useful tool, but no more.
My database server has a firewall in place to protect its copy of MySQL. Only my http server can connect on that port,
Sounds like a job for UNIX domain sockets and proper file system permissions.
What services that require network access can't be turned off?
A lot of them, on Windows. Which is why Windows firewalls are critical... because they're not a redundant layer of protection... they're the only layer of protection.
It's a good thing that Windows firewalls are getting better. And a firewall is a useful tool on any system. It's not, however, the kind of critical necessity elsewhere that it is on Windows.
Sometimes you need to provide access to a service on one network adapter and not another, and the software in question doesn't provide for that.
In that case your computer is part of the security boundary between two unequal trust domains, so your computer is a firewall. Multi-homed hosts are a different kind of flying altogether, but that's not the usual context where people go on and on about how great their Windows firewalls are and express astonishment that I don't maintain a client firewall in everyday use.
And I think you forgot the "threat from inside" angle.
A firewall can not prevent attacks from inside its own security boundary. Now I admit that OS X is better off than Windows here, in that you actually need to find a local privilege escalation attack before directly opening a port, but if I were writing a trojan or botnet client for OS X I wouldn't bother with that... I'd use one of the many stealth tunneling techniques that have been developed. IP over DNS is pretty much unstoppable without a proxy firewall, for example.
Some of us like to put our raincoats on before we step outside.
But... in the shower?
If SCO didn't price their Unix so expensive that no normal person could ever hope to afford it, there would of been no reason to start Linux in the first place...
Um, maybe, maybe not. Linus was using MINIX, which was pretty much free. One reason he developed Linux was because the license for MINIX didn't let him update and improve it except through patches... conceptually, though not genetically, Linux was started as "MINIX Improved".
Now he has said that if BSD had been ready a year earlier there woudln't have been a Linux, but I haven't run into this meme that he would have found SCO an acceptable alternate before.
Client firewalls are of limited utility. I don't understand why people bother with them.
If you need to provide access to a service, then you have to open its matching ports anyway. If you need to protect a port/daemon/service/wakilix from attack, just don't run it. The only reason for a firewall is to protect you when you can't turn one off for some reason, and if that's the case then you're probably using Windows.
In fact, Windows XP SP1 with AVG *and* a software firewall ran office and home apps faster on my old C433/256 than Mandrake 9.2 *or* FreeBSD 4.3 with no A/V or firewall.
It's not hard to run Office faster than a platform that doesn't run it at all. You could try and be a LITTLE less obvious when you're trolling, eh?
Luckily, there's absolutely nothing that's actually forcing people to use Windows.
Setting aside the truth or falsehood of that statement... the amazing thing is it doesn't make a skerrick of difference to my point. Whether people are forced or merely "strongly encouraged" to use Windows, the way people have become used to its flaws is astonishing and (for those of us who find ourselves driven by an unfortunate sense of duty or charity into trying to help them) traumatic.
But Windows really does have truly horrific levels of fug (in the Pratchettian sense of 'air so full of toxic waste you can cut it with a knife') in it.
What's worse, though, is the people who think that kind of fug is inevitable and somehow desirable, and don't believe that other systems are less messed up.
I do not understand why setuid scripts are any different than setuid binaries?
You can't change the behaviour of binaries by tweaking environment variables that change the syntax of shell scripts, at least not in the general case.
I just finished reinstalling Windows because it had eaten its little brain.
.NET. Reboot.
Install Windows. Reboot.
Install VIA 4-in-1 drivers. Reboot.
Install Audio drivers. Reboot.
Install Ethernet and USB drivers. Reboot.
Install video card drivers. Reboot.
1 service pack. Reboot.
42 "security and critical updates". Reboot.
4 post service-pack updates. Reboot.
DirectX. Reboot.
Windows Media Player. Reboot.
7 reboots to bring Norton Antivirus up to date.
2 driver updates for the motherboard. 2 more reboots.
If I'd updated IE instead of using Firefox that would be 2 more reboots because you can't update IE at the same time as other applications.
Gee, where are the flames about "having to update all the time because of bugs"?
Well, I could update to Windows XP with its boobytrapped OS, but I'd rather not have a system decide I'm a pirate because I have to replace the motherboard. And I'd still have to do most of the same updates, so I don't think it's fair to flame about Windows 2000 that much. That's what you were talking about, right?
But private telephone companies aren't doing it. Governments and enthusiastic hoppyists are. Private restaurants and bookstores are. Private phone companies are trying to get individuals to pay through the nose by the megabyte for 4G services and selling them data-enabled phones that they can't access their preferred data services from.
I have a Verizon phone. It's more powerful than my PDA, but I can't run any of my own software on it... in fact I can't run ANY software on it, except by paying exorbitant rates to Verizon for "Buy It Now". Verizon has a cash cow in their captive customer base, and they don't just milk it... they bleed it. Is it any wonder people don't see them as the natural providers of high speed data services, services... I note again... they they're not even providing.
"Why in the world would you think your (cell) phone would work in your house?" he said. "The customer has come to expect so much. They want it to work in the elevator; they want it to work in the basement."
You're selling me a telephone, and you tell me it's good enough to replace my landline. Why shouldn't I take you at your word?
AT least your coverage is better than T-Mobile. T-Mobile I had to walk to the other side of my street to get a signal. Hell with "in my house" how about "in my back yard"?
Last year, the California Public Utilities Commission ordered all phone companies to give customers 30 days to test a service without slapping them with hundreds of dollars in early cancellation fees.
A few years ago I had a nice PDA-phone combo. I went to the phone companies that were compatible with it, and tried to get it activated with the pre-paid card they were selling.I didn't get far enough to find out about "early cancellation fees".
Open your books, mister Seidenberg, quit treating your customers as criminals and fools, and then maybe people will quit turning to government because the free enterprise system has failed them... because the cellphone market doesn't resemble anything so much as a parody of a soviet health-care program. Homeopathic levels of service and no accountability...
But given the price tag and the goals of the project, how much can this project actually help education? Has anyone out there in the high school level education field seen digital systems improve the classroom to the point that students actually learn more, or do they just tend to be fascinating distractions that detract from the classroom?
The second question answers the first one. Assuming the study is honest, if the answer to the last question is "the latter" then the study can potentially help education a hell of a lot.
Google on "Stirling engines".
Google on "Thermodynamics, laws of" while you're about it.
"This plugin will not be present in Safari or other WebKit applications, and is only accessible from Dashboard".
Unfortunately, they are using Microsoft-style "zones" for some functionality, which really bothers me.
Apple took the approach of separating the zones instead of limiting XMLHttpRequest access from file: URLs.
Note that Konqueror is already separating zones, and also allows file: URLs to use XMLHttpRequest to access local resources.
Stercus stercus stercus moriturus sum.
Microsoft has spent seven years proving conclusively that these kinds of zones are an unworkable approach to security. A web browser has to operate in a mandatory access control environment, and that means that rights once given up must never be granted again except by explicit request from a more trusted object. For example, calling it by "open" from the command line (since you can execute anything from the command line, the command line can be granted full local rights).
Zones don't work. You have to have inherited rights irrevocably discarded, there's no other way to guarantee there's no path from an untrusted object to a trusted one.
Not about the update itself, but what it implies about webcore.
Safari
Available for: Mac OS X v10.3.9, Mac OS X Server v10.3.9
CVE ID: CAN-2005-0976
Impact: Remote sites could cause html and javascript to run in the local domain.
Description: This update closes a vulnerability that allowed remote websites to load javascript to execute in the local domain. Credit to David Remahl for reporting this issue.
"local domain" sounds a lot like Microsoft's "local security zone". I had assumed that Apple would be smarter than Microsoft here, and rather than copying their dangerous idea of treating webpages differently depending on where they were loaded from it would use some irrevocable and inheritable rights control established by the application... and this there would be no code path available to a webpage loaded from Safari to do anything dangerous... no matter where the page was loaded from.
If that's not the case... Apple, before going any further down this path, please reconsider.
Okay, you think that you know so certainly what the furutre of this industry holds because you read a few rumor sites and talked it over with some other ignorant people in a /. forum
Well, that and I've had more than a few dealings with the cellular industry myself. There is no limit to how fucked up they're willing to make a phone if it'll give them a way to make an extra buck per transaction here or there.
To look to the future of the cellphone industry, you only need to look at the present of the cellphone industry.
However any dashboard that doesn't have cocoa or applescript parts will all run in Safari without any alteration (that I know of).
That's one thing I'd like to get more information about, actually. How exactly are they extending webcore and how much have they opened up for Safari. I'm worried that they're copying Microsoft's greatest mistake.
On a 1GHz Titanium PB, I felt the machine was at least 10-20% faster then 10.2.x.
Then Tiger ought to make you REALLY happy, since it's showing GUI speed improvements of 25-50% and more on some models.
I've lost count of the number of articles, comparisons, and reviews of Longhorn I've come across in the last two years that tout some *advantage* over another OS (usually OS X).
Really? I haven't seen one advantage actually listed. Maybe you can help me figure out what they are supposed to be... I'm pretty much lost at sea here.
Open a hailing channel, eh?
Google's example patent search:
Bathtub overflow control device
Abstract
A control mechanism for use with a bathtub having a drain opening and an overflow opening, with the drain opening having a stopper moveable between open and closed positions.
Is this a hint? Will we have google bathtubs that automatically grow over time so they never overflow?
Without yellow box, the entire user base would be screwed on their existing investment in software.
Nonsense. They had Blue Box. What became Classic. I used Photoshop under Classic for quite a long time because on my computer it gave me better performance than the "real" Carbonized Photoshop, because Quickdraw bypassed all the double-buffering you got from Quartz.
Blue Box / Classic was a real, functional, effective, and efficient way forward for the short term. I'm sorry that you and other developers didn't believe it. I guess you were so used to the horrid OS that Apple had saddled you with that the idea that you couldn't believe emulation would give you better performance. But... it could, it did, with all the horrible passive-aggressive "cooperative multitasking" drivers gone performance actually improved... whether using SheepShaver under BeOS or Blue Box under Rhapsody.
And Adobe screwed Apple two ways. First, they rejected Yellowbox/Bluebox. Second, they refused to cut them a break on Display Postscript, forcing Apple to start over with Quartz.