While I agree that professionally-developed software using well-defined and optimizing processes results in better software, it is an assumption to (1) guess that all of Microsoft's software development processeses are optimal or even good and (2) that no open-source software gets developed by paid professional software engineers utilizing optimizing software development processes. Similar to the commercial world, open source projects have development processes and resources that span the entire gamut from esoteric and specific to general and well-supported. Comparing a random Perl-script off of Freshmeat.net developed by a teenager in a parent's basement to Dave Cutler and the Windows NT kernel engineering team is not really an apples-to-apples comparison. Similarly, comparing the architects of the open-source KDE desktop environment and their highly object-oriented system to the developers of HuntBar, a commercial application, is not apples-to-apples, either.
My point is that both worlds of software development, commercial and open-source, are made up of the same diverse pool of people with opinions, capabilities, talents, and process regimentations that span the entire range of software quality and engineering disciplines.
Many open-source projects are created or have been contributed to by paid professional engineers on company time with an understanding of the mutual benefits of open-source software development and usage. Not all software engineers work at software development companies; most (I read 90% in one book) work for companies that are not in the business of selling software at all (I work for an non-profit AIDS organization, as an example), which are prime organizations to incorporate open-source technoligies and improve them to benefit the organization and, when appropriate, "give back" to the community to, in a way, "pay for" the benefit of being able to use that project in the first place versus having to develop it from scratch in-house or license it from a third party vendor.
As far as the tired argument of "being able to blame someone" for software defects, I suggest that proponents read their EULAs, including Microsoft's, especially the sections that explicitly state that the software comes with no warranty other than the installation media being defective and how the software company absolves itself of all liabilities resulting from the use or misuse of the software program in question. Some, including Microsoft's, even go as far as saying that it comes with no implied warranty and that it is technically not fit for any particular purpose. Read it if you don't believe me:-). I'm sure you've hit "I Agree" on their EULAs enough times to demonstrate to a court of law that you are well aware of this and whole-heartedly agree to abide by those terms (arguably, of course).
In closing, who has ever successfully sued Microsoft over defective software under their traditional and current EULAs for damages related to software defects causing lost productivity, time, profits, injuries, deaths, or whatever? If one could sue Microsoft over those things, then Microsoft would not be the large and resource-rich company it is today.
Though, I fully agree that public safety systems should be designed from the ground-up with professional engineering practices and processes. Whether or not that system is open-source is not mutually-exclusive of being designed by professional engineers and development processes. If it's open-source, that could permit other municipalities and governments to also use and professionally-contribute to that public-safety project, too, without having to write it themselves from the ground up, when combined with a collaborative and accountable contribution process.
To paraphrase a past president, "I feel your pain!"
I recently upgraded the laptop I'm typing this on to Fedora Core 4 by wiping Windows XP and Fedora Core 3, which worked well, completely off the drive first to ensure a totally clean install. Fedora Core 4 installed properly, but I could not get the wireless card to work with my 128-bit WEP network to save my life. It worked in FC3, but not in FC4. Oh, and don't get me started with all the other hardware and software that I would have to get working in FC4 manually, including the soft-modem, sleep mode, RealPlayer, DVD playback, and Java. I use FC4 at work and it works well, but getting FC4 working on a laptop made me so frustrated that I ultimately destroyed my FC4 DVD on a mad rampage and then discarded it.
Looking for a replacement distro, I decided to give Novell SuSE Linux Professional 9.3 a try through its free FTP-download-based installation method.
Until Fedora Core gets its act together, I'm not going back after having the extreme pleasure of installing and using SuSE Linux Professional! Really, it's that much better. SLP 9.3 and Fedora Core aren't even in the same league. Seriously, it's like comparing Windows 3.1 in all its AUTOEXEC.BAT, CONFIG.SYS, and WIN.INI glory with Mac OS X, with FC being Win 3.1 and SLP 9.3 being Mac OS X.
Not only did SLP's YaST, the system's comprehensive configuration management tool, detect _all_ of my laptop's hardware, it noticed that my eth1 was a wireless network card and graphically prompted me for the WEP settings. And it worked! No futzing with/etc/sysconfig/network-scripts/ifcfg-eth1 files and the like! It also noticed that I had a softmodem, installed the proper software to control it, and proceeded to the modem's configuration screen. It even installed a ThinkPad control panel (I have an IBM ThinkPad) without me having to do that manually! Sound, video, 1394, even Bluetooth were all set up without me having to futz with any configuration files. As a very pleasant surprise, and something that James Gosling can appreciate, "the lid works!" (sleep mode and hibernate)
I believe that I have finally found an OS besides Mac OS X that I can recommend to others. I was previously a FC fanboy, and I still like FC3, but I could never recommend FC to others, and I certainly cannot recommend FC4, especially on laptop computers.
It's really hard to describe the awesomeness that is SuSE Linux Professional 9.3, so try it out for yourself! Go to http://www.novell.com/products/linuxprofessional/d ownloads/suse_linux/index.html , scroll to the bottom, and read the instructions for the "SUSE LINUX 9.3 ftp version." One caveat that I must mention is that the autopartitioner, at least on my system, didn't automatically create a/boot partition at the beginning of the hard drive. Depending on your hardware, you really should ensure that a ext2 (or ext3)/boot partition is created at the beginning of the drive (100MB should work fine). Otherwise, GRUB might not be able to load SuSE (that was actually the only problem that I ran into, which is more of an installer issue than a system issue). Other than that, everything should "just work":-).
Oh, and SuSE includes Sun Java 1.4.2 and 1.5, Java Eclipse (not a buggy GCJ compiled version), Macromedia Flash, RealPlayer, Adobe Acrobat 7, and other goodies built-in; no hacks or editing of files/etc/yum.repo.d required. If you want DVD playback and Windows Media Codec support in Kaffeine, the media player, follow the easy instructions (even all-GUI) at http://www.plainfaqs.org/linux/dvdplay/ . Every Windows Media Player movie that I opened with it worked (I believe it's using official Microsoft DLLs coupled with winelib, and Wine is also built into SuSE), and every DVD that I tried worked prope
When the complete revision control tree of Windows, Office, and other programs appears on the Internet in the near future, no one will suspect the janitor;-).
Though, of course, I'll probably have to run it through a vss2cvs script that I used at work 5 years ago before posting the Windows and Office source to the Internet. Bwahahahahahaha!
And I can run it through sed to replace bitwise XOR shift swap patterns with "father, son, holy ghost" patterns to use up slightly more resources;-).
Actually, it would be cool to have access to the Windows source code as I'd probably try to make a trimmed-down version that runs.NET as a subsystem rather than underneath the Win32 subsystem, discards the Win32 subsystem (!) along with the Win16 compatibility support, and included core programs such as explorer.exe compiled in.NET using only.NET libraries and no Win32 code (though, calls to the core functions in ntdll.dll would be okay on rare occasions). But, why should I waste my time on such a thing when I'm a total Java person;-). I need to get back to JNode now..
Bugzilla does exactly that and is what I use at work and at home, though the proposed and actual start/end dates may have to take the form of "version," "milestone," "keywords," or a combination of those. Categorization can occur through a combination of "project," "component," "version," and/or "keywords."
It's also possible to prevent accidental usage of Internet Explorer through both IE and the Windows Explorer with the IE URL Lock Browser Helper Object that I recently released at http://ieurllock.sourceforge.net/
I'm about to deploy it where I work to replace the proxy.pac approach to locking down IE that we currently use so that WebDAV, FTP, and other folder views are not blocked.
Or, as a shameless plug:-), install my recently-released IE URL Lock from http://ieurllock.sourceforge.net/ so that users cannot use Internet Explorer except for Admin-approved web sites via a regular expression-based allow-list.
Fortunately, RPM in Linux does keep a checksum type of database (I think it's MD5) of all packaged-controlled files on the system, which is pretty much all files except for user-created files in/home and logs in/var/log.
If you want to verify your packages on a RPM system, the `rpm -V -a` command is your friend:-). Of course, that assumes that the RPM database has not been tampered with, though only root can modify it.
Also, program files are generally read-only to all users except root, even in Windows 2000+, though that protection flies out the window (no pun intended) when the user runs as Administrator or root.
Although I can't exactly say who I work for, the IT department that I am in rolled out Firefox with our Windows XP upgrades, and we're a relatively large non-profit AIDS service organization in a big US city (relatively meaning about 60-70 full-time employees, 10 part-time, and, during any business day, about 10-30 volunteers. We have about 110 computers). I effectively disabled IE in the process via a proxy.pac file, though I'm about to replace that approach with my yet-to-be-released IEURLLock software (when available, it will exist at http://ieurllock.sf.net/ which is already a registered Sourceforge.net project).
As an aside, I have a small Cygwin-bash script that pushes Firefox updates to all computers simultaneously from a large and well-connected Windows 2003 server on our core switch. It was cool to update about 108 computers simultaneously on Thursday night to Firefox 1.0.4:-) (it used almost 70% of the 200Mb/s teamed connection in some bursts!).
This sounds a lot like Capabilities http://www.cap-lore.com/CapTheory/, though it appears that Microsoft gave it a new name (it's also hard to Google on just 'capabilities' as all you get are marketing fluff sites rather than Capabilities).
I think some of this is already in various UNIX and Linux distributions in the form of NSA SELinux and other similar systems. Applications have a set of operations defined that they can do while restricting or denying access to other operations, which is pretty much the same thing as the manifest that Microsoft describes.
I need to dig deeper into the SELinux that's built into my Fedora Core boxes. I'd imagine that if Microsoft actually puts this into Longhorn, general interest in SELinux will also increase.
Actually, even though almost no one does this, it is possible to do that, even on NT 4. (I'm an OS X and Fedora Core user, but I have to use Windows at work (though, I run Fedora Core on my primary workstation)).
Unfortunately, very few services do this in their default installation. In Windows, the System account, as far as I'm aware, cannot simply say "I want to be UID xyz" as root in Unix/Linux can. Instead, it needs to know the password of the user account, which is a little odd as it's the freakin System account, but as pretty much all services run as System, maybe this is a good thing in Windows.
HOWEVER, the System account can obtain and duplicate the security context of a running process that is running as a different user. This is how I implemented the RunAsUser.exe component in my custom, currently unreleased except at work, PDF Writer. It finds the explorer.exe process running as the user and window station (sort of like the DISPLAY environment variable in X; used in Terminal Services) that submitted the job, duplicates its security token, and starts the PDFFile.exe process in that user's context and in their window station to prompt for the PDF file to save as without running as the Local System (Redmon's built-in File Save As dialog box runs as Local System, and I didn't want to give our users that level of access. Also, if it's not in their context, they cannot successfully save to their network shares as Local System). The AFPL Ghostscript that PDFFile.exe launches is then in the user's security context rather than Local System, so if a user submits malicious PostScript (remember, it is Turing-complete, so they can infinite loop it or use lots of resources), it's their own account they're screwing with.
Anyway, getting back to the topic of services, try right-clicking on a service, select Properties, and notice that you can set which account to run the service as. If you want System, no password is required, but if you want to use a non-System account, then you will need to specify a password for that user, which I think gets stored in the registry somewhere with light encryption (or, I could be totally wrong and it only needs it once to generate some kind of permanent security token or whatever to be stored in the Registry. Anyone know what it does? Please reply and let me know:-).
At work, we unfortunately run two public IIS servers, but instead of directly exposing it to the Internet, I have the Internet come through a Squid reverse-proxy first that applies a very restrictive set of URL regular expression matches before letting HTTP requests into our IIS servers. It works very well, and I have a guilty pleasure of 302 redirecting "../..%aa../..%fe../cmd.exe" and similar MS-specific attacks to www.microsoft.com;-). Anyway, Squid runs in Cygwin on both boxes as a heavily-restricted "squid" user with a long random password, so if someone compromises Squid, there's not much they can do unless if they know a Windows root exploit. I keep Squid up to date, so I'm hoping that it won't be compromised..
So there you have it: It is possible to run a service as a non-System user in Windows, and you can do this as early as Windows NT 4. Windows and Unix/Linux at their core implement similar concepts, though some concepts and especially the implementations differ wildly.
The built-in drive mapping feature for WebDAV in Windows XP only supports HTTP. If you require HTTPS, you can use the Network Places Web Publishing thing, but it's not a drive letter as another poster mentioned. NetDrive does support HTTPS, and that is what I've been using as I require HTTPS on my web server for WebDAV.
Interestingly, OS X is the same way! You cannot mount a HTTPS WebDAV share in OS X, either. I have to use Goliath to use HTTPS WebDAV from my Macs. I'm interested to see which OS vendor supports it first. I'm also curious if I can mount WebDAV in Linux (not VFS, but the "full mount-y"):-).
Q the dogmatic automobile zealots who will tell us "MY transportation device never has problems so nah nah nah nah nah"
Before you do people, get this, people wo DON'T work in transportation devices - they just don't care - did you know that? they don't care if it's a horse, a charriot, a car, or whatever, they just want to start using this new thing.
When they go to a shop to buy one what do they get? Horses, cos that's what 95% of other people do. Horses are big, it's always going to be big, deal with this fact.
Also, many malicious EXEs out there can be downloaded by users and then run after saving them to the desktop, which isn't nearly as sneaky as exploiting IE and Outlook [Express] holes, but is still a reality. Such things include screen savers, internet "optimizers," and other junk. Of course, such things could be readily downloadable for Mac and Linux, though implementations of new security models such as capabilities and such can help protect against those to an extent. At least the default security model in Mac and Linux prevents typical users from fscking up their systems (and I don't mean the filesystem check). (I know, I know, Windows XP/2000/NT can be secured to the same level, but then core programs such as even IE may have problems, not to mention many business-critical third-party applications).
Rolex spam has increased for me as well. I'm currently using the following regular expression on our Astaro firewall to block them, which has caught the recent "rolax" and "R-O-L-E-X" variants (remove the extraneous whitespace):
Hopefully, the next revision of Astaro will include Rolex spam filters in SpamAssassin so that I don't need to use this custom regex anymore.
Here's one message that I'd love to see (and hopefully blocked): =========
Gr33tingz, Dear Sir! I'm Dr. Jfjweaiofjweoif Iejfiowefjioe from an official bank in Nigeria and am trying to move $39,000,000 MILLION (million) US DOLLARS (United States currency) worth of \/1@gra pills and C1@li5 out of the country but need to confirm your CitiB@nk banking account details. In exchange for the sum of the transfer, you will have the opportunity to be a man like Britney Spears with real-like r()()()()()1eX watches with a screw-in bezel and a second hand that looks like the real thing. All you have to is click here (http://4.12.44.52:39/removeme/now.idc?really=yes) to install a FREE screensaver, which, if you're using Outlook [Express], should already be installed by the time you read this sentence! WOW! HOW CONVENIENT! Our online pharmacy is ready to take your orders for cheating housewives in your area, but HURRY! At these prices, they won't last long!
I've developed in Mozilla and, recently, Firefox with very limited or no testing in IE. The JavaScript debugging features are far nicer and more compatible with my workflow than the facilities in IE, making Mozilla a winner for my development time.
Generally, I have found that if it works in Mozilla (and Firefox), then chances are extremely good that it will work in IE. The opposite isn't as generally true. As a result, testing in IE for me is an afterthought, if I remember at all. And I'm held responsible for it working on our end-users' systems, which means IE at the moment, and my experience thus far has made me so confident in Mozilla and Firefox that I really don't need to spend much or any time testing code changes in IE. No user-reported problems related to limited IE testing have come up thus far..
Though, I have not gone as far as advocating Mozilla and Firefox on my web sites. I only do that in person;-).
I re-read the article and saw that it's a status bar issue after all.
I don't trust the status bar, and I don't see how this is really a big security issue. Besides, phishers are already using e-mail messages with embedded images that have http://citibank.com in the image but link to http://10.83.94.2:893, for instance.
So, I wouldn't hold my breath on Microsoft fixing this issue as larger issues out there already exist. But, I do agree that any security issue should be resolved, regardless of how minor.
Come to think of it, phishers can possibly use the image trick combined with this vulnerability to make the status bar say http://citibank.com, where this vulnerability can become quite serious.
Perhaps we should encourage users to check the URL bar of sites that they are in?
The primary issue in pre-XPSP2 IE is that when you click on the link, the URL bar says http://microsoft.com while the site is really http://google.com. Changing the status bar's text has not been seen as a major security issue historically, and Mozilla/Firefox lets you prevent web sites from changing the status bar.
In any case, the URL bar should be authoritative for where you are, which is the issue in pre-XPSP2 IE.
Though it may be possible with the iSight
on
Tiger Early Start Kit
·
· Score: 2, Funny
Assuming the iSight is on and looking at the user, a background daemon could look for middle finger patterns and then, if it detects one, dismiss the current modal dialog in the active application if one exists.
Yes, but not everyone has Windows XP. Probably most Windows users are on Windows 98, ME, NT, or 2000, and thus cannot benefit from the XPSP2-only version of IE:-(.
Dantz Retrospect lets you back up Linux boxes from a Windows or OS X backup server using its own client. They only support RedHat, but they do have a tar.gz that can probably be made to work with Debian. It's what I use to back up my firewall/email/web/everything server. It uses multicast for discovery, so if you put it onto a firewall, you'll need to set up multicast so that the packets are internal instead of on the default (Internet) route for the backup server to see the Linux box.
It sounds like you need to enable xft at configure-time. Do `./configure --help` for more info. You will probably need xft-devel or whatever the appropriate -devel package is.
Slashdot Mirror
While I agree that professionally-developed software using well-defined and optimizing processes results in better software, it is an assumption to (1) guess that all of Microsoft's software development processeses are optimal or even good and (2) that no open-source software gets developed by paid professional software engineers utilizing optimizing software development processes. Similar to the commercial world, open source projects have development processes and resources that span the entire gamut from esoteric and specific to general and well-supported. Comparing a random Perl-script off of Freshmeat.net developed by a teenager in a parent's basement to Dave Cutler and the Windows NT kernel engineering team is not really an apples-to-apples comparison. Similarly, comparing the architects of the open-source KDE desktop environment and their highly object-oriented system to the developers of HuntBar, a commercial application, is not apples-to-apples, either.
:-). I'm sure you've hit "I Agree" on their EULAs enough times to demonstrate to a court of law that you are well aware of this and whole-heartedly agree to abide by those terms (arguably, of course).
My point is that both worlds of software development, commercial and open-source, are made up of the same diverse pool of people with opinions, capabilities, talents, and process regimentations that span the entire range of software quality and engineering disciplines.
Many open-source projects are created or have been contributed to by paid professional engineers on company time with an understanding of the mutual benefits of open-source software development and usage. Not all software engineers work at software development companies; most (I read 90% in one book) work for companies that are not in the business of selling software at all (I work for an non-profit AIDS organization, as an example), which are prime organizations to incorporate open-source technoligies and improve them to benefit the organization and, when appropriate, "give back" to the community to, in a way, "pay for" the benefit of being able to use that project in the first place versus having to develop it from scratch in-house or license it from a third party vendor.
As far as the tired argument of "being able to blame someone" for software defects, I suggest that proponents read their EULAs, including Microsoft's, especially the sections that explicitly state that the software comes with no warranty other than the installation media being defective and how the software company absolves itself of all liabilities resulting from the use or misuse of the software program in question. Some, including Microsoft's, even go as far as saying that it comes with no implied warranty and that it is technically not fit for any particular purpose. Read it if you don't believe me
In closing, who has ever successfully sued Microsoft over defective software under their traditional and current EULAs for damages related to software defects causing lost productivity, time, profits, injuries, deaths, or whatever? If one could sue Microsoft over those things, then Microsoft would not be the large and resource-rich company it is today.
Though, I fully agree that public safety systems should be designed from the ground-up with professional engineering practices and processes. Whether or not that system is open-source is not mutually-exclusive of being designed by professional engineers and development processes. If it's open-source, that could permit other municipalities and governments to also use and professionally-contribute to that public-safety project, too, without having to write it themselves from the ground up, when combined with a collaborative and accountable contribution process.
To paraphrase a past president, "I feel your pain!"
/etc/sysconfig/network-scripts/ifcfg-eth1 files and the like! It also noticed that I had a softmodem, installed the proper software to control it, and proceeded to the modem's configuration screen. It even installed a ThinkPad control panel (I have an IBM ThinkPad) without me having to do that manually! Sound, video, 1394, even Bluetooth were all set up without me having to futz with any configuration files. As a very pleasant surprise, and something that James Gosling can appreciate, "the lid works!" (sleep mode and hibernate)
/boot partition at the beginning of the hard drive. Depending on your hardware, you really should ensure that a ext2 (or ext3) /boot partition is created at the beginning of the drive (100MB should work fine). Otherwise, GRUB might not be able to load SuSE (that was actually the only problem that I ran into, which is more of an installer issue than a system issue). Other than that, everything should "just work" :-).
/etc/yum.repo.d required. If you want DVD playback and Windows Media Codec support in Kaffeine, the media player, follow the easy instructions (even all-GUI) at http://www.plainfaqs.org/linux/dvdplay/ . Every Windows Media Player movie that I opened with it worked (I believe it's using official Microsoft DLLs coupled with winelib, and Wine is also built into SuSE), and every DVD that I tried worked prope
I recently upgraded the laptop I'm typing this on to Fedora Core 4 by wiping Windows XP and Fedora Core 3, which worked well, completely off the drive first to ensure a totally clean install. Fedora Core 4 installed properly, but I could not get the wireless card to work with my 128-bit WEP network to save my life. It worked in FC3, but not in FC4. Oh, and don't get me started with all the other hardware and software that I would have to get working in FC4 manually, including the soft-modem, sleep mode, RealPlayer, DVD playback, and Java. I use FC4 at work and it works well, but getting FC4 working on a laptop made me so frustrated that I ultimately destroyed my FC4 DVD on a mad rampage and then discarded it.
Looking for a replacement distro, I decided to give Novell SuSE Linux Professional 9.3 a try through its free FTP-download-based installation method.
Until Fedora Core gets its act together, I'm not going back after having the extreme pleasure of installing and using SuSE Linux Professional! Really, it's that much better. SLP 9.3 and Fedora Core aren't even in the same league. Seriously, it's like comparing Windows 3.1 in all its AUTOEXEC.BAT, CONFIG.SYS, and WIN.INI glory with Mac OS X, with FC being Win 3.1 and SLP 9.3 being Mac OS X.
Not only did SLP's YaST, the system's comprehensive configuration management tool, detect _all_ of my laptop's hardware, it noticed that my eth1 was a wireless network card and graphically prompted me for the WEP settings. And it worked! No futzing with
I believe that I have finally found an OS besides Mac OS X that I can recommend to others. I was previously a FC fanboy, and I still like FC3, but I could never recommend FC to others, and I certainly cannot recommend FC4, especially on laptop computers.
It's really hard to describe the awesomeness that is SuSE Linux Professional 9.3, so try it out for yourself! Go to http://www.novell.com/products/linuxprofessional/d ownloads/suse_linux/index.html , scroll to the bottom, and read the instructions for the "SUSE LINUX 9.3 ftp version." One caveat that I must mention is that the autopartitioner, at least on my system, didn't automatically create a
Oh, and SuSE includes Sun Java 1.4.2 and 1.5, Java Eclipse (not a buggy GCJ compiled version), Macromedia Flash, RealPlayer, Adobe Acrobat 7, and other goodies built-in; no hacks or editing of files
Cool! I can't wait!
;-).
;-).
.NET as a subsystem rather than underneath the Win32 subsystem, discards the Win32 subsystem (!) along with the Win16 compatibility support, and included core programs such as explorer.exe compiled in .NET using only .NET libraries and no Win32 code (though, calls to the core functions in ntdll.dll would be okay on rare occasions). But, why should I waste my time on such a thing when I'm a total Java person ;-). I need to get back to JNode now..
When the complete revision control tree of Windows, Office, and other programs appears on the Internet in the near future, no one will suspect the janitor
Though, of course, I'll probably have to run it through a vss2cvs script that I used at work 5 years ago before posting the Windows and Office source to the Internet. Bwahahahahahaha!
And I can run it through sed to replace bitwise XOR shift swap patterns with "father, son, holy ghost" patterns to use up slightly more resources
Actually, it would be cool to have access to the Windows source code as I'd probably try to make a trimmed-down version that runs
Hmm.. I would have answered this way:
:-).
;-)?
A = A ^ B
B = A ^ B
A = A ^ B
Try it out if you don't believe me
Does that mean that I get to work at Microsoft now
Note that ^ is the exclusive OR, or XOR in some languages. ^ is the exclusive OR in C, C++, Java, and many other languages.
Bugzilla does exactly that and is what I use at work and at home, though the proposed and actual start/end dates may have to take the form of "version," "milestone," "keywords," or a combination of those. Categorization can occur through a combination of "project," "component," "version," and/or "keywords."
The Bugzilla web site exists at: http://www.bugzilla.org/
It's also possible to prevent accidental usage of Internet Explorer through both IE and the Windows Explorer with the IE URL Lock Browser Helper Object that I recently released at http://ieurllock.sourceforge.net/
I'm about to deploy it where I work to replace the proxy.pac approach to locking down IE that we currently use so that WebDAV, FTP, and other folder views are not blocked.
Or, as a shameless plug :-), install my recently-released IE URL Lock from http://ieurllock.sourceforge.net/ so that users cannot use Internet Explorer except for Admin-approved web sites via a regular expression-based allow-list.
Fortunately, RPM in Linux does keep a checksum type of database (I think it's MD5) of all packaged-controlled files on the system, which is pretty much all files except for user-created files in /home and logs in /var/log.
:-). Of course, that assumes that the RPM database has not been tampered with, though only root can modify it.
If you want to verify your packages on a RPM system, the `rpm -V -a` command is your friend
Also, program files are generally read-only to all users except root, even in Windows 2000+, though that protection flies out the window (no pun intended) when the user runs as Administrator or root.
Although I can't exactly say who I work for, the IT department that I am in rolled out Firefox with our Windows XP upgrades, and we're a relatively large non-profit AIDS service organization in a big US city (relatively meaning about 60-70 full-time employees, 10 part-time, and, during any business day, about 10-30 volunteers. We have about 110 computers). I effectively disabled IE in the process via a proxy.pac file, though I'm about to replace that approach with my yet-to-be-released IEURLLock software (when available, it will exist at http://ieurllock.sf.net/ which is already a registered Sourceforge.net project).
:-) (it used almost 70% of the 200Mb/s teamed connection in some bursts!).
As an aside, I have a small Cygwin-bash script that pushes Firefox updates to all computers simultaneously from a large and well-connected Windows 2003 server on our core switch. It was cool to update about 108 computers simultaneously on Thursday night to Firefox 1.0.4
This sounds a lot like Capabilities http://www.cap-lore.com/CapTheory/, though it appears that Microsoft gave it a new name (it's also hard to Google on just 'capabilities' as all you get are marketing fluff sites rather than Capabilities).
I think some of this is already in various UNIX and Linux distributions in the form of NSA SELinux and other similar systems. Applications have a set of operations defined that they can do while restricting or denying access to other operations, which is pretty much the same thing as the manifest that Microsoft describes.
I need to dig deeper into the SELinux that's built into my Fedora Core boxes. I'd imagine that if Microsoft actually puts this into Longhorn, general interest in SELinux will also increase.
Actually, even though almost no one does this, it is possible to do that, even on NT 4. (I'm an OS X and Fedora Core user, but I have to use Windows at work (though, I run Fedora Core on my primary workstation)).
:-).
;-). Anyway, Squid runs in Cygwin on both boxes as a heavily-restricted "squid" user with a long random password, so if someone compromises Squid, there's not much they can do unless if they know a Windows root exploit. I keep Squid up to date, so I'm hoping that it won't be compromised..
Unfortunately, very few services do this in their default installation. In Windows, the System account, as far as I'm aware, cannot simply say "I want to be UID xyz" as root in Unix/Linux can. Instead, it needs to know the password of the user account, which is a little odd as it's the freakin System account, but as pretty much all services run as System, maybe this is a good thing in Windows.
HOWEVER, the System account can obtain and duplicate the security context of a running process that is running as a different user. This is how I implemented the RunAsUser.exe component in my custom, currently unreleased except at work, PDF Writer. It finds the explorer.exe process running as the user and window station (sort of like the DISPLAY environment variable in X; used in Terminal Services) that submitted the job, duplicates its security token, and starts the PDFFile.exe process in that user's context and in their window station to prompt for the PDF file to save as without running as the Local System (Redmon's built-in File Save As dialog box runs as Local System, and I didn't want to give our users that level of access. Also, if it's not in their context, they cannot successfully save to their network shares as Local System). The AFPL Ghostscript that PDFFile.exe launches is then in the user's security context rather than Local System, so if a user submits malicious PostScript (remember, it is Turing-complete, so they can infinite loop it or use lots of resources), it's their own account they're screwing with.
Anyway, getting back to the topic of services, try right-clicking on a service, select Properties, and notice that you can set which account to run the service as. If you want System, no password is required, but if you want to use a non-System account, then you will need to specify a password for that user, which I think gets stored in the registry somewhere with light encryption (or, I could be totally wrong and it only needs it once to generate some kind of permanent security token or whatever to be stored in the Registry. Anyone know what it does? Please reply and let me know
At work, we unfortunately run two public IIS servers, but instead of directly exposing it to the Internet, I have the Internet come through a Squid reverse-proxy first that applies a very restrictive set of URL regular expression matches before letting HTTP requests into our IIS servers. It works very well, and I have a guilty pleasure of 302 redirecting "../..%aa../..%fe../cmd.exe" and similar MS-specific attacks to www.microsoft.com
So there you have it: It is possible to run a service as a non-System user in Windows, and you can do this as early as Windows NT 4. Windows and Unix/Linux at their core implement similar concepts, though some concepts and especially the implementations differ wildly.
The built-in drive mapping feature for WebDAV in Windows XP only supports HTTP. If you require HTTPS, you can use the Network Places Web Publishing thing, but it's not a drive letter as another poster mentioned. NetDrive does support HTTPS, and that is what I've been using as I require HTTPS on my web server for WebDAV.
:-).
Interestingly, OS X is the same way! You cannot mount a HTTPS WebDAV share in OS X, either. I have to use Goliath to use HTTPS WebDAV from my Macs. I'm interested to see which OS vendor supports it first. I'm also curious if I can mount WebDAV in Linux (not VFS, but the "full mount-y")
Q the dogmatic automobile zealots who will tell us "MY transportation device never has problems so nah nah nah nah nah"
Before you do people, get this, people wo DON'T work in transportation devices - they just don't care - did you know that? they don't care if it's a horse, a charriot, a car, or whatever, they just want to start using this new thing.
When they go to a shop to buy one what do they get? Horses, cos that's what 95% of other people do. Horses are big, it's always going to be big, deal with this fact.
Because of new attack vectors such as WMA.
Also, many malicious EXEs out there can be downloaded by users and then run after saving them to the desktop, which isn't nearly as sneaky as exploiting IE and Outlook [Express] holes, but is still a reality. Such things include screen savers, internet "optimizers," and other junk. Of course, such things could be readily downloadable for Mac and Linux, though implementations of new security models such as capabilities and such can help protect against those to an extent. At least the default security model in Mac and Linux prevents typical users from fscking up their systems (and I don't mean the filesystem check). (I know, I know, Windows XP/2000/NT can be secured to the same level, but then core programs such as even IE may have problems, not to mention many business-critical third-party applications).
Or, if you have physical access to the machine, boot up into Single User Mode by adding a 1 to the end of the kernel bootup parameters.
If you're using Fedora, for instance, press A at the Grub screen, press the Space Bar, type in the number 1, and press Enter.
If you are using LILO, it will look something like this, plus or minus:
boot: linux 1
This will tell init to start up in runlevel 1, which drops you into root without the need for a password.
Rolex spam has increased for me as well. I'm currently using the following regular expression on our Astaro firewall to block them, which has caught the recent "rolax" and "R-O-L-E-X" variants (remove the extraneous whitespace):
[ :s pace:][:punct:]_]{0,3}(l|1){1,3}[[:space:][:punct: ]_]{0,3}(e|a){1,3}[[:space:][:punct:]_]{0,3}x
:-)
) to install a FREE screensaver, which, if you're using Outlook [Express], should already be installed by the time you read this sentence! WOW! HOW CONVENIENT! Our online pharmacy is ready to take your orders for cheating housewives in your area, but HURRY! At these prices, they won't last long!
(?i)r[[:space:][:punct:]_]{0,3}(o|0|\(\)){1,3}[
So, bring on the R0001ex!! spam
Hopefully, the next revision of Astaro will include Rolex spam filters in SpamAssassin so that I don't need to use this custom regex anymore.
Here's one message that I'd love to see (and hopefully blocked):
=========
Gr33tingz, Dear Sir! I'm Dr. Jfjweaiofjweoif Iejfiowefjioe from an official bank in Nigeria and am trying to move $39,000,000 MILLION (million) US DOLLARS (United States currency) worth of \/1@gra pills and C1@li5 out of the country but need to confirm your CitiB@nk banking account details. In exchange for the sum of the transfer, you will have the opportunity to be a man like Britney Spears with real-like r()()()()()1eX watches with a screw-in bezel and a second hand that looks like the real thing. All you have to is click here (http://4.12.44.52:39/removeme/now.idc?really=yes
I agree with his viewpoint as well.
;-).
I've developed in Mozilla and, recently, Firefox with very limited or no testing in IE. The JavaScript debugging features are far nicer and more compatible with my workflow than the facilities in IE, making Mozilla a winner for my development time.
Generally, I have found that if it works in Mozilla (and Firefox), then chances are extremely good that it will work in IE. The opposite isn't as generally true. As a result, testing in IE for me is an afterthought, if I remember at all. And I'm held responsible for it working on our end-users' systems, which means IE at the moment, and my experience thus far has made me so confident in Mozilla and Firefox that I really don't need to spend much or any time testing code changes in IE. No user-reported problems related to limited IE testing have come up thus far..
Though, I have not gone as far as advocating Mozilla and Firefox on my web sites. I only do that in person
Oh, shoot! I retract that.
I re-read the article and saw that it's a status bar issue after all.
I don't trust the status bar, and I don't see how this is really a big security issue. Besides, phishers are already using e-mail messages with embedded images that have http://citibank.com in the image but link to http://10.83.94.2:893, for instance.
So, I wouldn't hold my breath on Microsoft fixing this issue as larger issues out there already exist. But, I do agree that any security issue should be resolved, regardless of how minor.
Come to think of it, phishers can possibly use the image trick combined with this vulnerability to make the status bar say http://citibank.com, where this vulnerability can become quite serious.
Perhaps we should encourage users to check the URL bar of sites that they are in?
The primary issue in pre-XPSP2 IE is that when you click on the link, the URL bar says http://microsoft.com while the site is really http://google.com. Changing the status bar's text has not been seen as a major security issue historically, and Mozilla/Firefox lets you prevent web sites from changing the status bar.
In any case, the URL bar should be authoritative for where you are, which is the issue in pre-XPSP2 IE.
Assuming the iSight is on and looking at the user, a background daemon could look for middle finger patterns and then, if it detects one, dismiss the current modal dialog in the active application if one exists.
;-).
Sounds like a fun hack
Yes, but not everyone has Windows XP. Probably most Windows users are on Windows 98, ME, NT, or 2000, and thus cannot benefit from the XPSP2-only version of IE :-(.
Dantz Retrospect lets you back up Linux boxes from a Windows or OS X backup server using its own client. They only support RedHat, but they do have a tar.gz that can probably be made to work with Debian. It's what I use to back up my firewall/email/web/everything server. It uses multicast for discovery, so if you put it onto a firewall, you'll need to set up multicast so that the packets are internal instead of on the default (Internet) route for the backup server to see the Linux box.
It sounds like you need to enable xft at configure-time. Do `./configure --help` for more info. You will probably need xft-devel or whatever the appropriate -devel package is.
Darn; I didn't mean to post as AC. Oh, well..
"I'm gonna get one of my own real soon.
;-).
It's like
having a drive-in movie
in your own living room."
I couldn't resist
(Weird Al reference)