User: MeowMeow Jones

Re:security

On: BugTraq's Elias Levy Talks Security

The worm might be new, but the patch for the exploit in question was released in October 2000. Here are some links that are of interest:

http://www.microsoft.com/technet/treeview/defaul t. asp?url=/technet/itsolutions/security/tools/lockto ol.asp

http://www.microsoft.com/technet/treeview/defaul t. asp?url=/technet/itsolutions/security/tools/iis5ch k.asp

W2K has explicit denies

On: New (More) Annoying Microsoft Worm Hits Net

So you can explicitly deny execute access to TFTP to the IUSR_computername account.

Is this just the old Unicode exploit?

On: New (More) Annoying Microsoft Worm Hits Net

Or is it something new?

Looks like an exploit that's been around for a while (way before CR)

From the article

On: Lego and the IP Conundrum

That also happens to be the approach to learning championed by the Lego Co. of Billund, Denmark, the fourth-largest toy company in the world.

You can use different metrics than pixels

On: AtheOS Wizard Kurt Skauen Tells All

It's actually a pretty good idea to use some other form of measurement. If you just use pixels, then things can get wierd when you change resolution. If your screen is 3 units high by four units wide no matter what, this doesn't matter.

How does Atheos handle Binary Compatibility?

On: Ask AtheOS Creator Kurt Skauen About His Creature

(As I'm sure you know) one of the problems with C++ is that modifying a class changes the binary structure of an object. This then breaks any programs that were dynamically linked against this. This problem has been addressed in several ways (CORBA, COM, staticly linking in the code, or keeping 800 copies of MFC40.dll on your machine, etc, etc)

This seems (to me, at least) the biggest problem with writing an OS in C++. How does AtheOS deal with this problem?

Don't forget Xfree86

On: ESR Writes About O'Reilly and FSF Differences

From this page:

http://www.xfree86.org/legal/licence.html

However, some other Open Source compatible licenses are considered too restrictive for XFree86 use. They include the GNU Public License and the Perl Artistic License.

Part of the motivation for our licensing choice was to carry on the original MIT X11 tradition of allowing the code to be used as widely as possible, including in both free and commercial products.

Important lesson

On: Report Security Problems, Face The Consequences

Talk to the techs.

Why would you call an editor-in-chief who has no experience with computers instead of, I don't know, say emailing the webmaster? Contacting someone at the hosting company?

Finally

On: Mob Software

A software methodology that has a stupider name than "X-Treme Programming"

As much as I like google

On: Searching For Google's Successor

Things just haven't been the same since they started taking advertisers money. They've been shamelessly manipulating search results instead of keeping the engine honest.

Don't judge ruby based on the article

On: Programming in the Ruby Language

There's nothing wrong with it, it just doesn't get into any of the crazy stuff that makes ruby ruby. So wait until the other parts come out or check out the Pragmatic Programmers Guide.

If Python was the result of Lisp and C++ having a baby, Ruby is the result of Perl and Smalltalk having a baby.

Stop blaming microsoft

On: Code Red: the Aftermath

Blame the creators of C.

They're the ones who are responsible for buffer overflows.

Re:Bah.

On: Code Red III

Or you could just disable the isapi mapping to .ida extentions in IIS (and everything else you don't intend to use) Just right click on "Default Web Site" in MMC and you should find it pretty quick.

If Attack of the Clones wasn't bad enough

On: Slashback: Mods, Books, Checkmate

Lucas announced that after finishing episode three, he plans to film Episodes 1-1137 of THX.

Dude's got to lay off the crack.

It's OSHA regulations

On: Aeron Chairs As Stupidity Barometers

The Office Depot/Ikea chairs don't qualify as being 'ergonomically correct' You cant find a real office chair for under $500 and those are the barebones models.

It's Amiga, Inc

On: Be Buyout Looms Closer

Duh.

The two companies deserve each other.

A philosophical question

On: Honeynet Project: Blackhat Attack Stats

If you put up a machine to get hacked (a honeypot), aren't you partially responsible for any attacks to other machines that blackhats launch from that machine?

Trolls throughout history:

Can anyone seriously argue...

On: Senator Seeks Injuction Against WinXP

that bringing an end to the legacy 9x/ME OS isn't a good and important thing? That in and of itself is justification enough for Windows XP.

Trolls throughout history:

I'm talking about rootkits, not exploits

On: When "Security Through Obscurity" Isn't So Bad

rootkits indtroduce their own exploits on a compromised system.

So a big apache expliot comes out, and a half hour later there's a patch (thanks to open source) and you apply it/ recompile. Then you look at the apache log files and don't see any unusual activity. So you're safe, right? wrong. Your system was compromised and a rootkit was installed. It cleaned up all the logs. It added a backdoor to getty. It modified your MD5 checksum verification. It modified your rpm so that it points to the hackers server, no matter what you say. It modified gcc to include a backdoor into any program that requires authenitcation and insert this code into any gcc recompiles.

Do I really need to prove that it's easier to change:

if (checkPassword(password)) {goCrazy();}

to

if (checkPassword(password) || !strcmp(password, "k00ldud3") {goCrazy();}

than it is to use a disassembler on an executable with no symbols to figure out what the hell is going on and insert a back door? Not only does this require a much higher level of expertise, it also requires significantly more time for the person who can do it.

Trolls throughout history:

OS advocates always forget

On: When "Security Through Obscurity" Isn't So Bad

that it's a hell of alot easier to write a rootkit against source code than it is against a binary.

Trolls throughout history:

Yep

On: Higgs Boson Discovery Questioned

Most people don't realise that a real newspaper costs more than 50 cents because they don't pay more than 50 cents. Who pays? Advertisers. Real advertisers. How do they know they're getting thier money's worth? Demographics.

There's a reason advertisers will fork over extra bucks to advertise in the national NY Times or Wall Street Journal instead of saving a few bucks and advertising in the USA Today.

Shame on the NY Times for using thier 100 year old business model on the Net instead of embracing the 'new economy'

Trolls throughout history:

Re:OT: NYTimes

On: Solving the Great Shower Curtain Mystery

It might be because it's illegal to collect info on users under 13. And to login you need to give personal info.

Trolls throughout history:

Still not one Malt Liquor joke?

On: The Glories of Red Bull

Shame on all of you.

Trolls throughout history:

$300 dollars isn't that much

On: MSDN Subscriber Forced to use Passport

When you consider how much you pay a programmer in one week.

Trolls throughout history:

Electricity travels slower than the speed of light

On: IBM Develops Transistor Capable of 210GHz

How far can electricity go in 1/210,000,000,000 of a second?

Trolls throughout history: