the majority of "moon-landing-doubters" are naive people that watched that socially irresponsible Fox TV show, and a few pictures of the landing site may be enough to sway them
I dunno.. if someone doesn't believe it now, I don't think they believed it before.
I know someone who thinks the moon landing was a hoax - she's a friend's mother.. she was a doubter WAY before the TV show aired (I heard her talk about it in the late 1980s) and truth be told, I don't think she even watched the TV show, as she doesn't have a TV..
The TV show was pretty funny - but I don't think that it was powerful enough to change anyone's mind - if you don't believe the landing was real now, then I think it would have taken a little more than a single TV show - the seeds must have been planted before that..
California is where America sends all of its Ellens.
Actually, I don't think it's where you send them, but it is where they end up..
See, I have a theory that the rotational direction of the earth causes anything that's not well-anchored to drift to the west - including flakes... which explains the large number of them in California and BC.
Windows, out of the box, is not designed to be hung out on the internet w/o protection.
And this is a good thing?
firewalls are standard practice, and could really help out the report writer
To a point. But the problem with firewalls is that they lead admins to believe that their boxes are secure. Before I install a firewall for a customer, I always tell them that it won't provide more security, if the box is already insecure.
Once an attacker bypasses the firewall, they have access to pretty much anything they want. The ONLY way to be 100% sure of stopping them is to not have something listening on the port. Anything else is a band-aid.
which ports are used, and which processes are using them
Try using netstat -a
Yes, and that shows which processes are listening on those ports?
See, on any modern Unix, I can do netstat -ap. This will show not only the ports, but which processes are using them, which was pretty much my point. Once you know which process is responsible, you can make an informed decision as to whether the port needs to be open or not.
As for random ports being open, that's one reason we have these things called firewalls
Yeah, because god forbid you should actually fix the problem when you can just slap a band-aid on it instead... band-aids never break, do they?
not to mention port scanners
Good comeback - "we don't need for the administrator of a box to see, at a moment's notice, which ports are used, and which processes are using them - because we can run a port scanner instead."
So someone was portscanning MS, and just bumped into a public server with secret files on it?
No, not even a little bit. Please READ THE WIRED ARTICLE before commenting further.
MS had a PUBLIC, ADVERTISED FTP server, which they used to distribute drivers and documentation, and was referenced in many places on MS's web sites.
Employees at MS didn't know that the server was used to serve files to the public, and started putting sensitive internal documents (such as this one) on it.
Security Office is admitting to criminal activity?
Not necesarily. They never said they "hacked" it. Read this article at Wired yesterday. Apparently there was a public FTP server at MS that MS employees were using to store sensitive files, because they weren't aware that it was public.
The funny thing is that MS was notified, took the server down, cleaned it, put it back up, and the same employees started doing it again.
If the data is in a public server, then it's not "hacking".
If Hollywood really can't protect it's works the film industry will die
Yes, and if Sony is allowed to sell the Betamax, then the film industry will die,
and before that...
if Panasonic is allowed to sell audio cassette players, the music industry will die
and before that...
if tv stations are allowed to broadcast movies, the film industry will die
and before that...
if radio is allowed to broadcast music then the live music industry will die.
These have all failed to pass. In each case, the new technology not only didn't cause the 'death' of the old, but it provided a huge new revenue stream. "Protecting works" is just the latest catch-phrase, Jack.
There's open skepticism from researchers about the ability of DRM to solve Hollywood's copy protection problems
In May I attended a meeting on amending Canada's copyright laws to include DRM protection.. one of the guys there owns a company that does encryption research.. his statement basically said "the application of encryption technology to prevent copying is fundamentally flawed"
Indeed, someone who makes his living doing what the entertainment industry wants, and he says it can't be done.
I'm glad that researchers are finally speaking up about this.
Does sharing the code that can cause the problem allow you to protect yourself against it?
Along with patches/workarounds, yes, it does. Sharing the code allows you to determine if you are at risk, and to verify that the workarounds or patches you use actually do what they say. (There have been problems in the past where a vendor has released a patch, but the patch didn't fix the problem - without any way to test the patch, you are in the unenviable position of believing you are safe, when you actually aren't.)
If you're not sure that the instructions given to you by the authors of the software work, i don't think you should use that software.
So what you're saying is that once a security flaw is discovered in a piece of software, that nobody should continue to use it? - because without working exploit code, there is no way that anyone can KNOW that the instructions work or not.
Think about that for awhile, and let it sink in. If you don't have the code, how can you know that it doesn't work?
Pardon me, if you use IE, how is the exploit code going to help you protect yourself?
You're pardoned. If all I have are instructions on "how to be secure", how do I know if the instructions work? Or if they do work, how do I know I've applied them properly?
I don't. Not without the exploit code.
The first sites that any "hax0r" goes to to find out about exploits or such are major bugtraq sites, like securityfocus or packetstorm.
Do you know any "hax0r"s? Have they told you this?
I do, and Bugtraq is the last place they visit, because after it's posted to Bugtraq, it's too old to be any good.
Only people who need that information should be allowed to it.
How do you determine need?
If I use the software, I need the information, so I can protect myself. With that in mind, everybody potentially needs the information.
Read the article. The information in question was already available in black-hat circles, and was actively being used in the wild. Do you believe that the white hats shouldn't be on level footing?
These laws have helped because half your spam now includes another 200-300 bytes of disclaimer for Washington receivers?
Try to take the whole post in at once - I know the MTV generation has a low attention span, but it's only one paragraph. Perhaps you missed your Ritalin dose this morning?
Unless people from Washington are receiving less spam
That's pretty much implied by the part of my post that you didn't quote (you know, about how WA residents are sueing - and winning - and collecting) from spammers.
They're not cheap (and nor are the blanks), so it's hardly a "consumer-grade" unit, but there are no restrictions on purchasing or ownership, so anyone can own one.
Can you give more information about CSS - there was nothing on that page that even hinted at it.
Who's key do you use? (there are a fixed number) Is the CSS authoring implemented in software or hardware? Why do they not even mention CSS on the page?
the products are and services are mostly Windows oriented.
Funny story.. in 1995 my boss and a couple of the sales guys went to Comdex, and came back saying that Digital Video was the next 'big' thing - MS (and therefore everybody else) was hyping it, and everybody's product was related to it..
That was the year that the Internet happened - and it took MS (and the rest of the Windows world) completely and totally by surprise - digital video as "the next big thing" never really happened.
I think that was the beginning of the end for Comdex.. each year since, it has become less and less relevant.
The ISP in question leases servers one by one to individuals and companies. They hand over the root password, and off you go. So what exactly does slashdot think they should do?
How about just what the previous poster said:
shut them down if they start spamming, which would fall into "none of the above"
the SPEW thing just isn't going to work unless we want far more intrusion by ISPs.
Bullshit. It works right now (you're living proof!) Your ISP is spam-friendly, and everybody who uses SPEWS won't accept mail from them. If you don't like the fact that you're 'collateral damage', then change ISPs, to one that has a clue - then everybody's happy; you're not blacklisted, your brain-dead former ISP keeps it's customers, the spammers have a home which can't send spam to people who don't want it.
The only thing that anti-spam laws will do is have unintended consequences, perhaps of restricting legit email.
Bullshit.
Look at Washington state, or California, or any of the other sites that have anti-spam laws... I don't see anyone complaining about legitimate email being restricted, but I do hear about spammers being sued, and people collecting money.. and it is doing something, because 1/2 of the spam I get now has a disclaimer of "this isn't intended for people in Washington, California, etc.. if you are in one of these states, please don't sue me" at the bottom.
The laws are working.
If you are posting your email address to a public area (e.g., Usenet), then you might as well get a new email address.
Ahh what wonderful logic - "if you want your email address to be useful to you, then you better not tell anyone about it" - which, of course, makes it useless.
if ISP's had an opt-in feature for their customers.Maybe they did contact all of their customers and explain this new "feature" and gave them an option
Ahh, so you're saying that the customer's speech is being blocked?
That's not what's happening - see blocklists protect the ISP's customers from spam - so it's not censorship!
Slashdot Mirror
the majority of "moon-landing-doubters" are naive people that watched that socially irresponsible Fox TV show, and a few pictures of the landing site may be enough to sway them
I dunno.. if someone doesn't believe it now, I don't think they believed it before.
I know someone who thinks the moon landing was a hoax - she's a friend's mother.. she was a doubter WAY before the TV show aired (I heard her talk about it in the late 1980s) and truth be told, I don't think she even watched the TV show, as she doesn't have a TV..
The TV show was pretty funny - but I don't think that it was powerful enough to change anyone's mind - if you don't believe the landing was real now, then I think it would have taken a little more than a single TV show - the seeds must have been planted before that..
why not create an open-source filter for libraries to use?
You mean like SquidGuard?, with it's associated blacklist?
The show didn't do well, so Nine decided to put the show up against the 2000 Olympics
Is Nine the Aus affiliate of Fox?
If not, sounds like the executives went to the same broadcasting school.
California is where America sends all of its Ellens.
Actually, I don't think it's where you send them, but it is where they end up..
See, I have a theory that the rotational direction of the earth causes anything that's not well-anchored to drift to the west - including flakes... which explains the large number of them in California and BC.
Windows, out of the box, is not designed to be hung out on the internet w/o protection.
And this is a good thing?
firewalls are standard practice, and could really help out the report writer
To a point. But the problem with firewalls is that they lead admins to believe that their boxes are secure. Before I install a firewall for a customer, I always tell them that it won't provide more security, if the box is already insecure.
Once an attacker bypasses the firewall, they have access to pretty much anything they want. The ONLY way to be 100% sure of stopping them is to not have something listening on the port. Anything else is a band-aid.
which ports are used, and which processes are using them
Try using netstat -a
Yes, and that shows which processes are listening on those ports?
See, on any modern Unix, I can do netstat -ap. This will show not only the ports, but which processes are using them, which was pretty much my point. Once you know which process is responsible, you can make an informed decision as to whether the port needs to be open or not.
read the wired article again, and note near the bottom
You are correct. Thanks for pointing that out.
As for random ports being open, that's one reason we have these things called firewalls
Yeah, because god forbid you should actually fix the problem when you can just slap a band-aid on it instead... band-aids never break, do they?
not to mention port scanners
Good comeback - "we don't need for the administrator of a box to see, at a moment's notice, which ports are used, and which processes are using them - because we can run a port scanner instead."
So someone was portscanning MS, and just bumped into a public server with secret files on it?
No, not even a little bit. Please READ THE WIRED ARTICLE before commenting further.
MS had a PUBLIC, ADVERTISED FTP server, which they used to distribute drivers and documentation, and was referenced in many places on MS's web sites.
Employees at MS didn't know that the server was used to serve files to the public, and started putting sensitive internal documents (such as this one) on it.
Security Office is admitting to criminal activity?
Not necesarily. They never said they "hacked" it. Read this article at Wired yesterday. Apparently there was a public FTP server at MS that MS employees were using to store sensitive files, because they weren't aware that it was public.
The funny thing is that MS was notified, took the server down, cleaned it, put it back up, and the same employees started doing it again.
If the data is in a public server, then it's not "hacking".
If Hollywood really can't protect it's works the film industry will die
Yes, and if Sony is allowed to sell the Betamax, then the film industry will die,
and before that...
if Panasonic is allowed to sell audio cassette players, the music industry will die
and before that...
if tv stations are allowed to broadcast movies, the film industry will die
and before that...
if radio is allowed to broadcast music then the live music industry will die.
These have all failed to pass. In each case, the new technology not only didn't cause the 'death' of the old, but it provided a huge new revenue stream. "Protecting works" is just the latest catch-phrase, Jack.
There's open skepticism from researchers about the ability of DRM to solve Hollywood's copy protection problems
In May I attended a meeting on amending Canada's copyright laws to include DRM protection.. one of the guys there owns a company that does encryption research.. his statement basically said "the application of encryption technology to prevent copying is fundamentally flawed"
Indeed, someone who makes his living doing what the entertainment industry wants, and he says it can't be done.
I'm glad that researchers are finally speaking up about this.
if the changelog says it's fixed, are you going to test every security exploit there is just to see if you've applied the test correctly?
Yes, absolutely. If a security patch is released, and there are exploits available, I always check the exploits it claims to fix, just to make sure.
Same for workarounds - you have to know that it will stop an exploit for it to be any good.
if you can test the patch by trying to use the exploit, someone els can use that same exploit on an unpatched system
Yes, however if they already have it, there's no point in trying to keep it away from me.
Does sharing the code that can cause the problem allow you to protect yourself against it?
Along with patches/workarounds, yes, it does. Sharing the code allows you to determine if you are at risk, and to verify that the workarounds or patches you use actually do what they say. (There have been problems in the past where a vendor has released a patch, but the patch didn't fix the problem - without any way to test the patch, you are in the unenviable position of believing you are safe, when you actually aren't.)
the fact that you know about the exploit doesn't mean you can do anything about
No, but when a patch/workaround is enabled, it lets you know if the patch/workaround actually works, doesn't it?
if you're not a developer involved in apache, there is much less of a chance that you're going to do something about it,
Ahh, so the fact that there is a lower chance of you helping means that you should not be allowed to contribute at all?
Pretty silly reasoning.
If you're not sure that the instructions given to you by the authors of the software work, i don't think you should use that software.
So what you're saying is that once a security flaw is discovered in a piece of software, that nobody should continue to use it? - because without working exploit code, there is no way that anyone can KNOW that the instructions work or not.
Think about that for awhile, and let it sink in. If you don't have the code, how can you know that it doesn't work?
Pardon me, if you use IE, how is the exploit code going to help you protect yourself?
You're pardoned. If all I have are instructions on "how to be secure", how do I know if the instructions work? Or if they do work, how do I know I've applied them properly?
I don't. Not without the exploit code.
The first sites that any "hax0r" goes to to find out about exploits or such are major bugtraq sites, like securityfocus or packetstorm.
Do you know any "hax0r"s? Have they told you this?
I do, and Bugtraq is the last place they visit, because after it's posted to Bugtraq, it's too old to be any good.
Only people who need that information should be allowed to it.
How do you determine need?
If I use the software, I need the information, so I can protect myself. With that in mind, everybody potentially needs the information.
Read the article. The information in question was already available in black-hat circles, and was actively being used in the wild. Do you believe that the white hats shouldn't be on level footing?
These laws have helped because half your spam now includes another 200-300 bytes of disclaimer for Washington receivers?
Try to take the whole post in at once - I know the MTV generation has a low attention span, but it's only one paragraph. Perhaps you missed your Ritalin dose this morning?
Unless people from Washington are receiving less spam
That's pretty much implied by the part of my post that you didn't quote (you know, about how WA residents are sueing - and winning - and collecting) from spammers.
They're not cheap (and nor are the blanks), so it's hardly a "consumer-grade" unit, but there are no restrictions on purchasing or ownership, so anyone can own one.
Can you give more information about CSS - there was nothing on that page that even hinted at it.
Who's key do you use? (there are a fixed number) Is the CSS authoring implemented in software or hardware? Why do they not even mention CSS on the page?
the products are and services are mostly Windows oriented.
Funny story.. in 1995 my boss and a couple of the sales guys went to Comdex, and came back saying that Digital Video was the next 'big' thing - MS (and therefore everybody else) was hyping it, and everybody's product was related to it..
That was the year that the Internet happened - and it took MS (and the rest of the Windows world) completely and totally by surprise - digital video as "the next big thing" never really happened.
I think that was the beginning of the end for Comdex.. each year since, it has become less and less relevant.
The ISP in question leases servers one by one to individuals and companies. They hand over the root password, and off you go. So what exactly does slashdot think they should do?
How about just what the previous poster said:
shut them down if they start spamming, which would fall into "none of the above"
the SPEW thing just isn't going to work unless we want far more intrusion by ISPs.
Bullshit. It works right now (you're living proof!) Your ISP is spam-friendly, and everybody who uses SPEWS won't accept mail from them. If you don't like the fact that you're 'collateral damage', then change ISPs, to one that has a clue - then everybody's happy; you're not blacklisted, your brain-dead former ISP keeps it's customers, the spammers have a home which can't send spam to people who don't want it.
The only thing that anti-spam laws will do is have unintended consequences, perhaps of restricting legit email.
Bullshit.
Look at Washington state, or California, or any of the other sites that have anti-spam laws... I don't see anyone complaining about legitimate email being restricted, but I do hear about spammers being sued, and people collecting money.. and it is doing something, because 1/2 of the spam I get now has a disclaimer of "this isn't intended for people in Washington, California, etc.. if you are in one of these states, please don't sue me" at the bottom.
The laws are working.
If you are posting your email address to a public area (e.g., Usenet), then you might as well get a new email address.
Ahh what wonderful logic - "if you want your email address to be useful to you, then you better not tell anyone about it" - which, of course, makes it useless.
he wrote some new tools that are like the tools we already have but implemented in a slightly different way
Slightly different?
Yeah, and a cellphone is just like two cans and some string, only slightly more useful.
There are some seriously funky tools in there - check them out.
Clippy
You mean MS Bob 2.0?
ClearType?
Invented by Apple, circa 1981.
All the recent MS Media inventions?
Again, links please?
handwriting recognition software
Invented by GRiD computing in the late 1980's.
Text->voice software
My Vic-20 was doing that in 1982.
if ISP's had an opt-in feature for their customers.Maybe they did contact all of their customers and explain this new "feature" and gave them an option
Ahh, so you're saying that the customer's speech is being blocked?
That's not what's happening - see blocklists protect the ISP's customers from spam - so it's not censorship!