Presumably you've heard of sudo right? Have you ever noticed how it doesn't require you to enter your password every time you use it? Before sudo aquiring root privileges when a user would su was pretty hard. In fact, it was almost as hard as exploiting a suid binary. Now it's really easy to jump to root using sudo. All you have to do is use ptrace to inject code into the user's shell in memory (in the case of GNOME running sudo, that's even easier) and then execute a malicious sudo command after the user has started their own sudo command. The credentials are good for more than one sudo so the user doesn't need to enter their password again.
So where's the rash of viruses for linux exploiting this hole? Oh, there isn't, because linux users don't actually download and run untrusted software. Therefore any argument about how linux is impervious to viruses is just stupid as there are no programs for the virus to infect.
If you actually knew anything about safe cracking you might have had more luck coming up with an analogy that wasn't just rediculous. For example, you might have compared Lockwood safes to, say, Pregex safes. Lockwood safes are very easy for an experienced safe cracker to get into, whereas Pregex safes are a bitch to get into. Chances are that a sophisticated crew of thieves will easily get into a Lockwood safe on-site and run away with your jewels. Whereas if they run into a Pregex safe they're likely to try hitting it with a sledge hammer and when that doesn't work they'll either have to carry the damn thing out with them or just go home empty handed. Which is the better safe? Given infinite time and resources a Lockwood safe will win any test you want to throw at it but the largely unknown Pregex safe will actually protect your jewels from real thieves.
Ha! Most of your argument sounds like you're arguing for Windows, not against it. Modular vs Monolithic, hmmm, where have I heard this before.. oh yeah. Linus vs Tanenbaum.
I could cite many examples of these, but surely you can think of some on your own with modest effort.
No. And that's the specific question I asked. What part of the fundamental design of Windows is responsible for its apparent bad security? That's your claim, that the fundamental design of Windows is rotten and therefore we have to throw out the whole apple, so tell us already. Stop skirting around.
What's hard? Run software as a non-administrator. Just like you do on a linux box. People complaining about Microsoft being insecure whilst they're running untrusted apps as administrator are just brain dead.. end of story.
These people would have been owned and disconnected within hours of this being discovered. With the changing of the guard, so too does the changing of morality.
Why not seal the kernel and execution environment?
Because then you don't have a computer, you have a toaster. People need to install new programs and device drivers. Otherwise their general purpose computer becomes an appliance. The corporate method of security is to restrict these operations to administrators who are trusted to install software from trusted sources only. Guess what? These corporations use Windows. So what's your big plan for how to secure the operating system for people who don't have a dedicated administrator? Don't say education, because that's hardly Microsoft's problem.
A Mac Mini costs $500, you couldn't contract someone to write a virus for Windows, let alone OS-X for that much. I think I'm being more than reasonable. If I fail, you get your Mac back and you get a valuable piece of amunition in your quest to tell the world how impervious Macs are to virus attack. I'm only willing to do it because you're an idiot if you think it's hard to make a virus for a Mac. It's just a computer, like every other computer. There are viruses for other unixes, what makes you think Darwin is somehow special?
But that's not a fair analogy because there is no computer system that can stand up to it. Yes it is Microsoft's fault, but it's also the rest of the software industry's fault because we simply don't have the ability to make secure software. Maybe oneday we will, but until then, stop dreaming.
Obviously you'd expect the designers to reply to a question like that with "yes, of course you'll be required to buy the upgrades and if you don't you'll soon feel the back of my hand across your face bitch! Now bend over and grab your ankles." Jesus. How stupid are you? If all your friends are off enjoying the new content and you're stuck in the "common area" playing with, well, yourself then obviously you're going to feel the need to buy the expansion pack, or you're going to quit and run around telling everyone who will listen that the game sucks ass and that's why you quit.
The reason the prize went unclaimed is because, like most security prizes, the people running it were scumbags who kept changing the rules after they made the offer. They then pulled the offer because someone was about to win it and claimed they were responding to overwhelming public pressure. You want a virus for Mac OS X? Send me a Mac and I'll make you one. Seriously. Courier a Mac to me and I'll have it ready for you in a week. If I don't complete the task I'll courier the Mac back to you. Otherwise I get to keep the Mac. Ok?
Feel free to check my qualifications. I know what I'm talking about.
Sensible defaults really is something Microsoft needs to work on, but it hardly makes Windows insecure by design which is the claim people always make. As for NTFS and programs overwriting your files with garbage, what's that got to do with security and how is it any different to *nix? Sure, it'd be great if program access to the filesystem could be constrained, but I havn't seen any OS that provides this capability.
You're the second person to mention patches. We're not talking about individual security bugs. We're addressing the claim that Windows isn't secure by design.
Sigh. No it doesn't. It lies on the people making the worms. Really, it does. I used to be like you. I've slowly come to realise that it's just tall poppy syndrome. Worms exist for Windows not because it is more or less insecure than anything else. They exist because it is the biggest target and therefore people put more time into figuring out how to attack it. If Mac OS X were the #1 operating system we'd see more worms for Mac OS X. If some flavour of Linux were the #1 operating system we'd see more worms for it. If you want an historical validation of this theory, take a look at the first worms that spread across the internet. They were for SunOS 5 and other Unix systems. Does this mean that Apple II's and C64s were more secure than Unix systems? Of course not. I means that Unix systems were a more attractive target, and that's what the malware writers went for.
Windows doesn't enforce the distinction between user and administrator accounts in XP Home.
That's news to me man. If you don't put your user account in the administrators group the account has no special privileges. That doesn't mean the user can't download and run trojans that can destroy their user files, but that's no different to *nix. You can't heap everything onto the manufacturer of the software. On the other hand, every OS (except maybe openbsd) has serious local exploits that malware can take advantage of. But nothing short of open sourcing Windows and seeding a massive community to maintain it will fix that.
This comment, and others like it, are completely lame. It is possible to use Windows securely, but most people don't. This isn't Microsoft's fault. You can just keep repeating an argument made by people 10 years ago as if it still applies to today.
By freely I mean "out of their physical control". If you had to enter a music booth to listen to music and they had people to pay you down for tape recorders, then their business would be no different to any other business, where you have to enter someone's shop to buy their goods. If bakers sold their bread like muscians try to sell their music, they'd get up at dawn, bake the bread and then leave it in the market square with a sign that says "bakers must be paid before bread can be eaten". Everyone would laugh at the bakers for being so stupid and eat their bread without paying for it.. and that's the situation muscians are in. So what should we do? Setting up a quasi-official police force to roam from house to house ensuring that no-one is eating bread they havn't paid for, or put the burden of ensuring the bakers get paid back where it belongs, on the bakers sholders?
Sure, and that's why any sensible shop owner asks for the money first before they provide a service to children, or they insist that children be accompanied by an adult.
Re:This sort of thing...
on
RIAA Sues a Child
·
· Score: 1, Insightful
No. The point is that when you sit down to get a haircut you enter into a contract to pay for it and therefore the barber has a right to expect to be paid. This isn't the case when it comes to music/movies/software creators. They make what they create freely available and then demand payment without entering into a contract with anyone. Besides which, even in our theoretical barber case it's still not theft. It's a breach of contract.
Abe was obsessed with protecting the people affected by their experiment. He felt guilty for screwing up Aaron's life and hated Aaron for not caring. If you had to give up being with your wife you'd be pretty upset wouldn't you? Notice how Aaron wasn't?
As for the writing and the ear bleeds.. everything has side-effects. Those were just two.
Slashdot Mirror
Presumably you've heard of sudo right? Have you ever noticed how it doesn't require you to enter your password every time you use it? Before sudo aquiring root privileges when a user would su was pretty hard. In fact, it was almost as hard as exploiting a suid binary. Now it's really easy to jump to root using sudo. All you have to do is use ptrace to inject code into the user's shell in memory (in the case of GNOME running sudo, that's even easier) and then execute a malicious sudo command after the user has started their own sudo command. The credentials are good for more than one sudo so the user doesn't need to enter their password again.
So where's the rash of viruses for linux exploiting this hole? Oh, there isn't, because linux users don't actually download and run untrusted software. Therefore any argument about how linux is impervious to viruses is just stupid as there are no programs for the virus to infect.
If you actually knew anything about safe cracking you might have had more luck coming up with an analogy that wasn't just rediculous. For example, you might have compared Lockwood safes to, say, Pregex safes. Lockwood safes are very easy for an experienced safe cracker to get into, whereas Pregex safes are a bitch to get into. Chances are that a sophisticated crew of thieves will easily get into a Lockwood safe on-site and run away with your jewels. Whereas if they run into a Pregex safe they're likely to try hitting it with a sledge hammer and when that doesn't work they'll either have to carry the damn thing out with them or just go home empty handed. Which is the better safe? Given infinite time and resources a Lockwood safe will win any test you want to throw at it but the largely unknown Pregex safe will actually protect your jewels from real thieves.
usenet. Right. Not root ftp sites. Ok.
Oh, I see, you don't even know what a virus is. No wonder Mac users think they are invincible.
Have you considered that maybe you just hung out with pussies?
Ha! Most of your argument sounds like you're arguing for Windows, not against it. Modular vs Monolithic, hmmm, where have I heard this before.. oh yeah. Linus vs Tanenbaum.
I could cite many examples of these, but surely you can think of some on your own with modest effort.
No. And that's the specific question I asked. What part of the fundamental design of Windows is responsible for its apparent bad security? That's your claim, that the fundamental design of Windows is rotten and therefore we have to throw out the whole apple, so tell us already. Stop skirting around.
What's hard? Run software as a non-administrator. Just like you do on a linux box. People complaining about Microsoft being insecure whilst they're running untrusted apps as administrator are just brain dead.. end of story.
These people would have been owned and disconnected within hours of this being discovered. With the changing of the guard, so too does the changing of morality.
Because then you don't have a computer, you have a toaster. People need to install new programs and device drivers. Otherwise their general purpose computer becomes an appliance. The corporate method of security is to restrict these operations to administrators who are trusted to install software from trusted sources only. Guess what? These corporations use Windows. So what's your big plan for how to secure the operating system for people who don't have a dedicated administrator? Don't say education, because that's hardly Microsoft's problem.
A Mac Mini costs $500, you couldn't contract someone to write a virus for Windows, let alone OS-X for that much. I think I'm being more than reasonable. If I fail, you get your Mac back and you get a valuable piece of amunition in your quest to tell the world how impervious Macs are to virus attack. I'm only willing to do it because you're an idiot if you think it's hard to make a virus for a Mac. It's just a computer, like every other computer. There are viruses for other unixes, what makes you think Darwin is somehow special?
Universal bug tracking. That's the goal of the Malone project. And yes, it's sorely needed.
vx = virus exchange. Basically stamp collecting for computer geeks.
But that's not a fair analogy because there is no computer system that can stand up to it. Yes it is Microsoft's fault, but it's also the rest of the software industry's fault because we simply don't have the ability to make secure software. Maybe oneday we will, but until then, stop dreaming.
Obviously you'd expect the designers to reply to a question like that with "yes, of course you'll be required to buy the upgrades and if you don't you'll soon feel the back of my hand across your face bitch! Now bend over and grab your ankles." Jesus. How stupid are you? If all your friends are off enjoying the new content and you're stuck in the "common area" playing with, well, yourself then obviously you're going to feel the need to buy the expansion pack, or you're going to quit and run around telling everyone who will listen that the game sucks ass and that's why you quit.
The reason the prize went unclaimed is because, like most security prizes, the people running it were scumbags who kept changing the rules after they made the offer. They then pulled the offer because someone was about to win it and claimed they were responding to overwhelming public pressure. You want a virus for Mac OS X? Send me a Mac and I'll make you one. Seriously. Courier a Mac to me and I'll have it ready for you in a week. If I don't complete the task I'll courier the Mac back to you. Otherwise I get to keep the Mac. Ok?
Feel free to check my qualifications. I know what I'm talking about.
Sensible defaults really is something Microsoft needs to work on, but it hardly makes Windows insecure by design which is the claim people always make. As for NTFS and programs overwriting your files with garbage, what's that got to do with security and how is it any different to *nix? Sure, it'd be great if program access to the filesystem could be constrained, but I havn't seen any OS that provides this capability.
You're the second person to mention patches. We're not talking about individual security bugs. We're addressing the claim that Windows isn't secure by design.
Sigh. No it doesn't. It lies on the people making the worms. Really, it does. I used to be like you. I've slowly come to realise that it's just tall poppy syndrome. Worms exist for Windows not because it is more or less insecure than anything else. They exist because it is the biggest target and therefore people put more time into figuring out how to attack it. If Mac OS X were the #1 operating system we'd see more worms for Mac OS X. If some flavour of Linux were the #1 operating system we'd see more worms for it. If you want an historical validation of this theory, take a look at the first worms that spread across the internet. They were for SunOS 5 and other Unix systems. Does this mean that Apple II's and C64s were more secure than Unix systems? Of course not. I means that Unix systems were a more attractive target, and that's what the malware writers went for.
That's news to me man. If you don't put your user account in the administrators group the account has no special privileges. That doesn't mean the user can't download and run trojans that can destroy their user files, but that's no different to *nix. You can't heap everything onto the manufacturer of the software. On the other hand, every OS (except maybe openbsd) has serious local exploits that malware can take advantage of. But nothing short of open sourcing Windows and seeding a massive community to maintain it will fix that.
What design decisions are they exactly? Can you be more specific or are you just repeating some rambling that some security "expert" you heard said.
This comment, and others like it, are completely lame. It is possible to use Windows securely, but most people don't. This isn't Microsoft's fault. You can just keep repeating an argument made by people 10 years ago as if it still applies to today.
By freely I mean "out of their physical control". If you had to enter a music booth to listen to music and they had people to pay you down for tape recorders, then their business would be no different to any other business, where you have to enter someone's shop to buy their goods. If bakers sold their bread like muscians try to sell their music, they'd get up at dawn, bake the bread and then leave it in the market square with a sign that says "bakers must be paid before bread can be eaten". Everyone would laugh at the bakers for being so stupid and eat their bread without paying for it.. and that's the situation muscians are in. So what should we do? Setting up a quasi-official police force to roam from house to house ensuring that no-one is eating bread they havn't paid for, or put the burden of ensuring the bakers get paid back where it belongs, on the bakers sholders?
Sure, and that's why any sensible shop owner asks for the money first before they provide a service to children, or they insist that children be accompanied by an adult.
No. The point is that when you sit down to get a haircut you enter into a contract to pay for it and therefore the barber has a right to expect to be paid. This isn't the case when it comes to music/movies/software creators. They make what they create freely available and then demand payment without entering into a contract with anyone. Besides which, even in our theoretical barber case it's still not theft. It's a breach of contract.
Abe was obsessed with protecting the people affected by their experiment. He felt guilty for screwing up Aaron's life and hated Aaron for not caring. If you had to give up being with your wife you'd be pretty upset wouldn't you? Notice how Aaron wasn't?
As for the writing and the ear bleeds.. everything has side-effects. Those were just two.