This, as I understand it, is the purpose of a UDP.
You hurt the company (a few execs) by pissing off the millions of users. @home has already shown that they ignore repeated requests by other admins to stop the abuse, hopefully they will listen to their customers.
What traffic I, or any other admin, allows to pass through our networks is our business. Our companies own the equipment and we maintain it. I can block any and all traffic coming from @home if I so choose.
Oh so if i want to send mail to one of my friends on one of those server I can't... oh wait, your just stupid.
No, he's not stupid. He was saying that your ISP (hopefully) has their mail server configured so that someone who is not a subscriber can not send mail out through their SMTP server. If they didn't, they would be an open relay. Many admins block incoming mail from known open relays (I do for instance) because much of the spam coming into their network comes from open relays.
For example, if your ISP did not block non-subscribers from sending messages out through their SMTP server, you could not send email to me.
Maybe I'm not understanding how this Windows Update thing works since I've never used it.
Frest install of RH6.0 onto my girlfriend's computer (dont' ask why, she requested RH). Took about 20 minutes.
1. Boot up the computer straight to X 2. Along the left side of the screen is a an icon of a little man with a hat, underneath reads "Red Hat Errata". 3. Clicking the little man takes me to a website with a list of every package which has been upated, along with a fairly detailed description of why it's being updated. 4. Click the link of the package I want to update. Choose to save it to the default directory that comes up. 5. Once downloaded I follow the simple instructions that were printed right under the link on the webpage, type: rpm =Uvh * 6. Now have completely updated system.
What is the difference between this and this Windows Update page? I had to type a command into the evil command line? Guess I could have taken an extra 5 seconds to create a "shortcut" so that I could click it.
Linux is not that easy to setup securely. And obviously, looking at the LONG list of non-standard changes made to the NT box, neither is NT.
The point of this test is moot, since really neither OS was compromised. It was a flawed CGI script, just like the one that brought down Hotmail.
Like many others have said already. Pay up to the guy that got in. Then fix the flawed CGI (or release the source so that somebody who's competant can), and run it again. Once all the bugs are gone from the "add-ons" on both servers, then maybe we'll begin to see which is the more secure and stable OS.
I admin both NT and Linux boxes at work. I know which of the two I can rely on to stay running and keep unwanteds out. I don't think it makes me a "Linux Zealot", perhaps it just means I find Linux easier and more intuitive to admin. If somebody else finds NT to be more stable and secure for them, more power to them.
Perhaps this is a stupid question, but how many people who are planning to use w2k will be using it strictly for web hosting on port 80 with NO OTHER SERVICES RUNNING?
Every place that I've worked which runs NT uses it for more than just web hosting, it's also an FTP, mail, DNS, file server, and serveral other services as well.
In this case they're not testing the OS as it would be used in the real world. Many places can't afford the licenseing and software to split the services up on several machines.
This is not a Linux rules, MS sucks thing. I use both in my job, as well as Windows and MACs. All have their place. I'd like to know how W2K is going to standup in the real world. I don't care how many people are trying to break in at once or how many hits the server is getting, it shouldn't need a reboot, especially because the "logs are full". That should be true of any server OS. Perhaps that's just poor sys admining though, since a good admin would be setup to have those logs trimmed automatically before they got too large.
Personally I think it's just a PR thing for MS. Take a box and lock it down as tight as possible, to the point of being unusable in the real world, and see if somebody can break in. If nobody does they can say W2K is secure. If somebody does get in, they can blame it on a bug in IIS, not on W2K itself.
I think it would be safe to say that the majority of exploit programs like this ARE designed to attack "other" operating systems, primarily Unix. Every Unix admin I know hasa copy of Satan at their fingertips, and use it.
As to your other point, a default install of Linux wouldn't stand up against programs designed specifically to exploit them, that's what patches are for. The difference between patching the holes in Linux (and most unices) and Windows is the time between when the exploit is announced and when the patch is available. Most of the stuff BO is taking advantage of has been known about for quite a while and there is still no patch. Most exploits on Linux are patched within a couple days, often within a few hours.
"It is if they can't figure out why the hell some obscure flag set in/etc keeps them from doing something."
These same users would have just as much trouble figuring out why some obscure check box in Control Panel keeps them from doing something.
I was running Linux before I was running Windows (used DOS before that). So to me, Linux is easier and friendlier to use. I think if you took two average Joe Users and set one down in front of Windows and the other in front of Linux, both would learn and become proficient in their respective OS's just as quickly (or slowly as the case may be).
I work at an ISP. I've lost count how many users I've told to bring in their systems so that I could setup a dialup networking connection because they were so helpless they couldn't even be walked through it. Most of them are afraid to click anything on the screen because the last time they did it they ended up taking their machine back to the shop so Windows could be reinstalled.
Slashdot Mirror
This, as I understand it, is the purpose of a UDP.
You hurt the company (a few execs) by pissing off the millions of users. @home has already shown that they ignore repeated requests by other admins to stop the abuse, hopefully they will listen to their customers.
What traffic I, or any other admin, allows to pass through our networks is our business. Our companies own the equipment and we maintain it. I can block any and all traffic coming from @home if I so choose.
Oh so if i want to send mail to one of my friends on one of those server I can't... oh wait, your just stupid.
No, he's not stupid. He was saying that your ISP (hopefully) has their mail server configured so that someone who is not a subscriber can not send mail out through their SMTP server. If they didn't, they would be an open relay. Many admins block incoming mail from known open relays (I do for instance) because much of the spam coming into their network comes from open relays.
For example, if your ISP did not block non-subscribers from sending messages out through their SMTP server, you could not send email to me.
Maybe I'm not understanding how this Windows Update thing works since I've never used it.
Frest install of RH6.0 onto my girlfriend's computer (dont' ask why, she requested RH). Took about 20 minutes.
1. Boot up the computer straight to X
2. Along the left side of the screen is a an icon of a little man with a hat, underneath reads "Red Hat Errata".
3. Clicking the little man takes me to a website with a list of every package which has been upated, along with a fairly detailed description of why it's being updated.
4. Click the link of the package I want to update. Choose to save it to the default directory that comes up.
5. Once downloaded I follow the simple instructions that were printed right under the link on the webpage, type: rpm =Uvh *
6. Now have completely updated system.
What is the difference between this and this Windows Update page? I had to type a command into the evil command line? Guess I could have taken an extra 5 seconds to create a "shortcut" so that I could click it.
John
Linux is not that easy to setup securely. And obviously, looking at the LONG list of non-standard changes made to the NT box, neither is NT.
The point of this test is moot, since really neither OS was compromised. It was a flawed CGI script, just like the one that brought down Hotmail.
Like many others have said already. Pay up to the guy that got in. Then fix the flawed CGI (or release the source so that somebody who's competant can), and run it again. Once all the bugs are gone from the "add-ons" on both servers, then maybe we'll begin to see which is the more secure and stable OS.
I admin both NT and Linux boxes at work. I know which of the two I can rely on to stay running and keep unwanteds out. I don't think it makes me a "Linux Zealot", perhaps it just means I find Linux easier and more intuitive to admin. If somebody else finds NT to be more stable and secure for them, more power to them.
john
Perhaps this is a stupid question, but how many people who are planning to use w2k will be using it strictly for web hosting on port 80 with NO OTHER SERVICES RUNNING?
Every place that I've worked which runs NT uses it for more than just web hosting, it's also an FTP, mail, DNS, file server, and serveral other services as well.
In this case they're not testing the OS as it would be used in the real world. Many places can't afford the licenseing and software to split the services up on several machines.
This is not a Linux rules, MS sucks thing. I use both in my job, as well as Windows and MACs. All have their place. I'd like to know how W2K is going to standup in the real world. I don't care how many people are trying to break in at once or how many hits the server is getting, it shouldn't need a reboot, especially because the "logs are full". That should be true of any server OS. Perhaps that's just poor sys admining though, since a good admin would be setup to have those logs trimmed automatically before they got too large.
Personally I think it's just a PR thing for MS. Take a box and lock it down as tight as possible, to the point of being unusable in the real world, and see if somebody can break in. If nobody does they can say W2K is secure. If somebody does get in, they can blame it on a bug in IIS, not on W2K itself.
I think it would be safe to say that the majority of exploit programs like this ARE designed to attack "other" operating systems, primarily Unix. Every Unix admin I know hasa copy of Satan at their fingertips, and use it.
As to your other point, a default install of Linux wouldn't stand up against programs designed specifically to exploit them, that's what patches are for. The difference between patching the holes in Linux (and most unices) and Windows is the time between when the exploit is announced and when the patch is available. Most of the stuff BO is taking advantage of has been known about for quite a while and there is still no patch. Most exploits on Linux are patched within a couple days, often within a few hours.
Cernnunous
"It is if they can't figure out why the hell some obscure flag set in /etc keeps them from doing something."
These same users would have just as much trouble figuring out why some obscure check box in Control Panel keeps them from doing something.
I was running Linux before I was running Windows (used DOS before that). So to me, Linux is easier and friendlier to use. I think if you took two average Joe Users and set one down in front of Windows and the other in front of Linux, both would learn and become proficient in their respective OS's just as quickly (or slowly as the case may be).
I work at an ISP. I've lost count how many users I've told to bring in their systems so that I could setup a dialup networking connection because they were so helpless they couldn't even be walked through it. Most of them are afraid to click anything on the screen because the last time they did it they ended up taking their machine back to the shop so Windows could be reinstalled.
Anyway, guess I'm just feeding the troll.