But the new users created at the install screen have administrative privledge. You have to go to the control panel and manually remove it. And the password is blank by default. You are not even prompted to create a password (at least for all the XP Pro installs IIRC I've done). Personally, since these (the ones I work on) are machines intended for a business environment, I just reboot at the create users screen (reset switch since the F'ing cancel isn't available) and bypass it. You then proceed to a standard win2k login prompt.
And on the subject of tripwire, $325/machine is expensive. The Dot.com days are gone. That's one reason why Linux is making so much headway.
If you could point me to a cheap/free checksum app (win32), I'd much appreciate it.
Le Groupe Videotron Ltee VL-9BL (NET-66-130-0-0-1)
66.130.0.0 - 66.131.255.255 Le Groupe Videotron Ltee VL-D-QS-4282CE00 (NET-66-130-206-0-1)
66.130.206.0 - 66.130.206.255
# ARIN WHOIS database, last updated 2004-05-01 19:15 # Enter ? for additional hints on searching ARIN's WHOIS database.
The problem is users under XP run as administrator by default (with no password).
That and have you seen the price for tripwire for windows? Under Linux it's free. Under windows, it's out of reach for most users ($$$$). At least last time I checked. BTW Norton Anti Virus used to have a checksum utility back in the old days. It was removed somewhere about NAV2000 IIRC.
Where do you find the list of shit that windows needs just to boot. So you don't BSOD your machines with a GP? And then can't undo the GP because it won't boot far enough to execute the GP.
Honest question. If you have the answer. Thanks in Advance. I'd love to implement this in several companies I manage.
I vote libertarian almost exclusively in local and state elections where it may make some difference. Nobody on this planet wishes there was a viable 3rd party candidate than I do, but I'll not make the same mistake again and unfortunately help to select GWB.
This may have been a viable business plan 4 years ago. But today, I'll venture a guess that 90% of people who want to view DVDs on their *nix box already have a player that they had to install manually.
What is the incentive to buy a "licensed" DVD player?
I had Test 2 installed on my laptop. Worked good after install. UptoDate gave me a message Up2Date needed to be updated (manually). I updated it (manually). The it indicated I needed an additional 100+ MB of updates. WTF? So stupid me I ran it. Won't boot now. So, I've been waiting for Test 3. Downloading now. Bittorrent.
Compaq Proliant 1600 running software mirror (I didn't do it).
KB articles about compaq and the raid driver were known w/ NT SP6 SRP.
Waited 6 months. No KB articles about the scsi (not the raid) driver.
Installed SRP about midnight (security Rollup pack).
BSOD.
Rescue install replaced overwritten files. Nada. Many many other things tried. Compaq clueless.
Nothing on google. Nothing in MS KB. Finally called MS (about 3 AM). While giving CC info, tried one last thing. Broke software mirror with 2K rescue install. Bingo.
Canceled the support call (saved myself $250). Called back Compaq, told them the solution to their problem.
I don't know if it's true, but I've been told that articles don't make it into the public KB until they've had 50 support calls for the same issue.
Maybe presenting some reformed hackers as semi-normal people will help change the public preception of "hackers" in general.
Maybe even a few people in the general public will become enlighted to some of the issues involving computer security: Microsoft's lip service to security, public bashing of Linux, the dangers of a monoculture and the magnitude of un-patched end user's systems to name just a few.
We can only hope.
The simple fact that it is from ZDnet.com.au speaks volumes as to the bias here in America.
So RealSecure and Proventia are pieces of shit too?
I've used Black ICE (not in years) among other firewall and IDS software. Many have had security issues. Norton PFW active X exploit (recent), Zone Alarm, etc.
Please show me a firewall product that has been perfect "out of the box" and never needed an update or a patch. I'll be the first one to run it. Thanks.
So what you're saying is that more users should install those patches that Microsoft emails to them? That's a joke.
Have you ever had a new Microsoft patch BSOD your server? I remember a BSOD caused by NT 4 Service Pack 6 and another (on another server) by NT 4 Post SP6a SRP (Security Rollup Package).
Not everyone has non-production test systems (which are duplicates of production systems) to beta test patches on.
I am far more cautious today deploying patches on Microsoft system than I have been in the past.
I use a method similar to @RISK: The Consensus Security Vulnerability Alert (from sans.org). I "keep my ear to the ground" Bugtrack for problems with the fixes for the problems. I use "test deployments" (patch a few systems to see if a problem develops).
With a bit of caution and lag time, all systems I manage are patched to current.
This isn't a troll. I just want to point out that since the US eased the export of 128-bit ecrryption technology (there may be a reason why). Like it can be cracked if they are interested enough to look. If I remeber right (god damn altimerzers) 56 bit RSA is really weakened to 40 bit in the way it is hashed.
Slashdot Mirror
But the new users created at the install screen have administrative privledge. You have to go to the control panel and manually remove it. And the password is blank by default. You are not even prompted to create a password (at least for all the XP Pro installs IIRC I've done). Personally, since these (the ones I work on) are machines intended for a business environment, I just reboot at the create users screen (reset switch since the F'ing cancel isn't available) and bypass it. You then proceed to a standard win2k login prompt.
And on the subject of tripwire, $325/machine is expensive. The Dot.com days are gone. That's one reason why Linux is making so much headway.
If you could point me to a cheap/free checksum app (win32), I'd much appreciate it.
Thanks,
The problems is most luser just click "yes" (install, trust, etc) to any dialog box they see.
66.130.206.191 (modemcable191.206-130-66.mc.videotron.ca) : whois.arin.net
) : whois.arin.net
Le Groupe Videotron Ltee VL-9BL (NET-66-130-0-0-1)
66.130.0.0 - 66.131.255.255
Le Groupe Videotron Ltee VL-D-QS-4282CE00 (NET-66-130-206-0-1)
66.130.206.0 - 66.130.206.255
# ARIN WHOIS database, last updated 2004-05-01 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
68.62.154.154 (pcp08146547pcs.tsclos01.al.comcast.net) : whois.arin.net
Comcast Cable Communications, Inc. JUMPSTART-1 (NET-68-32-0-0-1)
68.32.0.0 - 68.63.255.255
Comcast Cable Communications, Inc. TUSCALOOSA-3 (NET-68-62-128-0-1)
68.62.128.0 - 68.62.159.255
# ARIN WHOIS database, last updated 2004-05-01 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
4.64.159.82 (atlnga1-ar3-4-64-159-082.atlnga1.dsl-verizon.net
Genuity GNTY-4-0 (NET-4-0-0-0-1)
4.0.0.0 - 4.255.255.255
GTE Intelligent Network Services GTEINS-64-152-30 (NET-4-64-152-0-1)
The problem is users under XP run as administrator by default (with no password).
That and have you seen the price for tripwire for windows? Under Linux it's free. Under windows, it's out of reach for most users ($$$$). At least last time I checked. BTW Norton Anti Virus used to have a checksum utility back in the old days. It was removed somewhere about NAV2000 IIRC.
Where do you find the list of shit that windows needs just to boot. So you don't BSOD your machines with a GP? And then can't undo the GP because it won't boot far enough to execute the GP.
Honest question. If you have the answer. Thanks in Advance. I'd love to implement this in several companies I manage.
It is spelled correct.
He was "selected" by the Supreme Court, not "elected" by the American People.
Hence selected vs. elected.
Don't tell me you didn't know that.
I could be wrong, but I believe the CIA is banned from "watching" US citizens within the US.
Again I could be wrong, but none of the highjackers were US citizens.
Please correct me if I'm wrong. Thanks.
I vote libertarian almost exclusively in local and state elections where it may make some difference. Nobody on this planet wishes there was a viable 3rd party candidate than I do, but I'll not make the same mistake again and unfortunately help to select GWB.
Bush Jr. became president with less than half the vote.
Matter of fact, he was selected with less than the majority of the votes.
So what's your point?
That Nader split the vote and allowed Bush Jr. to be selected?
I urge everyone who is offended by the unConstitutional Patriot Act to join the ACLU.
I've been a member for 7 years.
Do I agree with all of their policies or positions? No. Do I disagree with some of their positions? Yes.
But they are dedicated to defending the Constitution unlike many who have sworn to uphold and defend it, but work to undermine and destroy it.
$25 is it too much to ask?
I also suggest everyone here join the EFF.
Not only did I join the EFF, I offered to volunteer my time.
(This statement is Not directed at members of the military, rather members of the Executive Branch of the US Govmint).
I will endeavor to Never Vote For Anyone Who Voted For the PATRIOT Act.
I just wish there was a viable alternative to Kerry & Bush then I could remove endeavor to from the above statement.
My bad. Just got done reading the RIAA story.
Post should have been:
$$$$-->MPAA
$$$$->RIAA
This may have been a viable business plan 4 years ago. But today, I'll venture a guess that 90% of people who want to view DVDs on their *nix box already have a player that they had to install manually.
What is the incentive to buy a "licensed" DVD player?
So that you're not violating a corrupt law?
Two letters.
OJ
Money can buy you a LOT of Justice, Laws, etc.
I had Test 2 installed on my laptop. Worked good after install. UptoDate gave me a message Up2Date needed to be updated (manually). I updated it (manually). The it indicated I needed an additional 100+ MB of updates. WTF? So stupid me I ran it. Won't boot now. So, I've been waiting for Test 3. Downloading now. Bittorrent.
Compaq Proliant 1600 running software mirror (I didn't do it).
KB articles about compaq and the raid driver were known w/ NT SP6 SRP.
Waited 6 months. No KB articles about the scsi (not the raid) driver.
Installed SRP about midnight (security Rollup pack).
BSOD.
Rescue install replaced overwritten files. Nada. Many many other things tried. Compaq clueless.
Nothing on google. Nothing in MS KB. Finally called MS (about 3 AM). While giving CC info, tried one last thing. Broke software mirror with 2K rescue install. Bingo.
Canceled the support call (saved myself $250). Called back Compaq, told them the solution to their problem.
I don't know if it's true, but I've been told that articles don't make it into the public KB until they've had 50 support calls for the same issue.
50x250=$12500
Can you say Support Tax?
I believe Office 97 and below are no longer supported. Therefore no future patches.
f h; en-us;LifeOfficeFam
http://support.microsoft.com/default.aspx?scid=
Will office 97 be vulnerable to future bugs????
Will Microsoft release a patch for it if it is? I believe the answer is No.
Last patch was:
Microsoft Security Bulletin MS03-050
Vulnerability in Microsoft Word and Microsoft Excel Could Allow Arbitrary Code to Run (831527)
Issued: November 11, 2003
Support ended: 16-Jan-2004
However in all fairness, most Microsoft Office users are probably running unpatched (to current) anyway.
Maybe presenting some reformed hackers as semi-normal people will help change the public preception of "hackers" in general.
Maybe even a few people in the general public will become enlighted to some of the issues involving computer security: Microsoft's lip service to security, public bashing of Linux, the dangers of a monoculture and the magnitude of un-patched end user's systems to name just a few.
We can only hope.
The simple fact that it is from ZDnet.com.au speaks volumes as to the bias here in America.
Typical for /. I didn't RTFA and I posted anyway.
/.) of RH was worth reading.
/. effect. You know negative page hits instead of positive. Maybe we should contact Diebold...
Actually, reading the summary, I concluded it wasn't worth reading. However, the discussion (on
Too bad there isn't a reverse
Wrong.
Now I don't want to give anyone "bad" any ideas, but wouldn't it be wise to exclude this IP block explicitly from your malware?
So RealSecure and Proventia are pieces of shit too?
I've used Black ICE (not in years) among other firewall and IDS software. Many have had security issues. Norton PFW active X exploit (recent), Zone Alarm, etc.
Please show me a firewall product that has been perfect "out of the box" and never needed an update or a patch. I'll be the first one to run it. Thanks.
So what you're saying is that more users should install those patches that Microsoft emails to them? That's a joke.
Have you ever had a new Microsoft patch BSOD your server? I remember a BSOD caused by NT 4 Service Pack 6 and another (on another server) by NT 4 Post SP6a SRP (Security Rollup Package).
Not everyone has non-production test systems (which are duplicates of production systems) to beta test patches on.
I am far more cautious today deploying patches on Microsoft system than I have been in the past.
I use a method similar to @RISK: The Consensus Security Vulnerability Alert (from sans.org). I "keep my ear to the ground" Bugtrack for problems with the fixes for the problems. I use "test deployments" (patch a few systems to see if a problem develops).
With a bit of caution and lag time, all systems I manage are patched to current.
When you assume you make an ASS out of U am ME.
This isn't a troll. I just want to point out that since the US eased the export of 128-bit ecrryption technology (there may be a reason why). Like it can be cracked if they are interested enough to look. If I remeber right (god damn altimerzers) 56 bit RSA is really weakened to 40 bit in the way it is hashed.
See http://cacr.math.uwaterloo.ca/hac