And you have no issues with an administration that has redefined "militant" to include virtually anyone? This whole "they are going to bomb us if we don't bomb them" is a very distorted and broken philosophy. More often than not that philosophy is provably false.
So it is only "American's killed in wars" that counts? The US has increasing it's military presence and killing in foreign countries, not reducing. Pakistan, Yemen, Iraq, Afghanistan, Africa, and now Syria are all being bombed by the US. US torture has not gone down, and the fact that we are complicit in spying on every nation including our own citizens does nothing to bolster a claim of a "peaceful" government, just that they can squash dissent before it reaches certain proportions (and control the media to make sure the narrative does not talk about things like Ferguson, OWS, or any other movement that threatens the entrenched.
Obama received the Nobel for rhetoric, not actions. If he had actually taken actions he discussed people would mostly ignore the topic.
Investigate what I said above about the forensics expert. Investigate CNN fabricating stories as "news". You are attempting, incorrectly I'll add, to conflate two issues into one issue. TFA and my comment were about the narrative and how it's being controlled.
You have more logical fallacies in your post than you do sentences.
The problem is that many things that are "obvious" to you are wrong. Did you inspect officer Wilson's injuries? The problem is that many things that are "obvious" to you are wrong. Did you inspect officer Wilson's injuries?
TFA and my argument was regarding the establishment abusing power in order to control the narrative. Officer Wilson's alleged injuries are not relevant. Worse, the officer was not reported to be harmed at the scene, received no medical treatment on the scene, or even after he was removed from the location. So you start with a Strawman and cum hoc ergo propter hoc, then move to Argumentum ad verecundiam and appeal to assertion.
Do you deny officer's the right to self defense? Or is it open season for police officers for you?
Ahh, the ole ad hominem based on a argumentum ad misericordiam. Obviously if I'm against police brutality I must be supporting people randomly shooting cops, because there is no place between those two points.
I guess we know now.
Argumentum ad populum, or perhaps argumentum ad numerum. No you don't know, and no the populace does not agree with you.
Will no one rid me of the troublesome priest?
False dichotomy based on previous fallacy arguments. There are countless options in between promoting vigilante killing of dirty police and allowing police free reign to abuse the populace they are sworn to protect.
Would you care to go another round shill? I do mean shill with all of it's interesting implications, since whether you are paid or not you have a history of arguing as a pro-establishment mouth piece.
You completely missed the point in my GP about controlling narrative. I don't trust CNN as far as I can spit. In fact the one of the forensics experts was on the local radio here (910AM in the Bay Area) and has threatened to sue at least one media outlet for fabricating information and taking some of her work out of context, taking quotes from an off the record interview and using those with evidence instead of the correct quotes.
CNN has a very long history of fabricating stories as "news" and being an establishment mouthpiece, not "news".
Oh, and eye witness reports make no claim that the guy was attacking a cop. Perhaps you have never seen a lying cop, or an aggressive cop? Even as a white male you don't have to try that hard to find that type of cop.
As others have pointed out the Cop did not know about the robbery so it was not a factor. Now, let us say he did.. was it armed robbery? No. Even if the Cop knew about the robbery deadly force was not required. Every police department I know of has non-lethal weapons and more than 1 officer, meaning that there are obvious options outside of shooting to kill.
Though unfortunate, I believe you are correct. There is a lot of abuses in Ferguson which should have already landed officials in jail, outside of the obvious. Police have repeated targeted journalists, even firing Tear Gas directly at an Al Jazeera TV crew, and after chasing them away turned off their cameras and turned down their lights. RT and Infowars also had crews attacked by police. Before you "but but those guys are *insert something silly* they provide information which no other agency is providing.
People in power _WANT_ to take out media so that the only thing people see is what they script. They want the issue to be black vs. white, because if it looks that way instead of corruption people poke at each other instead of looking at officials. The agenda behind all of this is easy to see, because they do it all the time. Citizen and Blog media is blowing their cover, and they really hate it.
Back on point, they have already said that the cop that shot Michael Brown would probably not face any charges, even what should be obviously excessive use of force. So the trend of Police brutality and corruption will continue, until of course people just start killing dirty cops. I don't advocate vigilantism, but at a certain point people will see there is no choice.
AFAIK what you are describing is surely possible, but I'm wondering if it's illegal. "Alquada_terrorist_network" may be offensive, but not assuming the ID of anyone. Yes, possible so I stand corrected.
I think for the most part we agree, but I still disagree that you can't know if "Free_Hotel" WIFI is legit, since every Hotel I have been in has information in numerous places about their WIFI. Airports too, and shopping malls, etc... I could probably trap a whole mess of people in a Hotspot "Free_Airport_Porn", but anyone checking with the airport should know that this is not an Airport provided WIFI network. In fact they busted some guy just last week with a Hotspot because it had a name that included Al Quada somewhere (no charges filed), so some people do pay attention.
You still have not demonstrated that a Client can hack a Server (and won't be able to), which as I stated means that Best Practices fixes issues for companies. If you are running DHCP, secure it! Both on the client and the server side.
People connecting to "any" Wifi they can find should have an expectation that they are going to be hacked. In fact if I own a DHCP server as a bad guy, you have more serious problems than me getting a shell on your laptop. I can MITM every connection you make so would not brute force in except as a last resort. I'd steal all your credentials and activities first..
"Debian" is a rather generic statement. Instead of presenting information that is false based on a generalization why not work on your own pathetic communication ability. Oh, I know.. it's much easier to troll. Asshole!
So what you are telling me is that your wifi client automatically connects to any available network automatically? Okay, but if you get hacked that is not a Bash problem. My WIFI does not connect to any random network, I have to take action to connect. Get a new WIFI client or secure what you have, problem solved.
I was just going to quote Patches O'Hoolihan an say "You're about as useful as a poopy flavored lollipop."
Then I was going to ask if anyone else was concerned with this obvious brainwashing attempt for a pro systemd mindset? Between that, and all of the previous "You have to have it to be cool" and "all the cool guys are going to run it" arguments for systemd I'm going to start testing and auditing source code this weekend.
It may not have authentication, but it can surely be secured. Not to say your point is completely invalid, but it's not something that any business should really have to worry about because the DHCP Client does not hack the DHCP server.
Where your point has some validity is lets say a Laptop and a traveler. Going through the airport you could, if you wanted, connect to networks other than what the airport provides. So a bad guy can set up a rogue server and hotspot that you could connect to if you selected this network and told the application to connect. This should never be "automatic" and requires the user to change settings in everything I'm aware of. So let me go back and add user error to my list of reasons that shellshock was exploitable. Fair?
While surely there are serious bugs that are found, shellshock is not one on my list of "serious bugs". If you would have picked a different target, I may have taken less issue with your statement. Every exploit of "shellshock" requires either A) access to the system. or B) poor system administration/development (which in essence loops back to A).
Let's see how this is actually exploited from the same Wiki page.
CGI-based web server
If the request handler is a Bash script, or if it executes one for example using the system(3) call, Bash will receive the environment variables passed by the server and will process them as described above.
OpenSSH server
OpenSSH has a "ForceCommand" feature, where a fixed command is executed when the user logs in, instead of just running
DHCP servers A malicious DHCP server could provide, in one of these options, a string crafted to execute code on a vulnerable workstation or laptop.
QMail server Depending on the specific system configuration, a qmail mail server can pass external input through to Bash in a way that could exploit a vulnerable version
I added emphasis and snipped the quotes to the relevant portions, but you can read the whole Wiki if you have doubts.
As I stated in my opening, surely exploits exist but Shellshock was more noise than anything else. Yup it was a bug, but having it exposed to the Internet was not a Bash problem in and of itself. Shellshock was easy to avoid simply by using "Best Practices". If you are running your sites on a bunch of Bash CGI scripts, we knew that shell based CGI was a bad idea in the 90s. If you have a DHCP client attaching to unknown servers, shame on you. If you have arbitrary users with shell access to your hosts.. well, I guess it's possible that someone has this in their business model somewhere but it's surely not very common.
We manage many tens of thousands of websites, and even with "vulnerable bash" we could not exploit the bug unless we were logged in to a host. We tried really really hard to exploit it (at least 5 days of testing since they kept releasing patches), but we follow best practices.
I used to spend a ton of time doing nothing but scrutinizing source code. I used to not install things based on what I saw in the code, pretty commonly. I simply lack the time today, but wish I could make time for this. I have turned into a minimalist because I don't trust everything, which 15 years ago I thought was crazy.
That aside, at least with OpenSource I could try and make time. The source is there for scrutiny, we just need more eyes watching for problems. Compare this to closed source (as you stated) and you can't. What you may perceive as the OS looking to download a patch could easily be that OS uploading your passwords and credit card data. In fact go ahead and run one of those closed source OSes and dump all the traffic for a perfectly idle box.
You can read, puh leaze. I asked a question because the person wrote something that at best seemed misleading. If my interpretation of their statement was wrong, it would/could have been clarified. That did not happen.
Since you jump to this person's defense, I believe my assumption is fair that you are the same person. Numerous people here have personal sock puppet accounts, so this is not a novel or unexpected behavior.
If you didn't read the posts above mine and jumped in blind, that is _your_ fault. I responded to correct a false claim, your claim defended that post. That is how dialog works, and why there is post history so that you can determine context.
Well good news, this is the default, at least on Debian. In fact Debian doesn't even store journalctl logs, it fowards then straight through to rsyslog.
Of course, if you and literally every other Anon. Coward in this thread of posts knew what they were talking about, then it wouldn't exist.
The "anti-systemd" brigade seems to consist of a lot of people who have absolutely no idea what they're doing, let alone any idea of how Linux actually works.
To which I asked what version you ran, and you claimed "current production" which is Deb 7, and the installed packages demonstrate that you are warong.
In fact you claimed that I don't know what I'm talking about even though I proved you wrong numerous times. Continuing a lie will NOT make it the truth! A simple "Yup, I meant to claim that in beta/dev Debian it uses systemd, not in a production stable release" would have resolved the issue. Instead of doing this, you keep repeating a false claim that Debian 7 uses systemd as it's default init system.
The existence of a package page does not make it a package installed by default. Looking at the default packages list (or what's installed) determines the default. You lose, good day!
Public housing resulted from economic disparity and poverty, not building standards. It was a cheaper and safer option to make new "cheap" buildings that are tenant controlled than hand out checks every month which may not have gone to rent anyway. Wealth disparity and poverty causes riots and has caused governments to be toppled. A lack of affordable housing is a side effect of poverty, not a stand alone condition (with the rare exception of temporary housing loss due to a natural disaster, which in reality loops back to poverty).
Slashdot Mirror
And you have no issues with an administration that has redefined "militant" to include virtually anyone? This whole "they are going to bomb us if we don't bomb them" is a very distorted and broken philosophy. More often than not that philosophy is provably false.
So it is only "American's killed in wars" that counts? The US has increasing it's military presence and killing in foreign countries, not reducing. Pakistan, Yemen, Iraq, Afghanistan, Africa, and now Syria are all being bombed by the US. US torture has not gone down, and the fact that we are complicit in spying on every nation including our own citizens does nothing to bolster a claim of a "peaceful" government, just that they can squash dissent before it reaches certain proportions (and control the media to make sure the narrative does not talk about things like Ferguson, OWS, or any other movement that threatens the entrenched.
Obama received the Nobel for rhetoric, not actions. If he had actually taken actions he discussed people would mostly ignore the topic.
You are a Troll, and not a very good one.
Investigate what I said above about the forensics expert. Investigate CNN fabricating stories as "news". You are attempting, incorrectly I'll add, to conflate two issues into one issue. TFA and my comment were about the narrative and how it's being controlled.
You have more logical fallacies in your post than you do sentences.
The problem is that many things that are "obvious" to you are wrong. Did you inspect officer Wilson's injuries? The problem is that many things that are "obvious" to you are wrong. Did you inspect officer Wilson's injuries?
TFA and my argument was regarding the establishment abusing power in order to control the narrative. Officer Wilson's alleged injuries are not relevant. Worse, the officer was not reported to be harmed at the scene, received no medical treatment on the scene, or even after he was removed from the location. So you start with a Strawman and cum hoc ergo propter hoc, then move to Argumentum ad verecundiam and appeal to assertion.
Do you deny officer's the right to self defense? Or is it open season for police officers for you?
Ahh, the ole ad hominem based on a argumentum ad misericordiam. Obviously if I'm against police brutality I must be supporting people randomly shooting cops, because there is no place between those two points.
I guess we know now.
Argumentum ad populum, or perhaps argumentum ad numerum. No you don't know, and no the populace does not agree with you.
Will no one rid me of the troublesome priest?
False dichotomy based on previous fallacy arguments. There are countless options in between promoting vigilante killing of dirty police and allowing police free reign to abuse the populace they are sworn to protect.
Would you care to go another round shill? I do mean shill with all of it's interesting implications, since whether you are paid or not you have a history of arguing as a pro-establishment mouth piece.
You completely missed the point in my GP about controlling narrative. I don't trust CNN as far as I can spit. In fact the one of the forensics experts was on the local radio here (910AM in the Bay Area) and has threatened to sue at least one media outlet for fabricating information and taking some of her work out of context, taking quotes from an off the record interview and using those with evidence instead of the correct quotes.
CNN has a very long history of fabricating stories as "news" and being an establishment mouthpiece, not "news".
Oh, and eye witness reports make no claim that the guy was attacking a cop. Perhaps you have never seen a lying cop, or an aggressive cop? Even as a white male you don't have to try that hard to find that type of cop.
As others have pointed out the Cop did not know about the robbery so it was not a factor. Now, let us say he did.. was it armed robbery? No. Even if the Cop knew about the robbery deadly force was not required. Every police department I know of has non-lethal weapons and more than 1 officer, meaning that there are obvious options outside of shooting to kill.
Though unfortunate, I believe you are correct. There is a lot of abuses in Ferguson which should have already landed officials in jail, outside of the obvious. Police have repeated targeted journalists, even firing Tear Gas directly at an Al Jazeera TV crew, and after chasing them away turned off their cameras and turned down their lights. RT and Infowars also had crews attacked by police. Before you "but but those guys are *insert something silly* they provide information which no other agency is providing.
People in power _WANT_ to take out media so that the only thing people see is what they script. They want the issue to be black vs. white, because if it looks that way instead of corruption people poke at each other instead of looking at officials. The agenda behind all of this is easy to see, because they do it all the time. Citizen and Blog media is blowing their cover, and they really hate it.
Back on point, they have already said that the cop that shot Michael Brown would probably not face any charges, even what should be obviously excessive use of force. So the trend of Police brutality and corruption will continue, until of course people just start killing dirty cops. I don't advocate vigilantism, but at a certain point people will see there is no choice.
AFAIK what you are describing is surely possible, but I'm wondering if it's illegal. "Alquada_terrorist_network" may be offensive, but not assuming the ID of anyone. Yes, possible so I stand corrected.
I think for the most part we agree, but I still disagree that you can't know if "Free_Hotel" WIFI is legit, since every Hotel I have been in has information in numerous places about their WIFI. Airports too, and shopping malls, etc... I could probably trap a whole mess of people in a Hotspot "Free_Airport_Porn", but anyone checking with the airport should know that this is not an Airport provided WIFI network. In fact they busted some guy just last week with a Hotspot because it had a name that included Al Quada somewhere (no charges filed), so some people do pay attention.
You still have not demonstrated that a Client can hack a Server (and won't be able to), which as I stated means that Best Practices fixes issues for companies. If you are running DHCP, secure it! Both on the client and the server side.
People connecting to "any" Wifi they can find should have an expectation that they are going to be hacked. In fact if I own a DHCP server as a bad guy, you have more serious problems than me getting a shell on your laptop. I can MITM every connection you make so would not brute force in except as a last resort. I'd steal all your credentials and activities first..
"Debian" is a rather generic statement. Instead of presenting information that is false based on a generalization why not work on your own pathetic communication ability. Oh, I know.. it's much easier to troll. Asshole!
So what you are telling me is that your wifi client automatically connects to any available network automatically? Okay, but if you get hacked that is not a Bash problem. My WIFI does not connect to any random network, I have to take action to connect. Get a new WIFI client or secure what you have, problem solved.
I was just going to quote Patches O'Hoolihan an say "You're about as useful as a poopy flavored lollipop."
Then I was going to ask if anyone else was concerned with this obvious brainwashing attempt for a pro systemd mindset? Between that, and all of the previous "You have to have it to be cool" and "all the cool guys are going to run it" arguments for systemd I'm going to start testing and auditing source code this weekend.
Huh? First of all, DHCP has no authentication.
It may not have authentication, but it can surely be secured. Not to say your point is completely invalid, but it's not something that any business should really have to worry about because the DHCP Client does not hack the DHCP server.
Where your point has some validity is lets say a Laptop and a traveler. Going through the airport you could, if you wanted, connect to networks other than what the airport provides. So a bad guy can set up a rogue server and hotspot that you could connect to if you selected this network and told the application to connect. This should never be "automatic" and requires the user to change settings in everything I'm aware of. So let me go back and add user error to my list of reasons that shellshock was exploitable. Fair?
While surely there are serious bugs that are found, shellshock is not one on my list of "serious bugs". If you would have picked a different target, I may have taken less issue with your statement. Every exploit of "shellshock" requires either A) access to the system. or B) poor system administration/development (which in essence loops back to A).
Let's see how this is actually exploited from the same Wiki page.
CGI-based web server
If the request handler is a Bash script, or if it executes one for example using the system(3) call, Bash will receive the environment variables passed by the server and will process them as described above.
OpenSSH server
OpenSSH has a "ForceCommand" feature, where a fixed command is executed when the user logs in, instead of just running
DHCP servers
A malicious DHCP server could provide, in one of these options, a string crafted to execute code on a vulnerable workstation or laptop.
QMail server
Depending on the specific system configuration, a qmail mail server can pass external input through to Bash in a way that could exploit a vulnerable version
I added emphasis and snipped the quotes to the relevant portions, but you can read the whole Wiki if you have doubts.
As I stated in my opening, surely exploits exist but Shellshock was more noise than anything else. Yup it was a bug, but having it exposed to the Internet was not a Bash problem in and of itself. Shellshock was easy to avoid simply by using "Best Practices". If you are running your sites on a bunch of Bash CGI scripts, we knew that shell based CGI was a bad idea in the 90s. If you have a DHCP client attaching to unknown servers, shame on you. If you have arbitrary users with shell access to your hosts.. well, I guess it's possible that someone has this in their business model somewhere but it's surely not very common.
We manage many tens of thousands of websites, and even with "vulnerable bash" we could not exploit the bug unless we were logged in to a host. We tried really really hard to exploit it (at least 5 days of testing since they kept releasing patches), but we follow best practices.
I used to spend a ton of time doing nothing but scrutinizing source code. I used to not install things based on what I saw in the code, pretty commonly. I simply lack the time today, but wish I could make time for this. I have turned into a minimalist because I don't trust everything, which 15 years ago I thought was crazy.
That aside, at least with OpenSource I could try and make time. The source is there for scrutiny, we just need more eyes watching for problems. Compare this to closed source (as you stated) and you can't. What you may perceive as the OS looking to download a patch could easily be that OS uploading your passwords and credit card data. In fact go ahead and run one of those closed source OSes and dump all the traffic for a perfectly idle box.
You can read, puh leaze. I asked a question because the person wrote something that at best seemed misleading. If my interpretation of their statement was wrong, it would/could have been clarified. That did not happen.
Since you jump to this person's defense, I believe my assumption is fair that you are the same person. Numerous people here have personal sock puppet accounts, so this is not a novel or unexpected behavior.
If you didn't read the posts above mine and jumped in blind, that is _your_ fault. I responded to correct a false claim, your claim defended that post. That is how dialog works, and why there is post history so that you can determine context.
YOU DID!
Well good news, this is the default, at least on Debian. In fact Debian doesn't even store journalctl logs, it fowards then straight through to rsyslog. Of course, if you and literally every other Anon. Coward in this thread of posts knew what they were talking about, then it wouldn't exist. The "anti-systemd" brigade seems to consist of a lot of people who have absolutely no idea what they're doing, let alone any idea of how Linux actually works.
To which I asked what version you ran, and you claimed "current production" which is Deb 7, and the installed packages demonstrate that you are warong.
In fact you claimed that I don't know what I'm talking about even though I proved you wrong numerous times. Continuing a lie will NOT make it the truth! A simple "Yup, I meant to claim that in beta/dev Debian it uses systemd, not in a production stable release" would have resolved the issue. Instead of doing this, you keep repeating a false claim that Debian 7 uses systemd as it's default init system.
The existence of a package page does not make it a package installed by default. Looking at the default packages list (or what's installed) determines the default. You lose, good day!
Having a package available by backport is not the same as having a package installed by default, liar.
At least I was not the only one that got the joke..
He used to be able to hire more, but he got sued.
Public housing resulted from economic disparity and poverty, not building standards. It was a cheaper and safer option to make new "cheap" buildings that are tenant controlled than hand out checks every month which may not have gone to rent anyway. Wealth disparity and poverty causes riots and has caused governments to be toppled. A lack of affordable housing is a side effect of poverty, not a stand alone condition (with the rare exception of temporary housing loss due to a natural disaster, which in reality loops back to poverty).