Slashdot Mirror


User: spuzzzzzzz

spuzzzzzzz's activity in the archive.

Stories
0
Comments
261
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 261

  1. Re:Linux kernel and its ware have more security vu on Linux on the Desktop Doubles in 2007 · · Score: 1

    The point I was trying to make is that the number of security vulnerabilities is not as important as the type and criticality of the security vulnerabilities. That's why my original post gave a relatively detailed breakdown (which you seem to have ignored) showing that the vulnerabilities of Windows 2003 are more serious than the vulnerabilities of Linux 2.6.

    As for web servers and database servers, you may be right; I thought I made it clear on more than one occasion that the purpose of my post was to point out a flaw in the original poster's argument, not to get into a Linux vs. Windows flamewar.

  2. Re:ARGUE WITH FACTS... apk on Linux on the Desktop Doubles in 2007 · · Score: 1

    From what the other replier said, I am inclined to agree, that you are trying to dismiss the data secunia puts out and you are not right because I also looked at the mechanics of a remote exploit of a buffer overflow that causes remote privelege escalation to be possible. This is also a remotely exploitable attack and used against applications that solicit connections and have an overflowable buffer.

    I'm not sure what you're trying to say here. As I said in my post, 19% of linux vulnerabilities were remote exploits. In other words, I addressed the notion of remote versus local (and linux came out ahead, for what it's worth). Furthermore, I'm not aware that Secunia gives a statistical breakdown via attack vector (if it does, please point out where). As such, I don't know why you're talking about buffer overflows since their existence or otherwise cannot be derived from Secunia's data.

    I'm sorry if I've missed your point because I don't understand what it was.

  3. Re:ARGUE WITH FACTS... apk on Linux on the Desktop Doubles in 2007 · · Score: 1

    It seems you are stating these are not "critical" attacks...

    I didn't say they were "not critical," I said they were less critical than the vulnerabilities affecting windows. And Secunia agrees with me (I notice that your response conveniently ignores the statistics I gave from the "Criticality" section of Secunia's data).

    Funny - privelege escalation can be used from a buffer overflow attack, & if the app involved solicits connections from remote rigs?

    "Privilege escalation" implies that you already have privileges; it requires the user to have an account on the machine before they can exploit it. I don't mean to say that it isn't critical, I'm just pointing out that it is less critical than the vulnerabilities affecting windows

    This can be used remotely as an attack vector... & for remote system access because of privelege escalation via buffer overflow exploits (and it can escape chroot jails too if the author so writes it to do so as well).

    Not according to Secunia's data. They say that only 2% of linux kernel vulnerabilities can be used for system access. You're trying to twist their data to lump an extra 17% of vulnerabilities into that category. Read the advisories again.

    Also, the 2nd most most common type of attack was denial of service (46%) per your own words...

    Is that not a remote attack as well, & one that can damage a site based on views/pagehits no longer being able to be made, to make money?

    A denial of service may or may not be a remote attack. Clearly, not all linux DoS vulnerabilities are remote because 68% of its vulnerabilities were local and 46% of its vulnerabilities were denial of services.

    Once again, I'm not claiming that a DoS is not critical; I'm claiming that its less critical than the vulnerabilities affecting windows. The most common windows vulnerability involves a rooted box; the most common (not the 2nd most, as you said above) linux vulnerability involves a denial of service.

    (OR when you try to take on those stats on that clearly show Windows & its peripheral wares (IIS 6x & SQLServer 2005, both with 0 vulnerabilities found) has less vulnerabilities than Linux & Apache (and probably ANY backend DB engines it has as well, which I did not include)).

    Why are you trying to change the subject? I clearly pointed out that I was only addressing one aspect of your post (the aspect of your flawed data). Is it because you can't properly address the points that I did make? Anyway, I'll bite just this once.

    Care to name one (a DB engine for Linux), so I can point out how much more vulnerable than SQLServer 2005 it is?

    PostgreSQL 8.x has 0 of 8 vulnerabilities left unpatched. Happy?

    SECONDLY: I'd learn a BIT of comp. sci. before you attempt to interpret SECUNIA's findings above as you have... you are WAY off as to how they CAN be used, & yes, remotely... apk

    Secunia says that 19% of the linux kernel are remote vulnerabilities and I mentioned this specifically in my post. This clearly implies that not all of DoS vulnerabilities (that you are so quick to call remote vulnerabilities) are remote. If you want to argue with facts, I'd suggest you read all of the facts and stop twisting them.

  4. Re:ARGUE WITH FACTS... apk on Linux on the Desktop Doubles in 2007 · · Score: 2, Informative

    Take a closer look at the advisories instead of just counting them. Windows 2003 had 135 advisories: 61% were vulnerabilities from a remote attacker and 24% were vulnerabilities from the local network. The most common vulnerability type was system access (54%) and 74% of the vulnerabilities were of moderate or higher criticality (and 41% were highly or extremely critical).

    In the same period, the linux kernel had 132 advisories. Only 19% involved a remote attack and 13% involved attacks from the local network. Of the 132 advisories, only 15% were rated moderately critical and none were of higher criticality. The most common type of attack was denial of service (46%) followed by privilege escalation and the exposure of sensitive information. System access (remember, this was a factor in 54% of Windows 2003 vulnerabilities) made up 2% of linux kernel vulnerabilities.

    Ok, so this was only the linux kernel; I'm not necessarily asserting that the whole *NIX software stack is secure. Nevertheless, your approach of looking only at the number of vulnerabilities is highly flawed. Lies, damn lies and statistics indeed.

  5. Re:Power & display on Lessons To Learn From The OLPC Project · · Score: 3, Insightful

    Laser printers print at 600dpi and above, but you don't need a magnifying glass to read the output. The point is that the size of a character on-screen should not depend on the dpi of the display. If the GUI is properly designed, the fonts will be large enough and the high pixel density will allow the fonts to be smoother.

  6. Re:Mod parent down on The Heretical Freeman Dyson · · Score: 1

    The stories you link to seemed damning at first sight, so I went to the site that they referenced. They have a page devoted to "odd stations" where they list the stations that are obviously bad. Of the 281 stations surveyed so far, 9 were placed on the "odd stations" page. The dailytech article refers to this as "a surprising number" but it doesn't seem so terrible to me. Of course, the descriptions in the article were taken from the worst of the 9 bad sites, but they made it sound as though those descriptions were somehow representative.

    In the interest of fairness, I should point out that surfacestations.org has obviously been updated since the blog was posted. At the time of writing, only 48 sites had been surveyed; that number is now 281.

  7. Re:Hoo-ray on Firefox Now Serious Threat to IE in Europe · · Score: -1, Troll

    I'm sorry, but if you think that "liberté, égalité, fraternité" is a communist slogan, you have some history to read up on.

    Back to the main point, the reason that Hitler's crimes are more heinous (for me, at least) is that a race is something that you are born into while a class is something that you can control (or hide). The idea that you can be killed for who you are is more chilling than the idea that you can be killed for what you did (no matter how unjustly).

  8. Re:Pardons on FBI Employees Face Criminal Probe Over Patriot Act · · Score: 1

    Yeah! They could have a mat. And it could have, like, conclusions written on it...

  9. Re:Defined: Liberal on Court Orders Dismissal of US Wiretapping Lawsuit · · Score: 1
    From your first link:

    Kent Willis, executive director of the Virginia ACLU, said that individual students, such as Nuss, are entitled under freedom of speech rights to say a prayer of their own choosing during a graduation speech.

    But Willis maintained that school officials would have to take a ``hands-off approach'' or risk violating the law against state-sponsored religious expression. That means, Willis wrote in the June 6 letter, that ``such speeches should not be edited, approved or even reviewed in advance by school officials.''

    In other words, you seem to reinforcing the parent's point: schools are prohibited from organising or endorsing prayer, but the students retain the right to engage in individual prayer. A further quote from the same article:

    Bethanne Bradshaw, spokeswoman for Suffolk schools, said the district has no specific policy on graduation prayer but that if a ``prayer is initiated by a student during the course of a ceremony we don't interfere - that's where we start and stop.''
  10. Re:About that Cuban healthcare... on Michael Moore's New Film Leaked To BitTorrent · · Score: 1

    ...where "private," of course, means "government subsidised." I'm all for having private health insurance as an option but it kinda defeats the point if the taxpayers are paying for it.

  11. Re:That Is Pathetic...There is more on Holocaust Dropped From Some UK Schools · · Score: 1

    Thanks for the official definition, but it doesn't answer my question: how many Palestinian Arabs living in Israel are considered as refugees under this definition? In your original post, you implied that the answer is 1 million (which would consist of practically the entire Arab population of Israel).

    But that would require Israel to give concessions and the U.S. to not be be bias[ed].

    The unfortunate thing is that the loudest opinions on this issue are along the lines of either "Israelis are evil zionist pigs" or "Palestinians are suicide-bomber terrorists." It makes it difficult for me to find a political group I feel comfortable backing. Witness the guy further down in this thread complaining that Israelis are performing genocide by calling Israeli-Arabs "Arabs" instead of "Palestinians" and insinuating that the Mossad breaks down Arab doors right and left. Whenever I'm feeling particularly cheerful, I go to Ha'aretz or al-Jazeera and read some of the talkback comments there; that usually brings me crashing back to earth.

  12. Re:That Is Pathetic...There is more on Holocaust Dropped From Some UK Schools · · Score: 1

    They are not allowed to call themselves "Israeli Palestinians".

    In what sense are they "not allowed" to call themselves Israeli Palestinians? Does the Mossad break down their doors if they do? It's true that the mainstream Israeli press refers to them as Arabs, but I'm afraid that most of your comments come accross as hyperbole. Searching on Google, for example, turns up plenty of results for the phrase "israeli palestinians."

  13. Re:That Is Pathetic...There is more on Holocaust Dropped From Some UK Schools · · Score: 1

    Millions of other Palestinians live as refugees in other Arab countries (as well as one million in Israel proper)

    I would question your labelling of Palestinian Arabs living in Israel as "refugees." I am not aware that the UN considers them to be refugees. It is true that they are treated as second-class citizens in Israel, but this is a civil rights issue, not a refugee issue (and the Israeli Supreme Court has upheld their rights on several occasions).

    According to United Nations General Assembly Resolution 194 (1948) and subsequent resolutions, these refugees have the right to return to their homes, or to be compensated for their losses.

    Over the last few years, I have increasingly become of the opinion that Resolution 194 and particularly Article 11 should be forgotten. I support the compensation of refugees, but I do not think they should return home (I feel the same way about the ~800,000 Jewish refugees from Arab countries to which Article 11 also applies). The only possible effect of a mass return of Palestinian refugees would be to further inflame racial and religious tensions. I believe that the way to a peaceful solution is a two-state solution. If the Jews and the Arabs can live in peace in neighbouring countries for a few generations, the hate between them may subside to the point where they can live as neighbours in the same country.

    It's worth mentioning, by the way, that the text of Article 11 could be interpreted mean exactly what I say above. In particular, the text "refugees wishing to return to their homes and live at peace with their neighbours should be permitted to do so at the earliest practicable date" supports my opinion if you allow some leniency in the "earliest practicable date."

  14. Re:That Is Pathetic...There is more on Holocaust Dropped From Some UK Schools · · Score: 1

    This is a silly argument. They live in a country called Israel; therefore they are Israelis. If they lived in the (not yet country, but hopefully soon) of Palestine, they would be called Palestinians. When Czechloslovakia broke up, the people living in it ceased to become Czechloslovakians. Does that mean there was a genocide?

  15. Re:That Is Pathetic...There is more on Holocaust Dropped From Some UK Schools · · Score: 2, Insightful

    Calling people names will never do anything to advance your argument. Furthermore, your view of history is clearly unbalanced. There is evidence that Palestinian Arabs were driven from their homes (and also evidence that many left of their own accord). Your statement "They left of their own accord because they couldn't stand the thought of living in a Jewish state" implies that 100% of the Palestinian population left for racist reasons rather than, for example, to ensure the security of their families. That sort of blanket statement does nothing to improve the quality of a debate.

  16. Re:Zionist Propaganda on Holocaust Dropped From Some UK Schools · · Score: 1

    it's amazing the zionist racism that has gone on in Bethleham of all places.
    Can you give any references? IIRC, Bethlehem has been under Palestinian Authority control since the Oslo Accords. From a quick search on google, the only evidence of religious strife I can find is a tension between the local Christian and Muslim communities (which has seen the Christian population drop from ~80% to ~15% in 60 years).
  17. Re:Internet access is integral to education... on Internet Curfew for College Students? · · Score: 1

    Without the Internet, and with a LIMITED library available, where does he get it?

    He goes to the library and uses one of the computers there to access the internet. It has been stated several times in this thread that internet access is available at the library 24 hours a day.

  18. Re:On a related topic.. on MS Promotion Site Flagged By MS Anti-Phishing · · Score: 1

    I don't think you should be free to use in violation of the copyright owner's wishes.

    When I buy a book, the copyright holder isn't allowed to stop me from reading it while standing on my head, hitting myself on the head with it or using it as toilet paper. Why should a computer program be any different? Copyright refers to copying only. That's why it's called copyright and not, for example, useright.

    I'm not a lawyer, but I am under the impression that installing a computer program in order to use it is not restricted by copyright (in the same sense that if you buy a CD, you don't need express permission from the copyright holder to load that music into the RAM of your CD player in order to listen to the music). Even if there is a no legal distinction between listening to a CD (or installing a piece of software on a single computer) and handing out copies on the street, I feel that there is a moral distinction.

    To summarise my position:

    • When you buy a copyrighted work, you are free to use it however you like (including such copying as is required by normal use).
    • When you buy a copyrighted work, you are not allowed to copy and distribute it without express permission from the copyright holder
    • Any document that imposes restrictions on the use of the work does not impose those restrictions unless you agree to it.
    • Any document that grants rights for the distribution of the work does not grant those rights unless you agree to it.
    It's implied by these points that if you manage to install and run a (legally purchased) piece of software without agreeing to the EULA, it has no effect. If you feel that my argument relies on a personal feeling about Microsoft or Metallica, please point out where.
  19. Re:On a related topic.. on MS Promotion Site Flagged By MS Anti-Phishing · · Score: 1

    If you don't accept the GPL, you have no legal right to copy and distribute the code. The GPL grants rights, by letting you redistribute the code under certain conditions. That is, by agreeing to a EULA, you give up rights. By agreeing to the GPL, you gain rights. So there is no point in avoiding agreeing to the GPL.

  20. Re:there is No god on Humans Hardwired to Believe in Supernatural Deity? · · Score: 1

    Religions with a single God usually have other characters, such as patron saints or legends of profits, to make it more interesting.

    That is either a typo or a profound insight into modern society. As South Park would have it,

    1. Create religion with legends of profits.
    2. ???
    3. Prophet!
  21. Re:What's worse? on A Bad Month for Firefox · · Score: 1

    This isn't about adding a new device driver. It's about having the device driver detect a revision of a chipset. It's fairly easy to test and a very LOW risk change. Not doing so means an entire line of motherboards are not supported.

    You may have missed the following comment in the thread I linked to before.

    The problem is when some hardware suddenly become detected and assigned in the middle of a stable release. Do not forget that people need stable releases to be able to blindly update and get their security vulnerabilities fixed. Sometimes, unlocking 2 SATA ports on the mobo by adding a PCI ID or adding the PCI ID of some new ethernet cards that were not supported may lead to such fun things (eth0 becoming eth2, sda becoming sdc, etc...). This causes real trouble to admins, particularly those doing remote updates. At least, I think that if you manage to inform people clearly enough, and to separate security fixes and such fixes in distinct releases, it might work in most situations. But this is a dangerous game anyway.

    In any case, I suspect that most distros that aren't completely anal about stability will patch in PCI ID updates (you mentioned that gentoo applied the patch). Since most people use a distro-supplied kernel, I think that the rist of user-unsatisfaction is lower than you make it out to be. Remember that the vanilla kernel has to try to please lots of people at once, so they need to be conservative.

  22. Re:What's worse? on A Bad Month for Firefox · · Score: 1

    This is not about your one-line patch. The issue of adding hardware support to a stable branch is something that people have been arguing about for a while. See, for example, this, which is about 2.6.16.y but talks about some of the issues that adding hardware support can cause.

  23. Re:Java's dead! on 2007 Java Predictions · · Score: 1

    An argument is often made that an OS must be implemented in a language that *lacks* certain features, because those features shouldn't be used in kernel code.

    I could be barking up the wrong tree here, but complicated features sometimes require a complicated run-time environment; this can be a reason for favouring a simple language for OS development. In Ada, for example, the run-time environment is pretty much an operating system by itself. There's not much point developing an OS in Ada if the standard run-time system already has many of the features you need to implement. The same goes for any language that supports concurrency to a decent degree.

  24. Re:10 reasons why the US is hated all over the wor on US Slips Again In Freedom of the Press Ranking · · Score: 1
    In an attempt to provide a response that is slightly more moderate than krell's...

    A couple hundred years ago, New York was actually Dutch territory. How about the Dutch buying half of the property there, and then declaring it independent from the USA, meanwhile confiscating th eother half of the property there? The rest of the USA would not accept this? Why the hell do people in the USA expect the palestinians to accept something similar?

    This is not a particularly accurate analogy. First of all, the UN partition plan never involved the confiscation of land; it only involved the governance of that land. I realise that people accuse the Israeli forces of driving out the Arabs, but based on the evidence I have seen (the public statements by Arab leaders asking civilians to leave so that the Arab armies could move in, the large number of Arabs who didn't flee and still live in Israel today) I don't believe this happened on a large scale.[1]

    Secondly, the creation of a Jewish state did not remove Palestinian rule over anything. This is simply because the Palestinians have never had self-rule[2]. The Palestinian Arabs only gained power and land under UN partition plan. Yes, the plan was probably slanted towards the Jews and the Holocaust was probably the influencing factor. But the Arabs certainly had more constructive options than attempting to drive the Jews into the sea.

    [1] An interesting, but somewhat tangential question. If an Arab family fled their land because of urging from their own leaders rather than any actual threat to them, do they deserve reparations? If not, how do you distinguish between people that deserve reparations and those that don't?

    [2] AFAIK. My knowledge of the history of the region is not encyclopaedic.

  25. Re:want one^h^h^h 1000 on Linux Powers Lilliputian PCs · · Score: 2, Funny
    Just in case you weren't aware, you happen to be a pretentious asshole. The story had both inches and centimeters.
    From the article: The petite device measures 1-3/8 x 4-1/8 inches (35 x 103cm).

    I guess the article's authors were sick that day of elementary school.