lkml.org 
[lkml]   [1999]   [Aug]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Gates of Hell
"Robert G. Brown" wrote:

> On Thu, 12 Aug 1999, Jonathan Masters wrote:
>
> > Yep. I took the same attitude with him as I did with barclays bank and
> > threatened to sue him/her for discrimating between OSs in such a manner, I
> > mean winblows is crap everyone knows, and OK, so MacOS is *better*, but since
> > that microshark "loan" of millions to Apple, I will always view Apple and
> > microshaft as being too close so I find this kind of discrimination very bad
> > for everyone. BARCLAYS HAD THE NERVE to claim that
> > LINUX IS ***LESS*** SECURE THAN WINDOWS 95/98/NT - what an utter sh*tload of
> > crap. I mean, it made me laugh and I've still gotta decide if I'm gonna pursue
> > the case with Barclays.... (I *used* to like them too).
>
> Well, let's be less knee-jerk biased about this. As far as the network
> is concerned, Win9X is nearly perfectly secure because they have an
> outgoing-only sort of network. Can one crack a Win9X box on the
>

Nope. I wasn't talking about that - are you trying to say the winblows encrypts
data or something? - I can still snoop network packets as with any other machine -
that's what I meant. If I have a winblows/NT/Unix/whatever network using TCP/IP or
another other standard, by the sheer nature of standards (bear in mind that the net
is driven by standards so companies should *not* discriminate) I can snoop network
packets and read the data being transmitted (however, my machine is using 128bit
crypto - stronger than the UK M$ Internet Exploiter (did I mention IE 5 is 120Mb of
crap?) so even reading packets, my machine is *more* secure)..... etc...


> network? I doubt it -- even if one WANTS to login to it is impossible
> because it is brain dead at the network level, because it has no shells,
> and so forth. Macintoads are no better. So they're "secure" in that
>

Can still *READ* the data.


> only the person logged into the console can do anything and it is
> difficult for a remote cracker to install a snooper or capture
> keystrokes or the like.
>

Nope. Increadibly easy - ever heard of the Backorifice clients ("viruses")?...


>
> WinNT is a more reasonable complaint; it has a real network and is
>

what do you mean by "real", implementation? / what? .......


> remote accessible and hence remote crackable. I'd guess that one can
> crack a networked NT box and install a keystroke/mouse snooper (or
> trapped version of Explorer) to trap that good old Barclay's password.
>

Can do this on any machine with appropriate access. My cookie files are monitored,
the password wouldn't be around long enough unless it was snooped as I worked. I
don't run winblows and you'd need root access to perisopce to install a cracked
NS client.



>
> The difference is that linux has all source available, so all bugs are
> very rapidly found and exploits published. This is good and bad -- good
> in that if you religiously track the bugs and install patches you'll
> stay at least even with the bad guys, bad in that if you are a newbie or
> less conscientious, your system is probably approximately as secure as a
> gazebo. Parts of our network here at Duke are being portscanned by
>

Now that's utter crap. crap, crap and more crap. Linux is *more* secure because of
this. I guess the last major networking problem was with 2.2.x with the TCP
malformed packet thingy - how long did it take Alan to fix - 4 hours (M$ couldn't
ever achieve that - all that wonderful "QA" they do would take days to test it and
make the patch up to their increadably "high" standards :) - when was the last time
a M$ "service pack" came out ***4*** hours after the exploit? M$ has many more
problems than Linux since it is closed source. Open source can only be a good thing
- exploits are always being found with everything, but at least with Linux stuff is
fixed and fixed quickly. M$ can take months to fix problems. If you don't keep up
to date with the latest kernels, you are brain dead, it's hardly difficult to
download a patch now is it? Sorry, but M$ is no better in this area.


> intruders literally daily; many of these are seeking well known services
> (like NFS) on well known operating systems (like linux) to try well
> known exploits that will slice into the attacked system as if its
> security layer weren't even there. Historically, ALL unices have had
> hole after hole uncovered in their daemons and services and binaries.
>

Yep, but so have all M$ products - are you an M$ drone - have you been assimilated?



> It was only a year or three ago that a bug in syslogd was uncovered that
> gave open access to nearly every Unix system in the world, and sendmail
>

Yeah, but there are countless bugs in NT/winblows 9x which do similar stuff, and
the exploit was fixed almost as soon as it was discovered, so what's your
point/problem?


> was legendary up into the mid 8.X's. I keep my home linux system secure
> by simply turning off nearly all ports (and worrying about the two or
> three I leave open!). Newbies, however, often bring up their system
> with all sorts of daemons and services running and no idea how to manage
> them. Indeed, they not infrequently don't even know that they are
> running the services at all and don't even know what they do! They then
>

OK, but if you're a "newbie", you're hardly running the NSAs computer network,
I can honestly say thatmy computer holds no data of
importance/interest/significance to anyone else, so why would anyone really want to
crack their machine.??????



> use telnet or rlogin to login to remote sites a few times and type their
> passwd's in the clear on their LAN (which may be snooped) and the
> destination LAN (which may be snooped). All of this is an invitation to
> destruction.
>

Only if the machine is worth cracking - Reading library has an extreamly insecure
network, but would you really find it interesting to crack it?


>
> In summary, is Barclay's being overconcerned? Possibly. At the very
>

Yes they are, since my system is more secure than any of my friends winblows
machines. Besides, I'm speaking to Trading Standards about Barclays, and we're
going to get them sorted/have their bodies horribly mutilated with griant brandings
of the words "we do not work for M$ and as such we have open minds and we love
Linux and all penguins out there" - side note : why can't I legally own a penguin -
I really want one :)


> least, you should be able to sign something absolving them of all
> responsibility for an electronic theft from your accounts -- if you are
> willing to do this. Are they completely crazy? Absolutely not! They
>

No just certifiable.


> have no way of knowing if you are competent or incompetent as a systems
> manager of your linux box. In the latter case you could share your box
>

Fraid I'm the only user of this machine mate. And if you're trying to insult me, I
think I'm fairly "competant" Thanx.


> with a dozen trolls and never know it. True, NT is little better, so
> they are being discriminatory, but perhaps this is where they are being
> foolish -- they probably shouldn't permit access from NT EITHER.
>

Rubbish.


>
> The question of how electronic commerce of all sorts will securely
> proceed in the future is an interesting one. These days, any successful
> cracker almost always has the opportunity (if they choose to use it) to
> become a thief or blackmailer. Booby trap netscape and sooner or later
>

yeah, but only if people are stupid enough to run a version like that - some of us
would notice.


> you'll get a credit card number. Perhaps you'll observe somebody
> cruising a gay website. Maybe you'll intercept email to a secret lover.
>

Sorry, I'm not gay, and the only juicy thing about me is that my ex-girlfriend
fancied her uncle more than me.
(lasted 3 years, ended in big nasty fights).

> Privacy is an important issue, and we assume our systems to be secure
> when they almost never really are. Well, on THIS list they probably are

I think I'm fairly safe.


>
> for the most part, but out there in userspace, especially now that linux
> is in box sets in ordinary stores being installed by the ignorant, I'm
> sure that they are not infrequently wide open.
>

But still better than winblows and mac.


Sorry to find you missguided but I think most of what you've said is utter crap,
even blasphamous towards Linux.

Up with the penguins.

>
> rgb
>
> Robert G. Brown http://www.phy.duke.edu/~rgb/
> Duke University Dept. of Physics, Box 90305
> Durham, N.C. 27708-0305
> Phone: 1-919-660-2567 Fax: 919-660-2525 email:rgb@phy.duke.edu

--
Jonathan C. Masters (jonathan@oxlug.org)
PGP: www.brookes.ac.uk/~95227860/KEY

"Upon this rock I will build my church,
and the gates of hell shall not prevail against it".

-- Matthew 16, 17-18




-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.092 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site