December 2003 - Legacy - lists.gtalug.org

video plugin for mozilla on linux
by aacton-B71PBEe7S7Y＠public.gmane.org 03 Dec '03

03 Dec '03

On 12/03/2003 01:04:38 PM, Lloyd D Budd wrote: > I want to install real player and flash plug-ins on Mandrake 9.2. > First I am trying to get flash to work, but after installation I > receive: > > LoadPlugin: failed to initialize shared library > /usr/lib/mozilla-1.5/plugins/libflashplayer.so > [libstdc++-libc6.2-2.so.3: cannot open shared object file: No such > file or directory] # urpmi libstdc++2.10 BTW, the rpm is non-free software so it's only available on the PowerPack CD's and on the club website. Austin -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

SMC Cable/DSL 4port router
by tim-s/rLXaiAEBtBDgjK7y7TUQ＠public.gmane.org 03 Dec '03

03 Dec '03

James Knott <james.knott-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> writes: > Tim Writer wrote: > > James Knott <james.knott-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> writes: > > > > >>Terry Tanski wrote: > >> > >>>Hi all, > >>> Anyone have any comments on the SMC Cable/DSL 4port router (SMC7004VBR)? > >>> How does it compare to the DLINK (604) or the LinkSys (SR41)? Does it have > > >>>half-decent firewall capabilities? > >> > >>>Terry > >> > >>I have the wireless version of that. It seems to be OK. What capabilities > >>were you looking for? > > Well, I worked on the wireless version for a while and was not at all > > > impressed. The firewalling capabilities are only applicable to the Internet > > connection, i.e. you cannot firewall your wireless LAN from your traditional > > LAN. You can use MAC based ACLs to prevent wireless users from going out to > > the Internet but you can't stop them from accessing your wired LAN. You can > > also restrict wireless traffic but you can't implement a deny by default > > policy, i.e. you cannot deny everything except the few services you want to > > allow, you can only deny specific services. > > The bottom line: as long as you're not using wireless and you're using NAT, > > > it will give you a basic level of protection simply due to the use of private > > IPs with NAT. IOW, it's okay for a simple home setting but I wouldn't use it > > in a business setting. > > > > > I've got mine between my Linux firewall and cable modem. This way, the only > way into my home network, is via CIPE VPN or SSH. Yes, that's how I've configured it too. It just bothers me that a product labeled "firewall" has such limited firewalling capabilities. And if you've got a Linux firewall, it's not too hard to throw in a wireless card and do it "properly". -- tim writer <tim-s/rLXaiAEBtBDgjK7y7TUQ at public.gmane.org> starnix inc. 905.771.0017 ext. 225 thornhill, ontario, canada http://www.starnix.com professional linux services & products -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

video plugin for mozilla on linux
by lloyd-fEEwcc3XMu8jODpR/OX0VQ＠public.gmane.org 03 Dec '03

03 Dec '03

On Mon, 2003-09-15 at 20:22, Austin wrote: > On 09/15/2003 11:43:26 PM, JoeHill wrote: > > also, IIRC, there are Mozilla mplayer plugins availabe the same way, as > > well as flash, java, and realplayer. > > Not exactly. Mandrake Linux does not include any commercial software. But > while ethics are all good and nice, there are ways to get the other you > mentioned using urpmi. All java-related stuff is available at jpackage.org. > Flash and realplayer are a different story. Best to just install them > manually, but there are RPMs available for Mandrake Club members (not free). I want to install real player and flash plug-ins on Mandrake 9.2. First I am trying to get flash to work, but after installation I receive: LoadPlugin: failed to initialize shared library /usr/lib/mozilla-1.5/plugins/libflashplayer.so [libstdc++-libc6.2-2.so.3: cannot open shared object file: No such file or directory] I cannot seem to find a libstdc++ with this version of libc for mdk 9.2 , or a previous version of flash. ? Even better would be a mdk 9.2 RPM for flash. ? -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

MisterHouse / x10 /home automation
by tlug-KfBRzk3UKwol8X4E99VVQg＠public.gmane.org 03 Dec '03

03 Dec '03

Hi Sidney, Could you be a little more specific. Anything in particular you don't like? Robert --- Sidney Shapiro <sidney-3Kd7Tu4o6f/sBN0MCq728g at public.gmane.org> wrote: > I have a ton of x10 stuff, its total crap. > > Sid > -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

mdk: cooker individual software?
by lloyd-fEEwcc3XMu8jODpR/OX0VQ＠public.gmane.org 03 Dec '03

03 Dec '03

On Thu, 2003-11-27 at 10:11, Austin wrote: > 4. Check rogue RPM sites like Texstar's (www.pclinuxonline.com) Texstar "retired" (for now) some time ago. He has not made any 9.2 RPMs. > Thac's (http://rpm.nyvalls.se/) They rebuild new stuff for 9.2. Keep > in mind, if these eat your hard drive and spit it out at you, it's your > own fault. ;-) I discovered the following "rogue" RPMs: http://norlug.org/~chipster/?rpms -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

MisterHouse / x10 /home automation
by sidney-3Kd7Tu4o6f/sBN0MCq728g＠public.gmane.org 03 Dec '03

03 Dec '03

I have a ton of x10 stuff, its total crap. Sid > -----Original Message----- > From: owner-tlug-lxSQFCZeNF4 at public.gmane.org [mailto:owner-tlug at ss.org] On Behalf Of Mailing > List > Sent: Wednesday, December 03, 2003 10:11 AM > To: tlug-lxSQFCZeNF4 at public.gmane.org > Subject: [TLUG]: MisterHouse / x10 /home automation > > Has anyone used x10 or home automation in > their house? Where is a good place to > shop for x10 stuff? Any recommendations? > > Robert > -- > The Toronto Linux Users Group. Meetings: http://tlug.ss.org > TLUG requests: Linux topics, No HTML, wrap text below 80 columns > How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 09:59:43 -0500 (EST) Robert Brockway <robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org> wrote: > Software vulnerabilities are normally fixed by patches but I'll agree that > security overall is more a function of awareness. I think this sentence > mixes up too different concepts (specific security issues vs security > procedures and knowledge). Not at all. You are again assuming that "script-kiddies" gain somehow from the widespread "awareness" of vulnerabilities, an assumption to which I do not subscribe, mainly for lack of evidence. >From Security Focus: "A successful attacker requires three things: the opportunity to launch an attack, the capacity to successfully execute the attack, and the motivation to attack. An opportunity to launch an attack requires a vulnerable system and an access path to the system. The capability to successfully execute the attack requires knowledge of the vulnerability and the tools to exploit it. Proponents of the information dictatorship argument are targeting the second requirement of a successful attacker: his capability to launch an attack. This approach to the problem of computer security is flawed, and can only fail. First, we cannot stop some small number of malicious users from gaining knowledge of vulnerabilities, or access to the tools that exploit them. Vulnerability information and exploits have legitimate uses with the computer security field. They are part of research, are required in penetration testing, and used by system administrator to test their systems, mitigate the risks by gaining an in-depth understanding of the problem, and to verify that vendor fixes work as advertised." Link: http://www.securityfocus.com/news/270 -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "The more laws and order are made prominent, the more thieves and robbers there will be."-- Lao Tsu -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 09:59:43 -0500 (EST) Robert Brockway <robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org> wrote: > Well, there's my position. I won't be replying to this thread again > unless interesting new material is added. I find all too often that > people will follow up, just repeating (or slightly varying from) what has > already been said and the arguments go round and round. As far as I'm > concerned Joe and I have differing opinions and have both expressed them > now. I won't waste time following up if I'm only going to be repeating > what I've already said. Like to have the last word, eh? People like car ananlogies, so here goes: A certain brand of tire, it is discovered, has a propensity for explosive tread separation at highway speeds. Do we keep this info private, until the vendor can supply a patch? No. We immediately inform the public that there is a risk, so that they can take steps to reduce that risk, such as using another brand of tire or modifying their driving habits, or, if so inclined, staying off the road altogether until the vendor can supply a tire which does not go "boom". I have found/seen no empirical evidence to suggest that crackers (you are correct, I think in that distinction) benefit from disclosure, but I have read many accounts of public disclosure of security risks leading to timely and effective mitigation, such as the examples I have already posted. If someone could point me to a source which contradicts this evidence, I would gladly eat my words, otherwise, the idea that these script kiddies benefit *substantially* from public disclosure of vulnerabilities remains, in my mind, merely a theory. The fact that it is proposed primarily by proprietary software vendors also makes me suspicious. To wit: http://www.wild.lib.fl.us/bib/disclosure-by-date.html You will notice that proprietary vendors are by far the most vocal about keeping a lid on newly discovered exploits, whereas the actual security professionals see more good than harm in publicly disclosing them. My favourite quote, from: http://www.computerworld.dk/usarticles.asp?Mode=1&USArticleID=2682 ""On analysis of the code of the Slammer worm it is apparent that my code was used as its template," Litchfield wrote. Many parts of the worm's code were identical to the published proof of concept code, but the worm was not simply a copy of the published example, Litchfield said. "It (is) apparent that whoever authored the worm knew how to write buffer overflow exploits and would have been capable of doing this without using my shellcode as a template," Litchfield wrote. The code taken from Litchfield's published exploit saved the worm's real writer "about 20 or so minutes," Litchfield wrote." -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "Where the state begins, individual liberty ceases, and vice versa." -- Bakunin -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

MisterHouse / x10 /home automation
by tlug-KfBRzk3UKwol8X4E99VVQg＠public.gmane.org 03 Dec '03

03 Dec '03

Has anyone used x10 or home automation in their house? Where is a good place to shop for x10 stuff? Any recommendations? Robert -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003, JoeHill wrote: > Again, facts and reality fly in the face of this argument. Hackers are > usually, if not always, aware of these vulnerabilities before the > security "establishment", and certainly before software designers can > come up with a Years in the security arena make me disagree with this statement. Most "Hackers" (I prefer the term Crackers but there you go) are script-kiddies. The number of Black Hats (people who are actually serious crackers in their own right) is, and has always been, very small. Far smaller than the security establishment. Most exploits discovered these days are found by those who launch a concerted effort to detect them. By sheer number and amount of effort most of the people who discover exploits are in the security establishment and are not Black Hats. I, along with most security professionals, maintain that the vendors/developers are better off receiving some amount of warning before the exploit goes public. This period can be quite short: 2-4 weeks is fine. Lists like Bugtraq now have specified grace periods that a vendor should have to fix a problem. If they haven't patched after this period, then it is time enough to release the exploit to the world. The problem with this is approach is that while it definately speeds up lazy vendors it creates a race condition: Will the bad guys get to a working exploit before the good guys get a fix out. The reality is the idea of providing vendors a grace period before releasing info on a vulnerability/exploit has been working well for many years and we have all benefitted from it. Most exploits fixed in this way don't get the media attention of ones released on an unsuspecting world so the hard work of many security professionals goes unacknowledged (how typical :) > patch. Full public disclosure is one way to give the vast majority of users a Not true. The vast majority of users can't fix the problem for themselves. They are reliant on a vendor (using the term generically here to include OSS development teams) and the public disclosure has just put the vendor at odds with Black Hats who now know about the exploit. Immediate public disclosure just creates a situation where bad buys & good guys are working on the exploit at the same time, instead of providing the vendor with a head start to getting a fix. > head start, before a patch can even be issued, so that they can at least be > aware of the risk. In fact, following this logic, it could be proposed that Most exploits have few or no ways of mitigating risk without taking down services/servers so knowledge of the risk without viable means to protect against it is only of limited use (trust me I've been there :) It does keep you up at night watching firewall and IDS logs though. > disclosure be even *more* widespread, as soon and as widely as possible. > Security issues are not solved by a patch, they are mitigated by awareness. Software vulnerabilities are normally fixed by patches but I'll agree that security overall is more a function of awareness. I think this sentence mixes up too different concepts (specific security issues vs security procedures and knowledge). > Finally, there is no way to develop an enforceable "policy" in this Do you follow Bugtraq? The policy of advising a vendor first is not formally enforceable but it works anyway. Peer pressure can be a positive force in some instances. Well, there's my position. I won't be replying to this thread again unless interesting new material is added. I find all too often that people will follow up, just repeating (or slightly varying from) what has already been said and the arguments go round and round. As far as I'm concerned Joe and I have differing opinions and have both expressed them now. I won't waste time following up if I'm only going to be repeating what I've already said. Rob -- Robert Brockway B.Sc. email: robert-5LEc/6Zm6xCUd8a0hrldnti2O/JbrIOy at public.gmane.org, zzbrock at uqconnect.net Linux counter project ID #16440 (http://counter.li.org) "The earth is but one country and mankind its citizens" -Baha'u'llah -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0