December 2003 - Legacy - lists.gtalug.org

Debian attacker may have used new exploit
by jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, Dec 03, 2003 at 07:46:08AM -0500, JoeHill wrote: > On Wed, 3 Dec 2003 08:24:38 -0500 > John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > > > > > Ask yourself: if this were a certain proprietary company, would this > > > > news leak out so quickly, and would said organization publish a detailed > > > > post-mortem as soon as one is available? > > > > > > There's no "if". Microsoft actually got seriously pissed recently when news > > > of *seven* new vulnerabilities, two of them critical, was released to the > > > general public rather than being privately and secretly notified > > > themselves. > > > > That's a different matter and worthy of everyone being > > pissed. Anyone finding a new vulnerability should > > notify the owner of the code and give them some time > > to find a cure before making a public announcement. > > For an open source project, the original notification > > will be partially public, but you still should not > > try to make the news widely public until there has > > been adequate time to find a fix and distribute it. > > (Proprietary source products often require a longer > > period of time for that process to be carried out.) > > After the period of time is up, then announcing > > the vulnerability is fine (and if the code owner > > has wasted the time and not arranged a fix to be > > distributed widely enough, it rightly looks bad > > on them). > > I think considering MS's past behaviour in this respect (ie. taking *months* to > issue fixes that do not even work), the discoverers of the vulnerabilities did > the right thing. Leaving that aside, MS has no right to expect "courtesy" from > the security community, taking into account it has acted with aggressive > intolerance at any and all criticism of it's security track record, witness the > recent case of the CCIA report and the subsequent firing of it's principle > author from an MS-connected company, @Stake. MS has a poor track record for sure, but your example was not a case of MS acting poorly - they weren't given a chance. Now you're saying they don't deserve a chance, but that is irrelevant to your original point that this example proved that open source does a better job. The open source community can't fix problem before they know of them either. > The argument that public disclosure of security flaws encourages hackers is very > weak, and reeks of justification, in comparison to the logically sound idea that > more public scrutiny means more pressure, and more resources, brought to bear to > fix said bugs. Hence Eric S. Raymond's "many eyes make all bugs shallow." Immediate public disclosure does not provide more eyes for a bug in MS code, just more eyes in the cracker community. Telling MS of a bug, and then telling the world later of the bug (and that MS was told a month earlier so that people can judge whether their response was adequate) provide more than ample pressure, and may reduce the number of exploits carried out against victims who have never had any warning or chance to apply a fix because there wasn't one. If MS responds prompty (which they are doing better at these days - they've learned that they have to), then when the public announcement goes out any attacks prompted by the announcement can only be applied against people who have not yet applied the fix. -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 09:16:11 -0500 John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > Immediate public disclosure does not provide more eyes > for a bug in MS code, just more eyes in the cracker > community. That is a myth, propagated by MS and other proprietary vendors, to avoid embarassment and having to do actual work to improve security. Witness the recent case of Diebold and their voting machines. If it were not for the work of students and activists at Swarthmore College, no one would ever have known of the security flaws. Diebold certainly showed no interest in fixing the problem, even though internal memos showed they were aware of those flaws. It was only after said students published the internal memos online that enough pressure is being brought to bear on Diebold to fix the vulnerabilities. Now what software were those machines running agian...? Oh, that's right, MS. > Telling MS of a bug, and then telling the world later > of the bug (and that MS was told a month earlier > so that people can judge whether their response was > adequate) provide more than ample pressure, and may > reduce the number of exploits carried out against > victims who have never had any warning or chance to > apply a fix because there wasn't one. If MS responds > prompty (which they are doing better at these days - > they've learned that they have to), then when the > public announcement goes out any attacks prompted by > the announcement can only be applied against people > who have not yet applied the fix. Again, facts and reality fly in the face of this argument. Hackers are usually, if not always, aware of these vulnerabilities before the security "establishment", and certainly before software designers can come up with a patch. Full public disclosure is one way to give the vast majority of users a head start, before a patch can even be issued, so that they can at least be aware of the risk. In fact, following this logic, it could be proposed that disclosure be even *more* widespread, as soon and as widely as possible. Security issues are not solved by a patch, they are mitigated by awareness. Finally, there is no way to develop an enforceable "policy" in this regard, so it is not realistic to expect that, even if you assume this "myth" is true, people will not go on publicly releasing info on exploits. It's more realistic to find a way to deal with the *expectation* that the exploits are already widely known, and to work from there. If you read the full account of the Debian incident, you will see that that is exactly what happened, and exactly the attitude that was taken. Nothing radical here! In fact, if you do a quick google on this topic, you will find that nothing I'm saying is particularly original, this is the opinion of much bigger fish than you or I. -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "The modern conservative is engaged in one of man's oldest exercises in moral philosophy; that is, the search for a superior moral justification for selfishness."-- John Kenneth Galbraith -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Sendmail for smtp routing..
by fraser-Txk5XLRqZ6CsTnJN9+BGXg＠public.gmane.org 03 Dec '03

03 Dec '03

On December 3, 2003 12:25 am, JM wrote: > would it be possible to route all mails to a different mail server whos > recipient belongs to mydomain.com only.. Yes but why don't you just set the MX record correctly in DNS? With a correct MX record it will automatically go to the mail server of your choice. -- Fraser Campbell <fraser-Txk5XLRqZ6CsTnJN9+BGXg at public.gmane.org> http://www.wehave.net/ Georgetown, Ontario, Canada Debian GNU/Linux -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, Dec 03, 2003 at 05:22:56AM -0500, JoeHill wrote: > On Wed, 3 Dec 2003 00:22:29 -0500 > Chris Keelan <rufmetal-MwcKTmeKVNQ at public.gmane.org> wrote: > > > Ask yourself: if this were a certain proprietary company, would this > > news leak out so quickly, and would said organization publish a detailed > > post-mortem as soon as one is available? > > There's no "if". Microsoft actually got seriously pissed recently when news of > *seven* new vulnerabilities, two of them critical, was released to the general > public rather than being privately and secretly notified themselves. That's a different matter and worthy of everyone being pissed. Anyone finding a new vulnerability should notify the owner of the code and give them some time to find a cure before making a public announcement. For an open source project, the original notification will be partially public, but you still should not try to make the news widely public until there has been adequate time to find a fix and distribute it. (Proprietary source products often require a longer period of time for that process to be carried out.) After the period of time is up, then announcing the vulnerability is fine (and if the code owner has wasted the time and not arranged a fix to be distributed widely enough, it rightly looks bad on them). -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

SOT: shitfs in spam trends and topics
by matt-s/rLXaiAEBtBDgjK7y7TUQ＠public.gmane.org 03 Dec '03

03 Dec '03

Byron Sonne <blsonne-bJEeYj9oJeDQT0dZR+AlfA at public.gmane.org> writes: > SOT = Somewhat Off Topic, though if there is a another acronym in more common > usage let me know... Yeah, there is. It's 'OT'. > me. "Satisfy your woman, you pin-dick" was the most harsh, and perhaps > relatedly, the funniest one as well. If aggressive derision toward a > potential customer helps make you money then I should have been rich long > ago! The most hilarious spam that I ever got had the subject line 'Get exposed on the internet'. I think that they were offering to register me with various search engines. -- matthew rice <matt-s/rLXaiAEBtBDgjK7y7TUQ at public.gmane.org> starnix inc. phone: 905-771-0017 x242 thornhill, ontario, canada http://www.starnix.com professional linux services & products -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

2 1

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 08:24:38 -0500 John Macdonald <jmm-TU2q2He6PgRlD5gtYiU6kEEOCMrvLtNR at public.gmane.org> wrote: > > > Ask yourself: if this were a certain proprietary company, would this > > > news leak out so quickly, and would said organization publish a detailed > > > post-mortem as soon as one is available? > > > > There's no "if". Microsoft actually got seriously pissed recently when news > > of *seven* new vulnerabilities, two of them critical, was released to the > > general public rather than being privately and secretly notified > > themselves. > > That's a different matter and worthy of everyone being > pissed. Anyone finding a new vulnerability should > notify the owner of the code and give them some time > to find a cure before making a public announcement. > For an open source project, the original notification > will be partially public, but you still should not > try to make the news widely public until there has > been adequate time to find a fix and distribute it. > (Proprietary source products often require a longer > period of time for that process to be carried out.) > After the period of time is up, then announcing > the vulnerability is fine (and if the code owner > has wasted the time and not arranged a fix to be > distributed widely enough, it rightly looks bad > on them). I think considering MS's past behaviour in this respect (ie. taking *months* to issue fixes that do not even work), the discoverers of the vulnerabilities did the right thing. Leaving that aside, MS has no right to expect "courtesy" from the security community, taking into account it has acted with aggressive intolerance at any and all criticism of it's security track record, witness the recent case of the CCIA report and the subsequent firing of it's principle author from an MS-connected company, @Stake. The argument that public disclosure of security flaws encourages hackers is very weak, and reeks of justification, in comparison to the logically sound idea that more public scrutiny means more pressure, and more resources, brought to bear to fix said bugs. Hence Eric S. Raymond's "many eyes make all bugs shallow." -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "I have the South in front of me and the bankers behind me -- and for my country, I fear the bankers most."-- Abraham Lincoln -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 3 Dec 2003 00:22:29 -0500 Chris Keelan <rufmetal-MwcKTmeKVNQ at public.gmane.org> wrote: > Ask yourself: if this were a certain proprietary company, would this > news leak out so quickly, and would said organization publish a detailed > post-mortem as soon as one is available? There's no "if". Microsoft actually got seriously pissed recently when news of *seven* new vulnerabilities, two of them critical, was released to the general public rather than being privately and secretly notified themselves. -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "The US is our trading partner, our neighbour, our ally and our friend... and sometimes we'd like to give them such a smack!"-- Rick Mercer -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

Debian attacker may have used new exploit
by joehill-rieW9WUcm8FFJ04o6PK0Fg＠public.gmane.org 03 Dec '03

03 Dec '03

On Wed, 03 Dec 2003 00:24:51 -0500 cbbrowne-HInyCGIudOg at public.gmane.org wrote: > But that is rather like finding your home burgled, and, seeing normal > burglary tools lying around, assuming that it was, instead, black-ops > NSA agents trying to make it LOOK like an ordinary burglary. That would be *my* first assumption, 'course I just watched Enemy of the State for the fifteenth time...Tony Scott and Gene Hackman, ya can't go wrong! Back on topic though, I just can't resist the notion that somehow this is an attempt at a smear campaign by "enemy agents". I could see Darl McBride, sitting in a dark office, merc hackers standing at the ready..."See what you can do..." ;-) -- JoeHill ++ ICQ # 280779813 Registered Linux user #282046 Homepage: www.orderinchaos.org +++++++++++++++++++++++++++ "Wealth is the relentless enemy of understanding." -- John Kenneth Galbraith -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

sound & partitions
by aitken-BwLjziHGQLusTnJN9+BGXg＠public.gmane.org 03 Dec '03

03 Dec '03

I am starting my own business with the blessing of hrdc. If anyone is curious for more details you can certainly email me offline. This post will be long enough as it is : ) Two questions and one request: 1. I am reinstalling linux because I whimped out on my last install when I had trouble creating /home as a separate partition (I had the error: could not allocate partition". I settled for only / (9492 MB) and swap (510). Now I have a sick system. I could troubleshoot it, but I would still have an installation with no separate /home partition, which I don't think is a good idea. for a business.There is nothing critical in /home now, so I don't think I will bother troubleshooting just to copy it's contents over the network - no point. But what I do want to do is have /home on a separate partition on my reinstall. I don't want to disturb the existing MS partitions (for better or for worse, for now, I am using Pro Tools Free for the music recording part of my business). I have a C:\ and D:\ partition on the drive. That's only two primary partitions - so, I don't see why I can't create separate partitions for /, /home and swap - albeit they won't all be primary. Does Disk Druid have trouble with such things? Should I take the adult's approach and use fdisk? 2. Keeping in mind that want to get up and running again soon, is the following still my easiest best option?: install rh 7.3 (good multimedia OS, with sound already compiled into the kernel) and upgrade to 8.0 (to get Open Office and other goodies). 3. I could continue to use Pro Tools Free on W98SE for the music recording part of my business, but I would prefer to do everything in linux. This is important to the second phase of this business. I'll keep working through _The BOOK of LINUX MUSIC & SOUND_ by Dave Phillips (no starch press), but that means it'll be a year (I'm not being dramatic) before I'm recording sound in linux. If anyone has done this, I'd love to hear from you. Sincerely, Chris Aitken -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0

quiet PC
by aitken-BwLjziHGQLusTnJN9+BGXg＠public.gmane.org 03 Dec '03

03 Dec '03

Chris Aitken wrote: > ------------------------------------------------------------------------ > > Subject: Re: [TLUG]: quiet PC > Date: Mon, 8 Dec 2003 20:39:00 -0500 > From: Peter Hiscocks <phiscock-g851W1bGYuGnS0EtXVNi6w at public.gmane.org> > Reply-To: tlug-lxSQFCZeNF4 at public.gmane.org > To: tlug-lxSQFCZeNF4 at public.gmane.org > References: <3FD51233.6E2F5C25-BwLjziHGQLusTnJN9+BGXg at public.gmane.org> > > I sympathise, many PC's these days are unbearably noisy. I got one that was > unacceptably noisy and simply took it back to OTA the next day and asked for > a quieter fan. They obliged. That's the easiest and simplest solution. Thanks, everybody. I was blown away by the volume of feedback I got from this post. I thought I should let you know how I resolved this - such as it is. Honson would not commit to installing an ultra-quiet fan. The clerk told me that "all fans make some noise". I told her that I'm sure that that is true but that I understand that some fans are so quiet that you can't hear them ; ) She said she would have a tech call me - a tech never did call me. So, I took the PC to Stan at Union Computers (Yonge, South of Eg). He was a little more bullish on quiet fans. So, as is my nature, I let him "pour honey down my ear" (is that really an expression, or did I make that up?). So, for 80 bucks cash, I now have a PC that is definitely quiter (but not near-noiseless), and the noise it does make is at least uniform (not the organ grinder effect I had before). So, it's quieter (better fans) and its sound is uniform now, not pulsing and changing (that's because the fans are new). The PCU fan/heatsink packaging was not saved, so the best information Stan could give me was that it is rated for a 1.5 GHz processor (whereas I only have an 800 MHz one). The PSU fan specs are: Dimension: 80X80X25 Air Flow: 32.5CFM Speed: 2500 RPM Noise: 28.3 bBA Voltage: 12 VDC Current: 0.13 A Power: 1.6 W Thanks again, Chris Aitken -- The Toronto Linux Users Group. Meetings: http://tlug.ss.org TLUG requests: Linux topics, No HTML, wrap text below 80 columns How to UNSUBSCRIBE: http://tlug.ss.org/subscribe.shtml

1 0