Dailydave mailing list archives
Re: [Full-disclosure] Linux's unofficial security-through-coverup policy
From: spender () grsecurity net (Brad Spengler)
Date: Wed, 16 Jul 2008 18:01:47 -0400
Valdis, Please try to stay consistent with your own arguments. If you defeat them yourself barely into your third paragraph, you don't give me much to do! To summarize:
have any untrusted local users - for instance, my laptop. The only users on it are me, myself, and I<, and the guy that owned my webserver, or
the guy that owned my email client, or the guy that owned my audio player, or the guy that owned my video player, or the guy that owned my web browser, or the guy that owned my FTP client, or the guy that owned my PDF reader, or the guy that owned my office application> You're a very trusting individual! This is exactly why telling someone to update if they have any "untrusted local users" just doesn't make any sense since it misleads a majority of users. A better replacement would be "if your machine is network-connected." How do you own a website if you can't break into it directly? Find out what other websites are hosted on the same machine, break into one of them, then locally escalate privileges, giving you access to all the websites hosted on the machine. If you don't think this happens, you've got your head in the sand and honestly should just give up having anything to do with security. -Brad
Attachment:
signature.asc
Description: Digital signature
_______________________________________________ Dailydave mailing list Dailydave () lists immunitysec com http://lists.immunitysec.com/mailman/listinfo/dailydave
Current thread:
- Linux's unofficial security-through-coverup policy Brad Spengler (Jul 16)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy M. Shirk (Jul 16)
- Message not available
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Brad Spengler (Jul 16)
- Message not available
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Brad Spengler (Jul 16)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Dave Aitel (Jul 17)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Thomas Ptacek (Jul 17)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Valdis . Kletnieks (Jul 18)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Thomas Ptacek (Jul 19)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy nnp (Jul 19)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy pageexec (Jul 19)
- Re: [Full-disclosure] Linux's unofficial security-through-coverup policy Brad Spengler (Jul 16)
- Re: [Dailydave] [Full-disclosure] Linux's unofficial security-through-coverup policy Steve Grubb (Jul 17)