Full Disclosure mailing list archives
RE: RE: Linux (in)security
From: "Edward W. Ray" <support () mmicman com>
Date: Wed, 22 Oct 2003 10:16:02 -0700
There seems to be this tendency in every market the have the product with the most widgets at the least cost. Security vendors are out there selling a "one size fits all" solution to all of your security problems these days. I have never heard of a Linux vendor saying that Linux is "secure out of the box." Maybe Openwall or Engarde Linux, but most distos need to be made secure by the user. Linux is the hands of someone with no interest or regard for security is the same as Windows or any other OS in the hands of the same clueless individual. The main difference between the Linux and Unix variants (i.e. BSD, Solaris, HP-UX) is that they have already learned their lesson regarded buffer overflows and kernel hardening and allowed the user more control in securing their systems. M$ has not, and that is unfortunate. Edward W. Ray -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Thomas Binder Sent: Wednesday, October 22, 2003 8:39 AM To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] RE: Linux (in)security Hi! On Wed, Oct 22, 2003 at 09:12:12AM -0500, Schmehl, Paul L wrote:
Now, lest you get your hopes up and think it's possible to change the world, read this: http://www.ukauthority.com/articles/story898.asp After reading this, I had a good cry and then took some aspirin. :-(
Of course, what they do not (and most likely cannot) mention is how many of the passwords entered where just random keystrokes instead of a real world password. In fact, I tend to advise people not to completely refuse giving their password / PIN / etc. when asked for by someone, but to reluctantly "disclose" something completely wrong. This way, the attacker might think he's won and - depending on the attacked system - effectively locks the account he wants to break into. Ciao Thomas -- It is better to never have tried anything than to have tried something and failed. - motto of jerks, weenies and losers everywhere _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Linux (in)security Schmehl, Paul L (Oct 22)
- Re: RE: Linux (in)security Thomas Binder (Oct 22)
- RE: RE: Linux (in)security Edward W. Ray (Oct 22)
- RE: RE: Linux (in)security Arcturus (Oct 22)
- Re: RE: Linux (in)security Jeremiah Cornelius (Oct 22)
- Re: RE: Linux (in)security Mr. Rufus Faloofus (Oct 22)
- Re: RE: Linux (in)security Peter Busser (Oct 22)
- Re: RE: Linux (in)security Cael Abal (Oct 22)
- Re: RE: Linux (in)security Peter Busser (Oct 23)
- RE: RE: Linux (in)security Edward W. Ray (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Curt Purdy (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Michal Zalewski (Oct 22)
- RE: [inbox] Re: RE: Linux (in)security Ron DuFresne (Oct 23)
- RE: [inbox] Re: RE: Linux (in)security Curt Purdy (Oct 23)
- Re: RE: Linux (in)security Thomas Binder (Oct 22)