Skip to Content.
Sympa Menu

ch-scene - Re: OT: that new Windows vulnerability

ch-scene AT lists.ibiblio.org

Subject: RTP-area local music and culture

List archive

Chronological Thread  
  • From: Chris Calloway <ifoufo AT yahoo.com>
  • To: RTP-area local music and culture <ch-scene AT lists.ibiblio.org>
  • Subject: Re: OT: that new Windows vulnerability
  • Date: Mon, 2 Jan 2006 13:49:46 -0800 (PST)

> I think I have to disagree with Chris

fair enough. but...

> Go here & read the "trustworthy
computing" entry (a couple of entries down on the front page):
http://isc.sans.org/

"Please, trust us"

actually, that's the antithesis of trusted computing.

all that has to be done is to let us see the source code of the patch before
running it, and allow us to compile it ourselves.

i know that's not what ms does. but ms is a primary source for ms patches.
and ms provides a secure delivery mechanism for patches.

"Acceptable or not, folks, you have to trust someone in this situation."

no, we don't have to. windows users can not browse the internet for awhile.
and windows users can turn off viewing email as rendered html for awhile.

the ics statements simply aren't talking in a trustworthy manner. i don't
know why. it would be simple to do so. i'm not saying it is, but it sounds
like a test to find out if people know what trustworthy computing actually
means.

"To the best of my knowledge, over the past 5 years, this rag-tag group of
volunteers hasn't asked for your trust: we've earned it."

see, that statement is *exactly* how social engineers make their appeals. and
that rag-tag group of volunteers should be the first to know that.

> this
one at least requires you to actively fire up a browser/mailreader and
engage in risky internet usage.

risky as in visiting knoppix-std.org?

i agree previous threats have been worse. this one *may* have an
unnecessarily larger effect, however, due to the security expert obfuscation
going on. i don't understand why that is happening.

> Linux is a lot of fun if you're the kind of person who likes to spend 3
hours trying to get your machine to print to your home printer, even
though it was working the week before, and you didn't knowingly change
anything.

agreed, it's a nightmare. welcome to my nightmare. linux/bsd/'nix may be the
single biggest impediment i have in my job to getting things done in a timely
manner. and i don't dare use anything else on servers. i have no choice about
running windows on a least one desktop machine at any given time, though. not
because there aren't alternatives. but because i have to support people who
won't accept the alternatives.

> Windows just
isn't challenging enough for me anymore.

it will be plenty challenging this week for a lot of people. :)

i guess i have challenges enough already. i want the challenge of developing
my own software, not slogging through getting somebody else's software to
work. i develop software because i have problems to solve with software that
don't involve the software itself. most of the time, though, i have to pay
inordinate amounts of attention to the software and not the problem.

i just want to add that nothing i wrote above should be construed as an
attempt on my part to be pissy. i respect ross's respect for isc and his
admonitions on how to protect yourself. i respect todd asking us how to
protect ourselves.

3





Archive powered by MHonArc 2.6.24.

Top of Page