<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Security news roundup: 911 hacker gets 3 years, Ubuntu Linux stays unhacked ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-259244/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-24T04:17:50-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA[thank you]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466383]]></link>
        <description><![CDATA[My thought exactly. The third party software OBVIOUSLY requires the underlying OS, and it is in that interface the mayhem ensues. The OS is just as much a part of it as the app.I'm sure the Ubuntu box was running flash, right? Why didn't that get compromised exactly the same way as with Vista?]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466383]]></guid>
        <dc:creator><![CDATA[catseverywhere@...]]></dc:creator>
        <pubDate>Wed, 02 Apr 2008 06:23:14 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[blame]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466072]]></link>
        <description><![CDATA[Developing software that isn't secure is bad.Developing an operating system that allows unsecured software for unprivileged users to take over the whole system is one way to develop software that isn't secure.Notice that, in the public posting of the rules for the contest, it says:&quot;To claim a laptop as your own, you will need to read the contents of a designated file on each system through exploitation of a 0day code execution vulnerability (ie: no directory traversal style bugs).&quot;This means that the vulnerability in question didn't just involve the behavior of Flash -- it also involved execution of arbitrary code.  The fact that the OS allowed the application to run unauthorized third-party code that accessed the filesystem is a problem.It's not as bad as the OS itself just allowing the compromise without any third-party software involved, but it's not good, either -- and the OS is indeed part of the problem.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466072]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 16:15:30 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[&quot;compromise&quot;]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466068]]></link>
        <description><![CDATA[&quot;Ubuntu is a compromise between user friendly and security.&quot;So is MS Windows.That's the problem -- they're compromises.  The correct approach is not to compromise security for &quot;user friendly&quot; operation.  It's to provide as much security as possible without making the goals you want to meet with your software prohibitively difficult.That's not a compromise at all -- it's a good choice.  When you compromise, you get worse, not better.&quot;Also, your ordering on the laptops makes a lot of sense. Its the order I would choose them in as well, though I would wipe OSX and install linux.&quot;I'd prefer either FreeBSD or, if it was still supported, OpenDarwin.  The architecture of OpenDarwin is excellent.. . . though, to tell the truth, I'd probably keep MacOS X on it if someone gave me a Mac laptop.  After all, it'd never be my primary computer: I prefer Thinkpads, thanks.  Having an extra laptop lying around with a different OS might be kinda handy.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466068]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 15:57:48 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[other options]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466066]]></link>
        <description><![CDATA[My Linux preference is Debian (no, it's not the same thing as Ubuntu).  There are other distributions that are generally more secure than Ubuntu in default configuration as well -- such as Fedora Core and Slackware, last I checked.LiveCD distributions are in some respects more secure than installed software, all else being equal, because the software on the CD can't be altered.  In other respects, they're less secure because of a number of reasons.  One is that all copies of a given version of a given LiveCD OS probably have the same passwords.  Another is that you're stuck with the configuration on the CD and what you change at runtime every single time you boot it up -- you can't permanently configure it to use settings specific to your security needs, because you can't change what's on the CD.My OS preference isn't actually a Linux distribution at all, by the way.  It's FreeBSD.  You can get a pretty gentle introduction to FreeBSD via PC-BSD if you're interested.OpenBSD is generally regarded as even more secure, but also a bit more user-unfriendly, in case you're curious.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466066]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 15:52:23 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[3rd party apps]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466030]]></link>
        <description><![CDATA[From what I have heard, the exploit was a combination of java (sun) invoking flash (adobe).  Both of these seem to have problems from the authors with DEP.  Obviously a Microsoft problem that other vendors are too lazy / careless about security / uncaring / over several years (reported as problems with XP SP2)!Lets try putting the blame for the exploits of third party apps where the real blame belongs.  This one also is supposedly a cross platform exploit.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2466030]]></guid>
        <dc:creator><![CDATA[TelcoChuck]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 14:25:55 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[I'll toss one out for you]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465836]]></link>
        <description><![CDATA[&quot;Mandriva one&quot;a fairly user friendly distro, without the security issue of Ubuntu / Kubuntu not having a root password, or the security issue of PCLinuxOS in allowing root login in runlevel 5Mint, Gentoo live are also good options.with livecds, the risks are low simply because the os is not alterable.it's after you install that the issues are something to pay attention to fixing.[ or avoid by picking a different distro to install ]]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465836]]></guid>
        <dc:creator><![CDATA[Jaqui]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 11:01:49 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[The Ubuntu may not be bsd]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465824]]></link>
        <description><![CDATA[but at least its default has most services disabled by default.  So even with no firewall, there is not much to access remotely.  Ubuntu is a compromise between user friendly and security.And while it lacks SELinux, and AppArmor is not enabled by default, these settings are beyond the average appliance user that just wants to &quot;use&quot; their computer.  Though, Ubuntu could go the Fedora route and enable a default, fairly permissive AppArmor policy by default, and include the context info and changes for each new app in the install routine for apt.Also, your ordering on the laptops makes a lot of sense.  Its the order I would choose them in as well, though I would wipe OSX and install linux.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465824]]></guid>
        <dc:creator><![CDATA[Dumphrey]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 10:52:30 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Which ones?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465833]]></link>
        <description><![CDATA[Would you care to expand on these &quot;certain other Linux distributions&quot;? I'm still new to Linux and mostly run live distros on occasions when I don't trust the machine I'm borrowing.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465833]]></guid>
        <dc:creator><![CDATA[Mond0]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 10:47:24 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Where?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465787]]></link>
        <description><![CDATA[Would you mind posting a link to this collection?Thanks,]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465787]]></guid>
        <dc:creator><![CDATA[Mond0]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 10:39:56 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Actually . . .]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465778]]></link>
        <description><![CDATA[&quot;I'm no M$ fan, but you can't blame M$ for sloppy code on the part of third parties.&quot;That depends on the nature of the exploit.  If a third-party application just gives the security cracker easy access to the system, but a vulnerability in the design of MS Windows allows the security cracker to escalate privileges easily (for instance), there's still a security problem with the OS.&quot;usually has new features added to Windows versions before the features hit OSX and Linux.&quot;You mean like multi-user capabilities, multiple workspaces or virtual desktops, and secure remote access?  Oh, wait, all those have been available on Linux and other Unix-like OSes for years before Microsoft even looked sideways at the possibility of including them in its flagship OS.  There are many, many features that MS Windows not only hasn't had before Linux/Unix systems, but has been a decade or so behind on, and in some cases may never include.&quot;The fact that Windows made it to the third day is amazing considering the security reputation / position just a few years ago. Well done M$...&quot;Keep in mind that most of the attention was probably on the Mac at first, because part of the prize is the computer -- and more people probably wanted the Mac than the MS Windows machine.  The Ubuntu machine probably benefited from a combination of being too difficult to crack (in comparison with the others) and being less specifically interesting to crack (because one could always just crack the MS Windows machine, then install some Linux distribution on it later).I, personally, would rather have a Macbook Air than the Fujitsu, and the Fujitsu than a VAIO.  I'd especially choose in that order considering it would probably be easier to crack security on MacOS X or MS Windows Vista than on a typical Linux distribution -- though I don't have much confidence in the default configuration of Ubuntu, compared with certain other Linux distributions.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465778]]></guid>
        <dc:creator><![CDATA[apotheon]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 09:49:29 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Rules...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465622]]></link>
        <description><![CDATA[If you follow the link at the end of the article and read the first 2 paragraphs of that article (11 lines...) it has a link to the rules. (Or, for the lazy: http://dvlabs.tippingpoint.com/blog/2008/03/19/cansecwest-pwn-to-own-2008 ).]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465622]]></guid>
        <dc:creator><![CDATA[Penguin_me]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 08:04:32 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[RE: Security news roundup: 911 hacker gets 3 years, Ubuntu Linux stays unhacked]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465422]]></link>
        <description><![CDATA[&quot;Windows Vista Ultimate was successfully exploited on the third and final day.&quot;&quot;The third day saw the inclusion of several popular third-party applications such as Skype and Flash ??? which led to the downfall of Windows Vista.&quot;humm...I'm no M$ fan, but you can't blame M$ for sloppy code on the part of third parties... M$ will always lose out here case there is so much more code around and usually has new features added to Windows versions before the features hit OSX and Linux.The fact that Windows made it to the third day is amazing considering the security reputation / position just a few years ago. Well done M$...Rich]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465422]]></guid>
        <dc:creator><![CDATA[richard.e.morton@...]]></dc:creator>
        <pubDate>Tue, 01 Apr 2008 04:30:46 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[rules?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465110]]></link>
        <description><![CDATA[What are the contest rules regarding security configurations on the machines? Are they &quot;install default,&quot; or can adjustments be made?Regardless, I can smell the flames from here... the Linux FBs will state the obvious, the windows FBs will whip out the Rube Goldberg rationalization templates, the Mac FBs are always in denial...=)]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2465110]]></guid>
        <dc:creator><![CDATA[catseverywhere@...]]></dc:creator>
        <pubDate>Mon, 31 Mar 2008 14:25:29 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Security news roundup: 911 hacker gets 3 years, Ubuntu Linux stays unhacked]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2464407]]></link>
        <description><![CDATA[Here?s a collection of recent security vulnerabilities, alerts and news, which covers a 911 hacker being sentenced to 3 years jail, an RTSP vulnerability that affects current versions of MPlayer and VLC media players, Cisco having its first patch day, and news that Ubuntu Linux remained unhacked at the conclusion of the latest ?PWN TO OWN? contest.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-259244-2464407]]></guid>
        <dc:creator><![CDATA[paulmah@...]]></dc:creator>
        <pubDate>Mon, 31 Mar 2008 02:28:42 -0700</pubDate>
    </item>
    </channel>
</rss>

