[Dshield] Re: Re: [Larholm/PivX] Proxy attackers/hijackers

Sam Node dshield at pfunkjr.cotse.net
Mon Oct 20 15:05:41 GMT 2003


<<Rant begins.>
<Been doing it.  5 different PCs.  One at a time, each time new patches come

<out, all dial up.  A ROYAL pain in the *ss!  Especially when the update 
<site goes down, or decides that my IE browser is NOT an IE browser, when it

<is.  Grrrr.  Not to mention my favorite ".., an unknown error has prevented

<the installation of..," usually seen during the installation after an hour 
<of supposedly downloading a patch.

<MS has been aware for years that they built a system with holes someone can

<drive trucks through and they ignored it inspite of the warnings from 
<Gibson, CERT, and dozens of others.

This is from a former member of Team OS/2. In other words, I didn't buy it
if it was marketed by Microsoft back in the 80s and early 90s. Now, I'm
patching all our machines at work and home AND friends AND relatives, etc...
So, I'm frustrated too.

If it makes you feel any better, I have been patching my Linux boxes just as
often - IF NOT MORE - as my WinNT/2000/XP machines. The KDE GUI was recently
COMPLETELY updated for security reasons. I even won't go into the OpenSSL
issues and Send Mail and the myriad of other Linux security patches.

Anyone who used the Internet during the late 1980s and very early 1990s (I'm
too young to go back further. Hahaha - AND I have a really well built bridge
over the Hudson for sale.) was communicating with academics, for the most
part. There were no browsers - you used Gopher and ftp and email - nothing
else was available! There were no bad actors and very few people (as
compared with now...) outside of the US using the Internet. In those times,
I never even thought of firewalls. In 1993, I did use FPROT to disinfect my
minister's DOS box that a local business donated to the church. Frankly I
would (now and then...) use an anti-virus to scan my machine, but only when
I thought about it.

The point is this: Unix, Linux, the different flavors of windows, and the
MAC OSes were not designed for "protected computing." Why? Because it wasn't
necessary back when these operating systems were introduced. Let's face it -
it is not Microsoft's fault - any more than it was the automaker's fault for
all accidents or bank robber's getaway vehicles  - that people intentionally
misuse or unintentionally have accidents with their products. I DO remember
when GM was selling the Corvair. It was one of the most fuel efficient cars
available (Remember the little 4 cyl. Pontiac Tempests?). These cars flopped
in the market and Ralph Nader made sure that the Corvair was known as
"Unsafe at Any Speed." I never understood how a car that had the basic
design of the revered Volkswagen Beetle could so maligned. Oh Well... When
the fuel crisis of the 1980's came... Gee! - People wondered where the U.S.
automakers had been! <begin sarcasm> They had to be in bed with BIG OIL -
ripping off the American consumer! <end sarcasm>

I digress... We're patching ALL these OSes now because there were NO SUCH
THREATS back when they were released.

I dropped Warp - OS/2 version 3.0 (BTW, I paid IBM $100 - back when MS
started their Win95 preview program. Does anyone remember the WINS servers
on the Internet? There were hundreds of people sharing files by using WINS.
Talk about unsecure! But we didn't worry about it, then. No one bothered us.
Times have changed.

Remember - For every vulnerability that MS patches, another one will pop up.
It's like trying to make your house "burglar proof" - it can't be done. Why?
There are very determined criminals out there who will try to break in and
steal you stuff or vandalize your place - Internet or otherwise.

Anyone been patching their expensive Cisco routers? I could go on about a
myriad of other hardware and software manufacturers.

Do you feel better, now?




More information about the list mailing list