Re: securety related question...

On Thu, 10 Oct 2002, Erika Pacholleck wrote:

> [08.10.2002] [email protected] <-- :
> > I suppose if you're having other users delete your directories quite
> > often, that it might be a sign that you should listen to people who've
> > actually made a career of computer security.  ...or you can call around to
> > press agencies and places like CMU and tell them about this new DoS
> > vulnerability you've discovered in bash and make a complete ass of
> > yourself like Steve Gibson is so fond of doing.  I can promise you that
> > I'll be mightily entertained if you do.
>
> I would appreciate if you could stick to facts instead of assumptions
> and watch the choice of your words. Thanks

Fact: I actually got the stupid CISSP security certification--for what
good it does in the current job market.  I do computer security for a
living.  If I post using a psuedonym and people decide to act as if I'm
a 9-year old kid and behave in a supercilious or condescending manner it's
_their_ problem, not mine.

Fact: On at least two occasions Steve Gibson has done _exactly_ as I
described and called press agencies and administrators at CMU and Berkeley
to announce various trivial discoveries he has made, probably the most
famous of which was his reinvention of SYN-cookies a few years too late.
The man has a _skill_ for making a public spectacle of himself.

Fact: I chuckle to myself every time someone publicly reports something as
silly as finding overflow vulnerabilities in binaries that they must first
set suid to exploit, and which would not normally have any reason to be
suid (several of these hit Bugtraq each year), and complaints that a user
being able to delete their own files and break their jobs is somehow a
_bug_ doesn't really fall far from that particular tree.

Possibly you're unaware of this being in Germany and all, but the FCC
(defenders of public goodness and light that they are here in the US)
won't even *BLINK* at the use of the word "ass" in the context that I used
it.  If this still troubles you, try asking an adult.  (What?  I should be
insulting and cite the definition of the word from the OED?)


-- 
Unsubscribe: send email to [email protected]
and put 'unsubscribe lfs-security' in the subject header of the message