full-disclosure - Re: Ubuntu 11.10 now unsecure by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 18 Nov 2011 12:04:46 -0800
From: Johan Nestaas <johannestaas@...il.com>
To: Olivier <feuille@...ibox.fr>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Ubuntu 11.10 now unsecure by default

Sometimes it bothers me that everyone says Ubuntu is made for newbs and
that you're expected to switch distros as soon as you know enough to do it.
I worked as an intern with some folks who developed 802.11s, secure mesh
networking, and they mostly used Ubuntu. I find it extremely fast to
install, set up IDE's, and get a dev workstation up and running. I've never
had an easier time installing a printer. Sure, that helps newbies, but it
also makes work happen quick. If any problems come up, you can't beat their
user base and forums.
I love the freedom of choice, and I switch it up every few months to see
how the other distros are doing, but generally I'm back to ubuntu in a few
weeks.
Also, maybe I'm wrong about this and there are other reasons, but the
newest backtrack is ubuntu based, and they always mention that their distro
is meant for experienced linux users (and more of a toolkit than anything).
I don't know, I guess I feel like ubuntu should be cut some slack for being
newb friendly. It's not such a bad thing.
On Fri, Nov 18, 2011 at 11:32 AM, Olivier <feuille@...ibox.fr> wrote:

> On 11/18/2011 03:10 PM, Dan Kaminsky wrote:
> >
> >
> > On Fri, Nov 18, 2011 at 5:01 AM, <Valdis.Kletnieks@...edu
> > <mailto:Valdis.Kletnieks@...edu>> wrote:
> >
> >     On Thu, 17 Nov 2011 15:53:41 CST, C de-Avillez said:
> >
> >     > There is no guest account on an Ubuntu server, so at least there
> >     > this is not a real/perceived risk.
> >
> >     And nobody's *ever* installed the desktop version on a server
> >     because they didn't
> >     know any better, especially from Ubuntu's target audience.  Gotcha.
> ;)
> >
> >
> > OK, seriously.  If you're sitting in front of a machine that's
> > presenting you a login prompt, you've got enough privileges to insert a
> > bootable USB/CD and pull all the data / make yourself an account
> > (FDE/Bios PW notwithstanding).
>
> My disk is password protected, and the whole system (except /boot) is
> encrypted. Ubuntu guest account is definitively the best way to hack a
> running laptop (or workstation).
>
> --
> Olivier
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/