bugtraq - RE: Re: January 15 is Personal Firewall Day, he lp the cause

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 16 Jan 2004 11:32:08 -0600
From: "Wes Noonan" <mailinglists@...consulting.com>
To: <vb@...tpanic.ulm.ccc.de>, <bugtraq@...urityfocus.com>,
   <full-disclosure@...ts.netsys.com>
Subject: RE: Re: January 15 is Personal Firewall Day, he lp the cause

> With these quick steps, a solution without any costs but network
> access, Windows can be much more secure.

Did you really just propose that a viable solution is to remove network
access? Basically turn off everything that allows corporate uses to share
information and collaborate and you have security panacea. Granted, you
can't do a damned thing, but let's not forget that technology doesn't exist
to facilitate companies in making a profit and sharing of information, it
exists for some other geek reason.

This is in addition to "well, if you don't run popular software you aren't
as susceptible to threats". Yeah, back in 94 if you ran NT you weren't as
susceptible to all the Novell threats... then NT became the big player and
now you have folks saying "yeah, well run Linux and you won't be susceptible
to all those Windows threats". And if Linux ever goes mainstream and if
Linux ever surpasses Windows in market share, then 5-10 years down the road
people will be saying "yeah, but if you run ziggledorf, then you won't be
susceptible to all those Linux threats". 

This security through obscurity mantra is laughable.

The top dogs always get the most exploits. Accept the reality. When everyone
else starts using Firebird, Thunderbird or whatever other obscure program
you want to mention as your own personal bestest solution, then it will get
hacked and exploited beyond belief. History proves this.

Disconnecting from the network or disabling all those services that provide
network access is an unrealistic expectation. Next thing you know, you will
be proposing only using carbon paper to share documents (though surely
someone on this list will then point out the inherent security flaws in what
to do with the used carbons).

And people wonder why users don't understand, but certainly fear, a good
chunk of computer security...

Wes Noonan
mailinglists@...consulting.com
http://www.wjnconsulting.com 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html