full-disclosure - MS should point windowsupdate.com to 127.0.0.1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.GSO.4.53.0308151010370.11829@login-01.ee.ethz.ch>
From: oetiker at ee.ethz.ch (Tobias Oetiker)
Subject: MS should point windowsupdate.com to 127.0.0.1

Yesterday Schmehl, Paul L wrote:

> > > Because the local techs have no clue, it will
> > > take the affected companies ages to get back on the net.
> >
> > Which is perfect actually as it points out all the
> > stupid admins who get paid a lot of cash but really
> > sit around all day with their finger up their noses.
>
> I just curious how you geniuses would solve this problem.  You have a
> multi-six figure scientific instrument, which is only manufactured by
> one vendor in the entire world.  Your research department depends upon
> that instrument to do research for which they are being funded
> handsomely by grants and expected to produce results.
>
> There's only one problem.  The instrument requires that you run Windows
> 2000 Server with IIS, and the vendor requires that you not apply *any*
> patches post SP2.  The government certifies the equipment at a certain
> patch level, and if the equipment is patched then the certification no
> longer applies, the research is no longer funded and you are now staring
> a six figure boat anchor.
>
> Given that scenario, please apply your scintillating logic to the
> problem of patching this machine to protect it against threats that were
> discovered *after* SP2.

In the paragraph before you say, that there are not to be applied
*any* patches ... so how comes now you want to patch it ?

* If no patches are to be applied then all is well, you don't care
  about windowsupdate working or not.

* If patches are to be applied, I assume the vendor would certify
  the one which makes patching possible as well.

cheers
tobi

-- 
 ______    __   _
/_  __/_  / /  (_) Oetiker @ ISG.EE, ETZ J97, ETH, CH-8092 Zurich
 / // _ \/ _ \/ /  System Manager, Time Lord, Coder, Designer, Coach
/_/ \.__/_.__/_/   http://people.ee.ethz.ch/~oetiker   +41(0)1-632-5286