full-disclosure - SSH Exploit Request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: SSH Exploit Request 

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com 
> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of 
> Robert Davies
> Sent: Thursday, November 13, 2003 11:09 AM
> To: full-disclosure@...ts.netsys.com
> Subject: RE: [Full-Disclosure] SSH Exploit Request 
> 
> I am failing to see the logic in some of these issues here...
> 
> A service is flawed in one way or another, patch it! If the 
> vendor says the service is broke in some way, believe them, 
> get off your lazy ass and get patching. If you are the admin, 
> do your job and quit whining!
> 
Never heard the phrase, "Never criticize a man until you've walked a
mile in his shoes", Robert?

> Since that argument throws about the sniveling of, "We can't 
> afford the downtime of a server reboot", then think of it 
> this way, with services such as SSH, a restart of the SSH 
> Service does NOT shut down the whole server or kill active 
> connections, instead it's a 2 second lapse where the server 
> will refuse the connection, in which super important person Z 
> will just have to rety to connect.
> 
In some people's worlds, they don't get to make those decisions.  Yet
you would toss them out in the street for incompetence because you are
so much more competent?
> 
> I am quite bothered out the ass by well paid admins that are 
> too damn lazy to spend the few minutes it takes to repair a 
> flawed service. Either start doing your job, or get the hell 
> out of the way for those of us that want to do the job 
> required properly!
> 
I'm equally bothered by people who think they have all the answers and
anyone who doesn't think they way they do is incompetent.

So, now we're both equally bothered, and yet we haven't accomplished a
thing.  Frustrating, isn't it, Robert?

Maybe we should concentrate on our own problems and let other people
solve theirs?

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/