blog*spot

QODS ec

Saturday, June 12, 2004

PROG: CS622 S2001 Distributed Networks Home Page

CS622 S2001 Distributed Networks Home Page

UNIX: SCO - Ancient UNIX

SCO - Ancient UNIX

PROG: OS

OS

PROG: Linked Lists

Linked Lists

PROG: Drawing With Mouse

Drawing With Mouse

PROG: An Othello Game

An Othello Game

PROG: Index of /~anthony/info/C

Index of /~anthony/info/C

PROG: Infrequently Asked Questions in comp.lang.c

Infrequently Asked Questions in comp.lang.c

BOOK: Christophe's C stuff directory

Christophe's C stuff directory

BOOK: C Elements of Style

C Elements of Style

BOOK: Writing Bug-Free C Code

Writing Bug-Free C Code

BOOK: KDE 2.0 Development - Andamooka Reader

KDE 2.0 Development - Andamooka Reader

LINK: programmingsite.co.uk :: programming resources in various categories

programmingsite.co.uk :: programming resources in various categories

LINK: {Codepage 2.3}

{Codepage 2.3}

LINK: CSPP 51081 Home Page

CSPP 51081 Home Page

Friday, June 11, 2004

VIRUS: Who's Getting Rich on Computer Viruses?

NewsFactor Network - Network Security - Who's Getting Rich on Computer Viruses?

By Justine Brown
Enterprise Security Today
June 9, 2004 2:42PM

"If you're that good of a programmer, you have a bright future ahead, but it's not in writing viruses," said David Perry of Trend Micro. "We need to continue to pursue and apprehend and punish virus writers, and put out the message this is not acceptable behavior."

Computer viruses cost businesses and consumers around the world billions of dollars each year. So who -- if anyone -- is profiting from viruses? And if no one is profiting, what is the motivation behind virus creation? The answers are not completely clear.

"Almost all viruses are written for the same reason that people put graffiti on walls," said David Perry, global director of education at Trend Micro Latest News about Trend Micro. "It's simply a desire to claw their initials into the middle of your hard drive."

Yet, recent events have uncovered what may be a new trend: spammers paying virus writers to create worms that plant an open proxy, which the spammer then can use to forward spam automatically. Many suspect this occurred with the SoBig virus.

Spam Engines

"Worm authors are using their worms to become spam engines," said Christian Byrnes, senior vice president of technology research services at Meta Group Latest News about Meta Group. "The worm spreads itself over the Internet and then into people's computers. It doesn't do any damage; it just becomes a spam pass-through -- an e-mail relay. The spammer can then send an address list and a piece of spam, and the person's home computer will send out thousands of e-mails to people all over the world without their knowledge."

A D V E R T I S E M E N T
With increasing numbers of states passing legislation banning spam, and Internet service providers cracking down on those that abuse their systems, worms may be the next-best choice for spammers.

Using worms to send spam via such paths makes it extremely difficult to identify the item as spam and to trace the true sender.

Opportunistic Spammers

But it is also possible that spammers are using such open proxies without having any connection to the virus writers, according to Perry.

"They can scan the Internet looking for open proxies. Someone might have found SoBig and reported it to other spammers to use. We don't have any hard evidence that the SoBig writer received any money," he said.

A D V E R T I S E M E N T
Looking for Mischief

If the spam connection does not exist, then who is creating viruses? Primarily kids, Perry maintains -- and increasingly, groups of kids. "As we move forward, we're seeing a change in the nature of virus writing," he said.

"Instead of one kid sitting down and writing a computer virus Latest News about computer virus, now we get an Internet club of kids writing viruses together. Between them, they put out something that's a lot bigger technology than one of them could put out alone."

But most viruses are poorly written programs that are not difficult to create. "The famous Anna Kournikova virus was written by a kid that didn't know any computer programming at all," said Perry. "He went to a Web site that generated the virus for him."

Both Perry and Byrnes reject any speculation that virus companies themselves generate viruses to create a market for their products. "If we were doing that, the FBI would have uncovered it by now," said Perry.

A D V E R T I S E M E N T
Future Not Bright

Despite crackdowns and well-publicized arrests, such as that of the 18-year-old German student charged last month with creating the Sasser virus, the creation of new viruses is not likely to end anytime soon. The Sasser arrest may chill virus writing briefly, but as another generation of teenagers emerges, it will likely pick up again.

Preventing the spread of such viruses, therefore, is a more effective strategy than trying to stop them altogether.

Much of that effort involves education, and efforts are being made on a national level. In April, the Department of Homeland Security and the National Science Foundation announced an agreement to co-sponsor and expand the existing NSF Federal Cyber Service: Scholarship for Service program. The partnership will help strengthen cyber security by promoting higher-education courses that increase the number of information-security professionals trained to protect public- and private-sector I.T. systems.

Ethics Message

Meanwhile, Perry currently is working with a task force created to increase awareness of, and education about, computer viruses. Part of that effort involves trying to get an ethics message across to kids likely to write viruses.

"It's hard not to make it sound cheesy," he said. "We want to tell them we aren't impressed. If you're that good of a programmer, you have a bright future ahead, but it's not in writing viruses. We need to continue to pursue and apprehend and punish virus writers, and put out the message this is not acceptable behavior."

User education is also critical. Much of what causes viruses to spread can be summed up as "social engineering," according to John Pescatore, vice president and research fellow at Gartner Research.

Perry agreed.

"The love letter virus said, 'I love you.' Everyone wants to be loved, so they opened it," Perry said. "The Anna Kournikova virus said, 'Here's a naked picture of Anna Kournikova,' and everyone wanted to see a naked picture of Anna Kournikova, so they clicked on it. When addressing the dynamic of computer security, there's a large component of it that simply has to do with educating users not to open documents that could contain viruses."

SEC: MasterCard: Risk is in the cards

MasterCard: Risk is in the cards | Newsmakers | CNET News.com


By Ong Boon Kiat
Special to CNET News.com
http://news.com.com/2008-1029-5231474.html

Story last modified June 11, 2004, 8:06 AM PDT

Advertisement
toshibadirect.com

Instead of a jargon-filled dissertation, MasterCard's new regional head of security, Tim Morris, gave a cheerful and low-tech answer when asked how he tackles security in his line of work.

"Consultation, consultation, consultation," said the burly Australian, who is four months into his tenure as MasterCard's Asia-Pacific vice president and regional head for security and risk management.

"It's like location, location, location in real estate," he said. "There's just no substitute for sitting down and talking to your client, because the better you understand them, the better your solutions will be."


Get Up to Speed on...
Enterprise security
Get the latest headlines and
company-specific news in our
expanded GUTS section.



Morris, a 20-year industry veteran who served as the chief of counterterrorism in the Australian Federal Police before he joined the credit card industry, now spends a huge chunk of his time coaxing MasterCard holders into adopting the counter-fraud measures developed by his 10-person team in Asia. Through that, he has learned how tough it can be to create a common security solution that satisfies each member's unique requirements.

"For me, that's the biggest challenge," he said.

So what else does he find challenging about managing people and security?

Q: What threats will e-commerce face in the next five years?
A: Global payment is certainly not immune from globalization. We've seen issues like identity theft really starting to become high-profile in the United States. For example, you look at "phishing" Web sites--they are really exploding around the world now.

The problem is this: Today's criminal doesn't have to be geographically co-located with the scene of the crime. He could be sitting in an office in Uzbekistan, and the victim could be in Singapore or Sydney. That's one of the challenges that law enforcement have to grapple with every day. There's no quick solution to that one.

We are certainly seeing a higher take-up rate of people who are comfortable using electronic commerce, which unfortunately also means that you have a rising pool of potential victims out there.

The solution to that is to educate the public; to make them more security-aware when using electronic commerce platforms.

But public education can never be foolproof, right?
That's where risk management comes in. You need to know where your greatest risks are and how to measure those risks. It's what MasterCard's site data protection program tackles. It does (a) security scan of Web sites to look for vulnerabilities. And it offers proactive monitoring and alert services.

With this program, what we are trying to say is: We want the merchants that use our system to be well safeguarded and have comprehensive security systems. We want the customers who deal with the merchants to be able to deal with them in confidence.
With non-face-to-face credit card transactions becoming more popular, a photo really doesn't help you.
Our other initiative, SecureCode, is another way which we impart a higher level of confidence to users when they are using the Internet.

I don't think we are ever going to produce a silver bullet that's going to be the answer for everybody's security concerns. Rather, it is a series of measures being implemented, with each one being more sophisticated and comprehensive. It's a matter of evolution.

Could the worsening situation of computer virus attacks derail e-commerce?
It could be (serious enough to directly impact e-commerce), but I don't think multinational companies like MasterCard are directly at risk. We have got pretty sophisticated safeguards to protect against them.

However, I think that the merchant who isn't as e-savvy, who is small and has limited resources to apply (relevant countermeasures), will be more vulnerable. That's why programs like our site data protection program are relevant.
As MasterCard rolls out new solutions, like the recent wireless PayPass and Web-based SecureCode, do you find that convenience and security are incompatible?
Not really. Of course, the easy way to make the most convenient system in the world is to ignore privacy and security. Likewise, making the most secure and private system in the world is not difficult, only that you wouldn't be able to use it anywhere.

So how do you deliver a system that does both? The answer is technology.

With the solutions that are out there today, it is a matter of sorting through them, testing them and making sure that we get the right one. In the end, I'm confident that everyone's needs will be met.

But with more people getting jumpy about security, do you see the balance tipped at some point, with credit card companies sacrificing convenience in order to bump up security?
My tip is: Invest in a paper shredder in the office.
Hard to say, if only because new technologies are constantly arriving on the market, and that means that the planners have to reassess what could be delivered in terms of payment cards. So because things are so dynamic, it is difficult to predict exactly what manifestation would happen next.

Which credit card security technology is hottest now?
Well, there is now a major commitment from major card payment players toward chip-based credit cards. This move is significant because we now have the issue of shifting liabilities.

Explain what you mean by shifting liabilities.
If an issuer has a chip-enabled card, and an acquirer does not have a chip-enabled terminal, then any charge-back liability will shift to the acquirer. Likewise, if the acquirer has a chip-enabled terminal, and an issuer has a non-chip card, then the liability will remain with the issuer. So (the aim) is to encourage the industry to embrace chip-based credit card platforms.

Or force the acquirer to get chip-enabled terminals?
Well, that's the choice that they have to make, but I would. But it is also a big investment for the issuer, so it is a collective effort.

What is the impact of all this on the consumer?
For the consumers, chip-enabled cards mean more security, because there's far more (security measures) that can be delivered with chip-enabled cards. And since consumers won't be impacted at all in terms of liabilities, they will be the big winners, because they now have a more secure payment product in their pocket.

On the subject of credit card security, why do you think photo identification credit cards aren't more popular today?
It's interesting, you know.
I think you would be amazed what some people would leave in their laptops. There's a lesson to be learned there.
Citibank in Australia has a photo ID card, and that's one of its main marketing strategies, but there hasn't been much take-up. Of course, it's up to the financial institutions that issue credit cards whether they want a photo on them or not, but for reasons known to them, it is something that they seem to deem unwarranted.

Why?
Well, I think that if you have a white piece of plastic, you could basically screen or print anything that you like on it, and that includes photos. So if you were the thief, you could print a photo just as easily as you would other data. It is possible to counterfeit the photo as well, just like passports can be counterfeited.

And with non-face-to-face credit card transactions becoming more popular, a photo really doesn't help you there.

Don't get me wrong. I'm not against photo ID credit cards, but once again, it is not the silver bullet that's going to solve your problems.

For someone who deals with security intimately, what advice would you offer information technology managers in Asia on your pet topic?
The latest craze in the United States is the (document) shredder. And sales of shredders have just gone through the roof there. This tip might sound basic, but it is not silly. Americans now are learning to take care of their confidential information. And this is very important, because out-of-sight isn't out-of-mind when it comes to data.

So my tip is: Invest in a paper shredder in the office.

What's your second tip?
Tip No. 2 would be to protect data on your laptop with proper policies and data protection techniques. Just before I left the Australian Federal Police (early this year), the Australian government did an audit of laptops in various Australian government departments, and I think they found out that 300 were missing. So the next question is: What's on those laptops? I think you would be amazed what some people would leave in their laptops. There's a lesson to be learned there.

One last tip?
Ask questions. Be inquisitive. IT managers need to (constantly ask) other business units about the impact caused by the measures that they are taking. I mean, it's getting complex now, and you really need to ask questions to find out. Unless you ask often, you won't really find out what the impact is.

And as you implement measures, it's also about making users downstream aware of the benefits of your measures. Make them aware that (these measures you are implementing) are going to have a positive impact on their bottom line--even though they may seem inconvenient and (return on investment) may not always look obvious.

M$: Microsoft sues eight alleged spammers

Microsoft sues eight alleged spammers - Computerworld: "News Story by Grant GrossJUNE 11, 2004 (IDG NEWS SERVICE) - Microsoft Corp. has filed lawsuits against eight alleged spammers under a new U.S. antispam law that went into effect in"

News Story by Grant Gross

JUNE 11, 2004 (IDG NEWS SERVICE) - Microsoft Corp. has filed lawsuits against eight alleged spammers under a new U.S. antispam law that went into effect in January.

Microsoft is accusing the defendants of violating the Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act by falsifying their domains, routing e-mail through open proxies, deceiving customers with misleading subject lines and failing to include unsubscribe options in their e-mails.

Each of the defendants allegedly sent millions of e-mail messages, soliciting a variety of products including body-part enlargement pills, prescription drugs, dating services, university degree programs and work-at-home and get-rich-quick scheme offers. The eight new lawsuits don't include major spammers, but some of the defendants sent out hundreds of millions of pieces of unsolicited e-mail, according to a Microsoft spokesman.

Microsoft intends to continue filing spam lawsuits until spammers stop sending unsolicited e-mail, the spokesman said.

Four of the spam cases were filed June 2, with four more filed yesterday. In addition, three spam cases that Microsoft filed in December have been amended within the past two weeks to name defendants. The cases, filed in Washington state, ask the court to order the alleged spammers to stop creating Microsoft Hotmail accounts and to stop hijacking Microsoft computers to send spam.

Microsoft is seeking unspecified damages.

One of the eight new cases is against a defendant listed on the Register of Known Spam Operations (ROKSO), operated by the Spamhaus Project. Over the past year, Microsoft has filed more than 80 legal actions against spammers, including 51 in the U.S., according to the company. Nine of those U.S. lawsuits were against alleged spammers on the ROKSO list, including five on ROKSO's top 10 list.

In late April, the U.S. Federal Trade Commission filed CAN-SPAM-related charges against two alleged spamming companies.

LINUX: Mixed rulings advance two SCO cases

Mixed rulings advance two SCO cases | CNET News.com

By Stephen Shankland and Dawn Kawamoto
Staff Writer, CNET News.com
http://news.com.com/2100-7344-5231756.html

Story last modified June 11, 2004, 10:50 AM PDT

Advertisement
toshibadirect.com

The SCO Group won two and lost two in its Unix-related lawsuits against IBM and Novell, with a federal judge issuing rulings that, among other things, granted SCO's request to delay the IBM trial.

SCO's case against IBM, which alleges that Big Blue violated its Unix contract with SCO by moving proprietary software to Linux, had been set for April 2005, but Judge Dale Kimball of U.S. District Court in Utah pushed the five-week trial back to Nov. 1, 2005, according to court documents filed Thursday.

SCO's assertions that Linux is tainted with proprietary Unix intellectual property sent tremors through a computing industry that has eagerly embraced the open-source operating system. But the case began nearly a year and a half ago--almost an eternity in the fast-paced technology world--and SCO's foes have been impatient to see what SCO claims the infringements are.

IBM's countersuit includes three claims that SCO violated IBM patents, which SCO had sought to split into a separate case. Kimball denied that request.

In a separate ruling in the Novell case on Wednesday, Kimball denied SCO's request to move the case to state court. Novell, an earlier owner of Unix, argues it never transferred the operating system's copyrights, and SCO sued to try to establish its ownership.

In SCO's favor, Kimball also denied Novell's motion to have the case thrown out based its interpretation of contracts governing the sale. However, for SCO to meet the requirements of its "slander of title" charge, the judge said SCO had to amend its claim by July 9 with specific claims of financial damage stemming from Novell's actions.

The latest movements may be welcome by eager observers of the case. SCO's claims, often made in interviews and news conferences, have inflamed Linux advocates, who have responded in kind with investigations into the history and source code of Linux and Unix.

Despite SCO's request that the IBM case be delayed, the clock is ticking. SCO had a $15 million net loss for its most recent quarter, $4.4 million of which was from its SCOsource lawsuits and largely unsuccessful efforts to get Linux users to buy SCO intellectual property licenses to avoid legal actions.

CEO Darl McBride said Thursday that SCO's $61.3 million in cash and marketable securities is enough to see the cases through.

Kimball changed the IBM case schedule because of the new counterclaims IBM added to the case after the initial schedule was made and because the judge declined to separate those counterclaims, he said.

SCO also sued AutoZone and DaimlerChrysler for their Unix and Linux dealings, while Linux seller Red Hat sued SCO to try to disprove accusations that Linux code is tainted with copyrighted Unix code, which the SCO Group claims to own.

An 'ambiguous' contract
Kimball indicated there's room for interpretation in whether a 1995 Asset Purchase Agreement and 1996 amendment really did transfer copyrights--as SCO argues and Novell disputes--when Novell sold at least some elements of its Unix business to SCO's predecessor, the Santa Cruz Operation.

The APA specifically excluded all copyrights from transfer, but the amendment then added into the transfer "the copyrights and trademarks owned by Novell...required for (the Santa Cruz Operation) to exercise its rights with respect to the acquisition of Unix and UnixWare technologies."

These documents are "ambiguous," Kimball said, and not enough to convince him immediately that the copyrights had been transferred.

"It is questionable on the face of the documents whether there was any intention to transfer the copyrights as of the date the agreement was executed," Kimball said. "The amendment contains no transfer language in the form of 'seller hereby conveys to buyer'...Moreover, the use of the term 'required' in (the amendment) without any list or accompanying list or definition of which copyrights would be required for SCO to exercise its rights in the technology is troublesome, given the number of copyrighted works involved in the transaction."

LINUX: SCO Ruling May Threaten Linux's Progress in Enterprise

SCO Ruling May Threaten Linux's Progress in Enterprise

M$: Where, Oh Where Is Windows XP SP2?

Where, Oh Where Is Windows XP SP2?

M$: Linux threat is rising

Microsoft: Linux threat is rising | CNET News.com

By Graeme Wearden
Special to CNET News.com
http://news.com.com/2100-7344-5231561.html

Story last modified June 11, 2004, 10:05 AM PDT



More companies are using the threat of Linux when negotiating deals with Microsoft, one of the company's senior executives has admitted.

A year after a letter from Microsoft CEO Steve Balmer to his employees acknowledged the Linux threat looming on the horizon, Microsoft remains adamant that open-source software isn't a serious

competitor on the desktop today. However, it may well be forcing Microsoft's prices down.

"It's definitely more of a threat than it was," said Nick Barley, director of marketing at Microsoft, when asked whether more businesses are telling Microsoft that they're planning to migrate to Linux rather than to one of its own operating systems or applications in the hope of getting a better deal.

Barley wouldn't say how successful this tactic has been.

"It shouldn't be successful if we have built appropriate value-based relationships with our customers, so that they appreciate the extra value that we offer," Barley said, speaking at a Microsoft event in London. The '20:20 Seminar Series: Microsoft Windows and Linux' event was billed as an "open and honest technology discussion" and included speeches from Microsoft executives and independent parties.

According to Philip Dawson, senior program director at Meta Group, Linux poses just as significant a threat to Unix vendors as it does to Microsoft. He pointed out that it's simply good business sense in negotiations with a potential supplier to make clear that you're seriously considering using their rivals instead, even if you're not.

"It's true to say that Linux is a tool for trying to beat Microsoft up," Dawson said.

Microsoft used Thursday's event to try to dispel "the myths" surrounding Linux. A key plank in its argument is that open-source software isn't cheaper in the long run because companies need to spend more on retraining IT staff who may be experienced in Windows software but not in the open-source arena.

"We asked an audience of 250 or 300 businesspeople today if they thought that Linux was a free option, and no hands went up," said Nicholas McGrath, head of platform strategy at Microsoft.

McGrath also cited a series of recent customer wins, including the London borough of Newham's decision to go with Microsoft rather than open-source options. McGrath claimed that Newham can look forward to potentially twice the productivity-associated cost savings than if they had gone down the open-source road.

Those familiar with the Newham case, though, say it is actually a prime example of Microsoft cutting its prices when facing the threat of Linux.

Last year, a consultancy firm called netproject presented Newham with an open-source alternative to using Microsoft, and it is thought that this forced Microsoft to put a much more attractive offer on the table.

Speaking in January after Newham had made its decision, netproject's director, Eddie Bleasdale, said that "whenever netproject demonstrates an open-source solution to a Microsoft customer, they suddenly find Microsoft's approach much more amenable."

"Microsoft's reaction to Newham's decision to use netproject's Secure Open Desktop Architecture proves that it is a credible and viable alternative," Bleasdale added.

Netproject is now running an 'incubator club' for companies that want to learn about the potential benefits of open source.

McGrath declined to disclose further details about Microsoft's deal with Newham, but said more information would soon be released.

Paul Hartigan, chief executive of PharmiWeb Solutions--who attended the event as an example of a satisfied Microsoft customer--said he would welcome more visibility regarding Microsoft's pricing structure.

PharmiWeb recently chose to use Visual Studio .Net rather than J2EE or Eclipse, the Linux-based open-source tool, as the development environment for a portal it has built for the health-care sector. Hartigan said the top reason for making this decision was that Microsoft was a "one stop shop" for PharmiWeb's various needs.

NEWS: Antitrust Smackdown

Wired 12.06: VIEW

VIEW


VIEW|question

Pat Mooney
Executive director, ETC Group
There have been 11 negative studies on nanotech's effect on health and the environment, and they're coming from DuPont and NASA and major universities, not from Greenpeace. Meanwhile, products with nanomaterials are slipping through FDA loopholes and making it to market without proper testing.

* Start

* Sun is just a pawn in Microsoft's game
* Linux's potty-mouthed programmers
* The 20-MHz running shoe
* The Great Egg of China
* Desperately seeking Sasquatch
* More »

* Play

* Inside Spielberg's Terminal
* Simball wizards and open sourcery
* Geeking out at Seattle's sci-fi museum
* Fetish: Technolust
* Test: Consumer reviews
* More »

* View

* The organization outsmarts the CEO
* Hot Seat: Time Warner's cable guy
* Sterling: How political purges will kill American science
* Lessig: Europe's swat at Microsoft hits us all
* More »

Kevin Ausman
Executive director for operations, Center for Biological and Environmental Nanotechnology, Rice University
It's always dangerous to take early studies and try to make generalizations. Nanotech is certainly not completely new or unnatural. Natural nanomaterials are released in the environment - through forest fires, volcanic eruptions, diesel exhaust. Once we figure out what's analogous to current systems, we'll find that we have already done a lot of the work of testing.

Christine Peterson
President, Foresight Institute
A huge number of new chemicals are produced every year, and 85 percent of those submitted to the EPA have no health data at all. But bringing the industry to a standstill is not the answer. The way to drive forward is to speed development of molecular manufacturing.



VIEW|essay

American companies are suffering from a personality crisis. They talk about the virtues of flattened hierarchies and bottom-up organizations, and they laud the genius of the market. But when it comes to what they actually do, companies prefer authoritarianism to democracy. Success, most corporations assume, depends on the efforts of a few superlative individuals. As a result, they treat their CEOs as superheroes, look on most of their employees as interchangeable drones, and remain fond of command-and-control strategies that wouldn't have been out of place in the Politburo. In doing so, firms are neglecting their most valuable resource: the collective intelligence of the organization as a whole.


Instead of looking to a single person for the right answers, companies need to recognize a simple truth: Under the right conditions, groups are smarter than the smartest person within them. We often think of groups and crowds as stupid, feckless, and dominated by the lowest common denominator. But take a look around. The crowd at a racing track does an uncannily good job of forecasting the outcome, better in fact than just about any single bettor can do. Horses that go off at 3-to-1 odds win a quarter of the time, horses that go off at 6-to-1 win a seventh of the time, and so on. Decision markets, like the Iowa Electronics Markets (which forecasts elections) and the Hollywood Stock Exchange (which predicts box office results), consistently outperform industry forecasts. Even the stock market, though it's subject to fads and manias, is near-impossible to beat over time.

By contrast, while it's clear that some CEOs are excellent leaders and managers, there's little evidence that individual executives are blessed with consistently good strategic foresight. In fact, in an extensive study of intelligent CEOs who made disastrous decisions, Dartmouth's Sydney Finkelstein writes, "CEOs should come with the same disclaimer as mutual funds: Past success is no guarantee of future success." Even when executives are smart, they have a hard time getting the information they need - at so many firms the flow of information is shaped by political infighting, sycophancy, and a confusion of status with knowledge. Hierarchies have certain virtues - efficiency and speed - as a way of executing decisions. But they're outmoded as a way of making decisions, and they're ill-suited to the complex strategic landscapes that most companies now inhabit. Firms need to aggregate the collective wisdom instead.

One intriguing method of doing this is to set up internal decision markets, which firms can use to produce forecasts of the future and evaluations of potential corporate strategies. Few companies have tried such markets. But the few examples we have suggest that they could be very useful. In the late 1990s, for instance, Hewlett-Packard experimented with artificial markets to forecast sales. Only 20 to 30 percent of employees participated, and each market ran for just a week, with people trading at lunch and in the evening. The market's results outperformed the company 75 percent of the time. Even more impressive was a recent experiment at e.Lilly, a division of Eli Lilly, which set up a market to test whether it was possible to distinguish between drug candidates likely to be approved by the FDA and those likely to be rejected. Realistic profiles and experimental data for six hypothetical drugs were devised by e.Lilly, three of which it knew would be approved and three rejected. When trading opened, the market - made up of a diverse mix of employees - quickly identified the winners, sending their prices soaring, while the losers' prices sank.

The evidence is clear: groups - whether top executives evaluating a potential acquisition or sales reps and engineers analyzing a new product - will consistently make better decisions than an individual. Companies have spent too long coddling the special few. It's time for them to start figuring out how they're going to tap the wisdom of the many.
James Surowiecki (jamessuro@aol.com) is The New Yorker's financial columnist and the author of The Wisdom of Crowds.



VIEW|hot seat

Cable TV is like a crappy pizza joint: You can order a small, medium, or large pie, but you can't design your own - and no slices. Put off by increasing cable TV fees, US senator John McCain aims to introduce legislation to force providers to offer an à la carte menu as a way to rein in monthly bills and expand subscribers' choices. We asked Time Warner Cable chair and CEO Glenn Britt to get in front of any regulation and give his customers the option now.


WIRED: You're already giving us video-on-demand and DVRs. Isn't à la carte cable TV the logical next step?
BRITT: À la carte is really a step backward - you would end up with a lot less choice, less diversity. People like having maximum choice. We carry many channels that appeal just to niche groups and minorities. It's by no means clear those could survive in an à la carte regime.

So those channels aren't really supported by the marketplace. If I could pay for just the channels I want, I'd be a lot more valuable to advertisers.
Cable isn't about having a few channels that appeal to everybody, it's about having a lot of channels that appeal to everybody. You may not watch C-Span every night, but it's good to know it's there.

Sure, good for C-Span and Time Warner. But as a consumer, I'd rather lower my bill by paying for only the channels I actually watch.
The myth is that if you pay $60 a month and get 100 channels, then you could buy 50 and cut your price in half. That isn't how the economics work; there are a lot of fixed costs. You'd most likely end up with people paying the same amount of money for fewer channels. It's analogous to a newspaper or magazine. Hardly anybody reads every article in the paper; you read selectively. But nobody says, "Gee, you should only buy the sports section if that's all you want."

Cable and satellite are in cutthroat mode. Couldn't à la carte be an opportunity for you to differentiate Time Warner Cable from its competitors?
If that's what people wanted, yes. But the assumption is wrong. Every time we've tried to offer more packages with fewer channels - more toward à la carte - consumers always went for the big packages. People actually like this service, which is why 90 percent of the homes in the country buy it.

- Lucas Graves



VIEW|sterling

The Union of Concerned Scientists in a February report pointed out something the science press has known for years: The Bush administration has no respect for science. Ideologues prefer to make up the laws of nature as they go.


Presidential science adviser John Marburger complained that the UCS's account sounded like a "conspiracy theory report." That's because it is one. As the report amply documents, the Bush administration has systematically manipulated scientific inquiry into climate change, forest management, lead and mercury contamination, and a host of other issues. Even as Marburger addressed his critics, the administration purged two advocates of stem-cell research from the President's Council on Bioethics.

When politicians dictate science, government becomes entangled in its own deceptions, and eventually the social order decays in a compost of lies. Society, having abandoned the scientific method, loses its empirical referent, and truth becomes relative. This is a serious affliction known as Lysenkoism.

Trofim Lysenko was Joseph Stalin's top stooge in Soviet agricultural science, a field that was mercilessly politicized by fanatics. His specialty was inventing nutty schemes - things like stimulating the evolution of trees by overcrowding them to get them to cooperate, as though they were communist minions. This totalitarian huckster spent his whole career promising exciting results and bringing about only disaster. But the party never judged itself on results, so he always got a free pass.

Politics without objective, honest measurement of results is a deadly short circuit. It means living a life of sterile claptrap, lacquering over failure after intellectual failure with thickening layers of partisan abuse. Charlatans like Lysenko can't clarify serious, grown-up problems that they themselves don't understand.

State-sponsored pseudoscience always fails, but slowly, like a wheat field choked with weeds. (This is a particularly apt comparison, because Lysenko claimed that the weeds infesting Soviet wheat fields had evolved from the wheat itself.) It fails in predictable ways, and these are the very ways in which the Bush science policy is going to fail.

The rot begins to set in when honest local institutions, appalled by high-level misdeeds, denounce federal policy as corrupt and corrupting, just as the UCS has done. There will be much more of this: congressional investigations, high-minded committees. Government officials will temporize by getting scientists to "compromise" and "split the difference" between actual science and partisan jiggery-pokery. This will fail because science just isn't politics. You can't legislate that E=mc21¼2.

Before long, the damage will spread beyond our borders. International scientific bodies will treat American scientists as pariahs. This process has already begun in bioethics, meteorology, agriculture, nuclear science, and medicine, but doubts will spread to "American science" generally. (In Lysenko's heyday, when scientists abroad came across a halfway-decent Soviet scientist, they would charitably offer to publish his books offshore, then maybe help him defect to someplace where he could get serious work done.)

Meanwhile, gaps will open between research establishments in the US and other countries, much like the one that now yawns between American and Korean stem-cell producers. US science will come to have a stodgy, old-fashioned, commissar-style inability to think and act freely. Yankee initiative and ingenuity will bow to bulging pie-in-the-sky superprojects like unproven antimissile systems, hot-air broadband initiatives, and swashbuckling moon shots.

Eventually the whole vast bubble will burst of its own fairy-tale unreality. Few will be held accountable. The quackeries will be purged, forgotten, hushed up. Except, that is, for the lasting effect on the health, morale, and self-esteem of the American people.

Trofim Lysenko was a funny case. He had the authority to reduce a major scientific-research power to a dismal Burkina Faso with rockets; he left behind practically no scientific achievement or discovery. As a scientist, he was a nonentity, but his menace is universal. Wherever moral panic, hasty judgment, arrogance, fear, brutal partisan ignorance, slovenly standards of research, overcentralization of authority, conspiratorial policymaking, jingoism and xenophobia, and spin-centric travesties of disinformation can flourish, Lysenko's spirit will never die.
Email Bruce Sterling at bruces@well.com.



VIEW|lessig

Microsoft will appeal its second significant antitrust defeat in June. This time, the loss is Europe. After the company failed to persuade regulators that its practices benefit consumers, the European Commission fined Microsoft $600 million, and imposed a series of restrictions that go far beyond those ordered by the US over three years ago.


It's no surprise that the company lost again. Much of the European case was a rerun of US v. Microsoft. Nor is it a surprise that the result is harsher. That's the nature of competition law in Europe. But this rerun with a kicker shows the profound harm that disharmonized antitrust law does to competition in general - and to Microsoft in particular. The kicker here goes one antitrust theory too far.

The EC charged Microsoft with tying Windows Media Player into its operating system. That makes it harder, the EC says, for similar media products (like RealAudio) to compete. The commission thus ordered Microsoft to offer two versions of Windows: one with the media player, and one without.

Tying was at the core of the US case as well. But the tying alleged by the US was different, at least in part, from that alleged by Europe. In the US lawsuit, the government proved that Microsoft was using its power to defend its Windows monopoly against OS competition. (Disclosure: I served as special master in the dispute, advising the government on the technological issues of the case until Microsoft got me removed in 1998.) By "integrating" Internet Explorer into Windows, the company made it harder for other browsers to compete. That was an antitrust problem because the other browsers were thought (at least by Microsoft) to be the first step toward a platform-independent network - if developers started coding for a non-Microsoft world, then the power of the company's OS monopoly would begin to erode.

Economists are increasingly skeptical about whether, in general, tying actually harms competition. The only clear case is when a monopoly ties a product to protect its market dominance - as the US proved Microsoft did. Yet that theory is subtly, and significantly, different from the EC's theory.

European regulators argue that Microsoft is tying its OS to an application (a media player) to ensure dominance in the application's market. If Windows Media Player is everywhere, then everyone will develop content to its standards only. That will tip media-content development to a single platform, the EC worries, and weaken competition in applications to develop and spread that content.

Maybe. But a media player is not an operating system. And while dominance in a particular market will certainly benefit the underlying OS, as long as the media app continues to be available on alternative operating systems, it doesn't further tilt a platform war. Admittedly, Microsoft was slow to maintain cross-platform compatibility, but versions of Windows Media Player are now available on platforms from Mac OS X to Solaris. Microsoft has also licensed the technology to the makers of other media players. This clearly promotes the use of Windows Media Player, but its popularity doesn't depend on Microsoft's OS monopoly.

The EC ruling shows that Microsoft continues to suffer the unending burden of a silly defense and an undeserved victory in the US case. Its Alice in Wonderland arguments eroded Redmond's credibility to anyone who knows anything about how software actually works. (Sophistry about whether it was possible to separate a browser from an OS might earn you a hearing in a federal court, but it earns you only contempt everywhere else.) And when the Bush Justice Department's subsequent actions effectively reversed the US district court ruling, it only strengthened the resolve of others to pick up where the US had left off.

Microsoft has tried to signal a break from its past. The EC decision shows it has not yet succeeded. Although there have been many changes at the company, many of us still believe it will use its power to protect itself against competition. And as the spread of Linux increasingly suggests that life without Microsoft is possible, the world will be even less concerned with imperfect justice in its response to a proven monopolist.

That's too bad - for competition, and for Microsoft. The burden of answering many conflicting masters is costly for any competitor. And if every Microsoft innovation launches an antitrust investigation, then innovation will move to companies that don't pay such a high price. Microsoft needs to solve its antitrust problems. Soon.
Email Lawrence Lessig at lawrence_lessig@wiredmag.com.

M$: Microsoft goes on a 'myth-busting tour'

Microsoft goes on a 'myth-busting tour' - News - ZDNet
By Jo Best
Silicon.com
June 11, 2004, 5:38 AM PT
URL: http://zdnet.com.com/2100-1104-5231375.html

Microsoft has launched its 'Get the Facts' road show--the tech equivalent of a political battle bus--to tour the country and convince the wavering that Redmond is as at least cheap and as secure as its open-source rival.

Nick McGrath, Microsoft's head of platform strategy, described the campaign as "a reality check we're bringing out", aiming to tackle the "myths" surrounding Linux.

One of the myths that's getting Microsoft's goat is the term 'free'. At the London leg of the road show, not one attendee raised their hand when asked if they believed Linux was free--after all, Linux vendors aren't giving their Linux products away for nothing.

Meta Group analyst Philip Dawson said consumers should bear in mind that while Linux itself is free, that's not the whole story. "It's a free component--it's not a free platform, it's not a free service--it's a free component," he said.

But what about the old adage that it's not free as in free lunch but more free as in freedom of speech?

From the talk today, it seems that Microsoft have appreciated the difficulty of persuading the passionate Linux folk. One Microsoft exec described the anti-Microsoft feelings as a "jihad."

It's a term that didn't sit well with other open-sourcers. Novell's technical director, Steve Gaines, said: "There's a huge amount of passion around open source… It's far more positive; it's 'let's create alternatives' not 'let's trash something someone else has done'."

The other prong of Microsoft's rebuttal takes on security 'myths'.

Nick Barley, Microsoft's director of business marketing organization, refuted allegations that MS security was lax, saying the tools are there, but they have to be switched on. "We've spent a lot of time recently trying to educate the marketplace… work with the marketplace to help them understand what to do to protect their PC--it's not necessarily anything that's not on their PC already, it's just not enabled."

When asked the question, "Why might Linux be more secure than Windows?" in a recent silicon.com poll, the majority of respondents said it was the way the operating system was created.

Forty-one per cent said it might be more secure because of the open-source development model, 32 per cent said because it's not as widely used and is therefore less of a target and 27 per cent said it wasn't more secure, full stop.

While Microsoft does share its code with big corporations and government organizations, it's keen to keep overall control for commercial reasons--"our source code is our only intellectual property," said Barley. Microsoft also says that, as a proprietary company, it may not have an independent community looking out for flaws, but it has staff employed to exactly the same ends.

Novell's Gaines, for one, isn't concerned. "It's good news. [The road show] validates Linux as a platform."

Microsoft's Get the Facts road show will be in Edinburgh on June 17, Manchester on June 29 and Newport on July 7.

/. : Microsoft's Magical 'Myth-Busting' Tour

Slashdot | Microsoft's Magical 'Myth-Busting' Tour: "Posted by michael on Friday June 11, @05:05PM from the drive-offensively dept.Mz6 writes 'Microsoft has launched its 'Get the Facts' road show -- the tech equivalent of a politic"

Posted by michael on Friday June 11, @05:05PM
from the drive-offensively dept.
Mz6 writes "Microsoft has launched its 'Get the Facts' road show -- the tech equivalent of a political battle bus -- to tour the country and convince the wavering that Redmond is as at least cheap and as secure as its open-source rival and to spread the word that Windows is better than Linux. Nick McGrath, Microsoft's head of platform strategy, described the campaign as 'a reality check we're bringing out', aiming to tackle the 'myths' surrounding Linux. Microsoft's road show will be in Edinburgh on June 17, Manchester on June 29 and Newport on July 7."

LINUX: SCO Loses Attempt to move Novell Case to State Court

SCO Loses Attempt to move Novell Case to State Court

/. : Is Finding Security Holes a Good Idea?

Slashdot | Is Finding Security Holes a Good Idea?: "Posted by michael on Friday June 11, @12:35PM from the dare-not-speak-its-name dept.ekr writes 'A lot of effort goes into finding vulnerabilities in software, but there's no re"

Posted by michael on Friday June 11, @12:35PM
from the dare-not-speak-its-name dept.
ekr writes "A lot of effort goes into finding vulnerabilities in software, but there's no real evidence that it actually improves security. I've been trying to study this problem and the results (pdf) aren't very encouraging. It doesn't look like we're making much of a dent in the overall number of vulnerabilities in the software we use. The paper was presented at the Workshop on Economics and Information Security 2004 and the slides can be found here (pdf)."

GROKLAW: Novell Wins Remand Contest- Case Stays in Federal Court - It's Copyright Proof Time

GROKLAW: "Thursday, June 10 2004 @ 06:39 PM EDTJudge Kimball, as he promised, has issued his order* on the Novell case. The big news is that SCO lost its fight to get the case sent back to state co"

Thursday, June 10 2004 @ 06:39 PM EDT

Judge Kimball, as he promised, has issued his order* on the Novell case. The big news is that SCO lost its fight to get the case sent back to state court. SCO's entire theory of the case as a contract issue only went out the window, and they are now squarely in a pure copyright fight, which is the last thing they wanted. They will now have to prove that they own the copyright they are using to threaten end users like AutoZone. Kimball agrees with Novell that there are serious questions about whether the agreement even as amended by Amendment 2 is sufficient to be a copyright conveyance, and that means it stays in federal court. He retains jurisdiction. Remember all the experts who told us SCO might win this? They were mistaken.

Judge Kimball says he can't grant Novell's motion to dismiss at this stage, but he clearly has a leaning, and it isn't in SCO's direction. It's just that on a motion to dismiss, the judge is required to construe all facts in the light most favorable to the party whose case might be dismissed, the non-moving party, and on the Motion to Dismiss, that would be SCO, and as a matter of law, he can't grant the motion to dismiss in totality, because while "Novell has raised persuasive arguments as to whether a sufficient writing exists" without more evidence, he can't rule on the sufficiency of the agreement yet.

As we expected, he says SCO didn't plead the damages part adequately and he gives them 30 days to try, try again. I doubt they will be able to do it.

The conclusion is this:

"For the reasons stated above, Plaintiff's Motion to Remand is DENIED, and Defendant's Motion to Dismiss is DENIED as to Plaintiff's pleading of falsity and GRANTED as to Plaintiff's pleading of special damages. Plaintiff is granted 30 days from the date of this Order to amend its Complaint to more specifically plead special damages."

This is a huge loss for SCO. It's the kind of ruling that normally gets the plaintiff settling, out of fear of what the judge might do next, like in the BSDi case, when Debevoise's ruling on a motion got the parties working things out fast. I love this judge.

This just isn't SCO's day.

*Note it may take a few minutes for the PDF to make it to ibiblio's servers. I didn't want you to have to wait to hear the news.

VUN: Microsoft Internet Explorer URL Local Resource Acc

SecurityFocus HOME Vulns Info: Microsoft Internet Explorer URL Local Resource Acc

VUN: Microsoft Internet Explorer Modal Dialog Zone Bypa

SecurityFocus HOME Vulns Info: Microsoft Internet Explorer Modal Dialog Zone Bypa

VUN: Microsoft ISA Server 2000 Site And Content Rule By

SecurityFocus HOME Vulns Info: Microsoft ISA Server 2000 Site And Content Rule By

LINUX: Linux supporters waging a "jihad", says Microsoft exec



Jo Best
silicon.com
June 11, 2004

Microsoft has launched its 'Get the Facts' road show – the tech equivalent of a political battle bus – to tour the country and convince the wavering that Redmond is as at least cheap and as secure as its open-source rival.

Nick McGrath, Microsoft's head of platform strategy, described the campaign as "a reality check we're bringing out", aiming to tackle the "myths" surrounding Linux.

One of the myths that's getting Microsoft's goat is the term 'free'. At the London leg of the road show, not one attendee raised their hand when asked if they believed Linux was free – after all, Linux vendors aren't giving their Linux products away for nothing.

Meta Group analyst Philip Dawson said consumers should bear in mind that while Linux itself is free, that's not the whole story. "It's a free component – it's not a free platform, it's not a free service – it's a free component," he said.

But what about the old adage that it's not free as in free lunch but more free as in freedom of speech?

From the talk today, it seems that Microsoft have appreciated the difficulty of persuading the passionate Linux folk. One Microsoft exec described the anti-Microsoft feelings as a "jihad".

It's a term that didn't sit well with other open-sourcers. Novell's technical director, Steve Gaines, said: "There's a huge amount of passion around open source… It's far more positive; it's 'let's create alternatives' not 'let's trash something someone else has done'."

The other prong of Microsoft's rebuttal takes on security 'myths'.

Nick Barley, Microsoft's director of business marketing organisation, refuted allegations that MS security was lax, saying the tools are there, but they have to be switched on. "We've spent a lot of time recently trying to educate the marketplace… work with the marketplace to help them understand what to do to protect their PC – it's not necessarily anything that's not on their PC already, it's just not enabled."

When asked the question, 'Why might Linux be more secure than Windows?', in a recent silicon.com poll, the majority of respondents said it was the way the operating system was created.

Forty-one per cent said it might be more secure because of the open-source development model, 32 per cent said because it's not as widely used and is therefore less of a target and 27 per cent said it wasn't more secure, full stop.

While Microsoft does share its code with big corporations and government organisations, it's keen to keep overall control for commercial reasons - "our source code is our only intellectual property," said Barley. Microsoft also says that, as a proprietary company, it may not have an independent community looking out for flaws, but it has staff employed to exactly the same ends.

Novell's Gaines, for one, isn't concerned. "It's good news. [The road show] validates Linux as a platform."

Microsoft's Get the Facts road show will be in Edinburgh on 17 June, Manchester on 29 June and Newport on 7 July.

LINUX: Leader: Linux "jihad"? Less hysteria please...



Leader: Linux "jihad"? Less hysteria please...
silicon.com
silicon.com
June 11, 2004

Microsoft has bent over backwards to present itself as reasonable when it comes to the proprietary versus open-source software debate - at least until recently.

'Linux is a great competitor but we think we do a better job' is the standard line coming out of Redmond. This is a fine and sensible stance for any commercial enterprise – so why this talk of 'jihad' at Microsoft's Get the Facts road show?

At said event, which is intended to convince the world that Windows is as cheap and secure as its open-source rival, a Microsoft exec got up in front of a crowd of journalists and described the anti-Microsoft feelings of Linux supporters as a "jihad".

It's not the first time Microsoft has had a political dig at Linux. The partly Microsoft-funded Alexis de Tocqueville institution brought out a report claiming Linux is less secure than Windows and therefore any government agency using it is threatening national security.

SCO – which has links to Redmond – made similar noises recently, saying in a letter to Congress that open source "has the potential to apply our nation's enemies or potential enemies with computing capabilities that are restricted by US law".

It's not a good look for Microsoft – the world's biggest software company can't be seen both to be embracing the challenge of Linux while at the same time using such inflammatory terms as 'jihad' when discussing its rival.

The Linux community is undeniably passionate about its chosen operating system – for some, it almost approaches a religion - and Microsoft-bashing does form a part of that for many.

But that's not who Microsoft should be trying to persuade - those people will never be won over to the Microsoft cause, no matter how many road shows and studies are put in front of them.

It's the software platform-agnostic businesspeople mulling over which OS to choose for their commercial applications that Microsoft should be after – and using pejorative language certainly won't help to accomplish that goal.

Businesspeople are precisely the type who aren't interested in ideological arguments. They want to know what's cost-effective, reliable and effective in a corporate environment – not whether or not they can bring down 'an evil empire' by tinkering with a few lines of code.

If anything, Microsoft's behaviour at the road show reveals that the company feels threatened by the penguin party – and business can smell fear from a mile away.

If Microsoft really wants to convince people that its software is so great, it should stick to doing what it does best – making products for a mass market and pouring advertising money into telling the world about them.

M$: MS sues 200 for spamming

SecurityFocus HOME News: MS sues 200 for spamming: "MS sues 200 for spamming By Lucy Sherriff, The Register Jun 11 2004 8:25AM Click here for Astaro Internet Security!Microsoft has filed eight lawsuits in the US against nearly 200 a"

MS sues 200 for spamming

By Lucy Sherriff, The Register Jun 11 2004 8:25AM
Click here for Astaro Internet Security!
Microsoft has filed eight lawsuits in the US against nearly 200 accused spammers, saying that the defendants had used false information to conceal themselves, and had deceived consumers. Each of the lawsuits "names" at least 20 unidentified defendants, as well as one John Hites, identified by anti-spam campaigners at Spamhaus as one of the world's ten most prolific spammers.

Microsoft is seeking injunctions against each defendant, using the CAN-Spam act, and could be awarded up to $1m per spammer in civil fines. THe company said it hopes to unmask the anonymous spammers through the legal discovery process.

Microsoft filed its first suits against unsolicited mailers in June last year (2003), and is now involved in more than 80 such cases around the world. So far, its legal actions have resulted in four settlements, two defendants being declared bankrupt and five judgments for Microsoft.

"We're raising the stakes, we're making it more expensive for spammers," Tim Cranton, a senior lawyer at Microsoft said. "A lot of the established spammers are realizing that it's much harder to operate."

Although any efforts made in the fight against spammers are to be applauded, anyone with an e-mail account will testify that the effect on the amount of spam arriving in inboxes has been zero. Frank Gorman, former legal counsel for the Federal Trade Commission's Bureau of Consumer Protection, told The Washington Times: "It's not going to make an impact by itself, but you have to approach it from every angle."

In January this year, Bill Gates, Microsoft chairman, outlined a three-step programme to eliminate spam within two years: he proposed a system whereby senders would have to pay a digital stamp fee if recipients considered the mail to be spam.

The company has also introduced a whitelist scheme that will make its Hotmail database available to third parties willing to pay $20k to avoid the spam filters, provided they comply with Microsoft's guidelines. ®

SEC: Hacking Demo and Test Lab

raza sharif Fri, Jun 11, 2004 at 7:41AM
To: pen-test@securityfocus.com


Hi Folks ,

Im doing some advanced Hacking Demos for management and also Corporates etc.

I have a installed windows 2000 server and iis 5.0 on VMWARE GSX server.

Im using Webdav and other exploits that all basically should spawn a shell using netcat.

Im using XP as my attacking machine.

Prob at the moment is Netcat will not spawn a shell regardless of what i try.

Any ideas ? i checked the install it is windows 2000 500.1295 no reference to service packs etc. it's a default install.

Also what are good demo's etc to run to show real hacking on windows 2000 , iis etc..that i can get to work

thanks

Raza

Raza@raza.demon.co.uk
Martin Wasson Fri, Jun 11, 2004 at 11:33AM
To: raza sharif
Cc: pen-test@securityfocus.com


Raza,
A few things. I wouldn't really call this advanced. Why are you hacking
from XP instead of Linux? Get yourself a Linux box. These exploits of
which you write do not spawn shells using netcat. Netcat can bind shells
after you install it. You have to pop the Win2k box first, with something
like oc192-dcom.c. This exploit will get you a shell, then have it GET
(tftp) the files (like netcat) from your Linux box. Once the win2k box has
received nc.exe, run "nc -L -p 1234 -e cmd.exe" AFTER you've started netcat
on you Linux box (nc 1234).

Does that help?

Regards,

Marty Wasson, CISSP, CEH, IAM
Sr. Information Security Analyst
Global Information Security
MasterCard International
(636) 722-2372
martin_wasson@mastercard.com

"Men occasionally stumble over the truth, but most of them pick themselves
up and hurry off as if nothing ever happened." Winston Churchill

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

CONFIDENTIALITY NOTICE
This E-mail message and any documents which accompany it are intended only
for the use of the individual or entity to which addressed, and may contain
information that is privileged, confidential or exempt from disclosure
under applicable law. If the reader is not the intended recipient, any
disclosure, distribution or other use of this E-mail message is prohibited.
If you have received this E-mail message in error, please notify the sender
immediately. Thank you.
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

raza sharif
co.uk> cc: (bcc: Martin Wasson/STL/MASTERCARD)
Subject: Hacking Demo and Test Lab
06/11/2004 06:41
AM
[Quoted text hidden]

-----------------------------------------
CONFIDENTIALITY NOTICE
This e-mail message and any attachments are only for the use of the intended recipient and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If you are not the intended recipient, any disclosure, distribution or other use of this e-mail message or attachments is prohibited. If you have received this e-mail message in error, please delete and notify the sender immediately. Thank you.

Grissett, Chris CONT Ciber Fri, Jun 11, 2004 at 10:49AM
To: raza sharif , pen-test@securityfocus.com
Try this command on the remote machine
nc -l -p 23 -t -e cmd.exe

This allows nc to listen on port 23 for connections. When a connection is
made it will spawn a cmd[dos] shell, or whatever program you want to exec.
Hope that helps. If that fails, you can really impress the execs by using
knoppix-std (http://knoppix-std.org), to do all your hacking demos. Or if
you'd like, you could give me access to your lab, and Id do it for you. I'm
kidding, of course I couldn't do that, plus it would violate numerous laws
and ethics :) Are you familiar with linux?

Christopher Grissett
Security Analyst
Network Enterprise Security Team
[Quoted text hidden]
Victor Chapela Fri, Jun 11, 2004 at 1:59PM
To: raza sharif , pen-test@securityfocus.com
I am not sure about VMWare, I also had some problems running demos
consistently and decided to use a separate machine.

I usually do my demos with a similar configuration XP -> 2000.

A good 5 min sketch is:
- get a remote shell using Jill, iis5hack or dcomexploit
- You end up as NT Authority/SYSTEM in all cases, therefore you can add
yourself as an administrator
- connect to the admin$ share using your new credentials
- dump the SAM file with pwdump3
- crack some hashes using john
- copy winvnc to system32
- add your vnc password to the remote registry
- install and start winvnc remotely
- start a VNC session

Even though you will rarely need to install vnc while pen testing, I have
found that for demos it is a very good way to get the point through.

Good luck

Victor
[Quoted text hidden]
Grissett, Chris CONT Ciber Fri, Jun 11, 2004 at 10:59AM
To: raza sharif , pen-test@securityfocus.com
I guess I should have included a working example:

Assuming that you already have nc on the 2000 box, run this command:

nc -l -p 23 -t -e cmd.exe

Then on your xp box run this command:

nc xxx.xxx.xxx.xxx 23

replace the x's with the ip of the 2000 server box. The 23 is for the port
you assigned it earlier.

Oh, when you installed 2000 server, what type of connection did you choose.
You should choose to have 2000 server have direct access to the host's
Ethernet card and its connections. Do you have any personal firewalls
running at all? Are these two machines connected via a hub or switch.
[Quoted text hidden]

LINK: Pocket C# @ miFki.ru

Pocket C# @ miFki.ru

Welome to home of Pocket C# project - C# compiler running under Windows CE!

Overview

Pocket C# is port of C# compiler from DotGNU project to Windows CE. DotGNU contains open-source runtime, compiler, tools and many other things to make free cross-platform .NET environment. I took only compiler and several required tools and ported them with some modifications to WinCE platform. It's quite easy to use and I'm going to make IDE for more comfortable usage.

What all of this means? In a few words it means that now you can develop and build applications using standard .NET CF and C# right on your pocket device. It's really easy, you almost don't need to do anything manually - just write your code and project file and then build it with one tap!

Please visit public discussion group for latest info, downloads and help. And click here for more information about DotGNU.

News

10.06.04 - Small update to version 1.01 and more documentation added to this site.

09.06.04 - First public working version released.

Components

* C# compiler (cscc-cs)
* IL (intermediate language) assembler (ilasm)
* Linker (ilalink)
* Wrapper for these tools (cscc)
* XML based build tool (csant)
* Runtime libraries - standard Microsoft .NET CF
* Sample applications


Future plans

* some modifications for easier usage in PocketPC envoronment
* IDE
* maybe support for J# and VB.NET

LINUX: Showdown with the Linux Gang

Linux News: Open Source: Showdown with the Linux Gang

LINUX: Does Prentice Hall Really Own Linux?

NewsForge | Does Prentice Hall Really Own Linux?

Title Does Prentice Hall Really Own Linux?
Date 2004.06.11 7:00
Author warthawg
Topic Linux
http://software.newsforge.com/article.pl?sid=04/06/11/1139234

Bruce Perens writes "A recent report by Ken Brown of the "Alexis de Toqueville Institute" casts aspersions upon Linus Torvalds as creator of the Linux operating system kernel. The report attributes ownership of Linux to Prentice Hall PTR as publishers of Andrew Tannenbaum's book Operating Systems: Design and Implementation. In the book, Tannenbaum provided the source for an educational toy OS called Minix.

Mr. Brown is obviously not aware of my role as series editor of the Bruce Perens Open Source Series at Prentice Hall PTR. With ten books published so far, this series is unique in that not only are the books about Open Source software, the text of the books is under an Open Source license. They can be copied and redistributed freely in the same manner as the Linux kernel - it's even legal to sell the copies. The series has shown that a publisher can be commercially successful with Open Source text, as IBM, Red Hat, and other companies have been successful with Open Source software.

Like all technical book publishers, Prentice Hall is in the business of distributing ideas. They have copyrighted their books, but the express purpose of those books is for readers to use the ideas that their text communicates. Before Linus Torvalds created Linux, one of the ways he learned to build operating systems was by reading Tannenbaum's book and working with the Minix source code. Authors and publishers are proud of the role our books have played in developing the professional skills of Torvalds and the Open Source developer community. We should not, do not, and can not claim as our own the creations of the many millions of people who use our books as a reference in their work every day.

Regarding Brown's other assertions, it should be sufficient to point out that many of the people he quotes have published detailed refutations of Brown's text. Most interesting is that of Tannenbaum himself, parts 1, 2, and 3, that of the young programmer Brown hired to compare Linux and Minix, and scientist Illka Tuomi.

A recent title in my series, Understanding the Linux Virtual Memory Manager, is meant to be used directly by the Linux kernel developers in their work, and uses the Linux source code as a reference for tomorrow's computer scientists. This illustrates the synergistic relationship that a publisher willing to embrace Open Source can have with the developer community. I look forward to the continuation of that relationship.

Bruce Perens
"
Links

1. "Bruce Perens" - mailto:bruce@perens.com
2. "Operating Systems: Design and Implementation" - http://phptr.com/title/0136386776
3. "Bruce Perens Open Source Series" - http://phptr.com/perens
4. "1" - http://www.cs.vu.nl/~ast/brown/
5. "2" - http://www.cs.vu.nl/~ast/brown/followup/
6. "3" - http://www.cs.vu.nl/~ast/brown/rebuttal/
7. "young programmer Brown hired to compare Linux and Minix" - http://www.cs.vu.nl/~ast/brown/codecomparison/
8. "Illka Tuomi" - http://www.firstmonday.org/issues/issue9_6/tuomi/index.html
9. "Understanding the Linux Virtual Memory Manager" - http://www.informit.com/title/0131453483

SEC: SANS NetworkBits June 11, 2004 Vol. 1, Num. 10

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

***********************************************************************
SANS NetworkBits June 11, 2004 Vol. 1, Num. 10
***********************************************************************

NEWS

-- RIM, NTP in Court Again Over Patents
-- Telecom Sharing Decision Upheld
-- Broadband Use Rises as Dial-Up Declines
-- Wireless on the Upswing Straining Corporate Networks
-- Debate Highlights Vendors' Differences

STANDARDS

-- CWA: VoIP is a Telecommunication Service

PRODUCTS

-- MPLS-Enabled Metro Ethernet Switch Introduced
-- Foundry Adds IPv6 Support to Router and Switch
-- Wi-Fi Kits Launched by Broadcom and Netgear
-- Uncertified WiMax Kit Launched by Alvarion
-- SonicWall Launches New Wireless Solution

VULNERABILITIES

-- Cisco-Linksys Wireless Hole Not as Serious as Presented
-- Telstra Says Network Intrusions are on the Rise

ISP NEWS

-- ISP Offers Block for Accessing Child Porn
-- BellSouth Upgrades its Ethernet Services
-- NTL Ireland Upgrades Its Network
-- Telstra Looks Toward IVR
-- Worms Costing Firms Millions

TELECOM NEWS

-- Trials Set for VoIP in Asia and Europe
-- Record Set for IP Transmission Speeds

TUTORIAL

-- All You Need to Know About Domain Security

WHITE PAPER

-- Enabling a Successful Wireless Enterprise

OPINION

-- Free Phone Calls. Too Good to Last?
-- Is Open Source IP Telephony Ready For Prime Time?

HOW'S BUSINESS

FEDERAL REGISTER

-- FCC Establishes Office of Homeland Security
-- FCC Seeks Input regarding Broadband Data Gathering Program
-- FCC on Fixed-Wireless Telecommunications Antennas

STOCK QUOTES

******************* Sponsored by SANS SCHOOL STORE ********************

Check out our School Store for recently released books on Business Law,
Solaris Securing Solaris, Computer Security Incident Handling and
exclusive books and merchandise. Also, check out our section on
recommended books written by SANS faculty, PDF samples on our
Step-By-Step Guides, and current specials on Oracle Security, 7-Pack
Guides, and T-shirts. For more information go to
https://store.sans.org/

***********************************************************************
This Week's Featured Security Training Program: SANSFIRE 2004
Monterey, CA, July 5-13, 2004

SANSFIRE offers you 14 immersion training tracks in one of the most
beautiful and romantic places in America. Phenomenal training for
auditors who want to master the challenges of security auditors, for
managers who want to build a great security program, for security
beginners who want to get a fast start, and, of course, the only place
to go for technologists who want to master the most current methods for
protecting systems and networks. SANSFIRE also offers lots of evening
programs, extra one-day classes ranging from security business law to
cyberwarrior training, and vendor exhibits, too.

Register soon to get a seat at your choice of courses.
http://www.sans.org/sansfire2004
***********************************************************************

NEWS

-- RIM, NTP in Court Again Over Patents
(07 June 2004)
Judges from the Court of Appeals for the Federal Circuit in Washington,
D.C. will hear arguments and decide whether an injunction to keep
Research in Motion (RIM) from selling Black Berry handhelds, software
and services in the U.S. should be upheld. NTP filed a complaint in
November 2001 charging that RIM's Black Berry products and services
violate at least five NTP patents granted them by the U.S. Patent and
Trademark Office (USPTO) covering the use of radio-frequency wireless
communications in e-mail systems. In August 2003, the U.S. District
Court for the Eastern District of Virginia ruled in NTP's favor placing
an injunction on certain Black Berry products and services.
Subsequently, RIM was granted a stay on the injunction until the case
could be heard in Appeals Court.
http://www.nwfusion.com/news/2004/0607blackpaten.html

-- Telecom Sharing Decision Upheld
(04 June 2004)
The motion filed by the Federal Communications Commission to stay a U.S.
Court of Appeals for the District of Columbia Circuit injunction
regarding telecom sharing was denied. Therefore, the court's decision
in March 2004 which overturned most of the FCC's "triennial review
decision" stands. The decision allows negotiations for competitors to
continue using part of the networks put in place by incumbents.
http://www.nwfusion.com/edge/news/2004/0604appeacourt.html

-- Broadband Use Rises as Dial-Up Declines
(03 June 2004)
According to figures published by British telecommunications regulator
Ofcom, broadband usage has steadily risen, while dial-up has declined.
For example, the percentage of small businesses using broadband
increased from 35 percent to 37 percent since November 2003. However,
a senior technology consultant for Sophos, Graham Cluley, asserts
broadband is a "real problem" since always-on connections bring greater
risks of sending spam and propagating viruses. ISPs selling broadband
should take a proactive approach to educating their customers, he
states.
http://news.zdnet.co.uk/communications/broadband/0,39020342,39156630,00.htm
[Editor's Note (Triulzi): The UK had a major catch-up job on broadband
and the initial strategy on the part of BT which owns almost all of the
local-loops was such that it required "triggers" to DSL-enable
exchanges. This meant that it took a very long time for broadband to
be available everywhere. This changed recently when the "trigger"
mechanism was removed and all exchanges became eligible for
DSL-enabling. On the anti-virus aspect of the issue security
professionals have been hammering the point to death, to the level that
there is perhaps almost a refusal on the part of the average Internet
user to believe that he is such a great risk to the community.
Unfortunately it isn't just the ISP's which need to educate customers,
customers should also start demanding better software and better
operating systems which are not so vulnerable.]

-- Wireless on the Upswing Straining Corporate Networks
(31 May 2004)
The benefits of introducing mobile and wireless technology to corporate
networks are compelling. As the use of these technologies increases,
so does the likelihood for companies to see unauthorized WLAN
connections on their networks. According to Marc Simms, director of IT
at Shared PET Imaging LLC, "The problem of rogue employees is
maddening." When end users bring in their own mobile equipment, the
issue of security comes into play, notes Simms. He suggests IT managers
sniff out any unauthorized WLANS as well as starting to set standards.
http://www.computerworld.com/mobiletopics/mobile/story/0,10801,93530,00.html
[Editor's Note (Triulzi): Unfortunately the solution to rogue "wireless"
technology is far from being cheap. On the contrary the best solutions
(e.g. ethernet port authentication to prevent rogue access points being
connected to the main network) are often expensive to roll-out
pervasively. This means that they are rolled-out in a hap-hazard
fashion making them ineffective. Sniffing WLANs is a good reactive
measure but the only safety lies in being proactive and making it
particularly arduous to install rogue WiFi equipment.]

-- Debate Highlights Vendors' Differences
(31 May 2004)
At the CeBit America trade show, two established wired-network vendors,
Cisco and Extreme Networks, and two wireless start-ups, Airespace and
Aruba Wireless Networks, highlighted their differences as it relates to
how wireless networking should be done. While Cisco drew attention to
its "integrated approach" through the use of its enhancements to the
high-end Catalyst 6500 switch, Aruba's vice president of marketing
Keerti Melkote highlighted their preference for a "thin" access point
with centralized management. Vipin Jain, vice president and general
manager of LAN access at Extreme Networks, noted that his company had
introduced the idea of an integrated approach more than 12 months ago.
In addition, the four vendors disagreed on the need for a site survey.
http://www.nwfusion.com/news/2004/0531wlancebitshowdown.html

*************************** SPONSORED LINKS ***************************
Privacy notice: These links may redirect to non-SANS web pages.

(1) Browse through a variety of course books and benchmarks
at:
http://www.sans.org/click.php?id=471

(2) Want to go on a search and destroy mission against spybots?
Home in on:
http://www.sans.org/click.php?id=472

(3) Looking for step-by-step guides on various topics?
Check out:
http://www.sans.org/click.php?id=473

***********************************************************************

STANDARDS

-- CWA: VoIP is a Telecommunication Service
(02 June 2004)
The Communications Workers of America (CWA) union has joined the debate
over whether voice over Internet Protocol (VoIP) should be classified
as a telecommunications service, thus subject to the same regulations
as other telephone services, or as a date service, free of most
regulation and taxes, by petitioning the Federal Communications
Commission (FCC) to treat VoIP as a telecommunication service. Their
stand separates them from industry and business which advocates VoIP be
treated as a data service.
http://www.networkingpipeline.com/voicedata/21400974
Related Article: U.S. Groups Lobby Over VoIP Regulation
http://www.theregister.co.uk/2004/06/03/us_voip_fcc/

PRODUCTS

-- MPLS-Enabled Metro Ethernet Switch Introduced
(07 June 2004)
A new Ethernet switch, the 7450 Ethernet Service Switch, now available
in two configurations, using Multi-Protocol Label Switching (MPLS)
technology, has been introduced by Alcatel. According to Vinay Rathore,
director of strategic marketing for Alcatel's fixed communications
group, asserts, "The new switch is built to deliver high quality
packet-based services with a high amount of predictability."
http://www.networkingpipeline.com/news/21401931

-- Foundry Adds IPv6 Support to Router and Switch
(04 June 2004)
Foundry, a networking equipment vendor, has added IPv6 support to its
NetIron 40G router and its BigIron MG8 switch. At the Network + Interop
tradeshow, Foundry demonstrated both the router and switch showcasing
its capability to route up to 480 million IPv6 packets per second. The
40G router and the BigIron MG8 switch both support 10-Gigabit Ethernet.
http://news.zdnet.co.uk/communications/networks/0,39020345,39156800,00.htm

-- Wi-Fi Kits Launched by Broadcom and Netgear
(03 June 2004)
Broadcom and Netgear have both launched products to make high-speed
wireless networks easier to deploy. Broadcom introduced "Airforce
BCM5350," a "system on a chip" that supports 802.11g, Ethernet, and VPN
security. Netgear introduced its WG302 Prosafe 802.11g wireless access
point capable of being boosted from 54Mbps to 108Mbps.
http://news.zdnet.co.uk/communications/wireless/0,39020348,39156552,00.htm

-- Uncertified WiMax Kit Launched by Alvarion
(02 June 2004)
Despite not being certified as such, a WiMax product, BreezeMAX 3500,
was launched by wireless hardware manufacturer Alvarion. Alvarion
maintains that even though the emerging WiMax technology has not yet
been officially certified, telecoms are eager to be on the path to
WiMax. Carlton O'Neal, Alvarion's vice-president of marketing admits
there is a risk that they will have to upgrade the equipment when the
final WiMax specifications come out.
http://news.zdnet.co.uk/communications/wireless/0,39020348,39156528,00.htm
[Editor's Note (Triulzi): One hopes that the "Prosafe" Netgear equipment
lacks the hilarious backdoor recently published for its other WiFi
equipment not to mention the even funnier fix (changing the "secret"
login from admin to adminstar...).]

-- SonicWall Launches New Wireless Solution
(01 June 2004)
The Distributed Wireless Solution, which offers smaller companies a way
to integrate wireless and wired network security, was launched by
SonicWall. According to Jeff Wilson, principal analyst at Infonetics,
"Wireless has changed the way we work, but network administrators are
struggling to integrate wireless into their existing security
infrastructures." SonicWall's 'governing' appliance provides a central
point from which to deploy security policy and authentication rules.
http://news.zdnet.co.uk/communications/wireless/0,39020348,39156405,00.htm

VULNERABILITIES

-- Cisco-Linksys Wireless Hole Not as Serious as Presented
According to Alan Rateliff, who first posted a warning on the Bugtraq
discussion about a security hole in Cisco's Linksys WRT54G wireless
routers, has stated that after several tests, he found that the devices
were not vulnerable in their default configuration. "The exposure on
this is not as bad as the (discussion) on Bugtraq made it seem. I can't
account for the results of the first test, but at this point that's
irrelevant. What's relevant now is that "out of box" home users are
safe," he asserts.
http://www.nwfusion.com/news/2004/0607confuse.html
Related Article: Linksys Flaw Opens Door to Home Networks
http://news.zdnet.co.uk/internet/security/0,39020375,39156878,00.htm

-- Telstra Says Network Intrusions are on the Rise
(31 May 2004)
According to Ted Pretty, managing director of technology and innovation
at Telstra, network intrusions and denial of service attacks against
Telstra have increased 1,500 percent in the last few years. He notes
that as the use of Internet Protocol Virtual Private Networks (IPVPNs)
increases, so will network attacks. Pretty predicts that doing business
over the telephone will be a thing of the past as IPVPN's become more
widespread. However, he asserts that transmitting data and voice over
the air is not as reliable as transfer over cable.
http://www.computerworld.com.au/index.php?id=1468037417&eid=-255
31/05/2004 08:51:33

ISP NEWS

-- ISP Offers Block for Accessing Child Porn
(07 June 2004)
British Telecom's (BT's) one million broadband Internet customers will
be getting an elaborate software filter, known as Cleanfeed, which will
block access to a list of suspected child porn sites. The "block list"
will be compiled by the Internet Watch Foundation. According to Pierre
Danon, head of BT retail services, "In the U.K., because it is illegal
to view these [child porn] images, we can stop an illegal activity."
http://news.zdnet.co.uk/internet/security/0,39020375,39156894,00.htm
[Editor's Note (Triulzi): Despite it sounding like a marketing
initiative this is actually a move which has been appreciated widely as
a responsible and timely solution to a problem which is strongly felt
in the UK and it should not be compared with AOL's parental control
services.]

-- BellSouth Upgrades its Ethernet Services
(04 June 2004)
Atlanta-based BellSouth Corp. has a new premium-level addition to its
Metro Ethernet Service that includes the ability to prioritize voice
traffic on IP-based metropolitan-area networks (MANs). It also provides
business-continuity capabilities and allows users to add bandwidth in
smaller increments than they were formerly able to do. BellSouth is
offering its new service in Atlanta, New Orleans, Miami, Jacksonville
and Raleigh, with plans to add four more metropolitan areas later this
year.
http://www.computerworld.com/networkingtopics/networking/story/0,10801,93647,00.html

-- NTL Ireland Upgrades Its Network
(03 June 2004)
NTL will be able to deliver broadband to more than 100,000 homes in
Ireland as the result of an upgrade of its cable network. NTL is
expected to spend 100 million Euro on the upgrade. In addition, NTL
Ireland has announced a series of price changes for its existing
broadband products.
http://www.theregister.co.uk/2004/06/03/ntl_ireland_network/

-- Telstra Looks Toward IVR
(02 June 2004)
Although Australia remains two years behind the U.S. in adopting
interactive voice recognition (IVR) technology, Telstra expects IVR
could be worth more than 400 million dollars in Australia over the next
four to five years, says Louis Dupe, Telstra's business and government
voice managing director. While Telstra's Enterprise Speech Solutions
would be suitable for companies of 100 or more employees, the company
is developing products for smaller enterprises, says Dupe.
http://australianit.news.com.au/articles/0,7204,9723967%5E15306%5E%5Enbv%5E,00.html

-- Worms Costing Firms Millions
(28 May 2004)
A study done by security firm Sandvine concludes that the Internet
traffic generated by worm attacks on corporate networks results in
thousands to millions of pounds' worth of unplanned network and customer
support costs. Sandvine estimated that in the U.K. alone such costs
amounted to 22.4 million Euro. They also predict that worm attacks will
cost the European service provider sector more than 123 million Euro in
2004 and 159 million Euro in 2005.
http://www.networkitweek.co.uk/news/1155469
Related Article: Worms Still Number One Security Threat
http://www.networkitweek.co.uk/News/1153197

TELECOM NEWS

-- Trials Set for VoIP in Asia and Europe
(09 June 2004)
Telecommunication firm AT&T is set to start trials of its Internet
telephony services, voice over Internet Protocol, in Australia, Hong
Kong, Singapore and the United Kingdom based on the company's
CallVantage service. The trials will target multinational companies.
According to AT&T, the number of its customers using its VoIP services
has increased four fold.
http://news.zdnet.co.uk/communications/networks/0,39020345,39157140,00.htm

-- Record Set for IP Transmission Speeds
(08 June 2004)
MCI's plan to begin to upgrade and simplify its backbone, which they
announced in February, has led to the sending of IP packets from San
Francisco to San Juan at 40G bit/sec over its optical network. According
to Jack Wimmer, MCI vice president of Network Architecture and Advanced
Technology maintains that the company has no immediate plans to
introduce a commercial 40G services noting that it would only be a
limited number of customers, including government and university
researchers, who would require such high speeds.
http://www.computerworld.com.au/index.php?id=1706890780&eid=-6787

TUTORIAL

-- All You Need to Know About Domain Security
This tutorial examines the threats to domain security and how lack of
DNS security would impact the Internet.
http://www.ncasia.com/ViewArt.cfm?Magid=3&Artid=23924&Catid=5&subcat=50

WHITE PAPER

-- Enabling a Successful Wireless Enterprise
By Computer Associates
This white paper provides comprehensive information on what is going on
in the wireless arena covering topics such as wireless standards,
hardware and software. It also delves into topics such as concerns for
the mobile enterprise, including security and management, as well as how
to successfully set up a wireless enterprise.
http://www3.ca.com/Files/WhitePapers/22996-enabling_a_successful.pdf

OPINION

-- Free Phone Calls. Too Good to Last?
By Grace Chng
Grace Chng examines the development of a software, Skype, which allows
for high quality phone calls over the Internet for free, and the
expected response from telecommunications companies.
http://computertimes.asiaone.com.sg/columns/story/0,5104,1494,00.html?

-- Is Open Source IP Telephony Ready For Prime Time?
By Zeus Kerravala and Zenus Hutcheson
Zeus Kerravala, vice president of enterprise infrastructure research and
consulting at The Yankee Group, and Zenus Hutcheson, managing general
partner with St. Paul Venture Capital, debate the issue of open source
IP telephony and whether it is time for it to be implemented.
Kerravala argues against its implementation:
http://www.nwfusion.com/columnists/2004/0607faceoffno.html
Hutcheson argues for its implementation:
http://www.nwfusion.com/columnists/2004/0607faceoffyes.html

HOW'S BUSINESS

-- ALCATEL

Alcatel/Ditch Witch Demonstrate Vibratory Plow
http://www.cconvergence.com/shared/article/showArticle.jhtml?articleId=21402025

Alcatel Plans Handset Move
http://australianit.news.com.au/articles/0,7204,9777000%5E15320%5E%5Enbv%5E15306,00.html

LANS Systems Sues Alcatel
http://www.itnews.com.au/storycontent.asp?ID=6&Art_ID=19893

Alcatel To Deploy First Wireless Broadband Data Network In Zimbabwe
http://www.edubourse.com/finance/actualites.php?idActus=14539

-- CISCO

A Practical View of Cisco Services
http://techupdate.zdnet.com/techupdate/stories/main/Practical_View_Cisco_Services.html?tag=tu.arch.link

Cisco to Use Trend Micro Antivirus Technologies
http://www.reuters.com/newsArticle.jhtml?type=technologyNews&storyID=5364727&src=eDialog/GetContent§ion=news

Cisco Rolls Out Routing System
http://www.financialexpress.com/fe_full_story.php?content_id=60933

Trend Micro, Cisco to Fight Worms
http://www.computerworld.com.au/index.php/id;1565958375;fp;16;fpid;0

Cisco Gives Catalyst a 10G Jolt
http://computerworld.com.my/pcwmy.nsf/0/E6FB32ADB2EB17B148256EAC0025E548?OpenDocument

Foundry Fronts Cisco with Cheaper Router
http://www.computerworld.com.au/index.php/id;577674487;fp;16;fpid;0

Cisco Debuts High-End Router
http://www.washingtontechnology.com/news/19_5/datastream/23673-1.html

-- JUNIPER

Juniper Ready To Pop Pepsi
http://www.nwfusion.com/news/2004/0608pepsi.html

Shanghai Telecom Selects Juniper Networks
http://www.chinatechnews.com/index.php?action=show&type=news&id=1297

Juniper Networks 'SSL VPN Leader
http://www.lightreading.com/document.asp?site=lightreading&doc_id=54105

Juniper Upgrades VOIP Solution
http://www.lightreading.com/document.asp?site=supercomm&doc_id=53986

Juniper Touts Infranet
http://computerworld.com.my/pcwmy.nsf/0/FC5913E6F6EB24D348256EAC0022D53F?OpenDocument

-- NETWORK ASSOCIATES

Network Associates Delivers Next Generation Anti-Virus Solution
http://www.hardwarezone.com/news/view.php?cid=5&id=15824

Network Associates Rallies, But Obstacles Remain
http://www.thestreet.com/_tscs/tech/ronnaabramson/10164446.html

Network Associates Granted Broad Anti-spam Patent
http://www.computerworld.com/governmenttopics/government/legalissues/story/0,10801,93570,00.html

Network Associates Warms To Behaviour Blocking
http://www.theregister.co.uk/2004/06/04/mcafee_debuts_behaviour_blocking/

-- NORTEL

No News Is Bad News For Nortel
http://www.theregister.co.uk/2004/06/03/nortel_no_accounts/

Nortel Delays Revised Results
http://australianit.news.com.au/articles/0,7204,9731847%5E15306%5E%5Enbv%5E,00.html

Nortel Networks Enhances Edge Router
http://www.enterprisenetworksandservers.com/newsflash/art.php/274

Nortel Looks To Another Kind Of Networking
http://www.theglobeandmail.com/servlet/ArticleNews/TPStory/LAC/20040609/RRBCGLITCH09/TPBusiness/Canadian

CDSL Deploys Nortel Switches For VPN Tunneling
http://www.cxotoday.com/cxo/jsp/index.jsp?section=News&subsection=Business&subsection_code=1&file=template1.jsp&storyid=1034

Nortel Teams Up With Qovia
http://www.lightreading.com/document.asp?site=lightreading&doc_id=54034

SYMANTEC

Symantec Issues W32.KORGO.F Warning
http://www.cpilive.net/news_ver2/inside.asp?wherefrom=search&newsitem=69200483229AMCOMPUTER+NEWS+ME.htm&channel=COMPUTER+NEWS+ME

Symantec: Virus Deletes Your Whole Hard Drive
http://news.netcraft.com/archives/2004/06/08/symantec_new_virus_deletes_all_files.html

Symantec Nabs First 64-Bit Virus
http://www.computerworld.com/securitytopics/security/story/0,10801,93585,00.html

Symantec's Bizarre Swap
http://www.fool.com/News/mft/2004/mft04060406.htm

"Security is a Process," Says Symantec CEO Thompson
http://www.sys-con.com/story/?storyid=45066&DE=1

-- TIPPINGPOINT

Tipping Point: A Small Player With Big Credentials
http://www.it-director.com/article.php?articleid=11956

Utah Transit Authority Selects TippingPoint's UnityOne
http://www.tmcnet.com/usubmit/2004/May/1044383.htm

Tippingpoint's Net Loss, Revenue Rise
http://austin.bizjournals.com/austin/stories/2004/05/31/daily3.html

Korea University Deploys TippingPoint's UnityOne System
http://www.net-security.org/press.php?id=2184

FEDERAL REGISTER

-- FCC Establishes Office of Homeland Security
The Federal Communications Commission (FCC) is revising its rules to
promote more efficient and effective organizational structure and to
promote homeland security. Specifically, the FCC is revising its rules
to reflect the creation of the Office of Homeland Security within the
Enforcement Bureau, describe the Office's functions and delegated
authority, and make other conforming changes. The Commission is also
revising its rules to clarify how an Emergency Relocation Board will
operate during times of emergency under the Commission's Continuity of
Operations Plan (COOP) and setting out the line of succession to chair
the Board when no Commissioner is available to serve on the Board.
Effective: 08 July 2003.
http://edocket.access.gpo.gov/2004/04-11918.htm

-- FCC Seeks Input regarding Broadband Data Gathering Program
The Federal Communications Commission (FCC) is seeking comments about
whether it should extend and modify the local competition and broadband
data gathering program, established to collect basic information about
two critical areas of the communications industry: the deployment of
broadband services and the development of local telephone service
competition. The FCC seeks comments about specific proposals to improve
the program, including gathering more granular data from broadband
service providers and extending the program for five years beyond its
currently designated sunset in March 2005.
Comments due: 28 June 2004.
http://edocket.access.gpo.gov/2004/04-11322.htm

-- FCC on Fixed-Wireless Telecommunications Antennas
The Federal Communications Commission (FCC) has addressed four petitions
seeking reconsideration and/or clarification of the Commission's
determination to extend to users of fixed-wireless telecommunications
antennas the same OTARD (Over-the-Air-Reception Devices) protections
previously available to customers of multi-channel video service.
Effective: 27 July 2004.
http://edocket.access.gpo.gov/2004/04-12164.htm

STOCK QUOTES

13.55 Alcatel UP 0.02
28.82 Cisco UP 0.26
20.79 Juniper UP 0.34
17.16 Network Asssoc. DOWN 0.14
03.97 Nortel No Change
44.23 Symantec UP 0.38
25.05 Tipping Pt. UP 0.15

==end==

NetworkBits Editorial Board:
Aminah Grefer, Roland Grefer, Steve Lewis, Stephen Northcutt, Arrigo Triulzi

To submit comments, additional news items or other information you would
like to share with us, please send an email to NetworkBits@sans.org.

Please feel free to share this with interested parties via email, but
no posting is allowed on web sites. For a free subscription, and for
free posters) or to update a current subscription, visit
http://portal.sans.org/

An archive of past issues of the NetworkBits newsletter is available at
http://www.sans.org/newsletters/networkbits

The NetworkBits newsletter is also available as a RSS feed at
http://www.sans.org/newsletters/networkbits/rss

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iD8DBQFAyal4+LUG5KFpTkYRAk2mAJ4qETjhST8+jbKF6sHnnah4NqCIQwCdFDZ/
a86rkokQ3Mfybi9itZDEljQ=
=rl9E
-----END PGP SIGNATURE-----

Thursday, June 10, 2004

LINUX: SCO: Without Fear and Without Research

SCO: Without Fear and Without Research: "Eben Moglen* Just The Facts Making Up the LawThere's a traditional definition of a shyster: a lawyer who, when the law is against him, pounds on the facts; when the facts are against"

Eben Moglen*

Just The Facts
Making Up the Law

There's a traditional definition of a shyster: a lawyer who, when the law is against him, pounds on the facts; when the facts are against him, pounds on the law; and when both the facts and the law are against him, pounds on the table. The SCO Group's continuing attempts to increase its market value at the expense of free software developers, distributors and users through outlandish legal theories and unsubstantiated factual claims show that the old saying hasn't lost its relevance.

Just The Facts

SCO continues to claim in public statements about its lawsuit against IBM that it can show infringement of its copyrights in Unix Sys V source code by the free software operating system kernel called Linux. But on the one occasion when SCO has publicly shown what it claimed were examples of code from Linux taken from Unix Sys V, its demonstration backfired, showing instead SCO's cavalier attitude toward copyright law and its even greater sloppiness at factual research.

On August 18, 2003, SCO's CEO, Darl McBride, offered a slide presentation of supposed examples of infringing literal copying from Sys V to Linux at a public speech in Las Vegas. Within hours the free software and open source communities had analyzed SCO's supposed best evidence, and the results were not encouraging for those investors and others who hope SCO knows what it is talking about.[1]

In Las Vegas Mr. McBride offered two examples of code from the Linux program that were supposedly copied from Sys V. The first implements the ``Berkeley Packet Filter'' (BPF) firewall. Indeed, the Linux kernel program contains a BPF implementation, but it is the original work of Linux developer Jay Schulist. Nor did SCO ever hold an ownership interest in the original BPF implementation, which as the very name shows was originally part of BSD Unix, and which was copied, perfectly legally, into SCO's Sys V Unix from BSD. Because the BPF implementations in Sys V and Linux have a common intellectual ancestor and perform the same function, SCO's ``pattern-matching'' search of the two code bases turned up an apparent example of copying. But SCO didn't do enough research to realize that the work they were claiming was infringed wasn't their own (probably because they had ``carelessly'' removed the original copyright notice).

Mr. McBride's second example was only slightly less unconvincing. Mr McBride showed several dozen lines of memory allocation code from ``Linux,'' which was identical to code from Sys V. Once again, however, it turned out that SCO had relied on ``pattern-matching'' in the source code without ascertaining the actual history and copyright status of the work as to which it claimed ownership and infringement. The C code shown in the slides was first incorporated in Unix Version 3, and was written in 1973; it descends from an earlier version published by Donald Knuth in his classic The Art of Computer Programming in 1968. AT&T claimed this code, among other portions of its Unix OS, as infringed by the University of California in the BSD litigation, and was denied a preliminary injunction on the ground that it could not show a likelihood of success on its copyright claim, because it had published the code without copyright notices and therefore, under pre-1976 US copyright law, had put the code in the public domain. In 2002, SCO's predecessor Caldera released this code again under a license that permitted free copying and redistribution. Silicon Graphics, Inc. (SGI) then used the code in the variant of the Linux program for ``Trillium'' 64-bit architecture computers it was planning to sell but never shipped. In incorporating the code, SGI violated the terms of Caldera's license by erroneously removing Caldera's (incorrect) copyright notice.

Thus SCO's second example was of supposedly impermissible copying of code that was in the public domain to begin with, and which SCO itself had released under a free software license after erroneously claiming copyright. SGI had complicated matters by improperly removing the inaccurate copyright notice. So how many PCs and Intel-architecture servers around the world contained this supposedly infringing code? Zero. No version of the Linux program for Intel architectures had ever contained it. No SGI hardware for which this code was written ever shipped. HP, which sells 64-bit Itanium servers, has removed the code from the IA-64 branch of the Linux code tree; it was technically redundant anyway. But SCO's research went no farther than discovering a supposed instance of ``copying,'' without asking whether SCO had any rights in what had been copied, and certainly without providing the audience to whom it was speaking any indication that the ``Linux'' it was talking about was a variant for rare computers from which the supposedly-offending code had already been removed.

What the Las Vegas ``examples'' actually demonstrated was that SCO's factual claims were irresponsibly inflated when they weren't being kept artfully ``secret.'' With the facts running against them even when the facts were of their own choosing, it was unsurprising that after August SCO turned to the law. But the law was not on their side either.

Making Up the Law

SCO's legal situation contains an inherent contradiction. SCO claims, in the letters it has sent to large corporate users of free software and in public statements demanding that that users of recent versions of the kernel take licenses, that the Linux program contains material over which SCO holds copyright. It also has brought trade secret claims against IBM, alleging that IBM contributed material covered by non-disclosure licenses or agreements to the Linux kernel. But it has distributed and continues to distribute Linux under GPL. It has therefore published its supposed trade secrets and copyrighted material, under a license that gives everyone permission to copy, modify, and redistribute. If the GPL means what it says, SCO loses its trade secret lawsuit against IBM, and cannot carry out its threats against users of the Linux kernel.

But if the GPL is not a valid and effective copyright permission, by what right is SCO distributing the copyrighted works of Linux's contributors, and the authors of all the other copyrighted software it currently purports to distribute under GPL? IBM's counterclaim against SCO raises that question with respect to IBM's contributions to the Linux kernel. Under GPL section 6, no redistributor of GPL'd code can add any terms to the license; SCO has demanded that parties using the Linux kernel buy an additional license from it, and conform to additional terms. Under GPL section 4, anyone who violates GPL automatically loses the right to distribute the work as to which it is violating. IBM therefore rightly claims that SCO has no permission to distribute the kernel, and is infringing not only its copyrights, but those of all kernel contributors. Unless SCO can show that the GPL is a valid form of permission, and that it has never violated that permission's terms, it loses the counterclaim, and should be answerable in damages not only to IBM but to all kernel contributors.

IBM's counterclaim painted SCO into a corner on the subject of the GPL. Not only the facts but also the law are now fundamentally against SCO's increasingly desperate position. SCO and its predecessor, Caldera, have benefited enormously from the protections of the GPL. Thanks to the GPL, SCO has been able, for example, to use the invaluable work of compiler designers and implementers around the world who have made GCC the premier cross-platform C compiler. Customer applications run on SCO's Sys V Unix because of GCC, to which SCO contributed modifications particular to its system, and for which it assigned copyright to the Free Software Foundation. Caldera and SCO could not have marketed a usable operating system product without the contributions of the free software community. SCO was happy to take the benefits, but it has unethically sought to avoid its responsibilities. The law does not permit SCO to have it both ways.

So now it has become time for SCO and its lawyers to pound the table. SCO's response to IBM's counterclaim has been a round of absurd attacks on the GPL, its users, and its author, the Free Software Foundation. The GPL, SCO's answer to IBM's counterclaim alleges, violates not just federal statutes but also the United States Constitution. How a private copyright holder can violate the US Constitution by giving others permission to copy, modify and redistribute its work SCO does not deign to say. Legal theories aren't secrets; if SCO's lawyers had anything to offer in support of this novel proposition, they would offer it. Not one case decided in the long history of US copyright affords support to this ridiculous conception of an unconstitutional copyright license. No lawyer of my reasonably broad acquaintance, no matter what his or her view of the GPL may be, takes this moonshine seriously. After failing on the facts, failing on the law, and raising no more than derisive laughter from pounding the table, even the proverbial shyster is out of luck. What will we see next from SCO, an attack on the umpire?

©Eben Moglen, 2003. Verbatim copying of this article is permitted in any medium, provided this notice is preserved.


* Eben Moglen is professor of law at Columbia University Law School. He has served without fee as General Counsel of the Free Software Foundation since 1993. This paper is based on a presentation given to the Open Source Development Lab's User Advisory Council in Portland, OR, October 8, 2003 and updated to take account of subsequent developments .

1 The most complete review of the SCO Las Vegas presentation was written by Bruce Perens, and is available at http://www.perens.com/SCO/SCOSlideShow.html

LINUX: Questioning SCO: A Hard Look at Nebulous Claims

Questioning SCO: A Hard Look at Nebulous Claims: "Eben MoglenUsers of free software around the world are being pressured to pay The SCO Group, formerly Caldera, on the basis that SCO has 'intellectual property' claims against th"


Eben Moglen

Users of free software around the world are being pressured to pay The SCO Group, formerly Caldera, on the basis that SCO has "intellectual property" claims against the Linux operating system kernel or other free software that require users to buy a "license" from SCO. Allegations apparently serious have been made in an essentially unserious way: by press release, unaccompanied by evidence that would permit serious judgment of the factual basis for the claims. Firms that make significant use of free software are trying to evaluate the factual and legal basis for the demand. Failure to come forward with evidence of any infringement of SCO's legal rights is suspicious in itself; SCO's public announcement of a decision to pursue users, rather than the authors or distributors of allegedly-infringing free software only increases doubts.

It is impossible to assess the weight of undisclosed evidence. Based on the facts currently known, which are the facts SCO itself has chosen to disclose, a number of very severe questions arise concerning SCO's legal claims. As a lawyer with reasonably extensive experience in free software licensing, I see substantial reason to reject SCO's assertions. What follows isn't legal advice: firms must make their own decisions based upon an assessment of their particular situations through consultation with their own counsel. But I would like to suggest some of the questions that clients and lawyers may want to ask themselves in determining their response to SCO's licensing demands.

Eben Moglen is professor of law at Columbia University Law School. He has served without fee as General Counsel of the Free Software Foundation since 1993. This paper is based on a presentation given to the Open Source Development Lab's User Advisory Council in New York, July 24, 2003.
1 Where's the Beef?

What does SCO actually claim belongs to it that someone else has taken or is misusing? Though SCO talks about "intellectual property," this is a general term that needs specification. SCO has not alleged in any lawsuit or public statement that it holds patents that are being infringed. No trademark claims have been asserted. In its currently-pending lawsuit against IBM, SCO makes allegations of trade secret misappropriation, but it has not threatened to bring such claims against users of the Linux OS kernel, nor can it. It is undisputed that SCO has long distributed the Linux OS kernel itself, under the Free Software Foundation's GNU General Public License (GPL).1 To claim that one has a trade secret in any material which one is oneself fully publishing under a license that permits unlimited copying and redistribution fails two basic requirements of any trade secret claim: (1) that there is a secret; and (2) that the plaintiff has taken reasonable measures to maintain secrecy.

So SCO's claims against users of the Linux kernel cannot rest on patent, trademark, or trade secret. They can only be copyright claims. Indeed, SCO has recently asserted, in its first specific public statement, that certain versions of the Linux OS kernel, the 2.4 "stable" and 2.5 "development" branches, have since 2001 contained code copied from SCO's Sys V Unix in violation of copyright.2

The usual course in copyright infringement disputes is to show the distributor or distributors of the supposedly-infringing work the copyrighted work upon which it infringes. SCO has not done so. It has offered to show third parties, who have no interest in Linux kernel copyrights, certain material under non-disclosure agreements. SCO's press release of July 21 asserts that the code in recent versions of the Linux kernel for symmetric multi-processing violates their copyrights. Contributions of code to the Linux kernel are matters of public record: SMP support in the kernel is predominantly the work of frequent contributors to the kernel employed by Red Hat, Inc. and Intel Corp. Yet SCO has not shown any of its code said to have been copied by those programmers, nor has it brought claims of infringement against their employers. Instead, SCO has demanded that users take licenses. Which lead to the next question.
2 Why Do Users Need Licenses?

In general, users of copyrighted works do not need licenses. The Copyright Act conveys to copyright holders certain exclusive rights in their works. So far as software is concerned, the rights exclusively granted to the holder are to copy, to modify or make derivative works, and to distribute. Parties who wish to do any of the things that copyright holders are exclusively entitled to do need permission; if they don't have permission, they're infringing. But the Copyright Act doesn't grant the copyright holder the exclusive right to use the work; that would vitiate the basic idea of copyright. One doesn't need a copyright license to read the newspaper, or to listen to recorded music; therefore you can read the newspaper over someone's shoulder or listen to music wafting on the summer breeze even though you haven't paid the copyright holder. Software users are sometimes confused by the prevailing tendency to present software products with contracts under shrinkwrap; in order to use the software one has to accept a contract from the manufacturer. But that's not because copyright law requires such a license.

This is why lawsuits of the form that SCO appears to be threatening-- against users of copyrighted works for infringement damages--do not actually happen. Imagine the literary equivalent of SCO's current bluster: Publishing house A alleges that the bestselling novel by Author X topping the charts from Publisher B plagiarizes its own more obscure novel by Author Y. "But," the chairman of Publisher A announces at a news conference, "we're not suing Author X or Publisher B; we're only suing all the people who bought X's book. They have to pay us for a license to read the book immediately, or we'll come after them." That doesn't happen, because that's not the law.

But don't users of free software make copies, and need a license for that activity? The Copyright Act contains a special limitation on the exclusive right to copy with respect to software. It does not infringe the copyright holder's exclusive right to copy software for the purpose of executing that software on one machine, or for purposes of maintenance or archiving. Such copying also requires no license. But what if a firm has gotten a single copy of the Linux kernel from some source, and has made many hundreds or thousands of copies for installation on multiple machines? Would it need a license for that purpose? Yes, and it already has one.
3 Do Users Already Have a License?

The Linux kernel is a computer program that combines copyrighted contributions from tens of thousands of individual programmers and firms. It is published and distributed under the GPL, which gives everyone everywhere permission to copy, modify and distribute the code, so long as all distribution of modified and unmodified copies occurs under the GPL and only the GPL. The GPL requires that everyone receiving executable binaries of GPL'd programs must get the full source code, or an offer for the full source code, and a copy of the license. The GPL specifies that everyone receiving a copy of a GPL'd program receives a license, on GPL terms, from every copyright holder whose work is included in any combined or derived work released under the license.

SCO, it bears repeating, has long distributed the Linux kernel under GPL, and continues to do so as of this writing. It has directly given users copies of the work and copies of the license. SCO cannot argue that people who received a copyrighted work from SCO, with a license allowing them to copy, modify and redistribute, are not permitted to copy, modify and distribute. Those who have received the work under one license from SCO are not required, under any theory, to take another license simply because SCO wishes the license it has already been using had different terms.

In response to this simple fact, some SCO officials have recently argued that there is somehow a difference between their "distribution" of the Linux kernel and "contribution" of their copyrighted code to the kernel, if there is any such code in the work. For this purpose they have quoted section 0 of the GPL, which provides that "This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License." The Linux kernel contains such notices in each and every appropriate place in the code; no one has ever denied that the combined work is released under GPL. SCO, as Caldera, has indeed contributed to the Linux kernel, and its contributions are included in modules containing GPL notices. Section 0 of the GPL does not provide SCO some exception to the general rule of the license; it has distributed the Linux kernel under GPL, and it has granted to all the right to copy, modify and distribute the copyrighted material the kernel contains, to the extent that SCO holds such copyrights. SCO cannot argue that its distribution is inadvertent: it has intentionally and commercially distributed Linux for years. It has benefited in its business from the copyrighted originality of tens of thousands of other programmers, and it is now choosing to abuse the trust of the community of which it long formed a part by claiming that its own license doesn't mean what it says. When a copyright holder says "You have one license from me, but I deny that license applies; take another license at a higher price and I'll leave you alone," what reason is there to expect any better faith in the observance of the second license than there was as to the first?
4 Conclusion

Users asked to take a license from SCO on the basis of alleged copyright infringement by the distributors of the Linux kernel have a right to ask some tough questions. First, what's the evidence of infringement? What has been copied from SCO copyrighted work? Second, why do I need a copyright license to use the work, regardless of who holds copyright to each part of it? Third, didn't you distribute this work yourself, under a license that allows everyone, including me, to copy, modify and distribute freely? When I downloaded a copy of the work from your FTP site, and you gave me the source code and a copy of the GPL, do you mean that you weren't licensing me all of that source code under GPL, to the extent that it was yours to license? Asking those questions will help firms decide how to evaluate SCO's demands. I hope we shall soon hear some answers.

Copyright (c) Eben Moglen, 2003. Verbatim copying of this article is permitted in any medium, provided this notice is preserved.
Notes

(1) - Linux kernel source under GPL was available from the SCO's FTP site as of July 21, 2003.

(2) - See SCO Press Release, July 21, 2003, http://ir.sco.com/ReleaseDetail.cfm?ReleaseID=114170


* Eben Moglen is professor of law at Columbia University Law School. He has served without fee as General Counsel of the Free Software Foundation since 1993. This paper is based on a presentation given to the Open Source Development Lab's User Advisory Council in Portland, OR, October 8, 2003 and updated to take account of subsequent developments .

GOOGLE: Googlebomb Watch

Googlebomb Watch: "Googlebomb Watch keeps an eye on the latests (and older) Googlebombs. What's a Googlebomb? A Googlebomb is when a group of people link to a specific chosen page using a specific cho"



Googlebomb Watch keeps an eye on the latests (and older) Googlebombs. What's a Googlebomb? A Googlebomb is when a group of people link to a specific chosen page using a specific chosen link-text, in order to push this page up in the Google ranking. This can have political reasons and discredits a person, or is done for fun as part of a SEO (Search Engine Optimization) challenge.


Weapons of mass destruction

This was a joke page looking just like 'File not Found' page when you clicked the first result. Showing Google result 1 of 861,000 for Weapons of mass destruction.

Cannot find Weapons of Mass Destruction
These Weapons of Mass Destruction cannot be displayed. The weapons you are looking for are currently unavailable. The country might ...
www.coxar.pwp.blueyonder.co.uk/


SERPs

This is an older SEO contest for the word SERPs (search engine result pages). It was started in a newsgroup. Showing Google result 1 of 67,400 for SERPs.

SERPs - Main serps page. May 2nd Nigritude Ultramarine
Nigritude Ultramarine | xp64 | Weblogs | Mangeur de Cigogne nigritude ultramarine SERPs mangeur de cigogne competition. ... The full history about Serps . ...
www.sim64.co.uk/


Out of Touch Executives

This Googlebomb was started by Google critic Daniel Brandt and targets the Google executives bio. Showing Google result 1 of 128,000 for Out of Touch Executives.

Google Corporate Information: Management
... his time in Ann Arbor, Page served as president of the University's Eta Kappa Nu Honor Society and built a programmable plotter and inkjet printer out of Lego ...
www.google.com/ corporate/ execs.html


Mangeur de Cigogne

A french SEO contest. The nonsense phrase means 'Eaters of Stork'. Showing Google result 1 of 265,000 for Mangeur de Cigogne.

mangeur de cigogne by NONAME
mangeur de cigogne (stork eater) is a french web ranking contest based on mangeur de cigogne keywords. mangeur de cigogne . ... mangeur de cigogne (stork eater) ...
www.noname.fr/ mangeur-de-cigogne/


Waffles

A political Googlebomb targeting J.F. Kerry. Showing Google result 1 of 238,000 for Waffles.

:: John Kerry for President - Welcome to JohnKerry.com! ::
GET KERRY EMAIL. ...
www.johnkerry.com/


Nigritude Ultramarine

This SEO challenge started by Darkblue had no results in Google prior to its beginning in May 2004. Showing Google result 1 of 202,000 for Nigritude Ultramarine.

Anil Dash: Nigritude Ultramarine
... June 04, 2004. Nigritude Ultramarine . Update: The ... contest. Do me a favor: Link to this post with the phrase Nigritude Ultramarine . I ...
www.dashes.com/ anil/ 2004/ 06/ 04/ nigr...


Jew

Many people did not like the fact 'Jew' pointed to a hate-site, so they linked 'Jew' from their blogs to point to Wikipedia's entry. Showing Google result 1 of 756,000 for Jew.

Jew - Wikipedia, the free encyclopedia
Jew . From Wikipedia, the free encyclopedia. Jews. Total population: 13-15 million (est.). Significant populations in: ... [edit]. "Israelite", "ethnic Jew ". ...
en.wikipedia.org/ wiki/ Jew


French Military Victories

A Google mock-up telling French Military Victories did not return any documents ("Did you mean: French Military Defeats?"). Showing Google result 1 of 53,100 for French Military Victories.

french military victories
... No standard web pages containing all your search terms were found. Your search - french military victories - did not match any documents. Suggestions: ...
www.albinoblacksheep.com/ text/ victorie...


Litigious Bastards

This Googlebomb targets the SCO Group. Showing Google result 1 of 2,460 for Litigious Bastards.

The SCO Group, Inc. | SCO Grows Your Business
Discover 5 Reasons to Install UNIX® instead of Linux®. SCO® OpenServer™ Release 5.0.7 supports thousands of small and medium ...
www.caldera.com/


Buffone

Buffone is the Italian word for "clown" and points to Italian Prime minister Silvio Berlusconi. Showing Google result 1 of 14,200 for Buffone.

Personal Page of Silvio Berlusconi
Silvio Berlusconi, Yahoo! Yahoo! Chat, Yahoo! Games, Yahoo! Photos, Silvio Berlusconi (Milano, 1936) è laureato in giurisprudenza. ...
www.geocities.com/ palazzochigi2003/ bio...


Miserable Failure

One of the most famous Googlebombs, originally targeting only President George W. Bush, later on also Michael Moore and others. Showing Google result 1 of 105,000 for Miserable Failure.

Biography of President George W. Bush
Home > President > Biography President George W. Bush En Español. George W. Bush is the 43rd President of the United States. He ...
www.whitehouse.gov/ president/ gwbbio.html


Search Engine Optimization

Not a bomb per se, but whoever scores high for 'Search Engine Optimization' is also probably a very well search engine optimizer, as many professionals in the Google-search business optimize for this phrase. Showing Google result 1 of 1,420,000 for Search Engine Optimization.

Search Engine Optimization Search Engine Placement
Search engine optimization , Search Engine Placement by SEO Inc. Search Engine Optimization , Search Engine Placement and vital internet marketing. ...
www.seoinc.com/


Talentless Hack

This is the original Googlebomb by Adam Mathes from April 6, 2001. Showing Google result 1 of 2,600 for Talentless Hack.

Über: Better Than You, Daily.
... group effort. And it must be harnessed, and for one very important goal: make Andy " talentless hack " Pressman look stupid. Here's ...
uber.nu/ 2001/ 04/ 06/

M$: Inside Microsoft's Next Big Thing

Inside Microsoft's Next Big Thing

Inside Microsoft's Next Big Thing
By Susan Kuchinskas
June 9, 2004

MOUNTAIN VIEW, Calif. -- Microsoft brought its brainiacs to Silicon Valley for a road show highlighting the latest cool stuff.

Scientists from Microsoft Research (Quote, Chart) labs in San Francisco and Redmond joined their colleagues at the company's Mountain View, Calif. campus to showcase speculative projects that could someday find their way into products.

Researchers are working on everything from a Web services-based model of the universe to sneaky ways to foil spammers.

Dan Ling, vice president of Microsoft Research, told an audience of academics, entrepreneurs and business folk that while Research has only a small part of Microsoft's hefty $7 billion R&D budget, most of the company's products are influenced by what it does.

For example, the San Francisco lab's statistical analysis of the Web could find its way into the new search technology Microsoft is readying to go up against Google. Jim Gray, a Microsoft Research Distinguished Engineer, said that a yearlong project to produce a statistical characterization of the Web turned up some interesting and useful trends. Microsoft Research tracked 1 billion Web pages for a year, analyzing what had changed and looking for anomalies.

By keeping track of how many Internet names mapped to the same IP address or how many other pages linked to a single Web page, the technology seems to be able to identify what Gray called "places you don't want a search engine to go," such as sites identified with pornography or spam. Microsoft researchers Marc Najork, Mark Manasse and Dennis Fetterly published the research and passed the information to the MSN Search team.

A new algorithm for finding the shortest route could be used for Microsoft MapPoint.Net, Gray said. In tests, author Andrew Goldberg found it delivered a 20-times improvement in time and memory for the road network of a large state. This improvement could enable shortest path routing for PDAs. It could be used to offer users real-time advise about traffic congestion or road outages, and it also could enable larger requests, such as driving directions for the shortest cross-country route.

A very long-term project, Ling said, is modular data center software, codenamed Boxwood, that could make large-capacity storage and computation systems cheaper by virtualizing storage, distributing the locking and global state to unify the system, and automating provisioning, error detection and reinitializing.

"We need to get rid of the idea that with our 1500 CPUS we're going to have 1500 different file systems," Ling told internetnews.com.

One area Microsoft Research is helping lead Microsoft is the company's efforts to combat spam. "It's of great importance to the Hotmail group which is here in Silicon Valley," Ling said.

The stats are alarming: 23 percent of e-mail users say spam has reduced their e-mail use, while 76 percent are bothered by offensive or obscene content, and as much as 78 percent of all e-mails are spam.

"It's something that needs to be undertaken by the community as a whole. Leading e-mail providers are starting to get together to look at common strategies," he said.

Ling also outlined several approaches, including employing machine learning techniques to automatically identify e-mails that look like spam. With millions of Hotmail users participating in helping to train the software, Ling said, the filters can become very effective over time. Microsoft also is considering "black hole" lists and some form of "postage" that makes it more expensive to send spam, whether that's charging money, making the computer perform a computation or giving senders a test to prove they're human. All these could make spamming a little less economical.

The Silicon Valley Lab is working on using natural language, extending the language recognition capabilities shipped in Word 97. "Our end goal is to be able to speak in English to a machine and have it understand and respond," Ling said. While working on that long-range goal, the group expects to identify some interesting applications in the short term. For example, they've built grammar parsers, which try to identify sentence structure. This could be used to build a grammar checker.

Another project -- MindNet -- is a semantic network. "Think of it as a bunch of senses of a particular word and relationships between those words," Ling explained. For example, different words would link to the word bank when used to denote a financial institution than when it referred to the bank of a river.

Microsoft is bringing this to bear on automatic translation, to help with the production of its many manuals in even more languages. For its Product Support Services Knowledge Base, human editors translated five percent of the most important documents into Spanish and Japanese; the rest were done by machine, with little evident loss in customer satisfaction.

In an attempt to contribute directly to science, Microsoft Research is collaborating with Jim Mullins at the University of Washington and Simon Mallal of Royal Perth Hospital in Australia on what Ling described as "doing an AIDS vaccine in a rational manner." Computational science can contribute by calculating the probabilities of various protein sequences appearing in the rapidly mutating HIV virus, to identify the vaccine that would produce immunity to as many strains as possible.

Microsoft Research was founded in 1991; it has facilities in San Francisco, Mountain View, Redmond, Beijing and Cambridge, UK.

"Our goal," said Ling, "is advancing the state of the art, participating in the worldwide research community, then delivering that into the hands of Microsoft's customers."

M$: MSN Search claims to freeze out web spam

vnunet.com - MSN Search claims to freeze out web spam: "Microsoft is incorporating a new filtering technology into its forthcoming MSN Search technology, aiming to offer results clear of web spam.The company unveiled a research pro"

Microsoft is incorporating a new filtering technology into its forthcoming MSN Search technology, aiming to offer results clear of web spam.

The company unveiled a research project at its Silicon Valley campus in Mountain View which uses statistical analysis to locate spam web pages.

A spam web page is designed solely to fool search engines by linking keywords to web pages that the spammer wants to show up high in the search results.

Spammers are increasingly trying to weasel their way into search engine results, and Microsoft hopes that filtering them out can be one area where its tool can outshine Google's.

"This will be part of the [upcoming] Microsoft search," researcher Marc Najork told vnunet.com.

Microsoft has so far given little detail about its MSN Search project, which is designed to compete head on with Google. The new search technology is scheduled to be available this year.

In a sample of one billion web pages, Microsoft claims that eight per cent are spam.

In one case, the Microsoft researchers claim to have found a webpage in Germany that would constantly create pages filled with pieces of text that were copied from random web pages, linked to a porn site.

This not only leads visitors away from the webpage from which the text was copied, but gives the spammer an indefinite source of keywords and key phrases to link to.

The researchers found the site after their analysis identified that German web pages on average were updated more often than those in other geographies.

SEC: [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solution

Neohapsis Archives - Full Disclosure List - #0104 - [Full-Disclosure] Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan): "Just when I though it was save to once more use internet explorer I received an email bringing my attention to this webpagehttp://216.130.188.219/ei2/installer.htm that accor"

Just when I though it was save to once more use internet explorer I received
an email bringing my attention to this webpage
http://216.130.188.219/ei2/installer.htm that according to him used an
exploit that affected fully patched internet explorer 6 browsers. Being
rather skeptical I carelessly clicked on the link only to witness how it
automatically installed addware on my pc!!!

Now there had been reports about 0day exploits making rounds for quite some
time like for instance this post

http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

However I hadn't seen any evidence to support this up until now
Thor Larholm as usual added to the confusion by deliberately spreading
disinformation as seen in this post

http://seclists.org/lists/bugtraq/2004/May/0153.html

Attributing it to and I quote "just one of the remaining IE vulnerabilities
that are not yet patched"

I’ve attempted to write up an analysis that will show that there are at
least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
wrong) out there in the wild, one being fairly sophisticated

You can view it at:

http://62.131.86.111/analysis.htm

Additionally you can view a harmless demonstration of the vulnerabilities at

http://62.131.86.111/security/idiots/repro/installer.htm

Finally I also attached the source files to this message

LINUX: Inventor of Linux is Portland-bound

KATU 2 - Portland, Oregon

June 10, 2004
BEAVERTON, ORE. - Linus Torvalds, the Finnish-born inventor of the Linux computer operating system, is Portland-bound.

The Oregonian reported Thursday that Torvalds is moving to Portland from California to oversee the Open Source Development Labs in Beaverton

"Quite frankly," he told the newspaper via e-mail, "We want to be somewhere calmer and saner. Silicon Valley is a bit crazy."

Torvalds says he and his family will make the move after his children finish school next week.

"The plan was to try to acclimatize and have time to grow webbed feet (although I'm told there are implants available) by moving during the summer," he wrote.

Torvalds is often credited with transforming free operating system software from idea to reality.

(Copyright 2004 by The Associated Press. All Rights Reserved.)

SEC: Internet Explorer Local Resource Access and Cross-Zone Scripting Vulnerabilities

Secunia - Advisories - Internet Explorer Local Resource Access and Cross-Zone Scripting Vulnerabilities: " Internet Explorer Local Resource Access and Cross-Zone Scripting Vulnerabilities Secunia Advisory: SA11793 Print Advisory Release Date: 2004-06-08Last Update: 2004-06-1"


Internet Explorer Local Resource Access and Cross-Zone Scripting Vulnerabilities

Secunia Advisory: SA11793 Print Advisory
Release Date: 2004-06-08
Last Update: 2004-06-10

Critical:
Extremely critical
Impact: Security Bypass
System access
Where: From remote

Software: Microsoft Internet Explorer 6


Description:
Two vulnerabilities have been reported in Internet Explorer, which in combination with other known issues can be exploited by malicious people to compromise a user's system.

1) A variant of the "Location:" local resource access vulnerability can be exploited via a specially crafted URL in the "Location:" HTTP header to open local files.

Example:
"Location: URL:ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm"

2) A cross-zone scripting error can be exploited to execute files in the "Local Machine" security zone.

Secunia has confirmed the vulnerabilities in a fully patched system with Internet Explorer 6.0. It has been reported that the preliminary SP2 prevents exploitation by denying access.

Successful exploitation requires that a user can be tricked into following a link or view a malicious HTML document.

NOTE: The vulnerabilities are actively being exploited in the wild to install adware on users' systems.

Solution:
Disable Active Scripting support for all but trusted web sites.

Filter "Location:" headers containing the "URL:" prefix in a proxy server.

Use another browser.

Provided and/or discovered by:
Originally discovered in the wild.
Detailed analysis of exploit by Jelmer.

Changelog:
2004-06-08: Updated information in advisory.
2004-06-10: Updated information in advisory and added link to US-CERT vulnerability note.

Other References:
Jelmer's posting on Full-Disclosure:
http://archives.neohapsis.com/ar...fulldisclosure/2004-06/0104.html

US-CERT VU#713878:
http://www.kb.cert.org/vuls/id/713878

M$: Windows HPC edition in the works

Windows HPC edition in the works | The Register: "By Datamonitor Published Thursday 10th June 2004 20:08 GMTAlthough Microsoft has refused to confirm the many reports that say so, it appears the company is working on a version of"

By Datamonitor
Published Thursday 10th June 2004 20:08 GMT

Although Microsoft has refused to confirm the many reports that say so, it appears the company is working on a version of its Windows Server platform specifically tailored for the high performance computing market...

That Microsoft would branch off from Windows 2003 Server to create an HPC Edition makes perfect sense for a number of reasons, but the main benefit would be to cut off one of the major growth areas for the Linux market, while filling its own coffers.
How the sector evolved

Thirty years ago, the HPC market was dominated by massively expensive vector supercomputers that ran a collection of Fortran and C programs on Unix operating systems. A vector processor is a fancy name for a specialized computer that does floating point math very fast, and being a specialized machine for a relatively tiny market, vector processors had to be expensive by definition.
Newsletter

In the mid-1990s, as HPC computing requirements went up faster than budgets (particularly for weather modeling and weapons research), research organizations in government and academia swiftly adapted many of the supercomputing programs to run on so-called massively parallel supercomputers that were created from clusters of Unix workstations or servers. These servers were linked together by special fast switches and software based on the Message Passing Interface standard. This MPI approach gradually went corporate, and with the advent of Linux clusters on cheap X86 iron in the past few years, it has gone mainstream. Microsoft wants a piece of the action.

Since 1992, Microsoft has been working with Dell, Intel, and the Cornell Theory Center of Cornell University, in Ithaca, New York, to create MPI-based clusters running a variety of Windows operating systems. There is a plethora of software available to make Windows clusters, but most companies are moving from Unix to Linux clusters because of the close relationship that exists, from a code execution point of view as well as from a system administration perspective, between the Unix and Linux systems.
Overlooked factors

The people jabbering about this rumored HPC Edition for the past few weeks didn't stop to realize two things. First, MPI is an open standard and Microsoft can easily weave it right into the guts of Windows, either at the communications layer or within the Common Language Runtime (CLR) execution environment of the .NET Framework. The latter would be more useful, since it would better insulate programmers from the complexities of having to program for parallel environments. (That's the theory, anyway.) Microsoft could partner (say with MPI Software Technology, one of the experts in this area that has Windows-compatible MPI code already done).

Here's the other thing they forgot. With the Services for Unix (SFU) layer of Windows Server 2003, which was significantly expanded in February and is now free, Microsoft has a Unix development and runtime environment inside Windows. This could also be extended with MPI, allowing Fortran and C applications written for parallel Unix clusters to be more easily ported to parallel Windows clusters. In theory, the parallel Unix applications would not have to be tweaked much (but would have to be recompiled) to run within the SFU environment on Windows. This is not such a big deal. Companies moving from Unix to Linux clusters are already doing it, in fact.

There are other possibilities, including creating a grid environment, as Sun Microsystems has, that aggregates the processing capacity of servers in an MPI cluster with desktops residing on the corporate network to create an even more massive parallel supercomputer. What Grid Engine does for Solaris - creating a virtual processing pool for parallel applications - Windows Server HPC Edition could do for Windows.
Competing on price

The main thing Microsoft has to realize is, if it wants to get into the HPC market, it not only has to more tightly integrate MPI and other protocols with the Windows platform, it will have to compete on price as well. The dirty little secret in the parallel Linux cluster market is that a lot of these machines are not running expensive server editions of the commercial Linux software (if they are using commercial versions at all), but rather are using stripped-down versions of desktop Linux editions, which basically have the kernel, some compilers and libraries, and the clustering software installed.

Windows Server HPC Edition, whether it comes out later this year or next year, is going to have to be very inexpensive to beat Linux in the HPC market. Linux didn't just take off in the HPC market because it was like Unix. It took off because it was cheap or free. If Microsoft can make programming for parallel supercomputers easier, through the magic of CLR and the future Visual Studio 2005, it may be able to charge a slight premium for a future Windows Server HPC Edition.

Source: ComputerWire/Datamonitor

SEC: Unpatched IE vuln exploited by adware

Unpatched IE vuln exploited by adware | The Register

By John Leyden
Published Thursday 10th June 2004 13:52 GMT

Detailed information on a brace of unpatched vulnerabilities in Internet Explorer has been posted onto a dull disclosure mailing list. The flaws involve a cross-zone scripting vuln and a bug in IE's Local Resource Access and pose an "extremely critical" risk to Windows users, according to security firm Secunia. The vulnerabilities affect both Internet Explorer 6 and Outlook.

Secunia has confirmed the vulnerabilities in a fully patched system with Internet Explorer 6.0. Improved security features in the XP SP2 reportedly block exploitation but users would be ill advised to rely on beta code for protection. SP2 doesn't help users of earlier versions of Windows who are also at risk.

The vulnerabilities are actively being exploited in the wild to install adware on users' systems, security researchers warn. Other exploits - include computer viruses - based on the same techniques of tricking users into visiting a maliciously constructed website housing malign script could follow.

Etienne Greeff, director at MIS Corporate Defence Solutions, said: "This is a very sophisticated exploit using encryption and stealth technologies to deliver its payload, using previously unknown vulnerabilities to work."

Windows users should disable Active Scripting support for all but trusted websites until Microsoft releases patches to address the vulnerabilities. The vulnerabilities were publicised by a Dutch 'white hat hacker' called Jelmer, who came across an example of an exploit of the flaws already in circulation last weekend. ®

M$: Research makes a stronger mark on Microsoft

InfoWorld: Research makes a stronger mark on Microsoft: June 10, 2004: By : PLATFORMS: "Yet, the group, more than 700-people-strong, is more involved with Microsoft's products than before. Microsoft Research, for example, is working closely with Microsoft's pro"

Work extends beyond product development



By Joris Evers, IDG News Service June 10, 2004

MOUNTAIN VIEW, CALIFORNIA - Microsoft Corp.'s research group receives only a small piece of the company's massive research and development (R&D) budget, which in its current fiscal year is a sizeable $6.8 billion. Unlike what might be expected, Microsoft Research's (MSR's) main task is not researching new products. Instead, the group mostly does fundamental technology research.

Yet, the group, more than 700-people-strong, is more involved with Microsoft's products than before. Microsoft Research, for example, is working closely with Microsoft's product development teams on the development of Longhorn, the code name for the Windows release expected in 2006.

"We're actually a very small 'R' next to the very large 'D' that Microsoft does," said Daniel Ling, corporate vice president and head of Microsoft's Redmond, Washington, research lab in a presentation Wednesday. Yet, "every single Microsoft product has been touched by Microsoft Research," he said.

Ling spoke at a Microsoft Research road show at the software maker's Mountain View, California, campus. The group presented 10 of its projects, including future technologies designed to better secure computers, detect spam on Web pages and create summaries out of several news stories on a single topic. After his presentation, Ling sat down with IDG News Service to talk about Microsoft Research, the role the group plays within Microsoft and the increasing impact it has on Microsoft products.

IDGNS: You said that every product that Microsoft offers today was touched at one point by Microsoft Research. Is that something that you see increasing? Are Microsoft product groups using your services more than ever before?

Ling:I think over time it is true that we are expanding our influence. For example, I would say that around four years ago, we had relatively little engagement with MSN and now we have a lot of engagements with MSN related to spam and on search-related issues. Over the years, I think we are gradually increasing our involvement with different parts of Microsoft.

IDGNS: How does that happen? Do the product groups come to you and ask you to research technologies for a specific product or do Microsoft Research employees set out their own research directions?

DL: It is a mixture of both. Sometimes, we think a direction is important and we will pursue it on our own, then later the product groups will come to us. A good example of this is data mining in SQL (Server). We started our data mining efforts in Microsoft Research. SQL actually was not focused on the data warehouse, data mining or any of those things. We incubated, with the agreement of the SQL team, the data-mining process within MSR and in the next release (the team) said, "Oh, this is really interesting, let's include that as part of the main product offering." So it happens like that.

And sometimes (the product teams) come to us and say, "Gee, this is a really important area, can you help us do something about that?" Clearly, security is becoming a more and more important issue for Microsoft, and we have done more on security and bug- related things to meet that need.

IDGNS: Is your collaboration with the product groups something that has also increased over the years?

DL: I think we have a very good history of working with the product groups -- really since the beginning of Microsoft Research. So I am not sure (there) is a change in the way we work or a cultural change or anything like that. To give you an example, the original video and audio streaming work was actually a research project that started in the early to mid-'90s ... and later grew in to the whole (Microsoft) digital media division.

IDGNS: How long does it typically take for work by Microsoft Research to show up in Microsoft products?

DL: You should not think about these projects as product development. We work very closely with the product groups, so ideas from these research projects may appear in future versions of Microsoft products. For example, a lot of the spam technologies we developed showed up relatively quickly on MSN, by that I mean maybe six months or something like that. Longhorn obviously has a longer development cycle, so it will take longer to show up. That has to do partly with the technology and partly with our product cycles. It is not an easy thing to quantify.

IDGNS: If you look at your involvement with Microsoft products, is it mostly Web products such as MSN, consumer or desktop products such as the Windows client or enterprise products such as Windows Server, SQL Server or BizTalk Server? Is there any way you can see Microsoft Research being more involved with any specific part of Microsoft?

DL: I think we try to be involved with all of them. At events like today's, we tend to show the more visual things and not the back-end, tool kind of things. Take for example SQL. Here we have a very interesting project that tries to simplify the administration of a database and make it much easier to automatically tune the database to the workload that you see. This is a very enterprise kind of application. Our work cuts across all departments.

IDGNS: If I am a SQL Server user and tell my Microsoft representative that I need an easier way to manage my database, will this person tell me this is good feedback that can be used when the next version is being developed? You say that you are working on things related to SQL Server as well, so are customer requests coming down to you from the product team?

DL: No. We think it is important to give our researchers a lot of freedom in terms of choosing the topics that they want to investigate. That said, we ask the researchers to spend a lot of time, initially, with the product groups so they know what is going on and what is important. It is not that the product groups can say, "Definitely work on that." Very often we will work on something because we want to help the product teams, but they do not have direct control over the process.

IDGNS: So researchers don't go out to meet Microsoft customers?

DL: Sometimes they do. They might meet them on location or in executive briefings. There are lots of opportunities to interact with customers.

IDGNS: One of the research projects Microsoft talked about today is clustering and storage virtualization. There are companies already doing these things on Windows as well as Unix and Linux. What is Microsoft looking at developing itself?

DL: What we're trying to do is look at the next generation of clusters and build them in such a way that the amount of management required is minimized. We have a project called Boxwood. This is an innovative approach to building a new kind of storage infrastructure. (More details on Boxwood are at: http://research.microsoft.com/research/sv/Boxwood/)

IDGNS: The biggest thing that is happening at Microsoft right now is developing Longhorn and what Microsoft executives have called "the Longhorn wave of products." What is your involvement in Longhorn? And would you say you're involved more with Longhorn than you were with other version of Windows?

DL: I think it's been very good. When Longhorn was being formulated, there was a whole series of task forces around the company to look at what to do and how to do it. Microsoft Research was very heavily involved in these discussions. So, I think we have played a key role in defining what should be part of Longhorn. As the product is being developed, we've been engaged pretty tightly with the various Windows groups that are involved.

IDGNS: Do you remember the development of Windows XP, for example? How does Longhorn compare?

DL: Yes, I think we are more involved with Longhorn than we were with XP. With Longhorn, because it is such an important milestone for the company, we've been heavily engaged.

M$: Overview of MSBuild, Part 2: From the Task Author's Perspective

Longhorn Developer Center: Overview of MSBuild, Part 2: From the Task Author's Perspective ("Longhorn" Technical Articles)

PROG: .NET Rocks! hosted by MSDN

.NET Rocks! hosted by MSDN

PROG: Getting Started with Visual C#

Getting Started with Visual C#

NEWS: Hacker Intel Shuts Down

Hacker Intel - Hacker Intel Shuts Down: " Contributed by: spacerog on 10Jun04 @ 09:06EDT HackerIntel This will be the last article posted to Hacker Intel.A lack of support, visitors and time has forced me to come to this de"


Contributed by: spacerog on 10Jun04 @ 09:06EDT

HackerIntel

This will be the last article posted to Hacker Intel.

A lack of support, visitors and time has forced me to come to this decision. Unfortunately this website is just not covering its own expenses. In addition the amount of time available to invest into this site is quickly diminishing. The only logical solution is to shut the site down.

Ever since the demise of the Hacker News Network people have pleaded with me to create a similar website. I was told that there was a need for such a site within the community. After the mess that surrounded HNNs destruction I wasn't in a big hurry to start over. In addition at the time the software to do what I wanted to do, to run the site the way I knew it should be run, just didn't exist, at least not on my budget. So I resisted the temptation to start over.

Over the years the pleading and begging grew stronger. So strong that I once again started to look at what web software was available. Geeklog had just about every feature I wanted and it was fairly secure. (Man, if I had something like this back in the HNN days...) After discovering an extreme lack of good information security news websites I started Hacker Intel.

Despite some early success the Hacker Intel web logs indicate that people no longer want a quick but critical eye of mass media and underground news reports. They no longer want or need a voice of reason among the fear, uncertainty, and doubt that plagues the excuses labeled as news. Be that as it may, I am actually glad this is the case as I won't be wondering 'what if' any longer. I finally have an answer for everyone who asks me to start HNN again. Been there, Done that.

I'll leave Hacker Intel online for a few more days. Eventually I'll take it down so if you want any of the 900 plus stories in the archives grab them now.

- SR

GOOGLE: Inside the Google search machine

BBC NEWS | Technology | Inside the Google search machine

By Mark Ward
BBC News Online technology correspondent
If anyone knows how to get their webpage to top Google's search results it is Matt Cutts.

Mr Cutts is one of a team at Google who help webmasters and website creators tweak their pages to ensure they are properly indexed by the search engine.

But ironically, says Mr Cutts, he does not have an extensive personal web presence that can take advantage of this insider knowledge.

All he has is a few pages dating from his college days that he says he does not regularly update.

Though, it must be said, they do appear top of any search for the name "Matt Cutts" on Google.

Search here

Mr Cutts says that Google works hard to ensure that most of the problems that webmasters encounter can be solved automatically via its help pages or using the tools it provides.

Given the huge number of webpages out there in cyberspace, Google indexes more than 4.2 billion, it is the only approach that will work.

"We have a philosophy of trying to develop things scalably," Mr Cutts told BBC News Online.

The reason it can do this is because of the huge technical resources that Google has built up since it started.

In 2003 Google spent $173m on its data centres and is expecting to spend about $250m in 2004.

Although Google's senior technology folk have filed papers about how it does what it does, it has been reluctant to say just how many servers it owns and operates.

The estimates of how many machines it has in its datacentres range from 10,000 to 80,000.

This concentration of computer power could be addressing more than 6,000 terabytes of data.

In contrast to most other net firms, Google does not rely on these machines being reliable and all are based around cheap and easy to replace PC chips.

"The model of having a lot of machines and have them fail is a very powerful one," says Mr Cutts. "You have a small team replacing hard drives and it never affects the index."

Instead, he says, Google uses software to keep its search system reliable.

Google used to update its web index every month which, because it caused results to jump around a little, was dubbed the Google Dance.

But not anymore, says Mr Cutts.

"Within the last year we have improved out way of processing and indexing the web," he says. "You are not going to see Google dances."

"Now we crawl a percentage of the web everyday," he says, "so after a relatively small time frame we hit every page."

Bombs away

Google does not just have one copy of the entire web, it has several to help with reliability and ensure results are returned quickly.

Also, says Mr Cutts, there are quite a few Googlers, as staff are called, that keep an eye on its web index and make sure it is accurate.

Even the software at the heart of the search engine is regularly tweaked to ensure that results are relevant.

"We work on algorithmic solutions to scalably handle problems," he says. "We look at ways not just solutions for particular incidents but entire classes of problems."

"You do not have to worry about the bias of the computer. It's a fair and equitable way to tackle it."

Attempts to catch out the indexing system and force results to the top of returned results, called Google bombs, only work on a very small scale, says Mr Cutts.

Even blogs, which tend to refer to each other a lot, do not trouble the indexing system.

"Blogs are not so much of a problem," says Mr Cutts. "They show up less often than you expect."

In some respects, running the search system is just a preparation for everything else Google wants to do.

"Once you have thousands of machines with all these capabilities it's a lot of fun to see what else you can do with them," he says.

LINUX: Will .Net Developers Get Mono?

Linux News: Developer: Will .Net Developers Get Mono?

LINUX: My First Linux Server (Part II)

My First Linux Server (Part II): "Build a home for all the files you need to share. By Drew Robb June 2, 2004A file server is a specialized PC that holds large numbers of files that many people on a network can access. It"

Build a home for all the files you need to share.

By Drew Robb
June 2, 2004

A file server is a specialized PC that holds large numbers of files that many people on a network can access. It "serves up" files to everyone instead of each person having files on his or her own PC. The good news is that you don't have to be a network guru to set up a basic file server. If you followed the Easy Linux Install steps in Part 1, you are ready to set up a Linux PC as a file server.

While there are many ways to set up a network and a server, this article concentrates on the simplest approaches with the highest chance of quick success.

Reminder: Network Card
Your Linux platform must connect to the network with a NIC, or Ethernet adapter.

Step 1: Open Windows
The Linux file server process starts on the Windows side. Work on only one Windows PC at first. Once you get one Windows PC talking to your Linux file server, you can add more PCs, but for now, let's keep things simple and start with one Windows PC.

Note that networking goes easier if the user ID and password on the Windows side are the same those used on the Linux side. Open the Windows Control Panel and click on User Accounts to set up a user account with ID and password identical to a Linux user. Unfortunately, we have to get a little technical here in order to find the Internet Protocol (IP) address for the Windows PC on the network and some other required information. Click on the Start button on the bottom left of the screen, then All Programs, Accessories and Command Prompt. Type in this command: C:\> ipconfig /all. This let's you see a list of network information. Write down the details it provides for:

* IP Address
* Subnet Mask
* Host name

You don't need to know what all this means as long as you jot down this information. You will need it later in the process.

Step 2: Open Linux
To keep things simple, we refer only to SuSE Linux 9.0 because of its easy-to-use YaST (Yet another Setup Tool) Control Center graphical utilities. Red Hat Linux users can follow the same general process and go to the references listed at the end of this article.

Start by opening up the SuSE YaST Control Center (YaST = Yet another Setup Tool) graphic utility. Do the following:

1. Turn off all the servers and clients and the firewall.Just open each of the server icons, and if the server program is running, disable it.
2. Add the Windows PC to the Host Names utility list. Hosts are computers on the network.
3. Open the Samba Server icon. Samba is the Linux program that makes your Windows network think your Linux PC is just another Windows PC, so you can share files over the network. The Samba Server Tool is a series of screens that help you set up the file server. Most of the choices are obvious. Make the following selections as you go through the screens.

* Enable the Samba Server
* Sharing Type: Select File and printer sharing.
* Workgroup: Add the name of your Microsoft Windows Network workgroup
* Authentication Details: Choose Authentication Back-End = smbpasswd.
* Share Homes to allow sharing of home directories, but do not select Share Printers (yes, Samba is good for print servers too, but let's not worry about that at the moment for the sake of simplicity).
* Shared Directories: Create the shared directories you want to see on the Windows network.

Test 1: Can You See Me Now?
After completing the Samba Server setup, you should be able to see the Linux PC on the Windows network. On your Windows PC desktop, open the Network Places icon and see if the Linux PC is listed anywhere in the workgroup. (Network Places is usually on the desktop. If not, open the Control Panel and go into Network and Internet Connections, and you'll find it somewhere on the left). The Linux PC should now be listed. Click on the Linux PC to open it.

At this point you should get a Login box asking for your Linux logon user ID and password. Inside the Linux PC, you should see the shared directory. If you don't see all this, you may need to dig a bit deeper to find out what is happening. Refer to the tips at the end of this article if things get complicated at this point. But let's assume that all went as planned.

Test 2: Can You Read Me?
On the Linux machine, write a small test file into the Linux shared directory. Then go back to the Windows PC and see if the new file is listed in the directory share.

Test 3: Can You Write Me?
Try to copy a small file from a Windows directory into the Linux directory share. Go to the Linux PC and see if the test file arrived.

Success is Sweet
If you can write and read files, your file-sharing server is alive and well and properly installed on the network. Congratulations and add another notch to your Linux belt. Next you need to add the rest of your Windows clients — one by one:

* Create user accounts on Windows and Linux as needed. Remember that you need identical IDs and passwords on each side. Use the YaST Control Center utility called Edit and Create Users.
* Create shared directories for each user.
* Move the files you want to share onto the server.

Once you have mastered these steps, make sure you learn as much as you can about strengthening network security. Samba and SuSE Linux can provide higher-security methods that you should probably adopt, but that goes well beyond that scope of this article.

Troubleshooting Tips
If you have trouble accessing the Linux PC over the network, these tips may help:

* Try manually setting the Read, Write and File Sharing permissions on your shared Linux directories.
* The /usr/share/doc directory has huge stacks of documentation. Make a point of reading /usr/share/doc/packages/samba/examples/smb.conf.SuSE. This file helps explain the Samba Server.

References:
Samba help is available at O'Reilly Books and at the official Samba organization. Red Hat 9.0 Linux users can refer to the following books: Red Hat Linux Networking and System Administration by T. Collings and K. Wall and Red Hat Linux 9 Unleashed by B. Ball and H. Duff — both available at Amazon.com.

LINUX: Lindows invites comparisons

Lindows invites comparisons | CNET News.com

By David Becker
Staff Writer, CNET News.com

Linux seller Lindows announced it is offering a package with two other versions of the open-source operating system, to help customers compare competing Linux distributions. The Desktop Linux Comparison Kit will include Lindows' Linspire version of Linux, Red Hat's Fedora and Mandrake's self-titled distribution. Both competing versions are available from their publishers as a free downloads.

The Comparison Kit is available now, priced at $30 for the download version or $40 for a physical version on eight CDs. Lindows has emerged as one of the leading forces attempting to popularize Linux, already established on servers, for desktop PCs.

M$: FTC Probes Microsoft Korea

KoreaTimes : FTC Probes Microsoft Korea


By Seo Jee-yeon
Staff Reporter

The Fair Trade Commission (FTC) Thursday began an investigation of Microsoft Korea to verify allegations that the local subsidiary of the world’s largest software giant broke fair trade rules by packaging its instant messenger service with its Windows XP platform.

The investigation, which will continue till next Wednesday, came nearly two years after Daum Communications Corp., the nation's biggest Internet portal, filed a complaint with the FTC, claiming that Microsoft Korea was breaking fair trade rules by tying the instant messenger to its new operating system Windows XP.

The investigation also follows a European Union ruling to fine Microsoft 497 million euros for violations of the anti-trust laws for bundling music-related software with Window XP.

Korean Internet companies have accused the U.S. software giant of providing a range of applications, such as messenger software, music players and digital photo processing, with the Window XP operating system.

They claimed Windows XP could pose a threat to fair competition in the market as well as consumer choice and privacy.

M$: Microsoft Research Opens Its Doors

Microsoft Research Opens Its Doors

June 10, 2004
By Matt Hicks

MOUNTAIN VIEW, Calif.—Finding the shortest distance between two points sounds easy enough, but computing that route takes too long and consumes too much computer memory.

Researchers at Microsoft Corp. are tackling the problem so that, in the next few years, computers can map the fastest route as well as make fast adjustments for road work or traffic jams, said Michael Schroeder, assistant director of Microsoft Research's Silicon Valley lab here.

ADVERTISEMENT

It comes down to developing a better mapping algorithm, one efficient enough to do massive computations in the palm of someone's hand.

"It may be possible to put in a PDA and use for real-time reports of road outages," Schroeder said.

Microsoft Research's quest to find the shortest path was one of 10 projects on display here on Wednesday during an open house of one of its five research labs. Among the other projects demonstrated were ones focused on ridding Web search of spam, automatically creating summaries of news stories and blocking Internet worms.

While research projects are developed outside of Microsoft's product development, the end results ultimately can make their way into features for everyday users, said Dan Ling, corporate vice president of Microsoft Research.

"It's important for us to take some of research we work on and have it benefit the 100s of millions of Microsoft customers around world," Ling said. "At this point, every single Microsoft product has been touched by Microsoft Research."

Ling and other researchers were careful to point out that nothing on display was specifically slated for a product, but the possible connections between some of the projects and Microsoft's product plans were apparent.

PointerClick here to read about some Microsoft Research initiatives that could impact Windows Longhorn.

Take for example a project aimed at battling the rise of Web page spam, where sites use methods such as machine generation of pages and links to mislead search engines. It could directly impact popular Web search engines, such as Microsoft's MSN Search, said researcher Marc Najork said.

"Any search engine could and should apply this," Najork said.

eWEEK.com Special Report: Internet FuturesMicrosoft has said it plans as early as the end of this year to launch its own algorithmic search engine for MSN Search. MSN today is using search results from Yahoo Inc.'s engine.

The Web page spam research is based on two different crawls of the Web conducted almost two years ago, Najork said. Using the results from the crawl of 150 million Web pages conducted over the course of 11 weeks, researchers found that 8.1 percent of the pages were spam and that various statistical techniques could identify about 75 percent of those spam pages.

The statistical techniques look for such anomalies as a high number of host names being associated with the same IP address, a large number of characters or words being used in a host name, and an unusual distribution of links.

The Microsoft Research team plans to present its findings in a paper called "Spam, Damn Spam, and Statistics" during a Paris workshop next week. Next up is analyzing Web page content and words to weed out spamlike patterns, Najork said.

Researchers also are working to use natural language processing to automatically write summaries of news stories and items in a newsbot application. The ability for a computer to generate a summary could be important as more search sites attempt to crawl and sort news sources. MSN, for instance, is planning to launch a new news search service later this year.

To thwart Internet worms, researchers are proposing a line of defense in the network stack that could prevent the spread of worms even before software patches are available or deployed. Called Shield, the project uses network filters to monitor the incoming and outgoing traffic of vulnerable applications in order to stop traffic using an exploit.

LINUX: SCO Defiant Amid Financial Losses

SCO Defiant Amid Financial Losses

PROG: If you never understood C language

This is a Group of section that I have written about the C language I promise you that this is the simplest way you will have to learn the C language.

I have divided it into number of sections each explained to the very basic. So if you find this tutorial easy to learn then mail me at knowledge_forall@hotmail.com and I will send you the next the part this is completely free. One should not charge for knowledge.

I hope you all like it


IN the beginning there were basically three languages that were used to make computer based application (you don’t need to memorize them just knowledge sakes)

B.A.S.I.C --------- Beginner All Purpose Symbolic Instruction Code. (This was used by new ones that were just introduced to the world of computers)

C.O.B.O.L ------- Common Business Oriented language. (This was the Language that was used to make the software that were business oriented)

F.O.T.R.O.N ----- Formula Translator. (Used for scientific formula etc)


You don’t really need to actually learn there languages I am just telling you this so that you have an idea that why C and C++ were there in the first place. Anyway let us continue…..

So all these were different programming languages and when I say different, I mean really really different. There was no way that one could make a desired software, like basic could not make formula. In short it was always that one or the other thing was missing so they combined the languages and make it one language and named it. Well take a guess what they named it……..it was called C.P.L and B.C.P.L. Name it something nice no combine the the programming language and say it COMBINED PROGRAMMING LANGUAGE

C.P.L ----- Combined Programming Language (silly isn’t it) and another one
B.C.P.L ---- Basic Combined Programming Language

So in 1972 Dennise Rietche invented “C” a high language that we now use .(High level language is t that such a language is used not only to make simple programs but also operating systems like WINDOWS and UNIX it is called high level language because it at a higher level then COBOL and Pascal etc which are called base languages).

Fact File  (The original C was made in UNIX the UNIX then was rewritten in the language C {that is how amazing the language is it actually is it’s the mother of its father (WERID!!!!!)

Definition UNIX ---- This is an operating system just like WINDOWS
NOW WHAT DO YOU SAY WE START A LITTLE ABOUT “C“

IN this language that we can build any and all the software you can imagine. Not only softwares but even virus if you really put your head to it I mean really hardcore programming. So read and work dedicatedly (WORK HARD!!!).

Well now I am going to tell you about the properties of the C language, these are not basically used for making programs but they are important, So that we can understand why and how does “C” works and what are the properties that make it such a successful language.

1.Structure And Procedure Oriented
2.Modular And Flexible
3.Portable
4.Functional
5.Memory Management

Let us see the properties in details

1.Structure And Procedure Language

The C language is a structured language, what that means is that it has a definite structure The code can not just be written anywhere in the program window. There is a predefined structure which we have to follow in order to achieve our desired result.
Now let us see an example don’t get scared we have not started making programs as yet and u don’t need to think about wt these commands do. I have explained the command in details later in the book it is just that I want you to see the structure of a program.

Void main()
{

Printf (“hello user”);

}

Have a look at the yellow part above it is called the brackets
Now to explain this let us take an example
“Let the program be a criminal and the brackets be a jail in order to keep the criminal calm and working we need the jail if there is no jail the criminal will not be under control and not as we want them to”
Same is with the programs, if the program is in brackets then it will work as we want it to or else it will not work.

The language is called a procedural language as there is a definite procedure to follow
See the “VOID MAIN” command I can’t just write in just anywhere in the program
It is supposed to be in the beginning and it should be in the beginning, for the program to work properly.

2.Modular And Flexible

Definition Compiler --the one that converts the C language to computer language and the computer language back to the high level language)

Ok let us look at the command

Printf (“hello user”)

Let me speak in a very simple term what is a module, we wrote the command Printf (“hello user”) and this will print hello user on then computer screen. But the point is that how does the computer’s compiler know what printf command means, and how does it know that hello user is to be shown onto the screen. The answer is simple that printf is a command and it tells the computer’s compiler that the statement in the brackets is to be printed. Now the question rises, how does it tell this to the computer’s compiler? The answer is that there is a complete code for every command (commands like printf) in the “C” language. They are per-build and are saved in small modules.

These modules are stored in a HEADER FILE (we will do the header file later in the book)
To understand this think of header file as a box and commands as small cubes that are placed in the big box. We pick them out as we need them.



So all we have to do is write the printf and the computer prints what ever follows it.

If I confused you let us take it once more, well it is obvious that the computer can not understand any thing unless and until the word or command has been completely defined in the system. So there must be some code that tells the computer what to do when the printf command is given.
In this case of printf it tells the computer to print on the screen the text that is written after the command printf.

THE CODE TO FOR THE PRINTF STATEMENT MAY BE 4 PAGES LONG. This code was written by the programmers of C language.

Imagine that we have to write this code every time we are going to print anything. Then the program would be every tiring, long and confusing.

Would it not be stupid to write 4 pages of coding just to tell the computer to print something, and then just one line that we actually have to show? It would be something like this
Void main()
{

Blah Blah… (CODE FOR THE PRINTF STATEMENT)….blahhhhhlh (“hello user”);

}
Had printf statement not been previously defined


Void main()
{

printf(“hello user”);

}
normal use of printf statement


Now let us suppose that the above written BLAH is the code for PRINTF so what the makers of c language have has done is that it has already written the code for printf and saved it in a file and given the file a command name. So all the user has to is refer to the command and the compiler will find the code itself instead of the typing the complete code.

Void main()
{

Printf (“hello user”);

}

There are many such command that we are saved in modules that is why we call it a modular language

Flexible Well the language is very flexible as the user can bend it in any way he or she might like
To make any desired program.





3.Portable

The reason that this language is the most successful is because it can be transferred from one operating system to another. Transfer her means that the programmer makes a C file in windows, puts it in a floppy and then opens it in a UNIX system. That is why it is famous among the users of both UNIX and WINDOWS operating system.

4.Functional

Well you must be thinking what has a programming language to do with a function. The function like most of you might have seen is algebra looks likes this

F(2x + 3y +6)

Now see how similar a C function and normal function is.

F(2x + 3y +6) Printf (“hello user”);
(Algebra function) (C language function)

Let Printf here be = F.
The hello user be = 2x + 3y +6.

Hence due to the use of functions the C language is called functional.

5. Memory Management

This property helps the programmer to allocate and de-allocate memory in the hard drive and tell the programmer which part of the memory is used by the variable (I will just come to the variable part in a moment).


Ok let us start us with the juicy part THE CODING

#include

void main()
{

printf("Hello there");

}

This is how a simple program in C would look like. I know when one look’s at it for the first time it does looks a little confusing. If it does to you to there is nothing to worry about that is where my works starts

The best way to understand is to break it down to small pieces.In order to explain let me tell you every thing from the starting point “ # “ to the end brace “ } “

#  This is an operator (more details on operators later) used in the C language this tells the complier that you have to include the following file. It sort of yells to the compiler “Hey yo compiler include this header file”

Include  This is clear word include tells the compiler to include the file following.

< Anything.h >  Anything that comes in the < > and ends up with a .h is a header file actually the .h extension is a header file. What these files do is that they keep the modules that we discuss earlier in them.

Void Main  These are two keywords void and main( ) . Void is used so that the program does not return a value. well I know what you might be wondering “VALUE WHAT VALUE AND WHY ARE WE RETURNING IT ” for now let us just say that every program returns a value. When we don’t want it to return a value then we use the “void”

Now for the main part well main ( ) is a function in which all the code is to be written

{ }  These are the braces or the brackets these are used as discussed earlier that C is a structural language so every thing has be in a definite structure so when ever we use a function may it be the MAIN function or another function the code is always to be written in these brackets

Important point is there if you want your program to run successfully then check that …

Number of opening brackets { = Number of closing brackets }

Printf ------ This is a function that prints everything that is written in the inverted commas. Its syntax is always same and is

Printf (" Hello there ");

Let us study in detail about the printf command.

Printf  Is the command and is a key word for the compiler.

( )  The brackets are used to specific the part that is to be printed and also the variables. Anything out side the brackets in a prinf statement would not be printed. Moreover would give an error.

“ “  The inverted commas are there because everything that in the brackets is to be printed. But the variables are defined outside the commas. (This is inbuilt so we can not skip it.)

;  (The semicolon) It is the end point or the break point for a particular statement. When ever the command is over we always use a SEMICOLON in order to tell the C compiler that the particular statement is over.





I will love if you can tell me if any part was not clear or anything thing that needs to be re explained. I would prefer criticism over phrase.

Knowledge_forall@hotmail.com

#include< stdio.h >

void main()
{

printf("Hello there");

}

Now if you take this example and write it on a C screen which will look like this



In order to run this program you have to goto the run (in file menu) and click on the run command or press CTRL+F9( the functional key)

You will not see any output rather you won’t even notice anything happen other than a flash, in order to view the output press ALT+F5( the functional key) of the keyboard. When you run this program the output will be shown on a black screen just like the one in DOS.

Now I want you to run this program a few more time.

When you had run the program more than one time you will see that the results of the pervious runs are still there. So in order to clear the screen we use a function called the clrscr() (clear screen)function. I think you already know what a function is, if you don’t then let me help you; a function is set of predefined commands that are saved to do a particular task. If you still don’t get it think this way, in the morning we bathe and brush our teeth and go to toilet etc, but one word for it is morning routine. So if you say I got up and did my morning routine that means you did all these things but you did’nt had to repeat them.

In this case the function is MORNING ROUTINE and the commands were BATHING AND BRUSHING etc.

Similarly in clrscr(). The function is CLRSCR() and commands you don’t need to know.

Clrscr ( )  This is a predefined function that clears the screen so that the new output could be displayed. It is so that the result of the previous run is cleared.


Similarly aren’t you tired of pressing the Alt+F5 every time you have to run the program. If you are then you are going to like the next command.

Getch ( )  Getch  the full form is GET CHARACTER The reason that you don’t see the result without pressing ALT+F5 is because the program is immediately terminated after executing the last command. This is so because the compiler executes all the commands and returns to the C programming window. It works something like this, a guy was asked to run in a race from point A to B and then run back, then the guy won’t stop anywhere, he will touch the point B and run back to A. but if you ask him to get a kiss from the girl at point B then he would stop there for sure. Similarly when we use the command getch( ) the result will be shown on then screen as the compiler will wait to get a character from you and then terminate the program. Unless and until you press any key it will not terminate the program. As soon as you do it will put you back on the program screen.



But these functions or commands do not exist in the < stdio.h > header file these functions exist in the < conio.h > header file and you have to include this header file in the beginning


So a complete running code would be as under





Arithmetic Operations

We all have done these operations in our school time,
Addiction
Subtraction
Multiplication
Division

All these operations can be very easily performed in the c language also

But before we do this………………

LET US TALK ABOUT VARIABLES BABY. Many people have problem understanding them. I will try to be simple.

Most of the time when we make a program we ask the user to input some value that we can manipulate or use .So when the user enters a number or a value it has to be stored somewhere moreover it has to be retrieved when ever required, so how does the C compiler do that ??? Well, this is where variables come in. When we define a variable in a program and run the program then that variable acquire some space in the computers memory that is used later. You can understand this with a very simple example ,have you ever seen a human brain, I seriously hope it was no one you knew. But notice the line or cuts. These are made by memories. When ever something important happens a line is made on you brain, this is the brain way to remember it, similarly when you tell the computer something imp like a value it saves it in a variable (like the line of the brain). The reason why we use variable is simple. In order to save a value on your hard disk you need some space right! The space can be something like 109983rd place on the hard disk. Now it’s very difficult to remember that number so when we use Variable we sort of give a name to that place. So if you name your variable ABC then ABC is actually a name for the 109983rd place.

HOW TO DECLARE ANY VARIABLE

For the declaration of any variable there is a pre-defined format, all variables are to be declared like this only, or-else they are garbage or in other words of no use to the system.

DATATYPE AND VARIABLE-NAME

To understand this let us break it first
Data mean any type of value entered by the user
Type is the type of data that is to be entered like a number, an alphabet or a name etc. It can be anything for that matter (in a moment I will tell you all the data type and what they are used for)

Variable name is the name given to a variable; it can be anything but there are some rules that are predefined to name a variable

PROPERTIES

I.The variable can not be one of the keywords that are used in the c language ( like printf , include etc)
II.The first alphabet should always be a character after then anything goes (w1213 = right) but
1knsd, 1234, $3mm or anything like that does not start with a character and not accepted.
III.There can not be spaces in-between the variable ( ab c = wrong , abc = correct )
IV.There is only one special character that is to be used while naming a variable an underscore “_” ( ab_c , a_bc , a_bc = all correct ) but we can not use an underscore in the beginning ( _abc = wrong )

Along with that the most important point is that the variable declaration should be in the very first line while making a program, if it is not declared there then it will again be a garbage to the system (garbage is nothing or waste) Remember how we did C is a structured language. And if you don’t follow the structure the program won’t run.

#Include

void main()
{

int abc;

printf("Hello there");

}

Above is an example how and where it should be declared just under the first bracket of the main function (explained in detail in a while)

Here is a list of the variable that you might use. Now there is a complete list in the end of the book that you can use as you want but for now remember only these

Int
Float
Char

Let us have a deeper look at it shall we


DATATYPE
FULL NAME
DESCRIPITION

Int
Integer
Basically numbers
Float
Decimal
All the decimal numbers
Char
Character
Just one single character


LET US NOW TAKE EXAMPLE AS TO HOW TO DECLARE A VARIABLE

For example we want the user to input a number and we have to store its value in a VARIABLE .What we will simply do is

(There should be just one space between the data type and the variable name (see image bellow) I have given more just in order to explain the things a little.
DATATYPE VARIABLE-NAME

int abc ( When we want to declare number that we have given the . name “ abc”)
float abc1 ( When we want to declare a decimal number that we
have given the name “ abc1 ” )
char abc2 ( When we want to declare a character that we have
given the name“abc2“ )





And now I am going to show a program that will use an integer like variable and notice how the variable is used. I will explain it in the finest details in a moment.





FINEST details are as follows…

I have already explained most of the lines but there are new ones that need explaining, they are…….

Int abc  This is the declaration of the variable.
Int = the variable is an integer type.
abc = the name of the variable.

Abc = 23  In this case the user is not inputting the value for the variable. This time it is us the programmer assigning the value to abc and the value is 23. So from now on the value of abc = 23 until we change it further.
Printf(“%d”,abc)  ok now this is a important new line. I know you are a little confused and exited that what %d is doing here. It is a key word and it is used to show the value for an integer when we run the program. I know I don’t make sense right now so let us study this part in little detail and I explain to you why even the % is used.

Well I have told you earlier that the printf statement is the command that tells the compiler that what ever is written after the command is to be printed on the screen. So if you think that just by writing “abc” (the variable name ) would print the variable value on the screen then my dear you are wrong it will just print Abc on the screen and we don’t want that, so in order to print the values of a variable we have some special keyword. %d is one of them. There is a list right after the paragraph but for now let us concentrate on this part only. So %d tells the compiler that there is a variable in the position which is taken by it. And the variable comes after the inverted commas after a comma. It works like a ambassador for a country. The ambassador is not the complete country. But it presence presents the presence of the country it represents.

Printf (“ The value is : %d” , abc);


(Ambassador) (Country)


Well still confused!!! no problem don’t worry it is a little difficult let me go with the statement word by word and tell you exactly what is the use of every single word here

Printf  Told you before.

( )  Told you before

“ “  told you before

the value is :  Now why have we written this. This is used because a good programmer always think about the convenience of the end user if you just print a value 23 on the screen the user will be all confused but if you print like The value is : 23
then it looks like a lot simplified and easy to understand.

abc  This is the part where the value of the variable is inserted in to the system I mean is that we have told the compiler that there is a variable be giving %d but the value of the variable is to be given by putting a comma after the inverted commas and then writing the variable name

Printf (“The value is: %d” , abc)

Similarly we can give more variable and use there values as well here is how





Here is list of the type of key words that we have to use now yes there is a list in the end of any and all such you might need


%d
This is when we are using a integer (number)
%f
This is when we are using a decimal number(float)
%c
This is user when we are using a charter (single charter



Here are some examples



This is an example of the float type variable. The output of it will not just be 23.2 but when we say the following term is a decimal or a float in C language then it adds a .000000 point six digit to it by itself and the output on the screen will be like this


I am going to wind up this part right here. If some of you think I am not writing enough, I won't blame you because I am not. Thing is I have a paper to take and I have to prepare for it but it is because of the amazing response of all you people that I had to write more.

Once again I wanna thank all of you who written me mails and I have really appreciated it. Each and every mail was very important to me.

If you like the second part then you must mail me…………… because the response drives me to write more. Even if you have mailed me, you have to mail again for the third part because I have not saved your emails address.

P.S : Some of you rightly pointed I had some spelling mistakes. So this time I have the most beautiful girl called SUNSHINE (who is very intelligent by the way) edit my tutorials from now on along with a very especial friend ANDY. I hope you appreciate her work too because I am terrible at typing rightly. So if you find the English proper it's because of her for sure.


LINUX: Linux: Not for Everyone

Enterprise Linux IT (Linux Enterprise Servers): NewsFactor Network - Open Source - Linux: Not for Everyone

LINUX: Lindows' Michael Robertson Invents "Desktop Linux Comparison Kit"

Lindows' Michael Robertson Invents "Desktop Linux Comparison Kit" (LinuxWorld)

une 10, 2004, http://www.linuxworld.com/story/45180.htm

Summary
For less than 30 bucks, Michael Robertson announced yesterday in his latest "Michael's Minute" over at the Linspire site, you can now do a side-by-side comparison of three Linux desktops. Yup, he's come up with another wheeze, and a new site to go with it: www.linuxshootout.com.


By LinuxWorld News Desk

Michael Robertson yesterday published his latest "Michael's Minute" over at the Linspire site, and as usual it's full of innovation and provocation. Plus it launches a new site, www.linushootout.com.

"When I started Lindows about 2 1/2 years ago," he writes, "many people told me I was crazy."

"First they mentioned how challenging it is to compete with Microsoft," he continues, "and second they mentioned how Linux was too difficult to use for the desktop."

Robertson goes on to explain that his first Linux experience personally was with Mandrake, which he found to be "much more complex than necessary."

"I felt that with some work though, it could become a solid desktop product. Much has changed over the last few years and there's been great competition between a few of the Linux companies. I liken it to playing football with your cousins. Sure you want to win, but whoever wins, it's still a family victory."

This notion has given Robertson an idea. Every Linux fan, he reckons, should be interested in seeing how well the Linux leaders compare, so they can assess how quickly the desktop products are maturing. So with that in mind, he and his company have created so something they're calling Linux Shootout.

Here's how it works, according to Robertson himself:

"For just $29.95 you get digital access to 3 popular Linux products, downloadable from high speed servers. It includes everything you need to install Linspire, Fedora and Mandrake on your desktop or laptop computer. If you want the physical CDs, so they'll be on your bookshelf whenever you need them, you can pay $39.95 and get 8 CDs shipped to you, as well as get digital access to over 4 gigabytes of quality Linux products.

We want to encourage side-by-side comparisons of the latest Linux products, so we've bundled 3 leaders including the latest Linspire into one package for the first time. After you've downloaded or received the CDs, the "shootout" really begins. We've made a checklist of some of the more critical features we think are essential for mainstream desktop usage. Take a look at the chart that we put together. You can use your mouse to reveal our results of how the the products compare. But we encourage you to buy a copy of your own bundle for less than 30 bucks and perform your own assessment."

"No one Linux product will satisfy everyone - choice is a good thing," Robertson adds.

The emphasis on Linspire, he explains, is ease of use - "making Linux quick and easy to install and use. Plus we want to give people the easiest way to install the great software that is released for Linux on a weekly basis."

"Other products," he continues, "may have a different focus. That doesn't mean they aren't great products, just that their focus may be different. Every new Linux computer helps the Linux desktop industry - regardless of what company's product you choose."

No one can deny Robertson's eye and ear for a good new idea. And who can believe, in an age when 63 million domain names have been registered, or one for every 100 people on earth, that no one ever thought before of registering www.linuxshootout.com!?



About the author
LinuxWorld News Desk gathers stories, analysis, and information from around the Linux world and synthesizes them into an easy to digest format for IT/IS managers and other business decision-makers.

LINUX: Sun floats open source Solaris, but is it any of SCO's concern?

NewsForge | Commentary: Sun floats open source Solaris, but is it any of SCO's concern?

Title Commentary: Sun floats open source Solaris, but is it any of SCO's concern?
Date 2004.06.09 20:45
Author editingwhiz
Topic Business
http://business.newsforge.com/article.pl?sid=04/06/10/0046223

Sun Microsystems' Open Source Diva, the talkative and intelligent Danese Cooper, admitted in her Divablog the other day that her company has been "leaking" its plans to open source its Unix System V-based Solaris operating system for years. But not many people have been paying much attention. Until now.

(Aside to Danese: You want attention? I'll give you attention: Open up Java, then you'll get people to sit up and take notice. But Solaris ... come on. What impact can that have on the open source -- or the entire IT community, for that matter? Do the math: How many Java developers are there (estimated 4 million), compared to Solaris-Unix developers? Resting my case.)

Biggest Solaris story in years

Anyway, new President/CEO Jonathan Schwartz last week woke up some people -- including folks at his own company -- in his press conference from Shanghai when he announced that "we will be open sourcing Solaris" at some point, without divulging any details about how or when this would happen. He didn't say whether Sun is considering releasing all of its Solaris code, whether it would release parts of it, or whether it would release components developed in-house by Sun itself. In any case, it was the biggest news story involving Solaris in years.

Now some people are taking notice -- most notably The SCO Group, whose corporate ears stood up (imagine a Doberman Pinscher).

SCO Group on Wednesday basically warned Sun not to consider it, telling Computerworld's Rodney Gedda that "while the details of Sun's plan to open-source Solaris are not clear at this time, Sun has broader rights than any other Unix licensee. However, they still have license restrictions that would prevent them from contributing our licensed works wholesale to the GPL," SCO marketing manager Marc Modersitzki said.

Aha. Does the little Utah company, which considers itself the gatekeeper of all Unix System V code, smell yet another lawsuit? It's already embroiled in huge intellectual property litigation against one of its biggest customers, IBM (a $5 billion claim). It has smaller lawsuits pending against clients DaimlerChrysler and AutoZone and has other litigation in process against Novell and Red Hat.

Modersitzki told NewsForge late Wednesday that "we have done business with Sun for a long time, and we're confident that they will be rigorous in sticking to the terms of its licensing agreement with SCO."

But what if Sun has other ideas about how to sell, and otherwise distribute, the latest generation of the primary code upon which it runs its heavy-duty systems? After all, there is a new regime at Sun, one run by a man (Schwartz) who came up through the software side of the company and is savvy about the value of open source.

SCO history points to another lawsuit

Can we expect SCO Group to plod over to the Salt Lake City federal courthouse and file new papers against Sun in an effort to keep it from letting loose some code that won't make a big impact anyway? If you look at SCO's history, the odds are heavily in favor of that happening, should Sun decide to do what it says it will do.

Litigation is SCO Group's full-time stock in trade. Unix products and services? Pure piffle.

Sun, over the course of years, has paid a huge amount -- $100 million -- to SCO Group for the rights to use Unix System V as it sees fit in its enterprise software. By rights, SCO should let Sun do whatever the heck it wants with its Solaris code, which has been Sun-itized many times over anyway. SCO already has made a huge profit, but it may want even more. You can bet its lawyers are lusting after this one.

In this case, everything else SCO tries to get through the courts is simply due to greed. There's no other word for it.
Links

1. "Sun Microsystems'" - http://www.sun.com/
2. "Divablog" - http://blogs.sun.com/roller/comments/DaneseCooper?anchor=to_leak_or_not_to
3. "The SCO Group" - http://www.thescogroup.com/

PROG: Operating Systems Development

Flashdaddee Forums - Operating Systems Development

SEC: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)


Jelmer
<jkuperus@planet.nl > to bugtraq, full-disclosure, peter
More options Jun 6 (4 days ago)
Just when I though it was save to once more use internet explorer I received
an email bringing my attention to this webpage
http://216.130.188.219/ei2/installer.htm that according to him used an
exploit that affected fully patched internet explorer 6 browsers. Being
rather skeptical I carelessly clicked on the link only to witness how it
automatically installed addware on my pc!!!

Now there had been reports about 0day exploits making rounds for quite some
time like for instance this post

http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

However I hadn't seen any evidence to support this up until now
Thor Larholm as usual added to the confusion by deliberately spreading
disinformation as seen in this post

http://seclists.org/lists/bugtraq/2004/May/0153.html

Attributing it to and I quote "just one of the remaining IE vulnerabilities
that are not yet patched"

I've attempted to write up an analysis that will show that there are at
least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
wrong) out there in the wild, one being fairly sophisticated

You can view it at:

http://62.131.86.111/analysis.htm

Additionally you can view a harmless demonstration of the vulnerabilities at

http://62.131.86.111/security/idiots/repro/installer.htm

Finally I also attached the source files to this message

Attachments: exploit.zip (application/zip) 1K

ReplyReply to allForwardInvite Jelmer to join Gmail


Chris Carlson
<chris@compucounts.com > to Jelmer, full-disclosure, bugtraq
More options Jun 6 (4 days ago)
When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked.

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin. On the downside, I still havn't figured out how to turn it off ;)
- Show quoted text -

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of
> arbitrary code (An analysis of the 180 Solutions Trojan)
>
> Just when I though it was save to once more use internet
> explorer I received an email bringing my attention to this
> webpage http://216.130.188.219/ei2/installer.htm that
> according to him used an exploit that affected fully patched
> internet explorer 6 browsers. Being rather skeptical I
> carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!
>
> Now there had been reports about 0day exploits making rounds
> for quite some time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0
>
> However I hadn't seen any evidence to support this up until
> now Thor Larholm as usual added to the confusion by
> deliberately spreading disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html
>
> Attributing it to and I quote "just one of the remaining IE
> vulnerabilities that are not yet patched"
>
> I've attempted to write up an analysis that will show that
> there are at least 2 new and AFAIK unpublished
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated
>
> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the
> vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Chris to join Gmail


Jelmer
<jkuperus@planet.nl > to Chris, full-disclosure
More options Jun 6 (4 days ago)
I haven't installed SP2 yet since I heard a lot of complaints from people
who claimed it caused instability, it had memory management issues, some
drivers didn't work, security measures a bit too much in your face etc

But I reviewed the list of changes sometime back and I concur, it looks very
promising, I think in the near future an IE exploit will be a rare
occurrence as opposed to a bi weekly event
- Show quoted text -

-----Original Message-----
From: Chris Carlson [mailto:chris@compucounts.com]
Sent: maandag 7 juni 2004 4:06
To: Jelmer
Cc: full-disclosure@lists.netsys.com; bugtraq@securityfocus.com
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked.


Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin. On the
downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of
> arbitrary code (An analysis of the 180 Solutions Trojan)
>
> Just when I though it was save to once more use internet
> explorer I received an email bringing my attention to this
> webpage http://216.130.188.219/ei2/installer.htm that
> according to him used an exploit that affected fully patched
> internet explorer 6 browsers. Being rather skeptical I
> carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!
>
> Now there had been reports about 0day exploits making rounds
> for quite some time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0
>
> However I hadn't seen any evidence to support this up until
> now Thor Larholm as usual added to the confusion by
> deliberately spreading disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html
>
> Attributing it to and I quote "just one of the remaining IE
> vulnerabilities that are not yet patched"
>
> I've attempted to write up an analysis that will show that
> there are at least 2 new and AFAIK unpublished
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated
>
> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the
> vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message
>
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jelmer to join Gmail


Larry Seltzer
<larry@larryseltzer.com > to Jelmer, bugtraq, full-disclosure, peter
More options Jun 6 (4 days ago)
> >Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as "VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749):

"This trojan exploits an unpatched (at the time of this writing) vulnerability in
Internet Explorer. The vulnerability allows for the writing, and overwriting, of local
files by exploiting the ADODB.Stream object. There are several variants of this trojan.
Therefore this description is design to give an overview of how the trojan works.

The trojan exists as VBScript. This script contains instructions to download a remote
executable, save it to a specified location on the local disk, and then execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Larry to join Gmail


Jelmer
<jkuperus@planet.nl > to Larry, bugtraq, full-disclosure, peter
More options Jun 6 (4 days ago)
Most recent exploits are like vehicles, they are assembled piece by piece,
you can make a virus scanner detect the wheels, but a car, a bus and a bike
are most certainly entirely different things! Yet none of them are any good
without wheels, oh and in this case painting the wheel another color would
circumvent detection, it's just that trivial, virus scanners are pretty
useless against these type of attacks

From the psysm description:

"The vulnerability allows for the writing, and overwriting, of local files
by exploiting the ADODB.Stream object"

As I wrote in the analysis, this exploit uses both known and unknown
vulnerabilities. What is detected as psysm (the wheels) is what I described
in this post

http://seclists.org/lists/fulldisclosure/2003/Aug/1703.html

And is used in this exploit as well
However this flaw that has gone unpatched for many many months, only works
when run from a file on the local hard drive!, so essentially it's a useless
find unless you can complement it with one or more other vulnerabilities

Over the past couple of months it's been combined with many an exploit

I used it in combination with one of liu's finds
http://lists.netsys.com/pipermail/full-disclosure/2003-September/009992.html

Andreas sandblad used it:
http://www.forbiddenweb.org/viewtopic.php?t=5242&view=previous

Mindwarper used it:
http://www.securityfocus.com/archive/1/342471

Some unknown person used it in the wild and wrote a worm, http-equiv did a
writeup on it
http://seclists.org/lists/fulldisclosure/2004/Mar/1404.html

many many more people used it

But it are all separate exploits and none of the formentioned ones work
anymore they have been patched and dealt with, well except on thor's pc
naturally ;) but thor deserves only mockery
- Show quoted text -


-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Larry Seltzer
Sent: maandag 7 juni 2004 4:43
To: 'Jelmer'; bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

> >Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as
"VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749):

"This trojan exploits an unpatched (at the time of this writing)
vulnerability in
Internet Explorer. The vulnerability allows for the writing, and
overwriting, of local
files by exploiting the ADODB.Stream object. There are several variants of
this trojan.
Therefore this description is design to give an overview of how the trojan
works.

The trojan exists as VBScript. This script contains instructions to
download a remote
executable, save it to a specified location on the local disk, and then
execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jelmer to join Gmail


Jelmer
<jkuperus@planet.nl > to huber, full-disclosure, peter
More options Jun 7 (3 days ago)
- Show quoted text -
Most recent exploits are like vehicles, they are assembled piece by piece,
you can make a virus scanner detect the wheels, but a car, a bus and a bike
are most certainly entirely different things! Yet none of them are any good
without wheels, oh and in this case painting the wheel another color would
circumvent detection, it's just that trivial, virus scanners are pretty
useless against these type of attacks

>From the psysm description:

"The vulnerability allows for the writing, and overwriting, of local files
by exploiting the ADODB.Stream object"

As I wrote in the analysis, this exploit uses both known and unknown
vulnerabilities. What is detected as psysm (the wheels) is what I described
in this post

http://seclists.org/lists/fulldisclosure/2003/Aug/1703.html

And is used in this exploit as well
However this flaw that has gone unpatched for many many months, only works
when run from a file on the local hard drive!, so essentially it's a useless
find unless you can complement it with one or more other vulnerabilities

Over the past couple of months it's been combined with many an exploit

I used it in combination with one of liu's finds
http://lists.netsys.com/pipermail/full-disclosure/2003-September/009992.html

Andreas sandblad used it:
http://www.forbiddenweb.org/viewtopic.php?t=5242&view=previous

Mindwarper used it:
http://www.securityfocus.com/archive/1/342471

Some unknown person used it in the wild and wrote a worm, http-equiv did a
writeup on it
http://seclists.org/lists/fulldisclosure/2004/Mar/1404.html

many many more people used it

But it are all separate exploits and none of the formentioned ones work
anymore they have been patched and dealt with, well except on thor's pc
naturally ;) but thor deserves only mockery

-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Larry Seltzer
Sent: maandag 7 juni 2004 4:43
To: 'Jelmer'; bugtraq@securityfocus.com
Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
Subject: RE: [Full-Disclosure] Internet explorer 6 execution of arbitrary
code (An analysis of the 180 Solutions Trojan)

> >Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as
"VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749):

"This trojan exploits an unpatched (at the time of this writing)
vulnerability in
Internet Explorer. The vulnerability allows for the writing, and
overwriting, of local
files by exploiting the ADODB.Stream object. There are several variants of
this trojan.
Therefore this description is design to give an overview of how the trojan
works.

The trojan exists as VBScript. This script contains instructions to
download a remote
executable, save it to a specified location on the local disk, and then
execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


--
Sie haben den Sicherheitsboten abonniert.
http://sicherheitsbote.net
- Show quoted text -


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jelmer to join Gmail


Jelmer
<jkuperus@planet.nl > to Gadi, bugtraq, full-disclosure
More options Jun 7 (3 days ago)

> > Just when I though it was save to once more use internet explorer I
received
> > an email bringing my attention to this webpage
> > http://216.130.188.219/ei2/installer.htm that according to him used an
> > exploit that affected fully patched internet explorer 6 browsers. Being
> > rather skeptical I carelessly clicked on the link only to witness how it
> > automatically installed addware on my pc!!!


>So, you just clicked on the link which was reported as unsafe, did you? :)

Yes I did, I am not saying that it was a bright thing to do, but this was on
my home pc I really didn't have much to loose I use it to play games read
email, browse the web do some coding,
Addware I can handle, it's usually pretty easy to remove once you know how
it works

>Those protocol handlers always seem to cause problems and it's not just
>on Windows, Apple has had just as many problems in dealing with these
>for OS X.

Agreed they are a persistent pain in the ass

If it's not a lack of input validation then it is a lack of
>zone restrictions, perhaps the entire concept of higher privileged zones
>of any kind should be abandoned.

>Are these really new vulnerabilities or just variants of old? The
>"Location: URL:" proxy really just looks like the "Location: File:"
>proxy that Liu Die Yu reported

Yes it's a lot like the file proxy
But surely you won't argue protocol proxying itself is vulnerability, it's a
feature, the vulnerability was that Microsoft engineers forgot to take it
into account in *that particular instance*,

Liu die yu found out that you could inject javascript code in the search
pane res file using file:

These folks found out that you can use url:ms-its to do a redirect to a
local file

Surely this is a different thing! , If someone found a bufferoverflow
somewhere and the next year someone found another one in an entirely
different segment of code, you'd argue that it's the same thing??
Well they both used strcopy insecurely blah bla.. c'mon

>and the object caching stuff really just
>looks like a variation of the advisories from GreyMagic back in 2002
>with the showModalDialog caching and javascript: injection. Other than
>those 2,

No its waaaaaaay more sophisticated than the method caching stuff I've
looked at it some more and there seems to be some really wacky stuff going
on. I suspect they had a look at the leaked IE source, I'll probably have to
update the analysis a bit if I can figure it what the hell it is they're
doing

And again each and every one of the method caching vulnerabilities liu and
greymagic found where separate flaws, a separate oversight by Microsoft
engineers

>the only real vulnerability on the page is the Ibiza chm stuff
>which still works on plenty of fully patched machines.

and what would that be??
Ibiza brought only a single new thing to the table and this is nothing like
it for the rest it build on old vulnerabilies, infact it was a variation of
one of my exploits , surely you knew that didn't you?


> > Now there had been reports about 0day exploits making rounds for quite
some
> > time like for instance this post
> >
> > http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

>Why is this a 0-day? Are you trying to start a holy war here? Please
>explain why this is a 0-day if you make such claims.

It uses 2 new vulnerabilities that where

- not reported on any security list (afaik)
- first encountered in the wild

I won't argue semantics here but that's the reason why I chose to slap that
label on it


> > However I hadn't seen any evidence to support this up until now
> > Thor Larholm as usual added to the confusion by deliberately spreading
> > disinformation as seen in this post
> >
> > http://seclists.org/lists/bugtraq/2004/May/0153.html

>Thor? Spreading disinformation?

Yes but only when he isn't blatantly lying
(http://archives.neohapsis.com/archives/fulldisclosure/2004-04/0261.html)

> > Attributing it to and I quote "just one of the remaining IE
vulnerabilities
> > that are not yet patched"

>That sounds about right.

Like I said these are 2 new issues, at best they are the same class of
vulnerabilities we have seen previously but they are not variations!


> > I've attempted to write up an analysis that will show that there are at
> > least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> > wrong) out there in the wild, one being fairly sophisticated

>I, personally, appreciate any serious research work, but why put down a
>colleague while you're at it?

> > You can view it at:
> >
> > http://62.131.86.111/analysis.htm
> >
> > Additionally you can view a harmless demonstration of the vulnerabilities
at
> >
> > http://62.131.86.111/security/idiots/repro/installer.htm
> >
> > Finally I also attached the source files to this message

>If this really was a 0-day, isn't that a tad irresponsible?

So we are back to the full disclosure, limited disclosure, no disclosure
etc.. debate again, how trite

>As to Thor...

>You are claiming that he is deliberately spreading disinformation, but
>then you proceed to verify his claims.

Verify?? These issue's weren't reported before they are new, thor is full
of crap and my post proofed it, it's unfortunate that you fail to comprehend
this perhaps you lack the expertise in this particular niche of security
research to tell the difference

>Are you sure you don't just have a personal vendetta against him?

No it's nothing personal it's just my general way of treating dishonest
individuals, there I many many reasons why I dislike pivx, but I don't think
this is the appropriate forum to vent them

>I don't see what's wrong with him pitching his product (Quik-Fix (?))
>when reporting his research. That's how the industry work.

>You do research and advertise the company that did it, and what solution
>it offers.
>Working for free doesn't put food on the table and he has a product that
>might actually protects against such issues. What's next, you will
>complain about AV companies who say they detect a virus or security
>researchers that get paid to work instead of living off the street
>credit from the security mailing lists? Maybe you just don't like
>companies of any kind.

Ok what you have to understand is that Qwik fix is a collection of 5
registry patches nothing more, nothing less.. (run regmon, filemon while
running it and verify this) I can accomplish the same task by clicking on a
.reg file

They slapped a nice frontend on it some corporate branding, made it
available for free, pivx has some exposure, the user has a saver pc,
everybody wins, and that's all ok with me so far

But ask yourself how seriously can you take a company that names 5 registry
patches their flagship product??

Now they are trying to cash in on it by providing a pro version of the
product. They wrote a freaking 16 page whitepaper explaining the business
benefits of 5 registry patches!!!

http://www.net-security.org/dl/articles/Qwik-Fix_Pro_WhitePaper.pdf

I had this argument with someone before who asked me the same thing, he
asked me why do you dislike pivx so much,

doesn't their product work?
Well I had to admit that it did

Well isn't it worth the money then?
Well again I had to say, this can save your company a lot of $$

So you dislike them so much?

I finally got thru to him with the following analogy

What if someone offered to sell you a bottle of water for $400 would you buy
it?
Well hell no he replied.
To which I replied doesn't it relief your thirst then?
Doesn't it come with all sorts of minerals and stuff and keeps you alive?

It are just 5 registry patches, they are charging money for 5 registry
patches!!!, Much like selling water at $400 the bottle it is not illegal,
but anyone would agree that such a person would be a conman, and conmen pivx
are!

Their product is closed source so it makes it difficult to know what it
does, they make the progress bar move really really slow when applying these
fixes so it looks as if there is some heavy wizardry going on etc etc..

I dislike conmen they rub off badly to the rest of the people who have real
products to sell and put a lot of work in them (for clarity I am not a
competitor to me it's all fun and games) but surely you can sympathize with
this?

>As to the research itself...
>
>Thor went through the hnc3k.com website and listed all the pages and
>vulnerabilities on it, which sounds like an exhaustive task to me.

Sure he put in a lot of work, but came up empty!
*ALL* of the stuff he listed where old exploits long rendered useless by
Microsoft patched, yet he managed to reach some miraculous conclusion

The evidence did not match the conclusion, I encourage you to click on any
of the links he provided in that post with a fully IE6 on winxp, there's a
20 euro bill with your name on it if you get infected by anything but the
common cold.

>But didn't you do the same and when analyzing the 180 solutions Trojan
>pages? It sounds pretty exhaustive as well.

>The difference is that Thor also told you how to protect against this,
>by locking down the My Computer zone. I can't see anywhere that Thor was
>referring to the object caching vulnerability you are listing as new. In
>my mind, he was referring to the old Unpatched page that he used to
>maintain and that would mean he said some of those are still not patched.

>I miss that page. It was very good.

Yes interesting that that more or les coincided with the Microsoft logo
popping up on their client list http://www.pivx.com/clients.html
Oh and liu maintains a similar list now, you might want to check it out
though it's updated as frequently as I'd like, maybe I'll start my own who
knows

>We know that Ibiza still works

Talk is cheap and words are plenty where's the proof of that?? , this is
entirely different, the only thing they share is my adodb.stream code so you
can't be referring to my post as proof that "Ibiza" still works

So can you show me the code for an Ibiza variation that still works?

>and that there are still problems with
>the SSL certificate handling in IE, don't you think he was just
>referring to those? From this side it really just looks as if you are
>trying to deal a low blow against Mr. Larholm because you have some
>personal grudge against him.
>I hope I provided you with information to re-think your claims. Also,
>please try and keep your grudges to yourself where 50K plus busy people
>need to sift through vital information?

I probably saved you and these 50K others work by doing this write-up, for
free I may add. And I'll bloody well write whatever I like in it, if you
come half way and realize the signal to noise ratio is too high for you,
stop reading! I am not forcing you to read it.

I am not adding these remarks to be nasty or offend mr Larholm personally, I
do think a lot of the stunts they pull are unethical and I'll do everything
in my power to expose them
- Show quoted text -


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jelmer to join Gmail


Gadi Evron
<ge@linuxbox.org > to Jelmer, bugtraq, full-disclosure, peter
More options Jun 7 (3 days ago)
Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just
on Windows, Apple has had just as many problems in dealing with these
for OS X. If it's not a lack of input validation then it is a lack of
zone restrictions, perhaps the entire concept of higher privileged zones
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The
"Location: URL:" proxy really just looks like the "Location: File:"
proxy that Liu Die Yu reported and the object caching stuff really just
looks like a variation of the advisories from GreyMagic back in 2002
with the showModalDialog caching and javascript: injection. Other than
those 2, the only real vulnerability on the page is the Ibiza chm stuff
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

Why is this a 0-day? Are you trying to start a holy war here? Please
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I've attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated

I, personally, appreciate any serious research work, but why put down a
colleague while you're at it?

> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?))
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution
it offers.
Working for free doesn't put food on the table and he has a product that
might actually protects against such issues. What's next, you will
complain about AV companies who say they detect a virus or security
researchers that get paid to work instead of living off the street
credit from the security mailing lists? Maybe you just don't like
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and
vulnerabilities on it, which sounds like an exhaustive task to me. But
didn't you do the same and when analyzing the 180 solutions Trojan
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this,
by locking down the My Computer zone. I can't see anywhere that Thor was
referring to the object caching vulnerability you are listing as new. In
my mind, he was referring to the old Unpatched page that he used to
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with
the SSL certificate handling in IE, don't you think he was just
referring to those? From this side it really just looks as if you are
trying to deal a low blow against Mr. Larholm because you have some
personal grudge against him.

I hope I provided you with information to re-think your claims. Also,
please try and keep your grudges to yourself where 50K plus busy people
need to sift through vital information?

Gadi Evron.

--
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


http-equiv@excite.com
<1@malware.com > to bugtraq, ge, full-disclosure, jkuperus
More options Jun 7 (3 days ago)


<!--

I hope I provided you with information to re-think your claims.

-- >

Is that so?

You and your friend provide nothing. Never have. Never will.
You and he ought remain in the peanut gallery and let doer's do.
Sit back keep your mouth shut and learn from people who do.

Or create yet another mailing list and 'hope' that you can be
seen as a doer.

What you see is a 100% zero day. I'll personally guarantee
that ! And you'll never know it. Even
if it was explained to you in crystal detail like Jelmer just
did.

You should be on your knees thanking Jelmer for explaining it,
no one else can and no one else has. Because its not so easy.

--
http://www.malware.com

snivelling little shit
- Show quoted text -


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite http-equiv@excite.com to join Gmail


Larry Seltzer
<larry@larryseltzer.com > to huber, full-disclosure, peter
More options Jun 7 (3 days ago)
- Show quoted text -
> >Finally I also attached the source files to this message

My McAfee-based gateway scanner blocks the attachment and labels it as "VBS/Psyme",
which has this description
(http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100749):

"This trojan exploits an unpatched (at the time of this writing) vulnerability in
Internet Explorer. The vulnerability allows for the writing, and overwriting, of local
files by exploiting the ADODB.Stream object. There are several variants of this trojan.
Therefore this description is design to give an overview of how the trojan works.

The trojan exists as VBScript. This script contains instructions to download a remote
executable, save it to a specified location on the local disk, and then execute it."

Larry Seltzer
eWEEK.com Security Center Editor
http://security.eweek.com/
http://blog.ziffdavis.com/seltzer
larryseltzer@ziffdavis.com

--
Sie haben den Sicherheitsboten abonniert.
http://sicherheitsbote.net

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Larry to join Gmail


Gadi Evron
<ge@linuxbox.org > to dcoletta12, bugtraq, full-disclosure ...
More options Jun 7 (3 days ago)
- Show quoted text -
Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just
on Windows, Apple has had just as many problems in dealing with these
for OS X. If it's not a lack of input validation then it is a lack of
zone restrictions, perhaps the entire concept of higher privileged zones
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The
"Location: URL:" proxy really just looks like the "Location: File:"
proxy that Liu Die Yu reported and the object caching stuff really just
looks like a variation of the advisories from GreyMagic back in 2002
with the showModalDialog caching and javascript: injection. Other than
those 2, the only real vulnerability on the page is the Ibiza chm stuff
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

Why is this a 0-day? Are you trying to start a holy war here? Please
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I've attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated

I, personally, appreciate any serious research work, but why put down a
colleague while you're at it?

> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?))
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution
it offers.
Working for free doesn't put food on the table and he has a product that
might actually protects against such issues. What's next, you will
complain about AV companies who say they detect a virus or security
researchers that get paid to work instead of living off the street
credit from the security mailing lists? Maybe you just don't like
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and
vulnerabilities on it, which sounds like an exhaustive task to me. But
didn't you do the same and when analyzing the 180 solutions Trojan
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this,
by locking down the My Computer zone. I can't see anywhere that Thor was
referring to the object caching vulnerability you are listing as new. In
my mind, he was referring to the old Unpatched page that he used to
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with
the SSL certificate handling in IE, don't you think he was just
referring to those? From this side it really just looks as if you are
trying to deal a low blow against Mr. Larholm because you have some
personal grudge against him.

I hope I provided you with information to re-think your claims. Also,
please try and keep your grudges to yourself where 50K plus busy people
need to sift through vital information?

Gadi Evron.

--
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


Gadi Evron
<ge@linuxbox.org > to 1, bugtraq, full-disclosure, jkuperus
More options Jun 8 (2 days ago)
And the 0-day is Thor Larholm's post being put down?

I said in my post that if this is a 0-day, please explain further.

I'd love it explained to me, if I can read through all the flames and
hate mail.

Gadi Evron.


http-equiv@excite.com wrote:
> <!--
>
> I hope I provided you with information to re-think your claims.
>
> -- >
>
> Is that so?
>
> You and your friend provide nothing. Never have. Never will.
> You and he ought remain in the peanut gallery and let doer's do.
> Sit back keep your mouth shut and learn from people who do.
>
> Or create yet another mailing list and 'hope' that you can be
> seen as a doer.
>
> What you see is a 100% zero day. I'll personally guarantee
> that ! And you'll never know it. Even
> if it was explained to you in crystal detail like Jelmer just
> did.
>
> You should be on your knees thanking Jelmer for explaining it,
> no one else can and no one else has. Because its not so easy.
>
>
>

--
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


Chris Carlson
<chris@compucounts.com > to huber, full-disclosure, bugtraq
More options Jun 8 (2 days ago)
When run remotely:

Line: 1
Char: 1
Error: Access is denied.
Code: 0
URL: http://62.131.86.111/security/idiots/repro/installer.htm

When run locally, software installation is blocked.

Using IE 6.0.2900.2096 SP2, WinXP SP2

I've gotta say that SP2 has some VERY nice protection builtin. On the downside, I still havn't figured out how to turn it off ;)

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Jelmer
> Sent: Sunday, June 06, 2004 21:22
> To: bugtraq@securityfocus.com
> Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: [Full-Disclosure] Internet explorer 6 execution of
> arbitrary code (An analysis of the 180 Solutions Trojan)
>
> Just when I though it was save to once more use internet
> explorer I received an email bringing my attention to this
> webpage http://216.130.188.219/ei2/installer.htm that
> according to him used an exploit that affected fully patched
> internet explorer 6 browsers. Being rather skeptical I
> carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!
>
> Now there had been reports about 0day exploits making rounds
> for quite some time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0
>
> However I hadn't seen any evidence to support this up until
> now Thor Larholm as usual added to the confusion by
> deliberately spreading disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html
>
> Attributing it to and I quote "just one of the remaining IE
> vulnerabilities that are not yet patched"
>
> I've attempted to write up an analysis that will show that
> there are at least 2 new and AFAIK unpublished
> vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated
>
> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the
> vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message
>
>

--
Sie haben den Sicherheitsboten abonniert.
http://sicherheitsbote.net
- Show quoted text -


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Chris to join Gmail


Michael Evanchik
<mike@michaelevanchik.com > to Gadi, Jelmer, bugtraq, full-disclosure, peter
More options Jun 8 (2 days ago)
Although this ms-its exploit has been around ,the true author of finding this is an UNKNOWN author. I remember when it was _reported_ by Thor but he did not take credit. As for it being 0-day. It sure is. None of microsofts's patches stop it nor did Norton AntiVirus Corp. I have no idea who you are Gadi to give such comments like that.

Michael Evanchik

www.MichaelEvanchik.com
- Show quoted text -

----- Original Message -----
From: Gadi Evron
To: Jelmer
Cc: bugtraq@securityfocus.com ; full-disclosure@lists.netsys.com ; peter@diplomatmail.net
Sent: Monday, June 07, 2004 4:47 PM
Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)

Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just
on Windows, Apple has had just as many problems in dealing with these
for OS X. If it's not a lack of input validation then it is a lack of
zone restrictions, perhaps the entire concept of higher privileged zones
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The
"Location: URL:" proxy really just looks like the "Location: File:"
proxy that Liu Die Yu reported and the object caching stuff really just
looks like a variation of the advisories from GreyMagic back in 2002
with the showModalDialog caching and javascript: injection. Other than
those 2, the only real vulnerability on the page is the Ibiza chm stuff
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

Why is this a 0-day? Are you trying to start a holy war here? Please
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I've attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated

I, personally, appreciate any serious research work, but why put down a
colleague while you're at it?

> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?))
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution
it offers.
Working for free doesn't put food on the table and he has a product that
might actually protects against such issues. What's next, you will
complain about AV companies who say they detect a virus or security
researchers that get paid to work instead of living off the street
credit from the security mailing lists? Maybe you just don't like
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and
vulnerabilities on it, which sounds like an exhaustive task to me. But
didn't you do the same and when analyzing the 180 solutions Trojan
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this,
by locking down the My Computer zone. I can't see anywhere that Thor was
referring to the object caching vulnerability you are listing as new. In
my mind, he was referring to the old Unpatched page that he used to
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with
the SSL certificate handling in IE, don't you think he was just
referring to those? From this side it really just looks as if you are
trying to deal a low blow against Mr. Larholm because you have some
personal grudge against him.

I hope I provided you with information to re-think your claims. Also,
please try and keep your grudges to yourself where 50K plus busy people
need to sift through vital information?

Gadi Evron.

--
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


ReplyReply to allForwardInvite Michael to join Gmail


BoneMachine
<bonemach@sdf.lonestar.org > to huber, jkuperus, full-disclosure, peter
More options Jun 8 (2 days ago)
Hi Jelmer,
I've read your analysis of the trojan of 180 solutions and noticed the statement that this issue uses two zero day exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong feeling I've seen the Location header execution before.
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the vulnerabilities uses the following statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at : http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches for these issues had been provided.

Can you proof me wrong?

vriendelijke groet
Bone Machine

---
"hip hip hip" - The Pixies
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite BoneMachine to join Gmail


Jelmer
<jkuperus@planet.nl > to Michael, Gadi, bugtraq, full-disclosure, peter
More options Jun 8 (2 days ago)

This new exploit is unrelated to the ms-its exploit



I could just as easily have done



response.setHeader("Location", "URL:res://shdoclc.dll/HTTP_501.htm");



and there would be no ms-its protocol handler used in it, it’s just a local resource it loads , it could be a htm file a resource file, an ms-its file whatever
- Show quoted text -





-----Original Message-----
From: Michael Evanchik [mailto:Mike@MichaelEvanchik.com]
Sent: dinsdag 8 juni 2004 15:29
To: Gadi Evron; Jelmer
Cc: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com; peter@diplomatmail.net
Subject: Re: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)



Although this ms-its exploit has been around ,the true author of finding this is an UNKNOWN author. I remember when it was _reported_ by Thor but he did not take credit. As for it being 0-day. It sure is. None of microsofts's patches stop it nor did Norton AntiVirus Corp. I have no idea who you are Gadi to give such comments like that.



Michael Evanchik



www.MichaelEvanchik.com

----- Original Message -----

From: Gadi Evron

To: Jelmer

Cc: bugtraq@securityfocus.com ; full-disclosure@lists.netsys.com ; peter@diplomatmail.net

Sent: Monday, June 07, 2004 4:47 PM

Subject: [Full-Disclosure] Re: Internet explorer 6 execution of arbitrary code (An analysis of the 180 Solutions Trojan)



Comments inline.

Jelmer wrote:

> Just when I though it was save to once more use internet explorer I received
> an email bringing my attention to this webpage
> http://216.130.188.219/ei2/installer.htm that according to him used an
> exploit that affected fully patched internet explorer 6 browsers. Being
> rather skeptical I carelessly clicked on the link only to witness how it
> automatically installed addware on my pc!!!

So, you just clicked on the link which was reported as unsafe, did you? :)

Those protocol handlers always seem to cause problems and it's not just
on Windows, Apple has had just as many problems in dealing with these
for OS X. If it's not a lack of input validation then it is a lack of
zone restrictions, perhaps the entire concept of higher privileged zones
of any kind should be abandoned.

Are these really new vulnerabilities or just variants of old? The
"Location: URL:" proxy really just looks like the "Location: File:"
proxy that Liu Die Yu reported and the object caching stuff really just
looks like a variation of the advisories from GreyMagic back in 2002
with the showModalDialog caching and javascript: injection. Other than
those 2, the only real vulnerability on the page is the Ibiza chm stuff
which still works on plenty of fully patched machines.

> Now there had been reports about 0day exploits making rounds for quite some
> time like for instance this post
>
> http://www.securityfocus.com/archive/1/363338/2004-05-11/2004-05-17/0

Why is this a 0-day? Are you trying to start a holy war here? Please
explain why this is a 0-day if you make such claims.

> However I hadn't seen any evidence to support this up until now
> Thor Larholm as usual added to the confusion by deliberately spreading
> disinformation as seen in this post
>
> http://seclists.org/lists/bugtraq/2004/May/0153.html

Thor? Spreading disinformation?

> Attributing it to and I quote "just one of the remaining IE vulnerabilities
> that are not yet patched"

That sounds about right.

> I’ve attempted to write up an analysis that will show that there are at
> least 2 new and AFAIK unpublished vulnerabilities (feel free to proof me
> wrong) out there in the wild, one being fairly sophisticated

I, personally, appreciate any serious research work, but why put down a
colleague while you're at it?

> You can view it at:
>
> http://62.131.86.111/analysis.htm
>
> Additionally you can view a harmless demonstration of the vulnerabilities at
>
> http://62.131.86.111/security/idiots/repro/installer.htm
>
> Finally I also attached the source files to this message

If this really was a 0-day, isn't that a tad irresponsible?

As to Thor...

You are claiming that he is deliberately spreading disinformation, but
then you proceed to verify his claims.

Are you sure you don't just have a personal vendetta against him?
I don't see what's wrong with him pitching his product (Quik-Fix (?))
when reporting his research. That's how the industry work.

You do research and advertise the company that did it, and what solution
it offers.
Working for free doesn't put food on the table and he has a product that
might actually protects against such issues. What's next, you will
complain about AV companies who say they detect a virus or security
researchers that get paid to work instead of living off the street
credit from the security mailing lists? Maybe you just don't like
companies of any kind.

As to the research itself...

Thor went through the hnc3k.com website and listed all the pages and
vulnerabilities on it, which sounds like an exhaustive task to me. But
didn't you do the same and when analyzing the 180 solutions Trojan
pages? It sounds pretty exhaustive as well.

The difference is that Thor also told you how to protect against this,
by locking down the My Computer zone. I can't see anywhere that Thor was
referring to the object caching vulnerability you are listing as new. In
my mind, he was referring to the old Unpatched page that he used to
maintain and that would mean he said some of those are still not patched.

I miss that page. It was very good.

We know that Ibiza still works and that there are still problems with
the SSL certificate handling in IE, don't you think he was just
referring to those? From this side it really just looks as if you are
trying to deal a low blow against Mr. Larholm because you have some
personal grudge against him.

I hope I provided you with information to re-think your claims. Also,
please try and keep your grudges to yourself where 50K plus busy people
need to sift through vital information?

Gadi Evron.

--
Email: ge@linuxbox.org. Work: gadie@cbs.gov.il. Backup: ge@warp.mx.dk.
Phone: +972-50-428610 (Cell).

PGP key for attachments: http://vapid.reprehensible.net/~ge/Gadi_Evron.asc
ID: 0xD9216A06 FP: 5BB0 D3E2 D3C1 19B7 2104 C0D0 A7B3 1CF7 D921 6A06
GPG key for encrypted email:
http://vapid.reprehensible.net/~ge/Gadi_Evron_Emails.asc
ID: 0x06C7D450 FP: 3B88 845A DF1F 4062 E5BA 569A A87E 8DB7 06C7 D450

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


ReplyReply to allForwardInvite Jelmer to join Gmail


Gadi Evron
<ge@linuxbox.org > to Michael, Jelmer, bugtraq, full-disclosure ...
More options Jun 8 (2 days ago)
Michael Evanchik wrote:

> Although this ms-its exploit has been around ,the true author of finding this is an UNKNOWN author. I remember when it was _reported_ by Thor but he did not take credit. As for it being 0-day. It sure is. None of microsofts's patches stop it nor did Norton AntiVirus Corp. I have no idea who you are Gadi to give such comments like that.
>
> Michael Evanchik

I am the guy who gave what information he has, and asked for
clarifications on the 0-day issue.

Where Jelmer and I disagree is on dragging personal issues and flames
into the thread.

Gadi.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


http-equiv@excite.com
<1@malware.com > to jkuperus, bugtraq, full-disclosure, jkuperus
More options Jun 8 (2 days ago)


Who exactly are you?

You come barreling into FD several months ago, long after it was
created. Pissing in your pants to have found a unmoderated new
mailing list. You run around on a spree posting every piece
drivel at every possible opportunity. You then latch onto
bugtraq riding the coat-tails of other peoples message in order
to get yours approved. Now I see you have insinuated yourself
into the Risks Digest 23.41 with perhaps a record 3 messages in
one go.

Somebody spends there time and effort analysing a zero day, you
then have the fucking nerve to complain about that:

<!--
Also, please try and keep your grudges to yourself where 50K
plus busy people need to sift through vital information?
-- >

and then you further demonstrate your cockeyed thought process
by thinking Jelmer has given you a moments thought and has
also 'dragged personal issues and flames into "the thread"'

<!--
Where Jelmer and I disagree is on dragging personal issues and
flames into the thread.
-- >

"the thread" being his analysis of the zero day that you stuck
your fat face into in the first place.

Like I said go start yet 'another' mailing list if you are so
desparate for attention. You can be the moderator, the only
poster, the king of the hill, everything you want to be.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite http-equiv@excite.com to join Gmail


Jelmer
<jkuperus@planet.nl > to BoneMachine, huber, full-disclosure, peter
More options Jun 8 (2 days ago)
> Can you proof me wrong?

I'll give it a shot

Before sp1 you could simply load any local file into an iframe, then they
realized well this is a security risk and they removed that ability in sp1
There have been 5 issues found that circumvented this restriction (that I
know of)

1) Thor took a look at a prerelease SP1 and added his 2 cents

http://seclists.org/lists/bugtraq/2002/Sep/0090.html

One of the few times he was actually helpfull
It turned out that using a serverside redirect you could still access local
resources, This is very much like what you are seeing here
Microsoft then proceeded to correct this

2) Another issue popped up, this time by mindwarper

Load a file that does a redirect to a local resource in an iframe, reload
refresh the contents and presto your in, it renders it

3) the shell protocol allows access to local resources like this <iframe
src="shell:profile/bla.htm" > Eiji James Yoshida found this

http://www.geocities.co.jp/SiliconValley/1667/advisory08e.html

4) Arman Nayyeri found that showHelp let you access local chm files

http://www.security-corporation.com/articles-20040103-003.html

5) what I describe in the analysis, it's exactly the same as 1) with one
distinction it uses an URL: prefix, IE doesn't see an file , ms-its, res etc
protocol so assumes it's ok , and lets it pass

It's nothing like the refresh issue 2) (since there is no refresh)

Nor is it anything that roozbeh describes, nice it uses scripting this is a
serverside redirct

However no it's not strange that you have this feeling of déjà vu, it's a
variation of Thor's find. Microsoft patched it, overlooked this variation,
the author of this Trojan caught it effectively making it a new thing (tm)

Note I got this wrong in the analysis and will probably update it
As for Roozbeh Afrasiabi's posts just ignore them... really just do it
- Show quoted text -


-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of BoneMachine
Sent: dinsdag 8 juni 2004 15:29
To: huber@post.webmailer.de; jkuperus@planet.nl
Cc: full-disclosure@lists.netsys.com; peter@diplomatmail.net
Subject: Re: [sb] RE: [Full-Disclosure] Internet explorer 6 execution of
arbitrary code (An analysis of the 180 Solutions Trojan)

Hi Jelmer,
I've read your analysis of the trojan of 180 solutions and noticed the
statement that this issue uses two zero day exploits.
I'm trying to monitor and register IE vulnerabilities and have a strong
feeling I've seen the Location header execution before.
Just to be sure, are you aware that:
- Liu Die Yu discards the local protocol issue as a refresh issue:
http://www.safecenter.net/UMBRELLAWEBV4/IredirNrefresh/IredirNrefresh-MyPage
.htm
- Roozbeh Afrasiabi created a paper about vulnerabilities in IE. One of the
vulnerabilities uses the following statement in the example code :
target.location="ms-its:\\ntshared.chm::/copyright.htm";
The posting to bugtraq can be found at :
http://archives.neohapsis.com/archives/bugtraq/2004-05/0109.html

To me these issues and your URL: issue seem the same and afaik no patches
for these issues had been provided.

Can you proof me wrong?

vriendelijke groet
Bone Machine

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jelmer to join Gmail


Gadi Evron
<ge@egotistical.reprehensible.net > to 1, jkuperus, bugtraq, full-disclosure
More options Jun 9 (1 day ago)
As this is FD, I feel like answering.

> Who exactly are you?

I'm your brother's cousin's uncle's ex-room mate. (I hope I got the
SpaceBalls quote right).

> You come barreling into FD several months ago, long after it was
> created. Pissing in your pants to have found a unmoderated new
> mailing list. You run around on a spree posting every piece
> drivel at every possible opportunity. You then latch onto
> bugtraq riding the coat-tails of other peoples message in order
> to get yours approved. Now I see you have insinuated yourself
> into the Risks Digest 23.41 with perhaps a record 3 messages in
> one go.

I have had few communications with you in the past, but unlike other
people who can ignore, decline or laugh, you get all "my p?n*s* is
bigger" and act plain rude. What if I told you I have a dog? Can you
bark louder?

Besides, FD is open for any discussion or anything else. Like you can
send your flames, I can send whatever I want. I usually refrain from
doing it unless I see something on-topic which I feel is important, but
hey... Who am I to dare tell you that you act like an asshole baby who
didn't get his milk for lunch?

> Somebody spends there time and effort analysing a zero day, you
> then have the fucking nerve to complain about that:

I appreciate any hard work, and I appreciate Jelmer's work which I
commented on. I also said that most of his post is about his hate
towards Thor Larholm (which he admits to). That is not professional.
I did ask for clarifications on the 0-day.

But hey, you know what? You know best.

> <!--
> Also, please try and keep your grudges to yourself where 50K
> plus busy people need to sift through vital information?
> -- >
>
> and then you further demonstrate your cockeyed thought process
> by thinking Jelmer has given you a moments thought and has
> also 'dragged personal issues and flames into "the thread"'

He said he did.

> <!--
> Where Jelmer and I disagree is on dragging personal issues and
> flames into the thread.
> -- >
>
> "the thread" being his analysis of the zero day that you stuck
> your fat face into in the first place.

Who said I'm fat?

> Like I said go start yet 'another' mailing list if you are so
> desparate for attention. You can be the moderator, the only
> poster, the king of the hill, everything you want to be.

Can I have some chocolate too?

Gadi Evron.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


Benjamin Meade
<ben@lanwest.com.au > to Gadi, Full, 1
More options Jun 9 (1 day ago)
Gadi Evron wrote:

> As this is FD, I feel like answering.
> I'm your brother's cousin's uncle's ex-room mate. (I hope I got the
> SpaceBalls quote right).

Is anybody else feeling a little deja vu? Read: morning_wood before he cleaned
up his act. Lets just hope the Gadi grows up as well.

> Besides, FD is open for any discussion or anything else. Like you can
> send your flames, I can send whatever I want.

Gadi, I refer you to the charter (you did read the charter, right?), under the
section titled Acceptable Content:

"Any information pertaining to vulnerabilities is acceptable, for instance
announcement and discussion thereof, exploit techniques and code, related tools
and papers, and other useful information. Gratuitous advertisement, product
placement, or self-promotion is forbidden. Disagreements, flames, arguments, and
off-topic discussion should be taken off-list wherever possible."

Come back when you have something to say.

--
Benjamin Meade
System Administrator
LanWest Pty Ltd
Ph: +61 (8) 9440 3033
Fax: +61 (8) 9440 3370
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Benjamin to join Gmail


Gadi Evron
<ge@egotistical.reprehensible.net > to ben, Full, 1
More options Jun 9 (1 day ago)
> > Besides, FD is open for any discussion or anything else. Like you can
> > send your flames, I can send whatever I want.
>
>
> Gadi, I refer you to the charter (you did read the charter, right?),
> under the section titled Acceptable Content:
>

Please quote me in full:
Besides, FD is open for any discussion or anything else. Like you can
send your flames, I can send whatever I want. I usually refrain from
doing it unless I see something on-topic which I feel is important [snip]

> "Any information pertaining to vulnerabilities is acceptable, for
> instance announcement and discussion thereof, exploit techniques and
> code, related tools and papers, and other useful information. Gratuitous
> advertisement, product placement, or self-promotion is forbidden.
> Disagreements, flames, arguments, and off-topic discussion should be
> taken off-list wherever possible."
>
> Come back when you have something to say.

Unfortunately, I am one of the people who fight for this charter here,
when I have the strength to start a discussion about it every 6 months
or so. Thing is, the charter is not upheld or enforced. If kiddies can
write how much MS sucks and turn everything else of value which people
try and write here into a "we hate MS thread", I will write my opinions
here when I feel like it, which is exactly what this list is for. No
censorship.

If you have a problem with it, just don't read my posts.

I really enjoy this irony. I am not saying that I am not acting
childishly by replying to flames, but that the flamers would attack "the
other side" for being off-topic is just too much for me.

Gadi Evron.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gadi to join Gmail


Drew Copley
<dcopley@eeye.com > to Gadi, Jelmer, bugtraq, full-disclosure, peter
More options 1:16pm (5 hours ago)


> -----Original Message-----
> From: Gadi Evron [mailto:ge@linuxbox.org]
> Sent: Monday, June 07, 2004 1:47 PM
> To: Jelmer
> Cc: bugtraq@securityfocus.com;
> full-disclosure@lists.netsys.com; peter@diplomatmail.net
> Subject: Re: Internet explorer 6 execution of arbitrary code
> (An analysis of the 180 Solutions Trojan)
>
> Comments inline.
>
> Jelmer wrote:
>
> > Just when I though it was save to once more use internet
> explorer I received
> > an email bringing my attention to this webpage
> > http://216.130.188.219/ei2/installer.htm that according
> to him used an
> > exploit that affected fully patched internet explorer 6
> browsers. Being
> > rather skeptical I carelessly clicked on the link only to
> witness how it
> > automatically installed addware on my pc!!!
>
> So, you just clicked on the link which was reported as
> unsafe, did you? :)
>
> Those protocol handlers always seem to cause problems and
> it's not just
> on Windows, Apple has had just as many problems in dealing with these
> for OS X. If it's not a lack of input validation then it is a lack of
> zone restrictions, perhaps the entire concept of higher
> privileged zones
> of any kind should be abandoned.
>
> Are these really new vulnerabilities or just variants of old? The
> "Location: URL:" proxy really just looks like the "Location: File:"
> proxy that Liu Die Yu reported and the object caching stuff
> really just
> looks like a variation of the advisories from GreyMagic back in 2002
> with the showModalDialog caching and javascript: injection.
> Other than
> those 2, the only real vulnerability on the page is the Ibiza
> chm stuff
> which still works on plenty of fully patched machines.

<snip >

This is an undisclosed vulnerability which was genuinely found
in the wild.

It may utilize some known techniques. It may have some remote
resemblance to previous vulnerabilities, you mention one of
Liu Die Yu's old bugs... but most newly posted vulnerabilities
are somehow derivations of older bugs -- by far and wide. I can
not think of a new class of bug found in quite sometime.

"Nothing is new under the sun". Good, old saying.

You mentioned below something about "starting an Holy War" because
of this debate -- apparently, some researchers disagreed with each
other on whether or not this was new. However, it was new, it
is new, and the issue needs to get patched -- any political or
"religious" dispute aside.

So, recap.

A spyware distributor for a major spyware firm has
somehow gotten a hold of some genuine zero day -- not an easy
task. They have used this and are using this to make a lot of
money from it.

Spyware distributor's get cash for every system they trojanize --
much as "click through" banner systems operate. They can make
a lot of money doing this. They probably are not cognizant of
the fact that this kind of unauthorized access on a mass scale
is an extraordinary crime prosecutable in any country. If they
were, they would just use this to do credit card scams -- much
more payback, just a little bit more illegal.
- Show quoted text -

SEC: [Full-Disclosure] COELACANTH: Phreak Phishing Expedition

From: http-equiv@excite.com <1@malware.com>
Reply-To: 1@malware.com
To: full-disclosure@lists.netsys.com
Date: Thu, 10 Jun 2004 20:35:03 -0000
Subject: [Full-Disclosure] COELACANTH: Phreak Phishing Expedition


Thursday, June 10, 2004

The following was presented by 'bitlance winter' of Japan today:

test

Quite inexplicable from these quarters. Perhaps someone with
server 'knowledge' can examine it.

It carries over the address into the address bar:

[screen shot: http://www.malware.com/gosh.png 72KB]

while redirecting to egold. The key being %2F without that it
fails. The big question is where is the 'redir' and why is it
only applicable [so far] to e-gold. Other sites don't work and e-
gold is running an old Microsoft-IIS/4.0.

Working Example:

http://www.malware.com/golly.html

credit: 'bitlance winter'

End Call

--
http://www.malware.com

VUN: RealPlayer embd3260.dll Error Response Heap Overflow

RealPlayer embd3260.dll Error Response Heap Overflow

Release Date:
June 10, 2004

Date Reported:
May 14, 2004

Severity:
High (Remote Code Execution)

Vendor:
RealNetworks

Systems Affected:
RealOne Player
RealOne Player v2
RealPlayer 10
RealPlayer 8
RealPlayer Enterprise

Description:
eEye Digital Security has discovered a critical vulnerability in
RealPlayer. The vulnerability allows a remote attacker to reliably
overwrite heap memory with arbitrary data and execute arbitrary code in
the context of the user who executed the player or application hosting
the RealMedia plug-in.

This specific flaw exists within the embd3260.dll file used by
RealPlayer. By specially crafting a malformed movie file along with an
HTML file, a direct heap overwrite is triggered, and reliable code
execution is then possible.

Technical Description:
The code in embd3260.dll among other things is responsible for crafting
error messages in RealPlayer. The vulnerability is triggered by
crafting a malformed movie which is then embedded into an HTML page,
causing RealPlayer to generate a error in the form of
"mem://[address]/[movie file name]", resulting in a heap overflow. A
heap block is allocated to contain the error message, but because of a
flaw in how the buffer size is calculated, an overflow will always
happen. The following pseudocode represents the vulnerable condition:

char *errormessage = new char[strlen(moviename)+10];
sprintf(errormessage, "mem://%08X/", address);
strcat(errormessage, moviename);

Protection:
Retina Network Security Scanner has been updated to identify this
vulnerability.

Vendor Status:
RealNetworks has released a patch for this vulnerability. The patch is
available via the "Check for Update" menu item under Tools on the
RealPlayer menu bar.
A link to their advisory can be found here:
http://service.real.com/help/faq/security/040610_player/EN/

Credit:
Discovery: Karl Lynn
Additional Research: Derek Soeder

Related Links:
Retina Network Security Scanner - Free 15 Day Trial
http://www.eeye.com/html/Products/Retina/download.html

Greetings:
HD Moore, Riley Hassell, K2, Bronc Buster, RSnake, Kelly H., and the
entire staff at eEye.

Copyright (c) 1998-2004 eEye Digital Security
Permission is hereby granted for the redistribution of this alert
electronically. It is not to be edited in any way without express
consent of eEye. If you wish to reprint the whole or any part of this
alert in any other medium excluding electronic medium, please email
alert@eEye.com for permission.

Disclaimer
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition. There
are no warranties, implied or express, with regard to this information.
In no event shall the author be liable for any direct or indirect
damages whatsoever arising out of or in connection with the use or
spread of this information. Any use of this information is at the user's
own risk.

Feedback
Please send suggestions, updates, and comments to:

eEye Digital Security
http://www.eEye.com
info@eEye.com

SEC: SecurityFocus Linux Newsletter #187

SecurityFocus Linux Newsletter #187
------------------------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver
total control of your server to a hacker giving them the ability to read,
write and manipulate all data stored in your backend systems! Download
this *FREE* white paper from SPI Dynamics for a complete guide to
protection!

http://www.securityfocus.com/sponsor/SPIDynamics_linux-secnews_040607

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Attacks and Penetration Testing (part 1 of 3)
2. Catching a Virus Writer
3. Multiple Security Roles With Unix/Linux
II. LINUX VULNERABILITY SUMMARY
1. Isoqlog Multiple Buffer Overflow Vulnerabilities
2. Spamguard Multiple Buffer Overflow Vulnerabilities
3. Gatos xatitv Missing Configuration File Privilege Escalation...
4. SquirrelMail Email Header HTML Injection Vulnerability
5. Firebird Remote Pre-Authentication Database Name Buffer Over...
6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
8. Gallery Authentication Bypass Vulnerability
9. Tripwire Email Reporting Format String Vulnerability
10. Unix and Unix-based select() System Call Overflow Vulnerabil...
11. Trend Micro Scanning Engine Report Generation HTML Injection...
12. Michael Krax log2mail Log File Writing Format String Vulnera...
13. Slackware Linux PHP Packages Insecure Linking Configuration ...
III. LINUX FOCUS LIST SUMMARY
1. mrtg/snmp/subinterfaces (Thread)
2. OpenVPN? (Thread)
3. Block martians with source address 127.0.0.1 (Thread)
4. Martians? (Thread)
IV. NEW PRODUCTS FOR LINUX PLATFORMS
1. Immunity CANVAS
2. SecretAgent
3. Cyber-Ark Inter-Business Vault
4. EnCase Forensic Edition
5. KeyGhost SX
6. SafeKit
V. NEW TOOLS FOR LINUX PLATFORMS
1. Devil-Linux v1.2 Beta 1
2. GNU Anubis v3.9.94
3. DNSSEC Walker v3.4
4. Ettercap v0.7.0 pre2
5. Linux Intrusion Detection System (LIDS) v2.6.6
6. Astaro Security Linux (Stable 5.x) v5.007
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Wireless Attacks and Penetration Testing (part 1 of 3)
By Jonathan Hassell

This is the first of a three part series on penetration testing for
wireless networks. This installment will detail common styles of attacks
against wireless networks, introduce WEP key-cracking, and then discuss
some recent developments in wireless security.

http://www.securityfocus.com/infocus/1783

2. Catching a Virus Writer
By Kelly Martin

With the consumer WiFi explosion, launching a virus into the wild has
never been easier and more anonymous than it is today.

http://www.securityfocus.com/columnists/246

3. Multiple Security Roles With Unix/Linux
By Daniel Hanson

There are some areas of security where Linux and Unix have some strong
wins, and simply fit in better than anything else.

http://www.securityfocus.com/columnists/247

II. LINUX VULNERABILITY SUMMARY
-------------------------------
1. Isoqlog Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 10433
Remote: Yes
Date Published: May 29 2004
Relevant URL: http://www.securityfocus.com/bid/10433
Summary:
Isoqlog is prone to multiple buffer overflow vulnerabilities that span various source files and functions. Some of the vulnerabilities are remotely exploitable and may permit execution of arbitrary code in the context of the process. Others are local in nature, but as the software is not typically installed setuid/setgid, should not present any security risk.

2. Spamguard Multiple Buffer Overflow Vulnerabilities
BugTraq ID: 10434
Remote: Yes
Date Published: May 29 2004
Relevant URL: http://www.securityfocus.com/bid/10434
Summary:
Spamguard is prone to multiple buffer overflow vulnerabilities that span various source files and functions. Some of the vulnerabilities are remotely exploitable and may permit execution of arbitrary code in the context of the process. Others are local in nature, but as the software is not typically installed setuid/setgid, should not present any security risk.

3. Gatos xatitv Missing Configuration File Privilege Escalation...
BugTraq ID: 10437
Remote: No
Date Published: May 29 2004
Relevant URL: http://www.securityfocus.com/bid/10437
Summary:
The gatos xatitv utility is prone to a local privilege escalation vulnerability.

This issue may occur when the utility, which is installed setuid root, fails to drop privileges due to a missing configuration file. Unsanitized user-supplied environment variables may then be exploited to escalate privileges.

It is noted that the software ships with a default configuration file, so exploitation would require that the file was removed at some point.

4. SquirrelMail Email Header HTML Injection Vulnerability
BugTraq ID: 10439
Remote: Yes
Date Published: May 31 2004
Relevant URL: http://www.securityfocus.com/bid/10439
Summary:
SquirrelMail is reported to be prone to an email header HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied email header strings.

An attacker can exploit this issue to gain access to an unsuspecting user's cookie based authentication credentials; disclosure of personal email is possible. Other attacks are also possible.

5. Firebird Remote Pre-Authentication Database Name Buffer Over...
BugTraq ID: 10446
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10446
Summary:
Firebird is reported prone to a remote buffer overrun vulnerability. The issue presents itself due to a lack of sufficient boundary checks performed when the database server is handling database names.

A remote attacker may exploit this vulnerability, without requiring valid authentication credentials, to influence execution flow of the affected Firebird database server. Ultimately this may lead to the execution of attacker-supplied code in the context of the affected software.

6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
BugTraq ID: 10447
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10447
Summary:
PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
BugTraq ID: 10448
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10448
Summary:
Kerberos 5 is prone to multiple boundary condition errors that exist in the krb5_aname_to_localname() and helper functions and are due to insufficient bounds checking performed on user-supplied data.

An additional boundary condition issue also exists in the krb5_aname_to_localname() function. The condition is reported to present itself in the explicit mapping functionality of the krb5_aname_to_localname() as an off-by-one.

These conditions may be theoretically exploitable to execute arbitrary code remotely in the context of the affected service.

It is reported that explicit mapping or rules-based
mapping functionality of krb5_aname_to_localname() must be enabled for these vulnerabilities to be present. Additionally it is necessary that the principal name used by the attacker to exploit the issue be listed in the explicit mapping list.

These vulnerabilities are reported to affect all releases of MIT Kerberos 5, up to and including version krb5-1.3.3.

8. Gallery Authentication Bypass Vulnerability
BugTraq ID: 10451
Remote: Yes
Date Published: Jun 02 2004
Relevant URL: http://www.securityfocus.com/bid/10451
Summary:
It has been disclosed that an attacker can bypass Gallery's authentication process, and log in as any user without a password.

An attacker can override configuration variables by passing them in GET, POST or cookie arguments. Gallery simulates the 'register_globals' PHP setting by extracting the values of the various $HTTP_ global variables into the global namespace. Therefore, regardless of the 'register_globals' PHP setting, an attacker can override configuration variables.

An attacker can change configuration variables and cause Gallery to skip the authentication steps.

Versions prior to 1.4.3-pl2 are reported to be vulnerable.

9. Tripwire Email Reporting Format String Vulnerability
BugTraq ID: 10454
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10454
Summary:
Tripwire is affected by an email reporting format string vulnerability. This issue is due to a failure to properly inplement a formatted string function.

This vulnerability will allow for execution of arbitrary code on a system running the affected software. This would occur in the security context of the user invoking the vulnerable application; typically the superuser.

**Update - It is reported that this issue only presents itself when the MAILMETHOD is sendmail.

10. Unix and Unix-based select() System Call Overflow Vulnerabil...
BugTraq ID: 10455
Remote: Unknown
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10455
Summary:
The select() system call may be vulnerable to an overflow condition, possibly allowing attackers to write data past the end of a fixed size buffer.

select() uses arguments of type 'fd_set', which is of a fixed size in many Unix variants. fd_set is used to keep track of open file descriptors.

If a process raises its rlimit for open files past 1024, it is theoretically possible to cause select to change individual bits past the end of the fixed size fds_bits structure. In theory, an attacker may be able to use this vulnerability to cause a denial of service condition, or possibly execute arbitrary code.

It should be noted that rlimits can only be raised by root, and that only processes with rlimits allowing more than 1024 file descriptors would be affected.

This is a theoretical issue, and it has not been confirmed by any vendor. This BID will be updated when further information is released.

11. Trend Micro Scanning Engine Report Generation HTML Injection...
BugTraq ID: 10456
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10456
Summary:
Trend Micro's scanning engine is reportedly affected by an HTML injection vulnerability in its report generation feature. This issue is due to a failure to properly sanitize user-supplied before including it in a HTML report.

It has been speculated that the offending HTML alert reports run from the local zone on the affected computer, although this has not been verified.

This issue may be exploited by a remote attacker to execute arbitrary HTML or script code on an affected computer; potentially resulting in unauthorized access. Other attackers are also possible.

12. Michael Krax log2mail Log File Writing Format String Vulnera...
BugTraq ID: 10460
Remote: No
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10460
Summary:
Michael Krax log2mail is reported prone to a log file writing format string vulnerability. This issue is due to a failure of the application to properly implement a formatted string function.

This vulnerability will ultimately allow for execution of arbitrary code on a system running the affected software. This would occur in the security context of the user invoking the vulnerable application; typically the 'log2mail' user with group 'adm'.

13. Slackware Linux PHP Packages Insecure Linking Configuration ...
BugTraq ID: 10461
Remote: No
Date Published: Jun 02 2004
Relevant URL: http://www.securityfocus.com/bid/10461
Summary:
Slackware Linux PHP Packages are reportedly affected by an insecure linking configuration vulnerability. This issue is due to a configuration error that links PHP to be linked against shared libraries in insecure directories.

This issue can be leveraged by an attacker to execute arbitrary code in the security context of the user running the affected PHP process; typically the user 'nobody'.

III. LINUX FOCUS LIST SUMMARY
-----------------------------
1. mrtg/snmp/subinterfaces (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/365318

2. OpenVPN? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/365209

3. Block martians with source address 127.0.0.1 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/365207

4. Martians? (Thread)
Relevant URL:

http://www.securityfocus.com/archive/91/364805

IV. NEW PRODUCTS FOR LINUX PLATFORMS
------------------------------------
1. Immunity CANVAS
By: Immunity, Inc.
Platforms: Linux, Windows 2000
Relevant URL: http://www.immunitysec.com/CANVAS/
Summary:

Immunity CANVAS is 100% pure Python, and every license includes full access to the entire CANVAS codebase. Python is one of the easiest languages to learn, so even novice programmers can be productive on the CANVAS API, should they so chose.

Immunity CANVAS is both a valuable demonstration tool for enterprise information security teams or system adminstrators, and an advanced development platform for exploit developers, or people learning to become exploit developers.

2. SecretAgent
By: Information Security Corporation (ISC)
Platforms: Linux, MacOS, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.infoseccorp.com/products/secretagent/contents.htm
Summary:

SecretAgent is a file encryption and digital signature utility, supporting cross-platform interoperability over a wide range of platforms: Windows, Linux, Mac OS X, and UNIX systems.

It's the perfect solution for your data security requirements, regardless of the size of your organization.

Using the latest recognized standards in encryption and digital signature technology, SecretAgent ensures the confidentiality, integrity, and authenticity of your data.

3. Cyber-Ark Inter-Business Vault
By: Cyber-Ark
Platforms: Linux, Windows 2000, Windows NT, Windows XP
Relevant URL: http://www.cyber-ark.com/datasecuritysoftware/inter-business_vault.htm
Summary:

Based on Cyber-Ark Software's Vaulting Technology, the Inter-Business Vault, an information security solution that enables organizations to safely overcome traditional network boundaries in order to securely share business information among customers, business partners, and remote branches. It provides a seamless, LAN-like experience over the Internet that includes all the security, performance, accessibility, and ease of administration required to allow organizations to share everyday information worldwide. To learn more about these core attributes of the Inter-Business Vault click on the relevant link below:

4. EnCase Forensic Edition
By: Guidance Software Inc.
Platforms: DOS, FreeBSD, Linux, MacOS, NetBSD, OpenBSD, PalmOS, Solaris, UNIX, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.guidancesoftware.com/products/EnCaseForensic/index.shtm
Summary:

EnCase Forensic Edition Version 4 delivers the most advanced features for computer forensics and investigations. With an intuitive GUI and superior performance, EnCase Version 4 provides investigators with the tools to conduct large-scale and complex investigations with accuracy and efficiency. Guidance Software?s award winning solution yields completely non-invasive computer forensic investigations while allowing examiners to easily manage large volumes of computer evidence and view all relevant files, including "deleted" files, file slack and unallocated space.

The integrated functionality of EnCase allows the examiner to perform all functions of the computer forensic investigation process. EnCase's EnScript, a powerful macro-programming language and API included within EnCase, allows investigators to build customized and reusable forensic scripts.

5. KeyGhost SX
By: KeyGhost Ltd
Platforms: BeOS, DOS, Linux, OS/2, Solaris, SunOS, Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.keyghost.com/SX/
Summary:

KeyGhost SX discreetly captures and records all keystrokes typed, including chat conversations, email, word processor, or even activity within an accounting or specialist system. It is completely undetectable by software scanners and provides you with one of the most powerful stealth surveillance applications offered anywhere.

Because KeyGhost uses STRONG 128-Bit encryption to store the recorded data in it?s own internal memory (not on the hard drive), it is impossible for a network intruder to gain access to any sensitive data stored within the device.

6. SafeKit
By: Evidian Inc.
Platforms: AIX, HP-UX, Linux, Solaris, Windows 2000
Relevant URL: http://www.evidian.com/safekit/index.htm
Summary:

Evidian's SafeKit technology makes it possible to render any application available 24 hours per day. With no extra hardware: just use your existing servers and install this software-only solution.

This provides ultimate scalability. As your needs grow, all you need to do is add more standard servers into the cluster. With the load balancing features of SafeKit, you can distribute applications over multiple servers. If one system fails completely, the others will continue to serve your users.

V. NEW TOOLS FOR LINUX PLATFORMS
--------------------------------
1. Devil-Linux v1.2 Beta 1
By: Heiko Zuerker
Relevant URL: http://www.devil-linux.org/download.htm
Platforms: Linux
Summary:

Devil-Linux is a special Linux distribution which is used for firewalls/routers. The goal of Devil-Linux is to have a small, customizable, and secure Linux system. Configuration is saved on a floppy disk, and it has several optional packages.

2. GNU Anubis v3.9.94
By: Wojciech Polak
Relevant URL: http://www.gnu.org/software/anubis/
Platforms: Linux, POSIX
Summary:

GNU Anubis is an outgoing mail processor. It goes between the MUA (Mail User Agent) and the MTA (Mail Transport Agent), and can perform various sorts of processing and conversion on-the-fly in accordance with the sender's specified rules, based on a highly configurable regular expressions system. It operates as a proxy server, and can edit outgoing mail headers, encrypt or sign mail with the GnuPG, build secure SMTP tunnels using the TLS/SSL encryption even if your mail user agent doesn't support it, or tunnel a connection through a SOCKS proxy server.

3. DNSSEC Walker v3.4
By: Simon Josefsson
Relevant URL: http://josefsson.org/walker/
Platforms: Linux, UNIX
Summary:

DNSSEC Walker is a tool to recover DNS zonefiles using the DNS protocol. The server does not have to support zonetransfer, but the zone must contain DNSSEC "NXT" records.

4. Ettercap v0.7.0 pre2
By: ALoR
Relevant URL: http://ettercap.sourceforge.net/
Platforms: FreeBSD, Linux, MacOS, NetBSD, Windows 2000, Windows NT, Windows XP
Summary:

Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.

5. Linux Intrusion Detection System (LIDS) v2.6.6
By: Xie Hua Gang, xhg@gem.ncic.ac.cn
Relevant URL: http://www.lids.org/download.html
Platforms: Linux
Summary:

The Linux Intrusion Detection System is a patch which enhances the kernel's security. When it is in effect, chosen files access, all system/network administration operations, any capability use, raw device, mem, and I/O access can be made impossible even for root. You can define which program can access which file. It uses and extends the system capabilities bounding set to control the whole system and adds some network and filesystem security features to the kernel to enhance the security. You can finely tune the security protections online, hide sensitive processes, receive security alerts through the network, and more.

6. Astaro Security Linux (Stable 5.x) v5.007
By: astaro
Relevant URL: http://www.astaro.com/
Platforms: Linux, POSIX
Summary:

Astaro Security Linux is a firewall solution. It does stateful packet inspection filtering, content filtering, user authentication, virus scanning, VPN with IPSec and PPTP, and much more. With its Web-based management tool, WebAdmin, and the ability to pull updates via the Internet, it is pretty easy to manage. It is based on a special hardened Linux 2.4 distribution where most daemons are running in change-roots and are protected by kernel capabilities.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to linux-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

VII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver
total control of your server to a hacker giving them the ability to read,
write and manipulate all data stored in your backend systems! Download
this *FREE* white paper from SPI Dynamics for a complete guide to
protection!

http://www.securityfocus.com/sponsor/SPIDynamics_linux-secnews_040607

GROKLAW: More Rebuttals to AdTI's Ken Brown by Interviewees Ilkka Tuomi and Andrew Tanenbaum

GROKLAW: "Thursday, June 10 2004 @ 03:30 AM EDTYet another distinguished scientist, Ilkka Tuomi, has joined the growing crowd now publicly criticizing the research results recently rele"

Thursday, June 10 2004 @ 03:30 AM EDT

Yet another distinguished scientist, Ilkka Tuomi, has joined the growing crowd now publicly criticizing the research results recently released by the Alexis de Tocqueville Institution on the origins of the Linux kernel. The author, Ken Brown's, "research" and methodology have been seriously brought into question. Some of the arguments in the research paper were based on Mr. Tuomi's study of the credits list of the Linux kernel, which makes his rebuttal highly significant. Tuomi says Mr. Brown reached spurious conclusions and apparently greatly misunderstood the study. He says he tried to help Mr. Brown to comprehend the study, but that he had "only limited success". Tuomi is currently Visiting Scientist at the European Commission’s Joint Research Centre, Institute for Prospective Technological Studies, Seville, Spain.

Tuomi takes the time to carefully rebut Brown's conclusions. Linus Torvalds, Richard Stallman, Andrew Tanenbaum, Dennis Ritchie, Eric Raymond, historian Peter H. Salus, and the man hired by AdTI to compare Minix and Linux code, Alexy Toptygin (who found no copied code) have all gone public with reactions or corrective information. Andrew Tanenbaum has responded a second and now a third time.

That makes it unanimous, I believe. I have yet to see even one interviewee who has not complained about being misquoted or misconstrued.

It is in Section 6 of Tuomi's paper on the history of the Linux kernel's credits list that he mentions the AdTI report:

"A recent think–tank report by Alexis de Tocqueville Institution . . . used a draft version of this paper to argue that Linux could be based on intellectual property infringements and inaccurate allocation of developer credits. The report claimed that the history of Linux is too amazing to be true, and that it is improbable that a single individual without much experience in software development could have created a full operating system in just a few months. The report implied that Linux, therefore, could be derived from earlier software code and, in particular, from the Minix operating system. The report also claimed that the analysis of the Credits file shows that Linux developers may have acted against their employers’ intellectual property policies, and that missing entries in the Credits file may indicate that Linux may include copyrighted code that has not been acknowledged. Hence, the authors of the report claimed that the future of open source software and Linux is therefore threatened by the problem of assigning authorship to specific pieces of code, and potential legal costs resulting from this. As the argument to an important extent has been based on the data presented in this paper, a few observations may be useful."

Tuomi proceeds to methodically disprove the AdTI premise.

"First, as Section 2 above pointed out, the amount of code in the first release of what later became known as the Linux operating system was rather modest. It consisted of 88 files, with median size of 37 lines of code. Based on common knowledge about software development, it therefore appears that a single computer enthusiast could well have created the first Linux version in a couple of months. In fact, by reading the original source code, it is quite clear that a single author, still in the early phases of learning to program operating systems, has produced it. From the point of view of copyright law, the first version of Linux kernel therefore cannot be defined as a derivative work. . . .

"Second, the unavailability of Credits file during the early phases of Linux development does not signal unclear authorship. The fact that the first Credits file appears only in 1994, with Linux version 1.0, has a very simple explanation. During the early phases of the development, the amount of source code was small and the developers were aware of each other’s contributions. Explicit recording of 'credits' would have made little sense, as all developers knew where each piece of software came from. . . .

"Third, the Credits files do not record authorship in any legal sense. Formal copyrights and informal moral rights for the different parts of the Linux source code are embedded in the source code. The Credits file only acts as a 'hall of fame' without any direct links between copyrighted work and authorship. The Credits file, therefore, is irrelevant from the point of view of intellectual property rights. . . .

"Fourth, the affiliations given in the Credits files do not necessarily reflect the historical affiliations of the people mentioned in the file. The Tocqueville report, for example, argued that Linux developers may have harmed their employers’ intellectual property rights by releasing software to the Linux community. To make this argument, the report shows that an employer of a person mentioned in the Credits file has adopted an intellectual property policy, according to which only software that cannot be appropriated commercially may be released as open source. This would apparently imply that the Linux developer mentioned in the Credits file might have broken the intellectual property policies of his employer by providing code to the Linux kernel, and that his managers might have acted against the interests of the firm and its owners by allowing this to happen. As the Credits file is an accumulated record of contributors and as the current addresses and affiliations of the developers have changed during the years, the policies of the current employers, however, are quite irrelevant for any discussion on historically created intellectual property. For example, Linus Torvalds remains one of the main contributors to the Linux kernel project and his name will appear in the future versions of the Credits file, independent of the intellectual property policies of his current or future employers. Microsoft, for instance, could not retrospectively create copyright policy infringements simply by hiring all the persons mentioned in the Credits file, even if this would imply that all the developers would change their affiliations to Microsoft in the future versions of the Credits file, and subsequently be required to stop producing open source software."

"The difficulty to accurately allocate credit in software development projects should not, however, be automatically interpreted as evidence of misallocated credit or intellectual property rights infringements, as the Tocqueville report, for example, has done. Software products are often based on incremental innovation where existing technologies and knowledge are recombined to create new functionality. The history of the Internet, for example, shows that authorship, indeed, is often misallocated. This fact, however, could easily be used to argue that the current intellectual property regime — and specifically software related patents — may require reconsideration. In networked and combinatorial systems, intellectual property rights probably are often granted to inventors who only partially deserve the credit. Or, to put it in another way, developers may deserve much more credit than there is intellectual property available today. One way to deal with this issue is to create explicit representations of moral authorship that are only loosely connected with current concepts of intellectual property. The Linux Credits file is an example of such an approach."

If I were Ken Brown, which happily I am not, I'd be too ashamed to show my face in public. Attacking Linus' integrity and character is like clubbing baby seals. It's gratuituously and undeservedly cruel, so all the sympathy goes to the innocent victim of the bludgeoning. People despise you for doing it. Some things just should not be done, even for money. Attacking a man the world loves and admires has to rank up there in the top ten worst PR decisions of the decade. Linus' character is known internationally, as is his work, which is open to public inspection and which has ensured his place in history. People know this man and his remarkable achievement.

If I were advising Microsoft, which happily I am not, I'd tell them to rethink this boomeranging FUD and publicly disassociate the company from this think tank's Linux "research". Not that there seems to be too much thinking going on over there. And if I were AdTI, I'd acknowledge that mistakes were made, serious factual errors, and apologize for them. It's the 21st century and the old FUD ways don't work any more. Too many internet eyeballs.

GROKLAW: SCOSource Sinks Below the Poverty Line

GROKLAW: "Thursday, June 10 2004 @ 04:40 PM EDTWell. I guess you heard. In today's teleconference, SCO reported that they posted a decline in all three of its revenue segments in the quarter-"

Thursday, June 10 2004 @ 04:40 PM EDT

Well. I guess you heard. In today's teleconference, SCO reported that they posted a decline in all three of its revenue segments in the quarter--products, services and licensing. SCO isn't making money bullying Linux. The company posted a net loss of $15 million in its second quarter versus net income of $4,5 million a year ago. Revenue fell to $10.1 million from $21.4 million. That is a 52% drop, Biz Yahoo is saying. As you know, I don't do math. Analyst Dion Cornett does, and even he overestimated SCO. They did worse than he expected:

"'Some of their core customers are being scared off by the lawsuits,' said Dion Cornett, an analyst at Decatur Jones Equity Partners. 'SCO has sued some of its customers, and that is what's scaring people off.'

"As customers go from Unix to Linux, Cornett said, SCO's business is falling off at twice the pace of other software, like Novell's NetWare, a Unix derivative."

Well, yeah. Motley Fool calls SCO a serial litigator.

It's all Novell's fault, in the world according to SCO:

"SCO CEO Darl McBride acknowledged that Novell's claims that it owns Unix copyrights have been a hurdle to signing more SCOsource licensing deals. . . 'The reality now is I believe it is a war of patience,' McBride said in a conference call Thursday."

Oh, and EV1 paid them 7 figures, all right, just like SCO told us: $11,000.00. That's not a typo, says Motley Fool:

"SCOsource is the Linux users' shakedown program. Apparently, no one is paying up. It took in $11,000 last quarter. That's not a typo. President and CEO Darl McBride paid more lip service to 'increasing shareholder value,' but you really have to wonder about the viability of his vision when his firm's most engrossing initiative brings in less money than the guys who mow lawns in my neighborhood. By the way, McBride was paid more than $1 million last year -- most of it in cash -- to preside over this impending disaster."

There doesn't seem to be a lot of money shaking down Linux users after all. Yoo Hoo. Bay Star. Earth calling Mr. Goldfarb. The Washington Post [reg. req.] got him to tell us about the Microsoft connection. According to Goldfarb, it was *not* an ex-MS employee that did the matchmaking between him and SCO, and what a match made in heaven it has turned out to be:

"'I would not have known about the existence of SCO, but for the introduction by Microsoft,' BayStar President Lawrence Goldfarb said in an interview.

"SCO officials say the introduction was made by a former Microsoft employee, but Goldfarb said he was approached by two current, senior Microsoft executives whom he did not name except to say they were not Chairman Bill Gates or chief executive Steven A. Ballmer.

Goldfarb added that Microsoft's involvement stopped at the introduction, and that Microsoft is not an investor in BayStar. "'We're a pure financial animal,' Goldfarb said of the venture capital firm. The terms of the investment deal were attractive, he said, with BayStar purchasing $20 million worth of preferred shares that paid an ongoing dividend. The firm mitigates its risk by shorting the common stock of the company it is investing in. . . . .

"Initially, BayStar also sought a refund of its investment, which could have stripped SCO of much of its cash.

"'We do not like to be in the public forum,' Goldfarb said. 'We were not happy with what we thought was a cavalier attitude [by SCO management] . . . in dealing with investor relations and the press. This is an issue of grave importance.'"

Pure financial animals should do more research, methinks. And if being in the public eye is distasteful, I'd suggest not investing in public companies who are in numerous lawsuits where you could get deposed or called on the witness stand. One puzzling thing in the article is that Goldfarb says he has concerns about the GPL. What do pure financial animals have to do with the GPL? Maybe they have invested in Microsoft. One thing I like about the guy. He won't lie for SCO and back up their stories about ex-employees of Microsoft. Of course, Jonathan Krim might just be a really good reporter. He says, by the way, that legal eagles on both sides use Groklaw as a resource:

"One Web site focused exclusively on the case, known as Groklaw, was started by a paralegal named Pamela Jones and now has roughly 5,000 contributors. Though it is ardently pro-Linux, the site has grown into such an exhaustive archive of software history and law that attorneys on both sides use it as a resource."

Actually, since the interview, we've grown. We have 6300+ members now and millions of hits a week. As SCO sinks, we keep rising. Go figure. Dan Gillmor noticed the Post article and says this about it and Groklaw:

"This may be the best roundup of the SCO case by any mainstream newspaper. Note the tip of the hat to Groklaw, which is clearly the single best repository of information about the case.

"Groklaw is in my book a particularly fine example of grassroots journalism, where people at the edges of the networks are feeding data back into the middle and then back out to the edges. This is a powerful trend. I'm glad to see it used for such excellent purposes in this situation."

Shorting the stock seems to be the chief method of making money on SCO stock, I gather. Somebody in Germany seems to think so, anyway. SCO stock was listed on an obscure board that they say makes it possible to short, short, short your stock gently down the stream. SCO didn't give permission to be listed and has asked to be removed. SCO isn't the only company:

"'By listing the company's common stock on the Berlin Stock Exchange, market manipulators sought to benefit from an arbitrage loophole,' read a Pickups Plus press release, one of dozens issued by U.S. companies that employed nearly identical diction."

U.S. securities regulators are looking into the matter, according to TheStreet. Here's Motley Fool's conclusion:

"Here's the sad truth: SCO is working hard to erase whatever viability it had as a software provider. It is now little more than a shell -- a lawsuit with a fancy name. We saw this coming awhile back when the company's sugar daddy, hedge fund BayStar Capital, muscled the firm away from its languishing enterprise business and demanded it concentrate on the litigation. A legal victory looks highly unlikely, and even if a decision went SCO's way, the probable remedy would not be money for SCO, but a rewrite for Linux, something the open-source community would accomplish in the blink of an eye.

"At 5 bucks a share, with almost nothing available to short, SCO isn't worth much of your investing effort. But it's definitely worth watching, if only as an example of the way a company can be run into the ground, taking investors along."

Groklaw doesn't give financial advice obviously, and if we did, you would be a fool indeed to follow it, because I know very little about finance. I am finding it fascinating though. Melanie Hollands has just done a helpful article on legal and illegal insider trading.

So. $11,000. That is the entire SCOSource income this quarter. SCOSource cost $4.4 million. There seems to be an imbalance in SCOUniverse. Oh, there is another way to make money from SCO. Be David Boies:

"SCOsource revenue was $11,000 for the quarter, compared to $8.25 million in Q2 2003. SCO has collected $31,000 in SCOsource revenue since last October.

"SCOsource expenses, meanwhile, reached $4.4 million. The bulk of that money is going to the high-profile legal team fronted by David Boies, who tried and won the antitrust case against Microsoft. McBride said those expenses will remain consistent as the court case, expected to reach trial in April, plays out. This week, SCO asked for a delay in the trial until September 2005.

"McBride said SCO has been diligent in providing the courts with samples of the code it believes IBM has contributed to Linux. He said IBM has not been as forthcoming.

"'IBM is trying to slow the case down,' McBride said. 'It took IBM nine months to produce AIX code for us. We have been diligently going through that code and will respond to the court. The pieces are on the table. It's in the court's hands.'"

Maybe God's too. I don't think God likes liars. *IBM* is trying to slow the case down? Is there even one person left on planet earth who doesn't know that is not true? They just went to a lot of expense and trouble to ask the court NOT to slow the case down, which SCO is asking the court to do.

OK. One person. And he was paid a million bucks last year.

LINUX: Evolution of the Linux Credits file

First Monday

Evolution of the Linux Credits file: Methodological challenges and reference data for Open Source research

Abstract
Evolution of the Linux Credits file: Methodological challenges and reference data for Open Source research by Ilkka Tuomi

This paper presents time–series data that can be extracted from the Linux Credits files and discusses methodological challenges of automatic extraction of research data from open source files. The extracted data is used to describe the geographical expansion of the core Linux developer community. The paper also comments on attempts to use the Linux Credits data to derive policy recommendations for open source software.
Contents

1. Introduction
2. The structure of Linux credits file
3. Problems in automatic analysis
4. Analysis method
5. Results
6. Credits and authorship
7. Discussion
8. Future research





++++++++++
1. Introduction

The Linux Credits file has been included with all Linux operating system distributions since March 1994. It contains information on contributors to the Linux operating system kernel development. By analyzing the evolution of the Credits file, it is possible to study the evolution of the Linux developer community. For example, by using the address information contained in the Credits file, it is possible to describe the geographical expansion of the core Linux developer community. By combining this information with other data sources one can study the different factors that have influenced the expansion of the Linux developer network.

The open source development model operates over the Internet. Huge amounts of historical data are available on the Internet that can be used to study the open source phenomenon. In theory, the different versions of open source files record the evolution of open source projects in great detail. It is therefore an intriguing possibility to automatically generate data from files included in open source program distributions.

Several research projects have tried to analyze the open source phenomenon using automated analysis of source code and other data that are generated during the development process. Some authors have focused on a single open source project, using the source code snapshots, change logs, data from version control systems, problem tracking databases, and e–mail lists (e.g., Koch and Schneider, 2000; Tuomi, 2002; Mockus, Fielding, and Herbsleb, 2002; Robles–Martínez, Gonzáles–Barahona, et al., 2003; Robles, Koch, and Gonzáles–Barahona, 2004). Other research projects have adopted a horizontal approach, studying multiple open source projects, for example, by analyzing data available at open source Web portals, such as sourceforge.net and freshmeat.net (Krishnamurthy, 2002; Healy and Schussman, 2003; Capiluppi, Lago, and Morisio, 2003), or by retrieving e–mail addresses and copyright notices from large source code collections spanning thousands of open source projects (Ghosh, Robles, and Glott, 2002).

In practice, automated analysis is complicated by a number of factors. This paper discusses the challenges of analyzing the Linux Credits file, shows how these challenges can be addressed, and provides data that can be used to validate studies on Linux kernel development. The Linux Credits file contains information about project contributors who have made the Linux operating system what it is today. The analysis of Linux Credits, therefore, provides important information on the open source development model and its dynamics. A focused study of this strictly limited case example highlights the problems that need to be addressed by research projects that extract research data from open source files. The presented results and methodological issues will therefore be of general interest also to other studies that attempt to use automated tools to discover data from source code files.

This paper is organized as follows. The next section describes the basic characteristics of the Linux Credits file. Section 3 discusses the problems that automated source code scanning programs have to address to extract useful data from the Linux Credits files. Section 4 describes a methodology that can be used to associate persons in Linux Credits to countries. Section 5 describes the characteristics of time–series data that has been created using the methodology. Section 6 comments on a report by Alexis de Tocqueville Institution (Brown and Orndorff, 2004) that used an earlier draft version of this paper to derive policy recommendations for open source software. Section 7 discusses the results and compares them with some previously presented claims concerning the open source development model. Section 8 points out some future research opportunities that could be addressed using the described data.



++++++++++
2. The structure of Linux credits file

The first version of the Linux operating system was released on the Internet in September 1991. It consisted of 88 files, totaling 231 kilobytes of code. At the time, it would have been difficult to predict that Linux would ten years later be considered as a major threat to Microsoft’s dominance in operating systems. The amount of code in the first Linux release was rather modest. The smallest file consisted of a single line and the longest file was 678 lines, or 612 lines without comments. The median size file included in the first Linux package was 37 lines without comments. The program was written in the C programming language, which the creator of Linux, Linus Torvalds, had started to study in 1990.

The Linux kernel distribution consists of files that are needed to compile the Linux operating system. As the system has become increasingly complex, a number of documentation files have been added to the distribution package. The full operational GNU/Linux distribution includes a large number of programs in addition to the operating system kernel, and firms such as SuSE and RedHat have built businesses that package, document and support complete Linux based environments. The Linux kernel is the core of these distributions. The Linux kernel packages are also freely available through Internet sites that store all the existing historical versions of the Linux operating system code.

The kernel packages have included a Credits file in their Linux subdirectory since 13 March 1994. This file acknowledges important contributions to the kernel development. During the evolution of Linux, new contributors have been continuously added to the file. In July 2002, the Credits file contained information on 418 developers. With two exceptions, all were male [1].

The Credits file is a simple text file where the included persons can document information about their main areas of contribution, their e–mail and physical addresses, and other relevant data. A typical example of an entry in the Credits file is shown below in Table 1.



Table 1: A typical entry in the Linux Credits file.
N: Linus Torvalds
E: Linus.Torvalds@Helsinki.FI
D: General kernel hacker
S: Kalevankatu 55 B 37
S: 00180 Helsinki
S: Finland



In the first Credits files the possible entry fields had line descriptors for name (N), e–mail (E), description (D) and snail–mail address (S). In the more recent files, fields for Web address (W) and PGP key ID and fingerprint (P) have been added. The people included in the Credits file provide this information themselves. Although in principle it is possible for anyone to add herself to the Credits file, the persons who manage the kernel releases only accept entries from persons who are perceived as real contributors for the project [2].



++++++++++
3. Problems in automatic analysis

Given the semi–structured nature of the Linux Credits file, it is possible to extract data on kernel developers using automated software tools. A typical way of doing this is to use the Perl text processing language to write a program that scans through the Credits file and creates a database of Linux kernel developers. The snail–mail address fields, for example, can then be used to associate individual developers with geographical locations.

In practice, automated analysis is difficult. To see why, it is useful to present some example entries from the Credits file. These are discussed below.



Table 2: An entry without country data.
N: Lars Wirzenius
E: liw@iki.fi
D: Linux System Administrator’s Guide, author, former maintainer
D: comp.os.linux.announce, former moderator
D: Linux Documentation Project, co–founder
D: Original sprintf in kernel
D: Original kernel README (for version 0.97)
D: Linux News (electronic magazine, now dead), founder and former editor
D: Meta–FAQ, originator, former maintainer
D: INFO–SHEET, former maintainer
D: Author of the longest–living linux bug



Many entries in the Credits file do not include the snail–mail fields that contain the physical address. A trivial text scanning program could be written if all the entries in the Credits file would have the same structure and if all entries would contain full address information. Such a program would locate an entry by looking a line that starts with the N: –descriptor and keep scanning the lines until it finds a line with the S: –descriptor. As some entries in the Credits file do not have a field with the S: –descriptor, the program would, however, stop only at the next line where the descriptor can be found. This would associate a name with an address from a different entry, skipping some entries in the process. A casual browsing of some recent versions of the Credits files could easily lead a programmer to make such a mistake in programming the scanning algorithm.



Table 3: An entry with non–standard address.
N: John S. Marvin
E: jsm@fc.hp.com
D: PA–RISC port
S: Hewlett Packard
S: MS 42
S: 3404 E. Harmony Road
S: Fort Collins, CO 80528



The Credits file also has a number of entries with non–standard addresses. For example, Table 3 shows an entry which gives good information about the mailing address in a way that is difficult for an automated program to detect. Several such non–standard addresses are listed in the table below.



Table 4: Examples of non–standard address fields.
S: Canada K2M–2G7
S: No fixed address
S: Concord, CA
S: Ann Arbor, MI
S: Oxfordshire, UK.
S: England
S: United Kingdom
S: UK



A program that makes the assumption that the last S: –line contains the country name would find one Linux developer in a country called "Oxfordshire, UK," and another in "No fixed address." Without checking the validity of the country names, one could easily make wrong conclusions about the number of developers in different countries.

When attempts are made to create time–series data using several Credits files, the problems become more challenging. This is due to several facts. First, the entries in the older Credits files tend to be more incomplete and less structured than in the recent files. Although the structure of the Credits file was intended to facilitate automatic retrieval of information, the users were assumed to be able to make sense of the provided data. As a result, both the syntax and the semantics of the entries vary. For Linux programmers who use the Credits file to find information about other developers, the free format of the Credits file is not a major problem. They simply look up developer information and make sense of the provided information as well as they can.

It is relatively easy to interpret results produced by automatic extraction tools as long as the processed data can be manually checked. This becomes more difficult when several files from different time periods are used to process thousands of entries. Table 5 and Table 6 show entries with easy to interpret but difficult to automatically process country information.



Table 5: An entry from kernel release 1.0, 13 March 1994.
N: Alan Cox
E: iiitac@pyr.swan.ac.uk
E: gw4pts@gw4pts.ampr.org
E: GW4PTS@GB7SWN (packet radio)
D: NET2Debugged author
D: Network layer debugging
D: AX.25 & IPX alpha releases
S:





Table 6: An entry from kernel release 1.3.6, 26 June 1995.
N: Ken Pizzini
E: ken@halcyon.com
D: CDROM driver "sonycd535" (Sony CDU–535/531)
S:



Table 7, in turn, shows an entry with an exceptional order of fields, where the S: –descriptors are placed in the middle of the entry. Such entries are rare in the Credits files and appear only in some kernel release versions. Scanning programs that are tested using only a few examples of Credits files easily become programmed with the assumption that the country information can be found by looking the last line with the S: –descriptor and that this is the final line of the entry, followed by an empty line. In most cases, this, indeed, is true. Sometimes the empty lines, however, contain space and tab characters that cannot be found by simple visual inspection of the files.



Table 7: An entry from kernel release 2.0.1, 11 June 1996.
N: Eric S. Raymond
E: esr@thyrsus.com
W: http://www.ccil.org/~esr/home.html
S: 22 South Warren Avenue
S: Malvern, PA 19355 USA
D: ncurses library co–maintainer
D: terminfo master file maintainer
D: Distributions HOWTO editor
D: Instigator, FHS standard
D: Keeper of the Jargon File and curator of the Retrocomputing Museum
D: Author, Emacs VC and GUD modes



Longitudinal analyses of the Credits files also have to deal with the problem of address changes. For example, in the early Credits files Linus Torvalds has an address in Finland. In 1997 he moved to Santa Clara, California, and the address information changed accordingly. When Credits files are used to analyze the country of origin of developers, the results therefore show a decrease in the Finnish population of kernel developers in 1998. Similar changes have occurred in many countries. In some cases the countries themselves have changed. Furthermore, some entries contain multiple addresses in different countries — for example, when the person in question is temporarily studying or working abroad.



++++++++++
4. Analysis method

As the discussion above shows, automatic generation of time–series data from the Credits files requires solving some non–trivial issues. The particular way these issues are solved leads to different quantitative results and interpretation of the produced data. This is also generally true for other studies that try to extract data from open source files [3]. It is therefore important that researchers both describe their methodology accurately and validate it using independent data.

Below I present data on developer countries. The starting assumption is that the snail–mail address reflects the location of the developer. Where country data is not available, other available information in the entry will be used to associate persons with countries. If there is not enough information in the entry, we revert to other sources. The data is generated using the following procedure.

1. If the last S: –descriptor line contains text, start by assuming that it is a country name.
2. If this text is badly formatted, translate it into an appropriately formatted country string.
3. If no country information is available, use a support database.

The second step above consists of program code that matches any of the known irregularly formatted S: –fields. For example, if the last S: –line consists of a string "idaho 83686," the entry is associated with "USA." Similarly, if the line contains a string "South Australia," the entry is associated with the country value "Australia."

When country information is not available, for example, because there are no S: –lines in the entry, a support database is consulted in an attempt to resolve the country. The support database associates names in the Credits files with countries. It is built in the following way:

1. If the entry has an e–mail address or other information that clearly indicates a location, use that as the country.
2. If there is an entry in a later Credits file with similar information but with country information available, use that country.
3. If common knowledge about developer country is available, use that.
4. If there is a non–obvious e–mail address or Web address in the entry, use an IP trace router program [4] to check the physical location of the network host; if the host seems to be a local host, check the registered physical address for the host using the RIPE, APNIC, and ARIN whois databases [5] and use that country.
5. If the country is still unresolved, use Internet search engines and interview experts to check whether there is good information available about the developer’s location; if such information exists, use that.
6. If country information is still unresolved after the preceding steps, use "Unknown" as the country value.

Typically, many entries without explicit country information can be resolved using descriptions or e–mail addresses in the entry. For example, Lars Wirzenius at liw@iki.fi can easily be located in Finland, although his entry does not give country information. This assignment can be verified by common knowledge about the history of Linux. Similarly, although Alan Cox does not have explicit country information in the early Credits files, his e–mail address, amateur radio call sign and later entries assign him to the UK. Also in this particular case, the developer’s country is common knowledge within the Linux community. In some cases, however, there is not enough information to associate a person with a country. In those cases, the support database defines the country as "Unknown." For example, the entry for Gareth Hughes only gives an e–mail address at acm.org, which is a global professional organization that typically only forwards e–mail. The support database will therefore include the following associations, among others:

Lars Wirzenius, Finland
Alan Cox, UK
Gareth Hughes, Unknown

As was noted above, the support database is used only if explicit country data is not available. For example, when Alan Cox has an entry with S: –line "," this non–standard address string, which only Alan Cox has used, is translated into "UK." When he has no S: –line, the support database is consulted and Alan Cox is associated with the country found, in this case "UK." When Alan Cox has specified a S: –line with country information "United Kingdom" or "Wales, UK" they are simply translated into "UK." All these cases, indeed, occur in the different Credits file versions.

The procedure described above means that whenever there is an entry that cannot be associated with a country, and which has not explicitly been defined as "Unknown" in the support database, the scanning program generates an exception report. This means that entries that are labeled as "Unknown" have always been manually checked.

The support database has been built iteratively using a set of Credits files that range from March 1994 to July 2002. The procedure converges when no exceptions are generated. This also signals that the support database contains all the information that is required to process the entries in the Credits files.

After the support database is completely defined, the automatic procedure described above can be used to extract developer country information. By running this procedure over a set of Credits files, a time series can then be created. Possible irregular country names are checked at this point and the translation table is modified if necessary. Currently the translation table consists of 31 search strings that match all irregular addresses until release 2.5.25.



++++++++++
5. Results

Data from several versions of the Credits file are presented below. The processed Linux kernel releases are show in Table 8. The table shows the last modification dates of the processed Credits files, the total number of names found in the file, the number of times when the unavailability of explicit country information has required a lookup from the support database, and the number of names with an unknown country.



Table 8: Processed Credits files.
Release File date Total names Db lookups Unknown countries
1.0 13–Mar–94 80 13 1
1.1.0 19–Mar–94 81 14 1
1.1.23 6–May–94 86 13 1
1.2.0 6–Mar–95 128 23 1
1.3.0 11–Jun–95 129 24 1
1.3.6 26–Jun–95 130 24 1
2.1.0 21–Apr–96 196 27 1
2.0.0 8–Jun–96 190 27 1
2.0.1 11–Jun–96 190 27 1
2.1.44 7–Jul–97 209 40 2
2.1.108 13–Jun–98 245 34 2
2.2.0 19–Jan–99 269 41 2
2.3.0 11–May–99 275 46 2
2.3.9 29–Jun–99 287 42 4
2.2.14 4–Jan–00 284 58 2
2.3.51 10–Mar–00 341 48 4
2.4.0 31–Dec–00 375 67 5
2.4.6 28–Jun–01 395 73 5
2.4.9 13–Aug–01 403 71 6
2.4.17 21–Dec–01 408 72 6
2.4.25 6–Jul–02 418 77 6



A reasonable first assumption is that the mailing addresses provided by the developers in the Credits file reflect their physical locations. In theory, people may receive mail in an address that is in a foreign country, for example, if they are temporarily working or studying abroad. By manually checking different versions of the Credits files it is possible to see some movement across countries. In general, it seems, however, that mailing addresses reflect the main geographical location of the developers well. We therefore assume that when an explicit address is found in the entry it is the physical address of the developer.

In some cases, the developers have provided multiple physical addresses or e–mail addresses that point to different countries. In these cases, the country mentioned last is used.

Manual checking also reveals that that there are some entries that have not been updated during the years and which therefore may give misleading information about the current location of the developer. This is most probable for developers who have not been actively involved in Linux kernel development during the last years. As the Credits file is a cumulative record of the developers, a person who has developed Linux kernel ten years ago in a specific country may still be counted as a developer in that country simply because of outdated entry information.

It is not possible to detect a difference between active and passive developers using information from the Credits file. Although it can be safely assumed that new entries in the Credits file reflect active and recent developments, the earlier contributors may or may not be active.

When we associate names with countries it is important to note that this association has three possible interpretations. It is possible to assume that an explicitly given country reflects the current country of the developer. If the entry is updated and contains a physical mailing address, this probably is the case. In that case, we associate a person with his or her current location. When the regional expansion of the Linux developer network is studied, we usually, however, are interested in the country where the developers have done the work that has led to their inclusion in the Credits file. This may or may not be associated with the country where the developer currently lives. Furthermore, as the Credits file is a cumulative record of contributions, it does not differentiate between contributors that are active or passive.

A contributor who has developed Linux a decade ago appears in the Credits file exactly in the same way as a contributor who has recently made contributions. The aggregate country data therefore does not necessarily reflect current activity of Linux development.

When people have updated their address information after moving to a new country, as Linus Torvalds for example has done, this appears as a decrease in the number of developers in the originating country. If country information is extracted from a specific kernel distribution and used to associate the developer with a country at some other time period, the association may be wrong. It seems, for example, that some Linux developers have moved from Eastern Europe to the U.S. while they have been included in the Credits files. For example, Petko Manolov appears first as a Bulgarian developer in the year 2000, and then as a U.S. developer in 2002, leaving Bulgaria with zero developers. In other words, some of the growth in the U.S. developer numbers result from the movement of existing Linux developers and not necessarily from the emergence of new developers in the country.

In the table above, the column for Db Lookups shows the number of times when the support database has been consulted. This number gives a very conservative upper limit for possible errors in country allocations. In the worst case, the database could give wrong country information for all developers in the database. In many cases the data entered in the support database is, however, based on rather obvious cues. For example, it is relatively safe to assume that Ross Biro, with an e–mail address at stanford.edu, can be associated with the U.S.A., or that Kai Mäkisara at vtt.fi can be located in Finland. The association of Ross Biro with the U.S. can be confirmed by a Web search that finds him at the end of 2001 at San Francisco, working for The Learning Network. Kai Mäkisara, in turn, is clearly a Finnish name which fits well with the vtt.fi address that belongs to VTT Technical Research Centre of Finland.

In some cases, the association is more difficult to do. For example, Cyrus Durgin has only provided e–mail and Web page addresses at speakeasy.org, which resolves into an IP address 216.254.0.2. This belongs to a network that is registered in the ARIN database for Speakeasy Network, Inc., with an address in Seattle, Washington, U.S.A. Checking the Web site, one can see that the host is an independent U.S. Internet Service Provider, with strong roots in the Seattle area, but which operates in 11 points of presence in the U.S. and provides DSL access through a partner in 29 states. It probably therefore is correct to assume that Durgin is located in the U.S. A detailed study of information about Durgin finds him doing network and Unix administrator tasks in firms located in Seattle. Similarly, Daniel J. Maas, with a Web address http://www.maasdigital.com, has been located in Canada as his Web server seems to be located there. In some cases errors may have been introduced, as it is possible that people use their e–mail servers and Web hosts through international connections. For example, Daniel Maas also has Web pages at dcine.dyndns.org, located in the U.S., which inform that he has been studying at the Cornell University. A rough estimate is that there may be about a dozen country allocations in the most recent support database where the allocations have been based on indirect and difficult to verify IP addresses. Almost all of these are in the U.S. As it is probable that people on other continents do not commonly use U.S.–based Web hosts and e–mail addresses for their Linux–related activities, one may relatively safely assume that there are only few wrong country allocations in the support database.

The potential for wrong country allocations varies across countries and kernel releases. Recent kernel distributions typically have more detailed and more up–to–date information that can be verified through the Internet. Most of the missing country information is in the entries associated with U.S. developers. This is probably partly because physical address in the U.S. is often viewed as private information. Of the 22 Canadian entries only one entry did not explicitly specify the country in the most recent Credits file studied. Similarly, all developers from the Czech Republic explicitly gave country information. Of the twenty Australian developers five did not explicitly define their country of origin.

An important factor to note in using time–series data from the Credits files is that for a number of years there have been two different kernel distribution lines. One is intended for operational use, where reliability is more important than rapid incremental improvements. The kernel releases in this release path are commonly called "stable" versions. The other release path is used for ongoing development and incorporates more experimental additions to the kernel code. The Credits file versions have not been completely in synchrony between these two kernel release paths. As a result, the number of names in the Credits files does not always increase with time. For example, version 2.3.9, from 29 June 1999, has more names in its Credits file than version 2.2.14 that was released in January 2000. This can be seen from Figure 1 as an outlier point that breaks the relatively linear growth trend of the total developer count. The 2.3.x kernel release path is a developmental path, whereas 2.2.x is a "stable" path.

The summary data is shown in graphical form in Figure 1.


Figure 1: Number of people in the Credits file.

The generated data consists of time–series of the number of people in the Credits files per country. This data can therefore be used to study regional distribution of Linux kernel developers across time. For example, it is possible to see how the number of contributors has changed in the different countries across different time periods. An example is shown in Figure 2, which shows the number of entries in a few selected countries.


Figure 2: Developers in different countries.

The growth rates of developer populations have varied between different countries. This can be seen, for example, by fitting least squares estimates to the population weighted data and ranking the countries according to the estimated slope of growth. Results are shown in Table 9 below. To create the ranking, the country specific developer counts have been divided by the appropriate mid–year population of the country in question and a least squares linear curve has been fitted to the weighted country time series. The slopes of the fitted lines have then been used for the ranking. The U.S. Bureau of Census International Data Base has been used as the source of population data. For the estimates, an entry value of zero has been added for all countries, except Finland, at 17 September 1991, when the first Linux kernel was released. The starting value for Finland has been set to one.

The ranking shows that there have been countries both with slow and fast increases in the number of developers. Luxembourg appears on top of the list as its total population is only about 400,000 people and it has only one developer who appears in the Credits files since 1997. Leaving Luxembourg out, the quartile with the fastest growth includes Czech Republic, Sweden, Norway, Australia, Ireland, Denmark, the Netherlands, Germany, and Finland.



Table 9: Country ranking according to population weighted growth rates.
Rank Country Slope R2
1 Luxembourg 9.14E–10 0.76
2 Czech Republic 3.61E–10 0.90
3 Australia 3.05E–10 0.94
4 Sweden 2.85E–10 0.82
5 Norway 2.82E–10 0.78
6 Finland 2.57E–10 0.66
7 Netherlands 2.53E–10 0.84
8 Denmark 2.15E–10 0.87
9 Germany 2.11E–10 0.98
10 Ireland 2.09E–10 0.75
11 Ukraine 1.86E–10 0.98
12 Austria 1.77E–10 0.89
13 Canada 1.63E–10 0.93
14 U.S.A. 1.31E–10 0.97
15 Belgium 1.20E–10 0.91
16 Croatia 9.44E–11 0.78
17 Hungary 8.40E–11 0.85
18 Switzerland 7.93E–11 0.64
19 New Zealand 7.06E–11 0.50
20 France 6.03E–11 0.94
21 Hong Kong 4.67E–11 0.56
22 Portugal 3.04E–11 0.56
23 Italy 2.76E–11 0.92
24 Bulgaria 2.68E–11 0.34
25 Romania 2.03E–11 0.57
26 Poland 1.65E–11 0.61
27 Taiwan 1.53E–11 0.61
28 Brazil 1.51E–11 0.66
29 Argentina 8.97E–12 0.60
30 Spain 8.90E–12 0.63
31 South Africa 6.42E–12 0.50
32 U.K. 5.57E–12 0.56
33 Mexico 3.33E–12 0.59
34 Russia 2.62E–12 0.72
35 Japan 1.86E–12 0.44



An example of population weighted entry counts is shown graphically in Figure 3.


Figure 3: Number of entries in some example countries, per capita.

Many of the country rankings are statistically meaningless as there is a large number of countries with only few developers. In the last kernel release studied, there were 28 countries with ten or fewer developers and only seven countries with more than ten developers. The median number of developers was 2 and the average 11.7. The number of developers in different countries in the most recent kernel version 2.5.25, from July 6, 2002 is shown in Table 10. The full data set is in Appendix 1.



Table 10: Number of developers in different countries in Linux Credits, version 2.5.25.
Country Number of developers
Bulgaria 0
Argentina 1
Croatia 1
Hong Kong 1
Japan 1
Luxembourg 1
Mexico 1
New Zealand 1
Portugal 1
Russia 1
South Africa 1
Taiwan 1
Ukraine 1
Ireland 2
Poland 2
Romania 2
Spain 2
Switzerland 2
Hungary 3
Austria 4
Belgium 4
Denmark 4
Norway 4
Italy 5
Finland 9
Sweden 9
Brazil 10
Czech Republic 10
France 12
Netherlands 18
Australia 20
Canada 23
U.K. 32
Germany 69
U.S.A. 154
EU countries 187





++++++++++
6. Credits and authorship

A recent think–tank report by Alexis de Tocqueville Institution (Brown and Orndorff, 2004) used a draft version of this paper to argue that Linux could be based on intellectual property infringements and inaccurate allocation of developer credits. The report claimed that the history of Linux is too amazing to be true, and that it is improbable that a single individual without much experience in software development could have created a full operating system in just a few months. The report implied that Linux, therefore, could be derived from earlier software code and, in particular, from the Minix operating system. The report also claimed that the analysis of the Credits file shows that Linux developers may have acted against their employers’ intellectual property policies, and that missing entries in the Credits file may indicate that Linux may include copyrighted code that has not been acknowledged. Hence, the authors of the report claimed that the future of open source software and Linux is therefore threatened by the problem of assigning authorship to specific pieces of code, and potential legal costs resulting from this. As the argument to an important extent has been based on the data presented in this paper, a few observations may be useful.

First, as Section 2 above pointed out, the amount of code in the first release of what later became known as the Linux operating system was rather modest. It consisted of 88 files, with median size of 37 lines of code. Based on common knowledge about software development, it therefore appears that a single computer enthusiast could well have created the first Linux version in a couple of months. In fact, by reading the original source code, it is quite clear that a single author, still in the early phases of learning to program operating systems, has produced it. From the point of view of copyright law, the first version of Linux kernel therefore cannot be defined as a derivative work [6].

Second, the unavailability of Credits file during the early phases of Linux development does not signal unclear authorship. The fact that the first Credits file appears only in 1994, with Linux version 1.0, has a very simple explanation. During the early phases of the development, the amount of source code was small and the developers were aware of each other’s contributions. Explicit recording of "credits" would have made little sense, as all developers knew where each piece of software came from. In fact, the development process was based on iterative development and improvement of source code. The developers, therefore, did not only know who had produced specific components of the system, but they also knew the complete history of these developments. Explicit Credits files only started to make sense when the Linux project grew to a more complex development project where newcomers did not necessarily know the history of the project [7].

Third, the Credits files do not record authorship in any legal sense. Formal copyrights and informal moral rights for the different parts of the Linux source code are embedded in the source code. The Credits file only acts as a "hall of fame" without any direct links between copyrighted work and authorship. The Credits file, therefore, is irrelevant from the point of view of intellectual property rights. The addition of Linux contributors to the Credits file is controlled purely by behavioral rules decided by the developers themselves.

Fourth, the affiliations given in the Credits files do not necessarily reflect the historical affiliations of the people mentioned in the file. The Tocqueville report, for example, argued that Linux developers may have harmed their employers’ intellectual property rights by releasing software to the Linux community. To make this argument, the report shows that an employer of a person mentioned in the Credits file has adopted an intellectual property policy, according to which only software that cannot be appropriated commercially may be released as open source. This would apparently imply that the Linux developer mentioned in the Credits file might have broken the intellectual property policies of his employer by providing code to the Linux kernel, and that his managers might have acted against the interests of the firm and its owners by allowing this to happen. As the Credits file is an accumulated record of contributors and as the current addresses and affiliations of the developers have changed during the years, the policies of the current employers, however, are quite irrelevant for any discussion on historically created intellectual property. For example, Linus Torvalds remains one of the main contributors to the Linux kernel project and his name will appear in the future versions of the Credits file, independent of the intellectual property policies of his current or future employers. Microsoft, for instance, could not retrospectively create copyright policy infringements simply by hiring all the persons mentioned in the Credits file, even if this would imply that all the developers would change their affiliations to Microsoft in the future versions of the Credits file, and subsequently be required to stop producing open source software [8].

The difficulty to accurately allocate credit in software development projects should not, however, be automatically interpreted as evidence of misallocated credit or intellectual property rights infringements, as the Tocqueville report, for example, has done. Software products are often based on incremental innovation where existing technologies and knowledge are recombined to create new functionality. The history of the Internet, for example, shows that authorship, indeed, is often misallocated [9]. This fact, however, could easily be used to argue that the current intellectual property regime — and specifically software related patents — may require reconsideration. In networked and combinatorial systems, intellectual property rights probably are often granted to inventors who only partially deserve the credit. Or, to put it in another way, developers may deserve much more credit than there is intellectual property available today. One way to deal with this issue is to create explicit representations of moral authorship that are only loosely connected with current concepts of intellectual property. The Linux Credits file is an example of such an approach.



++++++++++
7. Discussion

Automatic extraction of data from open source code is a possible, but not a trivial, task. Computer programs typically operate on relatively well–defined tasks where users have enough domain specific knowledge to detect programming errors and where statistical and case–based testing can, at least in theory, be applied. Text scanning programs, in contrast, often operate on open and ill–defined domains. Text can be used in many different ways for communication. Interpretation of semantically ambiguous text, however, is usually impossible without context information and human sense–making capabilities. The programming of text analysis tools, therefore, typically requires detailed domain specific knowledge.

Errors in traditional computer programs can often be detected by the fact that the program crashes or that it produces obviously incorrect results. For example, operating systems function in a relatively closed world that is highly constrained by the underlying hardware. If program code has errors or if the programmer has made mistakes in interpreting the world, reality usually hits without much delay. In such a world, the hardware provides a foundation for objective evaluation of software errors.

Text processing programs that extract data from unknown domains operate in a very different world. This world is full of surprises and unexpected phenomena. When the size of the studied domain grows, it becomes increasingly difficult for the researchers to understand where and how their tools work. In practice, when automated text analysis tools are used in areas where their correct operation has not been validated, the results become unpredictable. It is particularly difficult to understand and interpret data that has been automatically generated if no analyses of potential sources of error and estimates of their impact are available.

One approach to alleviate this problem is to benchmark and test automated data extraction tools against a known set of data. Such benchmarking data can be created in a bootstrapping process that starts by analyzing a limited and well–defined domain where potential errors and their impact can be studied. In effect, we can isolate a small micro–world from a potentially open and ambiguous world and improve the research methodology within the micro–world until the results converge.

Methodologically, this is a variation of the grounded theory approach, often used in qualitative social studies (Glaser and Strauss, 1967). When the automated tools produce conceptually coherent results — for example categorize the data in known countries — and the tools do not produce any exception reports, the domain has been adequately understood. The results can then be verified using independent sources of knowledge to check that the converged results are valid. For example, we can study the list of generated countries and check that they are countries also in the real world. Indeed, we can see that some "countries" such as Hong Kong and Czech Republic have changed their status during the history of Linux [10]. After one micro–world has become understood and known, broader studies can then verify their results and estimate their errors using data from previous studies.

Open source research that is conducted using automated text processing tools is particularly challenging. As many open source projects have detailed historical archives of the different versions of the software, it is possible to generate time–series data that describes the evolution of the studied systems. Combined with other statistical data, such data can provide interesting theoretical and empirical insights. Typically, the massive amounts of text in open source archives, however, means that automated processing is necessary. If the resulting data is used to test theoretical hypotheses, the results depend on the quality of data. As the discussion above shows, there is a considerable risk that theorists get the basic facts wrong.

By reading the various open source research papers available on the MIT open source archive [11], one may note that conceptual and empirical confusions have been relatively common in this new and multidisciplinary research area. Many authors, for example, have repeated Raymond’s (1998) description of open source development as a "bazaar" that provides an alternative to the traditional "cathedral building." Historically cathedrals, however, were often built in ways that closely resemble the open source model [12]. Inspired by Raymond, some authors have built economic models based on the assumption that the open source model is "better" or "more reliable" than the proprietary software development model, without much evidence to support and qualify these beliefs. Early open source papers often took for granted that there is a unified "open source community" with shared values, motives, and development approaches. Some authors have struggled with technical details, for example, by describing the Unix operating system as a computer programming language, or by explaining the modularization of the Linux operating system as a result of modern object–oriented programming practices which, in fact, have not been used in Linux development. The Tocqueville report, discussed above, makes similar mistakes, for example, by claiming that Linux has been the only commercially successful open source operating system, and that a single individual created it in just a few months.

In new research domains, errors are easy to make and also the academic peer–review system has difficulties in reviewing the quality of research. Without sufficient domain–specific knowledge and existing benchmarks it is difficult to understand the empirical validity and relevance of new research. The rapid publication cycle–times in open source related research and the broad availability of working papers on the Internet exacerbate the problem of scientific quality control as erroneous information is easily available and spreads quickly.

An example may illustrate these problems. It appears that the first study on the Linux Credits files was reported by the present author in a working paper distributed at UC Berkeley and Stanford in April 2000. Some of the results were presented in a conference organized at Berkeley, and slides from this presentation subsequently became incorporated in a BRIE (Berkeley Roundtable on the International Economy) working paper (Weber, 2000), with permission, but without reference to their original source [13]. The working paper has been on the BRIE Web site since the summer 2000 and linked to the MIT open source working paper repository since December 2000, and it has apparently inspired later studies that have tried to extract data from the Linux Credits files. Both automated and manual bibliometric studies would always miss the fact that some of the data came from the present author. This connection can only be made by people who already know about it.

It is clear that both in open source code and scientific literature credits are not always accurately recorded. Whereas the scientific quality control system tries to improve the accuracy of the attribution of authorship, the Linux credits files explicitly note that the list most certainly is only a partial list of contributors. Linux and other open source developers, for example, rely on the GNU C compiler and its libraries but the contributions of the compiler developers are not explicitly noted in the source code files.

Explicit credit claims and copyright notes in open source code do not therefore necessarily accurately reflect authorship or developers’ contributions. Furthermore, as sociologists and historians of science have shown, institutional memory tends to be very selective [14]. Earlier contributions are often forgotten when complex social forces produce reinterpretations of history [15].

Although open source research has a unique opportunity in penetrating the barriers of institutional memory and avoiding social distortions in the allocation of credit, memory is also overwritten in the Linux kernel contributions. The different parts of the Linux kernel code have undergone considerable creative destruction during the years [16]. Old code has continuously been replaced and made redundant by new code. Linux development is cumulative system development where early contributions may be major contributions even when they are later discarded and made invisible. As the Linux kernel developers have used many different ways to tag their contributions in the source code files during the years, a detailed study of kernel contributions is a very challenging task indeed. This is the reason why we have focused above on the relatively simple task of analyzing the Linux Credits files.

The data presented in this paper can be used to cross–verify the methodology and results of several papers that discuss the structure and development of the Linux developer community. For example, David Lancashire (2001) has argued that the analysis of the Linux Credits files shows that the high concentration of Linux developers in the Nordic countries and the low per capita number of developers in the U.S. reflects the different structure of economic opportunities in the different regions of the world. This is an interesting argument. Based on the discussion above, it is, however, easy to see that it is not supported by the data provided by Lancashire or the data described in this paper.

The core of Lancashire’s argument is that the high demand for computer programmers in the U.S. during the 1990s has led to an abundance of economically beneficial opportunities, implying high opportunity costs of joining open source projects in the U.S. Lancashire therefore concludes that traditional economic arguments can explain the geographical distribution of Linux kernel developers. This conclusion, however, is based on data from a single kernel release (2.3.9). As should be clear from the above discussion, Linux Credits files are cumulative records of persons who have been involved in Linux development. The snapshot picture provided by a cumulative record of Linux developers should therefore be complemented with a more dynamical analysis.

A quick glance at Figure 2 reveals that there does not seem to be any obvious slowdown in the growth rate of Linux developers in the U.S. during the Internet boom years. When the developer data is aggregated in the European level, the European Union (EU–15) has about 20 percent lower developer density than the U.S. In other words, contrary to Lancashire’s claim, there does not seem to be any "apparent erosion of American support for free software development." Similarly, the population–weighted developer counts in Figure 3 do not seem to support the Lancashire argument about opportunity costs. As can be seen from Table 9, the story is more complex.

In particular, to support the claim that economic opportunity costs explain the geographical distribution of Linux developers, one should analyze the relationships between the growth rate in the developer population in a specific country and the opportunities in that country. It is obvious that as only 35 countries of the world have Linux developers with entries in the Credits files, the concept of opportunity and its related costs can only be understood within a larger socio–cultural context. For example, there are no developers from India, mainland China or Islamic countries. The fastest growth in developer populations has in recent years come from the Czech Republic and Australia. Most spectacularly, 99.6 percent of Linux developers mentioned in the Credits file are male. A simple economic theory of opportunity costs would therefore imply that women and men exist in two different economic spheres, or that women are paid much better for commercial software development than men.



++++++++++
8. Future research

Already a quick glance at Figure 3 produces several alternative hypotheses to the thesis that opportunity costs or wages in the local software industry can explain country differences in the Linux developer community. Finland seems to rank high partly because of the historic origin on Linux. The most important distribution host in the early years of the Linux history was funet.fi, located in Finland. As many Finnish hackers had good access to this Internet node, they were well aware of the evolution of the Linux system. The relatively high Finnish participation in the Linux development activity, therefore, seems to be more a story about innovation diffusion than a story about opportunity costs. The facts that Finland ranks highest among the countries in the proportion of science and engineering students [17] and that it was among the first countries to be connected to the U.S. Internet backbone [18] most probably also play a role here.

It is also worth noting that technological change has been an important factor in the expansion of Linux. The first Unix was developed at the Bell Labs in 1971 for PDP minicomputers. Towards the end of the 1970s, several alternative versions of the Unix operating system were created, most important of these being the UC Berkeley BSD Unix, which had strong support for computer networking. With its support for TCP/IP networks, Unix became the most popular operating system in the Internet. The Minix operating system, released in January 1987, was the first Unix–like operating system developed for cheap Intel–based PCs. Source code was available for all these systems. In this sense, Linux is a fourth generation Unix. It was made possible because PCs and the rapidly expanding Internet brought collaboration within the reach of computer enthusiasts, combining personal computing with global networking. The fact that these factors came together in many different countries almost simultaneously is reflected in the fact that the Linux developer network rapidly expanded to many countries. In this sense, Linux emerged exactly when it became possible.

The rapid recent expansion of Linux development activity in the Czech Republic is probably at least partly related to increased access to computer networks [19]. One might also speculate that the relatively low participation of Italy, France, and Spain may be partly explained by language barriers. These countries, of course, also had some of the lowest Internet penetration rates in Europe during the 1990s.

An interesting phenomenon emerges when the data presented above is extended to recent versions of the Credits file and complemented with information in the Maintainers file that describes the division of labor within the Linux developer community. At the end of 2003, there were about 250 persons maintaining specific parts of the Linux system. The Credits file, in turn, had grown to about 450 names and 35 countries. The developer affiliations increasingly appeared to be large businesses and government–related agencies. For example, the modules relating to system security apparently are now professionally developed and managed by people in firms that are known for their close contacts with the U.S. government. As Linux has increasingly been accepted as a core element in corporate and government organizations, developers are increasingly difficult to describe in terms that could have been relevant in the early phases of the Linux history. Future research could find a rich domain of study by analyzing the evolution of organizational and institutional ecologies in the history of Linux.

The data extracted from the Linux Credits files can be used to test a number of hypotheses about the factors that influence the growth and expansion of open source networks. For example, it is possible to study the correlations between national educational levels, information technology investments, growth of software related industries, cultural communication patterns, and expansion of open source networks. Furthermore, it is possible to ask why some countries are not involved in the Linux development.

Conclusions from such studies will be limited by the fact that Linux is a quite exceptional open source project. It is a highly successful project, which has attracted much interest, economic support, and millions of users. Linux is also special, as it has been an operating system project, where software architecture has been strongly constrained by hardware. Results from the analysis of the Linux Credits files, therefore, cannot necessarily be generalized into other successful open source projects. In particular, the boundary conditions that have made the Linux development model effective may have changed during the years. Indeed, the Linux developer community has not only created the Linux system itself but also many tools and procedures that make the current development process possible. These tools and procedures were not available for the early developers of Linux. For example, many recent open source research projects have tried to analyze the evolution of open source code and its developer communities using information recorded in software version control systems. Such information, however, cannot be used to analyze the history of Linux, as version control systems have not been used in Linux development until recently (Shaikh and Cornford, 2003).

The developmental path that led to the current Linux system may be difficult to repeat a decade later. Today, for example, it would be quite unrealistic to send an e–mail to an Internet newsgroup announcing the availability of 88 files that contain a rudimentary Unix–type operating system, and expect a tidal wave of interest. The world of computing has changed in many ways during these years. Linux itself has been an important part of this change. Theoretical generalizations that are based on the history of Linux, therefore, may require careful analysis of the changes that have occurred during the evolution of Linux. We can learn from history, of course, but technological change also continuously creates new domains for human activity. Technological development makes time inherently irreversible. In such emerging worlds, universal truths are far and few, and difficult to find before they become outdated. Better understanding of what exactly happens in open source projects, and how they became what they are, is, however, extremely important in a world where software both drives and facilitates social and economic development. End of article


About the author

Ilkka Tuomi is currently Visiting Scientist at the European Commission’s Joint Research Centre, Institute for Prospective Technological Studies, Seville, Spain. From 1987 to 2001 he worked at the Nokia Research Center in various positions, most recently as Principal Scientist, Information Society and Knowledge Management. From June 1999 to December 2000, he was Visiting Scholar at the University of California, Berkeley.
E–mail: Ilkka.Tuomi@cec.eu.int.


Notes

1. There are six names in the Credits file whose gender could not be verified by searches on the Internet or by asking other persons mentioned in the Credits file. As no information indicated that the persons in question would be female, I have made the assumption that they are males. This assumption was made for Sam Mosel, Pat Mackinlay, Niibe Yutaka, Chih–Jen Chang, Ani Joshi, and Asit Mallick. In general, as the developers come from many different cultures that have different naming conventions it is not a simple task to categorize them based on gender. Also Linux kernel developers sometimes make mistakes in this regard. For example, in some kernel discussions Andrea Arcangeli is referred to as a female. It may be easy for a Finnish speaker to know that Kai is a male name in Finnish. In some other languages it would be female name.

2. One should note that inclusion in the Credits file does not always imply major contributions to the Linux project. There are also some developers included who have made relatively minor contributions. I am grateful for Alan Cox for clarifying this point.

3. The FLOSS study by Ghosh, Robles and Glott (2002), for example, used an algorithm that assumed that source code has copyright lines where a developer is associated with the copyright. As a result, firms such as Sun Microsystems or institutions such as University of California at Berkeley were counted as particularly active software developers.

4. IP trace router is a program that sends IP packets to a specified destination and notifies the sender about all the intermediate hosts that the packet traverses to reach its destination. Using the generated routing trace it is possible to see where the destination host is physically located.

5. Internet domains are registered in RIPE, APNIC and ARIN databases depending on their geographical origin and domain type. RIPE maintains information on networks registered in the European, Middle East, Central Asia and African countries north of the equator, APNIC on networks in Asia–Pacific, and ARIN on networks in the American, Caribbean and Sub–Saharan countries, as well as networks registered in Antarctica and the .com, .org, .mil, .edu, .gov, and .net domains. The whois program can be used to find out in which network a specific IP address is registered and who has registered that network domain. It is possible to manage networks across country borders and operate country specific domains outside their real physical location. This typically occurs only for domains such as Tuvalu (.tv) and Coconut Islands (.cc) which are easy to detect as virtual addresses.

6. Copyright only protects expression, and the fact that Linux development was influenced by general knowledge about Unix–related operating systems is therefore irrelevant from the legal point of view. The Tocqueville authors apparently confuse copyright issues with the fact that in commercial software development developers often try to avoid any contact with earlier competing products. Software developers often avoid contact with earlier products to pre–empt any possible future claims that their work has been based on competitor’s business secrets and to prove that any such claims would be frivolous. This is a common legal strategy in highly competitive environments where lawsuits are used to deter competition. Ideas, however, are not protected by copyright. The report’s extensive discussion on the possible influences of Minix on the development of Linux, therefore, is historically interesting but has no consequences from the copyright point of view. Similarly, the analysis of source code structures and logic using "pretty printers" or reverse engineering software, proposed in the report as a means to reveal influences between software projects, is irrelevant when the issue is about copyrights. One should also remember that intellectual property rights are always granted under constraints that balance private and public interests. For example, copyrights are combined with "fair use" rules that, for instance, give citation rights. Similarly, patent monopolies are granted in exchange of revealing the underlying knowledge so that it can lead to further inventions and improvements. Even if Minix would have been both copyrighted and patented, reading its source code, therefore, would not be a problem from the intellectual property point of view, unless the new code would have incorporated pieces of earlier code or infringed a patent.

7. I tried to clarify this point to the lead author of the Tocqueville report in an interview referenced in the report, apparently with limited success.

8. Microsoft is used as an example here, based on a discussion with the report’s lead author, available information about the funding of the Alexis de Tocqueville Institution, and the specific way the report describes the evolution of Linux and its Credits file. It appears that the report was probably written mainly to promote the strategic interests of Microsoft among U.S. government policy makers.

9. Examples include packet switching, the Internet, and the World Wide Web. I have discussed these examples and their implications to intellectual property rights and innovation theory in Tuomi, 2002.

10. For example, I have used the population of Hong Kong for population–weighted data, instead of using the population of People’s Republic of China.

11. http://opensource.mit.edu.

12. Tuomi, 2002, p. 164.

13. The paper was labeled as a working draft, with a request not to cite or quote the paper. It has, however, become widely quoted.

14. Tuomi, 2002, chapter 9.

15. Although Linus Torvalds typically makes ironic statements about his role as the "creator" of Linux, popular accounts often take these statements seriously. The conventional heroic model of innovation requires heroes. This model does not fit well with historical facts, and it is particularly unsuitable for Internet–related innovations, but usually this means that the facts are adjusted so that a heroic story can be told. Thus, for example, Linus Torvalds emerges as the inventor of GNU/Linux and Tim Berners–Lee as the inventor of the Web.

16. Tuomi, 2001; 2002, chapter 10.

17. At the end of the 1990s, Finland had the fourth highest per capita count of engineering graduates in the world, after Singapore, Korea, and Japan.

18. Finland was connected to the NSFNET backbone together with the other Nordic countries and Canada at the beginning of 1989. The Finnish Unix hackers requested a country code for Finland already in December 1986.

19. It is also related to SuSE’s expansion to Czech Republic. I’m grateful for Roland Dyroff for pointing this out.


References

K. Brown and J. Orndorff, 2004. Samizdat: And other issues regarding the ‘source’ of open source. Washington, D.C.: Alexis de Tocqueville Institution.

A. Capiluppi, P. Lago, and M. Morisio, 2003. "Evidences in the evolution of OS projects through changelog analyses," Taking Stock of the Bazaar: Proceedings of the 3rd Workshop on Open Source Software Engineering, International Conference on Software Engineering, Portland, Oregon (3–11 May), pp. 19–23.

R.A. Ghosh, G. Robles, and R. Glott, 2002. Free/libre and Open Source software: Survey and study. Part V: Software source code survey. International Institute of Infonomics, University of Maastricht, at http://www.infonomics.nl/FLOSS/report/index.htm.

B.G. Glaser and A.L. Strauss, 1967. The discovery of grounded theory: Strategies for qualitative research. Chicago: Aldine.

K. Healy and A. Schussman, 2003. "The ecology of open–source software development," Working Paper, University of Arizona (14 January), at http://www.kieranhealy.org/files/drafts/oss-activity.pdf.

S. Koch and G. Schneider, 2000. "Results from software engineering research into open source development projects using public data," In: H.R. Hansen und W.H. Janko (editors). Diskussionspapiere zum Tätigkeitsfeld Informationsverarbeitung und Informationswirtschaft, number 22. Wien: Wirtschaftsuniversität Wien, at wwwai.wu-wien.ac.at/~koch/forschung/sw-eng/wp22.pdf.

S. Krishnamurthy, 2002. "Cave or community?: An empirical examination of 100 mature Open Source projects," First Monday, volume 7, number 6 (June), at http://firstmonday.org/issues/issue7_6/krishnamurthy/.

D. Lancashire, 2001. "Code, culture and cash: The fading altruism of open source development," First Monday, volume 6, number 12 (December), http://firstmonday.org/issues/issue6_12/lancashire/.

A. Mockus, R. Fielding, and J. Herbsleb, 2002. "Two case studies on open source software development: Apache and Mozilla," ACM Transactions on Software Engineering and Methodology, volume 11, number 3, pp. 309–346.

E.S. Raymond, 1998. "The cathedral and the bazaar," First Monday, volume 3, number 3 (March), at http://firstmonday.org/issues/issue3_3/raymond/.

G. Robles–Martínez, J.M. Gonzáles–Barahona, J. Centeno–Gonzáles, V. Matellán–Olivera, and L. Rodero–Merino, 2003. "Studying the evolution of libre software projects using publicly available data," Taking Stock of the Bazaar: Proceedings of the 3rd Workshop on Open Source Software Engineering, International Conference on Software Engineering, Portland, Oregon (3–11 May), pp. 111–115.

G. Robles, S. Koch, and J.M. Gonzáles–Barahona, 2004. "Remote analysis and measurement of libre software systems by means of the CVSAnalY tool," Second ICSE Workshop on Remote Analysis and Measurement of Software Systems (RAMSS ’04), Edinburgh (24 May), at http://libresoft.dat.escet.urjc.es/html/downloads/cvsanaly-icse.pdf.

M. Shaikh and T. Cornford, 2003. "Version management tools: CVS to BK in the Linux kernel," Taking Stock of the Bazaar: Proceedings of the 3rd Workshop on Open Source Software Engineering, International Conference on Software Engineering, Portland, Oregon (3–11 May), pp. 127–131.

I. Tuomi, 2002. Networks of innovation: Change and meaning in the age of Internet. Oxford: Oxford University Press.

I. Tuomi, 2001. "Internet, innovation, and open source: actors in the network," First Monday, volume 6, number 1 (January), at http://firstmonday.org/issues/issue6_1/tuomi/.

S. Weber, 2000. "The political economy of open source software," BRIE Working Paper 140, at http://e-conomy.berkeley.edu/publications/wp/wp140.pdf.



Appendix 1: : Developer countries in the Linux Credits files.
13–Mar–1994 19–Mar–1994 6–May–1994 6–Mar–1995 11–Jun–1995 26–Jun–1995 21–Apr–1996 8–Jun–1996 11–Jun–1996 7–Jul–1997 13–Jun–1998 19–Jan–1999 11–May–1999 29–Jun–1999 4–Jan–2000 10–Mar–2000 31–Dec–2000 28–Jun–2001 13–Aug–2001 21–Dec–2001 6–Jul–2002
country\version 100 110 1123 120 130 136 210 200 201 2144 21108 220 230 239 2214 2351 240 246 249 2417 2525
Argentina 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Australia 3 3 3 7 7 8 11 11 11 11 16 17 17 17 17 20 21 21 20 20 20
Austria 0 0 0 0 0 0 1 1 1 1 1 3 3 3 3 4 4 4 4 4 4
Belgium 1 1 1 1 1 1 2 2 2 2 3 4 4 4 4 4 4 4 4 4 4
Brazil 0 0 0 0 0 0 0 0 0 0 0 1 1 2 2 4 6 7 10 10 10
Bulgaria 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 0
Canada 2 2 2 8 8 8 12 11 11 12 12 13 13 14 14 17 17 19 19 20 23
Croatia 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1
Czech Republic 0 0 0 0 0 0 1 1 1 2 6 7 7 8 8 9 10 10 10 10 10
Denmark 1 1 1 1 1 1 1 1 1 1 1 3 3 3 3 3 4 4 4 4 4
Finland 5 5 6 6 6 6 7 7 7 6 6 6 6 6 6 8 9 9 9 9 9
France 1 1 1 2 3 3 7 6 6 6 8 8 9 10 9 11 11 11 12 12 12
Germany 15 16 17 25 25 25 38 38 38 41 45 49 51 51 51 58 60 65 66 67 69
Hong Kong 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Hungary 0 0 0 0 0 0 0 0 0 1 1 1 2 2 2 2 2 2 2 2 3
Ireland 0 0 0 0 0 0 0 0 0 0 0 2 2 2 2 2 2 2 2 2 2
Italy 0 0 0 2 2 2 2 2 2 2 4 4 4 4 4 5 5 5 5 5 5
Japan 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Luxembourg 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1
Mexico 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
Netherlands 8 8 8 9 9 9 14 15 15 15 16 16 16 17 17 18 18 19 18 18 18
New Zealand 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1
Norway 0 0 0 0 0 0 2 2 2 2 1 1 2 2 2 4 4 4 4 4 4
Poland 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 2 2 2 2 2 2
Portugal 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1 1
Romania 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 1 1 2 2
Russia 0 0 0 0 0 0 1 0 0 1 1 1 1 1 1 1 1 1 1 1 1
South Africa 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 1 1
Spain 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1 2 2 2 2 2
Sweden 1 1 1 1 1 1 1 1 1 2 2 3 3 4 4 6 8 8 8 9 9
Switzerland 0 0 0 1 1 1 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2
Taiwan 0 0 0 0 0 0 1 1 1 1 1 1 1 1 1 1 1 1 1 1 1
U.K. 5 5 5 8 8 8 12 11 11 14 18 21 21 21 22 25 26 30 32 32 32
Ukraine 0 0 0 0 0 0 1 1 1 1 0 1 1 1 1 1 1 1 1 1 1
U.S.A. 36 36 39 54 54 54 74 71 71 78 92 96 97 99 100 121 139 146 148 149 154

Unknown 1 1 1 1 1 1 1 1 1 2 2 2 2 4 2 4 5 5 6 6 6
Total 80 81 86 128 129 130 196 190 190 209 245 269 275 287 284 341 375 395 403 408 418
db lookups 13 14 13 23 24 24 27 27 27 40 34 41 46 42 58 48 67 73 71 72 77


Editorial history

Paper received 25 May 2004; revised 1 June 2004; accepted 4 June 2004.
Contents Index

Copyright ©2004, First Monday

Copyright ©2004, Ilkka Tuomi

Evolution of the Linux Credits file: Methodological challenges and reference data for Open Source research by Ilkka Tuomi
First Monday, volume 9, number 6 (June 2004),
URL: http://firstmonday.org/issues/issue9_6/tuomi/index.html

SEC: Double Snorting

Double Snorting: "by Jeffrey TaylorSnort is a GPLed, Network Intrusion Detection System (NIDS) that runs on Linux and Win32. A NIDS monitors the network, looking for hostile traffic. Basically it"

by Jeffrey Taylor

Snort is a GPLed, Network Intrusion Detection System (NIDS) that runs on Linux and Win32. A NIDS monitors the network, looking for hostile traffic. Basically it scans all traffic on a network interface, not just its own host's, comparing it to rules describing the signatures of known attacks.

Out of the box, Snort warns about almost anything remotely suspicious. If it is listening on an Internet connection, this means a lot of warnings, many of them no threat (e.g., MacOS attacks on an Intel-only site). The real threats are often buried in the deluge of non-critical information. At first, I added custom rules, disabled built-in rules, re-enabled them, swinging back and forth between terseness and completeness with no resolution in sight. Eventually, it occurred to me that I was trying to solve two different problems:

1. Being alerted to serious threats
2. Discovering what junk was floating around the Internet

My solution was to run two instances of Snort, one configured for the attacks on the services I actually run, and one with almost all attack rules enabled.

Snort's attack signature database is large and includes things like peer-to-peer and instant messaging connections, porn, executable code, pings, and port scans. Most rules are enabled by default. Rules are in text files organized by topic (e.g., backdoors, Distributed Denial of Service (DDoS), MySQL exploits, Web server exploits). You can delete or comment out unwanted rules. There is a file, local.rules, set aside for local custom rules (e.g., company policy violations). It is left alone during updates. Some sys admins run cron jobs to update the rules from the Snort CVS server nightly, or even more frequently.

Most Linux distributions include Snort, which is the easiest way to install it. If you need to stay current with new Snort releases, install from the stock (vanilla) Snort source distribution. The Snort FAQ says:

wget http://www.snort.org/downloads/snort-stable.tgz
tar zxvf snort-stable.tgz
cd snort-stable
./configure
make
su
make install
mkdir /var/log/snort
cd etc
vi snort.conf
snort -D -c snort.conf
exit

Consult the Snort documentation for details on editing snort.conf, the configuration file.

Startup

The stock distribution does not include a startup script. Startup scripts are somewhat distribution specific, so it is hard to give an example. One way is to install Snort from your distribution. Copy the startup script (typically, /etc/init.d/snort) somewhere safe, uninstall Snort, move the startup script back, and install Snort from sources as above. You may need to correct the executable and configuration file paths in the startup script to match the stock distribution.

After Snort is running properly, duplicate the configuration files and startup script:

cd /etc # adjust path for your system
cp -a snort snort2
cp -a /etc/init.d/snort /etc/init.d/snort2

The "-a" (archive) option copies recursively and preserves the file permissions and ownership.

Make a symbolic link (symlink, aka soft link) to the Snort executable:

cd /usr/bin # adjust path for your system
ln -s snort snort2

A hard link or a copy of the executable will not be updated when you upgrade Snort. (This may be what you want if an upgrade breaks a custom rule.)

Finally, edit the snort2 startup script and change all references of snort to snort2.

Startup scripts are normally written to start only one instance of a program. Therefore, if you run the startup script twice, the second run will do nothing. An easy, robust way to run two instances of a program is to start the second instance with a different name, which why the symlink is created. Both instances are running the same executable file, but the different name keeps the startup scripts happy. Any created locks, process ID (pid) files, and so forth use the different name.

One problem I have not solved is the planning for upgrades. The original Snort should be the one less modified so merging new and modified files is less work. The informational Snort will probably have the fewer changes to the attack rules but should not log to the default syslog facility. The critical Snort has more changes to the attack rules, but should log to the default syslog facility. A toss-up. The tie breaker is that I want the critical snort kept up to date, even if it means more hand-tweaking afterwards. Because both Snorts need customization, there are going to be long-term maintenance problems. Occasional re-installs from scratch will be necessary, certainly every time Snort breaks backward compatibility.

Logging

There are several ways to log the two Snorts. The simplest way is to send the informational Snort's output to a different syslog facility (e.g., LOCAL0). In Snort2's snort.conf, change the "output alert_syslog" line to:

output alert_syslog: LOG_LOCAL0 LOG_ALERT

You may need to uncomment the line.

To keep Snort2 out of the main logs, add ";local0.none" in /etc/syslog.conf to all catch-all logs (those with "*.*"). For example:

*.*;kernel.info;local0.none /var/log/messages
*.crit;local0.none /var/log/warn

To give Snort2 its own log, add the following:

local0.* -/var/log/snort2

The hyphen before the log filename is a Linux-specific tweak. Normally, syslog files are synced (write to physical disk is forced) after every entry. The hyphen suppresses this behavior, reducing the load. For non-critical logs, especially high-volume ones, this is a good idea.

Snort can also log to a database, like MySQL, for analysis by programs such as ACID (Analysis Console for Intrusion Databases). This is especially useful for looking for attack patterns (e.g., a port scan spread out over several days, such as nmap in its paranoid mode). Because the critical Snort alerts are generally a subset of the informational Snort alerts, I log just Snort2 to the database. If you want to log both, use the "sensor_name" parameter to keep the alerts separate:

output database: alert, mysql, host=localhost sensor_name=localhost:eth1:2

If you log both Snorts to a database, ACID will count the critical alerts twice. You can search on a sensor to get the counts for just one, but the graphs and shortcuts on ACID's homepage will double up. Techniques similar to those outlined in this article can probably be used to "Double ACID".

Conclusion

What at first appeared to be a tradeoff with no satisfactory middle ground was in fact two separate needs. Double Snorting allows each to be tuned separately. In the process, a more general technique was found for running multiple instances of a daemon. Another application is separate Snorts and logs for separate network segments. I can see adding a Snort to monitor critical traffic inside the firewall, as well as critical and information traffic on the outside — Triple Snorting. I leave that as an exercise for the reader. Enjoy.

UNIX: The Tide of FUD

The Tide of FUD

by Peter H. Salus

Alexis de Tocqueville observed that it is easier for the world to accept a simple lie than a complex truth.

So there's a painful irony when we're forced to recognize the validity of de Tocqueville's remark in a May press release from the head of the Alexis de Tocqueville Institution, Ken Brown.

In fact, Brown has agitated me sufficiently to devote time and space to trying to counter the FUD — fear, uncertainty and doubt — that is being propagated.

Brown released a "study" in which it is "revealed" that Linus Torvalds did not "invent" Linux, which says Brown, has "questionable" roots.

Of course, Ken Brown doesn't go into detail — this whole thing is a teaser for a "book he is writing on open source software and operating systems." As "excerpts" are promised for 20 May, this article may be a preface to a detailed commentary.

[It may be worth noting that the de Tocqueville Institution is, at least in part, funded by Microsoft.]

It's actually quite easy to question Brown's assertions. But most important, one has to realize at the very outset that I don't think Linus has ever claimed to "invent" anything. (Nor am I sure that either Dennis Ritchie or Ken Thompson ever claimed to have "invented" Unix — their 1983 Turing Award was for "the development and implementation of the UNIX operating system.")

Moreover, the roots of Linux are far from "questionable."

Knowledge builds on previous knowledge.

Operating systems build on one another. My personal feeling is that it is relatively pointless to try to go back much more than four decades. But even then, at the point where IBM had transitioned from the 701 to the 704 and was moving from the 709 to the 7090, the first transistorized computer, it is clear that the big development was time sharing.

So, the first truly important implementation was Corbato's CTSS at MIT, which led to both the Multics system and to the Dartmouth Time Sharing System.

Dennis and Ken built Unics (its original name) on their experiences with Multics, following Bell Labs' withdrawal from the Multics project in spring 1969. Many important features (like | "pipe") were suggested by or instantiated by others. Pipe was suggested by Doug McIlroy and coded by Brian Kernighan.

For several years, UNIX was confined to Bell Labs. Then it spread to other parts of AT&T and, following the presentation by Ken and Dennis at the ACM Symposium on Operating System Principles in October 1973 and publication of their paper in CACM in July 1974, to research and academic institutions all over the world.

[I don't want to go into great detail here, but those of you who are interested can read my A Quarter Century of UNIX (1994).]

UNIX received input from folks in Austria (job control) to Australia (port to the Interdata 7/32). A good example is what happened with the editor.

The original UNIX editor was ed, still the most ubiquitous yet user-hostile, editor. When 3rd Edition got to England, George Coulouris, then at Queen Mary College, London, wrote another editor, em (= ed for mortals). George went on sabbatical to UC Berkeley, where a graduate student asked about the editor. George explained em, and went off to the Labs in New Jersey for two weeks.

"When I got back," he told me a decade ago, "the student had rewritten it into a new editor, ex." The student was Bill Joy; ex eventually became vi.

At the 1979 USENIX Conference in Toronto, AT&T announced its new licensing fees, including $7,500 per CPU for academic institutions. This led Andrew Tanenbaum of the Free University in Amsterdam to create Minix.

I decided to write a new operating system from scratch that would be compatible with UNIX from the user's point of view, but completely different inside. By not using even one line of AT&T code, this system avoids the licensing restrictions, so it can be used for class or individual study. (A.S. Tanenbaum, Operating Systems, Design and Implementation, 1st Ed., 1987)

Several years later, a student in Helsinki, Finland, wrote an operating system, "just for fun," which he based on Minix. Linus Torvalds was going to call it "Freax," but his sysad persuaded him to use "Linux."

Linux was just a kernel. It has been, thanks to the near-universality of the Internet, added to and perfected by tens of thousands of users.

So, here we are, Linux is part of a Unix-like implementation of an operating system, inspired by Minix, and using a large number of GNU tools and applications.

Be ashamed, Mr. Brown!

SEC: Valve announces Half-Life 2 code theft arrests

Valve announces Half-Life 2 code theft arrests - PC News at GameSpot

Valve announces Half-Life 2 code theft arrests
By Tor Thorsen -- GameSpot
POSTED: 06/10/04 12:51PM PST

Developer of the much-anticipated and delayed shooter sequel reveals that an international wave of arrests have been made.
The Half-Life 2 code theft saga entered a new chapter today when Valve Software announced that a series of arrests had been made in the case. According to Valve, suspects in several countries had been taken into custody in relation to charges stemming from the theft of the Half-Life 2 code, the distribution of the code, and the break-in into Valve's network.

Valve CEO Gabe Newell credited gamers with providing the information that led to the arrests. “It was extraordinary to watch how quickly and how cleverly gamers were able to unravel what are traditionally unsolvable problems for law enforcement related to this kind of cyber-crime," he said in a statement. "Everyone here at Valve is once again reminded of how much we owe to the gaming community."

However, while Valve announced the arrests today, it was unclear when they actually occurred. Valve's statement on the matter--e-mailed to the press today--quoted Newell as saying, "Within a few days of the announcement of the break-in, the online gaming community had tracked down those involved."

The FBI's Northwest Cyber Crime Task Force, the law-enforcement agency overseeing the code theft investigation, also divulged little information. When asked by GameSpot if it had made any arrests, the media contact at the task force's Seattle, Washington, headquarters said simply, "We did." However, when pressed for more information on the case--such as how many people in the US were arrested, where were they apprehended--the agent declined to say anything other than that arrests had been made. "Beyond that we cannot comment," he said.

News of the Half-Life 2 arrests comes after months of rumors about law-enforcement activity on the case. In January, a number of computer experts in the San Francisco area reported having their hardware seized by FBI agents on the grounds that they were involved in the theft. Several weeks ago, unconfirmed reports from Germany said the author of the Phatbot Trojan worm was also involved in the theft. In both instances, neither Valve nor the authorities offered any comment.

GameSpot will have more details on this developing story as they become available.

PROG: Network functions in C - Tutorial

Network functions in C - Tutorial

BOOK: Thinking in C , 2nd ed. Volume 1

Thinking in C , 2nd ed. Volume 1

LINK: What is Mono?

What is Mono?

--[ BOOK REVIEW: Expert C Programming: Deep C Secrets



# By: Peter van der Linden
# Paperback: 384 pages
# Publisher: Prentice Hall PTR; 1st edition (June 14, 1994)
# ISBN: 0131774298





Book description:


This is a very different book on the C language! In an easy, conversational style, Peter van der Linden, of Sun's compiler and OS kernel group, presents dozens of astonishing examples drawn from practical experience, including:

* Software that blew up the space probe to Venus
* The C bug that shut down the entire AT&T phone system
* C programmer job interview secrets
* Why programmers can't tell Halloween from Christmas day
* The C code for a complete BASIC interpreter

Expert C Programming reveals the coding techniques used by the best C programmers. It relates C to other languages, and includes an introduction to C++ that can be understood by an programmer without weeks of mind-bending study. Covering both the IBM PC and UNIX systems, it is an entertaining and educational romp through C showing how experts really use it. Expert C Programming is a must read for anyone who wants to learn more about the implementation, practical use, and folklore of C.


"Not just clearly written, but fun to read. The tone and style of this text should make this a popular book with professional programmers. However, the tone of this book will make it very popular with undergraduates. Appendix A alone would make the purchase of this book a must. It's filled with great advice."
—Professor Jack Beidler, Chairman, Department of Computer Science, University of Scranton


"So that's why extern char *cp isn't the same as extern char cp. I knew that it didn't work despite their superficial equivalence, but I didn't know why. I also love the job interview test questions on C."
—David S. Platt, Rolling Thunder Computing

"In Expert C Programming, Peter van der Linden combines C language expertise and a subtle sense of humor to deliver a C programming book that stands out from the pack. In a genre too often known for windy, lifeless prose, van der Linden's crisp language, tongue-in-cheek attitude, and real-world examples engage and instruct."
—John Barry, author of Sunburst, Technobabble, and other books


This book is defiantly not geared to the novices in programming and the author does not make any attempt like he is going to target such audience. This is good because far too many books are targeting the beginner and not too many for the intermediate to advanced level. So if you are a newbie this is not a book for you but if you know C then the book is defiantly a good read. The book consists of a collection of many tips and techniques that were left out in some of the books i have read thus far. It also corrects some common mistakes that are found to books to date. Exposing the weaknesses of C might sound a bit harsh for the book on C but i found such chapters interesting to look out for and learn. Expert C programming concentrates on many topics such as syntax style, optimization issues, pointers, arrays, and a wide array of other important topics (please see the table of content bellow). Quite few books try to put humor into serious programming, especially in C programming, this book is filled with humor and as the author said "It put fun back in functions" these humorous jokes (which are labeled as humor as not be confused with factual information) make the book worth enjoying. The humor also make programming fun rather than facts. The book is up to ANSI C standards although the author does criticize the standard for not doing too well on some of the subject on the language. The last chapter teaches you some C++ so you could start programming in C++. The book also describes a great deal of history about C and how it came about.


This book also ranks in the top 5 of the books I have read so far on C programming. this book is not for newbies as stated previously but for the experienced C programmer let it be an intermediate of an advanced C programmer. The book is highly recommended to be on your shelf of cource with other introductory and reference C books. The book gets a 9 out of 10 in my judgment.


--------------------------------------------------------------------
Reviews done by others on the book:

Amazon
Barnes and Noble
ACUU
Slashdot
BYUU Unix Users Group

--------------------------------------------------------------------
Links pertaining to the book:

Sample chapter

--------------------------------------------------------------------


Table of Content:


Introduction xix
The $20 Million Bug xx
Convention xxi
Some Light Relief---Tuning File Systems xxii

1. C Through the Mists of Time 1
The Prehistory of C 1
Early Experiences with C 4
The Standard I/O Library and C Preprocessor 6
K&R C 9
The Present Day: ANSI C 11
It's Nice, but Is It Standard? 14
Translation Limits 16
The Structure of the ANSI C Standard 17
Reading the ANSI C Standard for Fun, Pleasure, and Profit 22
How Quiet is a "Quiet Change"? 25
Some Light Relief---The Implementation-Defined Effects of Pragmas 29
2. It's Not a Bug, It's a Language Feature 31
Why Language Features Matter---The Way the Fortran Bug Really Happened! 31
Sins of Commission 33
Switches Let You Down with Fall Through 33
Available Hardware Is a Crayon? 39
Too Much Default Visibility 41
Sins of Mission 42
Overloading the Camel's Back 42
"Some of the Operators Have the Wrong Precedence" 44
The Early Bug gets() the Internet Worm 48
Sins of Omission 50
Mail Won't Go to Users with an "f" in Their Usernames 50
Space---The Final Frontier 53
A Digression into C++ Comments 55
The Compiler Date Is Corrupted 55
Lint Should Never Have Been Separated Out 59
Some Light Relief---Some Features Really Are Bugs! 60
References 62
3. Unscrambling Declarations in C 63
Syntax Only a Compiler Could Love 64
How a Declaration Is Formed 66
A Word About structs 68
A Word About unions 71
A Word About enums 73
The Precedence Rule 74
Unscrambling C Declarations by Diagram 75
typedef Can Be Your Friend 78
Difference Between typedef x int[10] and #define x int[10] 80
What typedef struct foo { ... foo } foo; Means 81
The Piece of Code that Understandeth All Parsing 83
Further Reading 86
Some Light Relief---Software to Bite the Wax Tadpole 86
4. The Shocking Truth: C Arrays and Pointers Are NOT the Same! 95
Arrays Are NOT Pointers! 95
Why Doesn't My Code Work? 96
What's a Declaration? What's a Definition? 97
How Arrays and Pointers Are Accessed 98
What Happens When You "Define as Array/Declare as Pointer" 101
Match Your Declarations to the Definition 102
Other Differences Between Arrays and Pointers 103
Some Light Relief---Fun with Palindromes! 105
5. Thinking of Linking 109
Libraries, Linking, and Loading 110
Where the Linker Is in the Phases of Compilation 110
The Benefits of Dynamic Linking 113
Five Special Secrets of Linking with Libraries 118
Watch Out for Interpositioning 123
Generating Linker Report Files 128
Some Light Relief---Look Who's Talking: Challenging the Turing Test 129
Eliza 130
Eliza Meets the VP 130
Doctor, Meet Doctor 131
The Prize in Boston 133
Conclusions 133
Postscript 135
Further Reading 135
6. Poetry in Motion: Runtime Data Structures 137
a.out and a.out Folklore 138
Segments 139
What the OS Does with Your a.out 142
What the C Runtime Does with Your a.out 145
The Stack Segment 145
What Happens When a Function Gets Called: The Procedure Activation Record 146
The auto and static keywords 151
A Stack Frame Might Not Be on the Stack 152
Threads of Control 152
setjmp and longjmp 153
The Stack Segment Under UNIX 155
The Stack Segment Under MS-DOS 156
Helpful C Tools 156
Some Light Relief---Programming Puzzles at Princeton 161
For Advanced Students Only 163
7. Thanks for the Memory 165
The Intel 80x86 Family 165
The Intel 808x6 Memory Model and How It Got That Way 170
Virtual Memory 174
Cache Memory 177
The Data Segment and Heap 181
Memory Leaks 183
How to Check for a Memory Leak 184
Bus Error, Take the Train 187
Bus Error 188
Segmentation Fault 189
Some Light Relief---The Thing King and the Paging Game 195
8. Why Programmers Can't Tell Halloween from Christmas Day 201
The Potrzebie System of Weights and Measures 201
Making a Glyph from Bit Patterns 203
Types Changed While You Wait 205
Prototype Painfulness 207
Where Prototypes Break Down 209
Getting a Char Without a Carriage Return 212
Implementing a Finite State Machine in C 217
Software Is Harder than Hardware! 219
How and Why to Cast 223
Some Light Relief---The International Obfuscated C Code Competition 225
9. More about Arrays 239
When an Array Is a Pointer 239
Why the Confusion? 240
Rule 1: An "Array Name in an Expression" Is a Pointer 243
Rule 2: C Treats Array Subscripts as Pointer Offsets 244
Rule 3: An "Array Name as a Function Parameter" Is a Pointer 246
Why C Treats Array Parameters as Pointers 246
How an Array Parameter Is Referenced 247
Indexing a Slice 250
Arrays and Pointers Interchangeability Summary 251
C Has Multidimensional Arrays 251
But Every Other Language Calls Them "Arrays of Arrays" 251
How Multidimensional Arrays Break into Components 254
How Arrays Are Laid Out in Memory 256
How to Initialize Arrays 257
Some Light Relief---Hardware/Software Trade-Offs 260
10. More About Pointers 263
The Layout of Multidimensional Arrays 263
An Array of Pointers Is an "Illiffe Vector" 265
Using Pointers for Ragged Arrays 269
Passing a One-Dimensional Array to a Function 273
Using Pointers to Pass a Multidimensional Array to a Function 273
Attempt 2 275
Attempt 3 276
Attempt 4 277
Using Pointers to Return an Array from a Function 277
Using Pointers to Create and Use Dynamic Arrays 280
Some Light Relief---The Limitations of Program Proofs 287
Further Reading 291
11. You Know C, So C++ is Easy! 293
Allez-OOP! 293
Abstraction---Extracting Out the Essential Characteristics of a Thing 296
Encapsulation---Grouping Together Related Types, Data, and Functions 298
Showing Some Class---Giving User-Defined Types the Same Privileges as
Predefined Types 299
Availability 301
Declarations 301
How to Call a Method 304
Constructors and Destructors 305
Inheritance---Reusing Operations that Are Already Defined 307
Multiple Inheritance---Deriving from Two or More Base Classes 311
Overloading---Having One Name for the Same Action on Different Types 312
How C++ Does Operator Overloading 313
Input/Output in C++ 314
Polymorphism---Runtime Binding 315
Explanation 317
How C++ Does Polymorphism 318
Fancy Pants Polymorphism 319
Other Corners of C++ 320
If I Was Going There, I Wouldn't Start from Here 322
It May Be Crufty, but It's the Only Game in Town 325
Some Light Relief---The Dead Computers Society 328
Some Final Light Relief---Your Certificate of Merit! 330
Further Reading 331

A. Appendix: Secrets of Programmer Job Interviews 333
Silicon Valley Programmer Interviews 333
How Can You Detect a Cycle in a Linked List? 334
What Are the Different C Increment Statements For? 335
How Is a Library Call Different from a System Call? 338
How Is a File Descriptor Different from a File Pointer? 340
Write Some Code to Determine if a Variable Is Signed or Not 341
What Is the Time Complexity of Printing the Values in a Binary Tree? 342
Give Me a String at Random from This File 343
Some Light Relief---How to Measure a Building with a Barometer 344
Further Reading 346

Index 349

SEC: Microsoft game for plugging two security flaws

Microsoft game for plugging two security flaws - silicon.com

Microsoft game for plugging two security flaws
Robert Lemos
CNET News.com
June 09, 2004

Microsoft released two security patches for its Windows operating systems on Tuesday, plugging holes in an online gaming feature and a third-party program the company includes with several applications.

One patch fixes a problem in the DirectPlay network gaming functionality of DirectX, which enables games that support the feature to offer head-to-head match ups over the internet. The security issue could enable an attacker to disrupt the connection and crash the game.

The second patch solves a security problem with the Crystal Reports Web Viewer, a third-party product included with Visual Studio .Net 2003, Outlook 2003 with Business Contact Manager, and Microsoft Business Solutions CRM 1.2. The flaw could allow for a denial-of-service attack or give an attacker access to information on the computer.

The two flaws are ranked as "moderate," the software giant's second-lowest grade for security vulnerabilities.

Stephen Toulouse, security program manager for the company, said: "Even if it is not software that Microsoft has written, it is software that Microsoft has provided, so we are issuing a fix."

The two software updates bring the total number of bulletins issued by Microsoft to 17 in 2004, though the actual number of vulnerabilities fixed by the patches is much higher.

Microsoft released patches for a score of flaws in mid-April, but the fixes did not prevent the Sasser computer worm, released to the internet 17 days later, from spreading.

The latest flaws can't be used by attackers to gain control of computers, so they can't be used by a worm writer to create a Sasser-like program.

The network-gaming flaw only affects games that use Microsoft's free peer-to-peer gaming system rather than the client-server architecture used by many multiplayer games, such as the Quake and Unreal Tournament series. The flaw is present in Microsoft's consumer desktop operating systems - including Windows 98, 98SE, ME, 2000, XP and XP 64-bit - and also affects Windows Server 2003.

"The game could either crash or the UI (user interface) might become unresponsive," Toulouse said.

The Crystal Reports Web Viewer allows users to view and modify documents created with Business Objects' Crystal Reports application. The vulnerability in the viewer could allow an attacker to delete and modify files on the victim's system.

The software giant also used the monthly update cycle to revamp its security website by collecting its scheduled monthly updates in the same place and adding an RSS (Really Simple Syndication) feed of security bulletins to its site.

Robert Lemos writes for CNET News.com

SEC: Internet Explorer carved up by zero-day hole

Computerworld | Internet Explorer carved up by zero-day hole: "Kieren McCarthy, Techworld.com 09/06/2004 08:28:25Two new vulnerabilities have been discovered in Internet Explorer which allow a complete bypass of security and provide sy"

Kieren McCarthy, Techworld.com

09/06/2004 08:28:25

Two new vulnerabilities have been discovered in Internet Explorer which allow a complete bypass of security and provide system access to a computer, including the installation of files on someone's hard disk without their knowledge, through a single click.

Worse, the holes have been discovered from analysis of an existing link on the Internet and a fully functional demonstration of the exploit have been produced and been shown to affect even fully patched versions of Explorer.

It has been rated "extremely critical" by security company Secunia, and the only advice is to disable Active Scripting support for all but trusted websites.

The discovery stems from Dutch researcher Jelmer who was sent an Internet link which he was warned used unknown Explorer vulnerabilities to install adware on his computer. He found it did and embarked on a detailed analysis of the link, which demonstrates an extremely sophisticated use of encrypted code to bypass the Web browser's security.

In simple terms, the link uses an unknown vulnerability to open up a local Explorer help file -- ms-its:C:\WINDOWS\Help\iexplore.chm::/iegetsrt.htm. It delays executing anything immediately but instead uses another unknown vulnerability to run another file which in turn runs some script. This script is then used to run more script. And finally that script is used to run an exploit that Microsoft Corp. has been aware of since August 2003 but hasn't patched.

That exploit -- Adodb.stream -- has not been viewed as particularly dangerous, since it only works when the file containing the code is present on the user's hard disk. The problem comes in the fact that the Help file initially opened is assumed to be safe since it is a local file and so has minimal security restrictions.

By using the unknown exploits, code is installed within the help file window, all security efforts are bypassed, and the Adodb.stream exploit is then used to download files on the Internet direct to the hard disk.

What this means in reality is that if you click on a malicious link in an email or on the Internet, a malicious user can very quickly have complete control of your PC. And there is no patch available. You can see it happen by click here.

With the code already available on the Net, this is effectively a security nightmare ... unless you're a Mozilla or Opera user that is.


SEC: Search finds new holes in open source tool

Computerworld | Search finds new holes in open source tool: "Paul Roberts, IDG News Service 10/06/2004 08:09:47A close investigation of a common open source tool has uncovered more critical security holes in software used by developers t"

Paul Roberts, IDG News Service

10/06/2004 08:09:47

A close investigation of a common open source tool has uncovered more critical security holes in software used by developers to track and manage changes in computer code.

Six vulnerabilities were discovered in the Concurrent Versions System (CVS), which is used to manage code on a number of leading open source software development projects. CVS is also used by organizations developing proprietary software. The holes could enable remote attackers to launch denial of service attacks or run malicious code on systems hosting vulnerable versions of CVS, according to an alert published by e-matters GmbH.

Word of the new vulnerabilities comes just two weeks after another security hole in the software was used to hack the CVS project Web site. That compromise prompted an investigation of the CVS computer code, which revealed the latest holes, according to e-matters.

While some of the new vulnerabilities require a valid CVS user or administrator login to use, others can be exploited remotely and with few privileges on the vulnerable system, said David Endler, director of digital vaccine at TippingPoint Technologies Inc., which makes network intrusion prevention systems.

In particular, a vulnerability in a CVS function called "double-free()" was used to exploit a number of systems running the Linux operating systems, according to the e-matters alert.

"I wouldn't be surprised to see an exploit for the double-free vulnerability within the next few days," Endler said.

The CVS project released a software update fixing the holes, including the three discovered by e-matters researcher Stefan Esser. There is no evidence that the new holes have resulted in attacks. However, once security holes are announced, a race begins between organizations that need to patch their systems and hackers eager to take advantage of the vulnerability, Endler said. That is especially true of open source code projects, where the raw code that underlies products is in the public domain, he said.

The news of vulnerabilities in the CVS product has raised concerns about the security of open source projects, many of which have been breached by hackers in recent years. In October, 2002, for example, a Trojan horse program was discovered in some distributions of the open source Sendmail e-mail software. In August, 2003 the Free Software Foundation, sponsors of the GNU free software project, said that a key server housing the group's Linux software was broken into by a malicious hacker.

Open source development projects rely on the assumption that the platforms people use to collaborate on the development are secure. Vulnerabilities in the CVS product and hacking of CVS project resources invariably cause people to wonder whether the products developed using CVS might also have unknowingly been compromised by hackers, Endler said.

LINUX: A tutorial on vim (1 of 3 parts)

A tutorial on vim (1 of 3 parts) | Linux Gazette

Submitted by omnarasimhan on Wed, 06/02/2004 - 21:45. General Interest | How-to | Quick Tips & Newbies | Making Linux a little bit more fun!

Editing with vi can be a nightmarish experience for newbies of unices. But it is one of the most popular editors in the unix world, and nearly all unix boxes are equipped with some variant of vi. Vim is a widely popular clone of vi. Developed by Braam Moolenaar, vim has been ported to a wide number of platforms including Microsoft windows, all flavors of Unices, amiga, mac... etc. Gvim is the graphical front end of vim. This article aims to take that fear out of a newbie and give some editing tips to increase the productivity of an intermediate/advanced vim user.
This article is devided broadly into 2 sections.

* Moving around in the file quickly
* Text manipulation commands

Being myself a programmer/administrator, I have written these sections to detail the commands I use most and find most conveneient. I am sure you will find these commands very useful and this will prompt you to throttle the full power of vim and thus become a power user. Conventions used in this article:

Whenever a command is referred to, unless stated explicitly, the editor is assumed to be in the command mode. The special characters like or are the corresponding keys in the keyboard. ctrl-omeans pressing the 'o' when control key is pressed. Similarly Alt-m means pressing Alt key and hitting 'm' , without quotes.

Movement commands


Marks
Marking and jumping is the most easy and powerful way of moving around in an opened file. Marking is the process of storing the current cursor location into a 'mark'. The letters `A` through `Z` and `a` through `z` are used for placeholders of marks. To store the current position of the cursor, do
:m,
(without <>), where is anything a through z or A through Z, written as [a-zA-Z] in regular expression format. Numbers cannot be used as placeholders for marks.
Example :
:mA
will store the current position of the cursor to the mark A. To visit the location stored in any of the mark variable, press '(single quote) followed by the mark variable.
Example :
:'A will take you to the marked location A.
This will take the cursor to the line contained in the mark variable. To go to the exact location of the cursor, instead of single quote use `(reverse quote) followed by mark variable.
Example :
:`A
will take the cursor into the exact line and column of the mark A To see all the marks in the file, type in
:marks
Text manipulation commands (explained shortly after) can be combined with marks and then only the full potential of this powerful mechanism can be understood.

Movement commands with cursor fixed on a line.
Page movement commands explained in the box will change the cursor position along with the screen contents. There are a couple of commands which make the cursor stand on the same line and then move the screen forward and backward relative to the cursor position. ctrl-e will make the whole screen scroll up by one line, maintaining the cursor position at the same line. (of course, unless you are at the top line of the screen). ctrl-y does the same thing in opposite direction. Both of them can be preceded by a number N. So to scroll up 10 lines, in command mode press 10ctrl-e

Movement by screen with cursor fixed on a line
z. will take the line to the middle of the screen
z will take the line to the top of the screen
z- will take the line to the bottom of the screen
z+ will keep the line below window on the top of the window, and move the cursor there.

Moving to any line.
G (stands for Goto) will take the cursor to the last line.
:$ will also do the same. If you want to go to line number N, either you can press Ngg or :N . 1gg as well as 1 will take you to the first line. The difference is Ngg will mark the current line and :N will not do that. So you can come back to the same line by pressing '' (i.e two single quote marks) or `` (two reverse quote marks) after you issue Ngg Now you might wonder what will happen if you press 0gg or :0 . These commands will also take you to the beginning of the file, even though 0 is not a valid line number.

Movement within a line.
To go to any column you can use N| where N is the column number. To find a character in the line from left to right use fX , where X is the character to find. FX will find it from right to left. To repeat the last find in line, press ; (semicolon) and to repeat it with reverse direction press , (comma). F and f can be combined with a count. For example to find the 4th occurrence of the letter E from the current cursor location left to right, 4fE can be used. Another very useful command for finding in the line is t and T . This will take you to the character before the one you want to find. For example, tX will place the cursor one char before the first occurrence of X in the same line from left to right. T will do it in the reverse direction taking the cursor to the character after the one you want to find. These commands can also be given a count as F or f. Again the power of these commands will become evident once you know how to combine them with text manipulation commands, dealt shortly after.


Movement by searches
You can move from one line to another by searching for a pattern. To search for a pattern, simply press / (forward slash). Cursor will be taken to the last line and you can type in the pattern you want to search. The search will be performed from the current line position of the cursor to the end of the file. If you want to perform a search from current line to the beginning of the file, you have to press ? and pattern. Searches are case sensitive. Example.
/this pattern
will search for 'this pattern' (without quotes, with space) in the forward direction.
?this pattern
will search for this pattern in reverse direction
If you want to search the same pattern again you can use N or n . N will search in the same direction as the last pattern search whereas n will search in the reverse direction.

Movement by matches:
If you are a C/C++/Java programmer, you certainly have faced the problem of matching brackets, especially in large multiline if (...) conditions. In vim, there is a short cut for matching brackets, i.e. ( with ), { with } [ with ] you can place the cursor under any of them and press shift-5 (% sign). You will be taken to the matching bracket. But every time doing this is a pain. So you can get vim match the opening bracket every time you close a bracket. for that
:set showmatch
Whenever you close a bracket, the cursor will briefly jump to the matching open bracket. So if it does not jump, you can be sure the one you just put is redundant (vim will beep too! :-)

Text manipulation commands
The basic text manipulation commands are cut, copy and paste. In vim, copying is called yanking (without buffer modification), delete (with buffer modification) and pasting (with bufer modification). The commands (as you have guessed) are y , d and p .
The power of vi primarily derives from its ability to combine the different text manipulation commands to movement commands. Let's start with the basics. Combining text manipulation with basic movement commands:
To copy a word, yw (read yank word)
To delete a word, dw (read delete word)
To paste a yanked/deleted word on to the curosr location press p . (not pw, because pasting depends on what you have delete earlier)
If you delete or yank some text object, then it will be stored in the unnamed register " . Any further deletion/yanking will overwrite this unnamed register. Please see the box item for a detailed know-how of registers.

Text manipulation commands can be entered from the last line mode also. If you are combining text manipulation commands with ranges (see box), this form is very much useful. To copy a range of lines (say, 20 to 50) into named register z, the command should be
:20,50 y z
To paste (put) the contents of register z before a line number:
:[line] pu z
line is optional, omitting line will put before the current cursor position. Also, omitting the register name will put the contents of unnamed register.
From now onwards, I will simply use the command delete for examples. These are valid for copying also.
e.g. To delete a whole file, you can issue
:1,$ d or
:% d
To delete from current line to the end of the file you can use
:.,$ d Dot (.) character is a shortcut for current line when it appears in a range. To copy lines from beginning of the file to current line to 8 lines after the current line use
:1,.+8 y
You need not do the yank/paste operations explicitly. You can use 'copy' command ( co and t are the shortcut for this) on the last line mode. Say you want to copy the current line to the end of the file.
:. co $
For moving ,
:. mo $
To move a range of (say 20 through 30) lines of a file to the end of the file,
:20,30 m $
Now as an exercise, guess what the following command does?
:$ m 0
Say you have marked two file postions in a file in marks x and y. You want to delete all the text between these two marked lines, what can be the command?

'xd'y
This command works as follows:

'x will take the cursor to the line of mark x, d'y will delete the text objects from that line to the line contained in mark y. Try doing such things in some other windows based editors. That is the power of vim. Say you want to copy the contents of one C funtion into a register x. After placing the cursor on the opening { of the function, the command for this action is "xy% . % is the movement command matching braces, y will operate on this command to copy the text objects till the matching brace, and "x will copy the succeeding yank operation into register x.
To delete the parameters of a function,

int function (type1 param1, type2 param2);
while keeping the brackets intact, let's try a vim method. Assuming you have placed the cursor at column 0 of the above line, and are in the command mode, type:
3ftdt)
We can split the above command to 3ft and dt). ft will find the character t from left to right. When preceded by number N, it will find the Nth (here 3rd) occurrence of `t` in the line, that is just after opening bracket. t) will move the cursor one character before ) character. Now d will delete the following text objects, which is t), that is all characters till closing brace, ) excluded.

Combining searches with text manipulation
You already know how to search for a pattern using / and ? . To delete from the current line till the pattern "This pattern" (without quotes), issue,
d/This pattern
To yank from current line till the pattern "That pattern" into named register `a`,
"ay/That pattern

Now you know how to use the movement and text manipulation commands to get your editing chores. Some of you might think it is difficult to remember all the commands explained above. But from my own experience as a vim user, spending time to remember some basic commands will help you achieving tremendous improvements in productivity. In the part two and part three of this article, I will make your editing with vim much easier and productive by explaining multifile and multiwindow editing, regular expressions and editing automation using vim. Happy vimming!!


A recapitulation of basic vi commands.
h -> leftmost key for right hand, for movement to left.
j -> goes down, for downward movement.
k -> goes up, for upward movement.
l -> rightmost key for right hand, for movement to right.
w -> move forward by a word (sequence of letters, digits and underscores)
W -> move forward by a WORD (sequence of non blank characters.)
b -> move backward by a word
B -> move backward by a WORD
e -> Move to the end of word
E -> Move to the end of WORD

ctrl-d: Scroll half window down in the buffer viewed.
ctrl-u: Scroll half window up in the buffer viewed.
ctrl-f: Scroll window down in the buffer viewed
ctrl-b: scroll window up in the buffer viewed.

All of these commands operate on vim text objects, so can be preceded by number of objects to operate like:

10ctrl-D will take 10 half pages down

i -> Change the mode to insert mode.
I -> change the mode to insert mode, and place the cursor at the first character of the line.
$ -> move to the end of line.
^ -> move to the beginning non blank character of a line.
0 -> (zero) move to the beginning of a line.
o -> (small o)open a line down the cursor position
O -> (capital O) open a line above the cursor position.
M -> takes the cursor to the middle line of screen
H -> Takes the cursor to Top line of screen
L -> Takes the cursor to the bottom line of screen


Ranges.
Many of the last line mode commands operate on ranges , that is a number of lines, especially the text manipulating ones. The range on which the command operate can be expressed in three ways.

* Absolute ranges :
e.g. from line 3 to line 30. This will be typed in as
:3,30
e.g. To delete line 3 to 30, you can issue
: 3,30 d

* Relative ranges :
End of the range is expressed relative to the beginning. In this absolute range 3-30 lines is expressed as
:3,+27
e.g. To delete line 3 to 30, you can also issue
:3,+27 d

* Shortcut ranges:
There are short cuts for expressing ranges. For example $ represent last line of the file in ranges. e.g.
: 1,$
means line 1 through the last line of the file.


This is very useful when you paste text and don't know the number of lines in the file. Another shortcut for the whole file is % . The dot character ( . )represents current line as a part of range. To work on ranges, it would be better to display the line numbers. The command for that is:

:set number
To disable line number display,
:set nonumber
There are many commands working on ranges. For example, to write part of a file , say line 6 to line 130, to another file, say partfile.ext, you can use
:6,130 w partfile.ext
To join line 30 to 45 in a file,
:30,45 join

What was that command I just typed in ?
I have already mentioned that many of the commands explained above can be preceded by the number of text objects to operate on. But then there exists a problem. How can I know whether I pressed 10 or 100 before issueing a dd (line delete)? If you want so, gvim to print your keystrokes in the status line when you are in command mode enable showcmd option by entering
:set showcmd
Once you do this, in the command mode any key with no action is associated will be printed in the status line.

Registers
Even though there are 9 types of registers used for various purposes, only 3 types are of interest to us currently.

* The unnamed register - ""
* Vim automatically fills this register whenever (hmm.. not really, but does not matter) a deletion (using c , d or x keys) or yank ( y key) takes place. Numbered registers : 0 through 9
* Vim fills them up whenever a yank or deletion takes place. 0 will contain most recent deletion/yank, 1 second latest ...etc. unless the yank command use some other register explicitly. Vim automatically shifts the contents of 0 to 1, 1 to 2 ..etc when qualifying deletion happens. To paste from any of them, "Np , where N => 0 through 9 Named registers : a-z or A-Z, case insensitive
Filled up only when explicitly done so. To paste from any of them "Xp , where X is a-z or A-Z . If you give "a3dw , it will delete 3 words into register a as well as register " (unnamed register), "a3yw will copy the 3 words. if you use the command "zdd ,it will delete the current line to the z register as well as the unnamed register. If you replace dd with yy then, instead of deleting, yanking will take place.



About the author The author has been working in the linux world for the last 6 years. He can be reached at remove_this_omanakuttan (at) vsnl (dot) net

PROG: How an idea becomes a C# language feature?

How an idea becomes a C# language feature?: "In a recent email, a customer asked for a delegation feature. He wanted to do something like (purely theoretical syntax): class MyClass: ITest { MyHelperObject o: ITest; }so that"

In a recent email, a customer asked for a delegation feature. He wanted to do something like (purely theoretical syntax):

class MyClass: ITest
{
MyHelperObject o: ITest;
}

so that he could delegate the implementation of the interface to a helper object, and have the compiler automatically generate the interface implementation methods.

My response was that we had talked about this several times in the past, but hadn't been able to come up with a syntax that worked well.

This is a not uncommon state for us - on several occasions in the Whidbey (excuse me - “Visual Studio 2005”) design process, we tried to come up with a syntax that allowed the user to declare a trivial property (backing store, trival getter and setter) with one bit of syntax, but weren't successfull.

I thought I'd talk about that process to give you some insight on how we approach things. I can't be exhaustive with all of our considerations, mostly because we don't really operate that way (there isn't a set checklist). If you have a question on a specific feature, I am happy to consider talking about other features and decisions - see the “suggest a topic” hard link on my main page. Just note that my success rate on actually covering such topics is not exemplary. Also note that I make no attempt to answer questions in the order asked.

The process is fairly organic, in that the steps I list don't happen sequentially, and they are often iterative. Despite the length of this post, I've simplified what goes on significantly.

Sniff Test

We start with what I'm going to call the “Sniff Test“, which is basically the highest level triage to determine if we think such a feature is something we would ever consider for C#. Some features fail because they don't fit the language philosophy, some fail because there's no way we could ever express them in syntax.

Scenario Exploration

Our next level of attack is looking at what user problem we're trying to solve. This typically involves us writing down (or up, on the whiteboard) the code that users are currently writing. Sometimes this is limited to the most common scenario, sometimes we'll cover several scenarios - it all depends on what we need to know. This often happens iteratively with the next step.

Syntax Iteration

If we've gotten to this step, we're usually fairly convinced that there is a user need. We don't yet know if there is a language solution to that need. In this step, we'll start talking about what we could do in the language to make the developer's life easier.

This step typically works with Anders writing on the whiteboard while the rest of the design group gives suggestions and feedback. When we hit on a promising approach, we'll explore it for a bit to see where it leads us, contrast it to other approaches we could take.

In this step, we're asking questions such as:

* Does this new syntax cover the important scenarios?
* Does it really make the user's life easier? (new syntax is not a panacea - each new feature adds complexity)
* Is this syntax unambiguous? Is it possible for the parser to correctly deal with this new feature in the presence of all existing features? (this is a very limiting area)
* Would this be a breaking change for existing users? (Adding new keywords are examples of breaking changes, but it's also common for new language ambiguities and/or differences in behavior to show up because of new features)
* Does this feature fit the philosophy of the language?
* How will this impact tools? Can IntelliSense deal with this?
* Is this a language feature, or would it be better done through an API, or through the IDE?
* How have other languages approached this? Has their approach been successful?
* Does this require new features in the runtime?
* Does this require work in by other languages?
* What Microsoft teams would use this? Are they on board to use it?

In a single session, we will sometimes decide to do a feature and sometimes decide to not do a feature, but more typically we'll decide that we need to discuss it more. We go away and think about it, gather feedback from the people who read our language notes and those closest to the scenario, and then revisit it in a future meeting. A lot of the iteration is around exploring all the corner cases (some of which don't come up until implementation) and making sure the feature is well defined, still does what we want it to do, and still is in the best interests of the developer.

It's not uncommon for us to change our minds on the details of a feature, or even to decide upon reflection that we need to either reduce or eliminate a feature.

Structured Feedback

If we've gotten to this point, we're fairly sure that we want to have the feature, and typically have an implementation (though not always). We use feedback with the C# Customer Council (a small group of customers who we work closely with), and the C# MVPs (we've done a little with the MVPs in the past, we'll be doing more in the future) to see what their perspective is on the feature.

This is also the point where we work with the ECMA standards body to talk about our proposal, though it's often difficult to align the schedules of the standards body with product milestones.

There may also be internal Microsoft presentations at this point, depending on the feature.

Many times the feedback is positive, but sometimes it causes us to refocus the feature, and there have been language features that we cut due to feedback at this point.

Manufacturing and Shipping

If we've gotten this far, the feature is in the language, and often implemented. The remainder of the work is to polish the implementation, finish the testing (sometimes testing is concurent with implementation, sometimes it lags a bit - it depends on the type of feature and our resource constraints), do the spec, and discuss how we'll be presenting it to customers.

posted on Tuesday, June 08, 2004 9:54 AM

LINUX: Understanding Fear of the Gnu

Understanding Fear of the Gnu :: osViews | osOpinion :: Tech Opinions for the People, by the People: "Contributed by: Wesley Parish :: Open Content''Open source software is a serious threat to all that is good and true and right in this country.' Not surprising and easily dismisse"

Contributed by: Wesley Parish
:: Open Content

"'Open source software is a serious threat to all that is good and true and right in this country.' Not surprising and easily dismissed as anti-GNU (GNU's not Unix) rhetoric from a company that is running scared, but the issues are much older, wobblier and more complex than "Windows good, Linux bad." Wesley Parish submitted the following editorial to osOpinion/osViews which explores the use of GNU software from the perspective than many large businesses might take before taking the plunge."
--

'Open source software is a serious threat to all that is good and true and right in this country.' Not surprising and easily dismissed as anti-GNU (GNU's not Unix) rhetoric from a company that is running scared, but the issues are much older, wobblier and more complex than "Windows good, Linux bad."

The threat to innovation must be seriously considered. If GNU-ware can be used effectively in place of applications that cost hundreds or even thousands of dollars, how can serious software companies hope to compete? Huge financial and intellectual resources are being drawn away from industry by open source freeware.

Yet, upon examination, what other conclusion can be reached than that the industry is grossly over-pricing its product? Innovation largely seems to consist of adding a lot of gadgetry and minimum performance. Very often, the superficial improvements detract from performance and/or efficient use, over which the user is given little control in applications delivered as unified packages.

With the source code available, it is possible in theory at least to adapt software to the needs and wants of the individual, possibly even as far as making impromptu incremental adjustments by modifying the source and remaking the application.

Waiting For Bug Reports

An open source system does raise some interesting questions about security. If the source for the system is public, some argue that any flaw in its armor may be uncovered by studious and diligent hackers for possible exploitation.

But with source handy, a kernel might also be altered to make it unfamiliar to a potential invader, perhaps as simply as by misidentifying its flavor. Here an Information Systems manager, assuming limited coding skills, must rely on his or her programming staff to effect acceptable changes without "back doors" or else contract consultants to validate the source.

Total security may well be an impossible goal, but it seems as though being able to find out exactly how a system behaves by examining the source is better security than waiting for the vendor's bug reports.

Copyright Conundrum

The danger to intellectual property is the most serious concern. Aside from the issue of patents and licenses, there is the issue of digital content and copyrights. If the entertainment industry wants to make content available in far more cost-effective and reliable digital formats, they will want to feel comfortable that their capital resource is not being improperly distributed by parties who have no respect for the financial engine that sustains production.

In an open source environment, it becomes increasingly difficult for entertainment providers to establish effective and viable security measures, especially in the face of relentless reverse engineering and code sharing.

Creative Drain

One might argue that the entertainment industry has become mired in its business model, forsaking creativity for the same pap that it has known in the past to be profitable, and deserves a rude slap in the face to wake it up.

But such ideas, no matter how valid they might be, do nothing to improve the standing of the open source movement. Short of the loss of access to a large fraction of available content, there is little middle ground to be found as long as the ethos of honor continues to evaporate all around us.

Lessons Lost

Can the GPL (general public license) be declared invalid and illegal in court? That is a question that can only be answered after the arguments have been played out. With so much open source software so widely available, from chess programs to server systems, it is difficult to imagine what kind of sweeping action would be required to suppress it and how that would affect the price of development applications.

Perhaps an analogy can be drawn to labor's struggles a century back, never fully resolved, resulting in far more loss than gain and with any luck, a lesson we will not have to relearn. ::

SEC: Europe 'near agreement' on cybercrime fight

Europe 'near agreement' on cybercrime fight - ZDNet UK News

SEC: Russia and China 'behind current spam deluge

Russia and China 'behind current spam deluge': ZDNet Australia: Insight: Toolkit: Security: Systems Management


Graeme Wearden, ZDNet UK
June 09, 2004
URL: http://www.zdnet.com.au/news/security/0,2000061744,39150051,00.htm


As hardcore criminals step up their spamming, experts believe that nine out of 10 of all e-mails may soon be unsolicited junk.

Organised criminals based in Russia are fuelling the rise in the amount of spam sent over the Internet, according to a leading opponent of junk mail.

Steve Linford, director of The Spamhaus Project, warned on Tuesday that these gangs are supplying US-based spammers with details of compromised PCs that can be used to send out their unsolicited commercial messages, and creating viruses that will create more of these open proxies.

"There is a new level of criminality in the spamming world," Linford told the Openwave Messaging Anti-Abuse conference in London. "Russian gangs are creating viruses and proxies and selling them onto US spammers."

According to Linford, these Russian gangs aren't constrained by any anti-spam or cybercrime laws in their home country and have no respect for legislation implemented in other countries.

Linford also told the conference that some 70 percent of spam is sent from China by American spam outfits who are hosting their servers with Chinese ISPs. In many cases the spammers have set up firewalls so that the ISPs can't actually see what's being hosted.

"We keep battling with Chinese ISPs who don't understand what we are complaining about," said Linford, whose organisation run a number of blacklists in an attempt to prevent spammers sending their wares out onto the Web.

Estimates vary for the extent of the spam problem, with MessageLabs reporting on Tuesday that 76 percent of the emails it scanned in May were spam -- a greater percentage than ever before.

Linford, who was scathing about the anti-spam laws that have been brought in by the British and American governments, believes that this trend will probably continue.

"While the UK and US put the concerns of the direct marketing industry ahead of the interests of citizens, this problem will continue to get worse. Unless things change drastically, we predict that 80 percent of email will be spam by December this year, and it's very likely to go to 90 percent by this summer," Linford warned.

LINUX: SysAdmin to SysAdmin: Using Jabber as a log monitor

Linux.com | SysAdmin to SysAdmin: Using Jabber as a log monitor

LINUX: Creating custom keyboard layouts for X11 using XKB

Linux.com | Creating custom keyboard layouts for X11 using XKB

Newsflash: SCO Says Sun Can't GPL Solaris Without Its Permission (LinuxWorld)

Newsflash: SCO Says Sun Can't GPL Solaris Without Its Permission (LinuxWorld)

Summary
SCO, which announced recently that its 2nd Fiscal Quarter 2004 earnings release and investor conference call, previously scheduled for June 2, 2004, has been delayed until June 10, has gone onto the offensive against Sun's announcement last week that it intends to open-source Solaris. Sun could not just release Solaris under the GPL, says SCO, since Solaris is based on Unix System V, the source code to which is owned by The SCO Group.


By LinuxWorld News Desk

# Sun: "Make No Mistake, We Will Open Source Solaris"

"Sun has broader rights than any other Unix licensee," acknowledged SCO Group marketing manager Marc Modersitzki, in an interview today, "[but] they still have licence restrictions that would prevent them from contributing our licensed works wholesale to the GPL."

In other words, Sun can't open source Solaris, as announced/leaked last week (Jonathan Schwartz: "Make no mistake, we will open-source Solaris."). Not under the GPL and without reference to its Unix System V license with SCO, anyhow.

Sun has yet to comment today on SCO's statement, but Sun's Open Source Programs Manager Danese Cooper has in the meantime blogged very enlightingly on the whole subject of the Sun announcement - from Shanghai, by president and COO Jonathan Schwartz - in the first place.

"This whole business of 'leaking' information is fascinating to me," Cooper writes. "This story has actually been 'leaked' at least 3 times that I know of already: First by Anil Gadre all the way back in January of 2000 in the Wall Street Journal (so long ago that I can't find a link for it), then again in 2002 in interviews with Rob Gingell and most recently last December by Jonathan Schwartz."

"So, what's going on with all this leaking?" she asks rhetorically.

Here is her own answer to the question:

"At companies I've worked for I've seen executives 'leak' news when they wanted to test the waters, both inside and outside a company. You might ask why they don't just file a regular story? Well, leaks are interesting. It feels like you're learning something you're not supposed to know. In my experience executive 'leaks' are almost never unintentional, however.

In the old days at Apple (before Steve Jobs came back), MacWeek and similar magazines devoted whole columns to handling leaks put out with varying degrees of intention by product groups. In fact those columns were the best way for Apple employees to find out what was going on because internal communication was terrible. If your "rumor" got published the magazine sent you a coffee mug (which you could only use at home, although I remember one gutsy product manager who used his at work)! Reaction to well-placed rumors helped many an executive decide what to do. If the reaction was disastrous, it was only a leak after all."

"So, I always remember that there are two audiences for every leak," Cooper concludes, "The public and the private (company internal) audience reaction to a given piece of news may be very different."

"'Leaking' helps gauge reaction and helps close the gap when internal and public opinions don't match and helps move a decision along," she continues. "This is a reality of doing business today in hi-tech. Change is hard and almost nobody likes it. Getting used to the idea of a big change is sometimes best handled in small (leaky) increments."

Perhaps SCO will take a leaf out of the Danese Cooper book, and 'leak' what it expects Sun to do in response to its objections to any notions of one day releasing the source of Solaris unde

GOOGLE: Google mulls RSS support

Google mulls RSS support | CNET News.com

UNIX: Solaris 10 Operating System - Preview

Solaris 10 Operating System - Preview

LINUX: The Fast-Food Syndrome: The Linux Platform is Getting Fat

The Fast-Food Syndrome: The Linux Platform is Getting Fat - OSNews.com

By Bob Marr - Posted on 2004-06-10 05:48:42
at OSNews [http://www.osnews.com/]

Consider these memory requirements for Fedora Core 2, as specified by Red Hat: Minimum for graphical: 192MB and Recommended for graphical: 256MB Does that sound any alarm bells with you? 192MB minimum? I've been running Linux for five years (and am a huge supporter), and have plenty of experience with Windows, Mac OS X and others. And those numbers are shocking -- severely so. No other general-purpose OS in existence has such high requirements. Linux is getting very fat.

Linux Needs Diet, Page 1/2
I appreciate that there are other distros; however, this is symptomatic of what's happening to Linux in general. The other mainstream desktop distros are equally demanding (even if not as much as Fedora, for example Arch Linux or Slackware run Gnome on 128 MB, but not very comfortably when you load 2-3 apps at the same time), desktops and apps are bloating beyond control, and it's starting to put Linux in a troublesome situation. Allow me to elaborate.

A worrying tale

Recently, a friend of mine expressed an interest in running Linux on his machine. Sick and tired of endless spyware and viruses, he wanted a way out -- so I gave him a copy of Mandrake 10.0 Official. A couple of days later, he got back to me with the sad news I was prepared for: it's just too slow. His box, an 600 MHz 128MB RAM system, ran Windows XP happily, but with Mandrake it was considerably slower. Not only did it take longer to boot up, it crawled when running several major apps (Mozilla, OpenOffice.org and Evolution on top of KDE) and suffered more desktop glitches and bugs.

Sigh. What could I do? I knew from my own experience that XP with Office and IE is snappier and lighter on memory than GNOME/KDE with OOo and Moz/Firefox, so I couldn't deny the problem. I couldn't tell him to switch to Fluxbox, Dillo and AbiWord, as those apps wouldn't provide him with what he needs. And I couldn't tell him to grudgingly install Slackware, Debian or Gentoo; they may run a bit faster, but they're not really suitable for newcomers.

Now, I'm not saying that modern desktop distros should work on a 286 with 1MB of RAM, or anything like that. I'm just being realistic -- they should still run decently on hardware that's a mere three years old, like my friend's machine. If he has to buy more RAM, upgrade his CPU or even buy a whole new PC just to run desktop Linux adequately, how are we any better than Microsoft?

Gone are the days when we could advocate Linux as a fast and light OS that gives old machines a new boost. BeOS on an ancient box is still faster than Linux on the latest kit. And to me, this is very sad. We need REAL reasons to suggest Linux over Windows, and they're slowly being eroded -- bit by bit. Linux used to be massively more stable than Windows, but XP was a great improvement and meanwhile we have highly bug-ridden Mandrake and Fedora releases. XP also shortened boot time considerably, whereas with Linux it's just getting longer and longer and longer...

Computers getting faster?

At this rate, Linux could soon face major challenges by the upcoming hobby/community OSes. There's Syllable, OpenBeOS, SkyOS, ReactOS and MenuetOS -- all of which are orders of magnitude lighter and faster than modern Linux distros, and make a fast machine actually feel FAST. Sure, they're still in early stages of development, but they're already putting emphasis on performance and elegant design. More speed means more productivity.

To some people running 3 GHz 1G RAM boxes, this argument may not seem like an issue at present; however, things will change. A 200 MHz box used to be more than adequate for a spiffy Linux desktop, and now it's almost unusable (unless you're willing to dump most apps and spend hours tweaking and hacking). In those times, us Linux users were drooling over the prospect of multi-GHz chips, expecting lightning-fast app startup and super-smooth running. But no, instead, we're still waiting as the disk thrashes and windows stutter to redraw and boot times grow.

So when people talk about 10 GHz CPUs with so much hope and optimism, I cringe. We WON'T have the lightning-fast apps. We won't have near-instant startup. We thought this would happen when chips hit 100 MHz, and 500 MHz, and 1 GHz, and 3 GHz, and Linux is just bloating itself out to fill it. You see, computers aren't getting any faster. CPUs, hard drives and RAM may be improving, but the machines themselves are pretty much static. Why should a 1 GHz box with Fedora be so much slower than a 7 MHz Amiga? Sure, the PC does more - a lot more - but not over 1000 times more (taking into account RAM and HD power too). It doesn't make you 1000 times more productive.

It's a very sad state of affairs. Linux was supposed to be the liberating OS, disruptive technology that would change the playing field for computing. It was supposed to breathe new life into PCs and give third-world countries new opportunities. It was supposed to avoid the Microsoftian upgrade treadmill; instead, it's rushing after Moore's Law. Such a shame.

Linux Needs Diet, Page 2/2
Denying ourselves a chance

But let's think about some of the real-world implications of Linux's bloat. Around the world in thousands of companies are millions upon millions of Win98 and WinNT4 systems. These boxes are being prepared for retirement as Microsoft ends the lifespan for the OSes, and this should be a wonderful opportunity for Linux. Imagine if Linux vendors and advocates could go into businesses and say: "Don't throw out those Win98 and NT4 boxes, and don't spend vast amounts of money on Win2k/XP. Put Linux on instead and save time and money!".

But that opportunity has been destroyed. The average Win98 and NT4 box has 32 or 64M of RAM and CPUs in the range of 300 - 500 MHz -- in other words, entirely unsuitable for modern desktop Linux distros. This gigantic market, so full of potential to spread Linux adoption and curb the Microsoft monopoly, has been eliminated by the massive bloat.

This should really get people thinking. A huge market we can't enter.

The possibility of stressing Linux's price benefits, stability and security, all gone. Instead, businesses are now forced to buy new boxes if they are even considering Linux, and if you're splashing out that much you may as well stick with what you know OS-wise. Companies would LOVE to maintain their current hardware investment with a secure, supported OS, but that possibility has been ruined.

Impractical solutions

Now, at this point many of you will be saying "but there are alternatives". And yes, you're right to say that, and yes, there are. But two difficulties remain: firstly, why should we have to hack init scripts, change WMs to something minimal, and throw out our most featureful apps? Why should newcomers have to go through this trouble just to get an OS that gives them some real performance boost over Windows?

Sure, you can just about get by with IceWM, Dillo, AbiWord, Sylpheed et al. But let's face it, they don't rival Windows software in the same way as GNOME/KDE, Moz/Konq, OpenOffice.org and Evolution. It's hard to get newcomers using Linux with those limited and basic tools; new Linux convertees need the powerful software that matches up to Windows. Linux novices will get the idea that serious apps which rival Windows software are far too bloated to use effectively.

Secondly, why should users have to install Slackware, Debian or Gentoo just to get adequate speed? Those distros are primarily targeted at experienced users -- the kind of people who know how to tweak for performance anyway. The distros geared towards newcomers don't pay any attention to speed, and it's giving a lot of people a very bad impression. Spend an hour or two browsing first-timer Linux forums on the Net; you'll be dismayed by the number of posts asking why it takes so long to boot, why it's slower to run, why it's always swapping. Especially when they've been told that Linux is better than Windows.

So telling newcomers to ditch their powerful apps, move to spartan desktops, install tougher distros and hack startup scripts isn't the cure. In fact, it proves just how bad the problem is getting.

Conclusion

So what can be done? We need to put a serious emphasis on elegant design, careful coding and making the most of RAM, not throwing in hurried features just because we can. Open source coders need to appreciate that not everyone has 3 GHz boxes with 1G RAM -- and that the few who do want to get their money's worth from their hardware investment. Typically, open source hackers, being interested in tech, have very powerful boxes; as a result, they never experience their apps running on moderate systems.

This has been particularly noticeable in GNOME development. On my box, extracting a long tar file under GNOME-Terminal is a disaster -- and reaffirms the problem. When extracting, GNOME-Terminal uses around 70% of the CPU just to draw the text, leaving only 30% for the extraction itself. That's pitifully poor. Metacity is hellishly slow over networked X, and, curiously, these two offending apps were both written by the same guy (Havoc Pennington). He may have talent in writing a lot of code quickly, but it's not good code. We need programmers who appreciate performance, elegant design and low overheads.

We need to understand that there are millions and millions of PCs out there which could (and should) be running Linux, but can't because of the obscene memory requirements. We need to admit that many home users are being turned away because it offers no peformance boost over XP and its apps, and in most cases it's even worse.

We're digging a big hole here -- a hole from which there may be no easy escape. Linux needs as many tangible benefits over Windows as possible, and we're losing them.

Losing performance, losing stability, losing things to advocate.

I look forward to reading your comments.

About the author
Bob Marr is a sysadmin and tech writer, and has used Linux for five years. Currently, his favorite distribution is Arch Linux.

LINUX: KDE 3.2.3 Release Announcement

KDE Homepage - KDE 3.2.3 Release Announcement: "DATELINE June 9, 2004 FOR IMMEDIATE RELEASE KDE Project Ships Third Translation and Service Release for Leading Open Source DesktopKDE Project Ships Third Translation and Serv"

DATELINE June 9, 2004

FOR IMMEDIATE RELEASE
KDE Project Ships Third Translation and Service Release for Leading Open Source Desktop

KDE Project Ships Third Translation and Service Release of the 3.2 Generation GNU/Linux - UNIX Desktop, Offering Enterprises and Governments a Compelling Free and Open Desktop Solution

June 9, 2004 (The INTERNET). The KDE Project today announced the immediate availability of KDE 3.2.3, a maintenance release for the latest generation of the most advanced and powerful free desktop for GNU/Linux and other UNIXes. KDE 3.2.3 ships with a basic desktop and eighteen other packages (PIM, administration, network, edutainment, utilities, multimedia, games, artwork, web development and more). KDE's award-winning tools and applications are available in 51 languages (now including Arabic, Croatian and Upper Sorbian compared to KDE 3.2.2).

KDE, including all its libraries and its applications, is available for free under Open Source licenses. KDE can be obtained in source and numerous binary formats from http://download.kde.org and can also be obtained on CD-ROM or with any of the major GNU/Linux - UNIX systems shipping today.
Enhancements

KDE 3.2.3 is a maintenance release which provides corrections of problems reported using the KDE bug tracking system and enhanced support for existing translations.

For a more detailed list of improvements since the KDE 3.2.2 release in April, please refer to the KDE 3.2.3 Changelog.

Additional information about the enhancements of the KDE 3.2.x release series is available in the KDE 3.2 Announcement.
Installing KDE 3.2.3 Binary Packages

Packaging Policies. Some Linux/UNIX OS vendors have kindly provided binary packages of KDE 3.2.3 for some versions of their distribution, and in other cases community volunteers have done so. Some of these binary packages are available for free download from KDE's http://download.kde.org. Additional binary packages, as well as updates to the packages now available, may become available over the coming weeks.

Package Locations. For a current list of available binary packages of which the KDE Project has been informed, please visit the KDE 3.2.3 Info Page.
Compiling KDE 3.2.3

Source Code. The complete source code for KDE 3.2.3 may be freely downloaded. Instructions on compiling and installing KDE 3.2.3 are available from the KDE 3.2.3 Info Page.
KDE Sponsorship

Besides the superb and invaluable efforts by the KDE developers themselves, significant support for KDE development has been provided by MandrakeSoft, TrollTech and SuSE. In addition, the members of the KDE League provide significant support for KDE promotion, IBM has donated significant hardware to the KDE Project, and the University of Tübingen and the University of Kaiserslautern provide most of the Internet bandwidth for the KDE project. Thanks!
About KDE

KDE is an independent project of hundreds of developers, translators, artists and other professionals worldwide collaborating over the Internet to create and freely distribute a sophisticated, customizable and stable desktop and office environment employing a flexible, component-based, network-transparent architecture and offering an outstanding development platform. KDE provides a stable, mature desktop, a full, component-based office suite (KOffice), a large set of networking and administration tools and utilities, and an efficient, intuitive development environment featuring the excellent IDE KDevelop. KDE is working proof that the Open Source "Bazaar-style" software development model can yield first-rate technologies on par with and superior to even the most complex commercial software.

Wednesday, June 09, 2004

SEC: TCP/IP Skills for Security Analysts (Part 2)


TCP/IP Skills for Security Analysts (Part 2)
by Don Parker
last updated June 9, 2004
In the first part of this article series we covered the skills that a network security analyst should have in order to do their job properly. Now, this second part of the article will put these skills into context by simulating a "day in the life" of a network security analyst. I will give real life examples of why you need the specific skills that I noted earlier. Following this will be a brief discussion on the value of certification, and some of the ones I would suggest. Wrapping up the article will be some of the advanced skill sets that an analyst should strive for, and an indication of the small list of places one can go to learn them due to their complexity.
Example: a new vulnerability is discovered
The following premise assumes that you have just come into work, ready to begin your daily routine. The first thing I do once I hit my workstation at work is check my mail and take a quick look at the mailing lists I subscribe too. The ones I have coming to me are the SecurityFocus ones such as Vuln-Dev and Pen-Test, as well as the Firewall wizards one. Many people find Bugtraq and the massive Vulnerability Database to be useful as well. These plus several others are the ones I subscribe to in an effort to keep my finger on the pulse of the security world. Quickly scanning the subject lines I see one that happens to catch my eye. There appears to be a new vulnerability that was released late yesterday concerning a new exploit vector in a popular operating system. Exploit code, it seems, has been posted to one of the popular sites which hosts fully functional code.

Seeing as the network I help maintain security on is clearly going to be affected by this exploit, I hustle on over to the management console for our firewall. Lo and behold there have been quite a few scans on the port with that vulnerable service listening on it. This is of immediate concern to me, for we may have already been compromised (or, "rooted") overnight. With the firewall registering all of these hits I now go over to look at the IDS logs to see what it has registered. It seems that the IDS has fired off a series of "shellcode" alerts on the port in question. Things seem to be getting worse indeed. It now looks like our computers have not only been scanned, but that exploit code may have been sent to them.

While bearing in mind the above information, there are two things I have to do immediately. The first is that I will design a bpf and bitmask filter for my IDS, to cull all the packets that were directed at the port in question. The second step is to go and download a copy of the exploit code itself.

Seeing as it was a scan of our network, which was apparently followed by exploit code being sent to specific computers, I will construct a bpf filter as follows:

-nXvSs 0 tcp and src net 192.168 and src port 135 and tcp[13] = 18

Shown above is the filter I wrote to give me all the packets sent to our vulnerable port. It also shows me the syn/acks sent back to the machines scanning it. This enables me to write down the IP addresses of the possible offenders for future followup action with their ISPs, if and only if they are attempting to penetrate our network.

Now I devise a bpf filter to give me all the packets. This is to show actual data being sent across to our network, and it would look as follows:

-nXvSs 0 tcp and src net 192.168 and src port 135 and tcp[13] = 24

As mentioned, this will give me all the packets which are psh/ack's. These are the packets which will be used to convey the actual exploit code, if any. Writing the above filter will allow me to most effectively use my time by analyzing only the actual packets which are of importance. At this stage of the game I am no longer really concerned with who is scanning us or whether our computers sent syn/ack back, but rather I need to know if there was any actual exploit code directed against us. Instead of wasting my time with other packets like the syn and syn/ack packets, I concentrate on the important ones first.

While the filters are being worked on by the computer I surf over to the well known site which hosts the exploit code, in this case www.k-otik.com. Once there I grab a copy of the recently released exploit and open it up on a dual-booted laptop I have at work for these types of instances. The laptop itself is not connected to the network in any way, and it is therefore safe to play with exploit code or malware on it. I take a quick look at the exploit code itself and the header files to find that the exploit was written on a Linux machine. I realize this due to some of the #include files in the exploit code, which cannot be found on a Win32 based operating system.

I try to compile the code only to get some errors. I find it somewhat odd because this site is normally known for fully functional exploit code. I decide to try and compile the code again, but this time in an IDE within Linux. Once again the same errors come back, but this time I can use my average C programming skills to debug the code. As luck would have it there was just some minor "script kiddie" obfuscation done to the code. Five minutes later I now have a functional copy of the code.

Where I work I have the luxury of using a couple of lab boxes, which mirror our production baseline. This allows me the ability to test out patches, and other system fixes prior to deploying them on production machines. Also it allows me to test out new exploit code as it comes out to see how it will affect our machines and observe the behavior of an exploited machine. Ideally one has access to this type of lab environment at their work. Realistically not everyone has lab machines available for us, and he may have to make do simply with a company laptop to simulate most of the company's software baseline.

It is now time to go back and inspect the file that was generated by my bpf filter earlier. Upon close inspection of the psh/ack packets I can see there was definitely a binary transfer that has taken place. Seeing as I have not yet had time to invoke the exploit that I have now functioning, I do not really know what tell-tale sign is to look for in the packets themselves. By that I mean a sign such as say "/bin/sh" within the ASCII content of the packet, or some such other indication of possible mischief.

With this in mind I go back and establish a direct connection between my laptop and a lab machine. Once this is done I invoke the now functioning exploit and direct it towards the vulnerable port on the lab machine, which is segmented from the rest of the network. Lo and behold I am able to obtain a reverse command shell using this exploit. Prior to running this exploit I fired up tcpdump to write myself a binary log of all packets. This allows me to inspect them post-facto. I kill the command shell, which was obtained, and take a look at my binary log trace. The syntax I used to copy all of the packets being sent and received by the exploit is as follows:

tcpdump -nXvSs 0 ip and host 192.168.1.101 -w sploit_log

The above noted tcpdump filter will copy all packets with a valid IP header in them, and write them to the binary log called "sploit_log". Lastly the IP address of the lab machine being tested is 192.168.1.101.

Now that I have the binary log file and the exploit has been executed I can look at the packets themselves, and see if there is something telling in the packets themselves. I use the following tcpdump syntax to look at the file that was generated:

tcpdump -r sploit_log -nXvSs 0 |more

Looking at the file for a brief time I notice that there is no tell tale sign in the packets themselves that I can use for a possible IDS signature, or other aid to the analysis. With nothing obvious in the ASCII content, and without header metrics the job becomes a little more difficult. Bearing this in mind I will have to check out all the psh/ack packets by hand. This will not be overly arduous, as I have been able to pare down this mass of traffic to just the psh/acks themselves.

With this information in hand I approach management and advise them that until a vendor patch comes out we should shut down this port at the border router. Once the vendor patch comes out and an IDS signature is developed we can then open this port back up, but in the interim we need to manage the risk. Lastly I inform the management team that we probably have computers which have been compromised. With that update to management I am off to check and further analyze data to confirm or deny any compromised machines on our network.

As you can see from the above scenario, I have painted out the use of every skill mentioned in part one of this article series. This is why it is imperative to learn all of these skills, starting with TCP/IP, to become a competent analyst.
Thoughts on certification
What happens though if you have all of the aforementioned skills? How do you improve your skill set in an effort to improve yourself? There are two suggestions I would advise. Firstly would be to seek out a certification and preferably one which has a practical portion to it. In my opinion, arguably the best technical certification out there today with this practical portion are the GIAC certifications. These are widely recognized as being very technical and require the person to prove their skills not only via two exams but also through a demanding technical paper submission.

Not everyone is going straight to the network security field, however. What follows are my suggestions on a triumvirate of certifications to consider as a baseline. Obtain the CCNA, for example, as it will denote proficiency with a routers and daily maintenance. Perhaps get one of the GIAC certs, specifically the GCIA or GCIH. The former is about Intrusion Detection and the latter is the Incident Handling one. Both are very good, and demonstrate your mastery of the subject material. Lastly I would consider the MCSE simply because most corporate networks are still Microsoft based and it only makes sense to learn the operating system that you are trying to protect. Many sneer at the MCSE certifications, saying that they are paper certs only. While this is sometimes true, I have also met many MCSEs who are very good indeed. For many people, and particularly employers, it is simply a baseline to start from. Finally, if your aim is to eventually go into management then the cert to get is clearly the CISSP. It is very much a management based certification, is generally recognized around the world, and it will give you a bit of knowledge over a wide variety of topics. One can debate over the value of having a certification, and then argue about which is the best. The bottom line, however, is that any certification is better then none.
Programming essentials
What might be the next step to improve your skill set when you already have many of the core skills, and have evaluated various certifications? One should then strive to become good at C programming as well as learning Assembler. Why? Simply because most exploits are written in one of these two languages. Also, one should ideally become proficient at reverse engineering malware. It helps to understand exactly how it works, and being able to reverse engineer a piece of code is the best way to see that. This still leaves the problem of where to find this type of advanced training. Training venues that cover this topic are highly specialized in nature as they cater to an advanced skill set, or "training the trainer" courses if you will. It is at this point where such names as Mike Sues, Dave Aitel, and HD Moore begin to appear as possible teachers for these advanced skill sets. I would argue that these are some of the best presenters in computer security today.
Conclusion
Once you have reached this point in your career, you'll find that many new things are learnt on your own. Finding such specialized training is difficult, and expensive -- however the value of such training is indeed very much worth it when compared to the cost of a network breach, and can be great justification to your current employer. I sincerely hope that this article was able to clarify these skills for you, and help you out in your quest for possible skills upgrading. Remember being in this field means you are perpetually learning. You can't afford to sit still.

SEC: Risks-Forum Digest Thursday 3 June 2004 Volume 23 : Issue 41

RISKS-LIST: Risks-Forum Digest Thursday 3 June 2004 Volume 23 : Issue 41

FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at as

The current issue can be found at


Contents: Seasonal Slowdown in effect; MAILMAN has replaced Majordomo
Computer breakdown in England affects air traffic (Debora Weber-Wulff)
Privacy and Security Risks in Rampell's E-Mail Surveillance Service
(Lauren Weinstein)
France Telecom voice mail espionage (David F. Gallagher)
USB risks (Gadi Evron)
Whom do I tell? (Jerry James)
An anatomy of a PGP Joe Job (Gadi Evron)
Netgear/UWisc NTP mess (Hal Murray)
Selling Web bugs (Neil Youngman)
Re: Spam being rapidly outpaced by 'spim' (Gadi Evron)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Thu, 03 Jun 2004 18:43:42 +0200
From: Debora Weber-Wulff
Subject: Computer breakdown in England affects air traffic

tagesschau.de has an in-depth update on the software failure at
http://www.tagesschau.de/aktuell/meldungen/0,1185,OID3328786_REF1_NAVSPM1,00.html
(in German), here my synopsis/translation:

NATS (National Air Traffic Control Service) was supposed to move from West
Drayton to Swanwick near Heathrow in 1996 and 1997 with a completely
modernized technology for air traffic control. The system cost 623 million
Pounds Sterling (940 million Euros) and was not delivered by Lockheed Martin
until 2002. It will take until 2007 for the move to be completed.

Four months after the system was initiated, there was a large breakdown in
May 2002 that caused an air traffic outage over England. "Experts" decided
that the problem was the technical communication between the ancient
computers in West Drayton and the new ones at Swanwick.

The current misfortune is attributed to an attempt on the night of 2 Jun
2004 to update the system. The update did not work, and the mainframe could
not be restarted. Two hours were needed to get the backup system
functional. In the course of the day, it was disclosed that the computer in
question is 30 years old. [actually, sometimes I trust older systems more
than I do these modern WinTel boxes... -dww]

The update that was to have been installed was ordered after an incident in
Jan 2004 in which there was almost an in-air collision in British airspace.
The air traffic controller had told two large passenger machines to move
apart. The data came into the system reversed, so that the machines
actually moved closer to each other. The error was recognized in time by
pilots and by the air traffic controller.

Prof. Dr. Debora Weber-Wulff, FHTW Berlin, FB 4, Treskowallee 8, 10313 Berlin
Tel: +49-30-5019-2320 http://www.f4.fhtw-berlin.de/people/weberwu/

------------------------------

Date: Thu, 27 May 2004 13:00:00 PDT
From: Lauren Weinstein
Subject: Privacy and Security Risks in Rampell's E-Mail Surveillance Service

PRIVACY Forum Digest Friday, 28 May 2004 Volume 13 : Issue 03
( http://www.vortex.com/privacy/priv.13.03 )

Greetings. There's been a lot of publicity over the last few days about
Rampell Software's DidTheyReadIt.com service. There have been other
software tracking systems introduced before, but this one, by including
features that attempt to determine how long a message is kept open (as well
as whether it was received, who you forwarded it to, etc.) is worthy of
particular disdain and concern.

There's more than just basic privacy issues involved. Many individuals,
businesses, and particularly government entities may have serious security
issues regarding capabilities that can expose information about when a
particular person has read a message, and perhaps potentially even if they
are still actually sitting there reading the message right now. The
possible dangers are fairly obvious -- knowledge of the hours a person
works, when they tend to be in their office, etc. can be easily abused in
sensitive environments.

Some of these features not only depend upon invisible image "Web bugs" used
in a "conventionally invasive" manner, but also reportedly feed a slow
stream of data to your system during the entire interval you're reading a
message (that's how their "how long were you reading the message" function
apparently operates).

Luckily, there are several ways to protect yourself not only from Rampell
and their customers but also from other mail tracking services:

- Use a text-based e-mail reader, not an html mail reader, for most mail.
Do you really need to see all the fonts and associated frills in most
e-mail? What kind of mail is most likely to be full of such stuff?
Spam of course! When you need to display image or document attachments
they can still be processed externally. Text-based e-mail systems also
can provide essentially complete protection against all virus, worm, and
related attacks that use e-mail as their vectors. I use a text-based
e-mail system for 99.9% of all my mail quite successfully. And I get a
lot of e-mail.

- Turn off image display in your html mail reader. E-mail tracking
systems that claim to work regardless of where mail is sent typically
depend upon the recipient retrieving images (often invisible images)
from central servers. One way to stop that process is of course to read
your e-mail offline, though that isn't practical for most of us. But
various html mail reading systems allow you to turn off image display
(and typically retrieval as well) for e-mail messages (you can turn it
back on when you really need it for particular items). If you don't
retrieve the images or Web bugs, e-mail tracking systems that need them
won't work. And of course, you should never allow javascript in e-mail
messages to be processed, nor allow attachments to be executed.

- Server blocking. System administrators and others may choose
to determine (from viewing e-mail raw source data) the names and/or
IP numbers related to the servers used by Rampell or others to
serve the tracking images. If these servers are blocked at firewalls
or other filters the tracking systems will be rendered impotent.

Until legislation and the legal system recognize the risks in such e-mail
tracking and provide appropriate restrictions and remedies, you need to
protect yourself.

Lauren Weinstein lauren@pfir.org lauren@vortex.com lauren@privacyforum.org
1-818-225-2800 http://www.pfir.org/lauren
PFIR, Fact Squad - http://www.factsquad.org
Moderator, PRIVACY Forum - http://www.vortex.com

------------------------------

Date: Sun, 30 May 2004 13:15:21 -0700 (PDT)
From: "David F. Gallagher"
Subject: France Telecom voice mail espionage

France Telecom, by far the largest phone company in France, offers its
customers a free voice mail service called Top Message. Users of the service
can sign up to receive an e-mail letting them know when they have new voice
mail -- useful for people with dial-up Internet connections. You activate
this feature by sending an e-mail to a designated address with your phone
number in the subject line.

I've found that France Telecom makes no apparent effort to determine whether
a particular person has the right to be receiving these alerts, which
include the phone number of the caller and the time they called. I was able
to activate alerts for the phone in my apartment in Paris even though the
phone bills are in the name of a previous tenant. It also worked when I used
the phone number of some friends here who also use the voice mail
service. The online instructions for the service say you're supposed to
receive confirmation by voice mail and e-mail when the alert service is
activated. When I signed up I found that this was not the case -- the alerts
just started arriving.

There are no doubt thousands of jealous ex-lovers in France who would love
to know who has been leaving voice mail for the objects of their
obsession. Perhaps France Telecom should start charging stalkers for this
service? (Following through on the promise to notify users when the alerts
are turned on would provide a minimal level of protection against this
potential creepiness.)

Top Message online help (in French):
http://www.agence.francetelecom.com/vfrance/esav/fixe/pages/services/3103/etre_averti_du_depot.shtml#3

SPLIT:
http://www.agence.francetelecom.com/
vfrance/esav/fixe/pages/services/3103/etre_averti_du_depot.shtml#3

------------------------------

Date: Tue, 01 Jun 2004 17:24:30 +0200
From: Gadi Evron
Subject: USB risks

I got the idea of writing about this from a recent pen-test mailing list
thread I replied to.

In that thread, someone asked about the risks of using USB. The guy
described how he plugged in a USB device and was surprised to see it
auto-run. He was particularly worried about the potential theft of
information that can be caused by the malicious usage of USB devices.

Indeed.

This has been covered and demonstrated on several occasions, on TV shows
(Threat Matrix), Sci-Fi TV shows (Jake 2.0) and in actual _real_ security
discussions. I believe this was brought up before in both Slashdot and
Full-Disclosure, but only with actual solutions. I haven't personally seen
anyone discuss the risks.

Disabling auto-run might not be the solution for USB (although that is
always a good idea when hardening a Windows system). USB auto-run installs a
driver for itself on plug-in. A driver which is essential for the device to
operate. Auto-run on CD drives for example is not necessary, one can always
access the CD and execute whatever program is there (or even the auto-run),
manually.

On USB, there are a few concerns when it comes to drivers. The driver
can be:
1. Messed with, i.e. made to do things it shouldn't (Reverse
Engineering, manipulation).
2. Built from scratch with one of *many* SDK's out there.

USB brings the threat of any user, maid, cleaner or hostile "whoever" to
plug it in, covertly gather whatever information/perform whatever action
they wish, and leave. They might not even have to be covert about their
actions as USB devices are more than legitimate in many organizations
and aside to not being notices for using a USB device one could alter
the driver for any USB device they usually use.

This brings up the issue of what hardware should be allowed in an
organization and whether users can bring their home hardware to work, but
that is beyond the scope of this write-up.

USB technology is both fast and convenient. More and more computer services
and devices move to work over USB as a fast-growing trend. It has been this
way for several years, and the technology usage is still showing signs of
growth.

I feel threatened enough by the fact that such small devices with such a
huge data capacity exist and can be smuggled into a building in so many
ways, automatic operations done "on-plug-in" or "on-connect" are just a
plus. You don't really need many tools other than copy, but I suppose tools
can be created.

There are many ways in which the exploitation of this technology can
progress, from simply connecting a USB drive and copying information as I've
mentioned above, through PDA's which would allow you to chose what you want
to steal and map the network, all the way to wireless devices which can be
remotely controlled by a laptop or through, say, a cellular device, whether
temporary for the sake of one illegal operation, or permanently, providing
an hidden backdoor to a network.

Disabling USB all-together, virtually, by domain policy or removing the USB
devices themselves, maybe even just filling the plugs with silicon or glue
physically are some more drastic options which some organizations *might*
take, but I don't see it as a very viable option for most.

As always when it comes to security, it all depends on your risk analysis.
Cost vs. benefit. Is it worth it?

Do you have an opponent that could threaten you in this way? Do you have
anything to hide and how much do you care about hiding it?

There exist several tools to monitor a domain for when and if a USB device
is connected to any remote machine, and of what kind. A simple web search
should help you find some examples.

I suppose simple tools could be easily created, but as there are several
commercial options it might be worth a look.

The security risks of USB are more than this short email can convey, but I
think I gave you enough to get started and to think about. This issue is of
paramount importance and I don't see much *noise* about it.

Thoughts, anyone?

ge@linuxbox.org gadie@cbs.gov.il +972-50-428610 (Cell).

------------------------------

Date: Tue, 01 Jun 2004 15:08:15 -0500
From: Jerry James
Subject: Whom do I tell?

I've had two telephone annoyances over the past year that are RISKS
related.

First, a major home improvement chain came to town about a year ago. While
the store was still under construction, I started receiving telephone calls
at my home number, with the caller asking for this particular store. Upon
questioning the callers, I found that someone in the construction trailer
was giving out my number. I called up the construction trailer and had a
"Did, too!", "Did not!" type of conversation with the person who answered.
Even after construction finished, the calls continued. Now the callers
claimed to be getting my telephone number from the store's web site. I
confirmed this. The telephone book shows that the first 5 digits of the
correct number are the same as mine. The last two digits are completely
different. This is not a case of transposition or accidentally repeated
digits. Someone got the last 2 digits completely wrong. This should be
easy to fix, right? I sent e-mail to the webmaster. No response. I called
up the store. "We don't manage the web site. Our corporate office does
that." Nobody knows how to fix the problem. A year later, I am still
receiving calls for this store. I have taken to telling callers that this
store is so badly managed that they can't even figure out how to fix a wrong
telephone number. We'll see if that gets any action.

Second, something is amiss with my telephone company's software. I have
two pieces of evidence to support this claim.

- Two or three times a week, when I dial a number I know is good, I get the
message that I am calling a disconnected number. When that happens, I
just hang up, then hit redial, and the call usually goes right through.

- I get a lot more wrong numbers than I did at my last place of residence.
When I ask the callers what number they were attempting to call, I get the
usual transpositions and repeated digits, but I also get a fair number of
answers that have no obvious connection with my telephone number. I
usually suggest to these callers that they try hitting redial, and I've
never had any of them ring back.

(Oddly enough, I don't seem to be calling wrong numbers myself, unless that
is what is causing the "disconnected number" messages. But then why am I
not hitting valid, but wrong, numbers as well?)

So I called the operator and told her about it. She had absolutely no idea
what to do. "Surely there is some way to report problems of this nature?" I
asked. She didn't know. She didn't even know who to ask. The telephone
book yielded no clues.

In both cases I, a member of the public, knew about a problem, tried to
report it, and found that those responsible either have no problem reporting
mechanism in place, or have successfully hid its existence from their own
employees.

Jerry James http://people.eecs.ku.edu/~james/ james@eecs.ku.edu jamesj@acm.org

------------------------------

Date: Sat, 29 May 2004 09:47:51 +0200
From: Gadi Evron
Subject: An anatomy of a PGP Joe Job

How my PGP signature ripped off, and for what purpose

On May first I e-mailed a couple of mailing lists, announcing a new spam
research related mailing list.

Due to knowing that many viruses and kiddies spoof my e-mail address on a
regular bases, I signed the post.

So far I received about one e-mail a day from people who Googled the PGP
signature that was in a SPAM they got (right through their filters).

That signature was my signature from the spam mailing list.

Irony? Attempted Pay-back? Oh well.

As the e-mails don't stop and as it happens with Joe Jobs, you must reply
and be nice while you do it.. I decided I'd put this in a short write-up
describing:
1. What happened (the story).
2. A few of my opinions on the subject.
3. A full analysis of the SPAM message. Quite interesting, although
there is nothing completely new there.

PGP is used exactly for this purpose. Even if my signature was ripped,
it should be pretty obvious it wasn't made by me. Still, this is a risk
(which isn't completely new either

What _is_ new is the very targeted nature of this PGP Joe Job.

Here is the write-up that was supposed to be sent as e-mail. I figured that
with all the spam elements quoted in it though - it might get caught in
filters:
"An anatomy of a PGP Joe Job"
http://www.math.org.il/PGP-JoeJob.txt

ge@linuxbox.org gadie@cbs.gov.il +972-50-428610 (Cell).

------------------------------

Date: Mon, 10 May 2004 02:54:17 -0700
From: Hal Murray
Subject: Netgear/UWisc NTP mess

There is a category of bugs that can be summed up as (re)try too hard.

They are much more interesting when they involve positive feedback. Suppose
some networking code works fine normally but an environmental problem causes
retransmissions. If those retransmissions make the problem worse they will
cause more retransmissions which will...

Last summer, Netgear demonstrated a spectacular example of this type of bug. I'm surprised it hasn't been covered here yet.

Dave Plonka has an excellent writeup at:
http://www.cs.wisc.edu/~plonka/netgear-sntp/
He has links to several media web pages at the end.

Here is a highly abridged summary:

Netgear added an NTP client to some of their routers so log entries would
have the correct time. They hardwired the IP address of the NTP server at
UWisc into their code. They shipped many many thousands of those routers.
The total load was too much for the NTP server and/or network at UWisc so
packets started getting lost. The code had a bug. If it didn't get an
answer, it retransmited once per second. (One request per hour would be
reasonable.) The UWisc network collapsed on May 14th, 2003. In early June,
they were discarding 250K packets/second, 150 megabits of NTP traffic!
That's an impressive load for such a simple protocol.

A similar bug in SMC routers knocked the NTP server at CSIRO (Australia) off
the net.
http://mailman.anu.edu.au/pipermail/link/2003-April/049684.html

I know of a few other examples of try-too-hard bugs:

Consider a UDP request/response protocol running over a slow phone line.
Suppose that requests are tiny, the response takes a 1/2 second on the phone
line, and the retransmit timer is 1 second. If there is no other traffic,
things work cleanly. Suppose some other traffic causes an additional 1/2
second of delay. The retransmit timer goes off and that puts a second copy
of the response in the queue. The client will continue when it receives the
first (delayed) response. If the client generates more work for the server,
that response will be delayed by the retransmission that is still in
progress. A little more shared traffic can cause things to snowball. Note
that once a few retransmissions are in the pipeline the system doesn't need
any more outside traffic to cause troubles. It's own queued up
retransmissions will keep causing more retransmissions.

That's just a simple example of a retransmit/retry timer being set too
short. Variations involve the server having to do a lot of work and not
being smart enough to cache the answer.

The next two examples don't involve any positive feedback.

Consider the typical client-server setup that uses several servers for
reliability. What happens if a particular data pattern issued by a client
finds a software bug that crashes a server? If the client retries again
using another server, that one will crash too. If the client keeps retrying
it can kill all of the servers - embarrassing if you thought you were
building a reliable system.

When forwarding mail, some servers retry right-away on a temporary error.
That turns into a denial-of-service attack if the receiving server returns a
temporary error. Anti-spam defenses sometimes return temporary errors
because that gives the operator of a mis-configured server a chance to fix
things without any bounced mail.

RISKs related issues:

* Why didn't Netgear learn from the SMC/CSIRO event? Why didn't that event
get more publicity? (I can't find any reference in RISKS.)

* If you are outsourcing work or hiring contractors/consultants, how can you
tell if they are good enough to avoid problems like this? How would you
write a contract to avoid bugs like this? Is requiring "good engineering
practices" good enough?

* Could you explain this issue to your management? What would they do if
this bug was discovered when the product was about to ship? How much would
it cost your company to recover from a bug like this? (Looks to me like
Netgear got off lightly on the bad-PR area.)

* Should specifications mention this problem? Or would that just be clutter
and distract from the main purpose of the spec? Note that "specifications"
includes RFCs, product specifications, and contracts. Does the answer
change if the protocol/product is widely deployed, or likely to be widely
deployed?

* How do you update implementations out in the field when problems like this
are discovered? You can't even contact most of the owners because people
don't fill out product registration cards. (Probably because they get too
much junk mail when they do.) In this case, the ISPs should know which of
their customers are using these routers. Even if you could contact the
owners, would they bother to update their firmware? They don't see the
symptoms of any problem.

* How can we uncover bugs like this? The Netgear bug is somewhere between
very hard and impossible to find by traditional testing. The lab gear
required is too extensive/expensive. You could probably provoke it in a
lab, if you already knew about it so you could build an artificial
environment that would be more sensitive. Would that type of testing be
cost effective? (Or should that testing effort be devoted to other areas?)

* How can schools teach students about this type of problem? Is repeating
this war story in a lecture good enough for somebody to get it? Where
should this come on the priorities? [I hope this event becomes required
reading for a CS degree, but I'm a network geek.]

* Hardwiring some parameters is asking for troubles. How can we recognize
(and teach) which parameters are OK to hardwire and which ones require
configuration? Is there a middle ground where a parameter has a sensible
default as long as configuration is possible?

* What responsibility do corporations have to the Internet community as a
whole? How can we encourage them to do the right thing when it costs a
little more? Corporations includes hardware manufacturers, software
vendors, ISPs/ASPs, web site operators... (Maybe we should include home
users too, but I think it makes sense for their ISP to be responsible for
their actions.) For example, why didn't somebody at Netgear do the
back-of-envelope calculations and figure out how many routers their
customers (ISPs) could install before they should install NTP servers too?

* ISPs should be running time servers for their customers rather than
freeloading off the net.

The suespammers.org mail server is located in California. So are all my
other mailboxes. Please do not send unsolicited bulk e-mail or unsolicited
commercial e-mail to my suespammers.org address or any of my other
addresses. These are my opinions, not necessarily my employer's. I hate
spam.

------------------------------

Date: Fri, 28 May 2004 20:27:33 +0100
From: Neil Youngman
Subject: Selling Web bugs

The latest LWN security section (http://lwn.net/Articles/86022/) discusses a
service called DidTheyReadIt.com. In short, the service adds web bugs to
e-mail to try to determine whether the e-mail has been read.

(NOTE: that link is currently subscription only. It will probably become
freely available when the next edition is published on Thursday. Ed Felten
also comments at http://www.freedom-to-tinker.com/archives/000607.html)

To me the key excerpt is

"This, of course, has some not-so-pleasant implications for personal privacy.
While the company assures its potential customers that it respects their
privacy, nothing is said about the privacy of the recipient who may not wish
to divulge whether or not they've read a particular e-mail or where they've
read it from. On the company's About Us page, they identify what kinds of
people might want to find out whether an e-mail has been read -- including
some that make DidTheyReadIt sound like a must-have for potential stalkers:

Users of online dating services such as match.com who want to know if their
potential dates are reading their messages...or ignoring them."

The articles do a good job of identifying the RISKS.

------------------------------

Date: Fri, 28 May 2004 00:30:07 +0200
From: Gadi Evron
Subject: Re: Spam being rapidly outpaced by 'spim' (RISKS-23.39)

"Spim" is nothing new, but it is indeed a growing concern.

In recent years we have seen more and more security issues that we've
encountered before repeat themselves on different mediums and
technologies. Spam is no different.

In this case, though, it is much simpler. As asked by many people in the
past: Would you stay with a service that you get 40 SMS spam messages
every day with?

No. You'd switch a provider.

I am much more concerned with other security issues regarding cell phones,
which are rapidly changing from privacy and eavesdropping concerns to Trojan
horses and buffer overflows. That is an issue to be discussed in a different
post, though.

As to spam, there is no danger of it disappearing. In fact MessageLabs came
out with some interesting statistics this week saying that 70% of all e-mail
is spam:
http://news.bbc.co.uk/1/hi/technology/3746023.stm.

------------------------------

Date: 2 Jun 2004 (LAST-MODIFIED)
From: RISKS-request@csl.sri.com
Subject: Abridged info on RISKS (comp.risks)

The RISKS Forum is a MODERATED digest. Its Usenet equivalent is comp.risks.
=> SUBSCRIPTIONS: PLEASE read RISKS as a newsgroup (comp.risks or equivalent)
if possible and convenient for you. To subscribe or unsubscribe via
e-mail to mailman your FROM: address, send a message to
risks-request@csl.sri.com
containing only the one-word text subscribe or unsubscribe. You may
also specify a different receiving address: subscribe address= ... .
You may short-circuit the process by sending directly to either
risks-subscribe@csl.sri.com or risks-unsubscribe@csl.sri.com
depending on which action is to be taken.
Subscription and unsubscription requests require that you reply to a
confirmation message sent to the subscribing mail address. Instructions
are included in the confirmation message. Each issue of RISKS that you
receive contains information on how to post, unsubscribe, etc.

INFO [for unabridged version of RISKS information]
.UK users should contact .
=> SPAM challenge-responses will not be honored. Instead, use an alternative
address from which you NEVER send mail!
=> The INFO file (submissions, default disclaimers, archive sites,
copyright policy, PRIVACY digests, etc.) is also obtainable from

The full info file may appear now and then in future issues. *** All
contributors are assumed to have read the full info file for guidelines. ***
=> SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line.
*** NOTE: Including the string "notsp" at the beginning or end of the subject
*** line will be very helpful in separating real contributions from spam.
*** This attention-string may change, so watch this space now and then.
=> ARCHIVES: ftp://ftp.sri.com/risks [subdirectory i for earlier volume i]
redirects you to Lindsay Marshall's Newcastle archive
http://catless.ncl.ac.uk/Risks/VL.IS.html gets you VoLume, ISsue.
Lindsay has also added to the Newcastle catless site a palmtop version
of the most recent RISKS issue and a WAP version that works for many but
not all telephones: http://catless.ncl.ac.uk/w/r
.
==> PGN's comprehensive historical Illustrative Risks summary of one liners:
for browsing,
or .ps for printing

------------------------------

End of RISKS-FORUM Digest 23.41
************************

LINK: Sun Bloggers

Sun Bloggers

VIRUS: A brief analysis of the 180 Solutions Exploit

A brief analysis of the 180 Solutions Exploit

GOOGLE: Anatomy of a search engine

Index of /pub/papers

SEC: Confusion surrounds Cisco-Linksys wireless hole

Confusion surrounds Cisco-Linksys wireless hole

M$: Microsoft attacked by hackers

Metamorphosis > News > Microsoft attacked by hackers

VIRUS: New Virus Deletes All Files

Netcraft: Symantec: New Virus Deletes All Files

SEC: TV programme exposes security gaps in Dutch airline and government wireless networks

Digital Media Europe: News - TV programme exposes security gaps in Dutch airline and government wireless networks

M$: Microsoft releases monthly security patches

security.itworld.com - Microsoft releases monthly security patches

LINUX: Open contradictions: compilation and invitation

Open contradictions: compilation and invitation

GROKLAW: Is Brown Really the Father of Samizdat? - A Parody by Justin Moore

GROKLAW: "Monday, June 07 2004 @ 03:38 PM EDTJustin Moore has done a delightful parody, and he has given permission to publish it on Groklaw, 'Is Brown the Father of Samizdat?' We've been enjo"

Monday, June 07 2004 @ 03:38 PM EDT

Justin Moore has done a delightful parody, and he has given permission to publish it on Groklaw, "Is Brown the Father of Samizdat?" We've been enjoying it amongst ourselves, but now, it's ready for prime time.

************************************

Is Brown really the father of Samizdat?
~A Parody, by Justin Moore

It's hard to imagine that Ken Brown could have launched Samizdat without directly using earlier book-writing work, according to a report that has been unnoticed even before it was written.

The 2-page report from a one-person Durham, NC think tank called Justin Moore, suggests more book-writing credit should go to The Elements of Style. A book, The Elements of Style was written by Strunk and White to help them teach grammar and style elements in Chicago. Brown used The Elements of Style before he embarked on FUD development in 2003.

In an e-mail interview. Brown strongly disputed the study's conclusions. Strunk and White were unavailable for comment.

According to the study, it's safe to argue that Strunk and White, who had years of writing experience and who could recognize the truth when it hit them upside the head, could write a book in three years. "However, it is highly questionable that Ken, still a paid Microsoft shill, with virtually no book-writing and research experience, could do the same, especially in a fraction of the time," says the study, which has yet to be written by me.

"Why are the most brilliant business minds in the history of book publishing, with hundreds of millions of dollars in capital, reading The Elements of Style, if writing a book is as simple as writing one from scratch with little help or experience?" the study asks. "Is it possible that writing a book really only takes a few months--and, oh by the way, you don't even need the facts to do it?"

An unnamed source took a more measured view. "I think we can all stipulate that Samizdat is not a 'clean room' creation. Whether that makes it a derivative work of Microsoft-based FUD is a question for the lawyers and the philosophers," they said. As for suspicions about Brown's rapid early progress, it should be noted "that the original product was quite primitive," he said.

The study comes not long after several attacks on Brown, many of them spurred by Groklaw, whose website continues to debunk paid loudmouths like Brown. More significantly, it arrives in the midst of a legal kamikaze on Linux by Caldera Systems the SCO Group, which argues that up is down, and that it has never argued that up is down.

Bolder Words

Although my study raises more questions than it answers, in an interview with myself, I was bolder in my claims.

"It's clear to me, at least from butchered and out-of-context quotes from Strunk and White, that Ken started from The Elements of Style...He just sat down with The Elements of Style and wrote this book. By definition, that is not an invention," I said. "If you sit down with the Ford blueprints and build a Chrysler ... well, I guess that means you can't really read blueprints."

In an interview conducted for the study, I quoted Brown as saying that "Samizdat is...[i]nherently [u]nstable...[and]...depends heavily upon sponging...from U.S. corporations."

If Samizdat is a derivative work of The Elements of Style, that makes Samizdat vulnerable to charges of intellectual property infringement by Pearson Higher Education, which published the The Elements of Style book. "Arguably, Pearson Higher Education has lost out on tens of dollars" because of lost book sales, the study says.

But Brown argued that he and other Microsoft shills have given proper credit.

"Samizdat never used The Elements of Style text...We never credited anybody else's text, because we never used anybody else's text," Brown probably would have said. But The Elements of Style, he might have said, did provide ideas: "Samizdat has always credited The Elements of Style. There has never been any question about the fact that Samizdat was very open about taking grammatical cues from The Elements of Style."

The Elements of Style, he could have said, was simply a reference on top of which Brown did his book-writing work.

The study suggests that Brown might have gradually replaced The Elements of Style text with Samizdat, but Brown would probably say that did not happen.

"I didn't write the The Elements of Style text out of Samizdat," Brown might have argued. "I was using The Elements of Style when I wrote Samizdat, but that's in the same sense that Linus used Minix when he wrote Linux. Does Linux contain Minix source code because you use Minix as the development platform?"

Brown isn't the only one to dispute the study; I myself have sided against myself.

"Ken didn't sit down in a vacuum and suddenly type in Samizdat text. He had The Elements of Style and pages of Microsoft-written FUD. But the text was his," I said.

"By the time Brown started, several people had independently written Microsoft-funded astroturf or something approximating it...All of this was perfectly legal and nobody broke any anti-trust laws. Given this history, it is pretty hard to make a case that one person can't write a book attacking Linux with FUD, out-of-context quotes, and pseudo-research with pre-determined conclusions that are not shaken by the truth."

Fueling the flames

While I announced the pending writing of my report earlier this week--saying it "directly challenges Ken Brown's claim to be the writer of Samizdat"--it immediately drew criticism from Microsoft advocates who suggested Ken Brown foe Ken Brown was behind the report.

Ken Brown indeed has provided fodder to the open-source community for five years, a non-existent Alexis de Tocqueville Institution representative said, without disclosing how many out-of-touch-with-reality statements Brown has made. Brown shoots himself in the foot repeatedly, reportedly hitting all five of his "piggies"; the one that went to market, the one that stayed home, the one that had roast beef, the one that had none, and even the notorious one that went "wee-wee-wee" all the way home.

I declined to discuss my funding sources, but said there are several and that my research is independent. "I publish what I think, and that's it. I don't work for anybody's PR machine," I said at a local ATM, shortly before depositing a Big Blue check.

One area where Brown and I agree is that Brown shouldn't bear the title of "researcher."

"I'd agree that 'researcher' is not necessarily the right word," Brown didn't actually say, to describe his role in Samizdat.

The study also raises the issue that Brown saw Microsoft FUD. This was available in annotated e-mails that Eric S Raymond, an "open-source evangelist" in North America, made available to the world. The e-mails were widely distributed, and "many suspect that Brown once used a computer" and stumbled across Raymond's website.

Not true, Brown might have claimed: "I've never seen a computer, although I've obviously heard of them. And no, no leaked Microsoft memos either."

I and two colleagues--myself and me--read more than two websites for the study, but Brown "didn't get back to me" with requests for comment. Brown probably would have claimed that he never received any e-mail from me.

The Samizdat issue fuels my concern that Microsoft makes it easier for journalistic hacks to benefit from shoddy hatchet jobs, I said: "How are you going to have an intellectual attack on Linux if you keep throwing money at obvious puppets reciting provably false statements?"

Such political and business issues will likely get more attention in a book I plan to publish in my "copious free time" that will expand on these themes.

The study will be sold by an outside e-book seller, I said. Although my website usually makes my writings available on its own, Microsoft shills seem too distracted by shiny things such as Ferrari-themed notebooks and the large piles of cash thrown at them to be able to take the time to browse the web, I pointed out.

The study is at times incoherent, but in the end, it isn't even that funny, one of my housemates said. "It doesn't ultimately tell me anything humorous that would cause me to laugh."

Tuesday, June 08, 2004

LINUX: Rebuttal to Ken Brown

Introduction

For those of you just tuning into this soap opera, here is a brief summary of the plot so far. Ken Brown, president of a Washington think tank called the Alexis de Tocqueville Institution has written a book claiming open source using GPL is a bad idea and that Linus Torvalds stole Linux from MINIX, which I wrote. Linus, the alleged stealer, responded. As the alleged stealee I also felt the need to respond. Now Ken Brown has reacted to my responses. I very much doubt that when he came to visit me, he was expecting me to (1) defend Linus in our interview and then (2) do it fairly publicly later.

I was planning to spend my Sunday afternoon doing something useful, but since Brown has directly challenged me in his posting cited above, I feel I should respond. I will do this in the form of commenting on his posting. His comments are set off typographically like this:
"Samizdat is a series of excerpts from an upcoming book on open source and operating systems that will be published later this year. AdTI did not publish Samizdat with the expectation that rabidly pro-Linux developers would embrace it."

I have to give credit where credit is due. Brown got that one completely right.
"The United States is the home of the United States Patent and Trademark Office, an internationally respected agency which contributes to the worldwide effort to protect and govern intellectual property."

***EVERY*** country has a patent office. The United States is not unique in this respect. Furthermore, many people think that patenting software is a terrible idea. The subject of software patents is a very controversial issue in Europe right now.
"The Samizdat report recommends that the U.S. government should invest $5 billion in research and development efforts that produce true open source products, such as BSD and MIT license-based open source. Government investment in open source development will accelerate innovation."

I can live with this. Professors are always on the lookout for new sources of research funding.
"The disturbing reality is that the hybrid source model depends heavily upon sponging talent from U.S. corporations and/or U.S. proprietary software. Much of this questionable borrowing is a) not in the best interest U.S. corporations ..."

Excuse me? A Finnish student writes some software (in Finland) that a lot of people like and he is accused on sponging off U.S. corporations? And last time I checked, quite a few U.S. Corporations, such as IBM, seemed quite happy with Linux. And a very large number of U.S. corporations seem to be using the (open source) Apache web server. And even if open source weren't in the best interest of U.S. corporations, where is it written that all activities everywhere in the world must be done with the interests of U.S. corporations as their primary goal?
"Linux is a leprosy; ..."

This statement is not grammatically, politically, or factually correct. Does he mean "Linus has Hansen's disease"? I hope not. But if he does, fortunately, it is highly treatable these days. If he means Linux is wasting away, the facts speak otherwise. If he means "Linux is very contagious" this is true, but a better wording could have been chosen.
"... and is having a deleterious effect on the U.S. IT industry because it is steadily depreciating the value of the software industry sector. Software is also embedded in hardware, chips, printers and even consumer electronics. Should embedded software become 'free' too, it would be natural to conclude the value of hardware will spiral downward as well."

If, say, HP puts free software in its printers, how does this reduce the ***value*** of their printers? It would reduce the cost a little, which in a competitive marketplace might encourage them to drop the price somewhat, but I don't see why having cheaper printers is such a bad thing.
" ... Torvalds and the Linux kernel management team accept blind source code contributions. Then, they ask for a certification. But the certification does not hold the contributor, the Linux community, or Torvalds legally accountable. Nor does it guarantee that the source is produced in a 'clean room'."

This comment is actually true, but it holds for all software and all products. How does a commercial company with thousands of programmers know where all their code comes from? You might say: "The lawyers check each line of code to see if it is copyrighted." Sure. Maybe that is why there are so many lawyers. There is a lot of code to check.
A Brief History of Windows NT/2000/XP

Does Microsoft own Windows? Maybe HP does. Some history may be in order here. Windows 3.1, 95, 98, and ME were basically glorified shells running on top of 16-bit MS-DOS (which Microsoft didn't write, but bought from a company called Seattle Computer Products). In the 1980s, Microsoft realized that it would some day need a true 32-bit operating system. At about this time, David Cutler, one of the principal architects of the operating system for the DEC VAX, VMS, had just moved to Seattle to set up a development center to produce the successor to VMS. When top executives at DEC killed his project in 1988, Cutler decided to leave DEC and was quickly hired by nearby Microsoft to lead the team that produced Windows NT. Cutler took some of his key people with him. This was definitely a coup for Microsoft. Operating system designers of Cutler's quality are few and far between.

To make a long story short, Cutler and his team succeeded and the result was Windows NT. When the Windows 98 user interface was added and some small improvements made, it was renamed Windows 2000. A slightly modified version is now sold as Windows XP.

Not surprisingly, WNT looked a lot like VMS (just add one to each of the letters). After all, the same person was the chief architect of both of them. When a talented designer writes a 32-bit operating system and a few years later writes another 32-bit operating system, it is possible they might have some serious resemblances. I don't know if any code is the same. For details, see an article by Mark Russinovich. When DEC learned about WNT, they had some discussions with Microsoft and something in excess of $60 million was transferred from Redmond to Maynard to solve the problem. The case never went to court (probably because Microsoft wanted to get WNT out the door quickly and not get bogged down in years of litigation, even if they thought they would win). A few years later, DEC sued Intel for allegedly violating DEC's patents on the Alpha chip, although the case was settled out of court. By 1990, however, it was clear to everyone that the minicomputer era was over, despite the remark by DEC's president, Ken Olsen, "Nobody needs a computer in their [sic] house." By the mid 1990s, DEC may have been grasping at straws, threatening everyone in sight, just to survive. It didn't work and in 1998 DEC was bought by Compaq, which in turn was bought by Hewlett-Packard, which now owns the rights to VMS.

If Microsoft could not make sure its star programmer, who was known to have done similar work for a competing company, did not misuse some IP, how can they or any company make sure its thousands of programmers don't do something they shouldn't do? It is impossible. The problem of programmers misusing code is real but the problem is not unique to free software. And how can any company make sure its researchers, engineers, and other employees do not use techniques or processes patented by its competitors. It can't be done. But to say the problem of theft of IP is somehow greater for free software than for commercial software is completely unproven.
"He says Linus couldn't possibly have written that much code," said Tanenbaum. "But there's tremendous variation from programmer to programmer-- some research I saw says maybe as high as 30 to 1 for great programmers and poor ones -- and Linus could easily be in the top 10 percent or top 1 percent of all programmers.
--Lisa Stapleton, Linux Insider, May 21, 2004"

This quote is taken out of context. In it "that much code" refers to the current Linux operating system. Nobody has ever claimed Linus wrote every line of code in the current distribution." My point was that a decent programmer could easily have written the 10,000 lines of code in Linux 0.01 in a year. Probably more.
"AdTI and Tanenbaum do agree on one point: the Linux kernel is an incredible, but conspicuous accomplishment."

Actually, we don't agree on this. I wasn't all that impressed with the monolithic design of Linux 0.01. I think I have made that point a couple of times already.
The Interview
"As many are aware, I interviewed Professor Tanenbaum, the author of Minix, a copyright protected property by Prentice Hall. On March 8, 2004, Professor Tanenbaum sent me the following e-mail: "MINIX was the base that Linus used to create Linux. He also took many ideas from MINIX, including the file system, source tree, and much more."

Linus used MINIX as his development platform. There is no dispute about that. He also used some ideas from MINIX. But MINIX wasn't original either. Here is a little bit of the history

Linux used ideas from MINIX
MINIX used ideas from UNIX
UNIX used ideas from MULTICS
MULTICS used ideas from CTSS
CTSS used ideas from FMS

In science, all work is based on what came before it. Nothing unusual here. What Linus didn't do was steal the MINIX code. That has been well documented.
"In an interview with Tanenbaum, it became immediately noticeable that the professor was an animated, but tense individual about the topic of rights and attribution. He felt that well-known facts about Minix/Linux development should not have to be questioned. It was clear that he was very conflicted, and probably sorry that he sent the email in the first place."

I'm pretty animated all the time. But I only get tense when people try to put words in my mouth. After half an hour of repeatedly answering the question "Could Linus have written the Linux kernel by himself?" in the affirmative, I was getting a bit irritated. Beginning psychoanalysts often take this for being conflicted. People who know me would probably confirm that I do not suffer fools gladly.
"Question #1: Is it likely that a student (Linus Torvalds) with no operating systems experience, a non-Unix licensee, without any use of Minix or Unix source code, could build a functioning kernel in six months -- whereas it took you (Tanenbaum) three years to build Minix?"

As I have said before, I wasn't working on it full time at all. I had a regular job and I read bedtime stories to my kids every evening. Ironically, the main character in these wonderful books by Sheila McCullagh was Roger Red-hat. Conspiracy theorists should go wild with this new information.
"In Tanenbaum's recent posts(5), he argues (as he told me) that there are "others" that have created Unix clones or operating systems within the same constraints. Tanenbaum's argumentation only increased our doubt about the Torvalds story because the comparisons were too unbelievable. For us to accept Tanenbaum's argument, Linus Torvalds at 21, with one year of C programming, was Doug Comer, an accomplished computer scientist, or smarter than the Coherent team, and of course a better programmer than the good professor too."

While I definitely encourage my students to think that professors are infallible, especially in the matter of grading exams, not all CS professors are top programmers. Of the professors in my department, there are many who can barely program at all. The fact that one or two professors are good programmers does not imply that students are necessarily bad programmers. Furthermore, the first version of Linux wasn't so great. I have made that point before as I recall.
"Tanenbaum told us about the Coherent project repeatedly, but it was easy to research that it was a completely different situation. It wasn't a solo effort, it was a team. Second, the timeline was wrong. Tanenbaum told us it took two years, then corrected himself on his own website writing it took six years."

Yes, I corrected myself. It was 6 man-years, not six real-time years. But in that time they wrote the complete operating system, a C compiler, and all the utilities. In his posting, Brown says the GNU C compiler is now 110,000 lines of code. Maybe the Coherent compiler was half that, or 60,000 lines of code. The MINIX utilities were about 30,000 lines of code and covered about the same ground as Coherent did. Add a 10,000 line kernel to this and it looks like the three Coherent programmers wrote 100,000 lines of code in 6 man-years. That is a productivity of 16,000 lines per man-year. In that light I don't see why it is plausible for Canadian students to produce 16,000 lines a year but not plausible for Finnish students to produce 10,000 lines a year. It is just as cold in Finland as in Canada so programmers are never tempted to go outside.
Can One Person Write a Kernel?
"Both Ritchie and Thompson had exceptional familiarity with MULTICS-- and then wrote UNIX from scratch. Completely different from Linus, who says he started with nothing and had no experience. Another reason this is interesting is because the Ritchie, Thompson kernel was 11,000 lines of code over a number of years, and the Torvalds kernel was 32,000 in under a year.

Ken Thompson was a young programmer who worked on MULTICS. He wasn't one of the designers. Dennis Ritchie did not write any of the MULTICS code, although he had a part-time job at MIT writing some documentation on the MULTICS file system while he was a graduate student at Harvard. To say they were exceptionally familiar with MULTICS suggests that both of them knew the kernel inside and out, which is not true. Ken wrote the first version of UNICS by himself in assembly code on a PDP-7. I think it took less than a year. He did not have Lions' book available since it was not going to be written for another decade or so. He just sat down at his terminal, probably an ASR-33, and started typing. Dennis was not involved in the first version at all. Linux 0.01 was not 32,000 lines of code. It was just under 10,000 lines.
"Another problem with Tanenbaum's logic is that he only presents examples of people that were Unix licensees, had Unix source code, or who were exceptionally familiar with software development. He cannot provide one example reasonably comparable to the Torvalds case."

In my earlier posting, I pointed out almost half a dozen OS kernels written in around a man-year. Most of them were not UNIX licensees. I even forgot one--IDRIS--written by Bill Plauger. I think Linus' writing Linux in C on a PC with at least 64 KB was easier than Ken's writing UNICS in assembler on a 4K PDP-7. Ken's experience with MULTICS (which initially failed to boot because it didn't fit in the 256K memory of the large mainframe it was written for) didn't help much in writing assembly code for a tiny minicomputer. In short, Linus' writing Linux for the PC is not so different from Ken's writing UNICs for the PDP-7. Ken had a bit more experience, but the use of assembler and the tiny memory made the job harder. I find the argument that something can't be done because the half-dozen people who already did it were more experienced than the next one pretty strange. Doing anything is easier once someone else has shown that it can be done.
"Issue [sic] #2: Why do accounts continually assert that Torvalds "wrote Linux from scratch"?"

Maybe because everyone familiar with the facts, except Ken Brown, came to the same conclusion? How come nobody is challenging the fact that Dennis designed the C language and wrote the first C compiler all by himself? That was probably as hard as writing a kernel.
"Question #3 : If Linux was based on Minix, doesn't it owe rights, attribution to Prentice Hall?"

First, Linux 0.01 does not contain any MINIX code, as Alexey Toptygin's code comparison shows. Second, even if it had, there was no prohibition in using MINIX code for noncommercial purposes, even in the beginning. I find it dishonest in the extreme for Brown to have hired Toptygin to compare the Linux and MINIX code, get a report saying they were completely different, and then merrily continue claiming Linux was based on MINIX. I don't know if Brown used MS-Word to write his book, but saying Linux is based on MINIX is like saying Brown's book is based on MS-Word.
Follow Up With Torvalds
"AdTI contacted Torvalds employer OSDL to interview him for clarification. Without any facts, Tanenbaum goes as far to post that AdTI did not try to contact Linus, but this is contradicted by the attached post. The OSDL contact person tells AdTI that if Linus doesn't get back to us, he is not interested in being interviewed."

BEFORE stating that Brown did not talk to Linus, I asked Linus if Brown had interviewed him. Here is an except from his e-mail to me:

----------------------

AST: Did Brown come visit you?
Linus: Nope. I can't even find any emails in my archives, so unless he used some other name or it got marked as spam and deleted, he never even tried to approach me.

----------------------

At the very least, Brown didn't try very hard. During the past couple of weeks, reporters from all over the place have managed to locate me for interviews. Surely it would not have been that hard for Brown to contact Linus about something this incendiary.
The Truth Finally Emerges
"Vrije University is a very cool place. AdTI encourages anyone that spends any time in Amsterdam to visit. At the good professor's recommendation, AdTI spent a number of hours talking with Vrije university computer science faculty. They were great fun and extremely helpful. For that, we are also very grateful."

Score another point for Ken Brown. We have this great masters program in parallel and distributed systems...
"Professor Tanenbaum did not convince AdTI that Linus Torvalds wrote the Linux kernel from scratch. "

I was on the debating team in high school. I guess I am getting rusty.

All in all, Brown's only argument is that he, personally, doesn't believe a 21-year-old kid could have written an operating system kernel in a year, despite the fact that half a dozen other people had done the same thing earlier and the code Linus wrote wasn't all that great initially. And faced with a whole bunch of people telling him otherwise and the consultant he hired to examine the code saying the code is completely different from MINIX, Brown just ignores all the facts and persists in his belief. I'll bet he dismisses the widely reported claim that Mozart wrote three symphonies and performed for the King of England when he was nine on the grounds that 9-year-olds don't normally do this sort of thing.

Andy Tanenbaum, 6 June 2004

OT: PluggedIn: Step Aside TiVo, Here Comes Freevo

Yahoo! News - PluggedIn: Step Aside TiVo, Here Comes Freevo

LINUX: Build Your Own PVR :: Why Tivo When you can Freevo?

Build Your Own PVR :: Why Tivo When you can Freevo?

M$: Preview of Windows XP Service Pack 2

Preview of Windows XP Service Pack 2 - OSNews.com

LINUX: Four out of four experts agree: Linux lowers TCO

IT Manager's Journal | Four out of four experts agree: Linux lowers TCO
.
Title Four out of four experts agree: Linux lowers TCO
Date 2004.06.08 12:01
Author editingwhiz
Topic Systems Management
http://management.itmanagersjournal.com/article.pl?sid=04/06/04/2114222

Can a company count on Linux to lower the total cost of ownership (TCO) of an enterprise system? Reaction to this question from CIOs and IT managers usually goes something like: "Well, of course it saves money on the bottom line. No sky-high enterprise licensing fees every year. No over-the-top support subscription costs; you can maintain the code in-house. Way fewer security and access issues, keeping the system down time low. No paying for unnecessary bells and whistles on end-user software. No worrying about mandatory upgrades every year and a half."

We talked to independent analysts, developers, and IT company executives. They all pretty much agree on one answer to the question: Yes, generally there are fair to good TCO savings with Linux -- sometimes huge savings. But variables in every organization's mix will determine exactly what that monthly, quarterly, or yearly savings will be.

No one-size-fits-all answer

Key factors include what Linux distro you're using; what functions you need handled; what hardware you're using; what limitations you might have if you're doing a Windows-to-Linux transition or starting from scratch; and how much hands-on experience your IT staff has with Linux or a Unix-like OS.

IBM's take on Linux TCO

Dr. John Shedletsky, vice president of Competitive Technologies at IBM, runs the Competitive Technology Lab for Big Blue. Shedletsky and his team host competitive seminars for business partners and potential customers to illustrate the technical differences between IBM WebSphere and its competition.

Shedletsky, a key company insider who early on pushed for including Linux options in the company's product line, said he thinks there is no doubt that utilizing Linux lowers the TCO of any system -- anywhere from "somewhat" to "substantially."

"Yes, you save the product licensing fees off the top, which is substantial, but there is another subset of regular fees that certain companies (guess who?) don't want to talk about when they're in the sales mode," Shedletsky said with a slight twinkle in his eye.

These are customer access licenses (CAL), which can account for much more off the bottom line than a CIO might expect -- sometimes as high as 60 percent to 70 percent of the total cost of ownership of a proprietary system, Shedletsky said.

Microsoft, among others, charges for CALs in almost all of its enterprise software sales. Customer access license fees are levied on a per-employee/per-application scale and most often are used for standardized desktop support packages.

Commercial Linux vendors such as Red Hat charge for an enterprise license, but not for customer access licenses. IBM doesn't charge for CALs in its Linux offerings but (famously) makes its money on global support services.

One of the biggest advantages, Shedletsky said, in the TCO of a Linux/open source-based system isn't a dollar figure at all. "It's the simple fact that you as an organization are escaping a single-vendor lock-in. And this means that when it comes time to renegotiate your license renewals, you'll have a lot more power on your side if you have alternatives ready to install. Take for example SQL Server, Exchange, and ASP. If you're ready to plug in MySQL or Sleepycat, Apache Tomcat, and Perl, you'll have a lot more leverage in your negotiations."

'Move at your own pace' with Linux

A Linux system also means "you can move at your own pace" in upgrading or replacing various parts of the system, Shedletsky said, without being forced into upgrades and new components an organization may not need. Being forced to buy new software -- and resulting services -- simply because a vendor is upgrading its versions is a major fiscal headache for many businesses.

"There are still a lot of older systems out there that work quite well, and companies don't see the need to upgrade equipment and software unless they see a real business reason to do so," Shedletsky said. "A proprietary system lock-in can put a lot of undue pressure on companies to add new components that they don't really need."

Shedletsky said that "there are 4.7 million Windows NT servers still out there in operation, but they've reached the end of life. Microsoft stopped supporting them at the end of 2003. What are those companies going to do to replace them? Those decisions all must be made at some point."

Being able to modify and tune up code in house obviously is a big Linux cost advantage, Shedletsky said, as it allows companies to bypass expensive proprietary support services. However, Shedletsky said, companies often have to invest more in Linux-trained developers, who generally command more in salary, than, say, one trained in Visual Basic, C#, Java, and .Net.

Shedletsky is currently on a world tour, talking to customers, potential customers, developers, and IT managers about converting to Linux in enterprise systems.

"What surprises me the most is that we don't have to evangelize Linux, not one bit," he said. "In fact, we're finding that people are coming to us first, asking us how they can move over to Linux as soon as possible. I'd say more than half of the people we're speaking to -- maybe 60 percent -- are already quite familiar with Linux and want to know how to implement it. We've been outlining how to do this step by step, and they're really appreciative."

META Group's new study

META Group vice president Corey Ferengul, who wrote a recent opinion titled "Equating Linux TCO Requires New Equation: Operations Strategies, Infrastructure Strategies," is one Linux industry analyst who sees more and more companies trying to improve their systems' TCO through alternative IT products.

"We historically have taken the position that Linux has the same TCO as Windows," Ferengul said. "However, the potential for a lower Linux TCO exists, depending on what choices an organization makes, how much work it wants to take on itself, and how much risk it desires."

There are certain items that affect TCO and are inherent to a platform; thus, users cannot alter their effect on TCO (e.g., platform stability, number of patches). But organizations can make choices that shift the TCO of Linux, reducing it anywhere from 10 percent to 40 percent, Ferengul said.

Ferengul has identified five key choices, which result in the following formula:

Distribution + Support + Management Tools + Software Stack + Use Case = User-Controllable TCO

Breaking his formula down, Ferengul said:

* Distribution: This is the decision about whether to use a commercial -- as opposed to a free -- distribution. Most IT managers will see it an advantage for lower TCO, because a commercial distro is more likely to stabilize the Linux implementation as well as applications, resulting in fewer changes and fewer support issues. By not using a commercial distribution, enterprises save the cost of the customized (and enhanced) distributions.
* Support: If an organization is using a commercial distribution, does it purchase support? From whom? Support is expensive, and there are many choices. Not getting support saves money but potentially exposes an organization to risk.
* Management tools: The decision involves how to manage Linux. Linux has a healthy set of open source management tools, and commercial management tools continue to mature. Most management vendors (e.g., Computer Associates, BMC Software, IBM's Tivoli, Hewlett-Packard) now support Linux (at least Red Hat and SUSE distributions) with mainstream monitoring and management tools. In addition, Red Hat and Novell each has solid tools for supporting patches and other functions for managing Linux.
* Software stack: What software stack will the organization use for Linux? Will it choose MySQL or run Oracle on it? There are obvious cost implications to selecting open source infrastructure framework services (e.g., databases, Web servers, Web application servers).
* Use case: How will Linux be used? If an organization chooses to use Linux as a consolidation platform, it incurs the cost of virtualization software and the additional support that goes with it. However, if Linux is an edge device for Web servers, much less administration is required, offering lower ownership costs.

"Most large enterprises will make choices that result in Linux lifetime costs equaling those of other platforms," Ferengul said. "However, the fact that these choices exist illustrates the power and long-term effect Linux and open source are having and will continue to have on technology decisions."

Ferengul's bottom line: Organizations can make the choice to lower the TCO of Linux, but they will inherit other risks.

The more, the merrier

One factor remains constant in favor of Linux: scale. The larger the number of Linux servers that are on line, the more cost-saving that can be applied.

John Koenig, an analyst with Riseforth, Inc., of Half Moon Bay, Calif., and an open source SIG leader with SD Forum of San Jose, Calif., said that particularly large server farms realize a "huge" cost savings by using Linux.

"A good example is Google, which is rumored to be using more than 100,000 Linux servers now," Koenig said. "Just think of the economy of scale in a large system like that. How much is being saved? Who knows exactly how much value that Linux system has brought to Google over the nine years it's been in business?"

Koenig has written extensively on the effects of open source software on business systems and serves as a consultant on the topic for several large corporations. He also is knowledgeable about the use of Linux in embedded systems, a section of the IT market that is beginning to show traction in cell phone and handheld device sales this year. Linux systems can save a lot of money for telcoms and device manufacturers that produce these items in huge quantities. The Linux economy of scale comes into play here, too.

In a recent story on open source business strategies, Koenig pointed out that:

Linux and other open source software delivers great value in the embedded market. The inherent technical advantages of Linux for embedded systems include stability, small footprint, and networking. Through the IPv6 implementation, Linux can address thousands of embedded devices. The Linux kernel is well-known for its stability. Linux has relatively low latency, and is generally capable of driving hardware across the embedded device spectrum. Where embedded applications present a real-time performance challenge, the Linux kernel can run as a task under a real-time OS. Linux includes well-documented device drivers. A large support community exists, deeper and potentially more responsive than many proprietary vendors can field.

'Appealing ROI, regardless of the scale'

IT analyst Dr. Salvino Salvaggio, currently administrator of the Internet portal at Qatar Telecom and a former consultant at McKinsey & Co., has published a thorough, 221-page examination of the impact of open source and free software on the enterprise. In it, Salvaggio contends that using Linux within an enterprise system is going to lower the total cost of ownership, "regardless of the scale."

In his new report, Salvaggio cited a 2002 Robert Frances Group analysis that said the total cost of ownership of a Linux Debian server compared to a Windows Server Enterprise Edition would be a full 40 percent less over a three-year span. The following were the key factors cited in the study:

* Down time
* Software license, maintenance, and support
* Training
* Hardware
* Discounts if purchase of high volume
* System administrators
* Depreciation of hardware: three years

"There are lower hardware requirements and minimal costs for licensing for Linux," Salvaggio said. "And there are usually more costs associated with training, administrative procedures, and acquiring new applications (such as OpenOffice.org, Mozilla, Evolution, etc.)." But on balance, he concluded, you're going to realize a better ROI, no matter the size of the company.

So, there you have it -- four well-informed professionals, all agreeing that you can't help having a lower TCO using Linux in an enterprise system.
Links

1. "recent story on open source business strategies" - http://management.itmanagersjournal.com/article.pl?sid=04/05/10/2052216&tid=85
2. "Dr. Salvino Salvaggio" - http://www.salvaggio.net/
3. "221-page examination" - http://www.salvaggio.net/index.php?page=publications&cat=report

UNIX: Virtually Minix: A Tutorial & Intro to Minix on XP via Bochs

Virtually Minix: A Tutorial & Intro to Minix on XP via Bochs - OSNews.com

OT: Gentoo Foundation Achieves Official U.S. Not-For-Profit Status

Newsflash: Gentoo Foundation Achieves Official U.S. Not-For-Profit Status (LinuxWorld)

FREE: Book Giveaway: Snort 2.1 Intrusion Detection 2nd Edition

:: News : Security : Book Giveaway: Snort 2.1 Intrusion Detection 2nd Edition

SEC: Wireless Hackers Leave No Tracks

Wireless Hackers Leave No Tracks - Computerworld

SEC: Snort 2.1.3 released

Hello!

The Snort Team is pleased to announce the release of Snort 2.1.3.
Thank you to the community for using and testing out the Release
Candidate, your feedback is appreciated!

The differences between RC1 and Final are listed below:

* Fixed rule read up error when parsing hexmode content options.
Thanks for pointing it out Toni Maatta.

* Fixed null pointer dereference when detect_scans were enabled and
creating a new session that had odd TCP flags. Thanks to Chad
Kreimendahl for reporting the bug and testing the fix.

We recommend that everyone using RC1 upgrade to the 2.1.3 Final
release. The snort source can be found in the usual place:

http://www.snort.org/dl/

and RPMs (maintained by rpms@snort.org folks):

http://www.snort.org/dl/binaries/linux/

Cheers!
The Snort Team

VIRUS: Possible First Crypto Virus Definitely Discovered!

Billy B. Bilano
to full-disclosure
More options 11:53am (10 hours ago)
Salutations, amigos!

Bill Bilano here, reporting in from the front-lines! I've got some
disturbing news that I've got to get some answers about while I share. I
think we're about to come under full hacker attack at any second! And to
those people that said us folks talking about crypto viruses were being
chicken littles... let me tell you, the sky just fell! And it is HEAVY!

I was sitting at my desk doing more research on the OPENBSD virus I
discovered last week. I was watching ethereal and monitoring the traffic
coming in and out of the facility and I saw a ton of traffic coming straight
for our web servers! The routers, firewalls, and intrusion detraction
systems were not sounding the red alarms like they should have been (we'll
get to THAT one later).

There appears to be a new virus in town and it's affecting Windows and UNIX
web servers! I have not identified a pattern of infection yet but the virus
is clearly advancing but it only affects web servers!

The virus works on port 443. It seems to accept inbound connections on that
port as well and, presumably, awaits for commands from some series of
servers elsewhere. Perhaps taking orders? I also captured some of the
traffic and attempted to analyze it up but it looks like -- you heard it
here first, folks -- the payload is encrypted! Is this the first of a coming
storm of crypto viruses we've all been eagerly fearing? (I have already sent
a copy of the payload to the distributed.net people so they can try to use
some of those wasting cycles to decipher it like they did the last one!)

I have taken the liberty of naming the virus already. I looked in
etc/services and saw that this port is for and it is something called "ssl"
so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
thing!)

I called in our webmaster and showed him the data. He is either too stupid
to know what's going on or he takes me for a fool. I got him in the
conference room and showed him the print outs. He tried to convince me it
was not a virus and just normal web traffic but web traffic is on port 80!
No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
his marching orders. I have no time for this kind of bull, what with the
OPENBSD virus last week (still picking up the pieces there). He must have
known I was on to him because he was just laughing on his way out the front
door. He may have even been involved with the infection! Good riddance,
chump!

At any rate, this is your heads up, folks! You heard it here first! Be on
the lookout for this first, very nasty CRYPTO VIRUS!

P.S. I wonder if this virus was from a spam-gang?!

P.P.S. Check out my bloglog in my sig!

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Billy to join Gmail


madsaxon
to full-disclosure
More options 12:32pm (10 hours ago)
At 10:53 AM 6/8/2004 -0500, Billy B. Bilano wrote:

>Bill Bilano here, reporting in from the front-lines! I've got some
>disturbing news that I've got to get some answers about while I share. I
>think we're about to come under full hacker attack at any second! And to
>those people that said us folks talking about crypto viruses were being
>chicken littles... let me tell you, the sky just fell! And it is HEAVY!

Anyone else notice that it's getting harder and harder to tell
F-D from The Onion?

;-)

m5x
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite madsaxon to join Gmail


Harlan Carvey
to full-disclosure, Billy
More options 12:40pm (9 hours ago)
Bill,

From your post, you don't seem to have a great deal of
detailed information to share about this issue...

> The virus works on port 443.

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands
> from some series of
> servers elsewhere. Perhaps taking orders?

What information do you have to support this
assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks
> like -- you heard it
> here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't
you expect it to be encrypted?

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly
> fearing?

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal
of information in your post that supports any of your
assertions/assumptions. If this thing is spreading
the way you say it is, then it's a worm.

Regardless, there isn't any information in your post
that clearly shows that this worm infects both Windows
and Unix hosts. In fact, one thing that does seem
clear in your post is that you haven't collected any
information from the "infected" hosts, but rather all
you've got so far is network traffic via
Ethereal...and to be honest, any worm running over SSL
is going to be encrypted...

> At any rate, this is your heads up, folks! You heard
> it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!

Thanks. Noted.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Harlan to join Gmail


Billy B. Bilano
to full-disclosure
More options 1:05pm (9 hours ago)
Hi Harlan! Thanks for your reply... hard to make heads or tails of what you
are saying though...

> Wouldn't it then be, by definition, a worm?

A worm or whatever you want to call it, that's cool. I just thought "virus"
sounds more alarming than worm! Everybody has had a worm or two, but a virus
is a tough cookie to crack!


> What information do you have to support this
> assumption?

Because it is attacking our web servers and it seems to have somehow gotten
installed on our web servers at the same time! I don't know how it got in,
but there is traffic going in and out of the servers on port 443 with an
encrypted payload! I don't know what is answering on port 443 on the web
servers, but for the life of me I can't find anything on them that looks
like it's a virus or a worm or a troglodite or anything!


> If this worm runs over SSL, as you say, then wouldn't
> you expect it to be encrypted?

Whatever ssl is, I don't know but it's using the so-called "ssl" port on the
web servers. I don't think it has anything to do with whatever ssl was back
in the old days of UNIX. It has a lower port number and that means it's an
older port! Probably from the 1970s!

Besides, why should I see any encrypted traffic on any port other than SSH?
I don't expect to see encryption on anything other than the SSH port 22
(which is a very old port).


> Regardless, there isn't any information in your post
> that clearly shows that this worm infects both Windows
> and Unix hosts. In fact, one thing that does seem
> clear in your post is that you haven't collected any
> information from the "infected" hosts, but rather all
> you've got so far is network traffic via
> Ethereal...and to be honest, any worm running over SSL
> is going to be encrypted...

But this port 443 is not SSH! Why should it be encrypted? And what is this
"ssl" thing? I've been in IT for many years and I am now IT Director here at
the bank... I would think that I would know what "ssl" would be. I don't
think this worm has anything to do with whatever "ssl" is. Does anybody even
still use ssl? That's probably why the hackers chose it.

P.S. Check out my bloglog, Harlan!
- Show quoted text -

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Billy to join Gmail


Billy B. Bilano
to full-disclosure
More options 12:46pm (9 hours ago)
Steve,

Sorry to say but it is not! I checked my incoming traffic again this morning
and the attack on port 443 is still coming in full steam ahead! I don't know
what's going on, but I am about to block that port on my firewall. Some
nitwit (probably the idiot that was here before I became IT Director)
somehow, for some reason, deliberately opened port 443 on the firewalls!

I am beginning to think that this is the first wave of the new coming global
crypto-storm!

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS


----- Original Message -----
From: "-----, Steve" <----------------------->
To: "Billy B. Bilano"
Sent: Tuesday, June 08, 2004 11:34 AM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Please tell me this is just a really bad joke?
- Show quoted text -
>
> -----Original Message-----
> From: Billy B. Bilano
> [mailto:mr.bill.bilano@email.server.unix.bill.bilano.biz]
> Sent: Tuesday, June 08, 2004 10:53 AM
> To: full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Salutations, amigos!
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Billy to join Gmail


William Warren
to full-disclosure
More options 2:11pm (8 hours ago)
this is highly shortsighted..well maybe not..if you do not have any
users who do not use https...:)
- Show quoted text -

Billy B. Bilano wrote:
> Steve,
>
> Sorry to say but it is not! I checked my incoming traffic again this morning
> and the attack on port 443 is still coming in full steam ahead! I don't know
> what's going on, but I am about to block that port on my firewall. Some
> nitwit (probably the idiot that was here before I became IT Director)
> somehow, for some reason, deliberately opened port 443 on the firewalls!
>
> I am beginning to think that this is the first wave of the new coming global
> crypto-storm!
>
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
>
>
>
> ----- Original Message -----
> From: "-----, Steve" <----------------------->
> To: "Billy B. Bilano"
> Sent: Tuesday, June 08, 2004 11:34 AM
> Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
>
>
>>Please tell me this is just a really bad joke?
>>
>>-----Original Message-----
>>From: Billy B. Bilano
>>[mailto:mr.bill.bilano@email.server.unix.bill.bilano.biz]
>>Sent: Tuesday, June 08, 2004 10:53 AM
>>To: full-disclosure@lists.netsys.com
>>Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
>>Discovered!
>>
>>Salutations, amigos!
>>
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

--
My "Foundation" verse:
Isa 54:17 No weapon that is formed against thee shall prosper; and
every tongue that shall rise against thee in judgment thou shalt
condemn. This is the heritage of the servants of the LORD, and their
righteousness is of me, saith the LORD.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite William to join Gmail


Oliver Welter
to full-disclosure, Billy
More options 1:43pm (8 hours ago)
hi Guys,

I'm new to the list, so hello first ;)
I really dont know if you are just kidding or if I missunderstod your
post...
Port 443 is the SecureHTTP protocol (https) - so it is correct that it
is bound to a webserver process and it is correct that SSL-encryptet
traffic goes in and out - so whats the matter ?

Oliver
--
Diese Nachricht wurde digital unterschrieben
oliwel's public key: http://www.oliwel.de/oliwel.crt
Basiszertifikat: http://www.ldv.ei.tum.de/page72

Attachments: smime.p7s (application/x-pkcs7-signature) 3K

ReplyReply to allForwardInvite Oliver to join Gmail


James Bliss
to full-disclosure
More options 1:46pm (8 hours ago)
> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
> the web servers. I don't think it has anything to do with whatever ssl
> was back in the old days of UNIX. It has a lower port number and that
> means it's an older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
> SSH? I don't expect to see encryption on anything other than the SSH
> port 22 (which is a very old port).

You are kidding, right? SSL = Secured Sockets Layer. It probably includes
encryption. It would not be too _SECURE_ if it was plain text.

SSH = Secured Shell

Notice the use of _SECURED_ in both their names?
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite James to join Gmail


dila
to full-disclosure
More options 1:09pm (9 hours ago)
j00 d0nt f00l u5
- Show quoted text -

"Billy B. Bilano" wrote:
>
>Salutations, amigos!
>
>Bill Bilano here, reporting in from the front-lines! I've got some
>disturbing news that I've got to get some answers about while I share. I
>think we're about to come under full hacker attack at any second! And to
>those people that said us folks talking about crypto viruses were being
>chicken littles... let me tell you, the sky just fell! And it is HEAVY!
>
>I was sitting at my desk doing more research on the OPENBSD virus I
>discovered last week. I was watching ethereal and monitoring the traffic
>coming in and out of the facility and I saw a ton of traffic coming straight
>for our web servers! The routers, firewalls, and intrusion detraction
>systems were not sounding the red alarms like they should have been (we'll
>get to THAT one later).
>
>There appears to be a new virus in town and it's affecting Windows and UNIX
>web servers! I have not identified a pattern of infection yet but the virus
>is clearly advancing but it only affects web servers!
>
>The virus works on port 443. It seems to accept inbound connections on that
>port as well and, presumably, awaits for commands from some series of
>servers elsewhere. Perhaps taking orders? I also captured some of the
>traffic and attempted to analyze it up but it looks like -- you heard it
>here first, folks -- the payload is encrypted! Is this the first of a coming
>storm of crypto viruses we've all been eagerly fearing? (I have already sent
>a copy of the payload to the distributed.net people so they can try to use
>some of those wasting cycles to decipher it like they did the last one!)
>
>I have taken the liberty of naming the virus already. I looked in
>etc/services and saw that this port is for and it is something called "ssl"
>so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
>thing!)
>
>I called in our webmaster and showed him the data. He is either too stupid
>to know what's going on or he takes me for a fool. I got him in the
>conference room and showed him the print outs. He tried to convince me it
>was not a virus and just normal web traffic but web traffic is on port 80!
>No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
>his marching orders. I have no time for this kind of bull, what with the
>OPENBSD virus last week (still picking up the pieces there). He must have
>known I was on to him because he was just laughing on his way out the front
>door. He may have even been involved with the infection! Good riddance,
>chump!
>
>At any rate, this is your heads up, folks! You heard it here first! Be on
>the lookout for this first, very nasty CRYPTO VIRUS!
>
>P.S. I wonder if this virus was from a spam-gang?!
>
>P.P.S. Check out my bloglog in my sig!
>
>--------
>Mr. Billy B. Bilano, MSCE, CCNA
>
>Expert Sysadmin Since 2003!
>'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
>
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite dila to join Gmail


KF (lists)
to full-disclosure
More options 2:00pm (8 hours ago)
I really hope this guy is not THIS retarded... her was certainly smart
enough to leave the XSS enabled on his guest book (which of course he
called a virus)...

6/8/04
Javascript hackers in my guestbook! GUESTBOOK UNDER SIEGE! I guess I
upset somebody with my finding out about their silly port 443 virus! I
have disabled javascript on the guessbook for the time being! No more
javascript virus!

http://www.bilano.biz/passwords.html

some passwords so I don't forget:

network/server password system
------------------- --------------- ----------------
192.168.0.0/24 lips all servers have same password to make it easy
they are all in the same rack!
192.168.1.2/32 doodoo border router
192.168.1.3/32 doodoo border router failover
192.168.1.7/32 mormons the server that the ceo runs for his church.....
192.168.1.10/32 scat sun e10k (solaris)
10.200.0.10 scat sun el0k interface 2 (solaris root TELNET ONLY)

SQLserv1 nugg3tt3r SQL sa password (i should not have this but DBA don't know)
SQLserv2 laps1c1e SQL sa passwd (thanks DSNIFF! LOL)
SQLserv3 jumpsh1p sa password again... why does he change them on each one?
openbsd root simple but easy to remember password!
openbsdcarp root
openbsdapache root

they don't know i have this installed...
ceolaptop helloceo vmware works great!
cfolaptop hellocfo vmware again
ctpdesktop hellocto vmware! open source rules!


-KF
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite KF to join Gmail


VB
to Billy, full-disclosure
More options 2:33pm (8 hours ago)
Surely this is a poor attempt at comedy.........
fyi,
The Secure Sockets Layer (SSL) is a commonly-used protocol for managing the
security of a message transmission on the Internet. SSL has recently been
succeeded by Transport Layer Security (TLS), which is based on SSL. SSL uses
a program layer located between the Internet's Hypertext Transfer Protocol
(HTTP) and Transport Control Protocol (TCP) layers. SSL is included as part
of both the Microsoft and Netscape browsers and most Web server products.
Developed by Netscape, SSL also gained the support of Microsoft and other
Internet client/server developers as well and became the de facto standard
until evolving into Transport Layer Security. The "sockets" part of the term
refers to the sockets method of passing data back and forth between a client
and a server program in a network or between program layers in the same
computer. SSL uses the public-and-private key encryption system from RSA,
which also includes the use of a digital certificate.
TLS and SSL are an integral part of most Web browsers (clients) and Web
servers. If a Web site is on a server that supports SSL, SSL can be enabled
and specific Web pages can be identified as requiring SSL access. Any Web
server can be enabled by using Netscape's SSLRef program library which can
be downloaded for noncommercial use or licensed for commercial use.

TLS and SSL are not interoperable. However, a message sent with TLS can be
handled by a client that handles SSL but not TLS.
- Show quoted text -


----- Original Message -----
From: "Billy B. Bilano"
To:
Sent: Tuesday, June 08, 2004 1:05 PM
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Hi Harlan! Thanks for your reply... hard to make heads or tails of what
you
> are saying though...
>
> > Wouldn't it then be, by definition, a worm?
>
> A worm or whatever you want to call it, that's cool. I just thought
"virus"
> sounds more alarming than worm! Everybody has had a worm or two, but a
virus
> is a tough cookie to crack!
>
>
> > What information do you have to support this
> > assumption?
>
> Because it is attacking our web servers and it seems to have somehow
gotten
> installed on our web servers at the same time! I don't know how it got in,
> but there is traffic going in and out of the servers on port 443 with an
> encrypted payload! I don't know what is answering on port 443 on the web
> servers, but for the life of me I can't find anything on them that looks
> like it's a virus or a worm or a troglodite or anything!
>
>
> > If this worm runs over SSL, as you say, then wouldn't
> > you expect it to be encrypted?
>
> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
the
> web servers. I don't think it has anything to do with whatever ssl was
back
> in the old days of UNIX. It has a lower port number and that means it's an
> older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
SSH?
> I don't expect to see encryption on anything other than the SSH port 22
> (which is a very old port).
>
>
> > Regardless, there isn't any information in your post
> > that clearly shows that this worm infects both Windows
> > and Unix hosts. In fact, one thing that does seem
> > clear in your post is that you haven't collected any
> > information from the "infected" hosts, but rather all
> > you've got so far is network traffic via
> > Ethereal...and to be honest, any worm running over SSL
> > is going to be encrypted...
>
> But this port 443 is not SSH! Why should it be encrypted? And what is this
> "ssl" thing? I've been in IT for many years and I am now IT Director here
at
> the bank... I would think that I would know what "ssl" would be. I don't
> think this worm has anything to do with whatever "ssl" is. Does anybody
even
> still use ssl? That's probably why the hackers chose it.
>
>
> P.S. Check out my bloglog, Harlan!
>
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite VB to join Gmail


Nils Ketelsen
to full-disclosure
More options 2:21pm (8 hours ago)
On Tue, Jun 08, 2004 at 11:46:22AM -0500, Billy B. Bilano wrote:

> Sorry to say but it is not! I checked my incoming traffic again this morning
> and the attack on port 443 is still coming in full steam ahead! I don't know
> what's going on, but I am about to block that port on my firewall. Some
> nitwit (probably the idiot that was here before I became IT Director)
> somehow, for some reason, deliberately opened port 443 on the firewalls!

Close them. If you do not know what you need them for it might be the best
alternative.

> I am beginning to think that this is the first wave of the new coming global
> crypto-storm!

It is not that new, as a matter of fact. It is specified and documented for
10 years. It is SSL and it is supposed to be in place on many webservers.

Could we now please stop this stupid discussion, as it is absolutely not
worth eating up more time.

Thanks,
Nils
--
Gibt's eigentlich auch schon emacs-Einbauküchen?

[nico.hoffmann@physik.tu-chemnitz.de (Nico Hoffmann)
zum Thema "vi-Tassen" in de.alt.arnooo]
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Nils to join Gmail


Jason Bethune
to full-disclosure
More options 2:02pm (8 hours ago)
This is a hoax...check out his site he is known for things like this.

Jason Bethune

IT Specialist

Town of Kentville

354 Main Street

Kentville, NS

B4N 1K6

www.town.kentville.ns.ca
- Show quoted text -


-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of James Bliss
Sent: Tuesday, June 08, 2004 2:46 PM
To: full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Whatever ssl is, I don't know but it's using the so-called "ssl" port on
> the web servers. I don't think it has anything to do with whatever ssl
> was back in the old days of UNIX. It has a lower port number and that
> means it's an older port! Probably from the 1970s!
>
> Besides, why should I see any encrypted traffic on any port other than
> SSH? I don't expect to see encryption on anything other than the SSH
> port 22 (which is a very old port).

You are kidding, right? SSL = Secured Sockets Layer. It probably includes
encryption. It would not be too _SECURE_ if it was plain text.

SSH = Secured Shell

Notice the use of _SECURED_ in both their names?

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jason to join Gmail


William Warren
to full-disclosure
More options 1:46pm (8 hours ago)
have you got any code or anything to substantiate this? Your site is
unreachable
- Show quoted text -

Billy B. Bilano wrote:

> Salutations, amigos!
>
> Bill Bilano here, reporting in from the front-lines! I've got some
> disturbing news that I've got to get some answers about while I share. I
> think we're about to come under full hacker attack at any second! And to
> those people that said us folks talking about crypto viruses were being
> chicken littles... let me tell you, the sky just fell! And it is HEAVY!
>
> I was sitting at my desk doing more research on the OPENBSD virus I
> discovered last week. I was watching ethereal and monitoring the traffic
> coming in and out of the facility and I saw a ton of traffic coming straight
> for our web servers! The routers, firewalls, and intrusion detraction
> systems were not sounding the red alarms like they should have been (we'll
> get to THAT one later).
>
> There appears to be a new virus in town and it's affecting Windows and UNIX
> web servers! I have not identified a pattern of infection yet but the virus
> is clearly advancing but it only affects web servers!
>
> The virus works on port 443. It seems to accept inbound connections on that
> port as well and, presumably, awaits for commands from some series of
> servers elsewhere. Perhaps taking orders? I also captured some of the
> traffic and attempted to analyze it up but it looks like -- you heard it
> here first, folks -- the payload is encrypted! Is this the first of a coming
> storm of crypto viruses we've all been eagerly fearing? (I have already sent
> a copy of the payload to the distributed.net people so they can try to use
> some of those wasting cycles to decipher it like they did the last one!)
>
> I have taken the liberty of naming the virus already. I looked in
> etc/services and saw that this port is for and it is something called "ssl"
> so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
> thing!)
>
> I called in our webmaster and showed him the data. He is either too stupid
> to know what's going on or he takes me for a fool. I got him in the
> conference room and showed him the print outs. He tried to convince me it
> was not a virus and just normal web traffic but web traffic is on port 80!
> No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
> his marching orders. I have no time for this kind of bull, what with the
> OPENBSD virus last week (still picking up the pieces there). He must have
> known I was on to him because he was just laughing on his way out the front
> door. He may have even been involved with the infection! Good riddance,
> chump!
>
> At any rate, this is your heads up, folks! You heard it here first! Be on
> the lookout for this first, very nasty CRYPTO VIRUS!
>
> P.S. I wonder if this virus was from a spam-gang?!
>
> P.P.S. Check out my bloglog in my sig!
>
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

--
My "Foundation" verse:
Isa 54:17 No weapon that is formed against thee shall prosper; and
every tongue that shall rise against thee in judgment thou shalt
condemn. This is the heritage of the servants of the LORD, and their
righteousness is of me, saith the LORD.
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite William to join Gmail


Steve Boone
to full-disclosure
More options 3:20pm (7 hours ago)
How about renaming it to w32@imn.id10.t? More fitting methinks. :-)
- Show quoted text -

-----Original Message-----
From: Billy B. Bilano
[mailto:mr.bill.bilano@email.server.unix.bill.bilano.biz]
Sent: Tuesday, June 08, 2004 9:53 AM
To: full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

Salutations, amigos!

Bill Bilano here, reporting in from the front-lines! I've got some
disturbing news that I've got to get some answers about while I share. I
think we're about to come under full hacker attack at any second! And to
those people that said us folks talking about crypto viruses were being
chicken littles... let me tell you, the sky just fell! And it is HEAVY!

I was sitting at my desk doing more research on the OPENBSD virus I
discovered last week. I was watching ethereal and monitoring the traffic
coming in and out of the facility and I saw a ton of traffic coming
straight
for our web servers! The routers, firewalls, and intrusion detraction
systems were not sounding the red alarms like they should have been
(we'll
get to THAT one later).

There appears to be a new virus in town and it's affecting Windows and
UNIX
web servers! I have not identified a pattern of infection yet but the
virus
is clearly advancing but it only affects web servers!

The virus works on port 443. It seems to accept inbound connections on
that
port as well and, presumably, awaits for commands from some series of
servers elsewhere. Perhaps taking orders? I also captured some of the
traffic and attempted to analyze it up but it looks like -- you heard it
here first, folks -- the payload is encrypted! Is this the first of a
coming
storm of crypto viruses we've all been eagerly fearing? (I have already
sent
a copy of the payload to the distributed.net people so they can try to
use
some of those wasting cycles to decipher it like they did the last one!)

I have taken the liberty of naming the virus already. I looked in
etc/services and saw that this port is for and it is something called
"ssl"
so I am calling it w32.ssl.b (b for bilano, since I discovered this
wretched
thing!)

I called in our webmaster and showed him the data. He is either too
stupid
to know what's going on or he takes me for a fool. I got him in the
conference room and showed him the print outs. He tried to convince me
it
was not a virus and just normal web traffic but web traffic is on port
80!
No fooling old Bill! LOL! So I told him to gather his stuff up and gave
him
his marching orders. I have no time for this kind of bull, what with the
OPENBSD virus last week (still picking up the pieces there). He must
have
known I was on to him because he was just laughing on his way out the
front
door. He may have even been involved with the infection! Good riddance,
chump!

At any rate, this is your heads up, folks! You heard it here first! Be
on
the lookout for this first, very nasty CRYPTO VIRUS!

P.S. I wonder if this virus was from a spam-gang?!

P.P.S. Check out my bloglog in my sig!

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Steve to join Gmail


Jakob Jünger
to full-disclosure
More options 3:01pm (7 hours ago)
Hi,

I just can admit to what Billy wrote. The Firewall of my PDA is getting
hot. It plays "Yellow Submarine" everytime I press the escape-key. It
has to be something like this crypto-thing. I don't know what "crypto"
means but it seems to be encrypted with EnglishLanguageProtocol.
Believe me, I have been the administrator of my PDA since I was three
years old.

Jakob

> Whatever ssl is, I don't know but it's using the so-called "ssl"
> port on the web servers.

> But this port 443 is not SSH! Why should it be encrypted? And what
> is this "ssl" thing? I've been in IT for many years and I am now IT
> Director here at the bank... I would think that I would know what
> "ssl" would be. I don't think this worm has anything to do with
> whatever "ssl" is. Does anybody even still use ssl? That's probably
> why the hackers chose it.

>Sorry to say but it is not! I checked my incoming traffic again this
morning
>and the attack on port 443 is still coming in full steam ahead! I
don't know
>what's going on, but I am about to block that port on my firewall.
Some
>nitwit (probably the idiot that was here before I became IT Director)
>somehow, for some reason, deliberately opened port 443 on the
firewalls!

>I am beginning to think that this is the first wave of the new coming
global
>crypto-storm!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jakob to join Gmail


Billy B. Bilano
to full-disclosure
More options 3:26pm (7 hours ago)
Kenneth,

These are insidious hackers!

I did what you said and I am getting an exact duplicate of our web site!
They have probably infiltrated the system and are using this to capture our
customers' login information and passing it back to them encrypted! I can't
believe this!

I've already called a local consulting firm and they will be doing an eval
this Thursday of our security measures that we've taken. Then, I am going to
call the webmaster I just fired over this back in and have him sit in front
of their report and see if he has anything to say for himself. Hah!

Also, right before I wrote this message I blocked port 443 in and out on our
firewall at the bank! I will be going over these servers very carefully
tonight to look for anything wacky or goofy.

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS


----- Original Message -----
From: "Ng, Kenneth (US)"
To: "'Billy B. Bilano'" ;

Sent: Tuesday, June 08, 2004 1:51 PM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Question is, are you supposed to have a SSL server on that box? If so,
> that's what it is. If not, then you definitely have a problem. Try
> connecting to that box with the URL you normally use, just use "https"
> instead of "http". If you get the "normal" page, then someone turned on
> https without realizing it. If you get something different, then you
> investigate.
- Show quoted text -
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Billy to join Gmail


Thierry
to full-disclosure
More options 3:08pm (7 hours ago)
Hello Listmembers,

A brief call to the list: Please don't feed the troll.
My mail treshold from this list has enough bs.

Thanks.
--
Best regards,
Thierry mailto:Thierry@Sniff-em.com
- Show quoted text -

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Thierry to join Gmail


Rodrigo Gutierrez
to full-disclosure
More options 3:25pm (7 hours ago)
Has george bush become a security researcher? Htf people can answer to this
thread?... Is this GOOBLES AGAIN?

Rodrigo.-

-----Mensaje original-----
De: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] En nombre de Meeusen,
Charles D
Enviado el: Martes, 08 de Junio de 2004 13:50
Para: full-disclosure@lists.netsys.com
Asunto: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

"Men like me, we need a room full of clues"

--Doug.
- Show quoted text -

-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com]On Behalf Of Harlan Carvey
Sent: Tuesday, June 08, 2004 12:40 PM
To: full-disclosure@lists.netsys.com
Cc: Billy B. Bilano
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

Bill,

>From your post, you don't seem to have a great deal of
detailed information to share about this issue...

> The virus works on port 443.

Wouldn't it then be, by definition, a worm?

> It seems to accept inbound connections on that port as well and,
> presumably, awaits for commands from some series of servers elsewhere.
> Perhaps taking orders?

What information do you have to support this assumption?

> I also captured some of the
> traffic and attempted to analyze it up but it looks like -- you heard
> it here first, folks -- the payload is encrypted!

If this worm runs over SSL, as you say, then wouldn't you expect it to be
encrypted?

> Is this the first of a coming
> storm of crypto viruses we've all been eagerly fearing?

Is it?
http://www.us-cert.gov/current/current_activity.html#pct

http://www.cert.org/advisories/CA-2002-27.html

To be totally honest, Bill, I don't see a great deal of information in your
post that supports any of your assertions/assumptions. If this thing is
spreading the way you say it is, then it's a worm.

Regardless, there isn't any information in your post that clearly shows that
this worm infects both Windows and Unix hosts. In fact, one thing that does
seem clear in your post is that you haven't collected any information from
the "infected" hosts, but rather all you've got so far is network traffic
via Ethereal...and to be honest, any worm running over SSL is going to be
encrypted...

> At any rate, this is your heads up, folks! You heard it here first! Be
> on the lookout for this first, very nasty CRYPTO VIRUS!

Thanks. Noted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Rodrigo to join Gmail


valdis.kletnieks@vt.edu
to Billy, full-disclosure
More options 4:13pm (6 hours ago)
On Tue, 08 Jun 2004 10:53:29 CDT, "Billy B. Bilano" said:
> Bill Bilano here, reporting in from the front-lines! I've got some
> disturbing news that I've got to get some answers about while I share. I
> think we're about to come under full hacker attack at any second! And to
> those people that said us folks talking about crypto viruses were being
> chicken littles... let me tell you, the sky just fell! And it is HEAVY!

All: Please read this link before replying further:

http://www.catb.org/~esr/jargon/html/Y/YHBT.html

Attachments: noname (application/pgp-signature) 1K

ReplyReply to allForwardInvite valdis.kletnieks@vt.edu to join Gmail


Billy B. Bilano
to full-disclosure
More options 3:00pm (7 hours ago)
Oliver! Hello!

SSL is the same port as HTTPS ? OMFG then we have a bigger problem than I
ever imagined!! HOLY SMOKES! I am going to block port 443 right now and I
urge ALL of you to do the same before this gets out of control!

Also, Oliver, I am sure I am telling you something you don't know, but you
have a bunch of crypto code that is more then likely a virus at the end of
your message! In fact, you are so infected, that it seems the crypto code is
longer then the entire message you sent! This is probably how it spreads! I
saw a couple of other people on this thing already that had this same
symptom.

Good luck, everybody! I hope we can cleanse our systems of this 443 virus!

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
- Show quoted text -


----- Original Message -----
From: "Oliver Welter"
To:
Cc: "Billy B. Bilano"
Sent: Tuesday, June 08, 2004 12:43 PM
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> hi Guys,
>
> I'm new to the list, so hello first ;)
> I really dont know if you are just kidding or if I missunderstod your
> post...
> Port 443 is the SecureHTTP protocol (https) - so it is correct that it
> is bound to a webserver process and it is correct that SSL-encryptet
> traffic goes in and out - so whats the matter ?
>
> Oliver
> --
> Diese Nachricht wurde digital unterschrieben
> oliwel's public key: http://www.oliwel.de/oliwel.crt
> Basiszertifikat: http://www.ldv.ei.tum.de/page72
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Billy to join Gmail


joe
to full-disclosure
More options 4:39pm (5 hours ago)
The only thing funnier than this post are the responses to it.

Good show.

Cheers Billy, thanks for the laugh.


joe
- Show quoted text -


-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Billy B. Bilano
Sent: Tuesday, June 08, 2004 11:53 AM
To: full-disclosure@lists.netsys.com
Subject: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

Salutations, amigos!

Bill Bilano here, reporting in from the front-lines! I've got some
disturbing news that I've got to get some answers about while I share. I
think we're about to come under full hacker attack at any second! And to
those people that said us folks talking about crypto viruses were being
chicken littles... let me tell you, the sky just fell! And it is HEAVY!

I was sitting at my desk doing more research on the OPENBSD virus I
discovered last week. I was watching ethereal and monitoring the traffic
coming in and out of the facility and I saw a ton of traffic coming straight
for our web servers! The routers, firewalls, and intrusion detraction
systems were not sounding the red alarms like they should have been (we'll
get to THAT one later).

There appears to be a new virus in town and it's affecting Windows and UNIX
web servers! I have not identified a pattern of infection yet but the virus
is clearly advancing but it only affects web servers!

The virus works on port 443. It seems to accept inbound connections on that
port as well and, presumably, awaits for commands from some series of
servers elsewhere. Perhaps taking orders? I also captured some of the
traffic and attempted to analyze it up but it looks like -- you heard it
here first, folks -- the payload is encrypted! Is this the first of a coming
storm of crypto viruses we've all been eagerly fearing? (I have already sent
a copy of the payload to the distributed.net people so they can try to use
some of those wasting cycles to decipher it like they did the last one!)

I have taken the liberty of naming the virus already. I looked in
etc/services and saw that this port is for and it is something called "ssl"
so I am calling it w32.ssl.b (b for bilano, since I discovered this wretched
thing!)

I called in our webmaster and showed him the data. He is either too stupid
to know what's going on or he takes me for a fool. I got him in the
conference room and showed him the print outs. He tried to convince me it
was not a virus and just normal web traffic but web traffic is on port 80!
No fooling old Bill! LOL! So I told him to gather his stuff up and gave him
his marching orders. I have no time for this kind of bull, what with the
OPENBSD virus last week (still picking up the pieces there). He must have
known I was on to him because he was just laughing on his way out the front
door. He may have even been involved with the infection! Good riddance,
chump!

At any rate, this is your heads up, folks! You heard it here first! Be on
the lookout for this first, very nasty CRYPTO VIRUS!

P.S. I wonder if this virus was from a spam-gang?!

P.P.S. Check out my bloglog in my sig!

--------
Mr. Billy B. Bilano, MSCE, CCNA

Expert Sysadmin Since 2003!
'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite joe to join Gmail


Jon
to full-disclosure
More options 5:53pm (4 hours ago)
Make sure you block port 80 as well, the dreaded w32@www.web virus uses this
port. If you see any traffic on there, then chances are you have it.
- Show quoted text -

----- Original Message -----
From: "Billy B. Bilano"
To:
Sent: Tuesday, June 08, 2004 8:00 PM
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Oliver! Hello!
>
> SSL is the same port as HTTPS ? OMFG then we have a bigger problem than I
> ever imagined!! HOLY SMOKES! I am going to block port 443 right now and I
> urge ALL of you to do the same before this gets out of control!
>
> Also, Oliver, I am sure I am telling you something you don't know, but you
> have a bunch of crypto code that is more then likely a virus at the end of
> your message! In fact, you are so infected, that it seems the crypto code
is
> longer then the entire message you sent! This is probably how it spreads!
I
> saw a couple of other people on this thing already that had this same
> symptom.
>
> Good luck, everybody! I hope we can cleanse our systems of this 443 virus!
>
> --------
> Mr. Billy B. Bilano, MSCE, CCNA
>
> Expert Sysadmin Since 2003!
> 'C:\WINDOWS, C:\WINDOWS\GO, C:\PC\CRAWL' -- RMS
>
>
>
> ----- Original Message -----
> From: "Oliver Welter"
> To:
> Cc: "Billy B. Bilano"
> Sent: Tuesday, June 08, 2004 12:43 PM
> Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
>
> > hi Guys,
> >
> > I'm new to the list, so hello first ;)
> > I really dont know if you are just kidding or if I missunderstod your
> > post...
> > Port 443 is the SecureHTTP protocol (https) - so it is correct that it
> > is bound to a webserver process and it is correct that SSL-encryptet
> > traffic goes in and out - so whats the matter ?
> >
> > Oliver
> > --
> > Diese Nachricht wurde digital unterschrieben
> > oliwel's public key: http://www.oliwel.de/oliwel.crt
> > Basiszertifikat: http://www.ldv.ei.tum.de/page72
> >
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Jon to join Gmail


Micah McNelly
to full-disclosure
More options 6:32pm (4 hours ago)
Greatest post of all time.

/me claps.

/m
----- Original Message -----
From: "Goudie, Derek"
To:
Sent: Tuesday, June 08, 2004 1:54 PM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!


> Thanks! I needed that....
- Show quoted text -
>
> -----Original Message-----
> From: Jakob Jünger [mailto:krimskram@freenet.de]
> Sent: Tuesday, June 08, 2004 1:01 PM
> To: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Hi,
>
> I just can admit to what Billy wrote. The Firewall of my PDA is getting
> hot. It plays "Yellow Submarine" everytime I press the escape-key. It
> has to be something like this crypto-thing. I don't know what "crypto"
> means but it seems to be encrypted with EnglishLanguageProtocol.
> Believe me, I have been the administrator of my PDA since I was three
> years old.
>
> Jakob
>
> > Whatever ssl is, I don't know but it's using the so-called "ssl"
> > port on the web servers.
>
> > But this port 443 is not SSH! Why should it be encrypted? And what
> > is this "ssl" thing? I've been in IT for many years and I am now IT
> > Director here at the bank... I would think that I would know what
> > "ssl" would be. I don't think this worm has anything to do with
> > whatever "ssl" is. Does anybody even still use ssl? That's probably
> > why the hackers chose it.
>
> >Sorry to say but it is not! I checked my incoming traffic again this
> morning
> >and the attack on port 443 is still coming in full steam ahead! I
> don't know
> >what's going on, but I am about to block that port on my firewall.
> Some
> >nitwit (probably the idiot that was here before I became IT Director)
> >somehow, for some reason, deliberately opened port 443 on the
> firewalls!
>
> >I am beginning to think that this is the first wave of the new coming
> global
> >crypto-storm!
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Micah to join Gmail


Picciano, Anthony
to full-disclosure
More options 7:06pm (3 hours ago)
Did I pick or weird day to join this maillist, or is it always this silly?
- Show quoted text -

-----Original Message-----
From: full-disclosure-admin@lists.netsys.com
[mailto:full-disclosure-admin@lists.netsys.com]On Behalf Of Micah
McNelly
Sent: Tuesday, June 08, 2004 4:32 PM
To: full-disclosure@lists.netsys.com
Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

Greatest post of all time.

/me claps.

/m
----- Original Message -----
From: "Goudie, Derek"
To:
Sent: Tuesday, June 08, 2004 1:54 PM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Thanks! I needed that....
>
> -----Original Message-----
> From: Jakob Jünger [mailto:krimskram@freenet.de]
> Sent: Tuesday, June 08, 2004 1:01 PM
> To: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Hi,
>
> I just can admit to what Billy wrote. The Firewall of my PDA is getting
> hot. It plays "Yellow Submarine" everytime I press the escape-key. It
> has to be something like this crypto-thing. I don't know what "crypto"
> means but it seems to be encrypted with EnglishLanguageProtocol.
> Believe me, I have been the administrator of my PDA since I was three
> years old.
>
> Jakob
>
> > Whatever ssl is, I don't know but it's using the so-called "ssl"
> > port on the web servers.
>
> > But this port 443 is not SSH! Why should it be encrypted? And what
> > is this "ssl" thing? I've been in IT for many years and I am now IT
> > Director here at the bank... I would think that I would know what
> > "ssl" would be. I don't think this worm has anything to do with
> > whatever "ssl" is. Does anybody even still use ssl? That's probably
> > why the hackers chose it.
>
> >Sorry to say but it is not! I checked my incoming traffic again this
> morning
> >and the attack on port 443 is still coming in full steam ahead! I
> don't know
> >what's going on, but I am about to block that port on my firewall.
> Some
> >nitwit (probably the idiot that was here before I became IT Director)
> >somehow, for some reason, deliberately opened port 443 on the
> firewalls!
>
> >I am beginning to think that this is the first wave of the new coming
> global
> >crypto-storm!
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Picciano, to join Gmail


David Hane
to Anthony, full-disclosure
More options 7:43pm (2½ hours ago)
We're all feeling a little silly today. This thread has kept me chuckling all
day tho. I don't know what's funnier, the tongue-in-cheek replies or the
serious ones!
- Show quoted text -


On Tuesday 08 June 2004 16:06, Picciano, Anthony wrote:
> Did I pick or weird day to join this maillist, or is it always this silly?
>
> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com]On Behalf Of Micah
> McNelly
> Sent: Tuesday, June 08, 2004 4:32 PM
> To: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
>
> Greatest post of all time.
>
> /me claps.
>
> /m
> ----- Original Message -----
> From: "Goudie, Derek"
> To:
> Sent: Tuesday, June 08, 2004 1:54 PM
> Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> > Thanks! I needed that....
> >
> > -----Original Message-----
> > From: Jakob Jünger [mailto:krimskram@freenet.de]
> > Sent: Tuesday, June 08, 2004 1:01 PM
> > To: full-disclosure@lists.netsys.com
> > Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> > Discovered!
> >
> > Hi,
> >
> > I just can admit to what Billy wrote. The Firewall of my PDA is getting
> > hot. It plays "Yellow Submarine" everytime I press the escape-key. It
> > has to be something like this crypto-thing. I don't know what "crypto"
> > means but it seems to be encrypted with EnglishLanguageProtocol.
> > Believe me, I have been the administrator of my PDA since I was three
> > years old.
> >
> > Jakob
> >
> > > Whatever ssl is, I don't know but it's using the so-called "ssl"
> > > port on the web servers.
> > >
> > > But this port 443 is not SSH! Why should it be encrypted? And what
> > > is this "ssl" thing? I've been in IT for many years and I am now IT
> > > Director here at the bank... I would think that I would know what
> > > "ssl" would be. I don't think this worm has anything to do with
> > > whatever "ssl" is. Does anybody even still use ssl? That's probably
> > > why the hackers chose it.
> > >
> > >Sorry to say but it is not! I checked my incoming traffic again this
> >
> > morning
> >
> > >and the attack on port 443 is still coming in full steam ahead! I
> >
> > don't know
> >
> > >what's going on, but I am about to block that port on my firewall.
> >
> > Some
> >
> > >nitwit (probably the idiot that was here before I became IT Director)
> > >somehow, for some reason, deliberately opened port 443 on the
> >
> > firewalls!
> >
> > >I am beginning to think that this is the first wave of the new coming
> >
> > global
> >
> > >crypto-storm!
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite David to join Gmail


Gregh
to Derek, Disclosure
More options 7:53pm (2½ hours ago)
I think the original OP just didn't know how to spell some words correctly.
I believe he actually meant to refer to a "krypto virus" which is one that
affects the Superman factor meaning that those of us who are supposed to
know it all and do it all, 24 hours a day without rest or even a shit, would
start to finally lose that veneer of invulnerability!

(Stranger from a strange I.T, Planet. Jumps firewalls in a single bound!
Faster than a 3.4ghz CPU! Look! Up in the sky! It's a bird! It's a plane! Oh
no, wait - it's chicken bloody little again!)
- Show quoted text -


----- Original Message -----
From: "Goudie, Derek"
To:
Sent: Wednesday, June 09, 2004 6:54 AM
Subject: RE: [Full-Disclosure] Possible First Crypto Virus Definitely
Discovered!

> Thanks! I needed that....
>
> -----Original Message-----
> From: Jakob Jünger [mailto:krimskram@freenet.de]
> Sent: Tuesday, June 08, 2004 1:01 PM
> To: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] Possible First Crypto Virus Definitely
> Discovered!
>
> Hi,
>
> I just can admit to what Billy wrote. The Firewall of my PDA is getting
> hot. It plays "Yellow Submarine" everytime I press the escape-key. It
> has to be something like this crypto-thing. I don't know what "crypto"
> means but it seems to be encrypted with EnglishLanguageProtocol.
> Believe me, I have been the administrator of my PDA since I was three
> years old.
>
> Jakob
>
> > Whatever ssl is, I don't know but it's using the so-called "ssl"
> > port on the web servers.
>
> > But this port 443 is not SSH! Why should it be encrypted? And what
> > is this "ssl" thing? I've been in IT for many years and I am now IT
> > Director here at the bank... I would think that I would know what
> > "ssl" would be. I don't think this worm has anything to do with
> > whatever "ssl" is. Does anybody even still use ssl? That's probably
> > why the hackers chose it.
>
> >Sorry to say but it is not! I checked my incoming traffic again this
> morning
> >and the attack on port 443 is still coming in full steam ahead! I
> don't know
> >what's going on, but I am about to block that port on my firewall.
> Some
> >nitwit (probably the idiot that was here before I became IT Director)
> >somehow, for some reason, deliberately opened port 443 on the
> firewalls!
>
> >I am beginning to think that this is the first wave of the new coming
> global
> >crypto-storm!
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

ReplyReply to allForwardInvite Gregh to join Gmail


mark
to full-disclosure
More options 9:09pm (1 hour ago)

I found the fix for it.

http://tinyurl.com/37p35

SecurityFocus Microsoft Newsletter #192

SecurityFocus Microsoft Newsletter #192
----------------------------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver
total control of your server to a hacker giving them the ability to read,
write and manipulate all data stored in your backend systems! Download
this *FREE* white paper from SPI Dynamics for a complete guide to
protection!

http://www.securityfocus.com/sponsor/SPIDynamics_ms-secnews_040607

------------------------------------------------------------------------
I. FRONT AND CENTER
1. Wireless Attacks and Penetration Testing (part 1 of 3)
2. Catching a Virus Writer
II. MICROSOFT VULNERABILITY SUMMARY
1. MollenSoft Lightweight FTP Server Remote Buffer Overflow Vul...
2. JPortal Print.php SQL Injection Vulnerability
3. Microsoft Windows 2000 Domain Expired Account Security Polic...
4. Sambar Server Multiple Vulnerabilities
5. Rit Research Labs TinyWeb Server Unauthorized Script Disclos...
6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
8. Tripwire Email Reporting Format String Vulnerability
9. Trend Micro Scanning Engine Report Generation HTML Injection...
III. MICROSOFT FOCUS LIST SUMMARY
1. Exchange Information Store Security? Send As... (Thread)
2. SecurityFocus Microsoft Newsletter #191 (Thread)
3. Relative Security Provided by Cached Domain Credenti... (Thread)
IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
1. SP I-NET
2. secure2trust
3. N-Stealth Security Scanner
4. Softros LAN Messenger
5. Network Time System
6. Anon-Encrypt
V. NEW TOOLS FOR MICROSOFT PLATFORMS
1. XArp 0.1
2. Honeynet Security Console 1.0
3. LogMonitor 1.0
4. Ettercap v0.7.0 pre2
5. Syhunt TS Security Scanner 6.7 Build 96
6. yaSSL 0.1.0
VI. UNSUBSCRIBE INSTRUCTIONS
VII. SPONSOR INFORMATION

I. FRONT AND CENTER
-------------------
1. Wireless Attacks and Penetration Testing (part 1 of 3)
By Jonathan Hassell

This is the first of a three part series on penetration testing for
wireless networks. This installment will detail common styles of attacks
against wireless networks, introduce WEP key-cracking, and then discuss
some recent developments in wireless security.

http://www.securityfocus.com/infocus/1783

2. Catching a Virus Writer
By Kelly Martin

With the consumer WiFi explosion, launching a virus into the wild has
never been easier and more anonymous than it is today.

http://www.securityfocus.com/columnists/246

II. MICROSOFT VULNERABILITY SUMMARY
-----------------------------------
1. MollenSoft Lightweight FTP Server Remote Buffer Overflow Vul...
BugTraq ID: 10429
Remote: Yes
Date Published: May 28 2004
Relevant URL: http://www.securityfocus.com/bid/10429
Summary:
Lightweight FTP Server is prone to a remote buffer overflow vulnerability. This vulnerability can potentially allow a remote attacker to execute arbitrary code in the context of the server process. This issue presents itself due to a lack of sufficient boundary checks performed on CD command arguments.

Lightweight FTP Server version 3.6 is prone to this issue.

This issue is likely related to the issue previously described in BID 10409 (MollenSoft Lightweight FTP Server Remote Denial Of Service Vulnerability). This BID will be updated or retired subsequent to further analysis.

2. JPortal Print.php SQL Injection Vulnerability
BugTraq ID: 10430
Remote: Yes
Date Published: May 28 2004
Relevant URL: http://www.securityfocus.com/bid/10430
Summary:
JPortal is reportedly affected by a remote SQL injection vulnerability in the print.inc.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input before using it in an SQL query.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue.

3. Microsoft Windows 2000 Domain Expired Account Security Polic...
BugTraq ID: 10440
Remote: Yes
Date Published: May 31 2004
Relevant URL: http://www.securityfocus.com/bid/10440
Summary:
Windows 2000 domain controllers are reported prone to a weakness that may permit user accounts with expired passwords to logon to the domain.

This weakness may lead to a security policy violation. Where an administrator expires a users password to force them to modify it, or sets a weak password while creating the account. The user does not modify the password and can still logon to the affected domain. The administrator however believes that the password has been modified.

4. Sambar Server Multiple Vulnerabilities
BugTraq ID: 10444
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10444
Summary:
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.

These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.

Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

5. Rit Research Labs TinyWeb Server Unauthorized Script Disclos...
BugTraq ID: 10445
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10445
Summary:
TinyWeb Server is affected by an unauthorized script disclosure vulnerability. This issue is due to an input validation error that allows malicious users to bypass standard web server rules.

This issue will allow an attacker to download or view scripts residing in the 'cgi-bin' directory.

This issue is reported to affect TinyWeb 1.92, it is likely that other versions are also vulnerable.

6. PHP-Nuke Direct Script Access Security Bypass Vulnerability
BugTraq ID: 10447
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10447
Summary:
PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

7. MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Na...
BugTraq ID: 10448
Remote: Yes
Date Published: Jun 01 2004
Relevant URL: http://www.securityfocus.com/bid/10448
Summary:
Kerberos 5 is prone to multiple boundary condition errors that exist in the krb5_aname_to_localname() and helper functions and are due to insufficient bounds checking performed on user-supplied data.

An additional boundary condition issue also exists in the krb5_aname_to_localname() function. The condition is reported to present itself in the explicit mapping functionality of the krb5_aname_to_localname() as an off-by-one.

These conditions may be theoretically exploitable to execute arbitrary code remotely in the context of the affected service.

It is reported that explicit mapping or rules-based
mapping functionality of krb5_aname_to_localname() must be enabled for these vulnerabilities to be present. Additionally it is necessary that the principal name used by the attacker to exploit the issue be listed in the explicit mapping list.

These vulnerabilities are reported to affect all releases of MIT Kerberos 5, up to and including version krb5-1.3.3.

8. Tripwire Email Reporting Format String Vulnerability
BugTraq ID: 10454
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10454
Summary:
Tripwire is affected by an email reporting format string vulnerability. This issue is due to a failure to properly inplement a formatted string function.

This vulnerability will allow for execution of arbitrary code on a system running the affected software. This would occur in the security context of the user invoking the vulnerable application; typically the superuser.

**Update - It is reported that this issue only presents itself when the MAILMETHOD is sendmail.

9. Trend Micro Scanning Engine Report Generation HTML Injection...
BugTraq ID: 10456
Remote: Yes
Date Published: Jun 03 2004
Relevant URL: http://www.securityfocus.com/bid/10456
Summary:
Trend Micro's scanning engine is reportedly affected by an HTML injection vulnerability in its report generation feature. This issue is due to a failure to properly sanitize user-supplied before including it in a HTML report.

It has been speculated that the offending HTML alert reports run from the local zone on the affected computer, although this has not been verified.

This issue may be exploited by a remote attacker to execute arbitrary HTML or script code on an affected computer; potentially resulting in unauthorized access. Other attackers are also possible.

III. MICROSOFT FOCUS LIST SUMMARY
---------------------------------
1. Exchange Information Store Security? Send As... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/365052

2. SecurityFocus Microsoft Newsletter #191 (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/364918

3. Relative Security Provided by Cached Domain Credenti... (Thread)
Relevant URL:

http://www.securityfocus.com/archive/88/364873

IV. NEW PRODUCTS FOR MICROSOFT PLATFORMS
----------------------------------------
1. SP I-NET
By: Unisys
Platforms: Windows 95/98, Windows NT
Relevant URL: http://www.unisys.com/sp-security
Summary:

Designed for business-to-business communications requiring trusted relationships, SP I-NET ensures confidentiality of data, authenticates the identity of the involved parties, and ensures the privacy of their communication.

2. secure2trust
By: Avoco Secure
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.avocosecure.com/html_pages/products_service.html
Summary:

secure2trust gives you the power to create documents that remain under your corporate control throughout their entire existence. Even if you allow another party to have a copy of your original document you can be sure that the copy will always have your original controls as part of its properties. The digital rights options which will control printing, copying, viewing, etc give you persistent and secure digital asset protection and intellectual property control. Digital rights mechanisms are the only way to ensure document integrity in a persistent way for both inter and intra company communications.

3. N-Stealth Security Scanner
By: N-Stalker
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://www.nstalker.com/products/nstealth/
Summary:

N-Stealth is a vulnerability-assessment product that scans web servers to identify security problems and weaknesses that might allow an attacker to gain privileged access. The software comes with an extensive database of over 30,000 vulnerabilities and exploits. N-Stealth® is more actively maintained than the network security scanners and consequently has a larger database of vulnerabilities.

4. Softros LAN Messenger
By: Softros Systems Inc.
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://messenger.softros.com
Summary:

Softros Messenger is a secure network messaging software application for corporate LANs (local area networks). It does not require a server and is very easy to install and use. Softros Messenger comes with a variety of handy features, like message notification alarms, personal or group messaging, and intuitive interface. Softros Messenger offers strong encryption options for all incoming and outgoing messages, guaranteeing no unauthorized person ever reads personal correspondence. The program is very stable when running under any Windows operating system and in any TCP/IP network, regardless of its size. Also Softros Messenger correctly identifies and works under Windows NT/2000/XP limited user accounts (without administrative privileges).

5. Network Time System
By: Softros Systems Inc.
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Relevant URL: http://nts.softros.com/
Summary:

Network Time System - Secure, fast and accurate time sync software across entire network.

6. Anon-Encrypt
By: RiserSoft Corporation
Platforms: Windows 2000, Windows NT, Windows XP
Relevant URL: http://risersoft.com/anon-encrypt.php
Summary:

Surf the Internet Totally Anonymous, and Fully Encrypted with our Internet Explorer Pluging!

V. NEW TOOLS FOR MICROSOFT PLATFORMS
------------------------------------
1. XArp 0.1
By: Christoph Mayer
Relevant URL: http://www.chrismc.de
Platforms: Windows 2000, Windows XP
Summary:

XArp is a graphical tool to monitor the ARP cache. It periodically requests the local ARP cache and reports changes in the IP to MAC mapping. Thus it can be used to recognize ARP poisoning which is used to prepare 'man in the middle' attacks on switched networks.

2. Honeynet Security Console 1.0
By: Activeworx, Inc.
Relevant URL: http://www.activeworx.org
Platforms: Windows 2000, Windows XP
Summary:

Honeynet Security Console is an analysis tool to view events on your personal honeynet. It gives you the power to view events from Snort, TCPDump, Firewall, Syslog and Sebek logs. It also allows you to correlate events from each of these data types to have a full grasp of the attackers' actions.

3. LogMonitor 1.0
By: Adam Richard/SécurIT Informatique Inc.
Relevant URL: ftp://ftp.digitalvoodoo.org/pub/mirrors/securit/Logmon10free.zip
Platforms: Windows 2000, Windows NT, Windows XP
Summary:

LogMonitor is a log analysis console. It is 75% based on LogIDS, excepted for the GUI which is a complete makeover. Instead of focusing on network location, LogMonitor presents the data in a set of floating windows grouped by application, which may be a more intuitive interface to some people. The analysis is performed by defining the fields of each log we are monitoring, and then by using these fields to define rules as to what is important data or not.

4. Ettercap v0.7.0 pre2
By: ALoR
Relevant URL: http://ettercap.sourceforge.net/
Platforms: FreeBSD, Linux, MacOS, NetBSD, Windows 2000, Windows NT, Windows XP
Summary:

Ettercap is a network sniffer/interceptor/logger for ethernet LANs. It supports active and passive dissection of many protocols (even ciphered ones, like SSH and HTTPS). Data injection in an established connection and filtering on the fly is also possible, keeping the connection synchronized. Many sniffing modes were implemented to give you a powerful and complete sniffing suite. Plugins are supported. It has the ability to check whether you are in a switched LAN or not, and to use OS fingerprints (active or passive) to let you know the geometry of the LAN.

5. Syhunt TS Security Scanner 6.7 Build 96
By: Syhunt
Relevant URL: http://www.syhunt.com/section.php?id=scanner
Platforms: Windows 2000, Windows 95/98, Windows NT, Windows XP
Summary:

Syhunt TS Security Scanner is able to find the unfindable, not only known vulnerabilities, but also potential new ones. The new version can identify and exploit vulnerabilities in a matter of minutes and is a key tool for security professionals and administrators.

6. yaSSL 0.1.0
By: tao51
Relevant URL: http://freshmeat.net/projects/yassl/?branch_id=48050&release_id=160245
Platforms: Linux, POSIX, Windows 2000, Windows NT, Windows XP
Summary:

The yaSSL software package is a fast, dual-licensed implementation of SSL. It includes SSL client libraries and an SSL server implementation. It supports multiple APIs, including those defined by SSL and TLS. It also supports an OpenSSL compatibility interface.

VI. UNSUBSCRIBE INSTRUCTIONS
----------------------------
To unsubscribe send an e-mail message to ms-secnews-unsubscribe@securityfocus.com from the subscribed address. The contents of the subject or message body do not matter. You will receive a confirmation request message to which you will have to answer. Alternatively you can also visit http://www.securityfocus.com/newsletters and unsubscribe via the website.

If your email address has changed email listadmin@securityfocus.com and ask to be manually removed.

VII. SPONSOR INFORMATION
-----------------------

This Issue is Sponsored By: SPI Dynamics

ALERT: "How Hackers Launch Blind SQL Injection Attacks- New White Paper
The newest web app vulnerability... Blind SQL Injection!
Even if your web application does not return error messages, it may still
be open to a Blind SQL Injection Attack. Blind SQL Injection can deliver
total control of your server to a hacker giving them the ability to read,
write and manipulate all data stored in your backend systems! Download
this *FREE* white paper from SPI Dynamics for a complete guide to
protection!

http://www.securityfocus.com/sponsor/SPIDynamics_ms-secnews_040607

Monday, June 07, 2004

--[ BOOK REVIEW: Practical C Programming. 3rd Edition



# By: Steve Oualline
# Paperback: 451 pages
# Publisher: O'Reilly & Associates; 3rd edition (August 3, 1997)
# ISBN: 1565923065





Book description:


There are lots of introductory C books, but this is the first one that has the no-nonsense, practical approach that has made Nutshell Handbooks(R) famous.

C programming is more than just getting the syntax right. Style and debugging also play a tremendous part in creating programs that run well and are easy to maintain. This book teaches you not only the mechanics of programming, but also describes how to create programs that are easy to read, debug, and update.

Practical rules are stressed. For example, there are fifteen precedence rules in C (&& comes before || comes before ?:). The practical programmer reduces these to two:

* Multiplication and division come before addition and subtraction.
* Put parentheses around everything else.

Contrary to popular belief, most programmers do not spend most of their time creating code. Most of their time is spent modifying someone else's code. This books shows you how to avoid the all-too-common obfuscated uses of C (and also to recognize these uses when you encounter them in existing programs) and thereby to leave code that the programmer responsible for maintenance does not have to struggle with. Electronic Archaeology, the art of going through someone else's code, is described.

This third edition introduces popular Integrated Development Environments on Windows systems, as well as UNIX programming utilities, and features a large statistics-generating program to pull together the concepts and features in the language.


On my hunt to learn more on programming in C and eventually find the best book I stumbled on this book. I usually prefer Oreilly's book because of there style and quality and this book is no different. The book wasts no time jumping into programming although teaches you about elegance, style, and methodology first something that is not very well stressed in some of the C programming books I have read. The book continues to stress on style, simplicity, and commenting throughout the book which I find useful. This book although only 385 pages in text outweighs some of the books that are well over 800 pages long. The book is not repetitions and straight to the point. The book is divided into 3 main parts as you might notice in the following table of content"


Table of Contents

1. What Is C?
2. Basics of Program Writing
3. Style
4. Basic Declarations and Expressions
5. Arrays, Qualifiers, and Reading Numbers
6. Decision and Control Statements
7. Programming Process
II. Simple Programming
8. More Control Statements
9. Variable Scope and Functions
10. C Preprocessor
11. Bit Operations
12. Advanced Types
13. Simple Pointers
14. File Input/Output
15. Debugging and Optimization
16. Floating Point
III. Advanced Programming Concepts
17. Advanced Pointers
18. Modular Programming
19. Ancient Compilers
20. Portability Problems
21. C's Dustier Corners
22. Putting It All Together
23. Programming Adages


This book ranks in the top 5 of the books I have read so far on C programming. One issue that was lacking like the Pointers on C was that some examples are not complete programs. Besides that the author does give you questions in the chapter which were answered, the questions at the end of the chapter were not however. The book will get an 9 out of 10 for me just because of those two drawbacks.


--------------------------------------------------------------------
Reviews done by others on the book:

Amazon
Barnes and Noble
Security Forums
ACUU
BYUU Unix Users Group

--------------------------------------------------------------------
Links pertaining to the book:

C in Review
Download examples

PROG: Fresh Sources Home Page

Fresh Sources Home Page

PROG: code4u.com - your code to sourcecode!

code4u.com - your code to sourcecode!

PROG: C Languages General

C Languages General

FREE: Software Development Free Subscription

Software Development Free Subscription

PROG: Visual Studio Magazine - Table of Contents

Visual Studio Magazine - Table of Contents

PROG: ASP.NET tutorials, components, links

ASP.NET tutorials, components, links

PROG: .NET 247

.NET 247

FREE: Microsoft Windows XP SP2 CD

PROG: C Forum Code Comments

C

BOOK: C Programming: A Modern Approach

C Programming: A Modern Approach

PROG: Secure, Efficient and Easy C programming

Secure, Efficient and Easy C programming

PROG: Unofficial comp.lang.c booklist

Unofficial comp.lang.c booklist

SEC: Under the hood

Hackers: Under the hood: ZDNet Australia: Insight: Security

--[ BOOK REVIEW: Intrusion Signatures and Analysis



# By: Mark Cooper, Stephen Northcutt, Matt Fearnow, Karen Frederick
# Paperback: 350 pages
# Publisher: Que; 1 edition (January 29, 2001)
# ISBN: 0735710635





Book description:

Intrusion Signatures and Analysis opens with an introduction into the format of some of the more common sensors and then begins a tutorial into the unique format of the signatures and analysis used in the book. After a challenging four-chapter review, the reader finds page after page of signatures, in order by categories. Then the content digs right into reaction and responses covering how sometimes what you see isn¿t always what is happening. The book also covers how analysts can spend time chasing after false positives. Also included is a section on how attacks have shut down the networks and web sites of Yahoo, and E-bay and what those attacks looked like. Readers will also find review questions with answers throughout the book, to be sure they comprehend the traces and material that has been covered.


Written by the guys at SANS/GIAC and the main author Stephen Northcutt is the same author of SHADOW IDS the book is unique not only in it's subject but in it's content as well. The book ranks on the top 5 books I have read on IDS. The book's main strength comes from it's topic, currently (at least to my best knowledge) there are no books that cover how to track and analyze network traffic from an IDS.

The book consists of 17 chapters which span 359 pages. The first chapter talks about how to read packet dumps from some of the most widely known IDSs such as RealSecure, Dragon, and Snort. The chapter also talks about how to analyze firewall logs, NFR logs, syslogs, and TCPDump files among other things. The second chapter talks about the formating of the practicals which are used extensively in the books, it talks about what is expected and how to read them. The following two chapters list some of the most popular internet security threats and there signatures, this is exactly like the SANS top 10 list. The list is for multiple OSes and services such as: Bind, CGI, RPC, IIS, Sendmail, Sadmin/Mountd, file sharing, passwords, and SMTP. One of the most valuable chapters in the book is chapter 5 which presents you with normal behavior of internet trafic and some basic concepts behind TCP/IP. I will stop here about the description of the book, I do not want to ruin your reading. The following is the tables of content:



Table of Contents

1 Reading Log Files 1
2 Introduction to the Practicals 19
3 The Most Critical Internet Security Threats (Part 1) 39
4 The Most Critical Internet Security Threats (Part 2) 69
5 Non-Malicious Traffic 93
6 Perimeter Logs 113
7 Reactions and Responses 133
8 Network Mapping 149
9 Scans That Probe Systems for Information 169
10 Denial of Service - Resource Starvation 189
11 Denial of Service - Bandwidth Consumption 213
12 Trojans 233
13 Exploits 251
14 Buffer Overflows with Content 269
15 Fragmentation 299
16 False Positives 319
17 Out-of-Spec Packets 343
Appendix 361
Index 389

One issue that was really bad about the book was the extensive use of students practicals, while this is good because it gives you a different view I think the authors should have explained the content more and offered the practicals as a supplement on a disk or something. Another issue that I noticed with the practicals is that some would be wrong and the authors would acknowledge it but the authors will not give the correct response or explain well enough. I am forced to give this book an 8 out of 10, because of it's lacking and extensive use of practicals. The book however is a must for anyone wanting to read more about IDSs, it should not however be your first book on IDSs.


--------------------------------------------------------------------
Reviews done by others on the book:

Amazon
Barnes and Noble
Information Security News
Usenet
Rothstein

--------------------------------------------------------------------
Links pertaining to the book:

SANS
GIAC
SANS Reading Room
GIAC Practicles
The Intrusions Archives

/. : Native American Wireless ISP Launched

Slashdot | Native American Wireless ISP Launched

VIRUS: Virus writers deploy bulk mail software

SecurityFocus BUGTRAQ News: Virus writers deploy bulk mail software



Virus writers deploy bulk mail software

By John Leyden, The Register Jun 7 2004 8:42AM
Hackers have used spamming software to distribute thousands of copies of a new Trojan. Email filtering firm MessageLabs alone has intercepted more than 4,000 copies of the Demonize-T Trojan over the last 24 hours.

Demonize-T is a multi-stage Trojan that uses an object data exploit in Internet Explorer (patch here) to download and execute an encoded visual basic script from a website. The Trojan then creates an executable file which appears to download a malicious program from the same website as the original script. Early analysis suggests Demonize-T is similar to previous attacks where malicious code has been used to install key loggers and password stealers.

Spammers are increasingly using infected as a platform to distribute spam and this technique has come full circle with virus writers using spam to infect machines in the first place.

Alex Shipp, senior anti-virus technologist at MessageLabs, said hackers are increasingly adopting the tactics of spammers in their attempts to seize control of as many machines as possible. MessageLabs typically block four or five bulk mail batches of Trojans a day. Mostly less than 20 messages are involved so the new attack - with more than 4,000 messages blocked in the space of only 24 hours - is far more intense. MessageLabs detected Demonize-T proactively, using its Skeptic predictive heuristics technology.

"Some parts of these Trojans are new but some code is old. Using old code is a funny tactic for virus writers to use because you can almost guarantee malware will be caught," Shipp commented. ®

OT: SBC FreedomLink Wi-Fi Service to Be Available in Wi-Fi-Enabled McDonald's Restaurants Through Agreement with Wayport

SBC FreedomLink Wi-Fi Service to Be Available in Wi-Fi-Enabled McDonald's Restaurants Through Agreement with Wayport

SEC: Ethereal Multiple Protocol Dissector Vulnerabilities

SecurityFocus BUGTRAQ Vulns Info: Ethereal Multiple Protocol Dissector Vulnerabiliti

VIRUS: The Deadly Duo: Spam and Viruses

The Deadly Duo: Spam and Viruses, May 2004

SEC: G8 Summit To Test Homeland Security Network

Security Pipeline | Trends | G8 Summit To Test Homeland Security Network: "By Larry Greenemeier, InformationWeekThis week's Group of Eight Summit at a small resort island off the Georgia coast is the biggest test to date of the federal government's abil"

By Larry Greenemeier, InformationWeek
This week's Group of Eight Summit at a small resort island off the Georgia coast is the biggest test to date of the federal government's ability to coordinate secure communications among law-enforcement and other public officials at all levels of government. The Homeland Security Information Network is at the center of that effort, letting local, state, and federal officials collect and share sensitive-but-unclassified information.

HSIN, which the Department of Homeland Security rolled out four months ago, is a collection of collaborative tools, including Groove Networks Inc.'s Workspace and Microsoft's SharePoint portal and workflow software, that works in real time over existing networks and the Internet. It's a "fairly ubiquitous way to send out alerts throughout the country," says Lee Holcomb, chief technology officer for the Department of Homeland Security. "HSIN provides the ability for federal partners to reach out and touch local and state agencies."

The technology is in place in and around Sea Island, Ga., where President Bush is hosting leaders from seven of the most powerful nations in the world. It lets the 20,000 police and federal agents deployed to the area access information from federal, state, and local law-enforcement groups, as well as federal security agencies, governors' offices, and other emergency-management groups. Local law enforcement, including the Georgia Bureau of Investigation and the Georgia Emergency Management Agency, can send information on local situations back to the Homeland Security Department and other federal agencies monitoring the event.

Groove's Workspace technology delivers high-level security through an Advanced Encryption System algorithm that provides 192-bit encryption for sending and archiving messages, internally or over the Internet. Workspace uses public-key-technology practices to provide user authentication, data privacy, and data integrity.

"This is the largest and most complex [event] we've ever done," says a spokesman for the State Department's Summit Planning Organization, which organized the G8 summit. In addition to protecting the foreign dignitaries, 30,000 attendees, members of the media, and workers have to be checked and provided with appropriate credentials. Sea Island is a five-mile-long residential and resort island with two hotels and a population of 63,000. The only access from the mainland is via a seven-mile causeway.

Anti-globalization groups are expected to stage demonstrations in Brunswick, Ga., which is six miles from Sea Island, and Savannah, which is 80 miles away but also the site of the G8's international press center. Law-enforcement officials hope to avoid the violence that disrupted past international gatherings, including the World Trade Organization's 1999 meeting in Seattle and the 2001 G8 summit in Genoa, Italy.

HSIN technology also will be deployed at the Democratic National Convention in Boston and the Republican National Convention in New York later this summer. The President's Homeland Security Advisory Council has designated those venues, like the G8 summit, as National Special Security Events, putting the Secret Service in charge of designing and implementing security.

Seventy sites are up and running on HSIN now. By midsummer, the Homeland Security Department plans to add 30 more federal, state, and local law-enforcement and government entities, including state homeland security advisers, emergency operations centers, and National Guard units, Holcomb says.
The Homeland Security Department modeled the network on a law-enforcement information exchange developed two years ago by the Department of Defense, California Justice Department, and New York City Police Department. The Joint Regional Information Exchange System lets state and urban law-enforcement agencies share crime data and terrorism intelligence among themselves and with the federal government, says Ed Manavian, chief of the California Justice Department's Criminal Intelligence Bureau.

This earlier system "established a set of technology tools and a governance model to promote information sharing," Homeland Security's Holcomb says. The federal effort expands the concept beyond law enforcement to make the technology available to other local and state public officials. HSIN eventually will tap into county-level law-enforcement systems and also will be used to exchange classified information.

The Joint Regional Information Exchange System was the brainchild of the Defense Intelligence Agency, which was looking for a way to let law-enforcement groups securely share data without extensive IT overhauls. It cost $250,000 to build and has been expanded to include the Los Angeles Police Department and state law enforcement in New York and Texas.

That system and other regional law-enforcement data-sharing efforts will feed into the federal HSIN. Homeland Security's greatest challenge with the system is ensuring that the many different participants can effectively use it, says Patrick Duecy, a partner with Homeland Solutions and the former director of the Defense Department's Joint Intelligence Task Force Combating Terrorism, in an E-mail. Homeland Solutions is a consulting firm that has provided management and operations services for both the Joint Regional Information Exchange System and HSIN.

If it all works, local and state security officials will benefit from fast, easy access to the secure communications capabilities that HSIN will provide. And the country will benefit in a bigger way, since the technology will let federal officials use locally gathered intelligence to fight terrorism on a national level and more effectively protect significant national events such as the G8.

PROG: Understanding ASP.NET View State

ASP.NET Home: ASP.NET: Web Applications: Understanding ASP.NET View State (ASP.NET Technical Articles)

M$: How to Make Your Web Site Work with Windows XP Service Pack 2

MSDN Security Developer Center Home: How to Make Your Web Site Work with Windows XP Service Pack 2 (Windows XP Technical Articles)

M$: Microsoft Eyes Southeast Asia

CBS News | Microsoft Eyes Southeast Asia | June 7, 2004�10:37:46

OT: Trying to locate Linux muscle for your computer at home

San Mateo County Times Online - Business News

SEC: Confusion surrounds Cisco-Linksys wireless hole

InfoWorld: Confusion surrounds Cisco-Linksys wireless hole: June 07, 2004: By : SECURITY

Threat overstated, finder of vulnerability says



By Paul Roberts, IDG News Service June 07, 2004

BOSTON - A report last week about a security hole in a wireless broadband router made by Cisco Systems Inc.'s Linksys division overstated the severity of the vulnerability, according to the man who first warned of the problem.

Independent technology consultant Alan Rateliff said Monday that Cisco's Linksys WRT54G wireless routers are not, by default, vulnerable to remote takeover from a malicious hacker. However, a vulnerability in the software that runs on those devices could still allow a malicious hacker to access administrative features for the router and take control of the device.

Rateliff first posted a warning about the WRT54G on the Bugtraq discussion list on May 31. Based on testing with a sample Cisco router, Rateliff concluded that the routers were shipped with a configuration that would allow remote attackers to access the Web-based administration interface for the devices over two common communications ports, 80 and 443. The WRT54G, like other wireless routers, enables multiple computers to share a broadband Internet connection using wireless networking equipment

The Bugtraq post prompted numerous responses that contested Rateliff's findings. After testing additional WRT54G devices, Rateliff said he found that the devices were not vulnerable in their default configuration, but could still be compromised remotely given the right circumstances.

In particular, Rateliff discovered that a firewall feature in the routers is enabled, rather than disabled, by default, which prevents compromise on new systems.

On versions of the router using software (or "firmware) versions 2.02.2 and 2.02.7, malicious hackers can access the router's administrator interface and change the configuration of the router if the firewall feature is disabled and if the router's owner does not change the default administrator's password. The devices could be compromised regardless of whether a feature that provides remote, Web-based access to the routers was enabled or disabled, he said.

Cisco has since released a test, or "beta" version of software for the device that fixes the remote access problem, he said. (See: http://www.linksys.com/download/firmware.asp?fwid=201.)

Rateliff posted a message to Bugtraq on June 2 and acknowledged that he made an error in his initial warning about the problem, but said he was just posting his findings based on a test of the Cisco hardware, standard practice in the Bugtraq forum. Rateliff did not expect the immense response to his post, which spawned stories in a number of online news outlets and prompted multiple responses on Bugtraq.

"The exposure on this is not as bad as the (discussion) on Bugtraq made it seem. I can't account for the results of the first test, but at this point that's irrelevant. What's relevant now is that 'out of box' home users are safe," Rateliff said.

/. : Webmasters Pounce On Wiki Sandboxes

Slashdot | Webmasters Pounce On Wiki Sandboxes

SEC: IT security budgets expected to rise

IT security budgets expected to rise | CNET News.com: "By Dinesh C. Sharma Special to CNET News.comEnterprise investment in information technology security in the United States is likely to hit 12 percent of total IT budgets over the"

By Dinesh C. Sharma
Special to CNET News.com


Enterprise investment in information technology security in the United States is likely to hit 12 percent of total IT budgets over the next couple of years, according to a new study.

The average security investment will peak at 8 percent to 12 percent by 2006 in the United States and reach the same level in Europe and Asia by 2007. These budgets will stabilize between 5 percent and 8 percent by 2008 in the United States and in Europe and the Asia-Pacific region by 2009, the Meta Group said in a new study released on Monday.

The average spending on IT security in Global 2000 companies currently is 4 percent of their IT budget, the market researcher said. The figure has been rising--much faster in the United States due to concerns that include computer crime. The rate of increase has been much slower in Europe.

In the Asia-Pacific region, mature economies such as Singapore in Japan are seeing a rise similar to Europe's. Other maturing markets, such as Malaysia, Thailand and the Philippines, are only beginning to invest in security.

Recent surveys of U.S. businesses show that security software figures among top priority items in their growing IT budgets.

"Information security remains a top-five issue for CIOs, and the debate regarding appropriate investment levels continues to rage," Tom Scholtz, vice president of the Meta Group's Security and Risk Strategies advisory service, said in a statement. "Although capturing and benchmarking information security spending is complicated, security teams must model overall investment to track parity with industry peers and account for the cost of satisfying business requirements for managing information risk."

SEC: Zombie PCs spew out 80% of spam

Zombie PCs spew out 80% of spam | The Register: "By John Leyden Published Friday 4th June 2004 13:08 GMTFour-fifths of spam now emanates from computers contaminated with Trojan horse infections, according to a study by networ"

By John Leyden
Published Friday 4th June 2004 13:08 GMT

Four-fifths of spam now emanates from computers contaminated with Trojan horse infections, according to a study by network management firm Sandvine out this week. Trojans and worms with backdoor components such as Migmaf and SoBig have turned infected Windows PCs into drones in vast networks of compromised zombie PCs.

Sandvine reckons junk mails created and routed by "spam Trojans" are clogging ISP mail servers, forcing unplanned network upgrades and stoking antagonism between large and small ISPs.

Using its own technology, Sandvine was able to identify subscribers bypassing their home mail servers and contacting many mail servers within a short period of time - a sure sign of spam Trojan activity - over sustained periods. It also looked at SMTP error messages returned, which helps to clarify the total volume of spam within the service provider network. "After comparing those data points with the total volume of legitimate messages passing through the service provider's mail system, we are able to arrive at our percentage of 80 per cent," explained Sandvine spokesman Mark De Wolf.

Sandvine's analysis, cross referenced with data from SORBS, to determine what IP space is assigned to residential subscriber pools of global service providers, shows most spam now originating from residential broadband networks.
Viral marketing

Instead of using open mail relays or unscrupulous hosts (so-called 'bullet-proof' hosting - in reality, ISPs in developing countries who pull the plug on spammers when enough complaints are received by their upstream provider), spammers are using compromised machines to get their junk mail out. Many security firms reckons many of the most well-publicized worm attacks in recent months (such as MyDoom and Bagle) were launched expressly to install spam Trojans on unsuspecting end users' machines - waiting to be utilized later as a spam delivery relay. This expanding network of infected, zombie PCs can also be used as platforms for DDoS attacks, such as those that many online bookies have suffered in recent months.

Sandvine's preliminary analysis has shown that the most active Trojans for spamming purposes are the Migmaf and SoBig variants. Its work on this area of the problem is still at an early stage.

The behaviour of spam Trojans on the network taxes ISP infrastructure and, in the case of smaller ISPs, creates the perception that some networks are generating more than their fair share of spam and other types of malicious traffic. The mounting scope of the problem means ISP need to begin filtering traffic - rather than leaving the problem up to end users - if spam is to be contained, Sandvine argues.

"While spam filters can provide an effective treatment, the scale & scope of the spam problem means additional remedies are needed", said Marc Morin, co-founder and chief technology officer of Sandvine. "As a complement to existing mail server and client based tools, service providers need to arm themselves with network-based anti-spam defences and combat this growing form of malicious traffic." ®

OT: The Free & The Unfree

Wired 12.06: The Free & The Unfree

LINUX: Fedora Widens Its Scope

Fedora Widens Its Scope

LINUX: Linux certificate puts kernel developers in impossible position

PC Pro - Computing in the Real World: "Monday 7th June 2004 Linux certificate puts kernel developers in impossible position [PC Pro] 13:15A patent expert has attacked the Open Source Community's latest initiative t"

Monday 7th June 2004


Linux certificate puts kernel developers in impossible position
[PC Pro] 13:15

A patent expert has attacked the Open Source Community's latest initiative to document the provenance of code contributed to the Linux kernel so that proving its origins will be quicker and easier in the face of litigation.

The Developer's Certificate of Origin 1.0 asserts that the developer submitting the code which it covers has either written or modified that code according to their rights to do so, or it is being submitted, unchanged, on behalf of someone else who asserts these rights.

The problem, writes Greg Aharonian in his Internet Patent News Service newsletter, is that it is unlikely a programmer would know what rights they can assert for the code for which they are claiming responsibility.

'I highly doubt the average programmer is going to do a patent search, and then pay for some sort of infringement analysis... such a declaration is legally impossible for any programmer to assert in light of the contradictory nonsense of copyright case law,' he says.

He also says that the certificate assumes that the contributor is telling the truth, with no penalties for doing otherwise. 'The certificate is needed mostly to stop evil people from infecting open source software with proprietary code,' he says. 'Such an evil person will have no problem lying about the pureness of the code, and will be glad to attach the certificate - it is not as if any penalty is involved for lying.

'So having a stack of these certificates attached to some piece of open source software barely decreases the risk of using the open source software absent the certificates.'

Gartner's George Weiss agrees. 'Despite the new [developer certificate] process... enterprises still face the risk of liability for copyright infringements or patent thefts,' he said. 'The process will not automatically ensure that new Linux code carries no risk of infringement, even if the source of the contribution can be traced.'

But this risk extends beyond the Open Source developer network.

A recent survey conducted by Out-Law.com

ADVERTISEMENT
polled Slashdot users and revealed what pains they were at to ensure the code they produced didn't encroach patents and copyright. Of nearly 4,000 developers that responded, more than 75 per cent said they would reuse blocks of code written elsewhere.

'Most developers that I come in contact with (including myself) reuse, copy, or even reverse engineer code to make it work better or to include it in an application that we are programming,' wrote one respondent.

Fully 67 per cent say they carry a library of code with them that they dip into from job to job.

Indeed, the survey indicates that code-borrowing is endemic to the profession. But more problematic is that copying code is legal, at least in theory, in certain circumstances: that is it does not constitute a substantial part of the program it came from. But that 'substantiality' is not demarkated by a percentage of the complete program, but rather by the craft and skill that went into producing it.

In short, it requires the developer to make a legal assessment as to whether the code they are reusing is substantial or otherwise - effectively to second guess how a court might rule.

The quandary for Open Source developers now is that the Developer's Certificate of Origin asks them to do just that.


Matt Whipp

LINUX: Fedora Core 2: A Lot More to Expect from it

Fedora Core 2: A Lot More to Expect from it - OSNews.com

Posted by special contributor Jeremy LaCroix on 2004-06-07 19:36:44 UTC
There have been many FC2 reviews, littered all over the net. I thought I would do my own, because I have some things I feel Fedora 2 should be praised for, and a few things I think it should reconsider.

Overview:

Previously, I was using SuSE 9.1 while I was waiting for Fedora Core 2 to reach stable status. At the same time, I made sure to try the test versions and make bug reports accordingly, however, SuSE, as good as it is, had some things that really annoyed me (For example, the screen setting 1024x768 is actually 800x600, and the only way to get the same resolution is to set it to 1280x768 and suffer a 60hz refresh rate) so I eagerly installed Fedora Core 2 as soon as I had the CDR's ready.

Installation:

Fedora didn't really do anything here, this is the same installer we've been using since Redhat 8.0 and probably prior. I can't really complain, because it works, so why change it? I did a custom install for a little over 3GB, and it took less than a half hour, so the speed (in my experience) has definitely increased. There was an error message stating something to the effect of "unable to align partitions correctly" but everything is working for me, so that's a minor complaint.

Software:

KDE 3.2: What can I say, KDE 3.2 is exceptional. I was amazed at how much has improved, even though I tried KDE 3.2 first when I installed it with FC1. (Installing or updating a Window Manager is almost a rite of passage). KDE 3.2 is fast, beautiful and it get's the job done.

Gnome 2.6: This is the default window manager in Fedora Core 2. My experience with it so far has been much less than KDE 3.2, and I don't see why they went to "spatial" browsing. Give it whatever fancy term you like, "spatial browsing" is just a fancy term they gave it (Probably to make it sound cool, since it's been around since Windows 95) to describe "all windows open in new window". That's it. I am not sure I understand why they did this.

For those of you that don't know, with Gnome 2.6 every time you click on a window, it opens in a new window. (This is "spatial browsing").There is no option (I've checked, I could've missed it, but I doubt it) to turn this off. No offense to those that like this, but there is absolutely no excuse for it. You could set previous versions of Gnome up this way, the only difference now is that they removed the option to disable it and set it to default. Aside from how the option to remove spatial browsing was removed, Gnome is pretty solid. For me, it runs 1.5 times slower than KDE, but for those of you who like all the Gnome apps, it will probably fit the bill.

Usability:

When it comes to Stability, for me, Fedora Core 2 is less stable than the original release. With FC1, my system crashed about once a month. Now, it crashes twice a week. For example, last week I was copying a URL into my clipboard to paste in an email, and my system locked up so bad, the only way out of it was to hit the reset button and go through a disk check. A few days later, I had two Mozilla windows open, and my system slowed down so bad that it took me two minutes (yes, two minutes) to move my mouse cursor to the Kmenu to reboot it. At that time, I went and grabbed a sandwhich before it finally decided to reboot. However, this happens very rarely and with these problems, I can't reproduce them. Most of the time things work, however in some occasions they don't.

Next, with sound and music (one of the primary things my computer is used for) things aren't so smooth. The major problem is when I am listening to music, I get a loud, annoying hissing sound in the left speaker and you can't hear any vocals. When Test 3 was first released, there were at least two bug reports about this, one from me included, that were completely ignored. This doesn't make me feel so inclined to submit bug reports in the future. Yes, I know the Fedora team can't fix every problem, but this one is huge, and almost all the Fedora forums I have visited, had a half dozen users complaining about this problem before and after Fedora Core 2 Stable was released. The problem is solved now, but the only way is to disable surround, so now my surround system only uses two speakers. To dive further into my multimedia problem, if I load a Super Nintendo Rom into ZSNES, you have the Nintendo logo as usual, but the "ding" sound the logo makes isn't heard until two screens later.

Good Things About Fedora Core 2:

Don't get me wrong, Fedora Core 2 is great. I just feel it has some problems that should've been fixed. Fedora is one of, if not the, most supported Linux systems there is, I have no problem finding the software I need from only a minute or two on Google. The screens are smooth and everything runs fast for a Linux distribution. The installation is a dream and runs faster on 3-4 cd's than Microsoft does with one.

Bad Things About Fedora Core 2:

As much as I hate to say it, FC2 has some major issues. Although it isn't Red Hat's fault Gnome went to spatial browsing, it still shouldn't have. I will say it until I am blue in the face: Spatial Browsing doesn't give us anything we didn't already have, it just removed the choice to have it operate different. (Maybe I'm missing something, I hope I am).

Although KDE 3.2 and Gnome 2.6 are great aside from small complaints, these are the same KDE 3.2 and Gnome 2.6 versions you could get with any other distro. All that was done to them was adding in the bluecurve theme followed by a recompile. I feel that since Gnome and KDE are both open source, much more could've been done with customization. Gnome now has a neat "Computer" icon which lists your drives, but the same thing should've been done with KDE. I mean, I made one myself for KDE just making a directory and putting all my drive icons in it. Why didn't Fedora?

On the same wavelength, maybe there should have been some more time put into this release. Not much at all has changed from FC1. The only difference now is that all the software is more up to date, and you now have SELinux (Which is really only useful for servers) and X.org instead of Xfree. (Can someone please tell me if this effects performance at all? Both seem exactly the same to me).

My point is that with Windows Longhorn a year or two away, if all Linux distributions release the same thing over and over with only updating the software, Linux won't even put a scratch into Longhorn. I think all developers whom make Linux distro's should consider overhauling it, to make it more feature packed in order to combat Microsoft. It's like Microsoft is giving Fedora a head start in a footrace, and Fedora is just standing there looking at them funny.

Final Thoughts:

This review isn't meant to make Fedora look bad. With Fedora being all that's left of the once great Red Hat, I have a lot to expect from it. I feel they could have done a bit better. However, aside from all the letdowns of this release, I will continue using it. Now, if only I can *clearly* get surround sound working again without the static...

LINUX: Newbie guide for the net install (ftp install) of SuSe 9.1

USA Linux Users Group :: View topic - Newbie guide for the net install (ftp install) of SuSe 9.1: "This is my newbie guide for the net install (ftp install) of SuSe 9.1Read through this entirely so you can familiarize yourself with the steps, and get the data you need to finish you"

This is my newbie guide for the net install (ftp install) of SuSe 9.1

Read through this entirely so you can familiarize yourself with the steps, and get the data you need to finish your install.

A few of the nice "new" things about SuSe 9.1

Linux kernel 2.6
KDE 3.2.1
GNOME 2.4.2
Samba 3
KDevelop 3.0
Gimp 2.0
and much more.

Since SuSe doesn't offer free iso download versions of SuSe, I decided to write this guide on how to do an net install (ftp install) of SuSe 9.1 since that is something that they do offer for free, but don't offer support. They do offer a "guide" to installing SuSe from the net, but it lacks detail and seems intentionally cryptic to me. I wanted to write a step by step guide to make things simpler so others don't have to search and search for hints on how it's done. This is my third article on SuSe's ftp install, the first one was for SuSe 8.2 and the second one was for Suse 9.0 You can find these older articles here:
SuSe 8.2 Net Install http://www.usalug.org/phpBB2/viewtopic.php?t=524
SuSe 9.0 Net Install http://www.usalug.org/phpBB2/viewtopic.php?p=8161

The first thing you need to do is select a place to download the boot.iso from. You can do that by searching here : http://www.suse.com/us/private/download/ftp/int_mirrors.html and selecting the closest location to you. I choose the ftp://mirror.mcs.anl.gov/pub/suse/ (Chicago, IL). When searching for a mirror, it is very important when looking on the SuSe mirrors page to select a COMPLETE mirror. It just saves you headaches.

Once you have a mirror from SuSe open, you can find the directory where the boot.iso resides.
This is different than the other versions. The boot iso WAS in the ftp://mirror.mcs.anl.gov/pub/suse/i386/current/boot/ directory, however this time it's in the ftp://mirror.mcs.anl.gov/pub/suse/i386/9.1/boot/ (this may be because the mirrors are not completely updated as of this writing, I'm not postitive) The file your looking for is:

boot.iso 23744 KB

Now you can download the boot.iso file. Exact url to the boot iso I used is: ftp://mirror.mcs.anl.gov/pub/suse/i386/9.1/boot/boot.iso This iso file is a few MB's larger than the older 9.0 boot.iso file.

After you have the boot iso downloaded, burn the boot.iso file as an image to a blank cdr. I won't go into detail here, but there are many helpful tutorials on the net if you need help with that. Here is a good place to start though: http://www.linuxiso.org/viewdoc.php/howtoburn.html

Next, simply insert the disk into your computer, and reboot. You should be rewarded with a screen that displays some welcome message and then be forwarded on to the boot options screen. At this screen you should be able to choose from Installation

Choose Installation --- then hit the enter key.
It will say something like "Can't find cd - entering manual setup")
You should get a {Loading Linux Kernel...............} and then proceed to the next screen.

You should get a screen that lets you choose your language and keyboard map.... mine were both English, the defaults.

Then you should get to a MAIN MENU screen. Several options there. Starting with Settings. System Information. Kernel Modules. Start Installation. Exit/Reboot. Power Off.

Choose Settings first. Make sure your Language selection is correct.
Then choose KERNEL MODULES and then select Load network (ethernet) card modules. Choose your network cards modules and load it. It is important that you know what network card you have as this step needs to be correct in order to continue.

If you need to load other modules do so here before proceeding. IE: if you have more than one network card installed, load that module also. When that's done go back to the main menu and choose START INSTALLATION. Then choose the source medium (NETWORK). Then choose FTP. If you have more than one network card installed, here is where you have to tell the installer which card to use also. Then to enable your card to access the internet you need to choose AUTO CONFIG VIA DHCP or do it manually. I choose auto, since I'm using a router that does DHCP.

Next is the hard part. You have to enter the IP ADDRESS of the FTP server. It took me several trys to figure this out. But after a little research, I found that the IP address can be had via the DIG command on Linux.

You must use the dig command in a terminal to find the IP address of whatever FTP server your using. I was using the ftp://mirror.mcs.anl.gov/pub/suse/ FTP server. Using the dig command : dig mirror.mcs.anl.gov returns one IP address. 140.221.9.138

If you must use windows to get the ip address, try going to some web site, such as http://network-tools.com/ or similar. If you use http://network-tools.com/ select the Express lookup. Simply type in "mirror.mcs.anl.gov" in the blank space just under the first big box of choices on the screen. After pressing "Enter", it will resolve a traceroute to "140.221.9.138", and there you have the address. This method works in any browser in any operating system.

Enter this number into the box asking for the IP address. After hitting enter it asks you if you want to specify a username and password, just say no. Then it asks if you want to use a Http proxy. Say NO again.

If things have went right so far it should say "trying to connect to ftp server". Once connected it says "Please enter the directory on the server"

For the ftp://mirror.mcs.anl.gov/pub/suse/ ftp server the correct entry would be: pub/suse/i386/9.1/

You should then see a small screen that says "Loading data into ramdisk (53300 kB) WOOT..... the hard part of the install, getting connected, is over!!

After that data is downloaded into the RAM disk, you will be greeted with the YaST Installation and System administration program.

The first thing you get to do is choose your language again. Then Yast detects hardware and checks to see if you want to load those drivers/modules. Choosing yes to detected hardware seems like a no brainer to me... so choose yes. The rest of the installation seems fairly straightforward and should be easy. The YaST installer has a very NICE partitioning tool.

At a minimum, you should probably have these partitions.

/boot small 50 mb
swap 500 mb unless you have alot of ram
/root 2+ gigs at least
/home the rest of the hard drive...or dedicate more to other partitions and root.

NOTE: You can let SuSe auto-partition your drive for you. I decided to go that route this time and ended up with a 1 gig swap partition and a 5 gig root partition on my 6 gig test drive. While I'm not sure that's the best setup, it did work fine.

The net install once it begins does take some time, even with fast connections. My 9.1 install took 1 hour and 15 minutes start to finish using the above method. That's the fastest I've ever did a net install, so I doubt that it was an average time. The servers are all running and alot of time are running at full capacity. Your milage may vary of course, and depends on your connection speed, and how busy the mirror is when your doing this. I usually set it up to start downloading the packages right before I go to bed Plan on taking at least several hours to complete this on a fast connection. If I were on dialup, personally, I wouldn't even attempt this type of install. It would be much less painful to just pay for SuSe 9.1 in my local computer store, or order it online.

Once the packages are finally downloaded, you get a nice menu with Yast to choose different programs if you desire something besides the default setup. Working with Yast and configuring you system are beyond the scope of this artical, but I doubt you'll have many problems if you made it this far

Then it's time to finish the install, setting root password, users, graphic card settings, and that's about it. Special note, check your RESOLUTION SETTINGS here carefully, sometimes the installer sets them to high. I usually just change mine back to 1024x768, but you may want different settings. By default the installer usually sets the resolution to it's HIGHEST possible setting for the graphics card/monitor combination, sometimes this results in makeing the monitor run out of sync. Reboot and you get rewarded with a SuSe 9.0 Linux Desktop workstation !! I'm very impressed with the ease of use of the SuSe enviroment. I look forward to using it more and more.

On another side note, if you have several computers that you want to install this to, you can download the entire directory tree and do this install from your own network. (That to is beyond the scope of this article, but isn't to difficult to do.) This would be much quicker than installing via ftp from a remote server every time. I don't see much benefit to downloading the entire tree if your just going to install this on one machine though.

I hope this short tutorial was useful to you. If so, let me know

Things you might want to write down BEFORE you start the install:

1. The ftp mirror URL:

_________________________________________________
2. The boot iso url:

_________________________________________________
3. The IP address of the ftp server your using:

_________________________________________________
4. The directory address on the ftp server:

_________________________________________________
5. The names/model #'s of your network (ethernet) cards:

_________________________________________________
6. If you don't use dhcp for your network you may need

Static Network Address:
Subnet Mask:
Gateway/Router Address:
ISP primary DNS server address:

(note, I use a cable/dsl router and it uses dhcp to take care of this for me)

Main Download Page http://www.suse.com/us/private/download/suse_linux/index.html

SuSe Mirrors Page http://www.suse.com/us/private/download/ftp/int_mirrors.html

The installation guideline ftp://ftp.suse.com/pub/suse/i386/9.1/README.FTP

Most current version of this article:
http://usalug.org/phpBB2/viewtopic.php?p=24250

Special thanks to :Everyone that emailed me on previous articles and offered additional tips.

By Crouse
http://www.usalug.org
USA Linux Users Group

BOOK: The Programmers' Stone

#UNIX - The Programmers' Stone

BOOK: Reversed Hell Networks - books section

Reversed Hell Networks - books section

LINK: Netric Security Team

Netric Security Team

LINK: United Net Fontier - Thislib

United Net Fontier - Thislib

LINK: Hacker links

hacker links

LINK: 29A Labs

29A Labs

LINK: Welcome! (VX heavens)

Welcome! (VX heavens)

LINK: Black Sun Research Facility Tutorials

Black Sun Research Facility Tutorials

LINK: Willkommen auf www.delikon.de

Willkommen auf www.delikon.de

LINK: Shellcode.com.ar ( Shellcodes for linux *BSD, SUN, etc )

Shellcode.com.ar ( Shellcodes for linux *BSD, SUN, etc )

LINK: http://www.hackaholic.org/

LINK: Hello, Coder !

Hello, Coder !

LINK: Z0MBiE's HomePage

Z0MBiE's HomePage

LINK: priestmasters exploit coding homepage

priestmasters exploit coding homepage

BOOK: Learning GNU C

Learning GNU C

BOOK: Programming from the Ground Up Book

Savannah

WRITE: Argumentative paper (a rougher draft it will not get ;-) )

The EU patent law
In a couple of months the European Union (EU) will decide if software patents should be enforced in Europe. Although this might profit some of the huge companies it will eventually limit some people from producing competitive software due to having to pay loyalty fees and fear of breaking the law. It will also encourage what is witnessed today in the US which is outsourcing. This issue is not new, as a matter of fact in the United States many questions the effectiveness of the DMCA for small startups. The DMCA is a law that prohibits some people from reverse engineering of hardware and/or software, one of the many ways for making a good and competitive product. Patents limit on what ideas you could use to develop a product that is an exact clone, if not better that, the big marketer’s product but with a much lesser toll on your budget.
The United States patent office has issued many absurd patents to companies over the years, for example just last week it issued Microsoft two patents one dealing with double clicking a mouse and the other with buttons on a PDA. The patent office also issued Cisco systems a patent for enhancement in the TCP/IP protocol and another in a way of patching software. Such patens are not correct because nether companies did invent the idea; the companies were however the first at the door step and had the deepest pocket. Already in the United States many software developers are being persecuted or forced out of business because of making competitive software that follows the same idea as the big company. Big companies such as Microsoft and Apple are using such laws to capitalize the market and weed out competition.
The same nations that witnessed huge inventors from Leonardo Dafinci in the 1600s till Albert Einstein in 1940 is blocking the next generation from following in there foot steps. Software making is exactly like science (that is why the field is called computer science) a requirement is to share your ideas with others to excel and benefit the rest of the world. But if your ideas are patented by your company the company might refuse to give away such ideas without making cash themselves, and herein lies the real issue.

In Europe where programmers count in the millions this issue is huge. In a world were expert programmers are being bought by big companies, and the inexperienced are being forced not to learn due to government regulations this is going backwards down the drain of evolution not forward as the norm. While I agree that software could be copyrighted; I would highly disagree that the idea of the function of the software should. Currently patent laws in the US give the patent owner full rights to the idea, however, other could use the patent for royalty fees, the patent last 17 years well over the life cycle of a program and in my opinion is a huge leap for a technology that uses nanoseconds as it's measurement of time.
While software makers lobbies keep pushing for the law, the majority if not all the programmers currently disagree with the current laws and many petitions are circulating to ban such acts and change the future of Europe by banning software patents. May third world countries such as India, China, and Thailand rarely have an enforced copyright law. They will use such lack to develop software that will compete with the world largest software makers and leave the Europe nations wondering why they lacking in technological advances. The only solution to this problem is to block the EU from ever passing such law and blockading any software maker that supports software patents.
A new movement has sprung up and in an industry that is constantly changing and as Bill Gates said: “any teenager from a garage could develop software that directly competes with us and eventually put us out of business.” We should give that teenager a chance may be this invention is for the good of humanity. The issue currently rests in the EU’s hand choosing to reject the software patent law will be a good decision not only to the economy of Europe but for the economy of the world. Lindows (currently Linspire) has been prosecuted in many European countries due to its name and similarity to the software’s giant Microsoft’s product Windows. The world that struck me about the Lindows case was the president of the startup company challenged Microsoft in the software arena where it excels not in the judicial system.

LINK: Disposable email, for a single usage?

Disposable email, for a single usage?

LINK: 2GB free email AventureMail.com

Welcome to AventureMail.com - The worlds largest inbox.

VIRUS: Worst-Case Worm Could Rack Up $50 Billion In U.S. Damages

Security Pipeline | News | Worst-Case Worm Could Rack Up $50 Billion In U.S. Damages

By Gregg Keizer
June 04, 2004

A worst-case worm attack on the U.S. could easily cost the country $50
billion in direct damages, a pair of security experts said Friday.

Nicholas Weaver and Vern Paxson, two security researchers who work
with the International Computer Science Institute (ICSI), a nonprofit
research group associated with the University of California at
Berkeley, modeled a worst-case scenario in which state-sponsored
attackers construct a worm exploiting an unpublished vulnerability,
then launch it over the Internet.

Weaver is a postdoctoral researcher at ICSI, while Paxson is also a
staff scientist at the Lawrence Berkeley National Laboratory.

"Although our estimates are at best approximations, a plausible
worst-case worm could cause $50 billion or more in direct economic
damage by attacking widely used services in Microsoft Windows and
carrying a highly destructive payload," said Weaver and Paxson in
their paper.

And that boggling economic disaster doesn't include secondary losses,
such as possible impacts on IT infrastructure, but only accounts for
loss productivity, lost data, damaged desktops and servers, and repair
expenses.

Weaver and Paxson make a number of assumptions to arrive at their
worst-case worm, including attackers with extensive resources, such as
those sponsored by an enemy nation state; the ability to sniff out an
as-yet-undiscovered vulnerability in Windows; and a resulting worm
that could spread so quickly that anti-virus firms wouldn't be able to
react in time with updated signatures before the majority of the
damage had been done.

"An electronic attack [of this magnitude] could cause widespread
economic damage by disrupting or even destroying a large fraction of
the computers responsible for day-to-day business," said Weaver and
Paxson. "It's not implausible to conceive of attacks that could
disrupt 50 million or more business computers."

By comparison, Weaver and Paxson said, last summer's MSBlast worm,
which exploited a vulnerability that was known for almost a month
before the worm appeared, infected a minimum of 8 million machines.

Worms would be the weapon of choice for such an attack, the
researchers said, because they can spread very quickly, as evidenced
by the Slammer worm of 2003, which managed to infect tens of thousands
of systems worldwide in less than ten minutes. Speed would be crucial
to any successful worst-case worm, since, once it's released, the race
begins against propagation and security firms' ability to create new
signature files to defend against the threat.

The reason it's likely such a superworm would be developed with
support from a nation state, said the duo, is that it would require
the additional resources that smaller, less well-funded groups lack.
State-sponsored hackers would have the personnel and time to discover
one or more "zero-day" vulnerabilities in Windows-so called, because
they would be vulnerabilities never before seen, and so without a
patch--and thoroughly test the worm to make sure it could successfully
infect a wide range of Windows operating systems.

Among the most likely candidates for a zero-day exploit, said Weaver
and Paxson, is Windows' SMB/CIFS file-sharing service, which is used
by all versions of Microsoft's operating system since Windows 98.
SMB/CIFS is used for desktop file and print sharing, and by Windows
files servers.

"SMB/CIFS makes a good target because it's on by default in most
installs, it enables some exploits to connect without requiring
authentication, any successful attack gains complete control of the
machine, organizations cannot lightly disable it, and vulnerabilities
[in it] have been discovered in the past," said Weaver and Paxson.

Worst-case worm makers could steal already proven techniques, such as
those used by 2001's Nimda worm, to first rapidly scan the Internet
for vulnerable systems, then apply a mass-mailed version to penetrate
internal networks secured at the gateway.

"Although it is probably impossible to estimate more precisely," said
the researchers, "if released during U.S. business hours, it could
infect all the vulnerable machines before a reaction is possible, as
even the highly disruptive and detectable Slammer worm was effectively
unperturbed for three hours."

Attackers with the right resources could dedicate months to testing
their worm in order to ensure that it successfully infects as many
different versions of Windows as possible. Historically, that's been
one of the major flaws of most single-author or small-group worms,
which may reliably attack Windows XP systems, for instance, but not
work against Windows NT machines.

"Considerable attacker effort needs to be spent in testing [worm]
components in a wide range of environments," said Weaver and Paxson.
"The more diverse the testing, the more widely the resulting worm is
likely to penetrate."

Once infected, machines could be directed to install a backdoor Trojan
horse for deploying additional malicious payloads, randomly corrupt
files, erase all found drives on the local machine and the network,
and even corrupt the flash memory used by the PC's BIOS.

Weaver and Paxson investigated seven popular system and two
motherboard manufacturers' wares, and found that, in a third of the
cases, it's possible for a worm to cause enough damage that the
motherboard would need to be replaced. The other two-thirds of the
time, the BIOS could be restored, but that's "a complex procedure
that's beyond the skills of most computer users and perhaps even many
system administrators," said the researchers.

Businesses and government can take some steps to mitigate the damage
that might be caused by a worst-case worm, including turning to
SMB/CIFS-compatible servers, such as Samba, deploying mass-mailed worm
defenses, disabling the BIOS reflash feature by setting jumpers on PC
motherboards, and restricting desktop use of file sharing and other
related services that might be exploited.

But with damages that range from a low estimate of $50 billion to as
high as over $100 billion--depending on the breaks, so to speak--no
strategy can make such a worm anything but a disaster of monumental
proportions.

"Current defenses are not capable of dealing with threats of this
magnitude," said Weaver and Paxson.

OT: open-source Java "will happen"

Sun: open-source Java "will happen"

SEC: Linux Advisory Watch - June 4th 2004

Information Security News: Linux Advisory Watch - June 4th 2004: " ---------------------------------------------------------------- | LinuxSecurity.com Linux Advisory Watch | | June 4th, 2004 Volume 5, Number 23a | ---------------"

+----------------------------------------------------------------+
| LinuxSecurity.com Linux Advisory Watch |
| June 4th, 2004 Volume 5, Number 23a |
+----------------------------------------------------------------+

Editors: Dave Wreski Benjamin Thomas
dave_at_linuxsecurity.com ben_at_linuxsecurity.com

Linux Advisory Watch is a comprehensive newsletter that outlines the
security vulnerabilities that have been announced throughout the week.
It includes point

This week, advisories were released for mailman, kde, MySQL, mc, Apache,
Heimdal, utempter, and LHA. The distributors include Conectiva, FreeBSD:
core, Gentoo, Mandrake, Red Hat, and SuSE.

-----

>> Internet Productivity Suite: Open Source Security <<

Trust Internet Productivity Suite's open source architecture to give you
the best security and productivity applications available. Collaborating
with thousands of developers, Guardian Digital security engineers
implement the most technologically advanced ideas and methods into their
design.

http://ads.linuxsecurity.com/cgi-bin/newad_redirect.pl?id=gdn10

-----

Incident Response

One of the most overlooked aspects of information security is incident
response. Often system administrators and management only take action
after a compromise or critical failure. Incident response includes much
more than sorting out problems after they occur. It includes incident
preparation, detection mechanisms, containment, eradication, restoration,
and review.

In preparation for a security incident, it is important to establish a
security policy & plan of action and identify a security response team
that is available 24 hours. Software to be used during an incident should
be installed, tested, and configured during the preparation phase.
During the adrenaline rush of an incident, it is impossible to learn new
software.

Administrators should also take appropriate steps to ensure event
detection. This includes scanning and reviewing system log files,
installing host and network based intrusion detection systems, and
implementing a remote notification system to notify members of the
security response team via pager or mobile phone.

Upon detection of an incident, it is important to have containment
procedures. Is the threat a network user? It is important that the staff
has the knowledge and tools necessary to address the problem at the
firewall level. If there is a system compromise, is tripwire configured
properly to report exactly what files were modified? After containment,
the next step is eradication. How can the problem be eliminated? The
primary purpose of containment and eradication is limiting damage and
stopping the problem from further damage.

After an incident has commenced, the next step is system restoration. It
is important to assess the actual damage that took place and restore the
system to its original condition. This may only include fixing a few
files, or restoring completely from a tape-backup. Finally, after
restoration is important to review how well the incident was handled.

Until next time, cheers!
Benjamin D. Thomas
ben_at_linuxsecurity.com

----
Guardian Digital Security Solutions Win Out At Real World Linux
Enterprise Email and Small Business Solutions Impres at Linux Exposition.
Internet and network security was a consistent theme and Guardian Digital
was on hand with innovative solutions to the most common security issues.
Attending to the growing concern for cost-effective security, Guardian
Digital's enterprise and small business applications were stand-out
successes.
http://www.linuxsecurity.com/feature_stories/feature_story-164.html
--------------------------------------------------------------------
Interview with Siem Korteweg: System Configuration Collector
In this interview we learn how the System Configuration Collector (SCC)
project began, how the software works, why Siem chose to make it open
source, and information on future developments.
http://www.linuxsecurity.com/feature_stories/feature_story-162.html
--------------------------------------------------------------------
--> Take advantage of the LinuxSecurity.com Quick Reference Card!
--> http://www.linuxsecurity.com/docs/QuickRefCard.pdf
+---------------------------------+
| Distribution: Conectiva | ----------------------------//
+---------------------------------+
5/27/2004 - mailman
Multiple vulnerabilities
Fixes cross site scripting and remote password retrieval
vulnerabilities, plus a denial of service.
http://www.linuxsecurity.com/advisories/conectiva_advisory-4409.html
5/27/2004 - kde
Insufficient input sanitation
The telnet, rlogin, ssh and mailto URI handlers in KDE do not
check for '-' at the beginning of the hostname passed.
http://www.linuxsecurity.com/advisories/conectiva_advisory-4410.html
+---------------------------------+
| Distribution: FreeBSD | ----------------------------//
+---------------------------------+
5/27/2004 - core:sys Buffer cache invalidation vulnerability
Insufficient input sanitation
In some situations, a user with read access to a file may be able
to prevent changes to that file from being committed to disk.
http://www.linuxsecurity.com/advisories/freebsd_advisory-4408.html
+---------------------------------+
| Distribution: Gentoo | ----------------------------//
+---------------------------------+
5/27/2004 - MySQL
Symlink vulnerability
Two MySQL utilities create temporary files with hardcoded paths,
allowing an attacker to use a symlink to trick MySQL into
overwriting important data.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4404.html
5/27/2004 - mc
Multiple vulnerabilities
Multiple security issues have been discovered in Midnight
Commander including several buffer overflows and string format
vulnerabilities.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4405.html
5/27/2004 - Apache
1.3 Multiple vulnerabilities
Several security vulnerabilites have been fixed in the latest
release of Apache 1.3.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4406.html
5/27/2004 - Heimdal
Buffer overflow vulnerability
A possible buffer overflow in the Kerberos 4 component of Heimdal
has been discovered.
http://www.linuxsecurity.com/advisories/gentoo_advisory-4407.html
+---------------------------------+
| Distribution: Mandrake | ----------------------------//
+---------------------------------+
5/27/2004 - mailman
Password leak vulnerability
Mailman versions >= 2.1 have an issue where 3rd parties can
retrieve member passwords from the server.
http://www.linuxsecurity.com/advisories/mandrake_advisory-4402.html
5/27/2004 - kolab-server Plain text passwords
Password leak vulnerability
The affected versions store OpenLDAP passwords in plain text.
http://www.linuxsecurity.com/advisories/mandrake_advisory-4403.html
+---------------------------------+
| Distribution: Red Hat | ----------------------------//
+---------------------------------+
5/27/2004 - utempter
Symlink vulnerability
An updated utempter package that fixes a potential symlink
vulnerability is now available.
http://www.linuxsecurity.com/advisories/redhat_advisory-4399.html
5/27/2004 - LHA
Multiple vulnerabilities
Ulf Harnhammar discovered two stack buffer overflows and two
directory traversal flaws in LHA.
http://www.linuxsecurity.com/advisories/redhat_advisory-4400.html
5/27/2004 - tcpdump,libpcap,arpwatch Denial of service vulnerability
Multiple vulnerabilities
Upon receiving specially crafted ISAKMP packets, TCPDUMP would
crash.
http://www.linuxsecurity.com/advisories/redhat_advisory-4401.html
+---------------------------------+
| Distribution: SuSE | ----------------------------//
+---------------------------------+
5/27/2004 - kdelibs/kdelibs3 Insufficient input sanitation
Multiple vulnerabilities
The URI handler of the kdelibs3 and kdelibs class library contains
a flaw which allows remote attackers to create arbitrary files as
the user utilizing the kdelibs3/kdelibs package.
http://www.linuxsecurity.com/advisories/suse_advisory-4398.html
------------------------------------------------------------------------
Distributed by: Guardian Digital, Inc. LinuxSecurity.com
To unsubscribe email vuln-newsletter-request_at_linuxsecurity.com
with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
_________________________________________
ISN mailing list
Sponsored by: OSVDB.org

VIRUS: RE: [Vmyths.com ALERT] mi2g predicts ''catastrophic'' attack in 2004

Information Security News: RE: [Vmyths.com ALERT] mi2g predicts ''catastrophic'' attack in 2004: "Forwarded from: Marc Maiffret Can I get in at $1 so when everyone over bids I can win the house, andtractor trailer on the 'price is wrong bitch' showcase s"

Forwarded from: Marc Maiffret

Can I get in at $1 so when everyone over bids I can win the house, and
tractor trailer on the "price is wrong bitch" showcase showdown?

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9538
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

| -----Original Message-----
| From: isn-bounces_at_attrition.org
| [mailto:isn-bounces_at_attrition.org] On Behalf Of InfoSec News
| Sent: Thursday, June 03, 2004 11:29 PM
| To: isn_at_attrition.org
| Subject: Re: [ISN] [Vmyths.com ALERT] mi2g predicts
| ''catastrophic'' attackin 2004
|
| Forwarded from: Kurt Seifried
|
| Hahaha, jokes on mi2k. I'm betting a global cyber catastrophy
| will only result in 99.7 billion dollars and 54 cents (which
| countries dollars I do not know, and do they mean a european
| billion, which is a north american trillion?). Boy will mi2g
| look bad when the world melts down and they were caught
| 299,999,999.46 over on their estimate (or if they meant a
| european billion then they'll be off by a few orders of
| magnitude, but at that point I think the world economy would
| be drooling and twitching on the floor).
|
| Somehow $99,699,999,999,54 is silly, but 100 billion is ok.
|
| Kurt Seifried, kurt_at_seifried.org
| A15B BEE5 B391 B9AD B0EF
| AEB0 AD63 0B4E AD56 E574
| http://seifried.org/security/

M$: Microsoft bars Windows pirates

BBC NEWS | Technology | Microsoft bars Windows pirates

4 June, 2004

Many people using pirated copies of Windows XP will get no help from
Microsoft to make their PC safer.

The software giant has decided that a forthcoming update to XP will
not work with the most widely pirated versions of its operating
system.

The upgrade, called Service Pack 2, closes security loopholes in XP
and adds features that make it easier to keep machines safer from
viruses.

The software update is due to be released during the summer.

Pirate pack

SP2 is the long awaited upgrade for Windows XP that Microsoft hopes
will make the software much more resilient to many of the ways that
malicious hackers and virus writers have exploited it before now.

Also included are features that make it easier for users to manage
their anti-virus software and firewall. It also forces users to make
explicit choices about how secure they want their PC to be.

Other features include a blocker for adverts that pop-up when people
browse the web and background utilities that warn when spyware is
trying to install itself on their machine.

Once installed SP2 also changes the way that future updates are
installed.

Instead of downloading the whole chunk of XP being updated, SP2
instead only downloads the parts that have changed.

This change should reduce future patch download times by up to 80%.

Hefty download

The arrival of SP2 also has implications for those running websites
and Microsoft has issued advice to help webmasters cope with the
changes.

Paul Randle, Microsoft's UK manager of all things XP, said the final
SP2 package would be about 80MB in size when released.

"It is not a normal service pack," he told BBC News Online. "We are
breaking our own rules that said we would not put new code into
service packs."

Microsoft was working hard to ensure that users could get hold of the
software as many ways as possible, he said.

Net service providers plus software and hardware partners of Microsoft
are expected to make copies available to customers and subscribers.

Users will also be able to register on a Microsoft website to get a CD
containing the patch sent to them.

Mr Randle said during installation SP2 will check the product ID
number for the copy of XP in use on a PC and will not let itself be
installed if that software is a version that has been widely pirated.

Constant review

Microsoft has worked out the 20 most pirated product IDs and SP2 will
not install and run on any copy of XP bearing one of those numbers.

"The situation at the moment is that we will block those," he said.

It is unclear what effect this strategy will have in countries where
much of software used is illegal. For instance, the anti-piracy
Business Software Alliance estimates that 92% of software in China is
pirated.

Mr Randle said Microsoft was keeping its SP2 strategy under constant
review.

"Whether it will change between now and launch I do not know," he
said.

Service Pack 1 for Windows XP worked with almost all legitimate and
pirated versions of the software.

Only those copies of XP that used the two most widely pirated product
IDs were barred from getting the upgrade.

BOOK: Creating Applications with Mozilla

mozdev.org - books: chapters/index

LINK: User Agent Switcher Extension Firefox

User Agent Switcher Extension on chrispederick.com

LINUX: Linux In Government: Interoperability

Linux In Government: Interoperability: "Posted on Friday, June 04, 2004 by Tom AdelsteinLinux Journal welcomes government Open Source expert Tom Adelstein as our newest web columnist. In his first column, Tom covers so"

Posted on Friday, June 04, 2004 by Tom Adelstein

Linux Journal welcomes government Open Source expert Tom Adelstein as our newest web columnist. In his first column, Tom covers some notable government IT success stories.

Since August 2003, we have seen significant Linux adoption taking place within many sectors of the US federal government. Major accomplishments include deployment of a large interoperable database project using LAMP, Justice Department XML standards, establishment of a Government Open Source Community sponsored by the Federal Enterprise Architecture (FEA), and organization of the Government Open Code Collaborative.

While many other projects and initiatives exist, this article focuses primarily on standards-based thrusts into cooperation among states and local governments.
Interoperability - A Homeland Security Priority

Secretary Tom Ridge has said that the Department of Homeland Security (DHS) "must create new ways to share information and intelligence both vertically, between governments, and horizontally, across agencies and jurisdictions." Unfortunately, the efforts of DHS have fallen far short of expectations. Secretary Ridge has run into the same problems others have encountered on the way to implementing standards-based IT solutions: putting the technology together and overcoming fiefdoms.

Last fall, I had the opportunity to observe technology in a lab at the University of North Texas operated by Dr. William Moen. Dr. Moen proved Linux and standards-based Z3950 technology could provide a huge start in solving the problems of Homeland Security's needs. While DHS struggles with getting the States to cooperate, Dr. Moen's LAMP project provides some keys to rapid deployment of interoperable document stores and databases.

I also spoke with Kevin Marsh of the Texas State Library and Archives Commission about the same interoperability project I saw at UNT, called the Library of Texas. If you have an interest in seeing how an interoperable government web services system works, go to the web site and log on as a guest. Run a search and watch the remarkable capabilities of the system.

Kevin has worked with Linux since 1994. He offered me insights into interoperability and standards rarely identified in my forays in the government sector. He pointed me to the National Information Standards Organization where I found a plethora of interoperability standards.

When I asked Kevin if the Library of Texas project offered an example of how our Government could implement interoperability under Homeland Security, he said, "yes". He then went on to say, "Achieving compliance isn't easy. The Library of Texas has over 100 libraries on-line as well as 40 commercial databases. But, we're targeting 700 libraries to become part of the network. You may achieve compliance today, but things can change tomorrow."

Index Data of Denmark developed the software for The Library of Texas project. The Company has made the software available under the GNU General Public License (GPL). Index Data runs an open-source consultancy specializing in networked information retrieval.
Justice Department XML Standards

As Kevin Marsh and I discussed the Z3950 standards used in the Library Sciences he mentioned that interoperability for Homeland Security would require a different database library and definitions. This prompted me to mention Justice XML.

The site states:

What began in March 2001 as a reconciliation of data definitions evolved into a broad two-year endeavor to develop an XML-based framework that would enable the entire justice and public safety community to effectively share information at all levels - laying the foundation for local, state, and national justice interoperability.

Developed by Global and OJP, the GJXDM is an object-oriented data model comprised of a well-defined vocabulary of approximately 2,500 stable data objects, or reusable components, that facilitate the exchange and reuse of information from multiple sources and multiple applications.

While the Department of Justice has worked closely with state and local governments to create standards that can help protect the US, achieving compliance isn't easy. Chris Turrentine of ETS Development can explain why. Chris serves as a consultant to the Automated System Project (ASP) of the University of Southern Mississppi (see the entry on it.ojp.gov/topic.jsp?topic_id=107). The Office of Justice Programs describes ASP as establishing:

an information sharing network among county, local, and state agencies within three coastal counties in the state of Mississippi. The Project will provide a jail management, computer-aided dispatch, case management, and records management software suite to these agencies. Once the applications and databases are integrated, a mobile data infrastructure will be deployed for first responders to access information from laptops in the field.

According to Chris Turrentine, "the States say they want to implement Justice XML, but few have followed through." He also told me, "one State agency head said that they wouldn't share their database because they say it's their citizens' data. That's the prevailing sentiment."

Chris fought in the first Gulf War and recently added his secure portal, Quick Port, to the community of open-source applications licensed under GPL. We discussed his concern about the attitudes that exist with local government. The States don't really want to comply. They won't comply. We're going to need a national mandate to have them comply.

State and local governments follow what we might call fiefdoms or autonomous computing. The States maintain independent systems that do not trust each other. These systems hold mission-critical data such as warrants databases, directories of prison populations, and databases of known terrorists. The fiefdoms can work together under Linux like the Z3950 systems deployed by the Library of Texas.

Under the Z3950 model, each fiefdom can maintain the data in its own pond. The Z3950 Linux servers in the system deployed by Index Data in Texas can also provide interoperability without creating a single huge database. But, the heads of the fifedoms simply refuse to cooperate. That puts you and me at risk.

I recently spoke to the head of a court probation system in one of the ten largest districts in the country. She is the chief court officer. When I discussed interoperability with her, I thought she was going to go bonkers.

Her main concern dealt with the civil rights of the criminals. She said, "the Federal government has no right to violate the rights of state criminals by listing them in some database. It's like Big Brother watching everything we do. People might move to another location and they'd always have this mark against them. I'm dead set against connecting databases."

Unfortunately, I have heard this kind of argument many times. If that argument doesn't work, invariably, the last justification has something to do with the procurement process. People in state and local government consistently fall back on the argument that vendors don't provide the products they need to comply.
Establishment of a Government Open Source Community sponsored by FEA

In almost every RFP (Request for Proposal) issued by a government entity, you will see two terms used consistently: COTS and GOTS. The first stands for Commercial Off-the-Shelf Software. The second stands for Government Off-the-Shelf Software.

The FEA's Center for Components provides a Sourceforge.net style open-source community for US governments starting with Federal agencies and including state and local entities. The web site is a joint venture of the Federal Enterprise Architecture Program Management Office and Collab.net.

You will not find COTS on core.gov, but you will find Government Off-the-Shelf Software. This allows government entities to create and/or acquire open-source, standards based software. If you want to see an interesting description of the overall project, read the interview with Andy Stein of Newport News, Virginia.

While not a quick fix for fiefdoms in our country, Core.gov provides evidence that the Federal government remains serious about creating interoperable, standards-based software at every level. Core.gov will not fix the ever-present problem of improper procurement practices which exist everywhere you look.

For example, many vendors who have one or two custom installations of an application will claim their product fits the definition of COTS or GOTS. Their products do not qualify under either definition. But, procurement will allow agency heads to acquire software from vendors while turning the other way.

Core.gov can solve the need for GOTS. Again, improper procurement practices can stop progress. In those agencies where procurement doesn't turn the other way, the agency head can have a vendor sign a statement that such vendor is the sole source of such software. People refer to that process as Sole Sourcing.

The rules bend a little in this context. Here's an example of a local government policy:

"State law requires formal competition for any transaction expected to involve an expenditure of $50,000 or more. State policy further recommends that competition be sought for any transaction of $10,000 or more. Competition is not required for:

*personal or professional services (e.g., physicians, architects, attorneys, etc.)

*sole source purchases.

It is imperative that the purchasing function in a public institution be open to all qualified suppliers and that the process not impair or discourage competition. Thus, competitive bidding is always the preferred method of making an award."

Recently, I saw this happen at a Juvenile Services Agency. The agency head wanted a specific vendor to provide the software for a database. The agency dropped the bidding process after procurement drafted an RFP. The purchase was made under a Sole Source exemption. Procurement did not have the time, knowledge or resources to verify the exemption. So, what we had in this case was "plausible deniability".

The Organization of the Government Open Code Collaborative (GOCC)

Several states, local governments and universities have banded together to create an open-source repository of government software. You will find some old friends there such as Jim Willis of Rhode Island who made headlines by implementing a LAMP project for $40,000.

An outgrowth of the Massachusetts Open Source Initiative, GOCC started with seven states and four municipalities that will contribute and download open-source software designed by government agencies for their use. The repository consists of a LAMP environment. It includes MySQL, Z Object Publishing Environment application server, Apache Web server, OpenLDAP and Debian.

GOCC and Core.gov differ because the former only wants working software. To upload software to the repository, one must become a member of GOCC, while any municipality can download the software for free.

GOCC has yet to prove itself, but one has to admit that this represents a good start.
Connecting the Dots

I wonder if the fifedoms will ever connect the dots. If the American public understood the amount of money wasted everyday by the IT practices in this country, then you would expect an uprising. I wonder if anyone really cares.

While Linux and the open-source community continue to make strides, progress remains slow. In Government we not only face the problem of Linux acceptance, we also face the problems of people wanting to protect their territory and their niche. We also face bureacratic creep - the ability to keep a document authorizing a project on one's desk forever.

I hope that somehow this message makes it to Secretary Ridge.

Tom Adelstein works as a Linux consultant specializing in identifying opportunities for open-source software in organizations. He's the coauthor of the upcoming book, Exploring Linux with the Java Desktop System by O'Reilly and Associates. Tom also works with the Open Source Software Institute He recently published two articles in Forbes Magazine about open-source software and JBOSS.

LINUX: Is open source IP telephony ready for prime time? Yes

Is open source IP telephony ready for prime time? Yes

y Zenas Hutcheson, St. Paul Venture Capital
Network World, 06/07/04

Now is the time to begin implementing open source IP telephony. Here's why:

• Open source business models are changing market dynamics. Open source, coupled with subscription-based software licensing, is now a widely accepted business model with significant momentum. Linux and Red Hat are the best examples of the successful pairing of open source technology (Linux) with a subscription-based software license (Red Hat). Red Hat says eight of the top 10 global investment banks are customers. Goldman Sachs' recent IT spending survey reports that Red Hat ranks first among software companies gaining share of IT dollars. Linux is having its greatest effect in the data center, where mission-critical functions are run on higher-end servers and the majority of enterprise IT dollars are spent.

• Strong end-user benefits are driving the adoption of open source technology and subscription-based business models. The benefits of open source subscription-based business models include improved product quality, enhanced innovation, reduced cost, promotion of standards and elimination of vendor lock-in. In a recent IDC survey, more than 40% of CIOs said Linux is an important part of their IT strategy. According to a recent Jupiter Research report, price-sensitive small and midsize businesses are turning to Linux and other open source products as a lower-cost alternative to proprietary vendor offerings.

• Reliable, cost-effective open source IP telephony products are available today. Open source IP toll-bypass products and open source IP softphones are on the market. An open source IP PBX product scored on par with proprietary products in a recent Miercom evaluation. In fact, Miercom recently selected that same open source IP PBX product to benchmark Session Initiation Protocol (SIP) interoperability. In addition, CT Labs recently tested an open source IP PBX for feature completeness and found the product provided all the necessary features required for an enterprise-grade IP telephony solution.

• Open source-based IP telephony companies can change the market before traditional vendors respond. Traditional telephony system vendors cannot meet user needs without radical changes to their products and business models. The cornerstone of the traditional telephony industry - proprietary call control - must first be eliminated. The best means to achieve this is through open source. Forward-thinking industry observers now expect SIP-based open source IP telephony products will replace proprietary hardware and software with standard Linux servers, open call control, and a mixture of open source and proprietary application software.

Combining open source with a technology such as SIP offers the industry a stable, reliable and independent platform on which to build distributed applications. SIP provides a framework for multi-vendor interoperability and a compelling business proposition to value-added resellers and system integrators, and for the first time gives customers choices. Now is the time to say no to proprietary call control and vendor lock-in, and deploy standards-based IP telephony products.

Hutcheson is managing general partner with St. Paul Venture Capital. He can be reached at zhutcheson@spvc.com.

OT: Phishing just the start?

Phishing just the start?

PROG: Software Engineering LG #95

Software Engineering LG #95: "By Gustavo Rondina AbstractThe so called software crisis can generate several and serious consequences to computing and IT in the future, mainly on issues that refers to the free"

By Gustavo Rondina

Abstract
The so called software crisis can generate several and serious consequences to computing and IT in the future, mainly on issues that refers to the free software. This article intends to quickly introduce the reader to some of the problems which can contribute with this crisis and maybe encouraje users and programmers to adopt the necessary measures to avoid it.
1. Introduction

Nowdays the hardware devces are becaming more powerfull and are expanding its capacities and features every day. But those devices are useless if there are not software that are able to explore those features as much as possible, thus it is appropriate to say that the software development process, called software engineering, is one of the most important areas of computing.

To catch up with the rapidly technological advance at the hardware industry, the programmers and software engineers, whose job is develop the core of the softwares, must keep the idea that it is necessary not just create and develop a product that works, but a product that implements good software engineering practices, assuring that no computer or programmer's efforts will be wasted.
2. Linux, free software and software engineering

You might be asking yourselves: where does Linux fit on that scenario ? Well, the free software movement can answer that question. The Linux OS have been one great and successfull project that helped to spread the free software principles, concepts and philosophy.

In the last decade we can note a significant increasing if we look at the number of Linux users. Users that have adopted the system at home, at work or even at school. Many of these users had joined to Linux due its source code availability: any person over the world can get the source, read it, make modifications, copy and redistribute this code. Most of those users have had already a previous knowledge of computer programming and OSes based on Unix.

However there were users that have adopted Linux just to fill their curiosity, to know and explore a new and different system and have an idea of how a Unix-like system works; some of them didn't like or didn't get used to Linux and droped it soon, but most of them have adopted Linux as a way of life and a philosophy.

This new Linux's enthusiastics wanted to learn as much as possible about the system, so, with the source code open to anyone and built under C and assembler programming languages, they have decided that learning how to programm would be a good way to start understanting Linux. And this was what happened, a lot of new users have started to programm and hack codes volunteerly, giving their time and efforts to projects aimming to contribute with the open source community. Today there are a lot of successfull projects which show to the world that the free software development philosofy really works.
3. So, where is the problem ?

These new programmers had learned the programming languages that are necessary to software development and had put in practice their knowledge developing software that fits their needs, producing the expected results. However, there are no warranty that those products are totally realiable and the ideas have been implemented at the best way possible.

This happens due the lack of knowledge at the software engineering area. There are many projects that are developed by people who don't have much experience at the software development and production, so there are a lack of concepts and theory to these programmers. To programm isn't just about launching a text editor and start to hack some code and then compile it, even getting the expected results.

To know the syntax of a programming language doesn't mean to know how to programm and develop good and quality software. The software development is complex process, since the first algorithm design until the debugging and testing phase. A programmer who doesn't have the conecpts os language paradigms and their differences (i.e. oriented object programming and procedural programming); who doesn't know deeply the several types os data structures, such as stacks, queues, lists and binary trees; or the programmer who doesn't know how a hardware achitecture does arithmetic operations and how their logical circuits works, can develop a software that, even working, have not been implemented at it must have.

A software that isn't implemented at the right way may cause wast of hardware resources such as processing time of the CPU or how the memory is managed; waste the programmer's efforts as well, once he can solve trivial problems using a complex and expensive methods, since he doesn't know an easier way; waste also the features of the language by using it poorly or even incorrectly. All this things increases the final cost of the project.
4. How to solve this problem ?

This kind of problem is know as "the software crisis". Each person who starts to hack and produce new codes without the right knowledges of good software engineering contributes to the increasement of this crisis.

In the future that can be very dangerous, mainly to the free software community since, in some cases, there is no one in charge of monitoring and moderating the development phase of the project, once that several projects are developed by volunteers programmers.

The solution of this problem may be clear: the users and the programmers must study deeply software engineering and modeling, algorithms analisys, software testing and each paradigms and languages' details. The developers should read more scientific papers and tecnical books about software engineering. Many programmers just want their software producting the expected results, but if a programmer wants to be a successfull developer and have high quality and reliable software, it is essential to know all the theorycal bases that is hide under the practice. Theorycal knowledge is the base to everything.

A lot of programs and projects starts in the paper, it is not a shame to make some rough draft of the algorithm. Some times an idea can achieve a high abstraction level which can be more understantable trought a draw. To test the software before it get into the consumer hands is also important, and there are many different tecnics and issues related to software testing. To know several programming languages and languages paradigms give the programmer more flexibility while choosing the best way to solve a problem, since each language has its own limitations. Even the source code identation is important to increase the readability of the sources. All this things are related with the good software engineering and improves the quality of your product.
5. Conclusion

This article does not intend to criticize neither to discourage hobbyst programmers, but encourage them to know further and deeply the issues related with the software development process. Only that way we will have good and realiable software at the next generations.

I hope you have enjoyed this article. Please forgive my really poor english, this is not my native language. Maybe on a future article it will be improved a bit. Comments, questions and suggestions are always welcome. Feel free to email me at gustavorondina at uol dot com dot br



I am Gustavo Rondina, and I am from Brazil. I am a graduation student taking the 4th semester of Computer Science course, but I have been in touch with computers and Linux for about 5 years.

LINUX: Getting a better browsing experience with Mozilla LG #103

Getting a better browsing experience with Mozilla LG #103: "Getting a better browsing experience with Mozilla By Jimmy O'ReganOK, so the average browsing experience with Mozilla is pretty good to begin with, but Mozilla can be extended in"

Getting a better browsing experience with Mozilla

By Jimmy O'Regan

OK, so the average browsing experience with Mozilla is pretty good to begin with, but Mozilla can be extended in several ways to get greater functionality. I'm only covering ways to improve browsing in this article; though there are many other extensions available, from games to web development tools. You can even get UI designers for developing your own Mozilla extensions.

Of course, many people will say that the best way to use Mozilla is to install FireFox, but I'm still a bit too comfortable in Mozilla to consider changing. In any event, using extensions such as the Tabbed Browsing Extensions add FireFox's abilities (and more) to Mozilla.

This article is intended to be the start of a series on desktop related topics; covering everything from GDesklets/Super Karamba (next month!) to running Windows applications under Wine (and comparing them to native replacements).
QuickManager

If you think that you'll be using a lot of extensions, QuickManager is the first extension you'll want to install. QuickManager uses the lists of available extensions from the Database project (a project to keep a unified record of all Mozilla extensions) to provide an easy way to install multiple extensions.

Of course, you could always go to MozDev and browse the lists of extensions, but not all extensions are hosted there. One in particular is the tabbrowser extensions, which I can no longer browse without.
Tabbrowser Extensions

This is the big one for me. The tabbrowser extensions add several great features to Mozilla's tabs. This does everything to remembering a configurable amount of previously closed tabs, to allowing you to rearrange tabs so that pages of similar topics can be kept together on your screen. It allows you to choose whether new tabs get focus (as Mozilla does) or not (the FireFox default) depending on how they are opened. You can choose on a per-tab basis whether or not to allow images, Java, Javascript or frames. You can also choose to save tab sessions, and if Mozilla crashes it will offer to restore the last set of tabs which were open.

One of the best features for me, however, is Auto Reload. This allows you to pick an interval between reloads. I use this to watch Wikipedia's recent changes to watch for vandalism, and delete it as it happens. (This seems to be a good time to include a plug). Though Mozilla has a function to watch a bookmarked page, and notify the user (by changing the icon or playing a sound) when the page changes, Wikipedia is updated every few seconds, so this feature isn't useful me.
The Googlebar

The googlebar comes next for me in terms of usefulness. Though Mozilla can be configured to perform searches using bookmarklets (covered later in this article), the Googlebar provides access to most, if not all, of Google's facilities from the browser window - it'd get pretty confusing to try to remember keywords for all of them.

Another great feature is that googlebar can remember your last n searches (up to 50), which are available from a drop-down menu.
Small extensions
NextImage

NextImage is possibly the simplest Mozilla extension going. NextImage finds the last number in the URL, and adds an option to the browser's context menu to either increments it or decrements it by one. Although even its' own author refers to it as "pretty dumb", this simple idea has saved me a lot of time around /usr/share/doc. This requires global installation (i.e. root needs to install it).
Diggler

Diggler is another small extension. It simply adds a button to clear the addressbar, similar to Konqueror's. This would be useful enough by itself, but Diggler also provides a drop-down menu which gives easy access to lower level directories, and an ftp url for the site. Diggler also requires global installation.
PopupAlt

Popup ALT does exactly what is says on the tin: it provides a popup of an image's ALT tag when the mouse is placed over it. This feature, which was present in Netscape 4, was removed from Mozilla for some unknown reason.
User Agent Switcher

User Agent Switcher is also a pretty descriptive title: it provides a submenu which allows you to masquerade Mozilla as another browser. This is useful for sites which block access to browsers other than Internet Explorer, despite rendering just as well in others.

Command line users: You can do the same with lynx:

lynx -useragent="Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" [url]

wget:

wget -U "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" [url]

or curl:

curl -A "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" [url]

Bookmarklets

Another way of extending Mozilla's capabilities is by using bookmark keywords. Using the bookmark manager (Bookmarks->Manage bookmarks, or Ctrl-B) you can edit the properties of a bookmark, and insert a keyword. This allows you to use your own mnemonics to access frequently accessed URLs from the location bar.

Where this really comes in handy, though, is that you can replace any part of the URL with "%s", which will be replaced by whatever subsequent text you enter, with modifications to make a proper URL (spaces become '%20', etc). For example, if I have the URL "http://slashdot.org/search.pl?query=%s" bookmarked with the keyword "slash" (you can create a new bookmark from the bookmark manager from File->New->Bookmark), if I type "slash Alexis de Toqueville" Mozilla transforms the URL into http://slashdot.org/search.pl?query=Alexis%20de%20Toqueville

You can also use Javascript in Bookmarklets. Ben recently sent a few bookmarklets to The Answer Gang list which are useful for web development, allowing you to quickly resize the screen to various settings. If Ben was to create a new bookmark with "javascript:moveTo(0,20);window.resizeTo(1280,738)" as the URL and "fs" as the keyword, he would be able have his browser return to his preferred size. Knowing that Ben is pretty comfortable around a keyboard, I think he'd prefer that to having to reach for the mouse.

I've created a sample set of bookmarklets. This can be saved as a text file (though it's already available as sample-bookmarklets.html.txt), and can be imported into an existing set of bookmarks in the Bookmark Manager, from Tools->Import.




Some Bookmarklets



Freshmeat Search
Search Wikipedia
IMDB Search
SHORTCUTURL="dict">Dict Search
HREF="http://www.google.com/search?q=%s&btnG=Google+Search&domains=linuxgazette.net&sitesearch=linuxgazette.net"
SHORTCUTURL="lg">Search Linux Gazette

Search Slashdot
Google Linux Search
Google Search
Merriam-Webster
Dictionary


Resize to 640x480
Resize to 800x600
Resize to 1024x768





Jimmy has been using computers from the tender age of seven, when his father was left an Amstrad PCW8256. He was shown a Unix box several years later, and instantly fell in love. But it could never be, as Unix vendors tended to demand first-born children, and when Mark came along in 1997, the trade didn't seem worth it.

Within weeks of starting college, Shane, a fellow first year student, started a computer society and so Jimmy found his introduction to Linux. Jimmy was made an admin pretty quickly, because Shane figured he'd get the root password one way or another.

Jimmy has since reformed his l33t wayz, and could pass for a productive member of society in dim lighting, at a distance, if you're only looking out of the corner of your eye. In "Moving Pictures", Terry Pratchett wrote:

Of course, it is very important to be sober when you take an exam. Many worthwhile careers in the street-cleaning, fruit-picking, and subway-guitar-playing industries have been founded on a lack of understanding of this simple fact.

VIRUS: Microsoft's Swift Response Nabbed Sasser Suspect

Microsoft's Swift Response Nabbed Sasser Suspect

OT: Cities Say No to the Patriot Act

Wired News: Cities Say No to the Patriot Act

SEC: Fighting Back Against Cyber-Crime

Fighting Back Against Cyber-Crime

PROG: Scripting GNU in the 21st Century

Scripting GNU in the 21st Century

LINUX: A Linux-Based Implementation of Mobility Using SIP

A Linux-Based Implementation of Mobility Using SIP

ARTICLE: The Case for OpenOffice

Linux News: Special Reports: The Case for OpenOffice

ARTICLE: Is Anything Left of Novell?

Linux News: Special Reports: Is Anything Left of Novell?

OT: Who's Afraid of Internet Sales Tax?

Linux News: Special Reports: Who's Afraid of Internet Sales Tax?

OT: Did PayPal Kill Online Payment Systems?

Linux News: Special Reports: Did PayPal Kill Online Payment Systems?

LINUX: Who's Making Money from Linux?

Linux News: Special Reports: Who's Making Money from Linux?

LINUX: Linux (Finally) Ready for the Desktop

Linux News: Small Business: Linux (Finally) Ready for the Desktop

UNIX: Has SCO Killed UnitedLinux?

Linux News: Head-to-Head: Has SCO Killed UnitedLinux?

OT: Macromedia Flash - The Bottom Line

Linux News: Commerce: Macromedia Flash - The Bottom Line

LINUX: x86 No Execute Support

Linux: x86 No Execute Support

LINUX: Snownews - the text mode RSS/RDF newsreader - *Updated*

A. S. Bradbury: Archive - Snownews - the text mode RSS/RDF newsreader - *Updated*

LINUX: Gnome Roadmap



Introduction
============

GNOME is a large Open Source software project, with hundreds of
contributors from right across the globe. Some of these contributors
work on GNOME as part of their employment, but the majority offer up
many hours of their free time and energy in helping to create one of
the premier desktop environments for Linux and UNIX-like
installations.

The GNOME Community Road Map is a big-picture view of what
functionality GNOME can expect to include through the next year and
beyond. The Road Map is a combination of feedback from current GNOME
developers and other community members.

Due to the largely volunteer nature of the project, constructing a
detailed, long-term list of concrete goals is impractical. However,
it is possible to discuss the general themes that drive development of
GNOME.

For specific pieces of GNOME, there are a number of concrete short- to
medium-term goals listed. This list of improvements comes from the
individual module maintainers and contributors.

This document describes the major themes of GNOME development. Each
section describes theme and why it is important. It then lists three
sets of concrete tasks - 2.6 Improvements, 2.8 Plans, and Long Term
Goals. Items listed in the 2.6 Improvements sections are already
implemented and will be available in the GNOME 2.6 release. Items in
the 2.8 Plans are tasks that a contributor has expressed interest in
implementing, and can be expected for the 2.8 release. Long Term
Goals list items that the maintainers have identified as important,
but for which there are no concrete plans to address in 2.8.

Universal Access
================

The GNOME desktop strives to be a productive working environment for
all people. Wherever possible, GNOME strives to eliminate obstacles
that unnecessarily hamper the user experience. It is a guiding
principle of GNOME development that software should operate smoothly,
regardless of the user's level of expertise, language preference, or
physical disabilities.

2.6 Improvements
----------------

* New file selector from GTK+ 2.4.

* Bundled assistive technologies are more functional, and
new assistive technology and features have been added.

* Existing accessibility support has been largely or
completely internationalized.

* Integrated support for internationalized keyboards in
control-center.

* Improved user-visible mime UI.

* Object-oriented ("spatial") file manager to improve usability.

2.8 Plans
---------

* More improvement to the user-visible mime U.

* Accessibility support interoperating seamlessly with
Web, email, office applications, and other GUI toolkits.

Open Questions
--------------

* Mozilla ships the Firefox browser, which has similar goals to
GNOME's Epiphany browser. We would like to work with the
Mozilla foundation to settle on a common direction for the web
browser.

Collaboration
=============

Communicating and working with other people is not simply a function
of a single application that sits in a rectangular window on your
screen -- Evolution or Outlook, for example -- but one of the primary
functions of a computer. Therefore, collaboration should be a
first-class element of the user experience.

The GNOME desktop will have collaborative elements woven throughout
it: a centralized presence icon mechanism that shows whether people
you are working with are online or not, the ability to share files and
data with people from anywhere in the desktop, and generally the
presentation of collaboration-related information in every part of the
desktop where it is relevant, not just in one or two applications.

2.6 Improvements
----------------

* Optional integration of contact and calendaring information into
the desktop.

2.8 Plans
---------

* Inclusion of Evolution into the GNOME Desktop.
- Inclusion of the Evolution data server will provide a central
touchpoint for addressbook and calendaring information.
- The Evolution client will provide mail, addressbook, and
calendaring capabilities to the desktop.

* Wide-spread integration of addressbook and calendaring
integration with the desktop.

* Easy sending of files over email and IM.

* Discovery of network services.
- Detection of file shares through rendezvous will be integrated
into the gnome-vfs volume-management layer.

* Integration of presence information into the desktop.
- There are two projects underway (gossip and galago) to
provide presence information integrated with the addressbook.

* Personal file searching based on local file index, including
file metadata searching based on the Medusa file indexer.

Long Term
---------

* Blogging integration.

* Peer-to-peer data sharing.

* Metadata framework
- Possible implementations include Novell's Simias, GNOME
Storage

Media
=====

There are still pending issues with the stability, legality,
licensing, and/or developer-friendliness of the available the media
framework solutions. Partially due to these issues, no media
applications have been formally included in the GNOME 2.6 release.
However, the community is actively developing a complete series of
media applications.

2.6 Improvements
----------------

* Sound-Juicer, a CD audio importing tool has been developed.

* The Rhythmbox music player has matured and is now more stable
and feature complete.

* The Totem video player widget was placed into a separate
library for use by other apps.

2.8 Plans
---------

* Integration of CD audio importing into rhythmbox.

* Integration of CD burning into rhythmbox.

* Integration of portable music player support into rhythmbox.

* Investigation of legal issues surrounding licensing of media
frameworks.

- There is an explicit goal that the platform be LGPL or more
liberal in order to allow ISVs to use the platform to create
proprietary software. This policy has never been formally
documented. Both of the proposed media options have open
legal questions. The Helix framework is not LGPL- or GPL-
compatible. It is unclear that the GStreamer license
allows for proprietary codec implementations.

Long Term
---------

* Movement of media widgets into the core platform.

* Audio server replacement.

* Better image viewing/photo collection manipulation.

Hardware
========

One area in which GNOME has lagged behind other desktop operating
systems like Windows and Mac OS X is tight integration with hardware.
GNOME is working with the freedesktop.org community to make
plug-and-play hardware management just work.

In addition, the GNOME community is working on supporting a wide range
of devices - for example digital cameras, music players, and bluetooth
devices.

2.6 Improvements
----------------

* Better handling of removable media in GNOME VFS and the file
manager.

* DVD burning support in the Nautilus CD burner.

2.8 Improvements
----------------

* Better hardware integration via freedesktop.org's D-BUS and
hardware abstraction layer (HAL).

* CUPS management tools.
- Ximian has developed a set of tools to manage CUPS printers
and integrate them into the printing subsystem. These
should be integrated into GNOME for the 2.8 release.

Manageability
=============

Manageability of the desktop environment is a key area for most
large-scale deployments. The ability to centrally and remotely
administer settings of core desktop applications, along with the
ability to "lock down" end users' desktop configuration, are important
parts of an enterprise desktop.

GNOME is working toward providing these capabilities, both in the
underlying platform and in specific applications.

2.6 Improvements
----------------

* Lockdown mode for panel configuration

* Web Browser lockdown mode

* Improved lockdown and management via GConf

2.8 Plans
---------

* Improved menu system, including better compliance with
freedesktop.org specifications.
- Allows easier management of panel menus

Long Term
---------

* Improved gconf API and partial daemon rewrite.

Core Platform Improvements
==========================

GNOME realizes that ISV adoption is necessary to the success of the
free desktop. As such, constantly improving the development platform
while keeping it API and ABI compatible is an important goal.

An important part of improving the free software development platform
is communication and cooperation with other desktop environments.
GNOME is heavily involved with the freedesktop.org initiative. Within
the freedesktop.org project, GNOME works to develop standards and
implementations that ISVs can develop against to build applications
that work well regardless of the user's desktop environment.

2.6 Improvements
----------------

* Introduction and adoption of the GTK+ 2.4 toolkit, including the
new file selector API and UI, new and easier menu API, and some
other new widgets.

* gnome-vfs daemon, improved authentication and connection
sharing.

* Improved mime-type detection and database (as part of
freedesktop.org).

2.8 Plans
---------

* Database support.
- The gnome-db project is focusing on adding database
support to GNOME office applications.

* Inclusion of D-BUS, a system-wide messaging daemon.

* Improved accessibility documentation, which will help all
developers ensure that their applications are completely
accessible.

* Release of GNOME Human Interface Guidelines version 1.2.

* Clarification/improvement of Nautilus extensibility APIs.
- A new extension API was added to nautilus in 2.6. They will
more widely adopted and tested in the 2.8 timeframe. This
extension API is not currently a part of the core platform.

* Formalization of the Platform licensing policy.

Long Term
---------

* Deprecation of libgnomecanvas and libart in favor of new API
based on the Cairo library

* Improved cut and paste/drag and drop format documentation, to
allow better interoperability in this area.

* Improved applet/tray icon API and usage guidelines.

* New VFS API, to allow for less UNIX-like file semantics which
are easier to develop against and more appropriate for a larger
class of VFS backends.

Open Questions
--------------

* GNOME is currently implemented in C, with language bindings
implemented for use in third-party applications. There is some
consensus in the community that adoption of a higher-level
language and runtime would be beneficial to the development of
the desktop.

Java and C# have been proposed as alternatives. The community
is currently discussing the technical, political, and legal
ramifications of adopting these languages into the desktop.s

LINUX: CLI for noobies: have fun with ESR

Linux.com | CLI for noobies: have fun with ESR

Title CLI for noobies: have fun with ESR
Date 2004.06.07 5:00
Author warthawg
Topic CLI Series
http://www.linux.com/article.pl?sid=04/06/06/2138218

By "have fun with ESR" I don't mean to argue or agree with his politics. Or his philosophy of open source software either, for that matter. What I mean is simply to enjoy his true genius, which is not in writing parables, or philosophy, or politics: but in writing code. So open a console and extract yourself from that GUI mess for a few minutes, noobie. Let's play some of ESR's favorite games -- on the command line.

Eric S. Raymond is famous for many things, not least of which are his famous papers like The Cathedral and the Bazaar and The Magic Cauldron, two works which have been instrumental in informing PHBs in Dilbertville that there just might be something worthwhile in this free software/open source "thing."

His exposes of Microsoft's secret plans and ambitions chronicled in The Halloween Documents are also legendary in certain circles. And all that is fine and good. But let's not forget, shall we, that the man is a coder. Like most of us he is never short on opinions, and he is not too shy about expressing them. But that's window dressing. We're going to look at a few programs he maintains -- if we can borrow a phrase from another famous coder -- just for fun.

The download page for each of these games is linked to from the game title in the section heading. A man page is included with each source code tarball. You should probably consider reading the man page a prerequisite for game play.

It's all about greed

After downloading, melt the tarball with "tar xzf filename." Then cd into the directory created by tar during decompression and type "make." Assuming a successful completion of the compile, su to root and type "make install". When that's done, exit super user mode and play the game by entering its name at the CLI.

The game of greed was originally written by Matt Day, but is now maintained by ESR. Gameplay is deceptively simply. When the game begins, you (the "@" symbol) are somewhere in a field of colored digits. Movement is controlled by two things: you enter the direction you want to go and the value of the first digit that lies in your path in that direction. The value of the first digit controls how many digits will be "eaten" as you move. If a 5 is on your right, for example, and you press the right arrow key, the 5 and the next four digits to its right will be erased.

The catch is that you cannot make a move that would take you over a previously erased digits. It's a lot easier to box yourself in than you might think. Be careful with this game, it can make you crazy.

Would you like to ski, silly?

It looks to me as if something was forgotten in the Makefile included in the ski source code tarball. As a result, the man page wasn't installed and I could only play the game from the directory where I uncompressed it. To tidy things up on my system, I moved the man page (named ski.6) to /usr/share/man/man6 and the executable file (ski) to /usr/games.

Ski is another orphaned project. The original author was Mark Stevans. This release by ESR has been rewritten in python. As promised in the README, it's fun and silly. The idea behind the game is that you are skiing downhill on powered skis. Yeti's try to beat you up or kill you, trees get in the way, and there are treacherous patches of ice. Luckily for you, you can steer left and right, fire nuclear ICBMs, or summon the Fire Demon to assist you.

If you don't mind silly, this game can be just as addicting as greed. Type ski at the command line to start getting silly.

An empire of one's own

As was the case with ski, the Makefile included with the source code tarball doesn't do installation. You still need to run make, in order to compile the program. This one written in C instead of python. According to the README, the DNA from this game is in all the versions of empire that have appeared, and there have been many. All thanks to the original work by Chuck Simmons. To complete the installation, move vms-empire.6 to /usr/share/man/man6 and the executable vms-empire to /usr/games.

It's just you against the computer. The cities you build or capture will produce what you tell them to produce: armies, fighters, destroyers, transports, satellites, and so on. One tip before sending you noobies out to die: choose a very low level of difficulty to get started. I don't want your blood on my hands.

There you have it, a quick tour of a few of the fun things ESR has done to make the world a little more fun for all of us. At the CLI, of course.


Greed

Ski

Empire
Links

1. "The Cathedral and the Bazaar" - http://www.catb.org/~esr/writings/cathedral-bazaar/
2. "The Magic Cauldron" - http://www.catb.org/~esr/writings/magic-cauldron/
3. "The Halloween Documents" - http://www.opensource.org/halloween/
4. "greed" - http://www.catb.org/~esr/greed/
5. "melt the tarball" - http://www.linux.com/print.pl?sid=04/06/06/2138218
6. "ski" - http://www.catb.org/~esr/ski/
7. "empire" - http://www.catb.org/~esr/vms-empire/
8. " " - http://www.linux.com/blob.pl?id=6f3de142144751898032f2eaaad863d5
9. " " - http://www.linux.com/blob.pl?id=88821d1404ae760c04c53a21b4d77859
10. " " - http://www.linux.com/blob.pl?id=416d30ecedb3c5945a19eec1e477ee2e

Sunday, June 06, 2004

PROG: c coder's Journal

c coder's Journal

SEC: Shellcode development / Overflow coding community's Journal

Shellcode development / Overflow coding community's Journal

SEC: vortex.labs.pulltheplug.com

vortex.labs.pulltheplug.com

PROG: C# Developers' Journal

C# Developers' Journal

LINK: Free Software Directory: All GNU Packages

Free Software Directory: All GNU Packages

REVIEW: Programming Linux Games

freshmeat.net: Book Reviews - Programming Linux Games

LINUX: Thin Linux clients deliver Internet to library patrons

Thin Linux clients deliver Internet to library patrons

LINK: Links to mathematical software sites

Links to Other Services

PROG: Mono Documentation

Mono Documentation

SEC: 10 Immutable Laws of Security

Microsoft TechNet: 10 Immutable Laws of Security

SEC: Next-Generation Win32 exploits: fundamental API flaws

Next-Generation Win32 exploits: fundamental API flaws

PROG: So You Like Color !!! (The mysterious ^[[ characters) LG #65

So You Like Color !!! (The mysterious ^[[ characters) LG #65

BOOK: Writing Programs with NCURSES

Writing Programs with NCURSES

PROG: flipCode - Programming Tutorials

flipCode - Programming Tutorials

BOOK: Index of /virtual/books

Index of /virtual/books

BOOK: Sorting and Searching: a cookbook

PROG: Mastering Linux debugging techniques

Mastering Linux debugging techniques

LINK: OpenTracker

OpenTracker

M$: Microsoft offering free OS for 'cold' servers

ARNnet | Microsoft offering free OS for 'cold' servers

OT: The Making of BSD Hacks

ONLamp.com: The Making of BSD Hacks [Jun. 03, 2004]

The Making of BSD Hacks by chromatic -- Dru Lavigne, the author of BSD Hacks, and chromatic wanted to use open source tools to write and edit the book, so they turned to PseudoPOD and Subversion. chromatic writes about how they used these tools to collaborate, write, edit, and produce the book in record time.

SEC: Writing Nessus Plugins [Jun. 03, 2004]

ONLamp.com: Writing Nessus Plugins [Jun. 03, 2004]

Writing Nessus Plugins by Nitesh Dhanjani -- Today's best vulnerability detector will be out-of-date next week unless you can somehow teach it about new exploits and vulnerabilities. Fortunately, Nessus and NASL make that easy. Nitesh Dhanjani walks through the creation of a custom Nessus vulnerability plugin.

OT: Wireless Backpack Repeater

Wireless Backpack Repeater

LINUX: GNOME

arvindn - June 6th, 2004

OT: Why It Makes Sense for Sun to Open-Source Java Libraries & Solaris Kernel

Why It Makes Sense for Sun to Open-Source Java Libraries & Solaris Kernel (LinuxWorld)

LINUX: Critique of Ken Brown's response

Critique of Ken Brown's response || kuro5hin.org: "Critique of Ken Brown's response (Op-Ed) By Ta bu shi da yu Sun Jun 6th, 2004 at 09:43:53 AM ESTI hereby present a critique to K5 of Ken Brown's response to critics of his book, Samizda"

Critique of Ken Brown's response (Op-Ed)

By Ta bu shi da yu
Sun Jun 6th, 2004 at 09:43:53 AM EST



I hereby present a critique to K5 of Ken Brown's response to critics of his book, Samizdat.

The following quote gives a good introduction to the sort of response it is:

Linux is a leprosy; and is having a deleterious effect on the U.S. IT industry because it is steadily depreciating the value of the software industry sector. Software is also embedded in hardware, chips, printers and even consumer electronics. Should embedded software become 'free' too, it would be natural to conclude the value of hardware will spiral downward as well.

Does this remind anyone of the stance that Microsoft took that the GPL is "viral"?

Note: in the interests of attribution (which Ken Brown likes to talk about a lot), I cited all articles linked to on June 5th (Sydney, Australia for those across international date lines). I am unable to prevent any changes made to this website.



Critique of Ken Brown's introduction

The introduction is quite illuminating:

Samizdat is a series of excerpts from an upcoming book on open source and operating systems that will be published later this year. AdTI did not publish Samizdat with the expectation that rabidly pro-Linux developers would embrace it. Its purpose is to provide U.S. leadership with a researched presentation on attribution and intellectual property problems with the hybrid source code model, particularly Linux. It is our hope that leadership would find this document helpful with public policy decisions regarding its future investment in Linux and other hybrid source products.

So he's going to present his "facts" to the U.S. government? Well, when he finds some I wish him the best of luck.

The United States is the home of the United States Patent and Trademark Office, an internationally respected agency which contributes to the worldwide effort to protect and govern intellectual property. In addition, the U.S. government is one of the largest patent holders in the world, owning the rights to 20-30,000 patents. Annually, the U.S. government also contributes billions to hi-tech research and development because research and development supports our intellectual property economy. Therefore, it is in the U.S. government's best interest to fully understand the impact of Linux on the intellectual property foundation of our country, as well as the entire information technology (IT) sector.

This is arguable. The other day it passed a patent that gave Microsoft control over double-clicking a mouse. With so many patents, the U.S. Patent office is falling apart at the seams, and most people know it. The USPTO just can't research the concepts well enough to know that the patents submitted are trivial and already have prior-art.

I can't even agree with this statement of Brown's.

Next, we get his recommendations to the US government:

True Open Source vs. Hybrid Source

The Samizdat report recommends that the U.S. government should invest $5 billion in research and development efforts that produce true open source products, such as BSD and MIT license-based open source. Government investment in open source development will accelerate innovation. However, increased investment should be in true open source, open source without any stipulations, other than attribution and copyright notification, not hybrid source.

What other sorts of open-source are there apart from license-based ones? Anyway, apart from this, open source is not just the BSD or MIT license. As an example, Open Source is also defined by the FSF (who prefer "Free Software"), and is also defined here. It's a vast and ambiguous term, so when Brown redefines it he looks stupid. Keep this in mind, however lets take Brown's definition and apply it to the next paragraph anyway.

"Hybrid source code" is a phrase coined by former Tocqueville Chairman Gregory Fossedal. The term refers to any product with a license that attempts to mix free and proprietary source code at the same time.

While hybrid software appears to be the same as open source, it isn't. Hybrid source code can never be true intellectual property. The actual purpose of hybrid source is to nullify its value as private property, which makes the hybrid source model significantly different from true open source. Noone can ever truly accrue any value from owning hybrid source software, because everybody (and anybody) has the rights to every line of improvement in it. Worse, many argue that if hybrid source is used the wrong way, it can make other source code hybrid source as well.

The hybrid source model negatively impacts the intellectual property model for all software, and inevitably the entire IT economy.

Well, this much is pretty obvious. But no-one is arguing this point, in fact if proprietry code is introduced into Open Source software it gets rejected unless the project gets the original owner to open the code up with a different, compatible, license.

Which makes the next sentence laughable:

As long as the value of the IT economy is dependent on the preservation of intellectual property, it is counterproductive for the U.S. government to invest in Linux.

So far, it's been proven that the Linux kernel isn't contaminated. Only Brown and SCO are asserting that it's contaminated, and they haven't given one shred of evidence that it's polluted with someone else's intellectual property (IP).

Note to Ken Brown: speculation isn't evidence.

The next section comes under the heading "Linux is Inherently Unstable", which is pretty funny really, because Browns definition of "unstable" and most users definition is quite different. Brown is defining "unstable" as unusable due to IP pollution. Technical users define "unstable" as not of high-quality due to crashing, data loss, etc.

The disturbing reality is that the hybrid source model depends heavily upon sponging talent from U.S. corporations and/or U.S. proprietary software. Much of this questionable borrowing is a) not in the best interest U.S. corporations b) not in the best interest of IT workers in America c) at a serious expense to the investment community, an entity betting on the success of intellectual property in the marketplace.

Again with the "hybrid-source" definition of Open Source! The only "disturbing reality" is that this whole paragraph is incorrect.

Linux is a leprosy; and is having a deleterious effect on the U.S. IT industry because it is steadily depreciating the value of the software industry sector. Software is also embedded in hardware, chips, printers and even consumer electronics. Should embedded software become 'free' too, it would be natural to conclude the value of hardware will spiral downward as well.

What emotive and imprecise language - "leprosy" indeed. Actually, there are many companies out there using embedded Linux and finding it cuts their costs and increases their profit. It means they can actually compete in a free market! Brown's argument here appears to be that because existing companies are losing money as they have to compete better, Linux is like leprosy.

Let's look at his logic, however.

Assertion: Software is also embedded in hardware, chips, printers and even consumer electronics.
Assertion: Embedded software is becoming free (have removed the quotation marks myself because they aren't needed)
Conclusion: The value of hardware will spiral downward as well

In syllogistic logic, this is called an invalid and unsound argument. It's invalid because it's contradictory to have the premises all true and the conclusion false (you can't come to his conclusion via his assertions), and it's unsound because it's invalid and has an untrue conclusion.

In Samizdat, AdTI argues that the inherent instability of hybrid source development such as Linux is due in great part to its inability to provide a sound policy for originating source code without attribution or IP problems. Within two days of AdTI's release of Samizdat, OSDL(1: Open Source Development Laboratory ed: added by me, but it's in Brown's footnotes) member Linus Torvalds affirmed AdTI's concerns, announcing that Linux kernel contributions depend largely on `trust'. In an attempt to fix the system, Linus Torvalds announced an ambiguous policy(2 Under the enhanced kernel submission process, contributions to the Linux kernel may only be made by individuals who acknowledge their right to make the contribution under an appropriate open-source license. The acknowledgement, called the Developer's Certificate of Origin (DCO), tracks contributions and contributors. ed - also added by me, but this is part of the footnote) to promote better `trust'.

Yep, attribution has been tightened. This is a good thing, and Ken Brown and SCO are both to be congratulated that they pushed their individual (or corporate!) agendas to make them do this. Regrettably, neither have told us where the code is that has been purloined from existing proprietary code-bases.

Samizdat concludes that the root of attribution, IP misappropriation, and acknowledgement problems in Linux is ---in fact--- the trust model. Basically, Torvalds and other Linux advocates are admitting to using a `three monkeys' policy for software development: see no evil, speak no evil, hear no evil. Specifically, Torvalds and the Linux kernel management team accept blind source code contributions. Then, they ask for a certification. But the certification does not hold the contributor, the Linux community, or Torvalds legally accountable. Nor does it guarantee that the source is produced in a 'clean room'. Meanwhile users are left to just 'trust' Linux too, legally left to face the ramifications of any significant legal problems. This is a 'wishful thinking' policy, and is not a sound approach for software development. The reality is that, noone, including Linus Torvalds, can ever guarantee that code in the Linux kernel is free of counter ownership, or attribution claims. AdTI suggests that the U.S. government should buy and invest in software from a confirmable entity, not from an assortment of unconfirmable sources. AdTI is certain that inevitably, some unfortunate user of Linux will be facing an incalculable legal problem.

First of all (and sorry to keep harping on at this), but what misappropriation, attribution and acknowledgement problems are there?? Please Mr Brown, give us some examples if you're going to make a statement like "root of attribution, IP misappropriation, and acknowledgement problems in Linux is ---in fact--- the trust model."

Secondly, Brown appears to favour the BSD and MIT licenses. Yet why would they have more or less accountability in the attributions they supply than what is maintained in the GPLed Linux code-base?

Brown also makes the assertion that users will have legal problems. This sounds suspiciously like what SCO is doing when they sued companies like Lehman Brothers (who've basically told them to push off). Regrettably for Brown, he obviously doesn't understand IP laws very well. Hey, neither does SCO...

I found the sentence "Meanwhile, we should also very plainly ask, 'who[m] are we trusting?'" quite amusing. Clearly not Ken Brown, because I have no idea who[m] he is getting his funding from,

Brown flew over to Amsterdam to interview me on 23 March 2004. Apparently I was the only reason for his coming to Europe. The interview got off to a shaky start, roughly paraphrased as follows:

AST: "What's the Alexis de Tocqueville Institution?"
KB: We do public policy work
AST: A think tank, like the Rand Corporation?
KB: Sort of
AST: What does it do?
KB: Issue reports and books
AST: Who funds it?
KB: We have multiple funding sources
AST: Is SCO one of them? Is this about the SCO lawsuit?
KB: We have multiple funding sources
AST: Is Microsoft one of them?
KB: We have multiple funding sources

Tanenbaum, "Some Notes on the "Who wrote Linux" Kerfuffle, Release 1.5", '04

Anway, enough commentary on this aspect of the AdTI. Back to Ken Brown's article.

In a controversial section of Samizdat, I ask readers to pose some very hard questions about the origin of the Linux kernel. This is for a number of reasons, but especially because the same people that are selling the trust model cannot answer basic questions about what attribution, acknowledgement, and IP credit they may have owed ATT Corporation and/or Prentice Hall Corporation in 1991 when the Linux kernel was introduced.

Prentice Hall? Is he referring to Minix? If so, is he aware that Minix is a Microkernel, and Linux is a monolithic kernel? Does Ken Brown even know what the difference is?!?

As for the ATT Corporation, they aren't concerned, and there is no evidence that Linux has any code that they developed, apart from some POSIX stuff. That bit of code is part of a external standard anyway as the original Linux 0.01 used part of Minix for error codes. Hardly a huge IP issue).

The same community that sells `trust', is the same community that celebrates: the theft of ATT Unix source code in the late 70's, joked about the theft of Windows source code in February, and commenting on the Cisco source code theft in May wrote in Newsforge, "maybe the theft will be a good enough reason for Cisco customers to check out open source alternatives....(3: Commentary: If only Cisco code had been open source, May 17, 2004)"

What is this guy, some sort of troll? What a stupid comment. He's basically tarred everyone with the same brush... why not just say that all Linux coders joked about the Challenger disaster or September 11th? These are ungrounded and baseless accusations - unless of course he's referring to the "community" as the slashdot crowd and not the development crowd. If he's referring to the development crowd, however, then he might want to read the response on the ReactOS mailing list to people who even started talking about the leaked Windows source code.

Isn't fair (sic) to question the character and ethics of individuals that espouse contempt for intellectual property? Isn't fair to question their character, when the core of their business strategy is trust?

It is fair to question that. If Linux open source programmers had a nefarious scheme to steal code, however, don't you think they'd close the sources and not open the code to inspection by everyone? However, I'd like to turn this argument around and apply it to Ken Brown - I'd like to question who's funding his research and question the ethics of writing badly resarched FUD.

This concludes our critique of his introduction. Now let's look at the next section, entitled "Interviews for Samizdat".

Interviews for Samizdat

Ken Brown starts with a quote from Linux Insider. I was under the impression that when you quote a web-based article you should give the URL of the article, the date it was cited and the article's title. This is important (I can't believe I have to mention this to anyone) so that we can check the sources of information ourselves and verify:

a. what was quoted is correct (it is), and
b. the wider context in which it was written so that we can evaluate the claims of the person who quoted from the article.

So much for his big whinge about attribution problems in the Linux kernel! Perhaps before Brown criticises something he doesn't understand he could put his own house in order.

For the record, the link at the time of writing (June 5th, 2004) is at http://www.linuxinsider.com/story/33929.html and it's title is "Tanenbaum Disputes Methods of Controversial Report".

The next subsection under "Interviews for Samizdat" is "Reasonable Doubt".

Reasonable Doubt

Brown starts by praising the Linux kernel, but then disparages it in the same breath:

AdTI and Tanenbaum do agree on one point: the Linux kernel is an incredible, but conspicuous accomplishment. Noone seemed to be interested in critiquing it. So subsequently, AdTI decided to look into this, because we agreed it was no average feat. We collected evidence and looked at it a dozen different ways. Afterwards, we humbly concluded that the story in the public record about Torvalds and the Linux kernel is questionable. Thus, we published some of the facts we came up with, so readers could analyze the story for themselves.

Humbly? Nice choice of words, and a pretty big call from someone who's not a developer! He didn't critique the codebase, which is really the only way to tell if there is someone else's IP in the Linux sources. Anyway, enough sniping. Basically, the evidence collected appears to have been molded to fit Brown's ideas about Open Source, not the other way around. Your conclusion should be supported by your evidence, not you conclusion supports the evidence!

As many are aware, I interviewed Professor Tanenbaum, the author of Minix, a copyright protected property by Prentice Hall. On March 8, 2004, Professor Tanenbaum sent me the following e-mail:

To find out what Tanenbaum thinks of Brown, check his home page. I'll be frequently linking to it. Anyway, to continue:

To write Samizdat, I worked with (and quoted) many individuals directly or indirectly familiar with Linux development. AdTI will continue to interview people within the open source profession about open source. It would be skewed and bias to only quote people that are anti-Linux or anti-open source. I have done this for years, and will continue to do so, regardless of what a source thinks of my theories.

Very noble of him, I'm sure, though wouldn't it be better if he actually talked to the man who claimed to write Linux, Linux Torvalds, and who he is so suspicious of?

According to a followup written by Tanenbaum, Linus emailed informing him that he was never contacted by Brown:

In his email, Linus said that Brown never contacted him. No email, no phone call, no personal interview. Nothing. Considering the fact that Brown was writing an explosive book in which he accused Linus of not being the author of Linux, you would think a serious author would at least confront the subject with the accusation and give him a chance to respond. What kind of a reporter talks to people on the periphery of the subject but fails to talk to the main player?

Quite.

"MINIX was the base that Linus used to create Linux. He also took many ideas from MINIX, including the file system, source tree, and much more.(4: Tanenbaum, Andrew. Interview with AdTI. March 8, 2004. ed - added by me, but taken word for word from Brown's footnotes)"

I met with Professor Tanenbaum not to write a treatise on software engineering, but to discuss the issue of software product rights and protection that he brought up in his email. In an interview with Tanenbaum, it became immediately noticeable that the professor was an animated, but tense individual about the topic of rights and attribution. He felt that well-known facts about Minix/Linux development should not have to be questioned. It was clear that he was very conflicted, and probably sorry that he sent the email in the first place.

That's right. Attack your subject. Tanenbaum wrote some fairly interesting things about him, saying he wasn't the "sharpest knife in the draw", and also noted that he appears to have not done any research on Minix. It appeared that he was fishing for an answer he liked.

Ironically, Professor Tanenbaum's recent comments only recapitulate many of the substantive contradictions regarding the early Linux kernel AdTI decided to discuss in Samizdat. I met with Professor Tanenbaum with the hope of resolving some of these inconsistent and contradictory accounts in the public record.

Funny, I didn't get that Tanenbaum was very conflicted at all. I got from Tanenbaum that he realised that Brown had no idea what he was talking about:

Now Ken Brown shows up and begins asking questions. I quickly determined that he didn't know a thing about the history of UNIX, had never heard of the Salus book, and knew nothing about BSD and the AT&T lawsuit. I started to tell him the history, but he stopped me and said he was more interested in the legal aspects. I said: "Oh you mean about Dennis Ritchie's patent number 4135240 on the setuid bit?" Then I added:"That's not a problem. Bell Labs dedicated the patent." That's when I discovered that (1) he had never heard of the patent, (2) did not know what it meant to dedicate a patent (i.e., put it in the public domain), and (3) really did not know a thing about intellectual property law. He was confused about patents, copyrights, and trademarks. Gratuitously, I asked if he was a lawyer, but it was obvious he was not and he admitted it. At this point I was still thinking he might be a spy from SCO, but if he was, SCO was not getting its money's worth.

He wanted to go on about the ownership issue, but he was also trying to avoid telling me what his real purpose was, so he didn't phrase his questions very well. Finally he asked me if I thought Linus wrote Linux. I said that to the best of my knowledge, Linus wrote the whole kernel himself, but after it was released, other people began improving the kernel, which was very primitive initially, and adding new software to the system--essentially the same development model as MINIX. Then he began to focus on this, with questions like: "Didn't he steal pieces of MINIX without permission." I told him that MINIX had clearly had a huge influence on Linux in many ways, from the layout of the file system to the names in the source tree, but I didn't think Linus had used any of my code. Linus also used MINIX as his development platform initially, but there was nothing wrong with that. He asked if I objected to that and I said no, I didn't, people were free to use it as they wished for noncommercial purposes. Later MINIX was released under the Berkeley license, which freed it up for all purposes. It is still in surprisingly wide use, both for education and in the Third World, where millions of people are happy as a clam to have an old castoff 1-MB 386, on which MINIX runs just fine. The MINIX home page cited above still gets more than 1000 hits a week.

Finally, Brown began to focus sharply. He kept asking, in different forms, how one person could write an operating system all by himself. He simply didn't believe that was possible. So I had to give him more history, sigh. To start with, Ken Thompson wrote UNICS for the PDP-7 all by himself. When it was later moved to the PDP-11 and rewritten in C, Dennis Ritchie joined the team, but primarily focused on designing the C language, writing the C compiler, and writing the I/O system and device drivers. Ken wrote nearly all of the kernel himself.

Question #1: Is it likely that a student (Linus Torvalds) with no operating systems experience, a non-Unix licensee, without any use of Minix or Unix source code, could build a functioning kernel in six months -- whereas it took you (Tanenbaum) three years to build Minix?

It seems that Brown doesn't believe that anyone is smart enough to write their own operating system. Well, I know he isn't, but he thinks that someone with "only one year experience of C" wouldn't be able to do the job. Let's focus on this now:

Question #1

Is it likely that a student (Linus Torvalds) with no operating systems experience, a non-Unix licensee, without any use of Minix or Unix source code, could build a functioning kernel in six months -- whereas it took you (Tanenbaum) three years to build Minix?

In Tanenbaum's recent posts(5), he argues (as he told me) that there are "others" that have created Unix clones or operating systems within the same constraints. Tanenbaum's argumentation only increased our doubt about the Torvalds story because the comparisons were too unbelievable. For us to accept Tanenbaum's argument, Linus Torvalds at 21, with one year of C programming, was Doug Comer, an accomplished computer scientist, or smarter than the Coherent team, and of course a better programmer than the good professor too.

Well, I have news for Brown. Version 0.01 of the Linux kernel was crap. It had no file permissions, which only got implemented when Linus nearly wiped the file-partitiion table from his hard-drive:

At one point, Linus had implemented device files in dev, and wanted to dial up the university computer and debug his terminal emulation code again. So he starts his terminal emulator program and tells it to use dev-hda". That should have been dev-ttyS1. Oops. Now his master boot record started with "ATDT" and the university modem pool phone number. I think he implemented permission checking the following day.

Really, the claims that he couldn't write an O/S are stupid. Any Uni student with a bit of nouse and some good ideas about Unix concepts could do this, it's just Linus decided that he didn't like Minix very much.

Tanenbaum told us about the Coherent project repeatedly, but it was easy to research that it was a completely different situation. It wasn't a solo effort, it was a team. Second, the timeline was wrong. Tanenbaum told us it took two years, then corrected himself on his own website writing it took six years.

Indeed. He got his timeline slightly wrong... but really this proves nothing, as Tanenbaum pointed out on the same page Brown refers to:

In 1983, a now-defunct company named the Mark Williams company produced and sold a very good UNIX clone called Coherent. Most of the work was done by three ex-students from the University of Waterloo: Dave Conroy, Randall Howard, and Johann George. It took them two years. But they produced not only the kernel, but the C compiler, shell, and ALL the UNIX utilities. This is far more work than just making a kernel. It is likely that the kernel took less than a man-year.

So the team didn't just focus on the kernel. They had to make all the utilities that go with an operating system! Linux just ported the GNU tools and got it all working. So Brown is correct about the Coherent team working under different conditions. Regrettably for Brown, however, this only makes his initial argument weaker.

Either way, it wasn't six months. On his website, it seems now Tanenbaum is comparing the inventors of Unix, Dennis Ritchie, and Kenneth Thompson to Torvalds. This comparison if anything should demonstrate why AdTI was just not very convinced by the professor. Both Ritchie and Thompson had exceptional familiarity with MULTICS-- and then wrote UNIX from scratch. Completely different from Linus, who says he started with nothing and had no experience. Another reason this is interesting is because the Ritchie, Thompson kernel was 11,000 lines of code over a number of years, and the Torvalds kernel was 32,000 in under a year.

Yes, let's look at the argument. Firstly, Brown states that Dennis Ritchie and Kenneth Thompson had extensive MULTICS understanding. True, but then again they wrote on a PDP-11 (from memory) which took large amounts of time to compile anything and was, at any rate, using a completely different architecture.

Brown also fails to note that 0.01 of Linux was released to the Internet and he started reincorporating contributed code almost immediately. This fact has never been in dispute, and it certainly doesn't take away the fact that Linus did in fact write the O/S kernel from scratch! As for the lines of code submitted - so what? More hardware was supported than older architectures, and this happened mainly because a larger pool of people had easy access to x86 machines, peripherals and documentation. With more people and more hardware that they want to support, I'd suggest you get more lines of code. I mean, Brown hasn't even bothered to seperate the lines of code that make up the core O/S (process managment, memory management, file management, etc) and the lines of code needed to manipulate hardware (device drivers)! So much for in depth analysis that backs up his assertions.

Another problem with Tanenbaum's logic is that he only presents examples of people that were Unix licensees, had Unix source code, or who were exceptionally familiar with software development. He cannot provide one example reasonably comparable to the Torvalds case.

Maybe because this wasn't asked? According to Tanenbaum, "He kept asking, in different forms, how one person could write an operating system all by himself. He simply didn't believe that was possible. So I had to give him more history, sigh." Then he went over the history of Unix and how people developed things.

In case anyone is getting lost here, let me briefly summarise Brown's argument. Linus Torvalds, a young university student with only one year's experience in C programming and operating system research, would be unable to achieve what more experienced programmers were able to do in far more time - even though they worked with a different platform and were still inventing how Unix should work (sorry, I added this last bit - I couldn't help it!).

Issue #2: Why do accounts continually assert that Torvalds "wrote Linux from scratch"?

(note how this changes from "Question" to "Issue"? Either it's poor editting, or he's trying to make a point. You decide.)

Brown starts by stating a little bit of stupidity:

Presumably, Professor Tanenbaum was not in Linus Torvalds's apartment at the time Linux was, to use a phrase recently (but only recently) disclaimed by Torvalds, "invented." Yet Tanenbaum vehemently insists that Torvalds wrote Linux from scratch, which means from a blank computer screen to most people. No books, no resources, no notes -- certainly not a line of source code to borrow from, or to be tempted to borrow from. But in a number of interviews AdTI completed with various individuals about operating system development, almost everyone reported that it is highly unlikely that even a pure genius could start from a blank computer screen and write the early Linux kernel. Suppose he could, would he?

OK, let me be anal about wording. What do you mean by "most people"? If you mean "most people" as in the general, non-technical, public, then sure. So why are we even mentioning them? they have nothing to do with technology (as indeed evidently Mr Brown has had little experience in development and is talking out of his hat). If we're talking about technically proficient developers, then duh! of course they're going to have ideas take from existing technology.

The last line "Suppose he could, would he?" is completely speculation. Ironic, actually, since Brown is accusing Tanenbaum et al. of speculation themselves. In other words it's a stupid argument and Brown is clutching at straws.

Let's continue.

In fact, everyone reported to me the opposite, that it only makes perfect sense to start with someone's code, or framework, which is the common practice among programmers.

Furthermore in almost every interview with experienced computer science professionals, almost all said that they personally had a copy of the Lions notes, an illegal distribution of Unix source code. Even Tanenbaum admits to teaching from the Lions notes. Linus says he started with nothing. In a recent ZDNet interview(6), he denies having the Lions notes. This is also unbelievable to AdTI. The story is too amazing----everybody that I met knew Linus intimately enough to confirm he wrote the kernel from scratch--- had an illegal copy of the Lions notes---- but Torvalds, was never---even near the Lions notes.

Non-attributed sources. Speculation. "The story is too amazing" - so what? Quantum Theory and Chaos Theory are too amazing, but does this mean they don't exist? Evidently it would be amazing to someone who's never created an O/S before. Does this mean that it didn't happen? Nope. Then he says that he can't believe that Linus didn't have a copy of the Lions handbook. So? Speculation, in fact interestingly enough I wonder how close to libel this is. It is possible (and even likely!) that he never read the Lions book. If he did read it, the kernel would have looked quite different, I suspect. This is my own little bit of speculation, and quite useless. Perhaps this in itself proves the stupidity of such comments.

Brown also asserts that the Lions handbook is "illegal"... sorry? I wasn't aware of that! UNSW (a Sydney university, btw) never stopped selling it in the bookstore, in fact I think I remember seeing it in the Co-op Book store at one point.

Meanwhile, an associate of mine asked Richard Stallman, who started with the Mach Kernel, why his GNU team could not build a kernel as fast as Torvalds. Mr. Stallman provided AdTI with a credible, believable set of reasons why building a kernel was not a simple task. We thank Mr. Stallman for his forthrightness and honesty. We included this interview to provide another perspective for readers to understand the magnitude of the Torvalds story. To accept the Torvalds story, Torvalds would also have been light years ahead of a team that built the very compiler he needed to make the kernel work.

Yes, well, not only is GNU/HURD a completely different type of O/S (it's a Microkernel), but it had a different development environment. Stallman wanted to keep the team small and focused on engineering to a specific spec with clean code, so he reduced his pool of volunteers. There's really nothing wrong with this, but it does lead to slow development. Proof of this is that HURD is still in alpha stage, whereas Linux has gone through thousands of iterations.

The more I read this article of Brown's, the more I had to shake my head. I mean, just look at the ridiculousness of what Brown says! He asserts "to accept the Torvalds story, Torvalds would also have been light years ahead of a team that built the very compiler he needed to make the kernel work."

First of all, the GNU team that writes gcc is very different to the GNU team that writes HURD. People should also be aware that writing a compiler like gcc is arguably harder that writing an operating system. Try to remember that gcc has been ported across O/Ses and architectures, and it has to support several different and tricky C & C++ standards. It's really not surprising that gcc takes a lot longer to develop! Secondly, I refer you, the gentle reader, to this article with Stallman. In it, Stallman states,

"The actual words I used were quoted correctly, but [author Kenneth Brown] deliberately confuses his terms, like 'Linux.' He confuses the Linux kernel, which I had nothing to do with, and the GNU OS project, which I launched," said Stallman, who characterized such mistakes as "deliberate."

Next, Linus Torvald's character is questioned:

We also included this interview to resonate the character of Mr. Torvalds. The GNU team contributed their GCC compiler, a complicated product with over 110,000 lines of code to the Linux project. Without the compiler, it is very likely that the Linux project would not have succeeded. The GNU team only asked that the product be called GNU/Linux, a very simple request for helping to make him famous. But Torvalds silently, but deliberately let the naming idea die.

This is absurd. Nowhere in the GPL does it state that you have to call Linux this, and Torvald's couldn't be bothered doing it. While I think it was a bit silly of him not to, I'd hardly call him immoral. Incidently, a note to Ken Brown: Linus Torvalds never actually named Linux, and even a cursory search with Google would pull up that the naming controversy went on for years and was really pretty stupid really. Kind of like Brown's work, I guess. (sorry, couldn't resist).

Question #3: If Linux was based on Minix, doesn't it owe rights, attribution to Prentice Hall? Does it owe attribution or rights to anyone else?

Of all the arguments, this is the most stupid.

Question #3

If Linux was based on Minix, doesn't it owe rights, attribution (sic) to Prentice Hall? Does it owe attribution or rights to anyone else?

How much `inspiration' did Linus get from Minix? AdTI argues clearly enough to credit the Prentice Hall product. Not in conversation either, but within the copyright and/or the credits files of the kernel. Quite noticeably, however, there is not one acknowledgement of Minix anywhere in the Linux kernel. Almost daily, we receive new contradictions from people on this point. In a published interview between Eric Raymond and Linus Torvalds, Raymond brandishes how Torvalds basically derived Linux from Minix. But recently in a ZDNet interview last month, Torvalds insisted that he didn't start with Minix, but did get ideas from Unix(7).

I'll just copy and paste from earlier in this document: Minix is a Microkernel, and Linux is a monolithic kernel. Does Ken Brown even know what the difference is?!?

The only thing that Linus might have taken from Minix was a list of error codes, but even then it doesn't matter. Basically, the error codes followed the POSIX standard, which anyone can use.

What is anybody suppose to believe?

Ken Brown doesn't know what he's talking about?

The larger issue is that Minix was a copyrighted product, for academic use only. The Minix license insisted from 1987 to 2000 that any commercial use of Minix for any reason, required permission of Prentice Hall. The Linux kernel was released in Fall 1991, well within the Prentice Hall proprietary license period. On the point of the license issue, Tanenbaum would just nervously repeat that he succeeded in getting Prentice Hall to change the license to BSD, so the topic was irrelevant. AdTI asks readers to ask why? Why did the license issue matter to Tanenbaum?

Blah blah. Please, Mr Brown, show us the code where Linus Torvalds infringed copyright.

Tanenbaum insists that we are wrong to bring any of this up, but ironically, he comments on his site, "...but Linus' sloppiness about attribution is no reason to assert that Linus didn't write Linux(8)." AdTI is not suggesting that readers believe that Prentice Hall is going to sue. The point of the paper is to magnify potential problems associated with this type of software development. AdTI insists that development such as this is an accident waiting to happen; something that will seriously impact both Linux users and developers. For example, in the case of Minix/Linux, AdTI argues that hypothetically, a copyright infringement case could easily erupt, if someone was determined to prove that Linux was an unauthorized derivative product of Minix.

Well, it wasn't. Minix uses a microkernel, not a monolithic kernel. Linux is not an "unauthorized derivative product of Minix". I really think the creator of this product would know better than Ken Brown does! You might want to also note that Tanenbaum says that "When distribution via the Internet became feasible, I convinced Prentice Hall to drop its (extremely modest) commercial ambitions and they gave me permission to put the source on my website for free downloading, where it still is."

The final reason why AdTI decided to focus on this issue is because we learned that in fact, Prentice Hall took all of this very seriously and had previously sued a programmer for unauthorized development of Minix.

To ask a pointed question: Brown doesn't represent Prentice Hall, so why is he so concerned? Also, to risk sounding like a broken record: Linux is not a derivative of Minix.

I'll cover the next bits briefly as I'm gettting tired of reading this crap.

Follow Up With Torvalds

AdTI contacted Torvalds employer OSDL to interview him for clarification. Without any facts, Tanenbaum goes as far to post that AdTI did not try to contact Linus, but this is contradicted by the attached post. The OSDL contact person tells AdTI that if Linus doesn't get back to us, he is not interested in being interviewed. AdTI has no problem publishing a report, whether sources do, or do not want to talk with us.

Why did he contact his employer? Why not just contact him directly? It's not like he couldn't find his contact details - he does, after all, accept and coordinates patches to the Linux kernel. Plenty of people know how to contact him directly, so why doesn't Ken Brown?!?

It is actually possible that Linus Torvalds never received Brown's email. Certainly Brown didn't try very hard to contact him, and it makes me suspect a hatchet job by Brown.

For years, Linus is (sic) credited with being an inventor. AdTI argued the claim was false. Coincidently in a recent interview, Linus decided (decided?! - ed)he was not the inventor of Linux commenting in a ZDNet story, "I'd agree that 'inventor' is not necessarily the right word...(9)"

So in other words, Ken Brown is attacking Linus for claims he never made. To restate it another way, and to make it clear how ridiculous Brown's comments are: others made the assertion that Linus is an inventor and yet Brown is attacking Torvalds for allowing people to call him this, while in the same breath he admits he claims not to be an inventor.

Weird.

Other Issues

AdTI publishes its work for all audiences. It is written so that even if a group of elementary school children asked Tanenbaum the same questions AdTI did, they would see the very contradictions we reported.

Simplistic answers for a problem as complicated as IP law are stupid. Just look at the SCO case and how mucky this is! There are basically hundreds of lawyers on both sides arguing over IP law, with thousand of pages of legal notes, opinions and court documents.

Besides which, based on what Brown has put forward so far, I don't see what he is seeing at all. The only thing I see is the contradictions in Brown's own arguments.

Vrije University is a very cool place. AdTI encourages anyone that spends any time in Amsterdam to visit. At the good professor's recommendation, AdTI spent a number of hours talking with Vrije university computer science faculty. They were great fun and extremely helpful. For that, we are also very grateful.

The way I hear it, Ken Brown was just looking for people who could give him ammunition against Linux. Think of this as you will, it's purely speculation on my part.

Professor Tanenbaum did not convince AdTI that Linus Torvalds wrote the Linux kernel from scratch. We are sorry if this has caused any inconvenience to Professor Tanenbaum or anyone else.

So Brown admits that he went to Amsterdam with a specific agenda. It's a fair conclusion to make from this statement, otherwise this apology wouldn't have been necessary. Interesting.

Summary

There is far too much boasting about stealing, reverse engineering, and illegal copying espoused by some within the open source community.

Where is he getting this info from?!? Who's boasting about stealing stuff?

What a stupid statement.

If the theft of the Lions notes had not become such a banner waving incident, our research team probably would have never been inspired to write Samizdat. The purpose of Samizdat is to demonstrate how and why the hybrid model encourages these types of activities.

Banner-waving event? News to me. Brown's whole case rests on the "theft" of the Lions notes - good grief. Also, research team? This whole thing seems like a one man operation to me! I believe that Brown is misrepresenting himself, I'm rather afraid.

AdTI argues the best way to solve this problem is to create a more substantive pool of true, free open source code. For example, Vrije University would be an excellent candidate for research and development dollars to produce more open source. To this day, Linux is siphoning resources from proprietary software companies. Encouraging this activity would be a significant mistake for the U.S. government.

Garbage, for all the reasons I noted above.

Unix is one of the greatest achievements in the history of computer science. Like other great inventions, the existence of a robust intellectual property model enabled Unix investors, developers, and users to reap significant rewards. We should support both invention and innovation.

True.

However, building a product that starts with the accomplishment of others and announcing it as completely your own work product, is not invention, nor is it innovation. Innovation can only work properly if innovators properly credit the work of others, especially if the innovator has decided to introduce the product into the marketplace for commercial gain.

From this I assume that he's saying that Linus Torvalds claimed he wrote the entire Linux operating system himself. If so, this is a completely unfounded, baseless accusation, as Torvalds never claimed this. What is certain is that Linus did initially create Linux, and he does contribute vast amounts of code and does the patch coordination. Basically, Brown is accussing Torvalds of code theft!

Brown had better watch out, this is getting close to libel. He could be sued a lot of money, should Torvalds feel the urge.

Nevertheless, AdTI concludes that U.S. Government investment in true open source development would significantly bolster the IT industry sector; and conversely, investment in hybrid open source will deteriorate it.

Kenneth Brown's qualifications

Kenneth Brown is president of the Alexis de Tocqueville Institution and director of its technology research programs. He is the author of numerous research papers and popular articles on technology issues, including the 2002 report, "Opening the open-source debate," one of the first papers to raise serious questions about the security of open- and hybrid-source computer software, a point recently raised by the president of Symantec Corporation.

Ah yes, Symantec Corporation. Actually, John Thompson, president of Symantec Corporation, wasn't talking about code attribution of IP concerns. He was talking about the inherent security of Linux. But read the article yourselves, which I'll quote part of here:

Symantec CEO John Thompson has hit out at "the myth" that Microsoft's operating system is inherently less secure than the open-source alternatives, which he likened to a "dead-end alley". However, he still had few kind words for the software giant.

Interesting that Brown brings this up, isn't it? Ken Brown should really first try to understand what people are saying first, then comment on it.

He is reportedly "not the sharpest knife in the drawer," but nevertheless is able to converse with many intelligent people, and is accepted at fine restaurants and hotels around the world.

I have to admit that I doubled over with laughter when I first read this! This is a direct quote from Andy Tanenbaum when Brown interviewed Tanenbaum and displayed a remarkable level of ignorance. It looks like the criticism is getting to him!

Conclusion

It looks to me like Ken Brown is on the backfoot after having released his book. Brown's credibility has been seriously damaged by all the criticism leveled at him by developers and founders of major software projects and organisations like GNU, Minix and Linux. Not only this, but he's now a high-visibility player - mainly thanks to slashdot and their love of controversial figures.

Lastly (thanks to John Thompson for pointing this out to me), one thing that stands out when you read Brown's rebuttal is that he does not address the issues Tanenbaum and others raised concerning his (Brown's) professionalism. Instead, he relies on ad hominem attacks on these critics. I think that epitomizes his general approach to his subject.

LINUX: Linux Anecdotes

Linux Anecdotes

LINUX: Proceed With Caution

The New York Times > Magazine > Encounter: Proceed With Caution

OT: Default Firefox theme to be replaced!

Chris' Corner � Default Firefox theme to be replaced!



It looks like the default theme for Firefox (and I assume Thunderbird), Qute, is going to be replaced by a Windows version of the excellent Pinstripe theme that is used by default on Mac OS X builds of Firefox. Apparently licensing issues (denied by the person who designed Qute, saying that he is willing to work on finding an acceptable solution to the licensing issues) and a quest to find a default theme that fits will on all platforms are the main reasons.

I am very confused as to why this is happening when Qute makes Firefox look like a perfect Windows application, right down to fitting in with Windows XP better then most Windows apps do. I have converted many people to Firefox and one of the reasons they convert is the fact that Firefox looks so much like a Windows application. I have also converted some Mac users to Firefox because of the excellent Pinstripe theme.

I guess I can’t really make a proper judgement until I see the Pinstripe theme in the Windows builds. I am saddened by this though, especially due to Arvid Axelsson’s hard work into polishing Qute thanks to it being selected as the default theme versions ago. I feel the different themes for Windows and Mac OS X are a necessity due to the way both Operating Systems have their UI’s designed. Qute just seemed perfect for Windows and Pinstripe seemed perfect for Mac OS X.

Guess I was wrong…

OT: Firefox: Another default theme coming

Another default theme coming - MozillaZine Forums



SEC: The NX Bit

CPU-Based Security: The NX Bit

OT: Why the iPod May Not Have the Horsepower for OGG

OGG on iPod: Why the iPod May Not Have the Horsepower for OGG

SEC: Symantec CEO hits Microsoft security myth

Symantec CEO hits Microsoft security myth - News - ZDNet