Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Mr O
The reason you'll find XP Pro on more laptops in a retail enviroment is they are more likely aimed towards business users where as desktop systems are geared for home users with a bunch of mulitmedia crap on them. Look at Toshiba Tecra laptops, mostly XP Pro. Toshiba Satellite on the other hand is

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Jason
This is good advice O. I typically recommend non-savvy users to get a hw firewall/router immediately if they have a broadband connection. FWIW, AV, FW and patching make up the core of what MS calls 'Protect your PC' (their overall strategy for security guidance for end/home users). They've been r

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Garl Grigsby
[EMAIL PROTECTED] wrote: In XP, when you add users during the install they're all administrators. I believe this is with the Home Edition only, but I may be wrong. Home basically ignores the normal user/administrator distinction. Fortunately, Home's a lot less common, even in the home. I re

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Mr O
XP Home and Pro both give any users entered during setup Admin access. "Any user not running FW or AV" is overrated. A router does a fine job of providing one with a hardware firewall (although as hackable as any other firewall), and you could get by without AV software if you know exactly what y

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread jgw
>> I believe this is with the Home Edition only, but I may be wrong. Home >> basically ignores the normal user/administrator distinction. >> Fortunately, >> Home's a lot less common, even in the home. > > What metrics were used to come to this last conclusion? Just from experience and word on the

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Darren Hayes
- Original Message - From: <[EMAIL PROTECTED]> To: "Eugene Unix and Gnu/Linux User Group" <[EMAIL PROTECTED]> Sent: Friday, November 05, 2004 11:19 AM Subject: Re: [Eug-lug] Stupid Security Story of today > > In XP, when you add users during the install they&

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread jgw
> In XP, when you add users during the install they're all administrators. I believe this is with the Home Edition only, but I may be wrong. Home basically ignores the normal user/administrator distinction. Fortunately, Home's a lot less common, even in the home. In our version of XP (Professiona

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread jgw
> and people deride OpenBSD because they claim that there are no holes > in a default install ... to a degree because hardly anything is enabled > by default. And that's a good thing, Jake ;) I can't count the numbers of times I've helped some poor soul that's been rooted: "Ah they got in via po

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread jgw
> There is no need for /ad hominem/ personal assaults on this or any other > forum. This is totally out of line, and it is not the first time you've > tried to pick a fight with me. Actually, if I remember, that "infamous" assault was began by an out-of-line post you made, kind of like the one y

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread Ken Barber
On Friday 05 November 2004 9:24 am, [EMAIL PROTECTED] wrote: > You do not know what you're talking about, and while you may look > legitimate on a list full of UNIX users who don't pay attention to > Windows, you look like a fool to anyone in the know. There is no need for /ad hominem/ personal a

Re: [Eug-lug] Stupid Security Story of today

2004-11-05 Thread jgw
> On Thursday 04 November 2004 12:29 pm, perdurabo wrote: >> On Thu, 04 Nov 2004 08:39:35 -0800, Russ Johnson <[EMAIL PROTECTED]> >> wrote: >> > One of the fundamental flaws with Windows is that most of the time, >> any >> > user logged on has administrator privileges. >> >> That's not a flaw in Wi

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Ken Barber
On Thursday 04 November 2004 3:39 pm, Jacob Meuser wrote: > On Thu, Nov 04, 2004 at 01:18:29PM -0800, Ken Barber wrote: > > On Thursday 04 November 2004 12:29 pm, perdurabo wrote: > > > On Thu, 04 Nov 2004 08:39:35 -0800, Russ Johnson <[EMAIL PROTECTED]> wrote: > > > > One of the fundamental flaws

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Jacob Meuser
On Thu, Nov 04, 2004 at 01:18:29PM -0800, Ken Barber wrote: > On Thursday 04 November 2004 12:29 pm, perdurabo wrote: > > On Thu, 04 Nov 2004 08:39:35 -0800, Russ Johnson <[EMAIL PROTECTED]> wrote: > > > One of the fundamental flaws with Windows is that most of the time, any > > > user logged on ha

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Russ Johnson
Jason wrote: With XP, 2K, 2K3, etc. though, the recommendations of user/admin are pretty much the same as with Unix, Linux, etc. That may be the "recommended" way, but it's not how the installer sets things up. In XP, when you add users during the install they're all administrators. Russ

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Jason
Some notes . . . --- perdurabo <[EMAIL PROTECTED]> wrote: > That's not a flaw in Windows. That's a flaw in the > system > administrator, or in many applications vendors who > still program in > "Windows 95 One User For All" mode that require > users to be > administrators Yeah, unfortunately users

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Ken Barber
On Thursday 04 November 2004 12:29 pm, perdurabo wrote: > On Thu, 04 Nov 2004 08:39:35 -0800, Russ Johnson <[EMAIL PROTECTED]> wrote: > > One of the fundamental flaws with Windows is that most of the time, any > > user logged on has administrator privileges. > > That's not a flaw in Windows. That's

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread perdurabo
On Thu, 04 Nov 2004 08:39:35 -0800, Russ Johnson <[EMAIL PROTECTED]> wrote: > larry price wrote: > > >OK, linux, unix, BeOS, anything must be better than a system that allows this: > >http://www.theregister.co.uk/2004/11/04/phishing_exploit/ > > > >I mean, rewriting the hosts file from a browser e

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Mr O
Has anyone tried the exploit using a "Limited Account" under XP though? "Limited Accounts" can't do alot of stuff. Changing hosts files is nothing new though. It's just the first noted time of occuring from a browser exploit that I'm aware of. --- Russ Johnson <[EMAIL PROTECTED]> wrote: > One

Re: [Eug-lug] Stupid Security Story of today

2004-11-04 Thread Russ Johnson
larry price wrote: OK, linux, unix, BeOS, anything must be better than a system that allows this: http://www.theregister.co.uk/2004/11/04/phishing_exploit/ I mean, rewriting the hosts file from a browser exploit...? Shouldn't you a least need elevated privileges to access functionality that could

[Eug-lug] Stupid Security Story of today

2004-11-04 Thread larry price
OK, linux, unix, BeOS, anything must be better than a system that allows this: http://www.theregister.co.uk/2004/11/04/phishing_exploit/ I mean, rewriting the hosts file from a browser exploit...? Shouldn't you a least need elevated privileges to access functionality that could bury you in the ma