RE: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread Steve Wray
> > One word. Ok two; > > Driving Test. > > > > Do you have a driving license? > > Did you buy it from a shop or did you have to demonstrate > > an acceptable level of competence? > > > > Who administers it? > > Holy Crap. You've got to be kidding. What an insane analogy. Totally, to most of yo

RE: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread Bruce Ediger
On Mon, 10 Feb 2003, Steve Wray wrote: > One word. Ok two; > Driving Test. > > Do you have a driving license? > Did you buy it from a shop or did you have to demonstrate > an acceptable level of competence? > > Who administers it? Holy Crap. You've got to be kidding. What an insane analogy. Fi

RE: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread Steve Wray
One word. Ok two; Driving Test. Do you have a driving license? Did you buy it from a shop or did you have to demonstrate an acceptable level of competence? Who administers it? > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]] On Behalf Of yossarian > Sent: Mond

Re: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread yossarian
Steve Wray wrote >So demonstrate to your ISP that you are competent. >Whats wrong with that? There is a lot wrong wit that. Maybe not at first sight. Why should I prove anything? Who is competent to be the judge? And, what is worse, demonstrate my skills on what? Suppose I am very competent in s

RE: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread Steve Wray
So demonstrate to your ISP that you are competent. Whats wrong with that? And if someone isn't competent and doesn't get an open pipe internet connection and doesn't get their IIS server infected with nimda W HOOO FANTASTIC! > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[E

Re: [Full-Disclosure] SQL Slammer - lessons learned (fwd)

2003-02-09 Thread Steffen Dettmer
* yossarian wrote on Sun, Feb 09, 2003 at 19:52 +0100: > My question - must my ISP know all types of traffic legit to me, in order to > service me? I don't think they can. Maybe they can serve AOL customers without any requirements except high color depth, but for people that work with the net, t

RE: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread Steve Wray
But if things carry on the way they are, ISPs are going to be required, by law, to restrict access to the internet. Once upon a time, the internet community was a closed circle, if someone on the internet released a worm or something that closed the net down, it only affected that small circle of

[Full-Disclosure] List Charter

2003-02-09 Thread John Cartwright
[Full-Disclosure] Mailing List Charter John Cartwright <[EMAIL PROTECTED]> and Len Rose <[EMAIL PROTECTED]> Introduction & Purpose -- This document serves as a charter for the [Full-Disclosure] mailing list hosted at lists.netsys.com. The list was created on 9th July 2002

RE: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread Steve Wray
ok so how about some sort of 'driving test' for internet access? Proposed Scenario; ISPs will give you unfiltered internet access if you can pass a basic test demonstrating your ability to stop your machine from being used to mess up internet access for others. (Ok so MS engineers would probably *

Re: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread yossarian
PS wrote: > All this is well and good, but I have a really hard time understanding > why we need to route insecure networking protocols such as NetBIOS, > CIFS, NFS or NIS across the Internet. Just closing those ports would do > a world of good for the Internet as a whole, and who in the world wou

Re: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread Georgi Guninski
Schmehl, Paul L wrote: ..snip... Are you really willing to demand your "freedom" in the face of the overwhelming odds that leaving those ports open will do more harm than good? I am willing to demand my freedom. When I pay to an ISP for internet, I want to have all ports in/out working. If I do

Re: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread Helmut Springer
On 09 Feb 2003 at 21:53 +0100, Schmehl, Paul L wrote: > This analogy is false. For sure it is not 100% true, as all analogies aren't. > Your phone calls do not affect my ability to connect to the > telephone company, nor to do they take down my phone system. If I'm attacking your line or telco

Re: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread Helmut Springer
On 09 Feb 2003 at 20:36 +0100, Schmehl, Paul L wrote: > All this is well and good, but I have a really hard time > understanding why we need to route insecure networking protocols > such as NetBIOS, CIFS, NFS or NIS across the Internet. Just > closing those ports would do a world of good for the I

Re: [Full-Disclosure] SQL Slammer - lessons learned

2003-02-09 Thread yossarian
PS wrote >> Can you think of a legitimate reason why ISPs should allow >> ports 135-139/TCP/UDP to be open to the Internet? How about >> port 445/UDP? Many ISPs now block port 25/TCP (for obvious >> reasons.) Why not other service ports? SD wrote >Are that InternetServiceProviders or InternetSe

[Full-Disclosure] #!ICadv-02.09.03: nethack 3.4.0 local buffer overflow

2003-02-09 Thread tsao_4sh0
-BEGIN PGP SIGNED MESSAGE- ### /usr/games/lib/nethackdir/nethack - LOCALLY EXPLOITABLE BUFFER try th1s: nethack -s `perl -e "print 'A' x 1000"` nethack.RPM package for redhat 8 is installed SETUID GAMES!@)~* ther pre compiled b1nz for c