[Full-Disclosure] [Paper] Designing secure desktop operating system

2004-07-31 Thread Timo Sirainen
[possibly somewhat off-topic here, [EMAIL PROTECTED] can be used for discussion about it] I've written down some ideas how I think it would be possible to implement easy to use and quite secure graphical user interface and operating system around it to make it possible. It's available at http://ik

Re: [Full-Disclosure] Friendly and secure desktop operating system

2003-10-13 Thread Timo Sirainen
On Tue, 2003-10-14 at 05:41, [EMAIL PROTECTED] wrote: > > classifying software simply to "trusted" and "untrusted" isn't enough. I > > don't want my "trusted" web browser accessing files in my home directory > > (due to security holes in it) unless I specifically tell it to upload or > > download t

Re: [Full-Disclosure] Friendly and secure desktop operating system

2003-10-13 Thread Timo Sirainen
On Tue, 2003-10-14 at 04:31, Charles E. Hill wrote: > I read it, and have a couple comments. .. Most of it was about how to run current operating systems slightly more securely. I don't think it's nearly enough to provide good security. > 5. Make a list of services allowed to make network connect

Re: [Full-Disclosure] Friendly and secure desktop operating system

2003-10-13 Thread Timo Sirainen
On Tue, 2003-10-14 at 03:27, [EMAIL PROTECTED] wrote: > On Tue, 14 Oct 2003 02:00:39 +0300, Timo Sirainen <[EMAIL PROTECTED]> said: > > > http://iki.fi/tss/security/friendly-secure-os.html > > > > I'd like to hear comments about it. I hope it's easily eno

[Full-Disclosure] Friendly and secure desktop operating system

2003-10-13 Thread Timo Sirainen
For a while I've been wondering if it's possible to create an operating system that would allow "stupid" users to easily do whatever they want, but still prevent viruses and other malware from doing any harm. Today I finally spent a few minutes thinking about it and then wrote some of the thoughts

Re: [Full-Disclosure] openssh remote exploit

2003-09-16 Thread Timo Sirainen
On Mon, Sep 15, 2003 at 04:31:56PM -0700, [EMAIL PROTECTED] wrote: > you can see the 2 bugs in this code?, seems to of me that theo could > not. i am of understanding that there are exploits working on this in > the wild. 3 remote holes in default install now ! Since the patch is now available I'd

RE: [Full-Disclosure] CERT Employee Gets Owned

2003-08-27 Thread Timo Sirainen
On Tue, 2003-08-26 at 18:21, Nelson wrote: > I disagree, pedophilia is about security, because we have to know how the users > are using the network. It's about Security Policy. Sorry for yet another _really_ off-topic post, but this pedophilia talk got me really annoyed. Is someone a pedophile j

Re: [Full-Disclosure] LOL

2003-07-18 Thread Timo Sirainen
On Saturday, Jul 19, 2003, at 00:11 Europe/Helsinki, [EMAIL PROTECTED] wrote: hmm, ever heard of procmail? Yea, ugliest piece of code I've ever seen. I gave up trying to audit it and I doubt anyone can be sure it's safe of buffer overflows. I certainly won't be installing it in any of my server

Re: [Full-Disclosure] linux type definitions

2003-04-14 Thread Timo Sirainen
On Mon, Apr 14, 2003 at 07:12:32AM -, n d wrote: > i was wondering why pid_t and size_t are defined as signed integers? im > not too sure that a process id can be negative. and if strlen returns a > 16-bit signed integer what would happen if strlen was passed a string with > a size of 34000? I

Re: [Full-Disclosure] sendmail vunerability?

2003-03-28 Thread Timo Sirainen
On Wed, 2003-11-19 at 14:55, nag wrote: > there is some rumor spreading about new sendmail vulnerability. i do not see > any news at www.sendmail.org but supposedly ths is remote buffer overflow. > i received the patch (see below), but o not have any exploit, so please > don't mail me about it. >