RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Steve Wray
[mailto:[EMAIL PROTECTED] On Behalf Of Paul Schmehl [snip] We expect people to change the oil in their cars regularly. Why don't we expect similar behavior in the computer world? Would you blame OpenBSD if a user got hacked because he hadn't bothered to patch? The car analogy is a

Re: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Ron DuFresne
[SNIP] Would you blame OpenBSD if a user got hacked because he hadn't bothered to patch? I'm not arguing that Microsoft has done the right thing or even that their OS is secure. (It isn't, and I refuse to use it as a server unless forced to. I prefer to use FreeBSD whenever

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Schmehl, Paul L
-Original Message- From: Ron DuFresne [mailto:[EMAIL PROTECTED] Sent: Wednesday, January 21, 2004 9:30 AM To: Schmehl, Paul L Cc: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] Who's to blame for malicious code? Wasn't it you that made the argument during the msblaster

Re: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Tobias Weisserth
Hi Paul, Am Mi, den 21.01.2004 schrieb Paul Schmehl um 06:53: ... The two examples I gave in my initial answer to you actually contain that. I wonder why you didn't comment on them. What's your opinion on an enabled RPC port by default in consumer OSs? Precisely the same as my opinion

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Tobias Weisserth
Dear Paul, Am Mi, den 21.01.2004 schrieb Schmehl, Paul L um 19:23: ...Tobias wants to lay *all* the blame at Microsoft's feet, and I disagree. _I_ must have made some mistakes expressing myself correctly because you seem not to understand me :-) (See? I don't blame you. I blame myself for

Re: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Vlad Galu
-- a lot of cutting here -- |Hopefully that clarifies my position. Let's clarify mine. First of all, I mean no offence. BUT: I've had it with you. I signed up for Full Disclosure, not for Full Disclosure and Paul Schmechl. So I expect to see and hear information that strictly serves to

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Schmehl, Paul L
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Tobias Weisserth Sent: Wednesday, January 21, 2004 12:54 PM To: [EMAIL PROTECTED] Subject: Re: [Full-Disclosure] Who's to blame for malicious code? And yes, we know by now. Then why is it so hard

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Tobias Weisserth
Hi Paul, a few last words since this is going into repetitive mode now ;-) Am Do, den 22.01.2004 schrieb Schmehl, Paul L um 00:44: ... It's an impossible goal. I know :-) Of course it's impossible. It's as impossible as trying to change end users. Yet we have to try because it is still

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-21 Thread Ron DuFresne
[headers snipped] Yes, I believe it was me, although you could easily verify that with the archives. perhaps I'm thinking it was you and in fact it was someone else Either the arguement was false then and windows admins were and remain just plain lazy, or the argument

Re: [Full-Disclosure] Who's to blame for malicious code?

2004-01-20 Thread Tobias Weisserth
Hi Paul, Am Di, den 20.01.2004 schrieb Schmehl, Paul L um 19:53: This is too easy. It's the same with guns. People always blame the people who pull the trigger but the fact that guns are soo damn easy to get, even for minors doesn't startle a soul... This is a ludicrous

RE: [Full-Disclosure] Who's to blame for malicious code?

2004-01-20 Thread Brent Colflesh
-Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Schmehl, Paul L Sent: Tuesday, January 20, 2004 1:53 PM To: [EMAIL PROTECTED] Subject: [Full-Disclosure] Who's to blame for malicious code? -Original Message- From: [EMAIL PROTECTED]

Re: [Full-Disclosure] Who's to blame for malicious code?

2004-01-20 Thread Paul Schmehl
--On Tuesday, January 20, 2004 9:31 PM +0100 Tobias Weisserth [EMAIL PROTECTED] wrote: The two examples I gave in my initial answer to you actually contain that. I wonder why you didn't comment on them. What's your opinion on an enabled RPC port by default in consumer OSs? Precisely the same as