Red Hat, Fedora Servers Compromised

scheistermeister

https://www.redhat.com/archives/fedora-announce-list/2008-August/msg00012.html

darkerosxx

http://rhn.redhat.com/errata/RHSA-2008-0855.html

HeroPsycho

And that's why people who say linux is 100% secure and Windows isn't shouldn't be listened to.

(Neither should you listen to anyone making the opposite claim.)

tiersten

HeroPsycho wrote:

And that's why people who say linux is 100% secure and Windows isn't shouldn't be listened to.

Can't really fault "Linux" at the moment because we don't know how they got in. Linux is actually just the kernel.

HeroPsycho

The linux nuts who slam windows on security even when unwarranted certainly don't bother to make the distinction between what was truly a code or inherent problem with Windows and other root causes that honestly don't have anything to do with Windows. To them, it's an entire evil system.

Not slamming linux here, I'm just slamming OS bigots in general.

shednik

very interesting read none the less! hope to get some updates once the analysis is complete.

slinuxuzer

The linux nuts who slam windows on security even when unwarranted certainly don't bother to make the distinction between what was truly a code or inherent problem with Windows and other root causes that honestly don't have anything to do with Windows. To them, it's an entire evil system.

Not slamming linux here, I'm just slamming OS bigots in general.

I like the way you think, I used to hate when I was in the consulting business and I would have to endure the *%*#@ Hobbyist with dual monitors tell me how he couldn't stand windows especially I.E. because it's insecure. News Flash if you keep your OS up to date you have alot better chances + not all network admins / networks were built equal, some networks acutally have vulnerabilitys that my 12 year old nephew could hack.

Anyway nothing good comes from being shortsided.

HeroPsycho

LOL, yep.

And I swear to the gods of jelly and jam if I hear one more person talk about how bad Vista is, I'm gonna go postal. Just today, I was at a customer's site, and some jackhole who thinks he knows everything walked up and butted in my conversation with my point of contact and railed against Vista, and how it's a complete piece of crap, because he couldn't run Front Page 2003 on it, which was a shame because Vista was "designed to be able to be used for Web Authoring".

I thought, "it's an OS designed to run all programs, you idiot, not just web authoring!" Anyway, turns out, all the issues he discussed were addressed with Office 2003 SP3.

RussS

Sorry HeroPsycho, but Vista is the latest incarnation of Muppet Edition .... a lot opf crap. Absolutely nothing will change my mind on that and we are advising our clients to stick to XP and wait until the next OS comes out.

bertieb

RussS wrote:

Sorry HeroPsycho, but Vista is the latest incarnation of Muppet Edition .... a lot opf crap.

I'm with Hero on this Russ, I like Vista (I must state that I like XP too, that is a good OS). To compare it to the truly evil Windows ME is harsh to say the least

kellyjohn

I thought that Linux was suppose to be secure? Guess not, oh well, back to Windows!

HeroPsycho

RussS wrote:

Sorry HeroPsycho, but Vista is the latest incarnation of Muppet Edition .... a lot opf crap. Absolutely nothing will change my mind on that and we are advising our clients to stick to XP and wait until the next OS comes out.

If nothing will change your mind, then there can't be a rational discussion about it.

dynamik

It seems like all the Vista complaints stem from low powered machines or incompatible hardware. I've been using it since it's been out, and I can't stand going back to an XP machine. There's not one or two huge features that I miss, but there's a ton of little stuff missing that makes XP feel cumbersome.

Slowhand

dynamik wrote:

It seems like all the Vista complaints stem from low powered machines or incompatible hardware. I've been using it since it's been out, and I can't stand going back to an XP machine. There's not one or two huge features that I miss, but there's a ton of little stuff missing that makes XP feel cumbersome.

The funny thing, I remember when XP was "the worst Windows OS ever", and everyone made a HUGE deal out of having to upgrade their Pentium II, 64MB RAM machines. It's just how it goes when something new comes out, brings along a lot of bad press, bad blood, and Linux-zealots.

darkerosxx

You'll see those same people drool over a game that causes them to buy a whole new computer, yet still slam an OS that wants them to upgrade RAM.

Slowhand

darkerosxx wrote:

You'll see those same people drool over a game that causes them to buy a whole new computer, yet still slam an OS that wants them to upgrade RAM.

Now, now. I can sympathize. I'll spend $50 on a good cigar, $100 on a good bottle of whiskey, and $2,000 on the call-girl of a lifetime, but I still complain and moan when I have to spend more than $2 on something like toilet-paper or toothpaste. It's just not the same, spending money on the things you need.

HeroPsycho

Slowhand wrote:

darkerosxx wrote:

You'll see those same people drool over a game that causes them to buy a whole new computer, yet still slam an OS that wants them to upgrade RAM.

Now, now. I can sympathize. I'll spend $50 on a good cigar, $100 on a good bottle of whiskey, and $2,000 on the call-girl of a lifetime, but I still complain and moan when I have to spend more than $2 on something like toilet-paper or toothpaste. It's just not the same, spending money on the things you need.

Yes, but you don't need Vista, either.

That's what kills me. People expect they can upgrade their OS running on 3 year old hardware with no upgrades. WRONG!

And to be honest, even on 3 year old hardware, if it were the right hardware, Vista runs fine. My MCE machine downstairs is running an Athlon 64 3700, and it runs great. I had a little stutter in the MCE menuing, so I popped in an extra gig of RAM to go to 2GB, and it's running like a champ. The only other thing I upgraded was my video card because I'm doing QAM HDTV, so I needed something with HDAssist. Popped in a cheap 8600GT, and the HD stuff runs fine. I can watch/record 2 standard channels and 2 HD channels at the same time, and no problems.

dynamik

HeroPsycho wrote:

Slowhand wrote:

darkerosxx wrote:

You'll see those same people drool over a game that causes them to buy a whole new computer, yet still slam an OS that wants them to upgrade RAM.

Now, now. I can sympathize. I'll spend $50 on a good cigar, $100 on a good bottle of whiskey, and $2,000 on the call-girl of a lifetime, but I still complain and moan when I have to spend more than $2 on something like toilet-paper or toothpaste. It's just not the same, spending money on the things you need.

Yes, but you don't need Vista, either.

What are you talking about? It seems like he listed off only the essentials...

royal

Most people hated XP when it came out because it was a resource hog and 2000 was solid and people stayed on 2000. It's a simple point, people like to whine and **** when it comes to change because people are scared of change.

Seriously though, it's the same crap over and over. Take for instance Diablo 3 which is coming out. People are bitching due to the graphics. People bitched with Diablo 2 came out because the graphics were too colorful over Diablo 1. But Diablo 2 ended up becoming one of the best games in history.

So again, Vista is not a bad OS. I've had no problems with it with computers that have the hardware. It's been fast, been stable for me on different systems, and it includes several features. When you're deploying it, you can use the deployment tools to remove the stuff you don't need.

Granted I understand that it's difficult to make the decision to go to Vista due to needing to upgrade hardware, end user training due to the new interface, etc... But generally, from a user perspective, the user gets to the same file the same way. Start > documents, or document icon on desktop, start > programs, or go to mapped drive in my computer and double click their file, etc...

And don't take this post as I'm talking badly about the people who want to stay away from Vista. As I said, people don't like change (I didn't say people excluding me). I know there's a fair share of things I've not wanted to change and have bitched about. Just saying.

tiersten

The main issues with Vista were because most of the initial drivers were to be blunt crap. Now that Vista has been out for a while its much better now. I did an install of Vista when it first came out and had to totally wipe it clean and start again when SP1 was released. Now that I've got a clean install of Vista SP1 its been much better.

I don't see how people could have possibly said XP was the worst OS ever when the previous home edition was Windows ME...

RussS

HeroPsycho wrote:

RussS wrote:

Sorry HeroPsycho, but Vista is the latest incarnation of Muppet Edition .... a lot opf crap. Absolutely nothing will change my mind on that and we are advising our clients to stick to XP and wait until the next OS comes out.

If nothing will change your mind, then there can't be a rational discussion about it.

There can always be rational discussion - to dismiss that outright is irrational. However, Vista is an OS that just does not work for me - nor does it work for many of my clients.
When I get people bringing brand new laptops and workstations to me asking that I back-port them to XP I know there are issues. Yes SP1 cured many issues, but there are so many others that I do not believe will ever be resolved until the new OS comes out.
Just like I am not ragging on Fedora for this issue, I don't blame MS for Vista. Now we could discuss and/or argue endlessly on the need for a new OS, but at the end of the day the need is the generation of $$$$$$$$.

According to many developers I have spoken with they believe that there is a strong argument for 3 different OS from MS - Server OS, Business OS & Home OS. They have started down that path, but at this point in time the business OS should have remained XP based. That Vista is a recalcitrant OS is probably based on the inability of many software companies to actually write software that works in a certain memory space. If software runs in its own space then a lot of the features built in to Vista would either not be necessary or would not cause both the software and OS to react in such a sluggish manner.
To be frank, the reason there have been so many secruity holes in Microsoft operating systems is more to do with the arrogance of the large software companines and not the percieved weaknesses in MS programmers - I do however take exception to the Office team doing exactly the same thing and ingoring the basics of good programming


Just to make a further link to Muppet Edition - it is my understanding that the bulk of the team that developed ME were on the Vista team .... 'nuff said



Now, back on topic ..... there will always be security loopholes in software and operating systems - it is the nature of the beast. While many Mac and *nix people like to pontificate at how secure their OS is I would put forth the argument that the reason they appear to be so secure is that because they are not as widespread as MS operating systems it makes the results vs effort a bad equation for the script kiddies.

HeroPsycho

Agreed with your last point.

Many users bringing laptops back with a newly designed OS that is a major revision different from XP and wanting a downgrade doesn't sound like Vista is necessarily bad. It sounds like a craptastic rollout of Vista. If there were problems with apps, why weren't apps tested before rollout? Was an honest effort of testing how to properly run those apps ever conducted? Some may need compatibility mode options set, others may need to run as admin set, while others may simply need a patch from the app vendor, and none of those mean Vista is a bad OS. If Vista was "sluggish", were the machines spec'ed appropriately? And if they were sluggish, and nothing weird was installed on the machine, surely this would have been caught in testing before Vista was widely deployed. Was there any kind of even light training to show users the differences between the OS's to alleviate concerns and help with common difficulties that are associated with just adjusting to a different OS?

Vista is not ME. Vista is more like 2000 in that it is a major revision grade above XP. Migration and deployment problems should be compared to when businesses migrated from 9x to 2000 or XP, not from a change from 2000 to XP. When compared in that light, migrations and deployments have been far easier and less painful in my experience.

RussS

HeroPsycho - these were the latest hi-end laptops and workstations from several major manufacturers. Vista may be OK for home use, but it is not suitable for many of the commercial business applications out in the real world.

If there were problems with apps, why weren't apps tested before rollout? Was an honest effort of testing how to properly run those apps ever conducted?

The applications were there and working perfectly before Vista was rolled out. Nothing wrong at all with the applications - just how they run on Vista.

Was there any kind of even light training to show users the differences between the OS's to alleviate concerns and help with common difficulties that are associated with just adjusting to a different OS?

When a client replaces a stolen or failed unit they do not want to be retrained - they just want to be able to continue doing their business.

And if they were sluggish, and nothing weird was installed on the machine, surely this would have been caught in testing before Vista was widely deployed.

I agree - MS should have caught on that Vista was sluggish before they rolled it out.

Vista is not ME.

Well, considering the new OS is a MAJOR release I would have to say that Vista IS ME - rushed out into the market place and full of flaws.

Vista is more like 2000 in that it is a major revision grade above XP

Ahhh, downgrade would be a more appropriate description


HeroPsycho - the thing you have to realise is that a majority of users do not WANT to have all the features in Vista ... they just want a solid and secure system that operates on a mid spec machine.
Techies **** and moan about all sorts of stuff and demand all sorts of features in an OS, but the majority of end users could not care less about those features. Christ, I have users out there that would be more than happy to stay with Win2000 - all they want is a platform to run their accounting software. They have nothing more than a plain desktop background and have no need for flash multi-media features because they have no speakers and don't want them.

Remember - when supporting businesses it should not be about what we want to give them, but about what they want and need.

HeroPsycho

I've deployed Vista on machines at my house, and at clients. It's worked perfectly fine for both. You're assuming apparently I have no experience with it "in the real world". It's worked absolutely great "in the real world". If it hasn't worked for you, maybe there's a perfectly good explanation why that doesn't involve the "Vista is the next ME" stuff. There are people remarking in this very thread who also have had few or no issues, and Vista has been perfectly fine. I beg you to explain how Vista could be the pile of crap you're saying it is, yet there are numerous people who have had good experiences with it. The answer is obvious: it's not a piece of crap.

Funny, Vista has been more reliable than XP has been for me, and most people I know who are using it. I've been able to correct problems that weren't the fault of Vista, such as Itunes spontaneously corrupting Itunes library files for no reason. Happened with XP, and it happened with Vista. The difference is I recovered a shadow copy of the library file with Vista, and I was off to the races. With XP, I'd have to restore the last backup, and lose some of my library info since the last backup.

Is that the kind of reliability you think users and businesses can benefit from? I sure do.

They want a secure OS you say, and it's now coming to light Vista is actually more secure than XP in the real world, significantly in fact, so long as you don't do the stupid things people have done, like turn off UAC. Isn't that something home and corporate users can benefit from?

Isn't that something people who just run accounting software could benefit from?

I know what you're saying: if they don't want to buy a new machine, then no, Vista shouldn't be purchases for old hardware. That doesn't however make it a bad OS. If it did, any OS with a GUI would be a bad OS. Remember, you could run DOS on a 286, so DOS must be 1000x better than any version of Windows, right? Wrong! And I heard your exact argument here before - it was the argument against Windows 95 to stick with Windows 3.11, and to stick with Win98 over Win2K, and to stick with Win2K over WinXP. Each and every time, those OS's were advancements over the previous OS's.

Compare that to WinME and Win98 - there wasn't a single significant advancement WinME had over 98. Not one. The best claim to fame ME had was System Restore, which in it's first iteration, didn't even work. Vista has numerous features XP simply does not have, many of which could be useful for all users. Shadow copies, UAC for better security (have the average user run XP as a non-admin and use admin only when necessary, and compare that to Vista with UAC, and THEN the user will agree Vista is far easier to use, and far more secure to boot, which they benefit from), the revamped start button with searching capability to find your programs, protected mode for IE which provides a far more secure web browsing experience compared to IE on XP. Every single one of those features is a significant improvement over XP, and every single one is a feature a majority of users benefit from. Vista is also a major revision change compared to XP, NOT a minor release difference like WinME was to Win98. Sorry, it's not Windows ME 2, "muppet edition", whatever else you'd like to call it.

Vista runs perfectly fine on a mid spec'ed machine of today, and last year, and higher end machines of the year before. I repeat, I run Vista doing media encoding tasks on an Athlon 64 3700, with 2GB of DDR1 RAM. It is stressed far more than the average user's load, and it's running on several year old hardware. An Athlon 64 3700 is a single core processor of 3-4 years ago. Runs perfectly fine, even when recording 2x HD shows and 2x analog shows concurrently. I ran XP MCE on it with 1GB of RAM, but I wasn't doing HD content on it then, so jumping to 2GB is justified just because of that, irrespective of the OS change. And even if it was due to the OS, so what? XP came out 6 years ago! Need I remind you that Windows 2000 ran okay with 128M of RAM, but you really needed 256M of RAM for XP for general usage. It then went to 512M and later 1GB as we piled service packs and more advanced apps on. How is Vista out of line here?

I'm sorry, but it's called progress.

Anyway, I'm done ranting. I don't doubt Vista didn't work for you on some of your deployments, but that doesn't make the OS a bad one.

AlanJames

Vista is better now, i personally couldn't switch back to XP.

RussS

Christ HeroPsycho, you don't work for Microsoft do you?


The fact of the matter is that most of the world doesn't need Vista. You can go on about how well it runs, but quite frankly according to my research the majority disagrees. Recently I was told by the local MS guy about how Vista had a bad name and that was from people who either had not tried it or had not applied the appropriate service packs. We invited him back to our base and showed him several issues - a couple that involved Microsoft Office on brand new name-brand units.


Vista is there for 1 reason alone - and Microsoft even acknowledges that. A quote from the Pac region manager ... "Support companies should welcome Vista - for every dollar spent on the OS you should expect about $22.00 in support costs. That my friend is a load of crap - when I sell something to one of my clients I sell it to them with the expectation that once they recieve whatever it is I sell them that it will work as described with little or no further cost except for general maintenance.

scheistermeister

HeroPsycho wrote:

They want a secure OS you say, and it's now coming to light Vista is actually more secure than XP in the real world, significantly in fact, so long as you don't do the stupid things people have done, like turn off UAC. Isn't that something home and corporate users can benefit from?

http://searchsecurity.techtarget.com/news/article/0,289142,sid14_gci1324395,00.html#

HeroPsycho

RussS wrote:

Christ HeroPsycho, you don't work for Microsoft do you?


The fact of the matter is that most of the world doesn't need Vista. You can go on about how well it runs, but quite frankly according to my research the majority disagrees. Recently I was told by the local MS guy about how Vista had a bad name and that was from people who either had not tried it or had not applied the appropriate service packs. We invited him back to our base and showed him several issues - a couple that involved Microsoft Office on brand new name-brand units.


Vista is there for 1 reason alone - and Microsoft even acknowledges that. A quote from the Pac region manager ... "Support companies should welcome Vista - for every dollar spent on the OS you should expect about $22.00 in support costs. That my friend is a load of crap - when I sell something to one of my clients I sell it to them with the expectation that once they recieve whatever it is I sell them that it will work as described with little or no further cost except for general maintenance.

You have several other people in this very thread who also think Vista is a good OS. We apparently all work for Microsoft? And good job on personally attacking instead of rationally debating.

Dude, I run Microsoft Office. I ran 2003 and 2007 on Vista. I've seen some issues with Front Page 2003 that were corrected by SP3 for Office, and that's it. Even if it doesn't work for you, which I can fully appreciate, it doesn't mean the OS is bad. If it were, there wouldn't be so many people who have had good results.

The majority of people think there are problems with Vista, but the majority of people aren't running it. I'm running it, my wife is running it, my older brother, father, nephew, father-in-law, co-workers, all running it perfectly fine with few if any issues. Every single one of them think Vista is better than XP. The non-techies in my family all had the exact same reaction to Vista - "it took a little getting used to, but I don't know what everyone is complaining about!" The people I've encountered who have had problems experienced bad drivers, or incompatible software, etc. One person I ran into complained bitterly that his Cisco VPN client didn't work, Vista sucks, blah blah. Got him the Cisco client updated for Vista, and presto, he was happy.

That's not a Vista problem. It's adjusting to a new OS.

As for support costs, dude, Microsoft is a software company. That's how they make money. How do you think linux companies make money? Support costs. In fact, it's support costs more so than Microsoft. Seriously, wtf. Of course they want to sell software and increase revenue. However, you're almost suggesting that the reputation Microsoft has about Vista is true, and that must be to drive up revenue in support costs. Microsoft "screwed up" Vista on purpose. You actually think Microsoft wants this reputation for Vista? Why do you think they did the "Mojave Experiment"?

The above article concerning the address randomization, I completely agree that security in Vista isn't full proof, but compare that to XP. XP had no memory address randomization whatsoever, so it wasn't esoteric in it's vulnerabilities for exe's to be replaced in memory. XP consistently loaded numerous exe's into the same address spaces, where as Vista's randomization does a better, although not perfect, job. The key thing is still to say "compared to XP, Vista actually has memory address memorization, so Vista is still more secure".

I won't trumpet ASLR as a huge security advantage of Vista over XP. It's better, but not nearly as significant as UAC. UAC actually makes running as a non-admin routinely convenient enough that people can actually do it and not get frustrated. I know people complain about the constant prompting, but those are also the people who ran XP as a full admin. Again, compare running XP running with a non-admin to Vista running with UAC on, and I'm sorry, but Vista is far easier and more convenient to use. And if you don't think running as a non-admin makes your box far more secure, you don't know jack about security. That is a significant advantage. Like I said, it's coming to light UAC is in fact proving to be effective against malware. Ditto Protected Mode for IE if you're an IE user.

RussS

Oh, my clients can do all that HeroPsycho - the thing is ... they want to get their work done and not be constantly double/triple/quad clicking .... or waiting for something to happen.


BTW dude - My asking if you work for MS was not a personal attack - just a question, as you appear very evangelic about Vista and I have only found that in MS staff to date


scheistermeister - exactly man.

royal

RussS wrote:

scheistermeister - exactly man.

Exactly what? Something got exploited. XP got exploited a lot. That technology in Vista still makes progress towards additional security. It's not like the whole world knows how to exploit that. :P

Anyways, I think XP and Vista are both great OS'. Let's not forget that XP didn't really become that secure until SP2. Heck, Messenger service was on and constantly caused people to get net send message spam prompts on a consistent basis. XP got flamed back then too.

It's the same **** over and over and over. And because of that, I consider this thread a 5/5 on my ridiculousmeter.

And just to add my last point, if we're comparing XP to Vista when both were at their same service pack level, MS did a better job with Vista. It's just that XP became so solid with SP2 that many people have a hard time justify moving away from it. But Vista has been really solid for me on the systems I have ran it on. It's when it first came out with all the driver issues and applications needing to support it when it got a bad name. But again, this also happened with XP when it came out. Vista's x64 support was also much better than XP's.

HeroPsycho

RussS wrote:

Oh, my clients can do all that HeroPsycho - the thing is ... they want to get their work done and not be constantly double/triple/quad clicking .... or waiting for something to happen.


BTW dude - My asking if you work for MS was not a personal attack - just a question, as you appear very evangelic about Vista and I have only found that in MS staff to date


scheistermeister - exactly man.

Riiiiight, you asking that was an innocent question...

And UAC doesn't prompt when you start Word. It doesn't require triple/quad clicking either.

You're wholeheartedly agreeing with an article, as if it's an indictment of Vista security. Nowhere in that article does it say XP is any better. Without ASLR, it's even more susceptible to the same attacks. Dispute that fact right now, please, I beg you.

Dude, this debate is over. You're not going to respond with anything concrete, just broad generalizations that are ill-informed and unsubstantiated.