241–250 of 304 posts
Earlier quoted context omitted.
The NSA hoarding / leaking aspect of this vulnerability has been reported by most major news outlets. Even the mainstream ones. Albeit most haven't expanded on that point to the level that Microsoft did here.
Sorry I misread it as the NSA was developing the holes as in backdoors, intentionally creating the vulnerability.
Earlier quoted context omitted.
Free software is defined by the FSFs list of freedoms and MIT licence certainly provides those freedoms.
Fair enough, I got hung up on the lack of guarantees to distribute code alongside compiled applications. Would you say compiled MIT programs are still "free software" when they don't come with the source code?
The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…
I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get h…
The quote bombshell here, and what hasnt yet gotten much attention since sysadmins the world over are busy dealing with fallout, is that the NSA and therefore the US government is directly responsible for the current global cyber-carnage. We developed the capability, we chose to keep it unpatched, we tried to keep it secret, we lost control of it. This has similarities in type, if not in horror, to the development an…
I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get h…
Microsoft has done NOTHING to show that things have changed since they colluded with the NSA on PRISM (https://www.theguardian.com/world/2013/jul/11/microsoft-nsa-...), and so anyone who believes that things have changed is a moron.
Remember, head executives at Microsoft are essentially part of the "shadow government" as they were privy to 1984-style surveillance that even much of congress was unaware of until the Snowden leaks. People at MS knew and said nothing. Executives at MS are closer to the NSA than most of congress. Let that sink in.
One scary thing about these security holes is that it's almost impossible to check if your system is affected. There are at least 50 different releases of Windows 10 alone, and it's hard enough to find which is actually used. The "System" dialog Shows "Windows 10 2015 LTSB". "Winver" on the command line shows "Windows 10 2015 LTSB build 10240" - but there are several releases of that and only the latest ones, e.g. fr…
https://support.microsoft.com/en-us/help/4013429/windows-10-...
EDIT: Or KB4012606 / KB4013198 for older Windows builds.
Earlier quoted context omitted.
I agree completely. People can blame MS for their insecure OS, or users who don't know any better for running outdated systems (or even for running Windows at all), but the stark reality is that all OSes have vulnerabilities because they are huge and complex and it is impossible to make them 100% secure. But the NSA are - by definition - supposed to be security experts, so what are they doing letting themselves get h…
A bit rich from Microsoft to talk about hoarding when the patches they released over the weekend were all signed back in February... i.e. they are hoarding fixes to their own shit for their $$$ extended support agreements.
Earlier quoted context omitted.
Install Debian with testing repositories and unattended upgrades and you're done for good. Or just stick to CentOS and with their 11 years support period.
XP was supported for 12 years. It's now over 15 years since it was released.
For cost, CentOS, on it's own, is free. Support costs you of course, but the updates are coming down from RedHat for which there is enough money flowing in already, so support in this case means a sysadmin who understands CentOS and those are not that rare, not even that expensive.
Backwards compability is another topic, especially with the rise of systemd.
If the corresponding software is not included in any official or semi-official repositories (EPEL, for example), but is distributed with source, you may need someone to recompile it every 11 years, when you change mayor versions. I think this is reasonable to expect, though there might be issues for certain, especially if it involves Gnome3.
For those that are distributed without source code - well, that is the same problem as with XP, but usually it's possible to strace why it fails and fix/replace/dosomemagic with the underlying libraries it's depending on.
When this is not possible you can still create a container image with the old code to run it with.
With all the power out there even in the office workstations we could:
- install a base, damn stupid linux as hypervisor
- run windows in virtualbox with shared folders
- use btrfs for the shared folders and keep daily snapshots for a few weeks
If you get a virus, drop the image, get a new one, restore the snapshot, done.
If anyone is already using something like this, please tell, I'm curious.
[0] http://info.rippleshot.com/blog/windows-xp-still-running-95-...