RE: [Full-Disclosure] SSH Exploit Request

From: Schmehl, Paul L (
Date: 11/13/03

  • Next message: Shawn McMahon: "Re: [Full-Disclosure] PGP signed mail? Has to be spam!"
    To: <>
    Date: Thu, 13 Nov 2003 13:17:34 -0600

    > -----Original Message-----
    > From:
    > [] On Behalf Of
    > Robert Davies
    > Sent: Thursday, November 13, 2003 11:09 AM
    > To:
    > Subject: RE: [Full-Disclosure] SSH Exploit Request
    > I am failing to see the logic in some of these issues here...
    > A service is flawed in one way or another, patch it! If the
    > vendor says the service is broke in some way, believe them,
    > get off your lazy ass and get patching. If you are the admin,
    > do your job and quit whining!
    Never heard the phrase, "Never criticize a man until you've walked a
    mile in his shoes", Robert?

    > Since that argument throws about the sniveling of, "We can't
    > afford the downtime of a server reboot", then think of it
    > this way, with services such as SSH, a restart of the SSH
    > Service does NOT shut down the whole server or kill active
    > connections, instead it's a 2 second lapse where the server
    > will refuse the connection, in which super important person Z
    > will just have to rety to connect.
    In some people's worlds, they don't get to make those decisions. Yet
    you would toss them out in the street for incompetence because you are
    so much more competent?
    > I am quite bothered out the ass by well paid admins that are
    > too damn lazy to spend the few minutes it takes to repair a
    > flawed service. Either start doing your job, or get the hell
    > out of the way for those of us that want to do the job
    > required properly!
    I'm equally bothered by people who think they have all the answers and
    anyone who doesn't think they way they do is incompetent.

    So, now we're both equally bothered, and yet we haven't accomplished a
    thing. Frustrating, isn't it, Robert?

    Maybe we should concentrate on our own problems and let other people
    solve theirs?

    Paul Schmehl (
    Adjunct Information Security Officer
    The University of Texas at Dallas
    AVIEN Founding Member

    Full-Disclosure - We believe in it.

  • Next message: Shawn McMahon: "Re: [Full-Disclosure] PGP signed mail? Has to be spam!"

    Relevant Pages

    • Re: "bug.cgi" images dont show.
      ... Thanks again Robert, if nothing else I'm learning alot with this problem. ... Using System Restore checkpoints I was able to isolate the failure to the ... > Then I don't know if it it occurs in the source that the host server sent. ... > the bad guys figured out a way to use a different HOSTS file ...
    • Re: Errors In Security Log
      ... "Robert" schreef in bericht ... > I chose broadband. ... I just noticed that my server is not syncing ... > tab for syncing time on the Date and Time Properties dialog. ...
    • Re: File transfer
      ... Problem is Robert ... ... maybe my search phrases are not up to par but I did ... transmit files to a server. ... But I would like to know the best way to transmit files as they are ...
    • Re: kein Senden möglich?
      ... "Robert Maier" schrieb im Newsbeitrag ... Sende ich jedoch von dem im Geschäft auf einen ... Ich bin hinter einer Firewall und habe den Server ...
    • Re: OOP/OOD Philosophy
      ... >Robert C. Martin wrote: ... >it happens on the DB server, then it does not have to send all the ... "The aim of science is not to open the door to infinite wisdom, ...