RE: [Full-Disclosure] Re: January 15 is Personal Firewall Day, he lp the cause

From: Wes Noonan (mailinglists_at_wjnconsulting.com)
Date: 01/16/04

  • Next message: Schmehl, Paul L: "RE: [Full-Disclosure] Flawed arguments (Was all that other crap about PFW day)" 
    To: <vb@dontpanic.ulm.ccc.de>, <bugtraq@securityfocus.com>, <full-disclosure@lists.netsys.com>
Date: Fri, 16 Jan 2004 11:32:08 -0600

    > With these quick steps, a solution without any costs but network
    > access, Windows can be much more secure.

    Did you really just propose that a viable solution is to remove network
    access? Basically turn off everything that allows corporate uses to share
    information and collaborate and you have security panacea. Granted, you
    can't do a damned thing, but let's not forget that technology doesn't exist
    to facilitate companies in making a profit and sharing of information, it
    exists for some other geek reason.

    This is in addition to "well, if you don't run popular software you aren't
    as susceptible to threats". Yeah, back in 94 if you ran NT you weren't as
    susceptible to all the Novell threats... then NT became the big player and
    now you have folks saying "yeah, well run Linux and you won't be susceptible
    to all those Windows threats". And if Linux ever goes mainstream and if
    Linux ever surpasses Windows in market share, then 5-10 years down the road
    people will be saying "yeah, but if you run ziggledorf, then you won't be
    susceptible to all those Linux threats".

    This security through obscurity mantra is laughable.

    The top dogs always get the most exploits. Accept the reality. When everyone
    else starts using Firebird, Thunderbird or whatever other obscure program
    you want to mention as your own personal bestest solution, then it will get
    hacked and exploited beyond belief. History proves this.

    Disconnecting from the network or disabling all those services that provide
    network access is an unrealistic expectation. Next thing you know, you will
    be proposing only using carbon paper to share documents (though surely
    someone on this list will then point out the inherent security flaws in what
    to do with the used carbons).

    And people wonder why users don't understand, but certainly fear, a good
    chunk of computer security...

    Wes Noonan
    mailinglists@wjnconsulting.com
    http://www.wjnconsulting.com

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Schmehl, Paul L: "RE: [Full-Disclosure] Flawed arguments (Was all that other crap about PFW day)"

    Relevant Pages