[OT] Linus confirms that the NSA has asked him to put a backdoor in Linux

Post by Aragorn
At a recent LinuxCon conference, Linus Torvalds was asked whether any
government (and in particular the NSA) had asked him to put a backdoor
into the kernel. He replied "No", while nodding "yes", causing the
audience to burst into laughter.
http://tinyurl.com/mrescrm
Of course, certain trolls - I already have a good idea whom they will be
- will now take the above fact as ammunition for creating the FUD that
there would indeed be an NSA backdoor in Linux, which is *not* what the
article says.
Well, the source code of Linux is readily available for everyone to
scrutinize over at http://www.kernel.org, so I'm inviting the trolls to
look at the source code and find any such backdoor. I'll even make it
easy on them: they don't even have to peruse the hardware platform-
specific code, nor in any hardware driver modules, because if there were
a backdoor in Linux, then it would be inserted in that part of code
which is germane to all architectures, and thus it would have to be in
the core kernel code itself.
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Just a couple of questions.
How many lines of kernel source code?
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?
Exactly who determined that it had to be in the kernel?

Must be nice to live in a world where narrow-minded thinking
and failure to look at the big picture was comforting.

Not everything is confined to that tidy little GNU box you inhabit.

I'd probably agree with your conclusion, but strenuously object
to any claims that you got there logically based on what you wrote.

If you were an evil organization, would you communicate using windows?
Linux? or any other mainstream current system?
I sure wouldn't.

Bit Twister

2013-09-19 10:54:58 UTC

Post by mike
Just a couple of questions.
How many lines of kernel source code?

I can not find the article I read about 2 days ago to see if it was
15 million lines of code or was it 17 million. What caught my eye was
the headline about Micro$oft contribution, or more importantly the
lack of it this past year or so.

But huge amount of code is not going to be a good argument.

Post by mike
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?

Obscuring is going to be the real challenge.

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

Post by mike
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?

Now we can get down to a bit more realistic arguments.

There is no need to "examine it all". All that has to be examined is
new code and any changed code. Any decent source configuration
management software will spit out those changes.

You can bet China, Russia, and other nations are looking through the
code, not to mention criminals wanting the same thing. Micro$oft would
not hesitate a minute to show their customers and the world that open
source code is not as secure as theirs.

I really wish I could find that article. A tremendous amount of
changes was accomplished with very few defects. You do not get that
quality of code by just one person coding and releasing it. More than
a few people are looking at it.

I have been in a few code reviews, of my code and others. Does not take
long for any experienced coder to spot funny code.

It is like reading any document. Anything you see which does not make
sense just jumps out at you. Code checking tools have improved which
helps spot the usual exploitable holes.

Weak spots like stack manipulation tend to get closer checks than
normal code.

Then there is the actual design. Think of the code of the kernel like
the rings of a tree. The inside rings have higher risk of causing
damage because it has unfettered access.

You look at that code a whole lot harder than you would look at code
which runs in the next levels of the rings. Next level/ring code has
to jump through hoops to get unfettered access in previous ring(s).
That code will stand out pretty quick to anyone with experience with
that ring interface.

On the flip side, when I saw something about a secure linux being
released by some 3 letter government organization, my first thought
was SURE, RIGHT, Not on my system.

William Poaster

2013-09-19 11:25:30 UTC

Post by mike
Just a couple of questions.
How many lines of kernel source code?

And M$'s "contribution" was maintainance to the kernel drivers for its
Hyper-V virtualization hypervisor, which consist of tens of thousands of
lines of code. Outside of that, M$ was never a particularly significant
contributor to the kernel.
Furthermore M$ didn't do this by choice, they *had* to submit their code
because it contained open source GPL components.

Post by Bit Twister
But huge amount of code is not going to be a good argument.

Post by mike
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?

Obscuring is going to be the real challenge.

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

Post by mike
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?

Now we can get down to a bit more realistic arguments.
There is no need to "examine it all". All that has to be examined is
new code and any changed code. Any decent source configuration
management software will spit out those changes.
You can bet China, Russia, and other nations are looking through the
code, not to mention criminals wanting the same thing. Micro$oft would
not hesitate a minute to show their customers and the world that open
source code is not as secure as theirs.
I really wish I could find that article. A tremendous amount of
changes was accomplished with very few defects. You do not get that
quality of code by just one person coding and releasing it. More than
a few people are looking at it.
I have been in a few code reviews, of my code and others. Does not take
long for any experienced coder to spot funny code.
It is like reading any document. Anything you see which does not make
sense just jumps out at you. Code checking tools have improved which
helps spot the usual exploitable holes.
Weak spots like stack manipulation tend to get closer checks than
normal code.
Then there is the actual design. Think of the code of the kernel like
the rings of a tree. The inside rings have higher risk of causing
damage because it has unfettered access.
You look at that code a whole lot harder than you would look at code
which runs in the next levels of the rings. Next level/ring code has
to jump through hoops to get unfettered access in previous ring(s).
That code will stand out pretty quick to anyone with experience with
that ring interface.
On the flip side, when I saw something about a secure linux being
released by some 3 letter government organization, my first thought
was SURE, RIGHT, Not on my system.

--
Linux -- the Ultimate Windows Service Pack

Linux is the scientific community’s operating system of choice.
CERN’s Large Hadron Collider is controlled by Linux.
NASA and SpaceX ground stations use Linux.
DNA-sequencing lab technicians use Linux.
Really, for applications that require absolute stability,
which most scientific experiments are, Linux is the obvious choice.
http://tinyurl.com/d9ta82o

Cybe R. Wizard

2013-09-19 17:46:09 UTC

On Thu, 19 Sep 2013 12:25:30 +0100

Post by William Poaster
M$'s "contribution" was maintainance to the kernel drivers for its
Hyper-V virtualization hypervisor, which consist of tens of thousands
of lines of code. Outside of that, M$ was never a particularly
significant contributor to the kernel.
Furthermore M$ didn't do this by choice, they *had* to submit their
code because it contained open source GPL components.

I don't know for sure but would imagine that the MS code was very
thoroughly vetted before being added, too.

Cybe R. Wizard

--
Nice computers don't go down.
Larry Niven, Steven Barnes
"The Barsoom Project"

William Poaster

2013-09-19 22:09:57 UTC

Post by Cybe R. Wizard
On Thu, 19 Sep 2013 12:25:30 +0100

I don't know for sure but would imagine that the MS code was very
thoroughly vetted before being added, too.

It was. And M$ were made to remove any of their proprietary code before
their contribution was added to the kernel.

Post by Cybe R. Wizard
Cybe R. Wizard

--
XPN :: http://xpn.altervista.org

Linux is the scientific community’s operating system of choice.
CERN’s Large Hadron Collider is controlled by Linux.
NASA and SpaceX ground stations use Linux.
DNA-sequencing lab technicians use Linux.
Really, for applications that require absolute stability,
which most scientific experiments are, Linux is the obvious choice.
http://tinyurl.com/d9ta82o

Chris Ahlstrom

2013-09-20 10:23:17 UTC

Post by William Poaster

Post by Cybe R. Wizard
On Thu, 19 Sep 2013 12:25:30 +0100

I don't know for sure but would imagine that the MS code was very
thoroughly vetted before being added, too.

It was. And M$ were made to remove any of their proprietary code before
their contribution was added to the kernel.

Wasn't Microsoft told to rewrite it as well? Which led to the "high number
of commits" that pro-Microsoft pundits were touting awhile back.

--
Yow! Am I having fun yet?

William Poaster

2013-09-20 10:43:46 UTC

Post by Chris Ahlstrom

Post by William Poaster

Post by Cybe R. Wizard
On Thu, 19 Sep 2013 12:25:30 +0100

I don't know for sure but would imagine that the MS code was very
thoroughly vetted before being added, too.

It was. And M$ were made to remove any of their proprietary code before
their contribution was added to the kernel.

Wasn't Microsoft told to rewrite it as well? Which led to the "high number
of commits" that pro-Microsoft pundits were touting awhile back.

I believe they were, yes.
--
A)bort R)etry I)nfluence with large hammer?

Linux is the scientific community’s operating system of choice.
CERN’s Large Hadron Collider is controlled by Linux.
NASA and SpaceX ground stations use Linux.
DNA-sequencing lab technicians use Linux.
Really, for applications that require absolute stability,
which most scientific experiments are, Linux is the obvious choice.
http://tinyurl.com/d9ta82o

Aragorn

2013-09-19 12:45:26 UTC

On Thursday 19 September 2013 12:54, Bit Twister conveyed the following
to alt.os.linux.ubuntu...

Post by mike
Just a couple of questions.
How many lines of kernel source code?

I can not find the article I read about 2 days ago to see if it was
15 million lines of code or was it 17 million.

It was already 16 million last year, so it'll probably be around 17
million this year. But that amount covers the entire kernel as a
project, not the kernel as it will be installed on your system.

There is the kernel itself. There is the virtual filesystem layer.
There are the filesystem drivers. There is the architecture-specific
code - and Linux supports just about every processor architecture on the
planet. There is the hardware device driver code. Not everyone has all
hardware devices in existence in their computer, and some hardware
architectures do not even support certain hardware peripherals. Then
there are also the optional "hardening" patches like AppArmor and
SELinux.

Yes, SELinux is developed by the NSA - so that GNU/Linux would become
suitable for use on government/military computers - but that code is
audited, and all it does is add checkpoints for mandatory access
control.

Like I said, if a backdoor were to be planted in the Linux kernel, then
it would have to be in the platform-independent core kernel code. And
that part is strictly under control of a number of people, not in the
very least Linus himself.

Post by Bit Twister
What caught my eye was the headline about Micro$oft contribution, or
more importantly the lack of it this past year or so.

Microsoft's only contributions to Linux were with regard to having
support for running Linux inside a virtual machine on top of Microsoft's
Hyper-V hypervisor, and possibly with regard to Samba, although I don't
think they've been submitting code for that.

They are probably still contributing code, but far less so, and so their
code contributions were far smaller this year, and so they are no longer
in the top-10 list of code contributors for the past year.

In the past, Microsoft submitted code which was buggy and which they
weren't maintaining, and Linus threatened to kick their code out of the
kernel if they weren't going to submit patches to fix their bugs. After
all, there is no point in having buggy and unmaintained code in the
kernel. Linus won't stand for that.

Post by mike
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?

Obscuring is going to be the real challenge.

Especially since the code submissions for SELinux aren't all that big,
and are being audited, like every code submission from a third party.

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

There are literally thousands of people working on Linux, and by that I
do mean the kernel, because that's what Linux is. The rest of the code
comes from GNU, and a few userland submissions which are important in
early userspace - i.e. udev, systemd - from RedHat. And the number of
GNU developers runs up into the hundreds of thousands. But that's
userspace, and userspace can't exploit anything if the kernel doesn't
have the hooks for that in the form of a serious backdoor or a serious
security leak.

Post by mike
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?

The GIT development system - which was itself also written by Linus
Torvalds as a FLOSS replacement for BitKeeper, which they used earlier -
does not allow tampering. All code submissions are logged, and all code
is checksummed before and after each code submission. If anyone were to
mess with the source code, it would show in the logs.

That is correct, and so far they haven't budged. And guess what:
Microsoft has its own Linux Lab [sic]. Daniel Robbins, the founder of
the Gentoo distribution, left his position as leader of the Gentoo
project behind to go and work there. I don't think he's still working
there now, but he has started a new distribution, Funtoo, based upon the
Gentoo unstable code, so it's more "bleeding edge" than Gentoo itself,
but it uses the same repositories and package management system.

Post by Bit Twister
I really wish I could find that article. A tremendous amount of
changes was accomplished with very few defects.

Probably on kernelnewbies.org.

Post by Bit Twister
You do not get that quality of code by just one person coding and
releasing it. More than a few people are looking at it.

Of course. And Linus is very pedantic too. If it doesn't meet his
standards, or even if he doesn't like the way the code was written, then
it won't go into the kernel.

Post by Bit Twister
I have been in a few code reviews, of my code and others. Does not
take long for any experienced coder to spot funny code.

That is correct. I've done coding too in my time - nothing fancy, not
in the C language, and certainly not any kernel stuff - but when I see
funny stuff, I'll notice it.

Post by Bit Twister
It is like reading any document. Anything you see which does not make
sense just jumps out at you. Code checking tools have improved which
helps spot the usual exploitable holes.

Correct.

Post by Bit Twister
Weak spots like stack manipulation tend to get closer checks than
normal code.

Linux even has a stack protector in the upstream kernel, and as far as I
know, gcc - which isn't part of Linux as a project because it comes from
GNU - now mainly uses position-independent code for most userland stuff.

Most 64-bit distributions are built that way now, and it /may/ also be
the default on 32-bit now. There was a time when there were objections
against that because position-independent code would slow down 32-bit
systems (but not 64-bit). Don't ask me why.

Post by Bit Twister
Then there is the actual design. Think of the code of the kernel like
the rings of a tree. The inside rings have higher risk of causing
damage because it has unfettered access.
You look at that code a whole lot harder than you would look at code
which runs in the next levels of the rings. Next level/ring code has
to jump through hoops to get unfettered access in previous ring(s).
That code will stand out pretty quick to anyone with experience with
that ring interface.

Like I said higher up already.

Post by Bit Twister
On the flip side, when I saw something about a secure linux being
released by some 3 letter government organization, my first thought
was SURE, RIGHT, Not on my system.

I've read about that too, and I think it was the NSA itself. The news
was published just around the same time that the shit hit the fan about
Microsoft and other organizations/companies - like VUPEN - selling zero
day exploits to the NSA.

--
= Aragorn =
GNU/Linux user #223157 - http://www.linuxcounter.net

Aragorn

2013-09-19 13:00:23 UTC

On Thursday 19 September 2013 14:45, Aragorn conveyed the following to
alt.os.linux.ubuntu...

Post by Aragorn
On Thursday 19 September 2013 12:54, Bit Twister conveyed the
following to alt.os.linux.ubuntu...

Post by mike
How much effort might an organization with as deep pockets as the
NSA put into obscuring their additions?

Obscuring is going to be the real challenge.

Especially since the code submissions for SELinux aren't all that big,
and are being audited, like every code submission from a third party.

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

There are literally thousands of people working on Linux, and by that
I do mean the kernel, because that's what Linux is. The rest of the
code comes from GNU, and a few userland submissions which are
important in early userspace - i.e. udev, systemd - from RedHat. And
the number of GNU developers runs up into the hundreds of thousands.
But that's userspace, and userspace can't exploit anything if the
kernel doesn't have the hooks for that in the form of a serious
backdoor or a serious security leak.

Also, the way the kernel is developed is like this:

1. A code submitter has to send the code pasted literally into a
plain text e-mail. E-mail attachments - even if they are plain
text files - are discarded.

2. Code submitted must be written a certain way.

3. Code submitted may have to be submitted more than once, because
Linus chose to ignore the submission for some reason.

4. Once the code is accepted, it is submitted to the GIT repository.
Only a selected number of people have direct access to that GIT
repository, because this requires a user account at kernel.org,
and those user accounts are not handed out lightly, and especially
not now, after kernel.org and linuxfoundation.org were both
compromised (by way of legitimate user accounts) in 2011, the year
that Linux turned 20 years old.

5. As stated already, the GIT system was designed to keep checksums
of all code and of all patches. There is no way anyone could
tamper with either it or the Linux source code without anybody
finding out.

--
= Aragorn =
GNU/Linux user #223157 - http://www.linuxcounter.net

Timothy Daniels

2013-09-20 17:06:17 UTC

[ . .. ]
5. As stated already, the GIT system was designed to keep checksums
of all code and of all patches. There is no way anyone could
tamper with either it or the Linux source code without anybody
finding out.

Could someone submit some innocent-looking source code that
was designed, perhaps with properly chosen whitespaces and constants,
to produce a given checksum? Perhaps all it would have to do is slow
part of the system down by a millisecond to take advantage of an
undiscovered race condition.

*TimDaniels*

Bit Twister

2013-09-19 13:20:35 UTC

Post by Aragorn
On Thursday 19 September 2013 12:54, Bit Twister conveyed the following

Post by Bit Twister
I can not find the article I read about 2 days ago to see if it was
15 million lines of code or was it 17 million.

It was already 16 million last year, so it'll probably be around 17
million this year. But that amount covers the entire kernel as a
project, not the kernel as it will be installed on your system.

I think the article I had read was about total changes (add/deletes).

For some real numbers there is
http://www.linuxfoundation.org/sites/main/files/publications/whowriteslinux.pdf

Jonathan N. Little

2013-09-19 14:32:58 UTC

Post by Aragorn
On Thursday 19 September 2013 12:54, Bit Twister conveyed the following

Post by Bit Twister
I can not find the article I read about 2 days ago to see if it was
15 million lines of code or was it 17 million.

It was already 16 million last year, so it'll probably be around 17
million this year. But that amount covers the entire kernel as a
project, not the kernel as it will be installed on your system.

I think the article I had read was about total changes (add/deletes).
For some real numbers there is
http://www.linuxfoundation.org/sites/main/files/publications/whowriteslinux.pdf

And if you apply a little common sense about human behavior and consider
who are these people involved in writing the kernel? Independent
thinking, altruistic, non-conforming individualists... What is the
likelihood to get them *all* to conform and maintain *absolute secrecy*
for a hidden backdoor?

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Cybe R. Wizard

2013-09-19 17:43:55 UTC

On Thu, 19 Sep 2013 10:54:58 +0000 (UTC)

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

More to the point is what software will do that vast job for us. I
think it's likely that it isn't such a big job for computer to compare
known-safe code to code-of-suspicion.

Heh, diff should do, no?

Cybe R. Wizard

--
Nice computers don't go down.
Larry Niven, Steven Barnes
"The Barsoom Project"

mike

2013-09-19 19:53:34 UTC

Post by Cybe R. Wizard
On Thu, 19 Sep 2013 10:54:58 +0000 (UTC)

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

Yep. Assuming you have the code-of-suspicion. And you identify
all the suspect code.
That's why there are never any bugs, incompatibilities, missing
dependencies, malware...

Say you run the big bank.
You assure me that there is zero counterfeit money in your vault.
What does that tell me about the authenticity of the money in my wallet?
Surely my bookie validated every bill!

Life is not nearly as simple as you seem to believe.

Post by Cybe R. Wizard
Cybe R. Wizard

Bit Twister

2013-09-19 22:14:54 UTC

Post by Cybe R. Wizard
Heh, diff should do, no?

All I was indicating, was that diff can get you to the code needing
inspection. NO way was I implying it did anything else.

mike

2013-09-19 23:46:58 UTC

Post by Cybe R. Wizard
Heh, diff should do, no?

All I was indicating, was that diff can get you to the code needing
inspection. NO way was I implying it did anything else.

I'm suggesting that you can't.
You can inspect the code in the vault.
You have zero control over what happens between the vault and my
hardware. If you could do that, there would be zero malware
in the wild, cuz you'd have stopped it at the vault.

When I click the download link, I go to some NUMBER. What's there is
anybody's guess. To believe that it's always the place it sez is
naive. This is especially true when the repository doesn't have what
you need and you have to get it elsewhere.

The downside of the linux malware complacency is that if you ever do
get a virus, you may never know.
On systems with real-time malware scanners, you have at least a chance
of eventually discovering the infection.

I think the realization will come if there are ever enough ordinary
people clicking on everything that is shiny from linux. Malware
is more about social engineering than anything you can do in kernel
source code that's locked up in a vault.

Recently, there was some interesting-looking freeware posted.
The link address was e to about 50 decimal places. I chose
not to click it.

Bit Twister

2013-09-20 00:16:39 UTC

Post by mike
On systems with real-time malware scanners, you have at least a chance
of eventually discovering the infection.

Maybe 2 or more years down the road. Seen articles about those on some
other OS.

Post by mike
The downside of the linux malware <snip> is that if you ever do
get a virus, you may never know.

The same applies for the best damn malware magnet OS on the planet,
except with sever orders of magnitude better odds.

If you want to be complacent, that is your choice. If not, I suggest
you install an intrusion detection package, and maybe a database
driven malware detection package. Depending on your Distribution, they
might be a short click away from being installed. Some ids apps:
osiris, ossec-hids, samhain, tripwire, snare, integrit

Personally, I am using aide and rkhunter, might not hurt to run
unhide, or something like zeppoo. Some information about those can be
found at:

http://sourceforge.net/projects/rkhunter
http://sourceforge.net/projects/aide/
http://sourceforge.net/projects/unhide
http://sourceforge.net/projects/zeppoo

Distribution I use has a security auditor with a test that compares
the installed package against what is on the drive. If disk contents
do not match package contents, I get a report of mismatched file(s).

mike

2013-09-20 03:18:06 UTC

Post by mike
On systems with real-time malware scanners, you have at least a chance
of eventually discovering the infection.

Maybe 2 or more years down the road. Seen articles about those on some
other OS.

Post by mike
The downside of the linux malware <snipped complacency> is that if you ever do
get a virus, you may never know.

This is very interesting....
The only reason to snip one word is to change the meaning/intent of the
sentence.
You may not agree with my statement, but you have no right to change
the meaning/intent of MY statement/opinion.
I thought better of you.

Words of wisdom from Taylor Swift come to mind...
"Now, go stand in the corner and think about what you've done!"
;-)

Post by Bit Twister
The same applies for the best damn malware magnet OS on the planet,
except with sever orders of magnitude better odds.
If you want to be complacent, that is your choice. If not, I suggest
you install an intrusion detection package, and maybe a database
driven malware detection package. Depending on your Distribution, they
osiris, ossec-hids, samhain, tripwire, snare, integrit
Personally, I am using aide and rkhunter, might not hurt to run
unhide, or something like zeppoo. Some information about those can be
http://sourceforge.net/projects/rkhunter
http://sourceforge.net/projects/aide/
http://sourceforge.net/projects/unhide
http://sourceforge.net/projects/zeppoo
Distribution I use has a security auditor with a test that compares
the installed package against what is on the drive. If disk contents
do not match package contents, I get a report of mismatched file(s).

Thanks for the links.
I don't remember ever seeing any linux user admit that he installs
as much anti-malware stuff
on his system as I might on a "vulnerable" windows system.
Useful info like this gets lost in the barrage of "linux is not
susceptible to malware" mantra. Thanks for sharing.

Any estimate of the overhead of those tools?
I don't have any data, but I wouldn't argue with an estimate
that half of my windows CPU cycles get used up on antivirus and firewall
software. Good news is that I have easily twice the cpu cycles I need
to keep up with my internet connection.

Wildman

2013-09-20 03:37:39 UTC

Post by mike
I don't remember ever seeing any linux user admit that he installs
as much anti-malware stuff
on his system as I might on a "vulnerable" windows system.
Useful info like this gets lost in the barrage of "linux is not
susceptible to malware" mantra. Thanks for sharing.

I use rkhunter and zeppo. Don't have a problem admitting
it. I also use ClamAV and I scan everything I download.
There is no such thing as 100% security 100% of the time
no matter what OS you are running.

--
<Wildman>
GNU/Linux user #557453

Bit Twister

2013-09-20 07:54:59 UTC

Post by mike
The downside of the linux malware <snipped complacency> is that if you ever do
get a virus, you may never know.

This is very interesting....
The only reason to snip one word is to change the meaning/intent of the
sentence.

Not going to argue that. I wanted some focus on what I am responding to.

Post by mike
You may not agree with my statement, but you have no right to change
the meaning/intent of MY statement

I am sorry, but my keyboard and editor work just the way I want them
to and I can do whatever I like. :)

I read your statement to mean "Linux" was complacent about malware.
It is not.

A system designed up front with security in mind, it quite a bit
better than trying to patch it in later.

Post by mike
/opinion.

I do not change opinions, I provide my views and knowledge. What is
done with those is a user's prerogative.

Post by mike
I thought better of you.

I pretty much do not care what people think of me.
Since we are being honest, I have your id scored at -665 for defending the
letter spaced one's actions for degrading the usefulness of
alt.os.linux.ubuntu. I use -666 for the trolls. :)

Post by mike
Thanks for the links.

There is no telling how much knowledge/users has been lost due to the
troll and its followers in this group.

Post by mike
I don't remember ever seeing any linux user admit that he installs
as much anti-malware stuff
on his system as I might on a "vulnerable" windows system.

1. It is not paranoia when they are out to get you.
2. The above is not nearly enough for any windows system with an
external connection.
3. Malware authors are going after applications pulling files from
infected sites, (flash, pdf, gif, MP3, WMA, WMV, MP2,...) to get their
payload installed.
Number 3 is what the "anti-malware stuff" is for.

Post by mike
Useful info like this gets lost in the barrage of "linux is not
susceptible to malware" mantra. Thanks for sharing.

That is basically what the pollution control thread is about.
The users of this group have allowed the trolls and its respondents
to damn near make this group useless. :-(

Any subject matter expert have better things to do, or other Usenet
groups where they can spend time sharing knowledge or helping someone
with a problem than wading through this groups Pollution.

Post by mike
Any estimate of the overhead of those tools?

That is somewhat system relative, you know, busy system, under
powered, not enough memory, number of files, io bandwidth, hardware
speeds, ...

Take my system for instance, when idle, "keyboard/mouse not in use", I
have the system burning through about 443 process ids per hour.

Daily cron jobs kick in at a 2 minutes after 4am. Hourly cron jobs run
1 minute after the hour. A little bit after 4am, disk usage led goes
on solid and is pretty bright with a few flickers once in awhile for
about 25 minutes. Then it goes back to dark/not noticeable.

Looking at the following "top" result snippet might show you
I am not worried about overhead.

top - 02:53:11 up 1 day, 2:09, 2 users, load average: 0.00, 0.01, 0.05
Tasks: 200 total, 1 running, 199 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.1%us, 0.2%sy, 0.0%ni, 99.7%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 8179356k total, 7113136k used, 1066220k free, 248436k buffers
Swap: 8191996k total, 0k used, 8191996k free, 5658164k cached

First user is bittwister, second user is bittwister typing in the
"Usenet" account. :)

Post by mike
I don't have any data, but I wouldn't argue with an estimate
that half of my windows CPU cycles get used up on antivirus and firewall
software.

I hear that, when I ran windows, it felt more like 75% resource usage.
I am not happy when I waiting for response while
typing/clicking/wanting the system to do something.

Post by mike
Good news is that I have easily twice the cpu cycles I need
to keep up with my internet connection.

You might consider install/using VirtualBox to play around with your
distribution, especially for software package evaluation,
command/scrip usage/experiments, something pulled from the net or Usenet....

I give my guest installs a gig of memory, and it is nice to bring up a
saved guest in under 16 seconds to do some research.

mike

2013-09-20 15:37:06 UTC

Post by mike
The downside of the linux malware <snipped complacency> is that if you ever do
get a virus, you may never know.

This is very interesting....
The only reason to snip one word is to change the meaning/intent of the
sentence.

Not going to argue that. I wanted some focus on what I am responding to.

Post by mike
You may not agree with my statement, but you have no right to change
the meaning/intent of MY statement

I am sorry, but my keyboard and editor work just the way I want them
to and I can do whatever I like. :)
I read your statement to mean "Linux" was complacent about malware.
It is not.
A system designed up front with security in mind, it quite a bit
better than trying to patch it in later.

Post by mike
/opinion.

I do not change opinions, I provide my views and knowledge. What is
done with those is a user's prerogative.

Post by mike
I thought better of you.

Post by mike
Thanks for the links.

There is no telling how much knowledge/users has been lost due to the
troll and its followers in this group.

Post by mike
I don't remember ever seeing any linux user admit that he installs
as much anti-malware stuff
on his system as I might on a "vulnerable" windows system.

Post by mike
Useful info like this gets lost in the barrage of "linux is not
susceptible to malware" mantra. Thanks for sharing.

That is basically what the pollution control thread is about.
The users of this group have allowed the trolls and its respondents
to damn near make this group useless. :-(
Any subject matter expert have better things to do, or other Usenet
groups where they can spend time sharing knowledge or helping someone
with a problem than wading through this groups Pollution.

Post by mike
Any estimate of the overhead of those tools?

That is somewhat system relative, you know, busy system, under
powered, not enough memory, number of files, io bandwidth, hardware
speeds, ...
Take my system for instance, when idle, "keyboard/mouse not in use", I
have the system burning through about 443 process ids per hour.
Daily cron jobs kick in at a 2 minutes after 4am. Hourly cron jobs run
1 minute after the hour. A little bit after 4am, disk usage led goes
on solid and is pretty bright with a few flickers once in awhile for
about 25 minutes. Then it goes back to dark/not noticeable.
Looking at the following "top" result snippet might show you
I am not worried about overhead.
top - 02:53:11 up 1 day, 2:09, 2 users, load average: 0.00, 0.01, 0.05
Tasks: 200 total, 1 running, 199 sleeping, 0 stopped, 0 zombie
Cpu(s): 0.1%us, 0.2%sy, 0.0%ni, 99.7%id, 0.1%wa, 0.0%hi, 0.0%si, 0.0%st
Mem: 8179356k total, 7113136k used, 1066220k free, 248436k buffers
Swap: 8191996k total, 0k used, 8191996k free, 5658164k cached
First user is bittwister, second user is bittwister typing in the
"Usenet" account. :)

Post by mike
I don't have any data, but I wouldn't argue with an estimate
that half of my windows CPU cycles get used up on antivirus and firewall
software.

I hear that, when I ran windows, it felt more like 75% resource usage.
I am not happy when I waiting for response while
typing/clicking/wanting the system to do something.

Post by mike
Good news is that I have easily twice the cpu cycles I need
to keep up with my internet connection.

You might consider install/using VirtualBox to play around with your
distribution, especially for software package evaluation,
command/scrip usage/experiments, something pulled from the net or Usenet....
I give my guest installs a gig of memory, and it is nice to bring up a
saved guest in under 16 seconds to do some research.

I've been experimenting with Mint 13 in virtualbox.
Initial results are not encouraging.
Looks like I need to go enable hardware virtualization support so I can
give VB 2 or more cores. On the list of things to do...as soon as I
figger out and solve the sleep disorder issues.
The damn thing won't stay asleep, despite my attempts to coerce same.
It's the same OS load, so has to be hardware related...somewhere.

Bit Twister

2013-09-20 16:21:31 UTC

On Fri, 20 Sep 2013 08:37:06 -0700, mike wrote:

Please trim your posts.

Post by Bit Twister
I give my guest installs a gig of memory, and it is nice to bring up a
saved guest in under 16 seconds to do some research.

I've been experimenting with Mint 13 in virtualbox.
Initial results are not encouraging.
Looks like I need to go enable hardware virtualization support
On the list of things to do..

Thought that had to be enabled in the bios anyway.

Post by mike
so I can give VB 2 or more cores.

Hmmm, running on a Hewlett-Packard p6610f/2AB1 , BIOS 6.02 07/21/2010
Athlonll X4 635 (P) 2.9 GHz (95W) 4000 MHz HyperTransport 3.0 Socket AM3
and 8 gig of memory.

Did nothing special so I think VirtualBox is only using one core.
I know I have told none of the guest to use more than one.

Guest performance was on par on my single core system before AC power
fluctuations killed it.

Post by mike
...as soon as I
figger out and solve the sleep disorder issues.
The damn thing won't stay asleep, despite my attempts to coerce same.

Cute, I leave mine up. MythTv node needs to be up to record TV shows.
Test bed needs to be up to pull the daily updates from the
distribution test system. My "production" node is running in the test
bed mode, so an hour after the test bed pulled the updates, it rsyncs
them and all my system auditing sofware needs to check the system plus
all the cron jobs pulling down any email from my various email accounts.

DecadentLinuxUserNumeroUno

2013-09-21 01:02:14 UTC

Post by mike
I've been experimenting with Mint 13 in virtualbox.

You are a goddamned idiot. this is an Ubuntu group.

Post by mike
Initial results are not encouraging.

Look at the person attempting to perform the task.

Post by mike
Looks like I need to go enable hardware virtualization support so I can

No shit? Was that a guess or did someone have to hold your hand
again?

Post by mike
give VB 2 or more cores. On the list of things to do...as soon as I
figger out and solve the sleep disorder issues.

Yours or the PC's?

Post by mike
The damn thing won't stay asleep, despite my attempts to coerce same.

Your mobo is probably set to start after a mouse event or some other
such thing.

Post by mike
It's the same OS load, so has to be hardware related...somewhere.

Power state, and power up functions are in *some* BIOS settings.

I had one where a keyboard with a power button would work.

Those keyboards have all but withered away, and the BIOS settings are
rarely available any more. Pretty lame... like an afterthought.

You, however... YOU need to get you shit together and stop blaming an
OS you are all but clueless about , and you have no business expounding
on the paradigms Operating System authors use either.

Some of the crap you spew here is 100% indicative of your less than
lay person status and grasp of the realm.

Go learn some electronics first. Get some real knowledge. Riding the
t i m retard's coattails will move your education in a rearward
direction.

mike

2013-09-19 19:38:23 UTC

Post by mike
Just a couple of questions.
How many lines of kernel source code?

I can not find the article I read about 2 days ago to see if it was
15 million lines of code or was it 17 million. What caught my eye was
the headline about Micro$oft contribution, or more importantly the
lack of it this past year or so.
But huge amount of code is not going to be a good argument.

Post by mike
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?

Obscuring is going to be the real challenge.

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

Probably a lot more than you are alluding to.

Post by mike
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?

I'd have to agree...in a perfect world. That's why I'm baffled by the
number of things that worked in distro release 12.0 and no longer work
in distro release 12.4. In a perfect world, things that didn't change
wouldn't break. And things that changed would be examined and fixed.
And somebody would be running regression tests to verify compatibility
and that all the required interchangeable dependency pieces got included.

You can't deny that there are holes in that system.
And yes, I said distro. The bare kernel is useless to the end
single user desktop.
And the kernel isn't the only vulnerability.

I keep reading about how linux is impervious at the kernel level
and any malware could infect only the user space. On a single user
desktop system, there ain't no difference. If your single user
desktop system is compromised,
the actual nature of the compromise is of no consequence.
See, the kernel is safe...so what?

Post by Bit Twister
You can bet China, Russia, and other nations are looking through the
code, not to mention criminals wanting the same thing. Micro$oft would
not hesitate a minute to show their customers and the world that open
source code is not as secure as theirs.
I really wish I could find that article. A tremendous amount of
changes was accomplished with very few defects. You do not get that
quality of code by just one person coding and releasing it. More than
a few people are looking at it.

More than one person is looking at the official, controlled, code.
What about all the code that gets inserted out in the wild?
Safe kernel is good, but it ain't the only place a system can get
compromised. Malware rarely comes from the officially released stuff,
in ANY OS. I classify a backdoor as malware.

Post by Bit Twister
I have been in a few code reviews, of my code and others. Does not take
long for any experienced coder to spot funny code.

In a perfect world, yes. And I'm NOT saying that you shouldn't do code
reviews.
But if they found ALL the funny code, bugs wouldn't exist...ever...
Experts are blinded by their own expertise. They think they know
everything. They cover the bases on what they know. But the world
isn't perfect. Things don't always unfold the way you'd expect.
A fresh view from someone who ain't the expert can expose potential
problems that the experts would never have come up with.

Back in the day, I'd take off my manager hat, don my engineer hat and
walk across the building to learn about other projects.
I'd ask questions like, "what happens to your implementation under THESE
conditions?" Wouldn't take more than about three questions for a hole
to show up.
Some engineers would say, "thanks, you saved me a bunch of grief."
Most responded, "you're not the expert, that won't ever happen, go away."

And six months later, when they built it and it didn't work, I was still
the bad guy.
People are rarely grateful when you try to save them from themselves.

That's another area that baffles me. Many of the windows vulnerabilities
have been reported as the result of stack overflow.
Stack overflow has been a known issue for decades.
Sounds pretty simple. If the stack is full, don't let anybody push
anything on it. Why are there still stack overflow problems?

I agree that it's something you should do. But, for a single user
desktop system like Ubuntu, as a single user, if my system don't work,
I don't really care which ring has the problem.

If you're building a server farm, all these things are extremely important.
As a single user ubuntu desktop system, clicking on something I shouldn't
is WAY more likely to cause me grief than some kernel oversight.
A perfectly functioning kernel is no help if my keyboard is locked up
and 10 porn windows are opening every second.

I'm NOT saying anything bad about linux. I'm merely pointing out
that the myth surrounding it may be overstated.

Post by Bit Twister
On the flip side, when I saw something about a secure linux being
released by some 3 letter government organization, my first thought
was SURE, RIGHT, Not on my system.

Cybe R. Wizard

2013-09-19 20:49:52 UTC

Post by mike
I keep reading about how linux is impervious at the kernel level
and any malware could infect only the user space. On a single user
desktop system, there ain't no difference. If your single user
desktop system is compromised,
the actual nature of the compromise is of no consequence.
See, the kernel is safe...so what?

Please don't tell us that you don't surf, browse or use usenet,
really, do anything on the internet, as your main user. It would
seem only sensible to me (at least) to use a throw-away user
account on the iternet. I certainly do use a throw-away, cybe.
My actual user for important stuff stays strictly off the
internet.

--
----Android NewsGroup Reader----
http://www.piaohong.tk/newsgroup

Bit Twister

2013-09-19 22:23:01 UTC

Post by Cybe R. Wizard
Please don't tell us that you don't surf, browse or use usenet,
really, do anything on the internet, as your main user. It would
seem only sensible to me (at least) to use a throw-away user
account on the iternet. I certainly do use a throw-away, cybe.
My actual user for important stuff stays strictly off the
internet.

Yep, same here. When I click my firefox desktop shortcut, my Linux
browsing account pops up firefox, when I exit firefox,
files/directories are deleted and the firefox.tar puts everything back
in pristine condition.

DecadentLinuxUserNumeroUno

2013-09-19 12:23:21 UTC

Post by mike
put into obscuring their additions?

You are a total fucking retard, mike.

All of the educational additions you have made throughout your
pathetic life have all been obscured by your abject stupidity about how
and why things get done by real men.

If it was in there it would have been found. YEARS ago, or DAYS ago.
Either way, it DOES NOT exist or would be found.

YOU DIG, YOU RETARDED DUMBFUCK?

mike

2013-09-19 19:42:37 UTC

Post by DecadentLinuxUserNumeroUno

Post by mike
put into obscuring their additions?

You are a total fucking retard, mike.
All of the educational additions you have made throughout your
pathetic life have all been obscured by your abject stupidity about how
and why things get done by real men.
If it was in there it would have been found. YEARS ago, or DAYS ago.
Either way, it DOES NOT exist or would be found.
YOU DIG, YOU RETARDED DUMBFUCK?

Of the two threads I've read today, you're two for two.
First punch into the downward spiral for this thread thrown
by your very own self.
And the second...
And the third...

I don't know whether Aragorn's count measures that as one or three,
but the trend is clear.

DecadentLinuxUserNumeroUno

2013-09-19 12:25:44 UTC

Post by mike
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?

You should refrain from interjecting your obviously blatantly stupid
view of things into discussions where you don't even rate 'lay person'.

DecadentLinuxUserNumeroUno

2013-09-19 12:31:11 UTC

Post by mike
I'd probably agree with your conclusion, but strenuously object
to any claims that you got there logically based on what you wrote.

This has to be the most evidence that you are an abject idiot you have
yet posted.

I strenuously object to your genes being in the human gene pool.
Your entire bloodline should be erased from it.

Chris Ahlstrom

2013-09-20 10:21:34 UTC

Just a couple of questions.
How many lines of kernel source code?
How much effort might an organization with as deep pockets as the NSA
put into obscuring their additions?
How many people have the actual skills to determine if a particular
chunk of code may or may not be part of an entry?
How many people with the time/energy to examine it all? Today?
Tomorrow? The day after that?
Exactly who determined that it had to be in the kernel?
Must be nice to live in a world where narrow-minded thinking
and failure to look at the big picture was comforting.
Not everything is confined to that tidy little GNU box you inhabit.
I'd probably agree with your conclusion, but strenuously object
to any claims that you got there logically based on what you wrote.
If you were an evil organization, would you communicate using windows?
Linux? or any other mainstream current system?
I sure wouldn't.

Idiot.
--
Coach: What would you say to a beer, Normie?
Norm: Daddy wuvs you.
-- Cheers, The Mail Goes to Jail

Sam: What'd you like, Normie?
Norm: A reason to live. Gimme another beer.
-- Cheers, Behind Every Great Man

Sam: What will you have, Norm?
Norm: Well, I'm in a gambling mood, Sammy. I'll take a glass of whatever
comes out of that tap.
Sam: Oh, looks like beer, Norm.
Norm: Call me Mister Lucky.
-- Cheers, The Executive's Executioner

Mach2

2013-09-19 13:42:24 UTC

And any user can see the source code, verify it is clean and compile it
for their own use. You cannot do this with MacOSX or Windows.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

DanS

2013-09-19 22:07:47 UTC

Post by Aragorn
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Also, no one has ever proven there to be a backdoor into Windows either,
for that matter, so what's your point?

Mark Warner

2013-09-19 23:52:22 UTC

Post by Aragorn
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Also, no one has ever proven there to be a backdoor into Windows either,
for that matter, so what's your point?

Absence of evidence is not evidence of absence. And since an open,
independent audit of the source can't be done, "proof" -- one way or the
other -- is unattainable. Only thing to go on is the word of Microsoft
and the NSA.

--
Mark Warner
MEPIS Linux
Registered Linux User #415318
...lose .inhibitions when replying

DanS

2013-09-20 02:37:06 UTC

Post by Mark Warner

Post by Aragorn
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Also, no one has ever proven there to be a backdoor into Windows either,
for that matter, so what's your point?

Absence of evidence is not evidence of absence.

Correct.

Post by Mark Warner
And since an open,
independent audit of the source can't be done, "proof" -- one way or the
other -- is unattainable. Only thing to go on is the word of Microsoft
and the NSA.

I don't know if I agree with that....that the only thing to go on is the
word of MS and the NSA.

Those that find exploits, either pro-actively to close them, or hackers
that actually use the exploits, would have most likely been able to find
or verify at least some evidence and be able to produce some valid proof
of concept paper, if not demonstrate it outright.

The presence of a registry key with NSA in the name is not "proof".

According to the experts, here, very little has changed under the hood
with Windows since NT was released, and all changes have been superficial
at best. This would mean that the security experts, hackers, and general
MS-haters have had 15 years to try to prove it, and as of yet, have no
evidence.

I'm not saying that there's absolutely no back-door, I'm just saying
there is no credible evidence to support such a claim.

At this point, I have no worries about it.

Chris F.A. Johnson

2013-09-20 03:01:19 UTC

Post by Mark Warner

Post by Aragorn
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Also, no one has ever proven there to be a backdoor into Windows either,
for that matter, so what's your point?

Absence of evidence is not evidence of absence.

Absence of evidence is not evidence of anything.

--
Chris F.A. Johnson

Aragorn

2013-09-20 04:27:36 UTC

On Friday 20 September 2013 01:52, Mark Warner conveyed the following to
alt.os.linux.ubuntu...

Post by Mark Warner

Post by Aragorn
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Also, no one has ever proven there to be a backdoor into Windows
either, for that matter, so what's your point?

Absence of evidence is not evidence of absence. And since an open,
independent audit of the source can't be done, "proof" -- one way or
the other -- is unattainable. Only thing to go on is the word of
Microsoft and the NSA.

Edward Snowden's documents, which he sent both to The Washington Post
and The Guardian (and probably a few other newspapers), prove that
Microsoft sells zero-day exploits to the NSA long before it decides to
write a patch for those exploits and issue it to its users.

http://tinyurl.com/m947j6t

--
= Aragorn =
GNU/Linux user #223157 - http://www.linuxcounter.net

*Hemidactylus*

2013-09-19 23:57:25 UTC

Am I safe to ASSume that SELinux gets a clean bill of health (aside from
its tendency toward false positives in my past experience)?

http://en.wikipedia.org/wiki/Security-Enhanced_Linux

[quote]The United States National Security Agency (NSA), the original
primary developer of SELinux, released the first version to the open
source development community under the GNU GPL on December 22, 2000.[/quote]

Statements like that used to *boost* my confidence in SELinux. I used to
think the NSA had my back, not my backdoor(s).

--
*Hemidactylus*

Aragorn

2013-09-20 04:36:24 UTC

On Friday 20 September 2013 01:57, *Hemidactylus* conveyed the following
to alt.os.linux.ubuntu...

Post by *Hemidactylus*

Post by Aragorn
At a recent LinuxCon conference, Linus Torvalds was asked whether any
government (and in particular the NSA) had asked him to put a
backdoor
into the kernel. He replied "No", while nodding "yes", causing the
audience to burst into laughter.
http://tinyurl.com/mrescrm
Of course, certain trolls - I already have a good idea whom they will
be - will now take the above fact as ammunition for creating the FUD
that there would indeed be an NSA backdoor in Linux, which is *not*
what the article says.
Well, the source code of Linux is readily available for everyone to
scrutinize over at http://www.kernel.org, so I'm inviting the trolls to
look at the source code and find any such backdoor. I'll even make
it easy on them: they don't even have to peruse the hardware
platform- specific code, nor in any hardware driver modules, because
if there were a backdoor in Linux, then it would be inserted in that
part of code which is germane to all architectures, and thus it would
have to be in the core kernel code itself.
(And for the really paranoid: no, there is *no backdoor* in Linux.)

Am I safe to ASSume that SELinux gets a clean bill of health (aside
from its tendency toward false positives in my past experience)?

Yes. And if you don't trust it, you can disable it at boot time by
adding a kernel parameter. I'm not sure but I think it's "selinux=off".
There's also an "selinux=warn", which nags about supposed security
violations (against the SELinux mandatory access control rules) in
applications, but doesn't stop the applications from doing what they do.

I believe that "selinux=hard" is the parameter needed to actually limit
the access some applications have, but this is known to break a number
of things, especially on desktops (by virtue of the X11 display server
and possibly a few multimedia plugins).

Anyway, this stuff is documented. Myself, I don't use SELinux.

Post by *Hemidactylus*
http://en.wikipedia.org/wiki/Security-Enhanced_Linux
[quote]The United States National Security Agency (NSA), the original
primary developer of SELinux, released the first version to the open
source development community under the GNU GPL on December 22,
2000.[/quote]
Statements like that used to *boost* my confidence in SELinux. I used
to think the NSA had my back, not my backdoor(s).

They asked Linus to put a backdoor in Linux, but Linus refused that, and
it would also have been clear to the NSA that it was a stupid question
given that Linux is GPL'd and that therefore the source code is
available to everyone.

The reason why the NSA came up with SELinux itself was that they wanted
a GNU/Linux system which would meet their demands on account of
military-grade security. Makes sense, doesn't it? Use a secure
GNU/Linux system on their own machines, while taking advantage of the
backdoors in Windows to run botnets, which they can then use to attack
foreign targets without that the attack could be traced down to the NSA
itself (and thus the US government).

--
= Aragorn =
GNU/Linux user #223157 - http://www.linuxcounter.net

unknown

2013-09-20 08:20:53 UTC

Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

As I see it a backdoor (in *nix based systems at least) can, in the
final analysis only mean one thing ... a compromised user account.

Why does this *have* to have anything to do with the kernel

A backdoor in the kernel *may* be possible but equally it may be
possible to hardcode a username and password in any number of ways, it
can be done per distro, is Canonical in league with the spooks? can you
be sure you machine isn't compromised?

A backdoor, however constructed is only any good if remote access is
enabled (networking), if you have a firewall and block all incoming
traffic then remote access will not be possible. Of course there is
always push but again, if you know what your network is up to it's
something that can be tracked.

I don't think it's possible to know if you have a compromised system
unless you go looking for it.

Just my 2 euros worth

lipska

--
Lipska the Kat©: Troll hunter, sandbox destroyer
and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

crankypuss

2013-09-20 09:15:48 UTC

Post by unknown

Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?
As I see it a backdoor (in *nix based systems at least) can, in the
final analysis only mean one thing ... a compromised user account.
Why does this *have* to have anything to do with the kernel
A backdoor in the kernel *may* be possible but equally it may be
possible to hardcode a username and password in any number of ways, it
can be done per distro, is Canonical in league with the spooks? can you
be sure you machine isn't compromised?
A backdoor, however constructed is only any good if remote access is
enabled (networking), if you have a firewall and block all incoming
traffic then remote access will not be possible. Of course there is
always push but again, if you know what your network is up to it's
something that can be tracked.
I don't think it's possible to know if you have a compromised system
unless you go looking for it.
Just my 2 euros worth
lipska

This is one of the advantages of a versioning filesystem, or of using
rsync with the test option against a full backup. Foreign code has to
live somewhere.

If you've checked every line of the source code and rebuilt from that,
any intrusive code has to be in a file somewhere, which means it has to
appear at some point, which means that you can find it if you look
thoroughly enough.

Nobody looks at all the source code himself, there's too much of it.
Some of it will be sufficiently specialized that a given individual
won't understand it, his specialty is something else.

So we are forced to trust, and wish not to trust too much. If the NSA
has me under a microscope their agents will soon be dropping dead at
their desks from sheer boredom.

I suspect that most people leave Update Manager turned on, try to keep
their system current. Personally, once I have the system installed and
operating the way I prefer, I freeze it. Nothing gets updated without a
very good reason. Most of the time I'm offline, disconnected from any
network.

Security is about what can be stolen from you, and what can be done to
you. Frequent backups limit what can be done to you. What can be
stolen from you is never more than you tell the computer, secrets that
remain in your head are not at risk.

mechanic

2013-09-20 10:03:24 UTC

Post by unknown
Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

Hmm, I thought it was the part in the source code with 'this is the
backdoor part!' comments wrapped around it! Seriously it must be any
flaw in the system that allows an account to be accessed by the bad
guys. On my system, it's the weak password protection that no doubt
could be cracked in a short time with the right hardware. There must
be an analogy in the software world to this problem recently
highlighted where a simple change to the doping levels in a couple
of places on the chip produces undetectable jammed 'transistors'
shortening the length of encryption keys and making attacks easier.
Some subtle change in the code that no review or test would reveal.
It just takes a few dollars paid to a vulnerable techie in the
system somewhere to make the change.

DecadentLinuxUserNumeroUno

2013-09-20 12:11:43 UTC

Post by unknown
Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

I'd say that your brain has several quadrillion undetectable jammed
neurons in it.

Except we have detected it. You are dirt dumb.

Your cable company has a better chance at observing you from 'the
other side'.

Bit Twister

2013-09-20 10:29:29 UTC

Post by unknown
Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

I would say it is a hard coded reliable method of access giving that
non-authorized person/process complete access to every thing in the
system.

Post by unknown
As I see it a backdoor (in *nix based systems at least) can, in the
final analysis only mean one thing ... a compromised user account.

To me a user account is not root. Also a compromised system is not a
compromised account, be it root or user.

Post by unknown
Why does this *have* to have anything to do with the kernel
A backdoor in the kernel *may* be possible but equally it may be
possible to hardcode a username and password in any number of ways,

Ah, to me id/pw is front door, not backdoor access and a backdoor does
not require an id/pw.

Post by unknown
A backdoor, however constructed is only any good if remote access is
enabled (networking),

Well, that is pretty obvious, unless it is a black bag operation. :)

Post by unknown
if you have a firewall and block all incoming
traffic then remote access will not be possible.

HA HA Ha ha, cough, cough, choke, .... whew.

Some followup on that at end of this reply.

Post by unknown
Of course there is always push but again, if you know what your
network is up to it's something that can be tracked.

You are a bit naive in that area.
What if the tracks are erased. :(

Post by unknown
I don't think it's possible to know if you have a compromised system
unless you go looking for it.

That is what system monitoring is all about.

Back to your
if you have a firewall and block all incoming
traffic then remote access will not be possible.
comment.

You go to some web site you have decided is safe/trust, but it has
been infected with malware.

Your router firewall is blocking incoming attempts, your distribution
firewall is blocking incoming attempts. Big fscking deal.

Oh, by the way, have you installed a firewall? Last time I looked
*buntu does not install/enable a firewall. :-(
I think that is a damn poor decision by the distribution vendor.
Anyway, back to my point. Why would you need a firewall on the system
if there is a firewall on the router? you ask.
It another level of protection against a cracked router, or another
system on your LAN.

For all intents and purposes that malware is running on your system in
your user space. What is it doing, you ask. It can be hacking into
your router and changing its/your dns server ip addresses to the
criminal's dns servers. Now when your "check for software updates"
process kicks off, you are notified of updates and would please enter
your password to get them installed.

What did you do? :-(

If you gave the password to get the updates, the criminals site gave
you the lasted released distribution updates, plus a few "extra" for
good measure. :-( :-( :-(

For those of you hollering OMFG WTF can I do to protect against that?

I have a few suggestions. I don't trust my ISP's administrators. I see
way too many screw ups and management decisions. Then there are all
the router exploits going around.

So what have I done. One, I try to keep up on what the latest exploits
are doing. As indicated they are cracking the user's router from the
infected web site. My protection is to install privoxy and tell it to
block access to my router's ip address. Then I told my browser to use
it as my proxy. That solves the first half of the problem.

Whats to say the dns servers in the router are not compromised.
Well, a solution there is to have your own dns server running on your
system. That is somewhat better. BUT, what if the World's dns servers
were faked out and the criminal was able to point traffic to their
site. :-(

You do what I do, you write a little script which accepts the name you
would use to access a site of interest, and compare current value
against the script's stored value and return a pass/fail status.

Now with a little bit more scripting, you write something like the
following UNTESTED example script "bank", which I just cranked out for
this reply,
create a shortcut and you would be good to go, assuming you have a
check ip perl script called ckip.pl :)
and you have the xmessage application installed.
------8<------8<------8< cut below this line------8<------8<
#! /bin/bash
#**************************************************************
#*
#* bank - connects to my bank's website
#*
#* Checks banks ip address against stored value.
#* Checks to verify user is not running firefox in another
#* desktop/window.
#* Banks url is passed to firefox to prevent mis-types of bank's url
#* or a possible poisoned bookmark or poisoned browser cache.
#*
#* Install: save script to bank, chmod +x bank.
#*
#**************************************************************

ckip.pl www.bankofamerica.com/
if [ $? -ne 0 ] ; then
xmessage -fg white -bg red -buttons No:102,Yes:0 "
www.bankofamerica.com/ ip address does not compare
against the stored value.
Do you wish to proceed?
"
if [ $? -ne 0 ] ; then
exit $?
fi

_result=$(pgrep firefox)
if [ -n "$_result" ] ; then
xmessage -fg black -bg yellow "
Always close the currently running firefox before attempting any
banking activity
" &
exit 1
fi

firefox https://www.bankofamerica.com/
fi

#************ end of bank ***********************************

unknown

2013-09-20 12:50:09 UTC

Post by unknown
Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

I would say it is a hard coded reliable method of access giving that
non-authorized person/process complete access to every thing in the
system.

So, on *nix based systems some kind of account then, everything has to
run under some kind of account doesn't it?

Post by unknown
As I see it a backdoor (in *nix based systems at least) can, in the
final analysis only mean one thing ... a compromised user account.

To me a user account is not root.

The root user is a user, if not a user then what?

Post by Bit Twister
Also a compromised system is not a
compromised account, be it root or user.

But a compromised account *is* a compromised system isn't it?

Ah, to me id/pw is front door, not backdoor access and a backdoor does
not require an id/pw.

But all processes need to run under some account ... don't they?
How can any process be run on a running system if not under an account?

Post by unknown
A backdoor, however constructed is only any good if remote access is
enabled (networking),

Well, that is pretty obvious, unless it is a black bag operation. :)

Post by unknown
if you have a firewall and block all incoming
traffic then remote access will not be possible.

HA HA Ha ha, cough, cough, choke, .... whew.

<snip>

Post by Bit Twister
Back to your
if you have a firewall and block all incoming
traffic then remote access will not be possible.
comment.
You go to some web site you have decided is safe/trust, but it has
been infected with malware.
Your router firewall is blocking incoming attempts, your distribution
firewall is blocking incoming attempts. Big fscking deal.

This is different though isn't it. You are talking about infection after
installation, as I see it the kind of thing we are talking about is the
ability to access the system in a covert way that is present, available
and enabled 'out of the box' and moreover not accessible or configurable
by any user, including root, although how this might be achieved is
still unclear to me.

Post by Bit Twister
Oh, by the way, have you installed a firewall? Last time I looked
*buntu does not install/enable a firewall. :-(

Ubu 12.04 64 bit comes with a firewall which I have enabled. I can see
what ports are open and what is listening on them. If my firewall is
hardcoded *not* to show port xxxxx then maybe I can't see it ... just
started looking at wireshark.

lipska

--
Lipska the Kat©: Troll hunter, sandbox destroyer
and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

Bit Twister

2013-09-20 13:08:31 UTC

Post by unknown
So, on *nix based systems some kind of account then, everything has to
run under some kind of account doesn't it?

OK, as a big over all, in a nutshell description, you are absolutely
correct, generally speaking.

What I want you to take away from this discussion, is a root ACCOUNT
compromised, is not the same thing as a root owned process compromise,
and a user compromise is not near as disturbing as a root compromise.

That ignores the default security hole setup for the first *bunter
user created on the system. :(

Post by unknown
This is different though isn't it. You are talking about infection after
installation,

Yes, you are quite correct. You made the statement you were safe
because firewall blocked any inbound hacking attempts.

Post by unknown
as I see it the kind of thing we are talking about is the
ability to access the system in a covert way that is present, available
and enabled 'out of the box' and moreover not accessible or configurable
by any user, including root,

Yep, you are absolutely correct, and your statement would put the
discussion back on topic. :)

mechanic

2013-09-20 16:51:20 UTC

Post by Bit Twister
What I want you to take away from this discussion, is a root
ACCOUNT compromised, is not the same thing as a root owned
process compromise, and a user compromise is not near as
disturbing as a root compromise.

The history is littered with Escalation of Privilege exploits which
allow a hacker to easily gain access to the root account once he/she
has access to any user. Hopefully mostly patched by now, but once a
hacker has control of your .bashrc file, basically the machine is
hers!

Mach2

2013-09-20 17:12:42 UTC

Your .bashrc file??? Why would that gain anyone access beyond whatever
they have inherent in my account? Please explain.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Paladin

2013-09-20 19:39:10 UTC

Your .bashrc file??? Why would that gain anyone access beyond whatever
they have inherent in my account? Please explain.

Once they get your fortunes, you're done for :)

--
IBM Pollyanna Principle:
Machines should work. People should think.

Mach2

2013-09-20 19:54:36 UTC

Post by Paladin
Once they get your fortunes, you're done for :)

Once they get your snickers bar, it's all over... Game over, man. Game
over.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Mach2

2013-09-20 20:57:00 UTC

Still Googling this trying to get educated about what you already said?
No Tim to offer stupidity to back you up? Why, the silence is deafening.
Do you want my .bashrc file? Happy to publish it right here. Then you
will have complete control over it. ;-)

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Paladin

2013-09-21 01:00:37 UTC

If you put 6 million monkeys on a typewriter, eventually they will produce
the Bible.
Monkies are hacking .bashrc?
Damn monkies.

--
Many people are desperately looking for some wise advice which will
recommend that they do what they want to do.

DecadentLinuxUserNumeroUno

2013-09-21 01:31:20 UTC

On Sat, 21 Sep 2013 01:00:37 +0000 (UTC), Paladin

If you put 6 million monkeys on a typewriter, eventually they will produce
the Bible.
Monkies are hacking .bashrc?
Damn monkies.

Are they anything like the Tibetans?

I wonder what the monkeys are doing.

I wonder what The Monkees are doing.

Paladin

2013-09-21 01:52:25 UTC

Post by DecadentLinuxUserNumeroUno
On Sat, 21 Sep 2013 01:00:37 +0000 (UTC), Paladin

If you put 6 million monkeys on a typewriter, eventually they will produce
the Bible.
Monkies are hacking .bashrc?
Damn monkies.

Are they anything like the Tibetans?
I wonder what the monkeys are doing.
I wonder what The Monkees are doing.

I don't wonder what T i m is doing.
He's burning LiveCD # 351.
Why he needs to burn so many LiveCDs is anyones guess.
Maybe Windows isn't great at burning .iso disks.

--
Many people are desperately looking for some wise advice which will
recommend that they do what they want to do.

Chris Ahlstrom

2013-09-21 10:51:45 UTC

Post by Paladin
I don't wonder what T i m is doing.
He's burning LiveCD # 351.
Why he needs to burn so many LiveCDs is anyones guess.
Maybe Windows isn't great at burning .iso disks.

Not when its garbage collection kicks in.

Do they still write some of Windows in .NET?

--
We can predict everything, except the future.

T i m

2013-09-21 10:57:59 UTC

On Sat, 21 Sep 2013 01:52:25 +0000 (UTC), Paladin
<***@thisis.invalid> wrote:

<snip>

Post by Paladin
I don't wonder what T i m is doing.

You know this level of interest in me is bordering on 'pervert'?

Post by Paladin
He's burning LiveCD # 351.

It must be more than that by now. The last was a few to send up to
Scotland for someone else to try.

Post by Paladin
Why he needs to burn so many LiveCDs is anyones guess.

Well, it shouldn't be a guess and I've explained it enough times. Oh
yes, sorry, my bad, you are another freak just stuck on 'Broadcast'
(and the tape loop is screwed).

Post by Paladin
Maybe Windows isn't great at burning .iso disks.

Ironically I generally use Windows (XP) for burning all such disks
(Imgburn (free, good, easy to use, reliable, logical)) because it will
burn directly from my server \ Images folder without some 'You don't
have the right rights' BS or needing to copy the .iso file locally
first.

http://www.imgburn.com/

I have used Linux to burn some (when the .iso is held locally) but the
status prompts it gives whilst doing so are as much of a clusterfcuk
as the OS itself (Done, cancel, Creating checksum, can't eject yada
yada)).

Anyway, thanks very much for your continuing personal interest in me
and everything I do. However, I really think you should try to get on
with your own life (for what it is).

Cheers, T i m

p.s. I understand that hook hole in your lip is still stinging but it
should become less painful in time.

Paladin

2013-09-21 14:54:34 UTC

Post by T i m
On Sat, 21 Sep 2013 01:52:25 +0000 (UTC), Paladin
<snip>

Post by Paladin
I don't wonder what T i m is doing.

You know this level of interest in me is bordering on 'pervert'?

You interest me in the way a squirrel darting into the road as I drive
interest me.
It's funny to watch the squirrel mindlessly scramble about,running one
way,then another,stopping,starting,running right in front of me to
leap into a tree to safety. If it just had stayed put in the first place,
it could have saved a few hundred calories.
What the squirrel was thinkin is anyone's guess.
I find it's behavior humorous.
I find you humorous.
You are a squirrel to me. :)

Post by Paladin
He's burning LiveCD # 351.

It must be more than that by now. The last was a few to send up to
Scotland for someone else to try.

If they weren't complete morons like you, you could have sent them a link.
Let them DL the thing themselves.
Or, does clicking on a DL link interfere with their shoe lacing class?

Post by Paladin
Why he needs to burn so many LiveCDs is anyones guess.

Well, it shouldn't be a guess and I've explained it enough times. Oh
yes, sorry, my bad, you are another freak just stuck on 'Broadcast'
(and the tape loop is screwed).

You post a lot of crap I don't read past the first few words.
Squirrel chattering is just noise to me.
I'm sure it means something to other squirrels.

Post by Paladin
Maybe Windows isn't great at burning .iso disks.

Ironically I generally use Windows

Nothing ironic 'bout that.

<SNIP stuff squirrels do>

--
Many people are desperately looking for some wise advice which will
recommend that they do what they want to do.

T i m

2013-09-21 15:41:57 UTC

On Sat, 21 Sep 2013 14:54:34 +0000 (UTC), Paladin

Post by T i m
On Sat, 21 Sep 2013 01:52:25 +0000 (UTC), Paladin
<snip>

Post by Paladin
I don't wonder what T i m is doing.

You know this level of interest in me is bordering on 'pervert'?

You interest me

<snip>

I know, you said and whilst I'm obviously flattered I'm not really
interested in 'that sort of thing'. ;-(

Post by Paladin
He's burning LiveCD # 351.

It must be more than that by now. The last was a few to send up to
Scotland for someone else to try.

If they weren't complete morons like you, you could have sent them a link.

They are not 'complete morons *either*' but I can still see how you
could jump to that conclusion with your massively limited
interpersonal skills.

Post by Paladin
Let them DL the thing themselves.

As you are still so interested ... I actually downloaded it onto their
laptop remotely but it wouldn't burn correctly (looked like hardware
errors). So, as a means of testing the drive I've send a few 'tested'
LinuxLiveCD/DVDs and even a Bootable LiveLinuxUSB multi-boot stick.

Post by Paladin
Or, does clicking on a DL link interfere with their shoe lacing class?

Awww, poor retard ... can't imagine anything outside it's own heavily
blinkered and limited world. ;-(

Post by Paladin
Why he needs to burn so many LiveCDs is anyones guess.

Well, it shouldn't be a guess and I've explained it enough times. Oh
yes, sorry, my bad, you are another freak just stuck on 'Broadcast'
(and the tape loop is screwed).

You post a lot of crap I don't read past the first few words.

Apart from commenting all the way down this post you mean?!

Post by Paladin
Squirrel chattering is just noise to me.
I'm sure it means something to other squirrels.

No, more like the hook is firmly though your lip and you are now being
dragged helplessly by it behind by boat!

Post by Paladin
Maybe Windows isn't great at burning .iso disks.

Ironically I generally use Windows

Nothing ironic 'bout that.

Apart from it completely countering even more of your BS you poor
little fish!

Are you getting used to that hook yet little fishy (I think you must
be). ;-)

Cheers, T i m

Paladin

2013-09-21 16:04:53 UTC

Post by T i m
On Sat, 21 Sep 2013 14:54:34 +0000 (UTC), Paladin

Post by T i m
On Sat, 21 Sep 2013 01:52:25 +0000 (UTC), Paladin
<snip>

Post by Paladin
I don't wonder what T i m is doing.

You know this level of interest in me is bordering on 'pervert'?

You interest me

<snip>
I know, you said and whilst I'm obviously flattered I'm not really
interested in 'that sort of thing'. ;-(

Don't snip the squirrel analogy.
It was the only highlight of this post.

Post by Paladin
He's burning LiveCD # 351.

It must be more than that by now. The last was a few to send up to
Scotland for someone else to try.

If they weren't complete morons like you, you could have sent them a link.

They are not 'complete morons *either*' but I can still see how you
could jump to that conclusion with your massively limited
interpersonal skills.

If they are getting your help, they are "complete f-ing morons".

Post by Paladin
Let them DL the thing themselves.

They are "utter Wintards idiots" if they need you to remotely DL ubuntu.
Do you remotely stick a blank CD into the drive?
Or do you talk them thru it on the phone.
You tell them "Shiny side down", "No, a blank CD,not a tea saucer".
There is the hardware error, you fuckin stooge.

Post by Paladin
Or, does clicking on a DL link interfere with their shoe lacing class?

Awww, poor retard ... can't imagine anything outside it's own heavily
blinkered and limited world. ;-(

I can't imagine why you and your retarded, imbred mates need a computer
at all.
Staple a mouse to a 2x4 and place it within reach of the toilet.

<SNIP piss poor, old insults>

--
Many people are desperately looking for some wise advice which will
recommend that they do what they want to do.

T i m

2013-09-21 16:16:45 UTC

On Sat, 21 Sep 2013 16:04:53 +0000 (UTC), Paladin

Post by T i m
On Sat, 21 Sep 2013 14:54:34 +0000 (UTC), Paladin

Post by T i m
On Sat, 21 Sep 2013 01:52:25 +0000 (UTC), Paladin
<snip>

Post by Paladin
I don't wonder what T i m is doing.

You know this level of interest in me is bordering on 'pervert'?

You interest me

<snip>
I know, you said and whilst I'm obviously flattered I'm not really
interested in 'that sort of thing'. ;-(

Don't snip the squirrel analogy.
It was the only highlight of this post.

Doh, sorry. It was funny though, all be it wrong. ;-)

Post by Paladin
He's burning LiveCD # 351.

It must be more than that by now. The last was a few to send up to
Scotland for someone else to try.

If they weren't complete morons like you, you could have sent them a link.

They are not 'complete morons *either*' but I can still see how you
could jump to that conclusion with your massively limited
interpersonal skills.

If they are getting your help, they are "complete f-ing morons".

See, I would really love to be there when you said such to their
faces. I'd even call the ambulance for you afterwards. The thing is
(that I wouldn't have to explain to any of those you insult) that 'we
are all different' and we all have different skills and interests. You
are interested in me for example. That's far less logical than even
peoples interest in Linux (considering OS's are just a means to an
end).

Post by Paladin
Let them DL the thing themselves.

They are "utter Wintards idiots" if they need you to remotely DL ubuntu.

See above (but essentially 'yes').

Post by Paladin
Do you remotely stick a blank CD into the drive?

No, they had to do that bit for me.

Post by Paladin
Or do you talk them thru it on the phone.

No, I just open a test document on the desktop and ye use it like IM
chat. I asked that way.

Post by Paladin
You tell them "Shiny side down", "No, a blank CD,not a tea saucer".

I didn't have to in this instance, no. See, luckily they were computer
literate, ordinary people but like most ordinary people had never even
heard of Linux before.

Post by Paladin
There is the hardware error, you f>snip expletive> stooge.

Yes, that's what I just told you it probably was but before I order
them a replacement optical drive, I thought I'd see if it would boot
from a Linux CD first (as that is all we really need it to do). Plus
that way she can see if she likes the look of Linux or not.

Post by Paladin
Or, does clicking on a DL link interfere with their shoe lacing class?

Awww, poor retard ... can't imagine anything outside it's own heavily
blinkered and limited world. ;-(

I can't imagine why you and your retarded, imbred mates need a computer
at all.

Exactly what I just said. The thing is, I *know* why you 'can't
imagine', you are socially and mentally inept.

Post by Paladin
Staple a mouse to a 2x4 and place it within reach of the toilet.

Oh dear. The poor retard can't compete with logic and facts so (as
usual) resorts to some mental babbling's. ;-(

Cheers, T i m

Jonathan N. Little

2013-09-21 02:42:07 UTC

I am kind of interest too, since for most folks it will be the same
default file if you have not done any customizations. Here you go, knock
yourself out!

***@kenny:~$ cat .bashrc
# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
[ -z "$PS1" ] && return

# don't put duplicate lines or lines starting with space in the history.
# See bash(1) for more options
HISTCONTROL=ignoreboth

# append to the history file, don't overwrite it
shopt -s histappend

# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
HISTSIZE=1000
HISTFILESIZE=2000

# check the window size after each command and, if necessary,
# update the values of LINES and COLUMNS.
shopt -s checkwinsize

# If set, the pattern "**" used in a pathname expansion context will
# match all files and zero or more directories and subdirectories.
#shopt -s globstar

# make less more friendly for non-text input files, see lesspipe(1)
[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then
debian_chroot=$(cat /etc/debian_chroot)
fi

# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
xterm-color) color_prompt=yes;;
esac

# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
#force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
# We have color support; assume it's compliant with Ecma-48
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
# a case would tend to support setf rather than setaf.)
color_prompt=yes
else
color_prompt=
fi
fi

if [ "$color_prompt" = yes ]; then

PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$
'
else
PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ '
fi
unset color_prompt force_color_prompt

# If this is an xterm set the title to ***@host:dir
case "$TERM" in
xterm*|rxvt*)
PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1"
;;
*)
;;
esac

# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval
"$(dircolors -b)"
alias ls='ls --color=auto'
#alias dir='dir --color=auto'
#alias vdir='vdir --color=auto'

alias grep='grep --color=auto'
alias fgrep='fgrep --color=auto'
alias egrep='egrep --color=auto'
fi

# some more ls aliases
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'

# Add an "alert" alias for long running commands. Use like so:
# sleep 10; alert
alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal
|| echo error)" "$(history|tail -n1|sed -e
'\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'

# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.

if [ -f ~/.bash_aliases ]; then
. ~/.bash_aliases
fi

# enable programmable completion features (you don't need to enable
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
# sources /etc/bash.bashrc).
if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
. /etc/bash_completion
fi

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Mach2

2013-09-21 02:59:02 UTC

I am kind of interest too, since for most folks it will be the same
default file if you have not done any customizations. Here you go, knock
yourself out!
# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples
# If not running interactively, don't do anything
[ -z "$PS1" ] && return
# don't put duplicate lines or lines starting with space in the history.
# See bash(1) for more options
HISTCONTROL=ignoreboth
# append to the history file, don't overwrite it
shopt -s histappend
# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
HISTSIZE=1000
HISTFILESIZE=2000
# check the window size after each command and, if necessary,
# update the values of LINES and COLUMNS.
shopt -s checkwinsize
# If set, the pattern "**" used in a pathname expansion context will
# match all files and zero or more directories and subdirectories.
#shopt -s globstar
# make less more friendly for non-text input files, see lesspipe(1)
[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"
# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "$debian_chroot" ] && [ -r /etc/debian_chroot ]; then
debian_chroot=$(cat /etc/debian_chroot)
fi
# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
xterm-color) color_prompt=yes;;
esac
# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
#force_color_prompt=yes
if [ -n "$force_color_prompt" ]; then
if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
# We have color support; assume it's compliant with Ecma-48
# (ISO/IEC-6429). (Lack of such support is extremely rare, and such
# a case would tend to support setf rather than setaf.)
color_prompt=yes
else
color_prompt=
fi
fi
if [ "$color_prompt" = yes ]; then
'
else
fi
unset color_prompt force_color_prompt
case "$TERM" in
xterm*|rxvt*)
;;
*)
;;
esac
# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval
"$(dircolors -b)"
alias ls='ls --color=auto'
#alias dir='dir --color=auto'
#alias vdir='vdir --color=auto'
alias grep='grep --color=auto'
alias fgrep='fgrep --color=auto'
alias egrep='egrep --color=auto'
fi
# some more ls aliases
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'
# sleep 10; alert
alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal
|| echo error)" "$(history|tail -n1|sed -e
'\''s/^\s*[0-9]\+\s*//;s/[;&|]\s*alert$//'\'')"'
# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.
if [ -f ~/.bash_aliases ]; then
. ~/.bash_aliases
fi
# enable programmable completion features (you don't need to enable
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
# sources /etc/bash.bashrc).
if [ -f /etc/bash_completion ] && ! shopt -oq posix; then
. /etc/bash_completion
fi

Here's mine...

# system-wide environment
source /etc/profile

# added path(s)
PATH=$PATH:~/bin:/sbin

# default editor
export VISUAL=vim
export EDITOR=vim

# Defining foreground variables for the prompt
P_BLACK="\[$(tput setaf 0)\]"
P_RED="\[$(tput setaf 1)\]"
P_GREEN="\[$(tput setaf 2)\]"
P_YELLOW="\[$(tput setaf 3)\]"
P_BLUE="\[$(tput setaf 4)\]"
P_MAGENTA="\[$(tput setaf 5)\]"
P_CYAN="\[$(tput setaf 6)\]"
P_WHITE="\[$(tput setaf 7)\]"
P_RESET="\[$(tput sgr0)\]"

# prompt
export PS1="$P_GREEN\u$P_RED@$P_YELLOW\h:$P_CYAN\w$P_BLUE\\$ $P_RESET"

#alias
alias tin1='tin -g news.supernews.com'
alias server1='ssh ***@server1'

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

mechanic

2013-09-21 09:27:09 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to) so let us know your home IP address and your
login account name and password and we'll start the clock running.
It will be interesting to see how long you last without compomise.

T i m

2013-09-21 11:01:27 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to)

That would mean letting go of the 'Broadcast' button first eh?

Post by mechanic
so let us know your home IP address and your
login account name and password and we'll start the clock running.
It will be interesting to see how long you last without compomise.

Bwhahaha ... have you read the lengths some of them go to when doing
even the most basic of things on the net! "This account will self
destruct in 5 seconds ...! Bwhahahaha!

I don't think there is enough silver foil made to get them to go along
with any of that!

Cheers, T i m

Jonathan N. Little

2013-09-21 12:51:35 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to)

If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it. That would be like saying your
refrigerator is a home security vulnerability when really if the
burglars have access you your refrigerator it was that lack of a lock on
your front door which was the *real* vulnerability.

Post by mechanic
so let us know your home IP address and your login account name and password
and we'll start the clock running. It will be interesting to see
how long you last without compomise.

I am not sure you understand what a backdoor vulnerability is. A
backdoor vulnerability allows access *without* knowing *login account
name and password*! Back to the analogy; your house key is is not a home
security vulnerability if you hand your key to the burglars. It is just
stupidity! So what you would call it where it is typical for Windows
users to run as an administrator and either have no password (null) or
auto login? (Wasn't a real issue until Bill realized his error and
tacked networking on to Windows)

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

DecadentLinuxUserNumeroUno

2013-09-21 13:30:02 UTC

On Sat, 21 Sep 2013 08:51:35 -0400, "Jonathan N. Little"

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to)

Post by mechanic
so let us know your home IP address and your login account name and password
and we'll start the clock running. It will be interesting to see
how long you last without compomise.

He is too stupid to understand the depths of his stupidity.

A few facts:

ANY system IS ALREADY compromised when user account info is in the
hands of someone other than the actual user it was given to.

SOME systems *cannot* be compromised easily without such a blatant
break in protocol.

Linux based systems number among those which are VERY secure, and
cannot be easily compromised.

Windows based systems did not even make the list.

unknown

2013-09-21 14:36:09 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to)

If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it.

<snip>

Post by Jonathan N. Little
I am not sure you understand what a backdoor vulnerability is.

Well that makes two of us.

Let's imagine a simple networked computer, no firewalls, proxy server or
any other network middleware.

The interface to the machine is (logically) the IP address. We also need
a port, on that port will need to be some piece of software that allows
a user to gain access to the machine, this software will need to run
under some user account.

So, if we are using a conventional internet service like telnet or ssh
for example the only way I know of to gain access is to 'log in'

Post by Jonathan N. Little
A backdoor vulnerability allows access *without* knowing *login account
name and password*!

I'd be interested to know how to gain access to a *nix based multiuser
system without needing to log in in some way.

thanks

lipska

--
Lipska the Kat©: Troll hunter, sandbox destroyer
and farscape dreamer of Aeryn Sun
GNU/Linux user #560883 - http://www.linuxcounter.net

Mach2

2013-09-21 14:41:50 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

No the hackers need *access* to your account first (try reading
posts you reply to)

If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it.

<snip>

Post by Jonathan N. Little
I am not sure you understand what a backdoor vulnerability is.

Well that makes two of us.
Let's imagine a simple networked computer, no firewalls, proxy server or
any other network middleware.
The interface to the machine is (logically) the IP address. We also need
a port, on that port will need to be some piece of software that allows
a user to gain access to the machine, this software will need to run
under some user account.
So, if we are using a conventional internet service like telnet or ssh
for example the only way I know of to gain access is to 'log in'

Post by Jonathan N. Little
A backdoor vulnerability allows access *without* knowing *login account
name and password*!

I'd be interested to know how to gain access to a *nix based multiuser
system without needing to log in in some way.
thanks
lipska

He's got nothing... He can't even argue it. He opened his mouth and
thought everyone would just accept it. oops. This is the best these two
morons could come up with.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

T i m

2013-09-21 14:50:46 UTC

Post by Mach2
He's got nothing... He can't even argue it. He opened his mouth and
thought everyone would just accept it. oops. This is the best these two
morons could come up with.

I claim that Mac2 IS the nym$hitter!

Same reaction to the same people (he neither understands nor can
intimidate) and the same BS and bluster.

Cheers, T i m

DecadentLinuxUserNumeroUno

2013-09-21 15:15:47 UTC

Post by Mach2
He's got nothing... He can't even argue it. He opened his mouth and
thought everyone would just accept it. oops. This is the best these two
morons could come up with.

I claim that Mac2 IS the nym$hitter!
Same reaction to the same people (he neither understands nor can
intimidate) and the same BS and bluster.
Cheers, T i m

I work in all seven layers every day.

You get to *look at* a couple, and think you are an expert.

I can go help the production floor personnel print a new label spec
and get more done in a day than you will do in your entire life.

Mach2

2013-09-21 15:55:52 UTC

Post by DecadentLinuxUserNumeroUno
I work in all seven layers every day.
You get to *look at* a couple, and think you are an expert.
I can go help the production floor personnel print a new label spec
and get more done in a day than you will do in your entire life.

Don't mention the 7 layers. Timmy-tard will get all confused. You saw
what happened in the mint group when he got a simple error message
written in plain English. His little brain got all confused. He's like a
VIC20 with 5k of RAM. Only so much fits in there at one time. You can
explain it to him, but it's like trying to fill a small cup with a liter
of water. It just doesn't work...

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

mechanic

2013-09-21 15:30:01 UTC

Post by Mach2
He's got nothing... He can't even argue it. He opened his mouth and
thought everyone would just accept it. oops. This is the best these two
morons could come up with.

I claim that Mac2 IS the nym$hitter!
Same reaction to the same people (he neither understands nor can
intimidate) and the same BS and bluster.

And he doesn't seem to know who he's replying too in the thread.

Bit Twister

2013-09-21 15:12:17 UTC

Post by unknown
I'd be interested to know how to gain access to a *nix based multiuser
system without needing to log in in some way.

Let's see if I can provide an example.

Wish I had kept the article url as proof, but take my word for it, go
ahead and play along with this example.

lipska is surfing the web, some linux article seems of interest on
some web site. That web site has been infected with a piece of malware
which creates a process with a connection to the criminals machine
that will stay resident until lipska logs out. Take that on faith.

This process allows the criminal to run/do whatever lipska privileges
allow. I do not know what can be accomplished with the terminals used
by kde or gnome. With xterm, you can point the display to any system
which will accept it. So let's assume xterm is on the system and the
criminal runs the command xterm -display ***@ipx:0 &
At this point he sees a terminal window pop up with something like

[***@localhost ] $

Beautiful, then runs
xterm -display ***@ipx:0 -e "tail .bash_history" &
another terminal window pops up to watch for any command line activity.
He does another xterm with commands to watch for a sudo process.
something like watch "ps aux | grep sudo"

While waiting for that, he checks to see which desktop is running, and
copies in a file/script to kickoff that original sneaking process upon
lipska's next login.

As soon as lipska does any sudo command, like updates are available.
the criminal knows he can do a "sudo -i" and have immediate root access.

Piece of cake for him to start installing software of his choice.

Setting here thinking about it, I can see how it would be possible to
completely automate installation of whatever he likes. No typing required.

The system is owned by him. Now all he has to do is clean out any
tracks left by his activity and you have no clue what was done, and he
has installed the backdoor of his choice based on whatever you already
have installed, extra distribution software he installed, or his
custom software.

Did he need an id/pw and have to log into your system. No.
Will he need an id/pw in the future, no.

T i m

2013-09-21 15:46:48 UTC

On Sat, 21 Sep 2013 15:12:17 +0000 (UTC), Bit Twister
<***@mouse-potato.com> wrote:

<snip story>

Post by Bit Twister
Did he need an id/pw and have to log into your system. No.
Will he need an id/pw in the future, no.

This sounds very much like the story from one of the few books I've
read, 'The Cuckoo's egg'.

Cheers, T i m

mechanic

2013-09-21 15:27:06 UTC

Post by Jonathan N. Little
If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it.

No just accessing your account doesn't give the bad guys ownership
of your machine, access to root does. That can be done via
substituting your .bashrc file with one with some nasty shell
spawning stuff in it, giving the bad guys the access they need next
time you run some innocent command in your account - it's called an
Escalation of Privilege exploit - just one example of many pathways
to their goal no doubt. No-one's interested in your rather boring
file, it's the machine that people want to exploit. It's a system
vulnerability people look out for to exploit - a backdoor.

Mach2

2013-09-21 15:37:40 UTC

Post by Jonathan N. Little
If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it.

Explain it. You can't can you? LOL. You don't know how it works and you
don't know what is required. You've had all day to read everything you
can on Google. Even ask others for help, and you still can't explain it
can you?

Who was your teacher? Tim? I'd get a refund...

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

DecadentLinuxUserNumeroUno

2013-09-21 16:11:54 UTC

Post by Jonathan N. Little
If they have "access" to it then you are *already* compromised, your
.bashrc had nothing to do with it.

Google retards amaze me.

LOOK, IDIOT... You MUST ALREADY HAVE ACCESS to set up your 'magical
exploit'. Try it from an external attempt. You will fail.

You absolute fucking idiot.

DecadentLinuxUserNumeroUno

2013-09-21 13:04:37 UTC

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

Right. Now get in WITHOUT a user name and password, you fucking
absolute IDIOT!

Mach2

2013-09-21 13:49:57 UTC

Post by DecadentLinuxUserNumeroUno

Post by Jonathan N. Little
I am kind of interest too, since for most folks it will be the
same default file if you have not done any customizations. Here
you go, knock yourself out!

Right. Now get in WITHOUT a user name and password, you fucking
absolute IDIOT!

Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Bit Twister

2013-09-21 14:04:02 UTC

Post by Mach2
Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

You already know the troll is grinning ear to ear in anticipation of
getting you to respond.

As you can see, the troll has decided he has gleamed all the important
information from this thread, and is ready to see how long it will
take for him and his followers to destroy the thread.

Glad to see you poking the troll so can defend himself from your
uncalled for vicious attack upon his integrity and knowledge. :(

Mach2

2013-09-21 14:07:36 UTC

Post by Mach2
Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

You already know the troll is grinning ear to ear in anticipation of
getting you to respond.
As you can see, the troll has decided he has gleamed all the important
information from this thread, and is ready to see how long it will
take for him and his followers to destroy the thread.
Glad to see you poking the troll so can defend himself from your
uncalled for vicious attack upon his integrity and knowledge. :(

They have an advantage. They put out misinformation and if not corrected
it appears to be true to others. If you respond you grant them their
little party. They're just assholes to begin with.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Jonathan N. Little

2013-09-21 14:21:51 UTC

Post by Mach2
Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

You already know the troll is grinning ear to ear in anticipation of
getting you to respond.
As you can see, the troll has decided he has gleamed all the important
information from this thread, and is ready to see how long it will
take for him and his followers to destroy the thread.
Glad to see you poking the troll so can defend himself from your
uncalled for vicious attack upon his integrity and knowledge. :(

They have an advantage. They put out misinformation and if not corrected
it appears to be true to others. If you respond you grant them their
little party. They're just assholes to begin with.

But if you lose your temper and get vitriolic they will feed on your
frustration, and the newbies will find difficultly distinguishing
between you and them. The FUD will endure.

--
Take care,

Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com

Mach2

2013-09-21 14:30:20 UTC

Post by Mach2
Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

You already know the troll is grinning ear to ear in anticipation of
getting you to respond.
As you can see, the troll has decided he has gleamed all the important
information from this thread, and is ready to see how long it will
take for him and his followers to destroy the thread.
Glad to see you poking the troll so can defend himself from your
uncalled for vicious attack upon his integrity and knowledge. :(

They have an advantage. They put out misinformation and if not corrected
it appears to be true to others. If you respond you grant them their
little party. They're just assholes to begin with.

But if you lose your temper and get vitriolic they will feed on your
frustration, and the newbies will find difficultly distinguishing
between you and them. The FUD will endure.

These guys are idiots. I'm not too worried about them. Just read their
responses. They got nothing. Too stupid to even mount credible FUD. I'm
not even close to losing my temper.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

T i m

2013-09-21 14:47:23 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them.

So you are a 'bit' worried then right?

Post by Mach2
Just read their
responses.

Yes, please do, and then you just can't help replying can you!

Post by Mach2
They got nothing.

I got a CNE cert. Poor little 'Paper CNE'!

Post by Mach2
Too stupid to even mount credible FUD.

But can mount volumes easily on Netware without having to learn Latin.
What was it for vi? 420 pages of manual? !!! Bwhahaha. !!!

Post by Mach2
I'm
not even close to losing my temper.

Yes you are, we have already seen it with all the frustration and
expletives ... and no wonder, hanging there from a hook in your lip,
that would hurt anyone!

Poor Neddkins! Here you are losing it!

Cheers, T i m

mechanic

2013-09-21 15:33:37 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them. Just read
their responses. They got nothing. Too stupid to even mount
credible FUD. I'm not even close to losing my temper.

Great contribution to this part of the thread mate. Your last four
or five posts have been pure name-calling content light fluff.

T i m

2013-09-21 15:56:46 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them. Just read
their responses. They got nothing. Too stupid to even mount
credible FUD. I'm not even close to losing my temper.

Great contribution to this part of the thread mate. Your last four
or five posts have been pure name-calling content light fluff.

This is the DLNU character coming to the fore, as it was bound to do
sooner or later.

It's the naivety of him that give it away. Social ineptitude etc. They
can't help showing themselves for what they are because they aren't
suitably equipped, like a child trying to convince you they didn't do
something bad when it's written all over their face (if you can 'see'
such things and I believe there are videos of facial expressions to
help these poor devils learn).

Cheers, T i m

<http://www.autism.org.uk/living-with-autism/communicating-and-interacting/social-skills/social-skills-for-adolescents-and-adults.aspx>

Mach2

2013-09-21 16:01:29 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them. Just read
their responses. They got nothing. Too stupid to even mount
credible FUD. I'm not even close to losing my temper.

Great contribution to this part of the thread mate. Your last four
or five posts have been pure name-calling content light fluff.

This is the DLNU

[yawn...]

I saw this show already. Get some new material already, you're boring.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Mach2

2013-09-21 16:10:05 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them. Just read
their responses. They got nothing. Too stupid to even mount
credible FUD. I'm not even close to losing my temper.

Great contribution to this part of the thread mate. Your last four
or five posts have been pure name-calling content light fluff.

This is the DLNU

[yawn...]
I saw this show already. Get some new material already, you're boring.

I found Tim!!!

Go to 24 seconds on this...

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Paladin

2013-09-21 16:15:00 UTC

Post by Mach2
I saw this show already. Get some new material already, you're boring.

I found Tim!!!
Go to 24 seconds on this...
http://youtu.be/PpccpglnNf0

LOL.
It's what "phone support" from T i m sounds like.

--
Many people are desperately looking for some wise advice which will
recommend that they do what they want to do.

mechanic

2013-09-21 16:12:07 UTC

Post by Mach2
These guys are idiots. I'm not too worried about them. Just read
their responses. They got nothing. Too stupid to even mount
credible FUD. I'm not even close to losing my temper.

Great contribution to this part of the thread mate. Your last four
or five posts have been pure name-calling content light fluff.

This is the DLNU character coming to the fore, as it was bound to do
sooner or later.
It's the naivety of him that give it away. Social ineptitude etc.

Yes young Mach2 started well being polite and enquiring, then
gradually the mask started to slip as he ingratiated himself with
Sheldon the fantasist, and put out ever longer blog-like posts about
his daily activities. Now I see he's taken to being rude and
offensive with his use of words you don't see in the Guardian. I've
lost patience with him some time ago and don't generally read his
stuff any more - there are just too many of these clueless script
kiddies on here to bother with. Does he have a fine arts degree?

Mike Yetto

2013-09-21 14:40:17 UTC

In a world where Mach2 <***@hushmail.com>
posts to Usenet.

Post by Mach2
Mechanic and Tim for that matter are two of the biggest idiots I've ever
seen. That they can write this horse shit with a straight face is beyond
words.

Need I point out that you can't actually see their faces while
they are writing their posts?

Mike "for which we (TINW) should be grateful" Yetto

--
"The beginning of wisdom is found in doubting; by doubting we
come to the question, and by seeking we may come upon the truth."
- Pierre Abelard

DecadentLinuxUserNumeroUno

2013-09-21 01:13:57 UTC

Your .bashrc file??? Why would that gain anyone access beyond whatever
they have inherent in my account? Please explain.

He is an idiot. The ONLY way someone could "get in" is if someone LET
HIM IN. THEN, he could "do things".

His fucking brain has "been rooted". By the T i m retard.

crankypuss

2013-09-21 07:36:54 UTC

Your .bashrc file??? Why would that gain anyone access beyond whatever
they have inherent in my account? Please explain.

Nobody gives a damn about your .bashrc file except you. I thought I had
"mechanic" in the moron file. Maybe I took him out for a reason. We'll
see.

mechanic

2013-09-21 09:30:03 UTC

Post by Mach2
Your .bashrc file??? Why would that gain anyone access beyond
whatever they have inherent in my account? Please explain.

Nobody gives a damn about your .bashrc file except you. I
thought I had "mechanic" in the moron file. Maybe I took him out
for a reason. We'll see.

Would you let anyone substitute another file for your .bashrc file?
I thought not. Read up some more on how vulnerable Unix systems have
been hacked in the past.

crankypuss

2013-09-21 10:39:37 UTC

Post by Mach2
Your .bashrc file??? Why would that gain anyone access beyond
whatever they have inherent in my account? Please explain.

Nobody gives a damn about your .bashrc file except you. I
thought I had "mechanic" in the moron file. Maybe I took him out
for a reason. We'll see.

Would you let anyone substitute another file for your .bashrc file?

Who gives a shit? It doesn't do anything outside of bash, it's mostly
irrelevant.

Post by mechanic
I thought not. Read up some more on how vulnerable Unix systems have
been hacked in the past.

Moron.

Mach2

2013-09-21 13:47:47 UTC

Post by Mach2
Your .bashrc file??? Why would that gain anyone access beyond
whatever they have inherent in my account? Please explain.

Nobody gives a damn about your .bashrc file except you. I
thought I had "mechanic" in the moron file. Maybe I took him out
for a reason. We'll see.

Would you let anyone substitute another file for your .bashrc file?
I thought not. Read up some more on how vulnerable Unix systems have
been hacked in the past.

That's the best you can do? You don't know shit. You can't explain how
it works at all can you fuck-tard? And even if you could, I'd be ready
to shoot you down again. You don't know what you're talking about.

You're such a retard it boggles the mind.

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

Mach2

2013-09-21 14:02:15 UTC

Post by Mach2
Your .bashrc file??? Why would that gain anyone access beyond
whatever they have inherent in my account? Please explain.

Nobody gives a damn about your .bashrc file except you. I
thought I had "mechanic" in the moron file. Maybe I took him out
for a reason. We'll see.

Would you let anyone substitute another file for your .bashrc file?
I thought not. Read up some more on how vulnerable Unix systems have
been hacked in the past.

No you stupid cunt, the hack you refer to isn't a hack in the first
place because by your own admission it requires you to already have
access. I'll try to explain it in retard lingo so you might get it. If
the door is wide fucking open in your house and a stranger walks in
through the front door, which is open you retard, did the stranger break
in? NO. The door was open. He simply entered the house.

You're such a retard you don't know the difference.

Breaking in means I have to BREAK in. You're so dumb you don't even know
what the supposed hack is you're referring to. That's why I asked you to
explain it. If you did try to explain it you might have realized the
grave error you made. But instead you chose to attempt to act like you
know something with your little lame ass paragraph which does nothing to
describe the supposed hack.

If someone already has access to your system, then they can do anything.
I can boot off a live CD, assume root of my OS, mount your hard drive
and bypass any security aside from drive encryption because your OS
isn't loaded and thus your OS is not in charge of handling security,
mine is.

If I have physical access to your machine, I can just walk away with it.
I can hit it with a hammer. I can take the drive out and walk away with it.

If I have access to an account I can install a key logger. I can create
another account and log into that. I can do any number of things. The
point is, when someone already has access to your machine then you can't
say they broke in. The door was already open. Do you get it retard? Are
you seriously this stupid that you don't understand that? How the hell
do you even have a job if you are this stupid?

--
Mach2
A member of the Linux Foundation
http://www.linuxfoundation.org

crankypuss

2013-09-21 07:33:56 UTC

Post by unknown

Post by unknown
Well this is all very interesting I'm sure but does anyone really
understand what a 'backdoor' really is?

I would say it is a hard coded reliable method of access giving that
non-authorized person/process complete access to every thing in the
system.

So, on *nix based systems some kind of account then, everything has to
run under some kind of account doesn't it?

I think that "blob driver" don't need no steenking account.

DecadentLinuxUserNumeroUno

2013-09-20 12:03:02 UTC