Microsoft Windows XP was the first consumer version that is used by most of the home and business users, which comes with three different service packs following with SP1, SP2 and SP3 (final in 2008).
Hi, wondering if you could help me? I have a genuine copy of windows that I had to reinstall after replacing a bust hard drive. I got a message saying the copy of windows may be fraudulent (after entering my product code)
I have deployed Linux on the desktop (RH8+Ximian to RH9+StarOffice) in an enterprise and they do not suffer from such problems for long.
1) The only network service the desktop systems expose is OpenSSH and the Iptables limit access from only three addresses.( We use a custom script with ssh to keep the systems rpms uptodate from a private mirror).
2) The iptables are configured to allow the desktops client services to connect only to the specified server.
3) The /usr partions are mounted read only and the /tmp, /home, /var directories are mounted non executable.
4) None of the users have, or need, root access. They have access to printer setting etc via Webmin's Usermin which runs on a dedicated server.
5) Mounting the users home directory required shares etc ( we use Samba for domain, file and print services ) is performed by script when the user logs in.
6) We update all the desktops within minutes of a updated RPM package becoming available. The window of opportunity for any disclosed vulnerability is very small.
7) We schedule Tripwire to check the intergrity of the desktops a couple time a day. Not quite. Just secure the desktops the right way Posted Mar 15, 2004 23:57 UTC (Mon) by paulj (subscriber, #341) [Link]
However, that grain is suspended in a large greasy globule of FUD.We (the FOSS, free and open source software communities) don't have to tolerate software or hardware monocultures. We can run Linux *and* any of the various *BSD flavors; we can run Linux (or NetBSD or OpenBSD) on many other hardware architectures; we can run alternatives to almost any software (many web servers, at least 4 major MTAs, a handful of DNS servers, even alternatives to sshd and for time synchronization). And there exist a number of different kernel security hardening patches (LIDS, GRSecurity, LOMAC, RSBAC, SELinux, syslinux, etc).So, no single bug need threaten more than a minority of us.Also the modularity and process protection model in Linux is substantially more effective than the practice evident in Microsoft's Windows OS, IIS, Exchange and other products. Theoretically they offer more elaborate protections in the OS, but in practice their own code is given permission to penetrate so many of these isolation semantics that the theory is practically a lie.If someone breaks my Apache processes with a remote, arbitrary code exploit, they've gained access to "Mr. Webserver" The default installation and configuration of Linux somewhat limits what "Mr. Webserver" can do to the rest of the system and a competent, professional Linux system administrator will routinely tighten that up much more.Competent systems administration makes a huge difference in either case. However, I would argue that a competent UNIX or Linux systems administrator can have a much greater impact on the security, stability and performance of their systems than a comparably trained and experienced NT/W2K/XP/ME administrator.For instance I can easily lock down sshd so that connections are only accepted from specific hosts, so that passwords are never accepted, public/private keypairs are required, so that specific accounts can only be used to execute specific commands, and so that there are multiple levels of this protection going on (through iptables/ipchains/ipfwadm *and* the TCP Wrappers and internal hosts ACLs in sshd itself, as well as with chroot jails, systrace wrappers, etc). I routinely lock down my servers to only permit a couple of specific "management stations" to access their ssh services; and I set up liaison systems which are similarly restricted for transferring data to and from "business partners" (or vendors and customers).That's a simple example, but it means that a bug in sshd can't spread directly from an arbitrary attacker or compromised system into my systems. The liaison systems become vulnerable only after one of my partners, vendors or strategic customers is compromised and that vulnerability is still limited to a chroot jail and a non-root account (probably) while my servers are secure until my internal management stations are compromised. In other words it's easy to put in these "firestops." (In the construction trades a firewall is a wall that extends from foundation to the roof and from one exterior wall to another, a firestop is a block of material, usually wood, between studs within a wall to limit and slow the spread of a file up through the inside of a wall --- reduce the drafting through wall segments which would otherwise act as chimneys, drawing oxygen more quickly and causing the fire to burn hotter).By simply limiting the peers to protocols like ssh, snmp, and NTP we mitigate some of the risks that these privileged pockets of software monoculture pose. That's why I refer to them as firestops.As another example we generally configure a small set of border NTP servers which can only receive NTP peering traffic from a limited set of external sources, sometimes we isolate those with a "protocol lock" using rdate across the firewall rather than NTP. Then the interior systems only use NTP to the internal NTP servers. In any case only a limited number of external hosts could exploit an NTP bug to compromise a border system. If a protocol lock is employed then a different bug (one that can propagate through this alternative time synchronization protocol) must be used to get through it. Even without that the systems administrators have time to be alerted to the problem and to temporarily block that service, update the border systems, etc. (Also it's notable that there are patches to the stock xntpd that use the Linux "capabilities" (from the POSIX.1e draft proposal) to allow that daemon to run as "nobody" with only the permissions necessary to adjust the system time --- it's also possible to write a trivial wrapper around xntpd using the lcap/lcap2 package (with sucap or execcap).Using systrace to jail programs like xntpd, BIND (named) etc is even better, somewhat easier, and is portable to OpenBSD/NetBSD, and MacOS X
as well. I would like to see it deployed more widely and adopted as a tool across all versions of UNIX.Granted that are far too few sites, distributions and software packages that are making use of all these techniques and options. However, the features exist for Linux, the knowlege is readily available, and the tools are free for the taking.Jim Mainstream means more malicious code for Linux (SearchSecurity.com) Posted Mar 16, 2004 9:20 UTC (Tue) by beejaybee (guest, #1581) [Link]
Fact of the matter is, everything built by Man (or Woman) is imperfect; there always will be security weaknesses, and some of them will inevitably be exploited in the real world. Nevertheless Windows has always had a "security" policy based on obscurity and a pack-everything-in-and-obfuscate (by deep application links into the kernel) design philosophy. The open source model (make source code avaiable for peer review, make every application do one thing only but do it well, maintain a clear distinction between OS kernel and application) is so obviously better that I really don't see that there is much of a case to answer.However, despite this wonderful piece of FUD, we can't be complacent - software designers need to "think secure", and the peer review really needs to be done, not just paid lip service to. Mainstream means more malicious code for Linux (SearchSecurity.com) Posted Mar 16, 2004 9:45 UTC (Tue) by jwharmanny (guest, #971) [Link]
As stated in Information Power'. Building Partnerships for Learning (American Association of School Librarians & Association for Educational Communications and Technology, 1998), the three basic ideas that underlie the vision of school library programs are collaboration, leadership, and technology. Outstanding teacher-librarians embody these three themes as clear, visible components within their programs. Evidence of this three-faceted vision is perfectly orchestrated through such an in-service as presented here. Through collaboration, the teacher-librarian determines a point of need for the faculty; through leadership, the teacher-librarian connects practical knowledge with skills needed by the teachers as home computer users; and through technology, the teacher-librarian helps to build not only an instructional connection with faculty but also a personal relationship that reflects a genuine desire to be of service through the school library program.
d0d94e66b7