OMG! 19 Year Old Vulnerability Only Now Patched????

[Virgorising]

More specifically, The relationship Google has with government agencies and how they spy, on everyone.
Which leads to the next obvious conclusion, Linux is on my daily laptop, not to mention my current Win10 test rig is my normally HDD-Free live Linux laptop. Because everyone knows you can't trust MS either since they work hand in hand with 3 letter government agencies, collecting right down to keystrokes in Win10TP.

I wouldn't be at all surprised if the reporter that is saying that she has been hacked by a government agency, if they used that exact vulnerability to gain access to her computer, and MS was told to have it there for just that reason. Just like when the NSA asked Linus Torvalds to create backdoors in Linux for them, but of course US companies would have caved to the pressure.

Thank you for this offering...however depressing it is. I mean it. But can't believe it's only US Cos who are Fausts.

 

[Virgorising]

The unfortunate fact is that all operating systems have vulnerabilities and everyone should assume there is something on their system that can be exploited. 19 years is a long time for a hole to be around, but then again Bash was vulnerable for 20 years so nothing is safe it seems.

I seem to say this to others at least twice a week re OSes and browsers. I do assume but I also do not live in fear ongoing....U try to learn and do what you can to minimize risk.

I also say....there are some hackers out there every bit as genius as they who write code the most meticulously. Nothing is impervious.

 

[RampantAndroid]

Shellshock says Hi.

But seriously, they've all got vulnerabilities and by definition the vulnerability is there *until* we stumble upon it or catch someone using it in the wild. The first rule of programming is that there's no such thing as bug-free code.

So much this. You can throw a lot of resources at testing for vulnerabilities, but a bunch still get out.

Keeping my mouth shut so I don't get called a Windows hater.

That you think this bug somehow make Windows worse than Linux (which is what I am inferring from your post) just confirms my belief that you don't have a good perspective on things.

 

[Virgorising]

So much this. You can throw a lot of resources at testing for vulnerabilities, but a bunch still get out.

That you think this bug somehow make Windows worse than Linux (which is what I am inferring from your post) just confirms my belief that you don't have a good perspective on things.

Good, perspective honing data.:thumbsup:

I was just initially gob smacked because I had no clue re this...until I learned about it. Now, the dust has settled.

 

[TheRyuu]

More specifically, The relationship Google has with government agencies and how they spy, on everyone.

I've been specifically referring to Chrome/Chromium as something separate from any Google (online) services for a reason. You have control over the software that you have installed and if you really wanted to you could start capturing packets to look for signs of "phoning home" (which you won't find).

I'm not trying to say that there isn't a relationship between the company and the government. I'm trying to say that on the software side of things the benefits outweigh the risks (where there is very little likelihood of there being any) because you have a certain amount of control over it. With Chromium you even have the src.

Just like when the NSA asked Linus Torvalds to create backdoors in Linux for them, but of course US companies would have caved to the pressure.

I seriously doubt the NSA needs backdoors inserted into the Linux kernel considering the sad state of security and lack of caring about it in the vanilla kernel. This also applies to linux in general but there has been a push in recent years to improve upon this on the software side of things (see: Debian using hardened binaries for certain services). One good thing about using Firefox on Ubuntu is I believe they ship with Appamor profile's (MAC) by default (I'm not sure about Debian). They may not be the most restrictive but it's an improvement nonetheless (and probably makes things better than on the Windows side of things with Firefox).

I like Debian, I like their package management, I have Debian on my server. I think the possibilities to secure a Linux environment are better than on Windows which is why I like it on servers. You can create a very restrictive policy with grsecurity's full system learning mode with minimal effort which is good because people will use stuff if there isn't a lot of effort involved or there isn't a large barrier to entry (this is extremely important). A counterexample to this is UAC in Vista pre-SP1 (IIRC) which was really annoying and everyone just wound up disabling it despite the benefits of having UAC enabled (you should have it enabled always).

This post may have been slightly off topic but I still think it relates to the never ending cycle of software bugs, some of which have been around for a while, and measure that can be taken to protect yourself.

 

[Skaendo]

Everything you do on any google product is logged and tracked if for nothing else 'targeted advertising'. It's not ET phoning home, it's google handing over the data that has already been collected, by using their ad targeting web and software.
http://www.huffingtonpost.com/2014/05/06/nsa-google_n_5273437.html
http://america.aljazeera.com/articles/2014/5/6/nsa-chief-google.html

I seriously doubt the NSA needs backdoors inserted into the Linux kernel considering the sad state of security and lack of caring about it in the vanilla kernel.

http://www.youtube.com/watch?v=7gRsgkdfYJ8
http://www.youtube.com/watch?v=wwRYyWn7BEo

 

[TheRyuu]

Everything you do on any google product is logged and tracked if for nothing else 'targeted advertising'. It's not ET phoning home, it's google handing over the data that has already been collected, by using their ad targeting web and software.
http://www.huffingtonpost.com/2014/05/06/nsa-google_n_5273437.html
http://america.aljazeera.com/articles/2014/5/6/nsa-chief-google.html

You've yet to make a case against Chrome/Chromium itself. Please provide real evidence against the browser itself and not a blanket "Google is evil" statement.

http://www.youtube.com/watch?v=7gRsgkdfYJ8
http://www.youtube.com/watch?v=wwRYyWn7BEo

I never said it didn't happen, I was just pointing out the security (or lack of it) of the linux kernel.