00000004.htm

来自「一份很好的linux入门资料」· HTM 代码 · 共 212 行 · 第 1/2 页

No&nbsp;known&nbsp;tool&nbsp;for&nbsp;security&nbsp;updates&nbsp;&nbsp;<BR>
&nbsp;<BR>
These&nbsp;are&nbsp;all&nbsp;mainstream&nbsp;Linux&nbsp;distributions,&nbsp;tending&nbsp;towards&nbsp;a&nbsp;&nbsp;<BR>
general&nbsp;audience;&nbsp;at&nbsp;the&nbsp;least,&nbsp;they're&nbsp;not&nbsp;aiming&nbsp;at&nbsp;the&nbsp;router&nbsp;&nbsp;<BR>
market&nbsp;or&nbsp;the&nbsp;embedded&nbsp;devices&nbsp;market.&nbsp;These&nbsp;are&nbsp;all&nbsp;products&nbsp;intended&nbsp;&nbsp;<BR>
to&nbsp;be&nbsp;used&nbsp;by&nbsp;normal&nbsp;people&nbsp;and&nbsp;thrown&nbsp;up&nbsp;on&nbsp;a&nbsp;corporate&nbsp;network&nbsp;or&nbsp;even&nbsp;<BR>
&nbsp;the&nbsp;Internet.&nbsp;Some&nbsp;may&nbsp;be&nbsp;aimed&nbsp;at&nbsp;relatively&nbsp;expert&nbsp;users,&nbsp;but&nbsp;I'm&nbsp;a&nbsp;&nbsp;<BR>
fairly&nbsp;advanced&nbsp;user&nbsp;myself,&nbsp;and&nbsp;I&nbsp;still&nbsp;expect&nbsp;that&nbsp;my&nbsp;software&nbsp;&nbsp;<BR>
distributor&nbsp;is&nbsp;watching&nbsp;out&nbsp;for&nbsp;security&nbsp;at&nbsp;least&nbsp;minimally.&nbsp;That's&nbsp;&nbsp;<BR>
one&nbsp;of&nbsp;the&nbsp;reasons&nbsp;I&nbsp;don't&nbsp;roll&nbsp;my&nbsp;own&nbsp;distribution.&nbsp;<BR>
&nbsp;<BR>
Of&nbsp;the&nbsp;eight&nbsp;common&nbsp;distributions&nbsp;I&nbsp;could&nbsp;think&nbsp;of,&nbsp;three&nbsp;have&nbsp;nothing&nbsp;&nbsp;<BR>
whatsoever&nbsp;to&nbsp;do&nbsp;with&nbsp;security,&nbsp;and&nbsp;at&nbsp;least&nbsp;one&nbsp;of&nbsp;the&nbsp;others&nbsp;didn't&nbsp;&nbsp;<BR>
seem&nbsp;to&nbsp;be&nbsp;doing&nbsp;anything&nbsp;useful.&nbsp;No&nbsp;wonder&nbsp;Linux&nbsp;has&nbsp;a&nbsp;security&nbsp;&nbsp;<BR>
problem:&nbsp;while&nbsp;those&nbsp;four&nbsp;distributions&nbsp;have&nbsp;probably&nbsp;less&nbsp;than&nbsp;a&nbsp;&nbsp;<BR>
quarter&nbsp;of&nbsp;the&nbsp;Linux&nbsp;market,&nbsp;they&nbsp;tend&nbsp;to&nbsp;be&nbsp;high-profile&nbsp;&nbsp;<BR>
distributions&nbsp;which&nbsp;garner&nbsp;more&nbsp;than&nbsp;their&nbsp;share&nbsp;of&nbsp;media&nbsp;coverage.&nbsp;<BR>
&nbsp;<BR>
These&nbsp;distributions&nbsp;aren't&nbsp;just&nbsp;putting&nbsp;their&nbsp;users&nbsp;at&nbsp;risk;&nbsp;they're&nbsp;&nbsp;<BR>
damaging&nbsp;Linux's&nbsp;credibility&nbsp;and&nbsp;its&nbsp;image&nbsp;in&nbsp;the&nbsp;marketplace.&nbsp;Every&nbsp;&nbsp;<BR>
time&nbsp;I'm&nbsp;asked&nbsp;by&nbsp;a&nbsp;reporter&nbsp;why&nbsp;Linux&nbsp;is&nbsp;so&nbsp;insecure,&nbsp;I&nbsp;have&nbsp;to&nbsp;&nbsp;<BR>
consider&nbsp;Caldera,&nbsp;Corel,&nbsp;Turbo&nbsp;Linux,&nbsp;and&nbsp;Slackware&nbsp;before&nbsp;I&nbsp;can&nbsp;answer.&nbsp;<BR>
&nbsp;These&nbsp;distributions'&nbsp;total&nbsp;lack&nbsp;of&nbsp;concern&nbsp;with&nbsp;security&nbsp;is&nbsp;an&nbsp;&nbsp;<BR>
embarrassment&nbsp;to&nbsp;the&nbsp;entire&nbsp;Linux&nbsp;and&nbsp;Open-Source&nbsp;communities.&nbsp;<BR>
&nbsp;<BR>
Because&nbsp;of&nbsp;these&nbsp;distributions,&nbsp;I'm&nbsp;forced&nbsp;to&nbsp;admit&nbsp;to&nbsp;reporters&nbsp;that&nbsp;&nbsp;<BR>
many&nbsp;Linux&nbsp;installations&nbsp;are&nbsp;insecure,&nbsp;and&nbsp;there's&nbsp;little&nbsp;the&nbsp;average&nbsp;&nbsp;<BR>
user&nbsp;can&nbsp;do&nbsp;about&nbsp;it&nbsp;without&nbsp;dedicating&nbsp;an&nbsp;inordinate&nbsp;amount&nbsp;of&nbsp;time&nbsp;&nbsp;<BR>
to&nbsp;security&nbsp;work.&nbsp;Most&nbsp;users&nbsp;aren't&nbsp;paid&nbsp;to&nbsp;worry&nbsp;about&nbsp;security,&nbsp;as&nbsp;I&nbsp;&nbsp;<BR>
am.&nbsp;For&nbsp;many,&nbsp;computing&nbsp;may&nbsp;be&nbsp;only&nbsp;a&nbsp;small&nbsp;part&nbsp;of&nbsp;their&nbsp;work.&nbsp;These&nbsp;&nbsp;<BR>
people&nbsp;can't&nbsp;rightly&nbsp;be&nbsp;asked&nbsp;to&nbsp;read&nbsp;Bugtraq;&nbsp;they've&nbsp;got&nbsp;work&nbsp;to&nbsp;do.&nbsp;<BR>
&nbsp;<BR>
If&nbsp;only&nbsp;systems&nbsp;were&nbsp;kept&nbsp;up&nbsp;to&nbsp;patch,&nbsp;huge&nbsp;numbers&nbsp;of&nbsp;systems&nbsp;&nbsp;<BR>
wouldn't&nbsp;be&nbsp;cracked.&nbsp;On&nbsp;the&nbsp;university&nbsp;campus&nbsp;where&nbsp;I&nbsp;work,&nbsp;systems&nbsp;have&nbsp;<BR>
&nbsp;been&nbsp;exploited&nbsp;using&nbsp;the&nbsp;automount&nbsp;daemon&nbsp;bug&nbsp;which&nbsp;is&nbsp;more&nbsp;than&nbsp;a&nbsp;year&nbsp;<BR>
&nbsp;old,&nbsp;and&nbsp;which&nbsp;has&nbsp;been&nbsp;patched&nbsp;nearly&nbsp;that&nbsp;long.&nbsp;Being&nbsp;a&nbsp;professional,&nbsp;<BR>
&nbsp;I&nbsp;know&nbsp;that&nbsp;they&nbsp;shouldn't&nbsp;even&nbsp;be&nbsp;running&nbsp;it,&nbsp;because&nbsp;I&nbsp;know&nbsp;that&nbsp;&nbsp;<BR>
they're&nbsp;not&nbsp;using&nbsp;it.&nbsp;But&nbsp;I&nbsp;can't&nbsp;expect&nbsp;them&nbsp;to&nbsp;know,&nbsp;and&nbsp;I&nbsp;can't&nbsp;&nbsp;<BR>
even&nbsp;fix&nbsp;it&nbsp;myself:&nbsp;I&nbsp;didn't&nbsp;know&nbsp;that&nbsp;some&nbsp;of&nbsp;these&nbsp;machines&nbsp;existed&nbsp;&nbsp;<BR>
until&nbsp;I&nbsp;found&nbsp;out&nbsp;that&nbsp;they'd&nbsp;been&nbsp;hacked.&nbsp;Asking&nbsp;these&nbsp;users&nbsp;to&nbsp;read&nbsp;&nbsp;<BR>
a&nbsp;single,&nbsp;low-volume,&nbsp;vendor-specific&nbsp;mailing&nbsp;list&nbsp;is&nbsp;a&nbsp;pretty&nbsp;good&nbsp;&nbsp;<BR>
solution&nbsp;--&nbsp;when&nbsp;those&nbsp;lists&nbsp;exist.&nbsp;<BR>
&nbsp;<BR>
Experienced&nbsp;users&nbsp;should&nbsp;abandon&nbsp;Linux&nbsp;distributions&nbsp;which&nbsp;don't&nbsp;provide&nbsp;<BR>
&nbsp;security&nbsp;fixes&nbsp;in&nbsp;a&nbsp;timely&nbsp;manner&nbsp;and&nbsp;post&nbsp;that&nbsp;information&nbsp;to&nbsp;a&nbsp;Web&nbsp;&nbsp;<BR>
site,&nbsp;a&nbsp;mailing&nbsp;list,&nbsp;or&nbsp;both.&nbsp;They&nbsp;should&nbsp;abandon&nbsp;these&nbsp;distributions&nbsp;&nbsp;<BR>
not&nbsp;because&nbsp;they&nbsp;necessarily&nbsp;need&nbsp;the&nbsp;security&nbsp;notices&nbsp;for&nbsp;themselves,&nbsp;&nbsp;<BR>
but&nbsp;because&nbsp;these&nbsp;distributions&nbsp;are&nbsp;ruining&nbsp;Linux's&nbsp;image&nbsp;not&nbsp;only&nbsp;&nbsp;<BR>
with&nbsp;novice&nbsp;users,&nbsp;but&nbsp;with&nbsp;the&nbsp;reporters&nbsp;and&nbsp;editors&nbsp;who&nbsp;shape&nbsp;&nbsp;<BR>
managers'&nbsp;opinions&nbsp;on&nbsp;whether&nbsp;Linux&nbsp;is&nbsp;a&nbsp;viable&nbsp;solution.&nbsp;<BR>
&nbsp;<BR>
You&nbsp;may&nbsp;claim&nbsp;that&nbsp;you're&nbsp;a&nbsp;hobbyist,&nbsp;and&nbsp;you&nbsp;couldn't&nbsp;care&nbsp;less&nbsp;if&nbsp;&nbsp;<BR>
businesses&nbsp;use&nbsp;Linux;&nbsp;that's&nbsp;your&nbsp;right,&nbsp;certainly.&nbsp;However,&nbsp;you&nbsp;lose&nbsp;&nbsp;<BR>
nothing&nbsp;when&nbsp;businesses&nbsp;use&nbsp;Linux,&nbsp;you&nbsp;lose&nbsp;nothing&nbsp;when&nbsp;security&nbsp;&nbsp;<BR>
updates&nbsp;are&nbsp;made&nbsp;available&nbsp;and&nbsp;publicized,&nbsp;and&nbsp;you&nbsp;gain&nbsp;nothing&nbsp;when&nbsp;&nbsp;<BR>
businesses&nbsp;reject&nbsp;Linux&nbsp;because&nbsp;some&nbsp;vendor&nbsp;couldn't&nbsp;be&nbsp;bothered&nbsp;to&nbsp;&nbsp;<BR>
package&nbsp;up&nbsp;an&nbsp;already&nbsp;publicly-available&nbsp;solution&nbsp;to&nbsp;a&nbsp;security&nbsp;hole.&nbsp;<BR>
&nbsp;<BR>
The&nbsp;rest&nbsp;of&nbsp;us&nbsp;do&nbsp;lose.&nbsp;It&nbsp;hurts&nbsp;our&nbsp;professional&nbsp;reputations&nbsp;when&nbsp;we&nbsp;&nbsp;<BR>
stand&nbsp;behind&nbsp;a&nbsp;piece&nbsp;of&nbsp;software&nbsp;with&nbsp;frequent&nbsp;and&nbsp;highly-publicized&nbsp;&nbsp;<BR>
security&nbsp;lapses.&nbsp;It&nbsp;wastes&nbsp;our&nbsp;time,&nbsp;tracking&nbsp;down&nbsp;hacked&nbsp;user&nbsp;&nbsp;<BR>
machines&nbsp;for&nbsp;which&nbsp;we're&nbsp;not&nbsp;responsible&nbsp;and&nbsp;rebuilding&nbsp;them&nbsp;from&nbsp;the&nbsp;&nbsp;<BR>
ground&nbsp;up.&nbsp;It&nbsp;wastes&nbsp;our&nbsp;money,&nbsp;when&nbsp;businesses&nbsp;and&nbsp;government&nbsp;&nbsp;<BR>
agencies&nbsp;buy&nbsp;more&nbsp;expensive&nbsp;hardware&nbsp;and&nbsp;software&nbsp;for&nbsp;the&nbsp;illusion&nbsp;of&nbsp;&nbsp;<BR>
security.&nbsp;<BR>
&nbsp;<BR>
Solving&nbsp;this&nbsp;problem&nbsp;isn't&nbsp;difficult&nbsp;or&nbsp;time&nbsp;consuming;&nbsp;simply&nbsp;pick&nbsp;&nbsp;<BR>
distributions&nbsp;which&nbsp;express&nbsp;a&nbsp;basic&nbsp;level&nbsp;of&nbsp;concern&nbsp;for&nbsp;security&nbsp;&nbsp;<BR>
issues,&nbsp;and&nbsp;let&nbsp;vendors&nbsp;know&nbsp;--&nbsp;at&nbsp;trade&nbsp;shows,&nbsp;in&nbsp;e-mail,&nbsp;in&nbsp;letters&nbsp;to&nbsp;<BR>
&nbsp;the&nbsp;editor&nbsp;of&nbsp;your&nbsp;favorite&nbsp;publication&nbsp;--&nbsp;that&nbsp;security&nbsp;isn't&nbsp;just&nbsp;&nbsp;<BR>
about&nbsp;security.&nbsp;It's&nbsp;about&nbsp;preserving&nbsp;our&nbsp;reputation&nbsp;for&nbsp;quality,&nbsp;and&nbsp;&nbsp;<BR>
it's&nbsp;about&nbsp;saving&nbsp;time&nbsp;and&nbsp;money.&nbsp;<BR>
&nbsp;<BR>
&nbsp;<BR>
&nbsp;<BR>
------------------------------------------------------------------------&nbsp;<BR>
--------&nbsp;<BR>
&nbsp;<BR>
Jon&nbsp;Lasser&nbsp;is&nbsp;a&nbsp;Unix&nbsp;Systems&nbsp;Administrator,&nbsp;Lead&nbsp;Coordinator&nbsp;for&nbsp;the&nbsp;&nbsp;<BR>
Bastille&nbsp;Linux&nbsp;Project,&nbsp;and&nbsp;author&nbsp;of&nbsp;a&nbsp;forthcoming&nbsp;Unix&nbsp;book&nbsp;from&nbsp;&nbsp;<BR>
Macmillan&nbsp;tentatively&nbsp;titled&nbsp;Think&nbsp;Unix.&nbsp;He's&nbsp;never&nbsp;bothered&nbsp;to&nbsp;take&nbsp;a&nbsp;&nbsp;<BR>
computer&nbsp;course,&nbsp;except&nbsp;a&nbsp;single&nbsp;Pascal&nbsp;class&nbsp;in&nbsp;high&nbsp;school.&nbsp;He&nbsp;lives&nbsp;&nbsp;<BR>
in&nbsp;Baltimore&nbsp;with&nbsp;his&nbsp;wife&nbsp;Kathleen,&nbsp;and&nbsp;their&nbsp;three&nbsp;cats:&nbsp;Mallet,&nbsp;&nbsp;<BR>
Dashigara,&nbsp;and&nbsp;Spike.&nbsp;If&nbsp;for&nbsp;some&nbsp;reason&nbsp;you&nbsp;want&nbsp;to&nbsp;know&nbsp;more,&nbsp;check&nbsp;&nbsp;<BR>
out&nbsp;his&nbsp;home&nbsp;page.&nbsp;&nbsp;<BR>
&nbsp;<BR>
&nbsp;<BR>
&nbsp;<BR>
--&nbsp;<BR>
&nbsp;&nbsp;&nbsp;&nbsp;每个人都会经过这个阶段，见到一座山，就想知道山后面是什么。我很想&nbsp;<BR>
告诉他，可能翻过山后面，你会发现没什么特别。回望之下，可能会觉得这一&nbsp;<BR>
边更好。但我知道他不会听，以他的性格，自己不走过又怎会甘心？&nbsp;<BR>
&nbsp;<BR>
Welcome&nbsp;to&nbsp;DNA&nbsp;Studio:&nbsp;<A HREF="http://dnastudio.dhs.org">http://dnastudio.dhs.org</A>&nbsp;<BR>
new&nbsp;software,&nbsp;navupdate,&nbsp;wallpapers,&nbsp;mp3z,&nbsp;linux,&nbsp;forums......&nbsp;<BR>
&nbsp;<BR>
※&nbsp;来源:·BBS&nbsp;水木清华站&nbsp;smth.org·[FROM:&nbsp;202.112.85.250]&nbsp;<BR>


<CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>



</BODY>

</HTML>