[prev in list] [next in list] [prev in thread] [next in thread] 

List:       kde-devel
Subject:    Re: One Way to Increase KDE security
From:       Thiago Macieira <thiago () kde ! org>
Date:       2005-12-27 16:24:28
Message-ID: 200512271424.28682.thiago () kde ! org
[Download RAW message or body]

[Attachment #2 (multipart/signed)]


Dave Feustel wrote:
>> > > Can you please stop making up facts about "security" every day on
>> > > this list? It wouldn't be so annoying if it actually made sense...
>
>I didn't make up a fact. I reported a technique I have tried for
> improving security which seems to work for me in practice, regardless
> of whether it makes any sense. YMMV of course.

So you made up a technique to improve security and you think it's helping 
you, even though you also report to not know anything about KDE or X's 
internals and you think they don't make any sense?

I'm sorry, but how is this helping? You could just as well be deleting 
random files and think it improves security.

>> > I didn't make this up. I have seen (network) sockets created that
>> > had no
>>
>> I think David meant that "deleting unused sockets increases security"
>> is made
>
>I do not see the word "unused" in my original text. It's important to
> quote accurately. Maybe I didn't express my thought clearly.

Right, your original text doesn't say it. My reply did: those sockets are 
no longer used.

>> up, because a socket which no one uses is obviously not a security
>> threat.
>
>It's a threat whether it's used or not. It becomes an exploit when it is
> actually used.

Please provide data to support the theory of "it's a thread when not 
used". Or stop supporting that theory.

>I know practically nothing about KDE and Xorg internals, but cleaning up
> sockets, files and processes seems to have, for the moment, eliminated
> 'spontaneous' changes to permissions of files of which I am owner. My
> counter-intrusion program is the result of experiment, not theory, but
> so far it seems to be working.

And you haven't yet established that there was an intrusion. For all we 
know, you stopped some normal, routine activity of your system.

Without hard data proving there was an intrusion (or high probability of 
one) and how it happened, this is all speculation. I'd like to ask you to 
stop labelling your speculations as security improvements.

That said, however, erasing temporary files and sockets is a good 
practice. We should be doing that when a normal exit happens. Please 
report any instances when a normal exit does not clean up after itself as 
bugs in bugs.kde.org (with, of course, instructions on how to reproduce 
the situation).
-- 
  Thiago Macieira  -  thiago (AT) macieira.info - thiago (AT) kde.org
    PGP/GPG: 0x6EF45358; fingerprint:
    E067 918B B660 DBD1 105C  966C 33F5 F005 6EF4 5358

2. Tó cennan his weorc gearu, ymbe se circolwyrde, wearð se cægbord and se 
leohtspeccabord, and þa mýs cómon lator. On þone dæg, he hine reste.

[Attachment #5 (application/pgp-signature)]

>> Visit http://mail.kde.org/mailman/listinfo/kde-devel#unsub to unsubscribe <<


[prev in list] [next in list] [prev in thread] [next in thread]