Jetico Personal Firewall freeware asks way to many questions

[kurt wismer]

Sebastian G. wrote:
> kurt wismer wrote:
>
[snip]
>>> Nonsense, it is really easy because almost every webbrowser is secury
>>> by default out-of-the-box.
>>
>> now you're just being absurd....
>
>
> Or correct. Just take a look at the major players Mozilla Firefox,
> Mozilla Seamonkey, Opera, Konqueror and w3m. Agreed, Mozilla Firefox is
> a bit obscure, but neithertheless still secure by default.

and the absurdity continues... apparently internet exploder (what most
people use to browse the web with) doesn't exist in your world, and of
the browsers that do exist firefox (of all things) is the one you
consider obscure...

>> vulnerabilities exist in most non-trivial programs whether the good
>> guys know about them or not so i will say *all* web browsers have
>> unpatched vulnerabilities and time will bear me out...
>>
>> and no, the bad guys don't depend on vulnerabilities already known to
>> the good guys... they have their own black hat researchers and their
>> own vulnerability black market...
>
> Thanks for stating the trivial exception that doesn't need to be
> discussed. Now, can you present some incidents showing any significant
> relevance?

lets just be perfectly clear, here... you want me to list documented
vulnerabilities in mainstream browsers for which there is no patch yet...

i just explained 2 things... the first was that the vulnerabilities that
the would get documented in the fashion you're looking for are not
necessarily the ones that are actually relevant to this discussion (it's
the ones that the blackhats know about but the whitehats don't that are
most relevant)...

the second was that we can take the assertion that most browsers contain
unpatched vulnerabilities as axiomatically true and let time do the work
of revealing the details of those vulnerabilities... in other words, if
browsers and all the components that plug into them never need security
updates ever again then you were right, otherwise not so much..

but, just to put the last nails in the coffin of the debate on how easy
it is to find vulnerabilities, these articles are all from the past
month and each one is about something different and has something
related to web browsing...
http://blogs.zdnet.com/security/?p=636
http://blogs.zdnet.com/security/?p=652
http://www.symantec.com/enterprise/s...ack_again.html
http://isc.sans.org/diary.html?storyid=3540
http://www.symantec.com/enterprise/s..._the_loos.html
http://securitywatch.eweek.com/apple...r_windows.html
http://www.liquidmatrix.org/blog/200...vulnerability/
http://securitywatch.eweek.com/vulne...tsoever_1.html

>>> It's hard getting exposed at all.
>>
>> no, it's not... it's quite easy because the exploits can be served
>> through mainstream sites like cnn.com...
>
>
> Exposure is measures by the vulnerabilities, not by the websites serving
> them. Who the hell cares if cnn.com serves some third-party scripts with
> malicious intends as long as the intend can't materialize into an actual
> compromise?
>
>> wrong... exposure has to do with whether you came in contact with it,
>> not whether you got compromised by it...
>
>
> In that case, exposure should be about 100% and every system would be
> compromised. Not. Without an unpatched vulnerability, that's a no-go.

it's clear to me that you are equating exposure to compromise, in spite
of the fact that (for example) you can be exposed to a biological
contagion without getting sick...

>>> ECMAScript is obviously interpreted by the webbrowser as well.
>>
>> aside from the fact that that is not the only script language out
>> there...
>
>
> Huh? It is, especially due to imply by the HTML standard. It's also that
> I have yet to see a webbrowser supporting any additional scripting
> language.

the majority of web users still use ie, ie supports additional scripting
languages, and ie's jscript interpreter is separate...

>>>> what about multimedia? what about other document formats like pdf?
>>> That's external. Do you let such things load by default or what?
>>
>> of course it's external, that's the point... rendering web content
>> normally involves external functionality in addition to what's built
>> into the browser... even rendering images is 'external' (and has been
>> a source of problems - see wmf and vml)...
>
>
> External ! embedded. And which webbrowser renders WMF and VML?

no browser does, the browser hands that job off to a different component...

>> it seems dustin is correct, i'm wasting my time here... it's
>> unreasonable to expect users to know that paypalsecurity.com is
>> registered to a different entity than paypal.com is...
>
> Sure it's reasonable, you just shouldn't expect people to be reasonable.
> Heck, when you don't know the URL syntax, then you should expect to run
> into security problems. Still it's the users fault, for intentionally
> ignoring minimum required knowledge.

oh it is reasonable? ok then i suppose i can reasonably expect you to a)
list the primary domains of all the sites you visit regularly and b)
list *every* *single* domain that is also registered to those entities...

that is essentially what you're expecting others to be able to do... so
go ahead, list away...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

[Sebastian G.]

kurt wismer wrote:


> and the absurdity continues... apparently internet exploder (what most
> people use to browse the web with) doesn't exist in your world,


It does, but it isn't a webbrowser and therefore counts as PEBKAC. It's
futile to discuss it in any security content since it's well documented to
not be supposed to provide security in a hostile environment.

> and of the browsers that do exist firefox (of all things) is the one you
> consider obscure...


Which becomes quite clear when looking at the internals of Mozilla
Seamonkey. The developers of Firefox don't even bother exposing really
important configuration options in the UI or not even at all, the coding
style of the components is horrible and full of stupid ideas (with the
firefoxurl: protocol handler being the most recent absurdity).

> i just explained 2 things... the first was that the vulnerabilities that
> the would get documented in the fashion you're looking for are not
> necessarily the ones that are actually relevant to this discussion (it's
> the ones that the blackhats know about but the whitehats don't that are
> most relevant)...


This is a principle attack vector that cannot be avoided unless you have
superior software verification mechanisms (which simply aren't practical
today). Since this is not within the decision of the vendor neither the
users, it's irrelevant to discuss.

> the second was that we can take the assertion that most browsers contain
> unpatched vulnerabilities as axiomatically true and let time do the work
> of revealing the details of those vulnerabilities... in other words, if
> browsers and all the components that plug into them never need security
> updates ever again then you were right, otherwise not so much..


You're forgetting one important detail: configuration can protect against
yet unknown vulnerabilities by reducing functional exposure.

> but, just to put the last nails in the coffin of the debate on how easy
> it is to find vulnerabilities, these articles are all from the past
> month and each one is about something different and has something
> related to web browsing...
> http://blogs.zdnet.com/security/?p=636


That's not even a vulnerability.



> http://isc.sans.org/diary.html?storyid=3540

> http://securitywatch.eweek.com/apple...r_windows.html
> http://www.liquidmatrix.org/blog/200...vulnerability/


And they're all patched already, with very short response time.

> http://blogs.zdnet.com/security/?p=652

That's about MSIE when used in a hostile environment, which was never
supposed to be secure. Thus it's not a security violation.

>
http://www.symantec.com/enterprise/s...ack_again.html
>
http://www.symantec.com/enterprise/s..._the_loos.html

> http://securitywatch.eweek.com/vulne...tsoever_1.html


And these aren't even webbrowser exploits at all.


Now is it ignorance or incompetence why you came up with these non-issues?

> it's clear to me that you are equating exposure to compromise, in spite
> of the fact that (for example) you can be exposed to a biological
> contagion without getting sick...


Oh hello, Mr. Bad Analogy Guy. The analogue world has the funny property
that you can always break a system with more brute force, whereas for
digital systems the set of input is fully enumerable (and that very trivially).

> the majority of web users still use ie, ie supports additional scripting
> languages, and ie's jscript interpreter is separate...


Abusing it as a webbrowser doesn't make it one. Of course, you don't need
any scripting, ActiveX or whatsoever to render MSIE insecure when used on
the world wide web, just like a Telnet session is always unencrypted and not
securely authenticated (which is a documented behaviour, that's why you
can't expect any security in first place).

> no browser does, the browser hands that job off to a different component...


Ok, can anyone point me over to a WMF and/or VML viewer plugin for any
decent webbrowser?

> oh it is reasonable? ok then i suppose i can reasonably expect you to a)
> list the primary domains of all the sites you visit regularly and b)
> list *every* *single* domain that is also registered to those entities...


I don't need to. I just don't create any false positive, but it's fully
secure to not trust a website belonging to an entity due to different
domain. As for your example, paypalsecurity.com doesn't belong to paypal.com
until proven otherwise, period.

[kurt wismer]

Sebastian G. wrote:
> kurt wismer wrote:
>
>> and the absurdity continues... apparently internet exploder (what most
>> people use to browse the web with) doesn't exist in your world,
>
>
> It does, but it isn't a webbrowser and therefore counts as PEBKAC. It's
> futile to discuss it in any security content since it's well documented
> to not be supposed to provide security in a hostile environment.

i see...

well, all i can say is that those things you disagree with regarding
drive-by downloading apply to the world where IE *is* a web browser -
the most popular one in fact, and firefox, rather than being the obscure
one of the bunch, is probably the second most popular...

since this doesn't appear to be the world you live in i don't think i
have anything more to say to you on the subject... i'm really not
familiar enough with the properties of your world to comment on them...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

[Sebastian G.]

kurt wismer wrote:

> Sebastian G. wrote:
>> kurt wismer wrote:
>>
>>> and the absurdity continues... apparently internet exploder (what most
>>> people use to browse the web with) doesn't exist in your world,
>>
>> It does, but it isn't a webbrowser and therefore counts as PEBKAC. It's
>> futile to discuss it in any security content since it's well documented
>> to not be supposed to provide security in a hostile environment.
>
> i see...
>
> well, all i can say is that those things you disagree with regarding
> drive-by downloading apply to the world where IE *is* a web browser -


Will you please shut up and read the documentation and/or look at the
implementation? The security model is to provide confluent protection in a
secure environment, but not in a hostile environment. And surely it doesn't
even get SGML comment pasing right, how should it ever get HTML right?

So once again: Being commonly abused as a webbrowser still doesn't make it
one. Telnet isn't a webbrowser either.

And despite your ranting, discussing security on IE is pointless, since in
your scenario it's insecure by design.

[kurt wismer]

Sebastian G. wrote:
> kurt wismer wrote:
>> Sebastian G. wrote:
>>> kurt wismer wrote:
>>>
>>>> and the absurdity continues... apparently internet exploder (what
>>>> most people use to browse the web with) doesn't exist in your world,
>>>
>>> It does, but it isn't a webbrowser and therefore counts as PEBKAC.
>>> It's futile to discuss it in any security content since it's well
>>> documented to not be supposed to provide security in a hostile
>>> environment.
>>
>> i see...
>>
>> well, all i can say is that those things you disagree with regarding
>> drive-by downloading apply to the world where IE *is* a web browser -
>
> Will you please shut up and read the documentation and/or look at the
> implementation?

my aren't you pleasant...

> The security model is to provide confluent protection in
> a secure environment, but not in a hostile environment. And surely it
> doesn't even get SGML comment pasing right, how should it ever get HTML
> right?

you make an excellent argument for why it's a *bad* browser, but not for
why it isn't a browser at all...

in the world most people operate in IE is a browser... i can appreciate
trying to redefine things in order to promote a paradigm shift in the
way people think about security - unfortunately it sucks for everyday
practical matters when that paradigm shift hasn't happened yet, and that
paradigm shift isn't likely to come as your behaviour doesn't encourage
people to buy into the alternative view you're proposing...

--
"it's not the right time to be sober
now the idiots have taken over
spreading like a social cancer,
is there an answer?"

[Sebastian G.]

kurt wismer wrote:

>> And surely it doesn't even get SGML comment pasing right,

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> how should it ever get HTML right?

>
> you make an excellent argument for why it's a *bad* browser, but not for
> why it isn't a browser at all...


First off, we're talking about *web*browsers.

I think it is a very strong argument against being a webbrowser. A broken
SGML parser/lexer, as the absolutely simplest part of rendering a website,
doesn't allow for getting it right at the higher layers. Thus it's
fundamentally unsuitable.

> in the world most people operate in IE is a browser...


Yes, a file browser. Not a webbrowser.

> i can appreciate trying to redefine things


No, that's what you're trying to do. You're claiming that because a lot of
people abuse the non-webbrowser IE as a webbrowser, it would actually become
one. That's silly.

[Troglodyte]

Sebastian G. wrote:

> Seems like a sarcastic expression of doubt, but of course it's a myth.
> There's no general way that just by visiting a website malware could be
> installed. What's needed that this actually works is a vulnerable
> webbrowser or something that is abused as such, and the trivial solution
> to this problem is not using a vulnerable webbrowser, thus it's anything
> but unavoidable.
> Instead of now throwing away their broken webbrowser or stop abusing a
> non-webbrowser as such those fools instead created a buzzword to blame
> their own incompetence on, and this buzzword is "drive-by-downloads".

Name one web browser that uses scripts that is not vulnerable. The only
one I know is firefox with the noscript add-on. That allows me to only
allow websites that I trust to run scripts. But then I've seen you in
here saying firefox is crap too so what browser do you use that is not
vulnerable? And don't tell my Lynx, I said one that allows scripts to run.

[Troglodyte]

Sebastian G. wrote:

> Or correct. Just take a look at the major players Mozilla Firefox,
> Mozilla Seamonkey, Opera, Konqueror and w3m. Agreed, Mozilla Firefox is
> a bit obscure, but neithertheless still secure by default.

No it isn't. Firefox allows scripts to run by default. Any browser that
allows scripts is not secure against malicious scripts. Only by using
noscript add-on does it become secure.

[Troglodyte]

Sebastian G. wrote:

> As you say: it's a band-aid. Nothing more. Security starts with
> addressing the causing, not cascading the symptoms. Especially since the
> main problem, lacking user education, is even further amplified.

Well, seeing as you are certain you know how to make a system secure
without having to use anti virus scanners, spyware scanners, hosts file,
script blockers, ad blockers etc. why don't you put up a website with
instructions on how to do it and provide a real service to the community?

[Troglodyte]

Sebastian G. wrote:

> Depends on which systems. Those with higher security margins have a
> global no-exec policy implemented, thus they simply can't anything but
> the preinstalled software, and as long as this is up-to-date an
> in-memory process compromise of the network is extremely unlikely.

And this is what you propose the average user does? Home users use their
computers for fun and not to pretend their computer is Fort Knox. Hello?
Earth to Sebastian G.You are out of touch with reality. You sure you are
not posting from within the local loony bin?