, SecurityFocus 2001-06-07
'Fluffy Bunny' claims he didn't target the open source community for attack... It just worked out that way.
Expand all |
Post comment
|
SourceForge, Apache hacker: Nothing personal
, SecurityFocus 2001-06-07 'Fluffy Bunny' claims he didn't target the open source community for attack... It just worked out that way.
Expand all |
Post comment
|
|
|
Privacy Statement |
are not worth overanalyzing, mainly because morality
is an ineffective security system.
The only thing that matters is how he did it: sniffing
from compromised intermediaries. There is nothing a host
can do to stop users from giving out their passwords,
except train them to only type in passwords from trusted
hosts.
Those sites could also filter logins from all but a handfull
of IP's. Part of being given an account would be an entry
in hosts.allow.
The next thing to do is compartmentalize users- local exploits are as bad as remote ones.
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/articles/215/5888#5888