Liudvikas Bukys

Opt-out links
for killing pop-up ads from eight major ad servers
(DoubleClick, Advertising.com, X10.com, FastClick.com, Interpolis, 24/7 Media, Avenue A, Blue Streak) — just one click per advertiser, and no questions to answer, puts a “do not disturb” cookie into your browser.

Find the Cost of (Virus) Freedom. Nimda, Sir Cam, Code Red and friends caused more than 50,000 security incidents last year. But experts say the estimates of billions in clean-up costs are pure guesswork. By Michelle Delio. [Wired News]

New Shockwave Virus Uncovered. Cosmiverse.com Jan 10 2002 4:09PM ET [Tech latest]

vnunet: Rare Linux virus on the loose

It has emerged in the last week that another of those rare Linux viruses may be on the loose. And this one has strong similarities to October’s Remote Shell Trojan (RST) that was largely dismissed by the Linux community.

In a posting to a security mailing list at the end of December, SecurityFocus brought ‘RST.b’ to the internet community’s attention.

vnunet: Users lose confidence in AV software
“The problem is that most of the software available today is reactive and not proactive. They are signature based and are linked to a database. If a new virus comes along that it does not recognise it will get through,” he added.

TechnologyEvaluation.com: OKENA Pioneers Next-Generation Intrusion Prevention: “Intrusion prevention has evolved as a smarter alternative to intrusion detection. Pioneer OKENA has mapped application behaviors into rules, and is using these behavior rules to prevent intrusions up front. This second-generation approach offers substantial bottom line savings, and frees up IT resources for other tasks.”

Microsoft warns millions about IE security flaw. vnunet.com Jan 4 2002 11:52AM ET [Tech latest]

Ditch IE – veteran bug hunter. Guninski nails another vulnerability [The Register]

Dave Winer: General comment on software patents. It’s terrorism, something we’re familiar with after Sept 11, applied to technology. Our terrorists wear suits and have law degrees. It will result in bankruptcies, orphaned software, and users without tools to use. The lawyers will get rich (and the technologists who think like lawyers). Ethical technologists who welcome competition because they want to be compelled to create the best products will go by the wayside, replaced by pseudo-technologists who use lawyers as competitive weapons. Who’s to blame? In the US, it’s the USPTO who grant patent abusers a legal basis to hijack open formats and protocols and crash them into products and services offered by developers of all sizes. State-sponsored terrorism. [Scripting News]

Debian Security Advisory: exim

Patrice Fournier discovered a bug in all versions of Exim older than
Exim 3.34 and Exim 3.952.

The Exim maintainer, Philip Hazel, writes about this issue: “The
problem exists only in the case of a run time configuration which
directs or routes an address to a pipe transport without checking the
local part of the address in any way. This does not apply, for
example, to pipes run from alias or forward files, because the local
part is checked to ensure that it is the name of an alias or of a
local user. The bug’s effect is that, instead of obeying the correct
pipe command, a broken Exim runs the command encoded in the local part
of the address.”

[Linux Today]