| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
KDE smokes MS in SSL bug fix | |
|
||
| Time: 07:41 EST/12:41 GMT | News Source: The Register | Posted By: Byron Hinson | ||
|
A serious flaw in SSL certificate handling reported by Mike Benham, affecting IE and Konqueror, has already been fixed by KDE's Waldo Bastian, we're pleased to mention. The fix is available only in the CVS (Concurrent Versions System) tree at the moment, but KDE reckons it will have patched binaries available for its 3.0.3 version, available early next week. A patch for KDE 2.2.x is currently in the works. As for Microsoft? According to Benham they haven't even replied to him yet. Apparently, real Trustworthy Computing takes an enormous amount of time. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 149 Last | Next |
The time now is
7:13:24 PM
ET.
Any comment problems? E-mail us |
| #1 By 6859 (204.71.100.215) at 8/13/2002 8:54:59 AM |
|
Man! I get real tired of the OSS people and their "We're faster at bug fixing" crapola.
First, how many of these companies are nearly as large as MS? None. Secondly, how many applications do they have to test regressively against as compared to MS? Perhaps 10% (and that's being generous.) I cannot wait for the first real nastiness to hit them that simply cannot be fixed without breaking everything (including that god-awful X). I'll have a beer that day I'll tell you; and they will fill the air with their wailing and gnashing of teeth. |
| #2 By 6253 (12.237.219.240) at 8/13/2002 10:43:22 AM |
|
There already IS a bunch of stuff originating from open source that is fundamentally broken from a security standpoint. The SMTP protocol itself allows gigabytes of spam to flow around the world every day, because it wasn't designed with security in mind, and all the patches to sendmail haven't fixed the fundamental problems. FTP is fundamentally flawed because passwords are sent in plaintext. That's per specification. So you either have to use anonymous (that's real secure), or wrap the whole thing inside SSL or some other wrapper such as VPN protocols, or use IP address restrictions if clients will always have known static addresses (and if you have guards against spoofing, because TCP/IP itself is insecure), or use a modified FTP protocol which requires special servers and clients (and thus isn't really FTP anymore). POP3 is the same way.
The Internet is held together everyday by the real-world fact that "good enough" fixes are sufficient, and everybody has decided to cut some slack to these old protocols, apparently just because they were designed long ago. As if NetBIOS/SMB weren't? |
| #3 By 135 (209.180.28.6) at 8/13/2002 11:06:52 AM |
|
If the KDE folks have not released a binary patch which can be installed by current users of KDE than they have not fixed the problem yet.
As an enduser I do not want to have to pull the sources out of CVS and recompile, nor should I be expected to. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 149 Last | Next |
The time now is
7:13:24 PM
ET.
Any comment problems? E-mail us |
