Ancient OS may be the best weapon against hackers.
June 7, 2002 6:46 AM Subscribe
Ancient OS may be the best weapon against hackers. I thought this was great, aging Operating Systems such as Solaris and older versions of Mac Os are becoming valuable tools against electronic attacks, simply because they *are* older. (Anyone got the full set of floppies for System 7?)
Link from RobotWisdom
Yes, I do, 7.1 to be exact. I just don't have a floppy drive anymore, except in that old Quadra in the garage.
posted by cowboy at 7:02 AM on June 7, 2002
posted by cowboy at 7:02 AM on June 7, 2002
Actually I have been using this approach. but with a slightly different twist for years. Instead of ancient software, I use ancient hardware. Truth is that even a sun workstations from 10 years ago is more than enough to do my mail/dns/www. Since most exploits involve a assembly portion (and at least 90% of those exploits are for x86 hardware), I'm nearly invulnerable to script kiddies with my sun 4m architecture.
That's not to say that I don't try to keep the boxes secure. However, when other boxes on the network running the same versions of software get 0w/\/3|), I'm seem to always dodge the bullet.
posted by betaray at 7:30 AM on June 7, 2002
That's not to say that I don't try to keep the boxes secure. However, when other boxes on the network running the same versions of software get 0w/\/3|), I'm seem to always dodge the bullet.
posted by betaray at 7:30 AM on June 7, 2002
This article was discussed on slashdot and pretty thoroughly debunked.
posted by srboisvert at 7:31 AM on June 7, 2002
posted by srboisvert at 7:31 AM on June 7, 2002
The fact that you have to jump through hoops to turn on root access and no sharing is enabled by default on OSX is good enough for me, thankyouverymuch.
(Combined with good passwords and other basic precautions, of course)
posted by jragon at 7:35 AM on June 7, 2002
(Combined with good passwords and other basic precautions, of course)
posted by jragon at 7:35 AM on June 7, 2002
This article was discussed on slashdot and pretty thoroughly debunked.
I'm not sure about that. Slashdotters often conflate a server's security with an encryption algorithm's security. Encryption security is evaluated in absolutes: any liability means the encryption has been compromised.
A server's security is somewhat different: slowing down an attacker - having an obscure system - can help improve security. But it won't do much for a system that is full of holes. This slashdot comment advocates security through obscurity, but just doesn't name it as such (if the poster had called it security through obscurity, the unwashed slashdot masses probably would have modded the post to -1, troll instead of 5, interesting).
It's sort of like living in a safer neighborhood. Your house might not be any more secure against a criminal bent on stealing your TV, but there's a lower chance of anyone trying.
posted by Llama-Lime at 8:01 AM on June 7, 2002
I'm not sure about that. Slashdotters often conflate a server's security with an encryption algorithm's security. Encryption security is evaluated in absolutes: any liability means the encryption has been compromised.
A server's security is somewhat different: slowing down an attacker - having an obscure system - can help improve security. But it won't do much for a system that is full of holes. This slashdot comment advocates security through obscurity, but just doesn't name it as such (if the poster had called it security through obscurity, the unwashed slashdot masses probably would have modded the post to -1, troll instead of 5, interesting).
It's sort of like living in a safer neighborhood. Your house might not be any more secure against a criminal bent on stealing your TV, but there's a lower chance of anyone trying.
posted by Llama-Lime at 8:01 AM on June 7, 2002
Want obscure, huh? Let's really throw 'em: Bring back Multics!
posted by alumshubby at 8:21 AM on June 7, 2002
posted by alumshubby at 8:21 AM on June 7, 2002
Bring back Multics!
It's so obscure, we can't even show you the URL!
posted by Danelope at 8:29 AM on June 7, 2002
It's so obscure, we can't even show you the URL!
posted by Danelope at 8:29 AM on June 7, 2002
<chuckle>
There's plenty of information available about the MULTiplexed Information and Computing Service.
And, unlike 'Unicians", "Multicians" caught on. :-)
posted by baylink at 8:39 AM on June 7, 2002
There's plenty of information available about the MULTiplexed Information and Computing Service.
And, unlike 'Unicians", "Multicians" caught on. :-)
posted by baylink at 8:39 AM on June 7, 2002
For some reason the article reminded me of the Navajo Code-Talker Program utilized in World War 2. The Navajo native language was unbreakable mainly due to it's complexity and lack of written documentation. (Plus the fact that there were so few speakers).
In a similar way, it seems the lack of available documentation and the obscurity of older OS's can be seen as strengths.
I love themes like this, I'm sure some sci-fi authors have picked up on this concept.
posted by jeremias at 8:43 AM on June 7, 2002
In a similar way, it seems the lack of available documentation and the obscurity of older OS's can be seen as strengths.
I love themes like this, I'm sure some sci-fi authors have picked up on this concept.
posted by jeremias at 8:43 AM on June 7, 2002
[sarcasm] Great, my host just upgraded to the latest and greatest in the middle of the night last night with no prior warning. I guess that makes everything ok even though PHP and MySQL are broken. [/sarcasm]
Maybe I should give them my copy of Mac OS 8.
posted by password at 8:47 AM on June 7, 2002
Maybe I should give them my copy of Mac OS 8.
posted by password at 8:47 AM on June 7, 2002
They're my host too, and I've been bugging them for days to fix my PHP/MySQL setups. I'd do it myself, but I can't even log into my site anymore!
Sorry for the OT rant.
posted by laz-e-boy at 9:10 AM on June 7, 2002
Sorry for the OT rant.
posted by laz-e-boy at 9:10 AM on June 7, 2002
"This article was discussed on slashdot and pretty thoroughly debunked."
Not really....people were talking about the inherent security issues with running x86 hardware with modern OS's.
posted by mkelley at 9:21 AM on June 7, 2002
Not really....people were talking about the inherent security issues with running x86 hardware with modern OS's.
posted by mkelley at 9:21 AM on June 7, 2002
[OFF-TOPIC]
Laz-e-boy, that sucks. I just got access to my site & database. They'd reset all the CHMOD settings. At least everything's back up for me. I'm gonna do a dump of my database while I'm thinking about it.
I hope they fix you up soon.
Sorry for the OT chat.
posted by password at 9:43 AM on June 7, 2002
Laz-e-boy, that sucks. I just got access to my site & database. They'd reset all the CHMOD settings. At least everything's back up for me. I'm gonna do a dump of my database while I'm thinking about it.
I hope they fix you up soon.
Sorry for the OT chat.
posted by password at 9:43 AM on June 7, 2002
There's a lot of merit in this, if security is more important to you than maintainability. If it's a set-and-forget type of installation, that balance is easily reached.
posted by dhartung at 9:44 AM on June 7, 2002
posted by dhartung at 9:44 AM on June 7, 2002
I have AOL 2.7 on an Apple fro 1990. Works fine for e-mail. Browser even allows me to read, but not post on Mefi. Sorry, members: no chance of it becoming my only computer.
posted by ParisParamus at 10:03 AM on June 7, 2002
posted by ParisParamus at 10:03 AM on June 7, 2002
On old Primos systems, you could bypass the login security by typing a bunch of ctrl-D's for password, so if you knew a login name, you could get in.
And once you got in, any user was able to write a C (or Pascal, this was college days, heh) program that called the system-library for processing user-logins, and request the unencrypted password for any user.
Obscure, yes.
Secure, no.
The idea that old systems are going to be harder to find info on seems silly, seeing as we can still find my posts to alt.tv.simpsons from 1992 on google groups....
posted by nomisxid at 10:11 AM on June 7, 2002
And once you got in, any user was able to write a C (or Pascal, this was college days, heh) program that called the system-library for processing user-logins, and request the unencrypted password for any user.
Obscure, yes.
Secure, no.
The idea that old systems are going to be harder to find info on seems silly, seeing as we can still find my posts to alt.tv.simpsons from 1992 on google groups....
posted by nomisxid at 10:11 AM on June 7, 2002
Anyone got the full set of floppies for System 7?
You can download the disk images from Apple, gratis. Of course, if you're really serious about security, you'll want System 6.0.8. ;)
posted by darukaru at 11:26 AM on June 7, 2002
You can download the disk images from Apple, gratis. Of course, if you're really serious about security, you'll want System 6.0.8. ;)
posted by darukaru at 11:26 AM on June 7, 2002
Obscure, yes.
Secure, no.
Totally agree. We have OS/2 Warp 3 running some obscene version of Btrieve (yes, I said the B-word). While a script kiddie running a probe might not be able to decipher it from a Unix box, it is more than a hassle to perform data recovery. Any OS, no matter how obscure, has the potential of being breached by a more experienced and focused hacker. The one thing I'm thankful of however, is that the OS/2 is immune to the latest virii and internet worms. (great, now I'm thinking about that btrieve engine again...ah panic)
posted by samsara at 11:26 AM on June 7, 2002
Secure, no.
Totally agree. We have OS/2 Warp 3 running some obscene version of Btrieve (yes, I said the B-word). While a script kiddie running a probe might not be able to decipher it from a Unix box, it is more than a hassle to perform data recovery. Any OS, no matter how obscure, has the potential of being breached by a more experienced and focused hacker. The one thing I'm thankful of however, is that the OS/2 is immune to the latest virii and internet worms. (great, now I'm thinking about that btrieve engine again...ah panic)
posted by samsara at 11:26 AM on June 7, 2002
I wouldn't recommend system 6 for the Mac. They changed APIs in system 7, without backwards compatibility. I would really recommend system 8.6 . It's stable, reliable and secure, and it doesn't have the carbonation for OS X going on. You can run ASIP on it, and you can install it up to the blue and white G3 hardware and any black G3 powerbook.
posted by schlaager at 12:02 PM on June 7, 2002
posted by schlaager at 12:02 PM on June 7, 2002
Security thru obscurity may be an answer, but I seriously doubt it's the right one. I knew of a guy running older versions of several UNIX daemons who thought because he was doing so he was more secure against the kiddies who look for the new exploits. That worked for a while, but someone turned around, found an exploit for almost every bit of software he was running and royally owned him.
The sad fact is no system is ever a hundred percent secure. I doubt seriously that any system ever will be... Besides, security thru obscurity is one of the worst models to adapt and I'd suggest smacking yourself upside the head for thinking it's a good idea.
The best soloution is staying on top of your system and patching what needs to be patched when said patches come down the line...
posted by boogah at 5:05 PM on June 7, 2002
The sad fact is no system is ever a hundred percent secure. I doubt seriously that any system ever will be... Besides, security thru obscurity is one of the worst models to adapt and I'd suggest smacking yourself upside the head for thinking it's a good idea.
The best soloution is staying on top of your system and patching what needs to be patched when said patches come down the line...
posted by boogah at 5:05 PM on June 7, 2002
Dave: You're off topic...no fair using OSes that are secure to begin with! :)
posted by samsara at 9:06 PM on June 7, 2002
posted by samsara at 9:06 PM on June 7, 2002
Just in case you don't already have System 7. (Man, I distinctly remember the 7.0 release ... still get goosebumps writing the phrase “System 7”. Oh, my misspent youth.)
posted by dsandl at 12:41 AM on June 9, 2002
posted by dsandl at 12:41 AM on June 9, 2002
« Older Subtleties of American Satire Lost on the Chinese. | Next move - nationalizing the internet... Newer »
This thread has been archived and is closed to new comments
posted by UncleFes at 7:02 AM on June 7, 2002