28 Feb
2013
28 Feb
'13
11:40 a.m.
------------------------------
On Thu, Feb 28, 2013 11:04 AM PST Allison wrote:
On 02/28/2013 11:45 AM, ben wrote:
What about security? Does Rpi employ a firewall and virus scanning? And since the pi uses
sd storage, it might make more sense to compare it's internet capabilities with a
tablet or smart phone.
That "low price is best trend" I would change. For me a modern programing tool
is "text editor" and 80x24 text screen on 15" display.
Explain to me why a cheap PC in my home can't keep up to the net (windows 7) and a
credit card computer can do better for surfing.
Ben.
Simple task specialization, and task overhead limiting. That and in7 is just a bigger
pig.
The average PC has many tasks running and even then unless the CPU is a pig and the
graphics
unassisted doing a web browse is usually limited to only how fast all the data gets
there.
However for 80x24 text terminal the cpu overhead is very low and the graphics load
(screen)
lower, linux give you that if you don't run the GUI and its very fast. I know this
from running
and ARM7 based system at 300mhz and for text and compiling code for itself the limiting
factor
is actually the disk subystem (a micro SD chip).
To e the raspberry-pi is a great computing resource for embedded tasks.
Allison 
28 Feb
28 Feb
11:55 a.m.
On 2/28/2013 11:40 AM, Chris Tofu wrote:
What about security? Does Rpi employ a firewall and
virus scanning? And since the pi uses sd storage, it might make more sense to compare
it's internet capabilities with a tablet or smart phone.
Raspian, the debian
equivalent that runs on the Pi is just one of many
OS's that run on that target.
You have confused the target (arm 7) and platform (Raspberry Pi) with
the OS. The things you speak of above have entirely to do with the OS
and nothing to do with the platform or target, other than performance.
The Rpi has nothing to do with firewall, virus scanning, or security in
this context. It is true that many target processors have enhanced
security and media extensions, but I do not think the Pi has such.
And unless you go out of your way to run windows or macos emulations on
the rpi, the virus is pretty much astronomically useless to discuss.
The chances of any targeted virus to an arm at this point is pretty
remote, though I'm sure there are linux exploits that may be applies.
12:17 p.m.
On Thu, 28 Feb 2013, Jim Stephens wrote:
And unless you go out of your way to run windows or
macos emulations on
the rpi, the virus is pretty much astronomically useless to discuss.
The chances of any targeted virus to an arm at this point is pretty
remote, though I'm sure there are linux exploits that may be applies.
The rpi is so popular that there presumably ARE targeted exoploits in
development.
1:17 p.m.
I haven't heard of any. It's a modern linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work. Most folks run normal Linux with no AV why should the PI be
different?
On Feb 28, 2013 9:08 PM, "Fred Cisin" <cisin at xenosoft.com> wrote:
On Thu, 28 Feb 2013, Jim Stephens wrote:
And unless you go out of your way to run windows
or macos emulations on
the rpi, the virus is pretty much astronomically useless to discuss.
The chances of any targeted virus to an arm at this point is pretty
remote, though I'm sure there are linux exploits that may be applies.
The rpi is so popular that there presumably ARE targeted exoploits in
development.
3:11 p.m.
> > And unless you go out of your way to run
windows or macos emulations on
> > the rpi, the virus is pretty much astronomically useless to discuss.
> > The chances of any targeted virus to an arm at this point is pretty
> > remote, though I'm sure there are linux exploits that may be applies.
> The rpi is so popular that there presumably ARE targeted exoploits in
> development.
On Thu, 28 Feb 2013, Dave Wade wrote:
I haven't heard of any. It's a modern linux
and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work. Most folks run normal Linux with no AV why should the PI be
different?
The level of additional interest WILL bring in some who WILL put in the
effort to engage in vandalism.
The current shortage of malware WILL eventually be addressed.
Being different from the current targets provides only a very brief
respite before NEW AND IMPROVED malware gets developed.
"But, it could NEVER happen HERE!" Yeah. right.
1 Mar
1 Mar
5:09 p.m.
On Thu, Feb 28, 2013 at 03:11:06PM -0800, Fred Cisin wrote:
But that whole virus scanner nonsense woh't help you there - by definition
they won't recognize any brand new mal ware payloads.
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
> > And
unless you go out of your way to run windows or macos emulations on
> > the rpi, the virus is pretty much astronomically useless to discuss.
> > The chances of any targeted virus to an arm at this point is pretty
> > remote, though I'm sure there are linux exploits that may be applies.
> The rpi is so popular that there presumably ARE targeted exoploits in
> development.
On Thu, 28 Feb 2013, Dave Wade wrote:
I haven't heard of any. It's a modern
linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work. Most folks run normal Linux with no AV why should the PI be
different?
The level of additional interest WILL bring in some who WILL put in the
effort to engage in vandalism.
The current shortage of malware WILL eventually be addressed.
Being different from the current targets provides only a very brief
respite before NEW AND IMPROVED malware gets developed.
"But, it could NEVER happen HERE!" Yeah. right.
5:39 p.m.
On Sat, 2 Mar 2013, Alexander Schreiber wrote:
But that whole virus scanner nonsense woh't help
you there - by definition
they won't recognize any brand new mal ware payloads.
I am not a big fan of current "signature matching" anti-virus software,
nor of many other forms of "security theater"
5:54 p.m.
On Mar 1, 2013, at 5:39 PM, Fred Cisin <cisin at xenosoft.com> wrote:
I am not a big fan of current "signature
matching" anti-virus software,
nor of many other forms of "security theater"
We had a lot of fun talking about this at BSides SF this year.
Imagine if it was up to you and you had 2500 workstations in your "enterprise."
? imagine being able to pick and choose and have 50% with some kind of endpoint virus
protection and 50% without. At the end of 12 months, what would the infection rate be
among the two "pools" of PCs?
28 Feb
28 Feb
3:12 p.m.
On 2/28/2013 1:17 PM, Dave Wade wrote:
I haven't heard of any. It's a modern linux
and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work. Most folks run normal Linux with no AV why should the PI be
different?
On Feb 28, 2013 9:08 PM, "Fred Cisin" <cisin at xenosoft.com> wrote:
> On Thu, 28 Feb 2013, Jim Stephens wrote:
>> And unless you go out of your way to run windows or macos emulations on
>> the rpi, the virus is pretty much astronomically useless to discuss.
>> The chances of any targeted virus to an arm at this point is pretty
>> remote, though I'm sure there are linux exploits that may be applies.
> The rpi is so popular that there presumably ARE targeted exoploits in
> development.
I have another reply to the AV thread, but worth saying it here
because
that reply will be moderated and will be a while coming.
The lack of exploits does not mean there will be none. There are still
vulnerabilities which could work on a linux machine as well as any of
the PC or Macos ones as well as any.
Unless you have a custom build with a tool which specifically defends
against binary exploits there will always be ways to get into a machine
as long as people keep coding and leaving buffer overflow and other
attack vectors.
the question is whether it is worth the time of someone who is creating
exploits to create something and hope it mates up with a host that is
vulnerable. I will run AV on linux when there are more chances of
someone hitting my specific machine, but so far there are not enough to
bother.
The fact that if 1 windows machine has a problem millions do makes them
the target. And the fact that microsoft seems to be pretty good at not
fixing the problems as a root cause. That is another discussion.
6:18 p.m.
In article <512FE45E.5000602 at jwsss.com>,
Jim Stephens <jws at jwsss.com> writes:
The lack of exploits does not mean there will be none.
There are still
vulnerabilities which could work on a linux machine as well as any of
the PC or Macos ones as well as any.
How quickly people forget that the first major internet
(unintentional) DDOS attack was all against unix machines.
<http://en.wikipedia.org/wiki/Morris_worm>
--
"The Direct3D Graphics Pipeline" free book
<http://tinyurl.com/d3d-pipeline>
The Computer Graphics Museum <http://computergraphicsmuseum.org>
The Terminals Wiki <http://terminals.classiccmp.org>
Legalize Adulthood! (my blog) <http://legalizeadulthood.wordpress.com>
7:56 p.m.
On 02/28/2013 09:18 PM, Richard wrote:
In article <512FE45E.5000602 at jwsss.com>,
Jim Stephens <jws at jwsss.com> writes:
Yep. The difference is...those problems were resolved. ;)
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
The lack of exploits does not mean there will be
none. There are still
vulnerabilities which could work on a linux machine as well as any of
the PC or Macos ones as well as any.
How quickly people forget that the first major internet
(unintentional) DDOS attack was all against unix machines.
<http://en.wikipedia.org/wiki/Morris_worm>
1 Mar
1 Mar
5:13 p.m.
On Thu, Feb 28, 2013 at 07:18:51PM -0700, Richard wrote:
In article <512FE45E.5000602 at jwsss.com>,
Jim Stephens <jws at jwsss.com> writes:
Well, back then the internet was a much more open, trusting environment.
And even back then, _proper_ system setup safeguards (limiting access to
rsh/rlogin, enforcing strong passwords, ...) could have severly limited
the spread of the worm.
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
The lack of exploits does not mean there will be
none. There are still
vulnerabilities which could work on a linux machine as well as any of
the PC or Macos ones as well as any.
How quickly people forget that the first major internet
(unintentional) DDOS attack was all against unix machines.
<http://en.wikipedia.org/wiki/Morris_worm>
9:36 p.m.
Well, back then the internet was a much more open, trusting environment.
And even back then, _proper_ system setup safeguards (limiting access to
rsh/rlogin, enforcing strong passwords, ...) could have severly limited
the spread of the worm.
C: Not to mention that probably every internet host on planet earth was running UNIX.
??? Was the worm supposed to attack Commie 64s? Coco's? Those vile Timex Sinclairs?
Kind regards,
? ? ? ? ? Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work."? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? -- Thomas A. Edison
2 Mar
2 Mar
3:45 a.m.
On Fri, Mar 01, 2013 at 09:36:24PM -0800, Chris Tofu wrote:
No. There were plenty of other systems, among them VAXen with VMS and
others.
Well, back
then the internet was a much more open, trusting environment.
And even back then, _proper_ system setup safeguards (limiting access to
rsh/rlogin, enforcing strong passwords, ...) could have severly limited
the spread of the worm.
C: Not to mention that probably every internet host on planet earth was running
UNIX. ??? Was the worm supposed to attack Commie 64s?
Coco's? Those vile Timex Sinclairs?
If you'd bothered to read a bit, you'd know the anser.
Kind regards,
Alex.
PS: Fix your quoting, having to repair it is annoying.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
28 Feb
28 Feb
4:25 p.m.
On Feb 28, 2013, at 4:17 PM, Dave Wade wrote:
I haven't heard of any. It's a modern linux
and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work.
Er, what? Buffer overruns are the same regardless of what chipset
you run, at least as long as your stack grows downwards (most stacks,
including ARMs' stacks, do). Stack headspace randomization, which
is generally a software thing, can cause the code intended to be
executed by a buffer overrun fail (since there's no static offset to
branch to), but it's not a feature of the hardware on most machines.
Side note: are there any architectures which provide hardware stack
randomization? Seems like an unlikely feature to implement, but it
would make sense since it tends to hurt performance to a measurable
degree.
- Dave
1 Mar
1 Mar
11:40 a.m.
On 01/03/2013 00:25, David Riley wrote:
On Feb 28, 2013, at 4:17 PM, Dave Wade wrote:
But buffer
over runs need to code specific. I meant current buffer run
attacks won't work as they generally target I86...
I haven't heard of any. It's a modern
linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work.
Er, what? Buffer overruns are the same regardless of what
chipset
you run, at least as long as your stack grows downwards (most stacks,
including ARMs' stacks, do). Stack headspace randomization, which
is generally a software thing, can cause the code intended to be
executed by a buffer overrun fail (since there's no static offset to
branch to), but it's not a feature of the hardware on most machines. Side note: are there any architectures which provide
hardware stack
randomization? Seems like an unlikely feature to implement, but it
would make sense since it tends to hurt performance to a measurable
degree.
- Dave
--
Dave Wade G4UGM
Illegitimi Non Carborundum
5:15 p.m.
On Thu, Feb 28, 2013 at 07:25:22PM -0500, David Riley wrote:
On Feb 28, 2013, at 4:17 PM, Dave Wade wrote:
But running buffer overflow exploits with x86 specific machine code
payloads isn't going to get you anywhere on ARM. And there are software
based mitigation techniques that can seriously limit the impact of
buffer overflow exploits - the machine architecture based obscurity
defense won't protect you for long.
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
I haven't heard of any. It's a modern
linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work.
Er, what? Buffer overruns are the same regardless of what chipset
you run, at least as long as your stack grows downwards (most stacks,
including ARMs' stacks, do). Stack headspace randomization, which
is generally a software thing, can cause the code intended to be
executed by a buffer overrun fail (since there's no static offset to
branch to), but it's not a feature of the hardware on most machines.
6:35 p.m.
On Mar 1, 2013, at 8:15 PM, Alexander Schreiber wrote:
On Thu, Feb 28, 2013 at 07:25:22PM -0500, David Riley
wrote:
Sure. All I was saying was that there's nothing intrinsic in the
RPi that prevents buffer overflow exploits; "standard" buffer
overflow attacks will work, provided that their payload is
written for ARM Linux.
- Dave
On Feb 28, 2013, at 4:17 PM, Dave Wade wrote:
But running buffer overflow exploits with x86 specific machine code
payloads isn't going to get you anywhere on ARM. And there are software
based mitigation techniques that can seriously limit the impact of
buffer overflow exploits - the machine architecture based obscurity
defense won't protect you for long. I haven't heard of any. It's a modern
linux and most tasks run as non-root.
In addition on its a non-standard chip set so standard buffer over runs
don't work.
Er, what? Buffer overruns are the same regardless of what chipset
you run, at least as long as your stack grows downwards (most stacks,
including ARMs' stacks, do). Stack headspace randomization, which
is generally a software thing, can cause the code intended to be
executed by a buffer overrun fail (since there's no static offset to
branch to), but it's not a feature of the hardware on most machines.
5:07 p.m.
On Thu, Feb 28, 2013 at 11:40:48AM -0800, Chris Tofu wrote:
------------------------------ On Thu, Feb 28, 2013 11:04 AM PST Allison
wrote:
What on earth for? It is not running Windows, it runs Raspbian (a modified
Debian Wheezy) by default. Aside from the fact that virus scanners are
useless in general.
On 02/28/2013 11:45 AM, ben wrote:
What about security? Does Rpi employ a firewall and virus scanning? And
That "low price is best trend" I would change. For me a modern programing
tool is "text editor" and 80x24 text screen on 15" display. Explain to
me
why a cheap PC in my home can't keep up to the net (windows 7) and a
credit card computer can do better for surfing. Ben.
Simple task specialization, and task overhead limiting. That and in7 is
just a bigger pig.
The average PC has many tasks running and even then unless the CPU is a pig
and the graphics unassisted doing a web browse is usually limited to only
how fast all the data gets there.
However for 80x24 text terminal the cpu overhead is very low and the
graphics load (screen) lower, linux give you that if you don't run the GUI
and its very fast. I know this from running and ARM7 based system at 300mhz
and for text and compiling code for itself the limiting factor is actually
the disk subystem (a micro SD chip).
To e the raspberry-pi is a great computing resource for embedded tasks.
Allison since the pi uses sd storage, it might make more
sense to compare it's
internet capabilities with a tablet or smart phone.
What "internet capabilities"? It is a Linux box. Which mean you can do
pretty much anything (within the computational & I/O limits of the box - it
won't work as an IMAP-Server for 100000 users for example).
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
9:34 p.m.
________________________________
From: Alexander Schreiber <als at thangorodrim.de>
To: General Discussion: On-Topic and Off-Topic Posts <cctalk at classiccmp.org>
Sent: Friday, March 1, 2013 8:07 PM
Subject: Re: Raspberry Pi
On Thu, Feb 28, 2013 at 11:40:48AM -0800, Chris Tofu wrote:
------------------------------ On Thu, Feb 28, 2013 11:04 AM PST Allison
wrote:
What on earth for? It is not running Windows, it runs Raspbian (a modified
Debian Wheezy) by default. Aside from the fact that virus scanners are
useless in general.
C: You entirely missed the point apparently. It was being compared to a Windows box in
terms of performance. Most Windows boxes employ a firewall and virus scanner (and spam
killer, cookie cutter, etc. oi). You haven't noticed Norton or Kaspersky slowing down
your system?
On 02/28/2013 11:45 AM, ben wrote:
? What about security? Does Rpi employ a firewall and virus scanning? And
That "low price is best trend" I would change. For me a modern programing
tool is "text editor" and 80x24 text screen on 15" display.? Explain to
me
why a cheap PC in my home can't keep up to the net (windows 7) and a
credit card computer can do better for surfing.? Ben.
Simple task specialization, and task overhead limiting.? That and in7 is
just a bigger pig.
The average PC has many tasks running and even then unless the CPU is a pig
and the graphics unassisted doing a web browse is usually limited to only
how fast all the data gets there.
However for 80x24 text terminal the cpu overhead is very low and the
graphics load (screen) lower, linux give you that if you don't run the GUI
and its very fast.? I know this from running and ARM7 based system at 300mhz
and for text and compiling code for itself the limiting factor is actually
the disk subystem (a micro SD chip).
To e the raspberry-pi is a great computing resource for embedded tasks.
Allison ? since the pi uses sd storage, it might make more
sense to compare it's
? internet capabilities with a tablet or smart phone.
What "internet capabilities"? It is a Linux box. Which mean you can do
pretty much anything (within the computational & I/O limits of the box - it
won't work as an IMAP-Server for 100000 users for example).
C: You're batting a thousand (which seems to be a trend in this discussion). Windows
boxes (and Linux boxes for that matter) use hard drives. The pi uses sd storage. As do
smart phones, tablets.
?So glad to be of service. You're welcome.
Kind regards,
? ? ? ? ? ? Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work."? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? -- Thomas A. Edison
2 Mar
2 Mar
3:52 a.m.
On Fri, Mar 01, 2013 at 09:34:10PM -0800, Chris Tofu
wrote:
Not at all, they have absolutely no impact on any of my systems. Which would
be because all my systems run Unix of some sort (mostly Linux, but also
NetBSD and FreeBSD).
________________________________ From: Alexander Schreiber
<als at thangorodrim.de> To: General Discussion: On-Topic and Off-Topic Posts
<cctalk at classiccmp.org> Sent: Friday, March 1, 2013 8:07 PM Subject: Re:
Raspberry Pi
On Thu, Feb 28, 2013 at 11:40:48AM -0800, Chris Tofu wrote:
That isn't really a valid comparison as your typical Windows box (assuming
it is less than 4 years old) has a _lot_ more memory, storage and much more
CPU and GPU than a Raspberry.
> Most Windows boxes employ a firewall and
> virus scanner (and spam killer, cookie cutter, etc. oi). You haven't noticed
> Norton or Kaspersky slowing down your system?
------------------------------ On Thu, Feb 28, 2013 11:04 AM PST Allison
wrote:
What on earth for? It is not running Windows, it runs Raspbian (a modified
Debian Wheezy) by default. Aside from the fact that virus scanners are
useless in general.
C: You entirely missed the point apparently. It was being compared to a
Windows box in terms of performance. On 02/28/2013 11:45 AM, ben wrote:
>
> That "low price is best trend" I would change. For me a modern
> programing tool is "text editor" and 80x24 text screen on 15"
display.?
> Explain to me why a cheap PC in my home can't keep up to the net
> (windows 7) and a credit card computer can do better for surfing.? Ben.
>
Simple task specialization, and task overhead limiting.? That and in7 is
just a bigger pig.
The average PC has many tasks running and even then unless the CPU is a
pig and the graphics unassisted doing a web browse is usually limited to
only how fast all the data gets there.
However for 80x24 text terminal the cpu overhead is very low and the
graphics load (screen) lower, linux give you that if you don't run the GUI
and its very fast.? I know this from running and ARM7 based system at
300mhz and for text and compiling code for itself the limiting factor is
actually the disk subystem (a micro SD chip).
To e the raspberry-pi is a great computing resource for embedded tasks.
Allison
? What about security? Does Rpi employ a firewall and virus scanning? And > >? since the pi uses sd storage, it might make
more sense to compare it's ?
> >internet capabilities with a tablet or smart phone.
>
> What "internet capabilities"? It is a Linux box. Which mean you can do
pretty
> much anything (within the computational & I/O limits of the box - it won't
> work as an IMAP-Server for 100000 users for example).
>
> C: You're batting a thousand (which seems to be a trend in this discussion).
> Windows boxes (and Linux boxes for that matter) use hard drives. The pi uses
> sd storage. As do smart phones, tablets.
And what exactly does the storage medium have to do with what the system
can do network-wise? For that matter, the Raspberry Pi can use harddrives
just fine: simply attach (via powered hub) a USB disk ...
Kind regards,
Alex.
--
"Opportunity is missed by most people because it is dressed in overalls and
looks like work." -- Thomas A. Edison
4084
days inactive
4086
days old
20 comments
9 participants
participants (9)
-
als＠thangorodrim.de -
cisin＠xenosoft.com -
dave.g4ugm＠gmail.com -
fraveydank＠gmail.com -
jon＠jonworld.com -
jws＠jwsss.com -
legalize＠xmission.com -
mcguire＠neurotica.com -
rampaginggreenhulk＠yahoo.com