[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: root compromise on debian woody



On Fri, May 27, 2005 at 05:59:08AM -0400, Charles Hallenbeck wrote:
> I am a newbie to Debian, a Slackware convert, but not a newbie otherwise. I 
> compile my own kernels since I use a set of kernel patches to support speech 
> synthesizer to the console, called "speakup". A precompiled kernel for 2.4.27 
> package got me started with an installation disk, but I quickly got me a 2.6.11 
> source package, patched it for speech access, installed it on Sarge, and then 
> went on a binge adding stuff to my system, like a kid in a candy store.
> 
> I recently read the FAQ by the guy at Cornell (forgive me for not looking up 
> your name) and was persuaded that it made sense for me to move on over to 
> unstable rather than following Sarge to stable or staying with testing, and as 
> I posted here, that upgrade went smooth as silk. But now I see I have put 
> myself beyond the reach of the Debian security team, without a graceful way to 
> go back.
> 
> Oh well. I will just have to live on the edge and keep an eye out for problems. 
> (okay, an ear!)
> 

Chuck,

Please be sure and don't top post.  It is considered bad list ettiquette
:-)

If you are running a regular desktop, chances are that:

1) You are behond a firewall/router of some sort.
2) You are not really using it in a mutliuser environment (i.e., giving
out accounts to random people you don't know).
3) Are able to inconvenience yourself/your limited users (e.g., family)
if necessary.

The people that really need to worry are those that are trying to run a
weg hosting business with Sid servers.  There you would need a fill time
person to stay on top of security updates.  However, with Sid it is not
usually so bad since the maintainers usually upload the security updates
in a fairly reasonable time frame.

-Roberto
-- 
Roberto C. Sanchez
http://familiasanchez.net/~sanchezr

Attachment: pgpo48Z2fvV9B.pgp
Description: PGP signature


Reply to: