HDTenEightyP/NetNews huggingface dataset:
From: nagle@netcom.com (John Nagle)
Newsgroups: alt.security,comp.security.misc
Subject: Re: WAISified PostScript would constitute a security hole
Keywords: trace, sunos
Date: 18 Aug 92 18:55:36 GMT
Organization: Netcom - Online Communication Services  (408 241-9760 guest)

pdgray@napier.uwaterloo.ca (Peter D. Gray) writes:

>In article <1992Aug15.172943.4449@jarvis.csri.toronto.edu>, flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>> sethb@fid.morgan.com (Seth Breidbart) writes:
>> >What I need is the ability to run a subprocess as a slave; whenever it
>> >tries to do any kind of system call, the call is handed to me (the
>> >master process) instead.  That way, I can allow only "safe" actions; I
>> >can also pretend to have done "unsafe" actions so the subprocess will
>> >run without causing trouble.
>None of that effort is required. SunOS comes with a cool command called
>"trace" which can attach itself to a running process and watch ALL system 
>calls that the process makes (it prints out the arguments, return value and any
>errors). This program is built on the C function (which seems to be standard
>UNIX) called "ptrace". It would be easy to write a program that "watches"
>a process and detects any unsafe system calls and returns a failure code or
>better still spoofs the calling process.

         Good idea.  

					John Nagle
Xref: sparky alt.security:4164 comp.security.misc:1021
Newsgroups: alt.security,comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: WAISified PostScript would constitute a security hole
Date: 15 Aug 92 21:29:43 GMT

sethb@fid.morgan.com (Seth Breidbart) writes:
>What I need is the ability to run a subprocess as a slave; whenever it
>tries to do any kind of system call, the call is handed to me (the
>master process) instead.  That way, I can allow only "safe" actions; I
>can also pretend to have done "unsafe" actions so the subprocess will
>run without causing trouble.

Well that's easy if you have source.. just link with libraries which send
messages rather than doing the syscall...

(when I say easy, I mean, theoretically speaking.. it *would* be a lot of work
to create these libraries, but they would only have to be done once.)
Newsgroups: alt.security
From: sycheng@csie.nctu.edu.tw (Shiao-Yang Cheng)
Subject: Security of X-station
Reply-To: sycheng@csie.nctu.edu.tw
Organization: Computer Science & Engineering, Chiao Tung U., Taiwan, ROC
X-Newsreader: Tin 1.1 PL3
Date: Wed, 12 Aug 1992 14:53:08 GMT

  Hi :
  
    We have several IBM Xstation 120s. I 've found that it has X's security
  problem. How can I protect my keystroke when I use X station ?
  
  < Maybe this is FAQ, but I really need help >
  
  Thanks.
  
--
System Manager of Computer Center          |     Sincerely Yours
Computer Science & Information Engineering | Cheng, Shiao-Yang (    )  
National Chiao Tung University             | sycheng@csie.nctu.edu.tw
Taiwan, Republic of China                  | sycheng@csunix.csie.nctu.edu.tw
Newsgroups: alt.security,comp.security.misc
From: pdgray@napier.uwaterloo.ca (Peter D. Gray)
Subject: Re: WAISified PostScript would constitute a security hole
Keywords: trace, sunos
Organization: University of Waterloo
Date: Sun, 16 Aug 1992 00:37:58 GMT

In article <1992Aug15.172943.4449@jarvis.csri.toronto.edu>, flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
> sethb@fid.morgan.com (Seth Breidbart) writes:
> >What I need is the ability to run a subprocess as a slave; whenever it
> >tries to do any kind of system call, the call is handed to me (the
> >master process) instead.  That way, I can allow only "safe" actions; I
> >can also pretend to have done "unsafe" actions so the subprocess will
> >run without causing trouble.
> 
> Well that's easy if you have source.. just link with libraries which send
> messages rather than doing the syscall...
> 
> (when I say easy, I mean, theoretically speaking.. it *would* be a lot of work
> to create these libraries, but they would only have to be done once.)

None of that effort is required. SunOS comes with a cool command called
"trace" which can attach itself to a running process and watch ALL system 
calls that the process makes (it prints out the arguments, return value and any
errors). This program is built on the C function (which seems to be standard
UNIX) called "ptrace". It would be easy to write a program that "watches"
a process and detects any unsafe system calls and returns a failure code or
better still spoofs the calling process.

PG
Newsgroups: alt.security
From: scs@lokkur.dexter.mi.us (Steve Simmons)
Subject: Re: Secure setuid programs: A model + NFS
Organization: Inland Sea
Distribution: alt
Date: Thu, 20 Aug 92 23:33:49 GMT

wls@cray.csd.uwm.edu (Bill Stapleton) writes:

>Something I've noticed in at least two vendors' NFS (perhaps it's standard) is
>that even with client superuser access mapped, root on a client can *READ*
>a file with world execute (like 711) on the server, no matter who owns the
>file.  Is this really in the NFS "design" or is it a common implementation
>bug?

A common implementation bug.  Been there since the SunOS 3.X days.
It's not impossible to close, but would require some changes with
(claimed) major performance hits.  This from a Sun software person
over a beer about 5-6 years back.
-- 
 "Voodoun is a very interesting religion for the whole family, even those
  members of it who are dead."
		-- "Good Omens", by Neil Gaiman and Terry Pratchett
Newsgroups: alt.security,comp.security.misc
From: sethb@fid.morgan.com (Seth Breidbart)
Subject: Re: WAISified PostScript would constitute a security hole
Followup-To: comp.security.misc
Organization: my opinions only
Date: Sat, 15 Aug 1992 20:57:34 GMT

In article <1992Aug15.140917.28166@jarvis.csri.toronto.edu>
flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>nagle@netcom.com (John Nagle) writes:
>>      You want the ability to start up a subprocess with limited privileges
>>without having to have super-user authority to do it.
>
>I think you need more than that.  You want the ability to start up a subprocess
>whose privileges are a strict subset of your own.  For example, setuid-nobody
>means that now you can chown files owned by nobody, whereas you couldn't
>before.  chroot with a copied-in /bin/login means you can spoof /etc/passwd.
>And so on.  You want to close certain things without opening any others.

What I need is the ability to run a subprocess as a slave; whenever it
tries to do any kind of system call, the call is handed to me (the
master process) instead.  That way, I can allow only "safe" actions; I
can also pretend to have done "unsafe" actions so the subprocess will
run without causing trouble.

Seth		sethb@fid.morgan.com
Newsgroups: alt.security
From: wls@cray.csd.uwm.edu (Bill Stapleton)
Subject: Re: Secure setuid programs: A model + NFS
Reply-To: Bill Stapleton <wls@csd4.csd.uwm.edu>
Organization: Computing Services, U of Wisc-Milwaukee
Distribution: alt
Date: Thu, 20 Aug 1992 17:26:25 GMT

In article <1992Aug20.093029.22179@jarvis.csri.toronto.edu>, flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
> buzz@toxicavenger.bear.com (Buzz Moschetti) writes:
> >The binary should be stripped and chmod-ed to 4711 to prevent strings(1)
> >from being run on it.
> 
> I presume that y'all realize that this is security through obscurity.  Not
> fatal, but don't assume it buys you anything.  Sure, chmod it non-readable, why
> not, but pretend you didn't.

Something I've noticed in at least two vendors' NFS (perhaps it's standard) is
that even with client superuser access mapped, root on a client can *READ*
a file with world execute (like 711) on the server, no matter who owns the
file.  Is this really in the NFS "design" or is it a common implementation
bug?

It may be obscurity, but we prefer people not be able to read/copy some system
software, especially where licenses or "secure" programs are involved.

--
Bill Stapleton
     wls@csd4.csd.uwm.edu
     uwmcsd4!wls
From: buzz@toxicavenger.bear.com (Buzz Moschetti)
Newsgroups: alt.security
Subject: Secure setuid programs
Date: 19 Aug 92 12:39:41 GMT
Reply-To: buzz@fsrg.bear.com
Distribution: alt
Organization: Bear, Stearns & Co. Inc.

We wish to make mount and umount available to two or three non-root accounts.
The plan is create a C code fork/exec wrapper that does the following:

	1.  Verifies that the euid is root.
	2.  Verifies that the uid is one of the "privileged" users.
	3.  Forces argv[0] to be /usr/etc/(u)mount.
	4.  Does an execv(3) -- NOT execvp(3) -- to run the argv.

The program itself is setuid root, mode 4711, so that the binary image
cannot be copied and compromised:
	-rws--x--x  1 root        24576 Aug 17 11:51 mmount

I believe this to be secure.  Can someone claim otherwise?
From: rvp7q@uvacs.cs.Virginia.EDU (Ramesh V. Peri)
Newsgroups: alt.security
Subject: Some one from Netherland
Date: 13 Aug 92 17:25:06 GMT
Organization: University of Virginia Computer Science Department

Some one from Netherland sent me mail reagrding my RFI about
security verification tools. The mail got deleted accidentally. 
Please send me mail again.

Regards,
Ramesh Peri
Newsgroups: alt.security,comp.security.misc
From: hp@vmars.tuwien.ac.at (Peter Holzer)
Subject: Re: WAISified PostScript would constitute a security hole
Keywords: trace, sunos
Organization: Technical University Vienna, Dept. for Realtime Systems, AUSTRIA
Date: Wed, 19 Aug 1992 10:44:03 GMT

pdgray@napier.uwaterloo.ca (Peter D. Gray) writes:

>In article <1992Aug15.172943.4449@jarvis.csri.toronto.edu>, flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>> Well that's easy if you have source.. just link with libraries which send
>> messages rather than doing the syscall...

>None of that effort is required. SunOS comes with a cool command called
>"trace" which can attach itself to a running process and watch ALL system 
>calls that the process makes (it prints out the arguments, return value and any
>errors). This program is built on the C function (which seems to be standard
>UNIX) called "ptrace". It would be easy to write a program that "watches"
>a process and detects any unsafe system calls and returns a failure code or
>better still spoofs the calling process.

I can't speak about SunOS, but on Ultrix, trace(1) does not use
ptrace(2). Instead it reads /dev/trace to get a log of system calls
issued by other processes (The pids, uids, ... of the processes to be
watched can be selected with ioctls). By the time your watcher process
detects an unsafe system call it has long been completed, and nothing
can be done about it anymore. 
-- 
|    _  | Peter J. Holzer                       | Think of it   |
| |_|_) | Technical University Vienna           | as evolution  |
| | |   | Dept. for Real-Time Systems           | in action!    |
| __/   | hp@vmars.tuwien.ac.at                 |     Tony Rand |
Newsgroups: alt.security
From: adam@arachne.uucp (Adam Shostack)
Subject: Re: Is SecurityCheck(tm) any good?
Organization: Aiken Computation Lab, Harvard University
Date: Fri, 21 Aug 1992 21:19:56 GMT

In article <CMM.0.90.2.714407160.dash@gyda.ifi.uio.no> Dag Asheim <dash@ifi.uio.no> writes:
>I'm sitting here with a demo-version of SecurityCheck by Raxco Inc.
>It tries to do much the same as COPS, but the price is $$$ (or NOKNOKNOK
>in my case, NOK=NOrwegian Kroner).  They even have a comparison I feel
>is kind of slanted.  The selling arguments is security by obscurity and
>commercial is better than PD.   But it also seems to be a little more
>polished.  Does any one else have any experience with it?

Dan Farmer wrote a reply after the company tooted its horn on the net.
He pretty effectively demolished their claims, asked (good) questions
about stuff like when will it be updated, how do we know that its
secure, why trust it when there's free code out there?

Dan might even mail you a copy, if you ask real nice.  :)

Basicly, spend the $ you would give them to pay a staff member to read
through the code, check it, make improvements, etc.  Much more
productive.



Adam




Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.      
Newsgroups: alt.horror
From: mch@sqwest.wimsey.bc.ca (Mark C. Henderson)
Subject: Ramsey Campbell - the mad blurber...
Organization: SoftQuad Inc., Surrey, British Columbia, CANADA
Date: Sat, 22 Aug 1992 05:18:36 GMT

Well, I just picked up the latest Abyss Book (_Anthony Shriek_, by Jessica A.
Salmonson), and I noticed the following blurb on the back cover:

"An awesome and terribly moving tale of madness 
and the supernatural. One of the most remarkable
novels the field of the macabre has produced for
a considerable time...A masterpeice."
- Ramsey Campbell
The last word is not a typo on my part.

Now for some reason that sounded familiar. I say to myself, I've heard
this before. So I go into my library and grab my copy of last month's
Abyss book _Stitch_ by Mark Morris. The back of that has a similar blurb by
Ramsey Campbell which reads...

"An awesome and terribly moving tale of madness and the 
supernatural. One of the most remarkable novels the field of 
the macabre has produced for a considerable time...  A 
masterpiece."
- Ramsey Campbell

Hmm. I suppose that the subtle difference between the two might
make this an altogether different brurb  :-)

Enough said I suppose.

(I'll add a plug for _Stitch_, it was very good).

Mark
-- 
Mark Henderson, SoftQuad Inc, 108-10070 King George Hwy, Surrey, B.C. V3T 2W4
Internet:   mch@west.sq.com, mch@sqwest.wimsey.bc.ca
UUCP: {van-bc,sq}!sqwest!mch Telephone: +1 604 585 8394  Fax: +1 604 585 1926
From: frantz@bvc.edu
Newsgroups: alt.horror
Subject: Re: Barker...Which one?
Date: 21 Aug 92 13:51:52 CDT
Organization: Buena Vista College, Storm Lake, IA

In article <170pl0INN30e@network.ucsd.edu>, mmaxwell@ucsd.edu writes:
> Okay.  After lurking on alt.horror for some time and seeing
> post after post about Clive Barker, i figure he must be worth
> reading.  The question is which one of Barker's books should
> i read to get a feel for him?  I used to be a big King reader
> but gave up after _Cujo_ (tho' i did read _Pet Sematary_ and
> wasn't reall impressed).
> 
> So, who wants to point me in the right direction?
> -------------------
> Matt Maxwell
> mmaxwell@ucsd.edu
> 
> "He took personality tests
>  and stapled them to his lower lip" -- Stan Ridgway

Well, Matt, it sorta depends on how you want to "sample".  Barker is a 
really wonderful short story writer and I would strongly recommend the 
Inuhuman Condition first--then lauch into The Books of Blood if you like it
.  If you're more interested in reading a lengthier work, well, it sort of 
depends on your tastes if you like horror-laced fantasy I'd recommend 
Weaveworld and follow that up with Imajica (I just finished the latter and 
loved it.  It's my favorite Barker book thus far, but I don't think it's 
one you want to start out with--pretty long & involved.)  As for a less 
fantasy-based novel, hmmm...I don't know.  Maybe Damnation Game?

Have fun.

Andrea @ BVC
From: laurelp+@pitt.edu (Laurel A Povazan)
Newsgroups: alt.horror
Subject: Re: Puppet Master (& other Full Moon Movies)
Date: 13 Aug 92 16:27:59 GMT
Organization: University of Pittsburgh

In article <rsykes.101.713563052@AFIT.AF.MIL> rsykes@AFIT.AF.MIL (Robert K. Sykes) writes:
>In article <4603@blue.cis.pitt.edu.UUCP> laurelp+@pitt.edu (Laurel A Povazan) writes:
>>From: laurelp+@pitt.edu (Laurel A Povazan)
>>In article <rsykes.85.713029615@AFIT.AF.MIL> rsykes@AFIT.AF.MIL (Robert K. Sykes) writes:
>>>                   Full Moon Production Films
>>>TITLE               GENRE     STARS                         
>>>-------------------------------------------------------------
>>>Bad Channels (5-92) Sci-fi    Charlie Spradling, Martha Quinn
>Laurel,
>     Yes, I get the calendars, the fan club newsletter and any other 
>information that I can get.  I watch the movies as soon as I can and on 
>Prodigy I have started some pretty good discusions about their movies.
>it here trying to get some Full Moon Fan's attentions.  I'm glad I got 
>yours, have you seen Bad Channels yet, it's pretty good.


I have not seen "Bad Channels" yet. I liked "Subspecies" and on my calendar,
August is "Suspecies II". I'd like to see that.

		Laurel

__________________"I am Count Dracula. I bid you welcome."__________________

Laurel A. Povazan                                "There is nothing there
laurelp@vms.cis.pitt.edu                          in the dark that isn't
                                                  there in the light---
(Also known as Laurel,                            except fear."  
 the avid horror fan!)                                 -Advertising line  
						        for "Cape Fear"
						 
_______________________-Count Dracula in "Dracula"__________________________
Newsgroups: alt.horror
From: J1300DAF@vm.univie.ac.at
Subject: Re: Sex and Horror
Organization: University of Vienna
Date: Thu, 20 Aug 1992 11:06:42 GMT

------------------------- Original Article -------------------------
From: J1300DAF@vm.univie.ac.at
Subject: Sex and Horror
Organization: University of Vienna
Date: Wed, 19 Aug 1992 09:27:25 GMT


The following thoughts came to my mind when reading the discussion
on Barker and his use of sex. It has been said, that he uses to
much sex (or features of deviant sex) in his works. In fact, by
doing so, he follows a tradition  of the genre. Horror is IMO
based on the fear of sex and the fear of death. Much of the classic
stuff is really very openly about sex: the vampire is a sexual
fantasy (think of Stoker's description of the 3 vampire ladies),
an other example is the topic of the split-personality (werewolf,
Jeckyll/Hyde), living out his sexual needs and therefore to be
punished. The same appears in some modern filoms (e.g. Halloween,
Friday the 13th), here are the teenagers to be punished (for having
sex). I don't want to start a discussion on Freud (libido and
thanatos and so on ...), but this concept fits perfectly.

Barker seems to be afraid of sex, and thats why he writes about it.
Why he often uses deviant forms of sexuality, is IMO clear: the
tolerance level of society has changed. Sexual taboos, which where
frightening at Stoker's time (sexual relationships without formal
binding, homosexuality), have lost their terrifying power. So Barker
uses harder stuff, but not to exploit them in a cheap way. I think
he only wants to show that there are forms of sexuality beyond our
"normal" understanding ... and he wants to show how frightening sex can
be. The combination of sex and hurt seems to be his major obsession,
and he uses it in a very exciting way in his work ... perhaps to get
rid of that obsession. When I was reading the Books of Blood, I felt
sometimes, that here is a person, who uses writing as a kind of therapy.

King also seems to be afraid of sex, that's why he doesn't write
about it. Obviously he is unable to write about that matter in an
open way, but I got the impression that is is always there. Many of his
figures are sexually frustrated. He said somewhere in an interview,
that one thing he is really afraid of, is the vagina dentata, so that
fits into the picture. King's main topic are the fears of children,
and one the fears of children is the fear of sex. I liked this theory
about the gang sex scene in IT, stating that the children used sex
to strengthen their bond. But think of an other possibility: IT
represents the sum of their childhood fears (isolation, division
from their parents and so on). By overcoming their fear of sex
they prepared to meet It. After they had successfully done away
with this big taboo, the were ready to destroy the rest of their
fears.

Well, just speculating ...

    - Oliver

"I never drink ... wine." (The Count)
From: dpsharpe@eos.ncsu.edu (DANIEL P SHARPE)
Newsgroups: alt.horror
Subject: Brian Lumley Info Request
Keywords: Brian Lumley
Date: 21 Aug 92 20:06:55 GMT
Reply-To: dpsharpe@eos.ncsu.edu (DANIEL P SHARPE)
Organization: North Carolina State University, Project Eos
Originator: dpsharpe@c00470-224wi.eos.ncsu.edu



I would like to get some information on Brian Lumley.  I remember
reading in this group an article or two talking about his work.
The articles were referring to a series of stories he wrote using
a Lovecraftian style.  I can't remember the titles exactly but I
remember the name Titius Crow (sp.) was in there someplace.  I have
looked in the "also by this author" listings of several of his
Necroscope novels but none of the titles seemed familiar.  If anyone
knows what I am talking about please email me more information about
this series of stories.  Are they hard to find? or out of print?  
Am I making all this up?  etc...
                            
=====================================================================
-                    |      Daniel Sharpe       |                   -
-                    |  dpsharpe@eos.ncsu.edu   |                   - 
======================= \\//<<>>||\\//<<>>||>> ======================
From: intruder@cats.ucsc.edu ()
Newsgroups: alt.horror
Subject: Re: Barker and sex
Date: 19 Aug 1992 11:01:56 GMT
Organization: University of California; Santa Cruz
Distribution: usa
NNTP-Posting-Host: am.ucsc.edu


> On the other hand, whereas I have to admit that Barker's treatment
> of sex in his work isn't always what I would call "normal" (that is
> to say, if one of the parties involved was your next-door neighbor,
> your response would probobly be anything from raising an eyebrow to
> actually attending the funeral), you certainly can't accuse him of  
> either over- OR under-doing it.  He just writes about it in the  
> same matter-of-fact style that he writes about anything else, so it  
> never seems out of place.

On the contrary, it DOES seem rather out of place to me.  Barker to me
seems to have a fixation with bodily functions of any kind.  He seems to
want to describe the human body in some way that will try and instill a
feeling in the reader that the body is a thing that is creepy or
disgusting in and of itself.  For instance, his constant portrayal of
sex and violence as being parallels, such as in the Hellraiser concept
or in that story with the chick who can manipulate human flesh.  Or,
just in the way he describes some things... I remember reading something
of his where he described what a male prostitue does as "selling what
sweated in his jeans to willing customers" or something like that.  I
don't know about you, but I personally don't usually think of a penis's
main function as constantly secreting sweat as it sits in my jeans.  He
could have put that MANY other ways.  Also, when reading Barker stories
I find that whenever anyone has to go to the bathroom, you have to hear
about it.  So-and-so relieves his bowels, such-and-such squats over the
toilet, etc.  Maybe he's tring to be "realistic" about his characters;
to me, it just leaves me picturing his characters with this constant
flow of bodily wastes squirting out of them.

Maybe trying to make the body seems disgusting is exactly the effect he's
looking for, but it doesn't really fly for me.  My own flesh is as
pathetic and weak as the next guy, but it's still just a machine my brain
sits in, to me.  Anything it does is just a fact of life.  I just get the
impression that Barker is a guy with a lot of hangups, about himself and
his sexuality.  Which to me seems typically English, if we want to bring
up the point about his being an English writer once again.
Newsgroups: alt.horror
From: frazier@elf.etsu.edu (Jeff Frazier)
Subject: Re: Question: Frankenstein, the true story?
Reply-To: frazier@elf.etsu.edu (Jeff Frazier)
Organization: East Texas State University, Commerce, TX
Date: Tue, 18 Aug 1992 19:15:02 GMT

Percy was her husband and Lord Byron was their friend. It started out as
a ghost writing contest during a weekend and her story eventually became
Frankenstein as we know it today.

Jeff Frazier (frazier@elf.etsu.edu)