Re: Explaining the need for a C compiler - to a security group

2007-10-27 Thread Mike Wallis
The counter argument i've heard is this: "but they'd need to compile a module for the specific kernel/OS they were attacking" But with vmware, it's not exactly a lot of effort to have VMs for each of the major OSes you're wanting to work with compile remotely and then copy the compromised k

Re: Explaining the need for a C compiler - to a security group

2007-10-26 Thread Ivan Voras
Cryer,Phil wrote: > "The days when you could prevent people from running non-approved > programs by removing the C compiler from your system ended roughly with > the VAX 11/780 computer." > My reply is, if an attacker is on the box and can compile code, you > already have more problems to worry a

Re: Explaining the need for a C compiler - to a security group

2007-10-26 Thread Poul-Henning Kamp
In message <[EMAIL PROTECTED] s.com>, "Cryer,Phil" writes: >Can anyone provide a more business sensitive response to "Isn't having a >C compiler on a prod box a security problem"? While I am in complete >agreement with the listed response: > >"The days when you could prevent people from running n

Explaining the need for a C compiler - to a security group

2007-10-26 Thread Cryer,Phil
Can anyone provide a more business sensitive response to "Isn't having a C compiler on a prod box a security problem"? While I am in complete agreement with the listed response: "The days when you could prevent people from running non-approved programs by removing the C compiler from your system