Re: [SL] SQL-Ledger vulnerability CVE-2006-4244

[GeorgeOsvald <geo...@ya...>]

On Friday 08 September 2006 09:12, Christopher Murtagh wrote:
> On 9/7/06, GeorgeOsvald <geo...@ya...> wrote:
> > On Friday 08 September 2006 07:41, Christopher Murtagh wrote:
> > > That is total BS. There are people who are using internet facing
> > > installations of SL, this can be demonstrated by a google search for
> > > 'SQL-Ledger version'.
> >
> > This is a total pile of crap. There is no way you could find my
> > SQL-Ledger installation on the net. If anyone is so naive and is letting
> > this happen then it is there fault but you should not say that every
> > installation of SL is under threat. That is bullshit.
>
>   And where exactly did I say this? I said that the application is
> critically flawed and that there are users who have internet facing
> installations. Claiming that these people were naive in trusting
> Dieter's work is unfair, 

I am not saying they are naive if they trusted Dieter. What I say is that 
there is a lot more to security then just the application itself. Anyone who 
just slaps anything on a web server without any additional precautions is 
naive. Dieter does behave strangely sometimes I admit but he can not be held 
responsible for every one who just blindely installs SL and then hopes for 
the best. I understand that there is a problem, my point is though that if 
your server is safe there is no way anyone from outside (not an employee) can 
do anything if your setup is half sane.

> most of them have never met him and, thanks 
> to his censoring haven't seen the security complaints. That makes
> about as much sense as saying that Dell laptop users who got burned
> were too naive and should have never used the batteries.
>
> Cheers,
>
> Chris
>
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> sql-ledger-users mailing list
> sql...@li...
> https://lists.sourceforge.net/lists/listinfo/sql-ledger-users