XPost: alt.comp.os.windows-10   
   From: user@example.net   
      
   On 03/04/2024 14.41, Newyana2 wrote:   
   > "Paul"  wrote   
   >   
   > | Both ecosystems have had supply chain attacks. There | was also an   
   > attack carried out by a local university, for | which Linus assigned   
   > a "permaban" on their kernel submissions. | That was an attack on   
   > kernel.org . Whereas the XZ one is | a more general Linux one, a test   
   > of how well the system | responds to shenanigans. | | Windows 11   
   > shows an "Extract from" if I highlight an XZ file. | It would appear   
   > the Insider development, is already in | the Release stream. All my   
   > instances of XZ are .tar.xz . |   
   >   
   > You have XZ files on Windows?   
      
   Yes, and you have sshd too, that you need of course enable yourself if   
   you intend to use it. So you have all the tools needed for this hack,   
   except you lack the systemd part as do all Unix variants and a number of   
   Linux distributions.   
      
   Things evolve, with the amount of work they are putting on WSL you   
   shouldn't be surprised that next version of microsoft windows may   
   actually run on a Linux kernel with an api wrapper to allow you to run   
   old windows applications. There was a talk about this already during   
   Balmer's time, you can guess who wasn't happy about the idea.   
      
      
   > ...To my mind this is all a classic case of placing the blame in the   
   > wrong place. Clearly it's a problem is someone comes up with a hack   
   > of remote access software. But the real problem is that software   
   > itself. Something like SSH shouldn't be in use. Remote Desktop shouldn't be   
   > in use. People just can't even imagine using a computer safely.   
      
   The major danger for desktop users ain't ssh nor rdp, but the web   
   browser and mail client for those who don't use a web based mail   
   service, so yet again hinting about CVE-2008-5424, CVE-2010-3147, and   
   MICE issues on your computer.   
      
   On corporate systems you need to be able to remote access them as it   
   would take hours just to upgrade a few computers if you need to get down   
   to the data center and then login to each machine locally and do the   
   update. Sure you shouldn't let the endpoints be accessible directly on   
   the internet.   
      
      
   > Some years ago my starving artist brother called me. He was in a   
   > panic, explaining the "Microsoft" had called him to warn that there   
   > could be repercussions because my brother had not paid his Windows   
   > bill for several years.   
      
   This kind of scams been around for a long time, "Hi, this is Microsoft   
   calling..." even I have had those calls, quite fun you can have with the   
   Indian guy on the other side.   
   It's amazing people still get caught in them... but that is how things   
   goes when people don't care to learn about the things they use.   
      
   --- SoupGate-Win32 v1.05   
    * Origin: you cannot sedate... all the things you hate (1:229/2)