One of the first things that one notices when trying to set up IPSec is that there are so many knobs and settings: even a pair of entirely standards-conforming implementations sports a bewildering number of ways to impede a successful connection. It's just an astonishingly-complex suite of protocols.

One cause of the complexity is that IPSec provides mechanism, not policy: rather than define such-and-such encryption algorithm or a certain authentication function, it provides a framework that allows an implementation to provide nearly anything that both ends agree upon.

Overview: A vulnerability within Adobe Reader has been identified. Under certain circumstances, remote exploitation of a buffer overflow in Adobe Reader could allow an attacker to execute arbitrary code.

Adobe has solutions available that can rectify these issues. Please refer to the "Recommendations" section for further information.

Effect: If exploited, it could allow the execution of arbitrary code under the privileges of the local user. Remote exploitation is possible if the malicious PDF document is sent as an email attachment or if the PDF document is accessed via a web link.

Details: The vulnerability is within the Adobe Reader control. Under special circumstances, if a malicious PDF file is opened using Adobe Reader, a stack buffer overflow could occur resulting in the execution of arbitrary code.

There is now a 50% chance of being infected by an internet worm in just 12 minutes of being online using an unprotected, unpatched Windows PC.

Security vendor VeriSign found 66 percent would choose to give up their passwords for a Starbucks coffee, during an informal on-the-street survey conducted Thursday in San Francisco.
...
Those that revealed their password or gave hints received a $3 gift card for Starbucks--the price of a latte.

More than one-third of Internal Revenue Service employees and managers who were contacted by Treasury Department inspectors posing as computer technicians provided their computer login and changed their password, a government report said Wednesday.

...

The auditors called 100 IRS employees and managers, portraying themselves as personnel from the information technology help desk trying to correct a network problem. They asked the employees to provide their network logon name and temporarily change their password to one they suggested

Every time I see one of the current spate of AOL television ads portraying their customers as clueless morons I want to scream. It’s not that I have some sort of deep-seated respect for the intelligence of AOL users, but rather, these ads represent, far too well, the current industry mindset, which treats computers as home appliances.

"Don’t worry about viruses and spyware," AOL explains, "we’ll take care of that for you... Plug it in, turn it on, and disengage your brain..."

Pay attention, you’re about to read something vitally important: COMPUTERS ARE NOT APPLIANCES. THEY ARE TOOLS. Tools require that their user be skilled. Tools require education and training to use. Tools require a level of involvement beyond that of an appliance because "tool use" carries with it an inherent danger.

And yet, over the past decade, the computer industry has deliberately ignored the nature of its product. It has attempted to grind off the sharp edges, to put padding on the corners, and to make a "consumer safe" appliance from these inherently dangerous tools.

The current state of security on the Internet is simply reaping the seeds we have sown.

Let's get out of the computer world. Let's talk about heirloom jewelry. My wife, Maryam, has a bit of jewelry. Does she store it here in the house? No. Why not? It's not secure enough. Where does she store it? In a safe deposit box in a bank. Let's talk about a bank's security and how many layers it has.