Well, Network Ice is trying to correct Little Stevies missives.
From The Register, for their side of the story.
Printable View
Well, Network Ice is trying to correct Little Stevies missives.
From The Register, for their side of the story.
Beware of people who profit (money or ego) by yelling "the sky is falling".
Gibson has had to retract at least two stories in the past year because he was just flat wrong. In this case, his evaluation of ICE is also wrong (IMO). His fears re MS XP may be "exaggerated". I don't know enough about XP to judge.
Steve's site provides a valuable service and some good products and I'm willing to accept that his motives are pure. Perhaps he is just overeager and concerned that we all know of dangers ASAP.
Many vendors of security info and products use scare tactics. In fact they often lie (especially if they claim to have a new private encryption scheme).
Remember that Chicken Little is alive and well.
------------------
Jerry CTX
Computer (In)Security
yeh, Steve Gibson is definatly sound more and more like an irrational alarmest...
i am quite sure M$FT is not about to make the internet a "crackers dream come true" with vulnerable OSs (atleast not intentionally), M$FT is is too big and in the spotlight too much for something like that to go over without more sys admins around the country talking about it, true WinNT and Win2k is targeted but only because a great percentage of servers use it...
a couple of months ago M$FT got Cracked pretty good, and maybe it was a wakeup call for M$FT so start makeing their Product more secure out of the box...
my philosophy is to make it secure without internet access,without file & printer sharing and then if the user or sys admin wants to open their system up to internet access they can reconfigure that as needed, because newbies don't have a clue of this so when the newbie gets their computer running with the default setting as they are now at present is a mess...
Hey guys, the sky is falling. You should see my car first thing in the morning, until I have a chance to wash all that **** off. Bird**** that is. Those damn seagulls really do a job.
https://discussions.virtualdr.com/]"
------------------
Your Neighborhood Schlepper
The Registry article states that "BlackICE Defender is not a firewall. Its primary function is that of an intrusion detection system," it says. "BlackICE Defender is, in reality, a 'hybrid' between intrusion detection and firewall protection."
I won't even pretend to understand half of the technical jargon over this issue but this sounds a little like 'six of one/half a dozen of another'.
Isn't the main difference between Black Ice and ZA the simple fact that Black Ice does not monitor outbound traffic?? For 40 bucks I would expect more/complete 'protection'.
Just my opinion. https://discussions.virtualdr.com/
BTW, looks like Steve's site is under bombardment again.
------------------
When everything's coming your way,
it means you're in the wrong lane
going the wrong way.
Hmmmm...
Did you guys actually read the article???
Gibson did take some hard jabs at BlackICE, and one has to expect some sort of counter jabs.
Network ICE is a good company that is also an important asset to the Internet Community.
I find it distressing that Gibson did not appear to inform Network ICE of his findings and conclusions and allow them the option and time to update their product.
If this indeed is the case, I personally feel that he used bad judgement.
But you folks should also know that the information put out by Network ICE countering Gibson's claims is just plain nonsense.
BlackICE has always been considered to be a firewall and as such, it's performance certainly should be compared to other firewall products.
Network ICE clearly claims it to be a "PERSONAL FIREWALL" on their Home Page at:
http://www.netice.com/
It would be nice to see less of the "quick draw" type of conclusions that seems to have ignited this controversy.
[This message has been edited by rmbox (edited 06-06-2001).]
Netork ice screams out loud that there s/w is NOT a firewall??? I never hear as much as a peep from them when I see countless "reviews" of "firewalls" which sing Black Ice's praises, many in popular PC mags and on famous web-sites...god forbid, now that there s/w is exposed as being an overpriced pos which does nothing more than tell you: "hey buddy, geuss what. You've been compromised, good luck to you" they scream bloody murder.
"i am quite sure M$FT is not about to make the internet a "crackers dream come true"" get your head out of the sand!! MS is the same company who has to release a zillion security patches after they so happily dish there product to unsuspecting sheep like us.
"Irrational Alarmest"??? Give me a break, what a load of hogwash. Let's not forget who made us aware of "spyware", it certainly wasn't MS or NI. I would rather have guys like Gibson "overreacting", rather than depending on the likes of MS, or NI, who obviously see that there once, huge monoploly on the "firewall"(errr, I mean Network intrusion device) industry is over. $39.00 for what???
------------------
Who put a 'Stop Payment' on my reality check?
Very few users know enough about security issues to judge the claims made by people such as Steve Gibson.
Among security professionals Gibson is at best a laughing stock. A few quotes from the Security Focus mailing list:
From H.D.Moore of secureaustin.comQuote:
This is definately not an issue for the vuln-dev mailing list. So Win2K and WinXP can spoof packets, so could Win9x/ME given the right code. It was possible to send forged packets with win95 by accessing the raw modem device (not as difficult as it sounds) and sending raw ppp packets (aggressor). You could also forge packets by writing them at the NDIS layer, either by using a custom packet driver or hooking into the TDI api. That Microsoft is finally complying to the Winsock standard shouldn't be cause for people to get upset.
<rant>
This seems like yet another attempt for Mr Gibson to get press by overreacting to a non-issue. Every single network project on his web site is based on him "rediscovering" old problems, presenting himself as the leading
authority, and failing to do a good job of conveying the real threat. Take his "nanopackets" project, where he describes an IP packet in binary context
which somehow makes it much more interesting than an IP packet in more understandable format.
</rant>
From [email protected]Quote:
Oh puleeese!
1) It's not too tough to "crack" any software registration program when
someone yahoo shares their enterprise license key - this is not cracking -
this is a known registration number that is now warez.
2) Gibson has just admitted how *not* bright he is. His scenario involves
getting a piece of code onto a WIndows XP box on the Internet. I'll skip
the piece about how you must first compromise a system or get a user to
launch a piece of code - so just for arguments sake, let's assume we send
an email to an XP user and get them to launch the code. The code is a
zombie client that is launched as part of a DDOS attack and uses raw
sockets to spoof the originating IP address
Here is where Gibson's thesis falls apart. Gibson claims that in order to
do this kind of attack on NT4 or Windows 2000, you must first load a
special packet driver (and reboot), then load a special IP stack (and then
I'm guessing, reboot), and then write special code to leverage all of
this. If this were indeed the case, Gibson might have a point - it would
be difficult to write script kiddie code to do this. However, it is far
simpler than all of this. I guess he's never heard of dynamically loading
packet drivers or winpcap! Any thirteen year old has already figured out
how to do this.
All he'd have to do is add one additional file to his trojan package - and
he could get any NT4 or Win2K machine to be part of his DDOS army. Weld
Pond has much more to say about this at HNN
(http://www.stake.com/security_news/arch.html?060501)
If Gibson isn't bright enough to figure out how to write a script kiddie
trojan to dynamically load the packet driver, I don't trust him enough to
be telling the world that he thinks there's a problem. Besides, if this
was really a problem, we'd already see this occuring on Win32 systems, Unix
systems, Mac systems, etc - all of which support raw sockets. Methinks
Gibsons diatribe was one more of wanting publicity for himself or his site
than making a legitimate statment. He's also shown that he thoroughly
misunderstands IDS products, and how to protect himself from being
trojaned: http://www.theregister.co.uk/content/8/19469.html with something
that should have been detected with his antivirus product
From [email protected]Quote:
Here are what I consider my 2 cents to above message :
This was Posted to nmap mailing list (The moderater note is not
from a securityfocus moderator but from Fyodor):
Steve Gibson is a media **** and should be treated as such. If you look
at how he writes up things on his own web site, you can see they're made
to look just like how they might in print. In my surveying of what he's
done, he's done...well...nothing very exciting. His "nanoprobes" were
really lame (a different spin on what nmap does) and if people would
just start ignoring him, we'd be much better off.
[ Moderator note: I agree 100% with Darren & Andy. Gibson is a
charlatan whose "research" is written for clueless media reporters
(for press attention) and the teeming masses of internet newbies (to
whom he sells various products). His "findings" are not new, are
always filled with massive hyperbole, and are frequently completely
false. Instead of presenting evidence to prove his points, he tends
to just state them using goofy blue or green fonts as if that
somehow adds credibility. We recommend avoiding this guy!
-Fyodor ]
At least half the "for profit" security sites on the web are pure B.S. Please take what they say with a large grain of salt.
------------------
Jerry CTX
Computer (In)Security
MEOW! http://communities.prodigy.net/genea...scratching.gif
Mo
https://discussions.virtualdr.com/
------------------
You Are The Weakest Link...Goodbye!
Check me here as well!
Jerry, I agree with a lot of what you say (as usual).
I do give Gibson credit for bringing awareness of spyware and a usable freeware tool (Optout) to the masses. The first time I became aware of spyware was in discussions of Gibson at NoWonder. I used Optout to clean up and was grateful. I now use Ad-aware and I'm grateful to the Lavasoft people too.
Where were all these other experts when spyware was being installed unknowingly? If they knew about it were they telling each other about it and shaking their heads at how dumb the masses are? Perhaps discussing among themselves how to get the word out while every day thousands more became victims?
Gibson is an effective whistleblower even if his technical expertise may not match some of the other security experts that most people never have and never will hear from. And if he's in it to make a buck... good for him, I hope he gets rich.
That said, he sometimes jumps the gun... and has to backtrack sometimes. https://discussions.virtualdr.com/
------------------
"If you look at the sun without shielding your eyes, you'll go blind. If you look at the moon without covering your eyes, you'll become a poet." --Serge Bouchard
I have always said, in all the past posts about BlackIce, that it is more of an intrusion detection program and not a firewall. It detects a connection and THEN takes steps to alert the user and stop the connection, unlike a true firewall (like ZA), which prevents the connection from happening in the first place. This has ALWAYS been the difference between these two programs, and NetworkIce has also ALWAYS made this distinction, althought it has called it a firewall because of it's firewall capabilities. Why would Gibson just NOW open his mouth and make such a boneheaded and amateurish error? *shrug* It makes no sense.
[This message has been edited by Interceptor1 (edited 06-12-2001).]
At least Steve Gibson is doing something and informing the public. Is he perfect, not by a long shot.. I don't see these others doing squat except for attacking folks like Steve Gibson. Their are those who do and those who whine!!! Steve is a doer..
------------------
Quote:
Never be afraid to try something new. Remember that amateurs built the Ark. Professionals built the Titanic.
I cant believe this crap....... Steve is a watchdog just like you see on local news every night. Hes performing a job that many will not do, "battle with the big boys" give him a break....geeesh I can remember many times hes been praised for his work, now he makes a mistake and ...hmmm lets kick him!!! YOU WILL be using his advice in the future believe me, lighten' up https://discussions.virtualdr.com/
------------------
"Onward Through the fog"
ErrorCity
smrfll snorrtt huh?? mufllea okay.. um..
I just disabled black ice on my mothers machine today.. not becaue I read all the articles etc?? because I blew 40$ and didn'nt hear a word from them until I needed to do WHAT?? PAY ANOTHER 40$? till I hear from them again?? LOL (another year presuming)
mach.
------------------
Tip#16: never go out in the rain without an umbrella.
Spaking of alarmist statements, does this sound alarmist to you or not?
I just love it how they listed computer activities and manage to target every major user group that exists. Special mention is even given to corporations. The above is just a taste of course, they go on to specifically mention broadband users, gamers, corporate users, and gamers again. But that's after they talk about their "sophisticated" product that will save you from malicious haxxorz!Quote:
As recently as five years ago, hackers pretty much ignored home and small office Internet users. This is no longer the case. As more and more individuals and businesses connect to the Internet, hackers are targeting home and small business users in ever increasing numbers.
Are You at Risk?
Do you do any of the following with your computer?
Log on to a corporate network using a VPN or dial-up connection?
Trade stocks on-line?
Play interactive games like Quake or Half-Life?
Purchase items from web sites like Amazon.com or Ebay.com?
Chat with friends using ICQ?
All of these typical Internet activities dramatically increase your risk to being attacked. Hackers love to prowl the Internet looking for unsuspecting victims. They especially like users with connections to corporate networks.
Then for good measire, they add a parting shot at paranoia again with:
Yup, that's all from http://www.netice.com/products/soho_solutions.htmlQuote:
Home and small office computers are no longer safe from hackers. If you do anything on the Internet you need to defend yourself. Get BlackICE Defender today and put the hackers on ice.
Gibson is not the only alarmist in the world. The diffrence between his alarmist statements and Network ICE's is summarized in the following:
Gibson tries to explain the vulnerabilities and tries to make his readers understand. He tells you that you are not safe and he tries to tell you why. NI just tells you that you are not safe and proceeds to tell you "by the way, check out this great product we made..."
Gibson is not selling ZoneAlarm. ZoneAlarm isn't even being sold. It's FREE. Gibson has never directly got so much as a penny from me, I don't even get the impression that he's trying to.
Those are the major differences I see.
Professional security experts think Gibson is a joke? Does that mean that what he says about DDoS is wrong?
Every day that GRC.com is attacked only serves to reinforce Gibson's claims that Internet Terrorrism is so easily done that 13 year olds who have the time to waste can do it.
I love it how "experts" say that Gibson is repackaging old knowledge about vulnerabilities and "presenting himself as the leading expert". If the knowledge was known to these "experts" for a long time, then why haven't they spoken up?
Instead of <ranting> about it, why don't they give out constructive criticism? Why don't THEY give us the real deal on things and tell us that causing mayhem in the internet is NOT as easy to be alarming. Oh doh! They're even saying it's *easier* than how Gibson explained it!
Again I find it tragically funny how these "experts" say that writing trojans is much easier than Gibson said it was and proceed on saying that they don't think there's a problem. Gibson said it was easy and said that it was a problem, they say it's easier and say there is no problem? Does that mean that it is not easy to bring down any site you choose with impunity?
This leads me to ask if they are upset so much because Gibson is hogging the limelight or because they aren't getting nearly as much as they want. It seems as if they dislike Gibson's overfed ego because their own egos are starved.
As far as I'm concerned, there are far too many quacks in the internet who like to say they know something. Heck, even Gibson might be one of those. All I know is that in the matter of Network ICE vs Steve Gibson, Network ICE wants me to pay ~$40 and Gibson tells me to download the FREE version of ZoneAlarm.
I choose the path of least monetary resistance.
Thanks for your indulgence in reading my rant, have a nice day.
Shinovich wins! VIVA REVOLUTION!
Okay, uh, Shin pretty much covered everything. Comment on Gibson's presentation style. I love it. YOu hate it. Oh well.
it's not true that he not selling zonealarm .He is selling zonealarm pro version.Quote:
Originally posted by MistarShin:
Gibson is not selling ZoneAlarm. ZoneAlarm isn't even being sold. It's FREE. Gibson has never directly got so much as a penny from me, I don't even get the impression that he's trying to.
beware of post under 200...lol but serious the ones near 1 bother me.........hehe
------------------
"Onward Through the fog"
ErrorCity
Stings shack
Quote:
Originally posted by MistarShin:
It's FREE.
I'm assuming that u mean that zonealarm is also available as a free version.That is correct but their is a reason behind having a free version and that is to build a name for the program.If he released zonealarm pro right away not alot of people would have bought it cause they would need to pay money.By creating a new software u can build a reputation of it and then released a pay version.I will not be suprised if in the near future he gona released ad-aware pro version.After all it has pretty good reputation at this moment minus the problem that version 5 has at this moment which i'm sure will be fixed soon.Quote:
Originally posted by MistarShin:
Quote:
Originally posted by MistarShin:
It's FREE.
Gibson has nothing to do with Ad-aware, although he does recommend it. It's made by Lavasoft and they already make an Ad-aware "Plus" version you can pay for.
------------------
"If you look at the sun without shielding your eyes, you'll go blind. If you look at the moon without covering your eyes, you'll become a poet." --Serge Bouchard
This quote is nothing different than Steve's quote. Kinda sounds like someone is trying to alarm people (scare them).Quote:
On average, 10 to 15 new viruses are released every day. On average, several program security holes are discovered each day. Most are in Unix, Linux and Windows 2000 servers but some are in Windows 9x processes. The hackers will always be one step ahead of the software vendors so don't assume you are safe because you have the latest security programs, patches and updates.
From http://www.ceepeeu.com.
Actually, every security page I have visited always has something in their articles they are trying to alarm you or scare you..
------------------
Quote:
Never be afraid to try something new. Remember that amateurs built the Ark. Professionals built the Titanic.
[This message has been edited by amathis (edited 06-13-2001).]
I have read some bad press latley about network Ice so I switched to Zone Alarm. I was wondering what people think of it. Thanks..
Bill
Quote:
Originally posted by Renovator:
Well, Network Ice is trying to correct Little Stevies missives.
From The Register, for their side of the story.
http://www.zdnet.com/downloads/stori...,,0015P7,.html
http://www.epinions.com/cmsw-Utilities-All-Zone_Alarm
------------------
"Onward Through the fog"
ErrorCity
Stings shack
Amathis - The quote from my web site is accurate. Scare tactics present exaggerated or false information. Gibson has repeatedly created furors that he later retracted.
Call me wrong. Call me stupid. Call me ugly. But please don't imply that I'm dishonest. I resent it deeply.
------------------
Jerry CTX
Computer (In)Security
cool out guys, it only gets better....lol
------------------
"Onward Through the fog"
ErrorCity
Stings shack