Less is More!
Less running or installed on your computer is more secure. With less running on your computer there are fewer attack vectors (http://searchsecurity.techtarget.com/sDefinition/0,290660,sid14_gci1005812,00.html).
To make sure we are all on the same page consider that everything that us running on a computer is a potential weak point where the system can be compromised. Unnecessary or occasionally used programs should not be set to start when your computer starts or you log into the computer. Sun Java is a good example here Java does not start until it is needed.
Some Things are *Not* Optional
This is not to say that there are some thing s that should be running as they specifically add security. Three that come to mind are personal firewalls, anti-virus and anti-spyware. Honestly the line between the last two has been blurring and we should have "anti-malware." Aside from the fact that there is no marketing value in malware and no one would buy it...
In keeping with the theme that more is less I won't do a deep dive on removing excess programs right now, but will look up some good references and post them in another blog entry.
Stay tuned for the next "Cup of Hot Cocoa" episode where I discuss patch warfare.
Showing posts with label Sun. Show all posts
Showing posts with label Sun. Show all posts
Monday, March 12, 2007
Monday, January 22, 2007
Do you Java?
Sun Java has this nice "feature." Every time you update it the old version is left behind.
Which is great if you have some Java program that needs that version. For the rest of us it leave old, hopefully unused, vulnerable code laying around.
oh by the way it's not just a few megabytes. Per the MS "Add/Remove Programs" each version takes up between 60+ MB to over 100MB. Not that I've verified that I was more interested in removing the vulnerable code.
I have not found a better method than to sit there and remove them one by one hoping that it doesn't require a reboot... I know there are arguments for and against letting it reboot, but I want it off my system so I'll do as it requests to be on the save side.
UPDATE 1/23/07: The Internet Storm Center (http://isc.sans.org) has an article on the subiect (http://isc.sans.org/diary.html?storyid=2088) including a link on command line silent installs/uninstalls (http://java.sun.com/j2se/1.4.2/docs/guide/plugin/developer_guide/silent.html). The uninstall requires the proper executable that was used for the installation
Update 2/21/07: Test Results
The good installation is a snap and using PSEXEC allows remote installations without a hitch Return codes I found are 0 installed and 1603 already installed. One caveat if you use "\\*" as your target it will install on everything in the domain including servers.
Uninstalling fails and throws a window explaining the options for Windows Installer switches. I don't know if I missed anything, but after a half dozen tests I decided move on for now.
Update 2/22/07: Silent Uninstall Resolved:
The link above was for older versions of Java I found the newer documentation online and basically here is how to uninstall silently.
1.5.0 Update 10 AKA 5.0 Update 10
msiexec.exe /qn /x {3248F0A8-6813-11D6-A77B-00B0D0150100}
1.5.0 Update 11 AKA 5.0 Update 11
msiexec.exe /qn /x {3248F0A8-6813-11D6-A77B-00B0D0150110}
Where 1.5.0u10=0150100
and 1.5.0u11=0150110
Additional details here: (http://java.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/silent.html#uninstalling)
Which is great if you have some Java program that needs that version. For the rest of us it leave old, hopefully unused, vulnerable code laying around.
oh by the way it's not just a few megabytes. Per the MS "Add/Remove Programs" each version takes up between 60+ MB to over 100MB. Not that I've verified that I was more interested in removing the vulnerable code.
I have not found a better method than to sit there and remove them one by one hoping that it doesn't require a reboot... I know there are arguments for and against letting it reboot, but I want it off my system so I'll do as it requests to be on the save side.
UPDATE 1/23/07: The Internet Storm Center (http://isc.sans.org) has an article on the subiect (http://isc.sans.org/diary.html?storyid=2088) including a link on command line silent installs/uninstalls (http://java.sun.com/j2se/1.4.2/docs/guide/plugin/developer_guide/silent.html). The uninstall requires the proper executable that was used for the installation
Update 2/21/07: Test Results
The good installation is a snap and using PSEXEC allows remote installations without a hitch Return codes I found are 0 installed and 1603 already installed. One caveat if you use "\\*" as your target it will install on everything in the domain including servers.
Uninstalling fails and throws a window explaining the options for Windows Installer switches. I don't know if I missed anything, but after a half dozen tests I decided move on for now.
Update 2/22/07: Silent Uninstall Resolved:
The link above was for older versions of Java I found the newer documentation online and basically here is how to uninstall silently.
1.5.0 Update 10 AKA 5.0 Update 10
msiexec.exe /qn /x {3248F0A8-6813-11D6-A77B-00B0D0150100}
1.5.0 Update 11 AKA 5.0 Update 11
msiexec.exe /qn /x {3248F0A8-6813-11D6-A77B-00B0D0150110}
Where 1.5.0u10=0150100
and 1.5.0u11=0150110
Additional details here: (http://java.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/silent.html#uninstalling)
Subscribe to:
Posts (Atom)