Security quotes of the week

> Is chkrootkit confused?

Yes and no. It correctly detects that your /sbin/init is something hideous and nasty, but fails to realise that it's something hideous and nasty that Fedora ships 8)

If the Order stands, Twitter will be put in the untenable position of either providing user communications and account information in response to all subpoenas or attempting to vindicate its users’ rights by moving to quash these subpoenas itself--even though Twitter will often know little or nothing about the underlying facts necessary to support their users’ argument that the subpoenas may be improper.

As long as the Air Force pinky-swears it didn’t mean to, its drone fleet can keep tabs on the movements of Americans, far from the battlefields of Afghanistan, Pakistan or Yemen. And it can hold data on them for 90 days — studying it to see if the people it accidentally spied upon are actually legitimate targets of domestic surveillance.

An Apple programmer, apparently by accident, left a debug flag in the most recent version of the Mac OS X operating system. In specific configurations, applying OS X Lion update 10.7.3 turns on a system-wide debug log file that contains the login passwords of every user who has logged in since the update was applied. The passwords are stored in clear text.