Slashdot Mirror

This reminds me of Bill Cheswick's paper "An Evening with Berferd In Which a Cracker is Lured, Endured, and Studied," from the 1992 Winter USENIX Conference. (Paper is available directly from Mr. Cheswick's site here as a postscript file).

In it, he toys with an intruder for a number of days. He pretends the system has actually been hacked, gives up bogus password files, and manually pretends to be a particularly slow machine with a lot of easy holes in it. It's a well-written, excellent piece of writing. I recommend it to anyone who enjoyed this video.

I saw the light on the "all systems need a firewall" thing after reading an excellent presentation called "My Dad's Computer: Microsoft and the future of internet security" by distinguished infosec professor, practioner, etc Bill Cheswick. I have a slide from that printed up and stuck to the side of my home rack*, I can read it from here:

"I've been skinny dipping on the Internet for years.

• FreeBSD and Linux hosts
• Very few, hardened network services
• Single-user hosts
• Dangerous service placed alone in sandboxes
• No known break-ins
• No angst

...and ever since I started practicing that credo, same here, too. It also saves you the false sense of security that a firewall gives. Guess what, if you have insecure services running a mistake on the firewall (or an attack from an internal host, or other source permitted to access that service) then a firewall's not going to save you. Turn 'em off. This laptop has apache (only running when needed, which is rarely and for local filesharing and a little light scripting only); sshd - ditto; CUPS - not externally accessible; X - ditto. Oh and (a secure) finger server, cos I wanted to demo the protocol to one of the kids in the office.

It takes a little longer to build a new machine, but the upside is you learn a lot reading the man pages.

* No, of course I haven't got a full-height rack in my bedroom; I'm a fully-grown adult, not a professional nerd. It's a half-height unit that doubles as a printer stand.

http://www.cheswick.com/ches/map/gallery/index.htm l/

Overlay (embed?) the Blogosphere map on an updated Internet map!

Maybe a "You are here" icon?

One-time passwords fix a lot of the problems with simple passwords, but generally require hardware or printouts.

People have toyed with pass-algorithms, where the response to a challenge is computed by a human without assistance. I have written a half-baked proposal to obfuscate these challenges and responses using some of the techniques used in baseball signals. See

http://www.cheswick.com/ches/papers/auth.pdf

Perhaps you can figure out how to make this idea workable.

ches

"It also includes a spectacular representation of the Internet"

hmmm... that represenation was taken from here, and its a snapshot from 1999 (sic). Also, i'v seen that before (aktually, i have one of those as a desktop image). I think it was on /. before...

are we being s^Htold old news? I mean, really old, not just your regular slashdot-dupes....

Also: look at theis galery of network images. Look at "Highschool Dating". Few cicles? No gays? something is wrong here... On the other hand, look at "Highschool Friendship": the four lonely ones to the left... what dot you think are the chances that thous four are still living in their parents basements and are reading slashdot?...

http://www.cheswick.com/ches/map/index. html