Slashdot Mirror

You may understand html, but you failed to note that goatse.cx does not have the https port open.

I'm sure there's a pithy comment I could make about encryption, security, and goatse.cx, but it just isn't coming to me right now.

I do understand html. I'm just lazy.

But point taken. (Although it wasn't really an MS crack, I should have known better on /.) I should have said "more software companies" instead of "other software companies". There are plenty of games that include level editors and such. I just wish there were more of them and that they embraced it as much as we see here.

But to rebut your comment, Office and VB are designed (better?) to be data manipulation tools. Games aren't and it seems to me that companies would rather you didn't mess with their "private" files. That's just paranoid thinking IMHO.

irony

If we fed it some /. trolls (like this one). think it would find any patterns relating to goats

NOT ANYMORE! hahahahahahahahahahahahahahahahahahahahaha

goatse is short for goatse.cx, which is pronounced goat-sex. I guess you could pronounce goatse, "goat-seh".

Sponsored Link:
GOATSE.CX
Salty donkey balls
In CmdrTaco's mouth
How he likes the taste

At first I thought you wanted flash and open sores

NASA Reports Vast Goat-cheese Reserves in Anal Crust

Note to moderators: mod this up! It's important to know the answer to this question. After all, the goatse man has by far the most-viewed anus on the internet. He's famous!!! Wouldn't you like to shake his hand (after he washes them, of course)?

but G.O.A.T is better!

Let's all include a page or two somewhere on our sites marked as warez, fill it with linkes marked as latezt offize xp etc.. and have the links point at some real ware

We should go start pushing it at goatse.cx :-).

Please go to www.ratehisdick.com and rate the thegiver (the giver as in from www.goatse.cx) a 10. Thank you everyone, especially trolls for introducing me to Goatse.cx

Please go to www.ratehisdick.com and rate the thegiver (the giver as in from www.goatse.cx) a 10. Thank you everyone, especially trolls for introducing me to Goatse.cx

will post goatse links if they think they can get away with it.

Who cares about the giver? Link straight to hello.jpg

Here's a mirror

Securing Small Networks With OpenBSD, Part 2
by Jacek Artymiak
04/11/2002

Welcome back.

advertisement
I'd like to thank you for your feedback on the first part of "Securing Small Networks with OpenBSD." You asked many interesting questions that prompted me to write another article in which I'll try to answer questions regarding the new packet filter, pf, introduced in OpenBSD 3.0.
How do I use pf?

That's easy: Download and install OpenBSD 3.0 or 3.1 and it's there. :-) To control pf, use the pfctl tool.

*
* Start pf -- pfctl -e
* Stop pf -- pfctl -d
* Upload new pf rules -- pfctl -R /etc/pf.conf
Upload new nat rules -- pfctl -N /etc/nat.conf

As you can see, the names of the configuration files have changed as well: packet filtering rules are now stored in the pf.conf file located in the /etc directory. The network address translation rules are stored in the nat.conf file located in the same directory. When pfctl complains about syntax errors, use the -v option to display the rules as they are processed by pfctl. For example, when the packet filtering rules contain errors, use pfctl -v -R /etc/pf.conf | less to browse the output and locate lines with errors; then edit the configuration file and try uploading the new rules again.

Note that pfctl will complain if you try to upload new configuration rules while pf is not running. When that happens, start pf as described earlier and try again.

For more information about pfctl, read man pfctl.
How do I translate ipf rules into pf rules?

Administrators new to pf will be glad to know that its syntax is very similar to that of ipfilter . Simple rules can be translated without any changes whatsoever, while more complicated statements will have to be slightly adjusted to match the new syntax. This is only a small inconvenience, as the new rule syntax is easier to read and manage. In general, you can expect to halve the length of the configuration file while retaining all previous functionality.

Let's have a closer look at what changes have been made. First, a simple example using the design described in the original article:

lo0: all inbound and outbound packets can pass through ()

ipfilter:

pass out quick on lo0 all

pass in quick on lo all

pf:

pass out quick on lo0 all

pass in quick on lo all

As you can see, nothing has changed here. Such simple rules can be copied verbatim. The situation changes when we try to rewrite more complex rules, like the ones shown below. (The tun0 interface connects our network to the Internet.)

tun0: outbound packets sent from any network address to the private address space cannot pass through

ipfilter:

block out quick on tun0 from any to 192.168.0.0/16
block out quick on tun0 from any to 172.16.0.0/12
block out quick on tun0 from any to 127.0.0.0/8
block out quick on tun0 from any to 10.0.0.0/8
block out quick on tun0 from any to 0.0.0.0/8
block out quick on tun0 from any to 169.254.0.0/16
block out quick on tun0 from any to 192.0.2.0/24
block out quick on tun0 from any to 204.152.64.0/23
block out quick on tun0 from any to 224.0.0.0/3

pf:

block out quick on tun0 from any to { 192.168.0.0/16, 172.16.0.0/12, 127.0.0.0/8, 10.0.0.0/8, 0.0.0.0/8, 169.254.0.0/16, 192.0.2.0/24, 204.152.64.0/23, 224.0.0.0/3 }

Now, that's a refreshing change! We've just shrunk nine lines into one. As you can see, we listed all network addresses inside a pair of curly braces: {}. This simple trick can be used to list multiple arguments for the proto, from, to, port, and icmp-type keywords.

The rest of the syntax is unchanged, but watch out for the port and proto syntax.

tun0: incoming packets sent from any network address to port 80 can pass through to the mail and HTTP servers located in the DMZ

ipfilter:

pass in quick on tun0 proto tcp/udp from any to x.x.x.x/32 port = 25 pass in quick on tun0 proto tcp/udp from any to 192.168.2.4/32 port = 25pass in quick on tun0 proto tcp/udp from any to x.x.x.x/32 port = 80 pass in quick on tun0 proto tcp/udp from any to 192.168.2.3/32 port = 80

pf:

pass in on tun0 inet proto { tcp, udp } from any to x.x.x.x/32 port { 25, 80 }

pass in on tun0 inet proto { tcp, udp } from any to 192.168.2.3/32 port 80

pass in on tun0 inet proto { tcp, udp } from any to 192.168.2.4/32 port 25

O'Reilly Open Source Convention.

From the Frontiers of Research to the Heart of the Enterprise

July 22-26, 2002
San Diego, CA

The O'Reilly Open Source Convention distills the values of the open source community into programs designed to share information, transfer skills, and integrate grassroots organizations and forward-thinking idealists into the growing open source community.

Saving up to $750 when you register for the conference is easy: Purchase a conference pass, buy two tutorials, and we'll give you two additional tutorials for free! Visit the conference home page for details.

As you can see, in pf rules there is no = character after the port keyword. We do not use the tcp/udp notation to specify both tcp and udp protocols, but we list them in curly braces instead. Forgetting to change this is a common mistake when transferring rules from ipfilter to pf. Fortunately, pfctl spots such mistakes and refuses to upload them to pf.

The name of the port can be replaced by the name of the service assigned to that port. For example:

pass in on tun0 inet proto { tcp, udp } from any to x.x.x.x/32 port { smtp, www }

The names of services can be found in /etc/services.

Other interesting changes include the scrub action, which normalizes malformed packets. This action uses additional CPU cycles, but it's well worth using to ensure that the packets arriving in our network are well formed and won't cause problems to applications running on your internal network. Should you use it? You decide. Try running your firewall with and without scrub and see if there is a difference in network performance. The following rule tells pf to normalize all incoming packets on all interfaces; add it at the beginning of your pf ruleset.

scrub in all

Further improvements made to pf include enhanced stateful filtering. Not only can you ask pf to keep state, the same feature available in ipfilter, but you can also improve security by generating more secure initial sequence numbers with modify state. To enable this feature, replace keep state with modify state . This feature puts additional load on the firewall machine, and you might want to compare firewall performance with and without modify state to see if and how it affects performance. To use it, replace keep state with modify state in your ruleset (using modify state implies keep state). state modification works only with TCP packets.

Hey all Linux whores around here!

Did you know that hick.org, host for goatse.cx, is running on LINUX servers?

And it's the 2.2 kernel too!

I just thought you wanted to know! :)

http://www.eveeieyhfgfcdoosammgwsnboivvbsczxlzga bc / /ooieiabdcdjsvbkeldfogjhiyeeejkagclmieooionoepdk / /abcdefmfighyiqxjklmonopqrosoyotuvwxoyqwertyuiov / /sdfghjklqewiuznmbjadzmcloeuirquakndsflksjdflkas / /fskdfasiewurznmcvweroiqewrnamdnzcvuowieramnfkas / /dfhzuxcihskjrnakjzkjcxbviusayrkajsfzxncvizudyri / /bakdnfbzkcvhgiuegriweramdnfzxlcvueirhamdnzkciue / /jranbsdmfzcowierandmfxzncbkjhfabsdifuweajzkxcuw / /erhasdfzxncvkjdfyiuzxcnvsikirkajeajsbdfkzxbuyef / /rahsdjbzcvxmnvcuweyriausdnfzxbcvkwueyrajnbvkjxg / /iwueyajdfkzxjcnbkeyriaushdfkjbzbuowrnasdkfbhuie / /asjmfnkkbyiurnakjsndfkzjbhiuwerajsknfkzbyhweiua / /dkfjbzkxvbjywekrjaskjnvzxjcweruiasdhfkzjxnsjkld / /fasoidfjalskdfasklhfxjdnmenrqoiuozxcopjgneaksjo / /nzxdkfajlsdfkljsdfoiasdfasndflzxkcvozixucoqweiu / /pwoeiruzxmncvoutyqwerizxnvmxmcnvoweurqmznxmbouw / /rmnzbkhuyrtjghanzxcvbkhgjweyriaudfbznbkweruyabz / /bcvnkdhityqhagsdfjglsieurakfsdnfbvfdsajkbiuyqwe / /kweorjasdknfbkjsdoifuzxbcmfgsltjewioahsdfnbzxcb / /heoiroaisjdfzbxckjksrhiuehadsfbzkxjcbhkeuryaksj / /fzbxcvkxlkcnvmndskfjwehaiursdfzjxnbjkdfhskdflas / /yroausdfzxmncvskeyiqozsjhfasdfoiwueranmcnzbkjhd / /ueafhksjfwheuirasdjhbzxiuewjhasmdnkfzxciurhaskj / /roiquwermcvkhiruhasdkjfnzxkjyeiuahsdbzxckjvopwe / /uqweuirjhvxzckjhweriuasydfoiqurnmxckvhweruiahdj / /znkxcvjhwierahsfzkxhhidufhsakjbzxjchiwueryqagsd / /kjhaksdfnbakwreyhaisknfjkzxbcvkoiqwueraskfzxcbk / /nlkwejrasoidjfxzlknvlkwjeroiasudflknzxlkbjeoiru / /slkdjfzxnmvkljdfawienzxveoriuaskdfjzxcmbnkseuri / /kfjlznxcvksjroeijasdklzjfowierqouasdhfzxncbkjhd / /jsdfljkweoriuasdfkjzxmcnvlkjdowuieraksdflkzxjbo / /werklasdnfmzxclkjewoijasdlfknzlkjwoeirqpweoiasd / /kjzxjvwperaksdjfxzweirjaslkdfzxnclvkjweroiasufd / /zxclkjeworijasdflknzlbkoiwuraksjflknxblkwjerois / /jfweknasdkfjzoxijkenraksjdfoizxjvlknwerlkajsdfo / /yroausdfzxmncvskeyiqozsjhfasdfoiwueranmcnzbkjhd / /ueafhksjfwheuirasdjhbzxiuewjhasmdnkfzxciurhaskj / /roiquwermcvkhiruhasdkjfnzxkjyeiuahsdbzxckjvopwe / /uqweuirjhvxzckjhweriuasydfoiqurnmxckvhweruiahdj / /znkxcvjhwierahsfzkxhhidufhsakjbzxjchiwueryqagsd / /kjhaksdfnbakwreyhaisknfjkzxbcvkoiqwueraskfzxcbk / /nlkwejrasoidjfxzlknvlkwjeroiasudflknzxlkbjeoiru / /slkdjfzxnmvkljdfawienzxveoriuaskdfjzxcmbnkseuri / /kfjlznxcvksjroeijasdklzjfowierqouasdhfzxncbkjhd / /jsdfljkweoriuasdfkjzxmcnvlkjdowuieraksdflkzxjbo / /werklasdnfmzxclkjewoijasdlfknzlkjwoeirqpweoiasd / /kjzxjvwperaksdjfxzweirjaslkdfzxnclvkjweroiasufd / /zxclkjeworijasdflknzlbkoiwuraksjflknxblkwjerois / /jfweknasdkfjzoxijkenraksjdfoizxjvlknwerlkajsdfo / /erhasdfzxncvkjdfyiuzxcnvsikirkajeajsbdfkzxbuyef / /rahsdjbzcvxmnvcuweyriausdnfzxbcvkwueyrajnbvkjxg / /iwueyajdfkzxjcnbkeyriaushdfkjbzbuowrnasdkfbhuie / /asjmfnkkbyiurnakjsndfkzjbhiuwerajsknfkzbyhweiua / /dkfjbzkxvbjywekrjaskjnvzxjcweruiasdhfkzjxnsjkld / /fasoidfjalskdfasklhfxjdnmenrqoiuozxcopjgneaksjo / /nzxdkfajlsdfkljsdfoiasdfasndflzxkcvozixucoqweiu / /pwoeiruzxmncvoutyqwerizxnvmxmcnvoweurqmznxmbouw / /rmnzbkhuyrtjghanzxcvbkhgjweyriaudfbznbkweruyabz / /bcvnkdhityqhagsdfjglsieurakfsdnfbvfdsajkbiuyqwe / /kweorjasdknfbkjsdoifuzxbcmfgsltjewioahsdfnbzxcb / /heoiroaisjdfzbxckjksrhiuehadsfbzkxjcbhkeuryaksj / /fzbxcvkxlkcnvmndskfjwehaiursdfzjxnbjkdfhskdflas / /yroausdfzxmncvskeyiqozsjhfasdfoiwueranmcnzbkjhd / /ueafhksjfwheuirasdjhbzxiuewjhasmdnkfzxciurhaskj / /roiquwermcvkhiruhasdkjfnzxkjyeiuahsdbzxckjvopwe / /uqweuirjhvxzckjhweriuasydfoiqurnmxckvhweruiahdj / /znkxcvjhwierahsfzkxhhidufhsakjbzxjchiwueryqagsd / /kjhaksdfnbakwreyhaisknfjkzxbcvkoiqwueraskfzxcbk / /nlkwejrasoidjfxzlknvlkwjeroiasudflknzxlkbjeoiru / /slkdjfzxnmvkljdfawienzxveoriuaskdfjzxcmbnkseuri / /kfjlznxcvksjroeijasdklzjfowierqouasdhfzxncbkjhd / /jsdfljkweoriuasdfkjzxmcnvlkjdowuieraksdflkzxjbo / /werklasdnfmzxclkjewoijasdlfknzlkjwoeirqpweoiasd / /kjzxjvwperaksdjfxzweirjaslkdfzxnclvkjweroiasufd / /zxclkjeworijasdflknzlbkoiwuraksjflknxblkwjerois / /jfweknasdkfjzoxijkenraksjdfoizxjvlknwerlkajsdfo / /yroausdfzxmncvskeyiqozsjhfasdfoiwueranmcnzbkjhd / /ueafhksjfwheuirasdjhbzxiuewjhasmdnkfzxciurhaskj / /roiquwermcvkhiruhasdkjfnzxkjyeiu
Read the rest of this comment...

[ Reply to This | Parent ]

Re:Klerck releases PWP by gabba_gabba_hey (Score:1) Friday April 12, @08:01AM
Why do ppl use such a shitty browser anyways? Friday April 12, @08:01AM
Re:Why do ppl use such a shitty browser anyways? by gabba_gabba_hey (Score:1) Friday April 12, @08:04AM

You loose.
No wide pages with NetScrap 4.79.
If you want real widening click here.

My heart jumped when I saw the horizontal scrollbar appear. Klerck's found another way to highlight the inadequacies of Slashdot's HTML. Kudos!

Let's see how long it takes them to patch THIS hole.

(Not this hole, you understand.)

Go Here

Hey all Linux whores around here!

Did you know that hick.org, host for goatse.cx is running on LINUX servers?

I just thought you wanted to know! :)

> Since assuming his position in early February, Mr. Sweeney has been....

And what position would that be?

ooh those shorts make my heart go boom
I can see you're pierced from accross the room
I'm glad I wore something kinda loose
like to hitch your engine to my caboose
if that thong was tighter youd pop a string
strutting down the beach you go miss thing
with a bulge up front making me go schwing
like you're smuggling a burrito

he had a cattle prod
prod prod
a lincoln log
log log
wanna polish that nob
nob nob
i think ill sing it again
he had a cattle prod
prod prod
wanna polish that nob
nob nob
sure is long
let me see that schlong!

love it when the beats go
make your baloney go
that dong-da-dong dong dong
love it when the beats go
make your baloney go
that dong-da-dong dong dong

baby those chaps make you look so butch
wanna grab that stick and pop your clutch
put you over me knee like a little boy
twist your key like a wind up toy
wanna make your salmon swim up my stream
mix your coffee with a little cream
pick you first for my softball team
cuz you got your own louisville slugger

love it when the beats go
make your baloney go
that dong-da-dong dong dong
love it when the beats go
make your baloney go
that dong-da-dong dong dong
let me see that schlong!

Can you port linux to my anus? This guy did

Star Wars episode III: The Goatse chronicles

Truffles are fragrant mushrooms which grow under the soil and cost a lot of money. I wonder if truffles can grow here?

fp

Chris Sologuk likes the way little boys feel~!

fp

Chris Sologuk likes the way little boys feel!

Hey all Linux whores around here!

Did you know that hick.org, host for goatse.cx is running on LINUX servers?

I just thought you wanted to know! :)

When is the senseless Katz bashing going to stop?

Around the same time people stop doing this

Hey all Linux whores around here!

Did you know that hick.org, host for goatse.cx is running on LINUX servers?

I just thought you wanted to know! :)

fp

Chris Sologuk is a raging homosexual!

I can't show you the way out, but I can show you the way in

I agree. Maybe if the fucking goatse.cx man was on Voyager, it wouldn't suck so much. They could have an episode where the fucker gets assimilated by the borg, or some shit, and he goes around saying "Restistance to my enormous bunghole is futile. You will be ass-imilated".

THAT would be entertaining.

How about slashbots vs. goatse.cx?

At least choice (b) is better than having Goatse.cx

Ring BARER. Someone who BARES A RING

Fucktard.

And yes, I DO like ass-sex actually. Care to insert a limb?

imagine a beowolf cluster of goatse men. I bet you could pass a cruise ship through that hole!!

I sacrificed some essential liberty for temporary safety, and look where it got me.

goatse.cx

Here's a goatse.cx link to spruce up your afternoon!

I'll pop something up for you! And then I'll shove it right up your asshole

Get another account. I have a +50 account as well as this one. Besides, AC trolling will still get you IP banned.

Oh yeah - almost forgot to post my picture.

Can someone tell me why everyone thinks this is so disgusting?

I, myself, think it is a work of art, and inspires me on a daily basis.

I'd like to see the goatse people get a hold of this one:

http://www.aware.com/products/compression/demos/re solution.html

Iknow there has been a lot of soiled geek pants today. But i just gotta

Can you offer any better theory than watching a Sliders rerun? Can you offer any decent insight to this discussion? Methinks not, dumbshit.

Go back to dropping your goatse.cx with H0t Gr!ts trolls, moron.