Slashdot Mirror
Register your own .mil Domain
JWSmythe writes " As reported in This Story at theregister.co.uk ,and on dailyrotten.com, it seems the US Department of Defense has dropped the ball. Not only can you register a .mil domain, but you can find "secret" domains that aren't publically known (the gov't uses security through obscurity?). I'm looking forward to hacker.mil, warez.mil, and porn.mil."
goatse.mil?
Dailyrotten.com just points to theRegister.co.uk article. It's like saying "Hey! I found more information here!"
What is music when you despise all sound?
I wonder if Osama has Al-Queda.mil?
-- OMFG = Oh My Floatse Goatse
runofthe.mil
peace.mil
So are the service men.
I work for the Air Force and I really find this hard to believe -they are very careful with their networks, almost to the point of making working there very difficult!
as opposed to white negroes?
hmmm. diploma.mil? gin.min?
what was that about homeland security? I guess it's all a load...
Hey, this is my sig, if you don't like it, STOP READING MY POSTS!
All my boxes is under the *.govnet.mil domain on my local DNS, *gotta* get that domain :-)
Doesn't (didn't) 2600 have a contest like this? The first person to manage to get a .mil domain gets a free subscription, or something like that?
Mmmm....cereal.
I am from a small, grease-loving country in the north called Ca-na-da.
http://www.nic.mil/dodnic. No, I didn't go poking around. If you've got bigger balls than I, perhaps you can link to the supposed admin area...
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Mmmm... caramel.
From The Register: We are, of course, straining against every natural, journalistic impulse in our beings by neglecting to mention any useful search strings with which to find it.
How long will it be before some A/C posts them here?
This is a runofthe.mil story
Why is this just hitting Slashdot now?
As far as I know The Register broke the story, and nobody else has cited information that wasn't in The Register's article.
Does anyone have a screenshot of this site?
Go here to create your own Slashdot dis
I strongly doubt that the DoD would give the IP addresses of machines with sensitive data on the web without them knowing about it. Then again if they don't, what does that mean about them fighting a war in Iraq?!?
eh, food for thought...
Pretty cool... First person to get a .va (Vatican City State) domain gets my vote though.
Whoever is stupid enough to screw with the DOD is on their own . I remeber the letter of the cyber terrorism bill all too clearly . They'll be bustin down your front door and haulin you away like you are illian(sp?) gonzales on crack . Oh an mind you once they have you your rights are revoked as you are a terrorist . Boy after this incident I'll be watching as i drive through washington dc for a line of the idiots heads who tried out this vulnerability on pikes per Rumsfields orders .This is a bad time to be poking at americas security . Kinda like throwing rocks at a rabid junkyard dog while sittin in his dog house .
The secret government TLD .bush was recently discover by a small group of drunken frat boys while searching for new free prOn sites...
:-)
Early reports indicated that Jenna was involved, but this has to be corroborated!
n2q
Beer is proof that God loves us and wants us to be happy. -- Benjamin Franklin
Unless your good at covering your tracks, and use lotsa proxy servers in the process, is it really worth the risk of going to jail for 5+ years for unauthorized use of a military computer system to register a domain name??
:P, and yes i do know the URL for registering these domains, even though it doesnt say in the article.
BTW, this story is old, i read it yesterday.
IIRC a few years ago the Chinese were caught buying up surplus military equipment including replacement parts for Apache helicopters and hard drives containing sensitive nuclear data. Admittedly with such a huge organization carelessness is to be expected, especially since these guys are overworked and underpaid, but I do wish that the government would stop encouraging average americans to be paranoid when they constantly drop the ball themselves.
Perhaps this story would be best posted at the rumour.mil?
Come on, that was funny!
Oh well..
--Dan
This implies that even if the DoD fixes the problem, the Google caches will still be available (until they expire or are replaced). Now, in the past, we've heard reports of people being upset that Google cached information. However, this time, the cache contains information pertaining to "national security" (that great new buzzword). I wonder, what will happen? Will these URLs be silently deleted from the cache? Will Google be told that cacheing links is now illegal because it could aid terrorists? Will they be prevented from cacheing .gov and .mil? Will Google be sued out of existence?
We've all found Google caches to be useful, when, say the documentation for an open source project is hosted via 56K modem line in the Czech Republic, for example, or even when a site is Slashdotted, but it'll be interesting to see what happens about this, and how the goverment may over-react.
(Note, if you're too stupid to understand this, I'm not talking about blame here - don't bother saying "Google rulez, the militery is dum asses for leeving these sitez open, u r an idiot...". I'm talking about reprocussions. Certainly Google doesn't "know" what information a link contains when they cache it. Certainly it's the government's fault for leaving open admin pages with default passwords listed on the page. But just because someone isn't at fault, doesn't mean they can't get screwed over.)
There is no sig, there is only Zuul.
I found this without having to click on this
... is my bet on how long it will take for someone to post the link. Anyone want to bet how much jail time they'll get?
allyourbase.mil
??
This depends on whether they follow the .mil registration RFC (1956) - if not, then that's what you get for violating RFCs!
Just having access to an admin interface does not imply it's automatic. All registrations should still have to be accepted by the hostmaster first. As the RFC says, security implications are not discussed :)
Perfect for SlashDot... "Rumor.mil"
methinks the link is down.... i think they oulled it from there immediately...
google showed up with it, didn't mess around though
i wonder what POC stands for?
link
IN-SOVIET-RUSSIA-we-practice-better-internet-secur ity-than-lazy-capitalist-pigs.mil
... the U.S. Government's DNS servers:
/. to there
1) Register slashdot.mil
2)Point
3)BANG!
-Mark
POC = Point of Contact
slashdot.milo mpany.mil
kevinmitnick.mil
2600.mil
fuckedc
bushisanidiot.mil
ashcroftisan ass.mil
Don't Tread on OpenSource
dawg geh wif da ploglam, gee.
I know you are psychotic, but please make an effort.
I wonder when it will be /.'ed.
DARPA will be settting up a special project to coordinate the information. In keeping with its hiring policies the Bush administartion will give the post to a senior military official from a prior administration.
Oh wait...
Wow, you've just made it incredibly easy to find the google cache....
I checked the google cache, and it doesn't say on that page, anywhere, what the password is.
http://www.nic.mil/visitors.txt and http://www.nic.mil/help
-madgeorge
Do you think it could be a trap? Given the gov't's of-late interest in total information, they just got a whole list of names for their file.
sic
At least the DOD has been kind enough to post best practices for registering your new .mil domain name through the use of a standard format...
For more info, help yourself to RFC 1956
n2q
Beer is proof that God loves us and wants us to be happy. -- Benjamin Franklin
I also found this
Now with all the linking on slashdot to .mil sites, I can see the military thinking it's a huge DDOS terrorist attack!
Now repeat after me...I will not slashdot military websites...:)
i waana get SGC.mil!
(Yes, I'm a Stargate fan.)
"I would say that 99 per cent of what my father has written about his own life is false." - L. Ron Hubbard Jr.
Then have their agents visit you at your house tomorrow, and haul you away under the patriot act..
Not my idea of a fun weekend, trying to explain to a guy with an M16 why he shouldn't shoot me.
Technically anyone that even reports the mistake to the *public* is potentially violating it. And irresponsible in this case, we aren't talking about some cutesy harmless web defacing, this is the US government defense department.. Morons.
---- Booth was a patriot ----
The DMCA partially protects Google in their caching. I say "partially" because a close reading of the bill shows that it is debatable whether or not they qualify for the caching provisions, but after a while they should have a certain amount of de facto protection, I would hope.
In addition to their compliance with the DMCA notification, they also provide a help page and automated removal system for the desparate. (See the last section of the page for the DMCA notification instructions, which involve physical letters and legal affirmation of ownership.)
Note that this is the "good" provision of the DMCA, preventing people from being liable for content they merely cache, not actively provide.
Since in this country the military isn't above the law, they'd still have a hard time finding something illegal that Google did. They don't have the luxury of simply not liking someone, like in some countries. If they don't want to be cached, the law says it is their obligation to opt-out, not Google's.
The subject says it. Even though outside of US (outside of US-jurisdiction is factually impossible these days !), I stopped voluntarily registering bull.shit.mil. To my greatest surprise, it permitted my actions until it got too hot for me. Either a honeypot, spam or incompetence ** 72! Better posted as AC, here !
And creating it was part of his exam.
That's my guess, anyway. My feeling is that most *nix folks COULDN'T create anything than insecure intentionally, ever fibers of our being would scream in complaint.
weoverthrewguatemala.mil
weassinatevietnamese.mil
wekillciviliansinasia.mil
wesupportcoupinchile.mi
wesupportmilitartyinemsavabor.mil
wetrainedosama.mil
wesupportcontras.mil
wegavesaddammoney.mil
wegaveiraqweapons.mil
weoverthrewpanama.mil
webombaspirinfactories.mil
List of stupid american military actions
[Please type your sig here.]
The arms dealers who didn't want to advertise much before. Now they can claim to be a department of the US military.
Now that whitehouse.com is a porn site, will pentagon.mil, cia.mil and nsa.mil become porn sites as well?
The funny thing is that in Spanish "mil" means "one thousand". I can imagine new domains like:
.tv domains
"noches.mil" (Thousand nigths)
"dos.mil" (Two thousand)
It can be like he
i was going to register blackop.mil but it was already taken...
You feel sleepy. Close your eyes. The opinions stated above are yours. You cannot imagine why you ever felt otherwise.
According to this, perhaps.
go to pepper.mil ... Spicy!
hmmm. where's kevin?
but I couldn't bother to read all reply heh....anyway I wonder if anyone will register paper.mil?
The interface is basically a data gathering and formatting tool. Below is the result of a long session of entering data. Excerpt:
..and a proxy to that :-)
This online program makes no changes to the WHOIS database.
Result:
Return E-mail Address
The entries in your registration appear to be satisfactory. In order for the NIC/SSC to act on your registration, you must enter an e-mail address. This web program will attempt to send the template to the e-mail address you enter in line 6-A. Obviously, the template will not be delivered if you enter an incorrect e-mail address, so take extra care to enter the e-mail address correctly.
If for some reason, you are completely unable to get the template to your e-mail address, you may toggle the checkbox in line 6-B. Doing so will summon a plain-text version of your template. Save the page as plain text, and you will be able to mail the template at your leisure. You could also cut and paste the template into a separate window.
PAY ATTENTION!
This online program makes no changes to the WHOIS database.
The scope of this online program is to send the template to the e-mail address entered in the field below.
Once you receive the completed template, you must forward it to the appropriate point of contact for action.
The NIC will not process any templates until it receives this template (by email) from the domain administrator or service PMO.
6-A: Enter an email address that you can reach from anywhere on the NIPRNET. e.g. username@email.host.mil
6-B: If you do not have a working e-mail address (due to various network problems, or because its creation depends on this registration), you may indicate so by toggling the checkbox below.
( Anonymizer.com is (hopefully) your friend... )
(
How long til the .mil and the .gov and the rest realise that spoofed sites like these could be a fantastic tool in capturing possible IPs of those stupid enough to actually try to use them. Even if you chained through a string of proxies to register the domain, it'd still be useless without somewhere to point it at.
;)
Editing *.mil* domains through a *logged* cgi form on a *.mil* server. Hello, no, I don't think so, thankyouverymuch. Might as well just a T-Shirt saying "got root?" or something...
The entries in your registration appear to be satisfactory. In order for the
NIC/SSC to act on your registration, you must enter an e-mail address. This web
program will attempt to send the template to the e-mail address you enter in line
6-A. Obviously, the template will not be delivered if you enter an incorrect
e-mail address, so take extra care to enter the e-mail address correctly.
If for some reason, you are completely unable to get the template to your e-mail
address, you may toggle the checkbox in line 6-B. Doing so will summon a
plain-text version of your template. Save the page as plain text, and you will
be able to mail the template at your leisure. You could also cut and paste the
template into a separate window.
PAY ATTENTION!
This online program makes no changes to the WHOIS database.
The scope of this online program is to send the template to the e-mail
address entered in the field below.
Once you receive the completed template, you must forward it to the
appropriate point of contact for action.
The NIC will not process any templates until it receives this template
(by email) from the domain administrator or service PMO.
Uh, this really sounds strange. .mil domain THAT easily? Has anyone succeeded?
Can you really register your own
I went to that link and it requires that you indicate a sponsoring agency. Since none of us have one, registering a domain would require entering false information into a DoD computer in order to gain unauthorized access. That is just a very bad idea.
While it might be funny to register al-qaeda.mil, grain.mil, or saddam.mil, you don't want to find yourself occupying Kevin Mitnick's old cell. The Department of Defense is not renowned for their lighthearted sense of humor and fun. They may very well decide to make an example of someone. Or they might just decide to hold someone for months or years prior to even filing charges.
It's not worth risking your freedom and your future livelihood for a prank.
The URL is http://sites.defenselink.mil/
It hasn't been possible to add new domains or run queries since Friday, so don't even bother.
Yeah i heard about this a few days ago, however i'm a former Soviet Spetsnaz (soviet special forces 'special designation') anyway now I have begun my live as a Singer.
I've a special song that I cover, you must like it, its an old New Order song.
NEW WORLD ORDER
Thieves Like US
I've watched your face for a long time
It's always the same
I've studied the cracks and the wrinkles
You were always so vain
Well, now you live your life like a shadow
In the pouring rain
Oh, it's called oil
Yes, it's called oil
Oh, it's called oil
And it belongs to US
Oh, it dies so quickly
It grows so slowly
But when it dies, it dies for good
It's called oil
And it belongs to everyone but US
I've lived my life in the valleys
I've lived my life on the hills
I've lived my life on alcohol
I've lived my life on pills
But it's called oil
And it belongs to US
It's called oil
And it's the only thing that's worth living for
It's called oil
And it belongs to US
It's called oil
Yes it's called oil
Oh, oil is found in the east and west
But when oil is at home, it's the best
oil is the cure for every evil
oil is the air that supports the eagle
It's called oil
And it's so un-cool
It's called oil
And somehow it's become unmentionable
It's called oil
And it belongs to every one of US
It's called oil
And it cuts your life like a broken knife
Few weeks i'll release this cover to the public.
And they will insist that they are Americans who love liberty and freedom for all.
admin page at nic.mil is here. have fun.
I'll leave it as an exercise to the reader to verify this, but chances are that any request for a new domain gets reviewed by a real person somewhere down the line before it is added into their DNS. Given that, the chances of getting www.iloveosama.mil would be substantially lower.
I did the process at the .mil NIC site.
After you fill all the forms, there's:
PAY ATTENTION!
This online program makes no changes to the WHOIS database.
The scope of this online program is to send the template to the e-mail address entered in the field below.
Once you receive the completed template, you must forward it to the appropriate point of contact for action.
The NIC will not process any templates until it receives this template (by email) from the domain administrator or service PMO.
So you are essentially filling a template, which you can do by hand as well, following the instructions here.
It lets you retrieve POC by a handle though. I don't know the access level of this information in USA, but this is quite odd, since it seems that the handles are assigned by initials, and are of progressively increasing length.
I also wonder where does this interface gets that data from... There's a DB somewhere, and it can be probably hacked via this interface.
... freespeech.mil
Because after all these AC posts it really does seem that in "the land of freedom" there in fact is very little freedom. Just because someone is finding holes, its best to air them rather than have them go unoticed by the owners. Thats what many people who report bugs say...
and im sure people wouldnt care one jot if it was say, India's Military site or something.
I'm going to pop over right now and register dark.satanic.mil :)
-- And when Justice is gone, there is always... Force. --Laurie Anderson, "Oh Superman"
Whoever creating the registration app was an MCSE
Yeah! Hah-ha! MCSE 'R' stoopid huh! Us *nix users are all so smert end 31337 that we could never do anything that insecure! You open source *nix guys are especially good at securing your own sites like SourceForge, apache.org and others as Fluffy Bunny has so graciously pointed out, linux guys know how to secure their boxen!
I wonder how it feels to have every phiber in your being screaming in comlaint!
starfleet.mil (for the trekkies)
Lame post detected.
Keyword: MCSE
we in the US cower before the power of big brother
wow. what a shitty country you live in.
The fact is, the current Bush administration is quite a bit more obvious in its cronyism than most, simply because we've actually seen most of the faces before; usually it's an unfamiliar set of cronies that comes in with a new President.
I find that amusing, that's all. This administration isn't filling me with a lot of joy in other respects, so please don't begrudge me that. Oh, and wash your mouth out with soap, preferably lye.
Wind.mil
As cunning as a fox, which has just been appointed professor of cunning at Oxford University. http://www.kinlan.co
If it's not there, it will be shortly...
"They do not preach that their god will rouse them, a little before the Nuts work loose." Kipling, 'The Sons of Martha'
Well, commercial businesses have been registering .org domains for years. Anybody know how that got started?
The article mentions that " ...default passwords are cheerfully provided on the page."
None of the sites suggested so far afaics have this. I went as far as I could on nic.mil without having a .mil email address, but as has been usggested here, that application is then obviously read by someone, and has the security check of requiring a .mil email address. Or has the page been fixed since the article was posted?
Also " ...an equally unprotected (and Google-cached) admin interface encouraging us to add a new user, like ourselves, say, which requires no authentication."
This sounds like the sites.defenselink.mil one:
http://216.239.57.100/search?q=cache:sites.defense link.mil/servlet/DataEntry/adduser&hl=en&lr=&ie=UT F-8&sa=N&tab=gw
Anonymous Coward
BTW nic.mil has a 'disclaimer' on the base url which says use of you page constitutes assent to being monitored. It doesn't limit the extent of monitoring. So here is my reply to them,
a) No it doesn't. You may be monitoring, but you have not got assent.
b) The warning only appears on one page! I only checked that page, last of all, by luck! Most users will never know that you assume that they assent to your monitoring.
c) The page is on a public network - your 'monitoring' better not consist of anything more than a logfile entry with an incoming IP, hostname and time.
My posting of this comment constitutes legal grounds for a lawsuit in excess of $1billion dollars should US DoD infringe the liberties of myself or anyone I know or meet. Since you don't know who I am, anyone can claim that they posted this article and claim the $1b. Nyer nyer. This is not satire, it is law.No, I didn't go poking around.
Smart move.
Can you say "honeypot"? I KNEW you could.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
mmm.. wind breaking
I'm responding to your sig.
Ok, so the new way of doing things is that instead of adding a point to your comment's overall score when you post with your karma bonus, your comment is posted at 1 with a separate "karma_bonus=yes|no" variable. Thereafter, users can specify how much weight to assign to the karma bonus on their preferences page. This was 0 when the editors quietly rolled in the changes without telling anyone (why so sneaky?), but has since been changed to '+1' by default, to by default be the same as the old way.
So, your comment that got 3 good moderations is scored at 4/1. Users who have a '+1' modifier to karma bonus will see this comment at 5, whereas users with a '0' karma modifier will see it at 4, and users with (for whatever reason) a '-6' modifier will see it at -2. If such a thing were possible.
Unfortunately, I see this as making it unlikely that comments posted with a karma bonus will ever be modded up to 5, since most moderators will be viewing with a karma bonus and see that the comment is already scored at 5, and that it therefore cannot be modded up further.
I'm going to say that the way this was changed was disgraceful. There is no reason not to maintain a place on slashdot indicating how the code is being changed. I have relied on CmdrTaco's journal to inform me of changes, but in this case it was silent, and after thinking about it further, it's still a crappy way of running things.
It all goes back to the difference between slashdot as community and slashdot as business. As a business, sure, slashdot can do whatever the hell it wants, who am I to lecture, blah blah blah. But as a community, changing things in profound ways without approval, comment, or even notification is bastardly. And slashdot as a business would do well to perceive its dimensions as a community.
Just like .mil it looks like all you are doing is submiting a request, it's not an automatic thing. I have looked through the whole site and unless I missed something I saw no admin data.I am still looking, I do invite someone to show me what I missed though
iRepairIT - iPhone, Mac, & PC Repair
http://www.nic.mil/ftp/templates/domain-template.t xt
It looks to me like it is a reputation attack. Its not enough for these systems to be secure they have to be seen to be secure.
A while back when I was security consultant to a certain well known federal site we had a bunch of Russian hackers claim that they had done a DDos on the site. In fact the claim was completely untrue, the site was down because a router had gone out. But the hackers managed to get their claim into wired.
It is like when there is a terrorist outrage and seventeen organizations claim responsibility.
Looking for an Information Security student project suggestion?
Try http://dotcrimeManifesto.com/
All this thing does is ask you a bunch of questions and at the end gives you a form to print out with the information you entered. It doesn't actually register domains or give you access to anything. Go ahead and try registering al-qaeda.mil or whatever you want, no domains get created unless you take the resulting form and mail it in to an actual human, and that person actually approves it. (not likely)
After looking around the various comments on here I thought I should point out the site: http://sites.defenselink.mil/warning.html
I do believe it says something in there about unauthorized access and stuff and how its punishable under some computer fraud act.
Since we're giving them 300 bil a year, anyone feel like we're not getting their money's worth?
Here's a summary of the proposed domains.
If you want to know who submitted it, read through the comments again.
Enjoy!
Al-Queda.mil
runofthe.mil
General.mil (cereal)
Cara.mil (caramel)
Rumor.mil (which would be slashdot.org.. hehe)
rastafarian.mil
peace.mil
Piece.mil ("as I find well toned and armed women hot")
starfleet.mil
diploma.mil
peace.in.our.t
gin.mil
pointlessdeath.mil
2600.mil
Na
runofthe.mil
slashdot.mil
ally
IN-SOVIET-RUSSIA-we-practice-better-i
in.soviet.russ
slashdot.mil
kevinmitni
2600.mil
fuckedcompany.mil
bushisanidiot
ashcroftisan ass.mil
sgc.mil
weoverthrewiran.mil
weoverthre
weassinatevietnamese.mil
wekillci
wesupportcoupinchile.mi
wesupp
wetrainedosama.mil
w
wegavesaddammoney.mil
wegave
weoverthrewpanama.mil
webombaspi
"noches.mil" (Thousand nigths)
"dos.mil" (Two thousand)
blackop.mil
pepper.mil
paper.mil
da
deathstar.mil (for dvader@deathstar.mil)
milf.mil
Wind.mil
honeyp
Serious? Seriousness is well above my pay grade.
Someone register peace.mil
Mix the failings of Usenet with the shortcomings of the World Wide Web and the result is slashdot.
salt.mil
I spoke to a lady at the NIC Help Desk (linked from here). She gave me the number for the security response team; I contacted them.
A lady answered the phone and told me that they were aware of the problem and looking into it.
Jouster
pepper.mil wind.mil
mmmm.... hey! What's that smell?
youve-got.mil
microsoft.mil, riaa.mil
Smart guy, why don't you scan the box and find out what OS it's running. Report back here with youur findings.
Idiot.
Can I bum a sig? I left mine at the office.
illuminati.mil
allyourbase.mil
borg.mil
Alex.
You look like a million dollars. All green and wrinkled.
slightly OT but along the same lines, but did anyone else happen to catch the 10 min or so segment CNN did on "information warfare" during yet another War on Iraq show last night?
I have to admit, I was pretty amused that from a glance at the monitors they let CNN tape, you could that the machines were all running Win 95. And the army rep did everything short of wave his arms in the air in a mystical manner while showing off the army's (again, Win9x, GUI based) port scanner to the interviewer.
The register article and this CNN piece help me sleep easier at night, knowing that our military has such 1337 h4x0r5 working for them...
... find "secret" domains that aren't publically known (the gov't uses security through obscurity?)
Grr. Security through obscurity is NOT A BAD THING. It is only a bad thing if it is the ONLY security measure you have, or if you are heavily relying on it. But as an added security measure on top of a solid system, there is nothing wrong with that.
slashdot!=valid HTML
ana.mil
Obscurity is all we have. When you obfuscate the truth of something, as long as it is done to a degree that the truth itself cannot be interpolated directly, that's generally good enough. The strength of the obfuscation then lies in how difficult it is to "guess" at the truth, but when you guess correctly, the truth will make itself known.
If I make a password for a system, the password exists to allow me entrance to the system, and if I reveal it to others, they will be able to enter the system. The password must be made of keystrokes, so the possibilities are finite...but the number of them is so large that it is, for all intents and purposes, completely unavailable to most people. The password is merely obscure, but to a highly effective degree of obscurity. The possible combinations seem infinite, but they are not. You could guess at the password and, eventually, gain access to the system.
The mathematics of encryption, public and private, is also merely obfuscation. The number of "guesses" you must make to gain entrance is often extremely high, and that makes it strong...but guess correctly and, voila, the encryption is made null and void. It is still "security through obscurity." In public key encryption you are given a clue, a smoky look at the private key. You may make guesses at what the private key is and, if you guess correctly using your clue, you will be rewarded with the truth of it.
In the physical world, you can augment your methods of obfuscation with physical deterrents, such as placing data within iron safes, or placing armed guards at the entrance to the building housing the data. Most of the world's most secure places are protected physically in this way, with obscurity providing an extra measure of security. But on a place like the internet, you have no such luxury. All security on the internet is a form of obscurity. Therefore, all information for which there is any way to access it from a remote location is subject to compromise to a degree that physical protection would not allow.
I think what people fail to realize is that no .mil address contains classified or otherwise "cool" information. So you can find out what units exist in the military? I can do that by going to any bar near a base. Something about drunk service members make them very talkative. Considering all the antimilitary rhetoric I see in many of these posts, how many of you would really *want* a .mil domain? If you are against the concept of a military, it seems silly to want a domain that advertises for them merely by the suffix. On a side note (and a bit offtopic), I venture to say that the military is not at fault for political decisions, the politicians are. Blame the person, not the tool.
For those who REALLY want a .MIL domain name...
Having spent a good deal of time in the US Navy dealing with the fun of keeping seperated, classified and unclassified networks, I can tell you exactly how much of a threat this problem is, to national security..
None. At the very worst, as pointed out in earlier posts... slashdotting a public domain .mil site (like http://chinfo.navy.mil/) would only serve to seriously tick off servicemembers family's, and the average run of the mill PR guys for the navy.
Classified servers, sites, and networks are encrypted before they ever touch the same cables as the internet. In many cases, they never DO touch the same cables, but.. Yes, alot of that -classified- traffic passes over the same lines as your average slashdot post, BUT... its highly encrypted before it ever gets there (encryption level and equipment obviously varied by classification level, some data doesn't even get to TOUCH a networked computer).
As well, a LARGE portion of the .mil domain's are setup to ONLY see traffic from another authorized .mil network (usually managed by IP address's). If your .mil network needs access to see my network, as well as getting the usual userids and passwords, my net admins need to talk to yours, and put your 1.2.3.xxx address into our firewall.
So, the threat here? The threat is really only to the fact that its completely possible to now have a bazillion "yourname.yourwebsite.mil" websites running around... And this wouldn't HURT anything persay, because most .mil websites are acronyms like "subhqnorva.navy.mil" (for Submarine Squadron Headquarters Norfolk Virginia).
US Military bungle? Yes
National Security Threat? Minimal...
Do you really want a .mil domain? Gee, only if you want to cause unnecessary trouble for a government trying to prepare for war...
~~~ SCO sued me because I printed this t-shirt with a Linux driven printer...
lumber.mili lp er.mil
saw.mil
iron.mil
steel.mil
paper.m
puppy.mil
flour.mil
corn.mil
grain.mil
pep
cotton.mil
youvegot.mil
Peace and love, y'all
puppy.mil
You know where you are? You're in the $PATH, baby. You're gonna get executed!
- deadkennedys.mil
- jellobiafra.mil
- klausflouride.mil
- eastbayray.mil
- dhpelligro.mil
???Quod scripsi, scripsi.
gaymen.mil
IMAGE VERIFICATION IS EVIL!
OKay, I just wanna know one thing. If this is freely available online, do you really think that the government would come seek you out or that they would put potentially very secret documents right here on the web? I mean, they may not be the smartest, but they CAN think a little. Anyone?
Think North Korea will register kimjongil.mil just to piss off the Pentagon?
Quod scripsi, scripsi.
Listen, it's not "off topic", it's just on a different topic. Relax. A lot of people are wondering why scoring is different now, I was one of them, I found out, I tried to share, other people decided that was worth modding up, so let it go. Until there's an article devoted to "Everything you always wanted to know about slash code changes last week, but we never told you", I'm afraid this is the only venue.
So relax. I'm not trying to subvert the discussion or anything with all this crazy scoring talk, I just figured it was something other people would be interested in. A few people agreed with me. What you're saying by modding me down is that you think other people wouldn't be interested, and I think you're doing them a disservice.
Let us hope metamoderation finds you swiftly.
Okay. I talked to someone at DoD. The main idea was that anything you can access on here is not a secret. They have a public accessible area for you to look at.
Anything that they don't want you to look at will not be available to you. He also made a point to say that, "I would not recommend trying to 'hack' into the site." I decided to just say okay and bye. Hmmm, what will Slashdot throw at me next?
My address for the subscription.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Lots of answers were posted here :-) One of them sounded like he knew what he was doing, and said that the site had stopped working as of Friday, which suggests it may have been the correct one..
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
It's good to look at but this is not a secret anymore. It's not like anyone is going to use it anyway
Don't hesitate
wow a lotta pointless comments :\. has anyone actually filled the form out or whatever and actually registerd one? i'm actually in the navy and have a .mil account that from what i understand is needed to get one but i'm still skeptical about doin it.
Cotton.mil
testingtesting123.mil
or how about:
ymca.mil
strip.mil
slipperywalls.mil
std.mil
disneyland.mil
sexual.mil
Not *read* the thread, but those who *act* should be picked up. As should those that printed the details.
We are not talking about some highschool prank, we are discussing something that is 100% illegal, and anyone that should attempt it should be tried for treason and executed.
If you cant understand that, or dont care, then get the hell out of my country as you dont belong here.
---- Booth was a patriot ----