Slashdot Mirror


RFC 3514: New Bit Defined for IPv4 Headers

RFC 3514 was just released, with a new bit definition for use in the headers of IP packets. Because there are important security implications, anyone coding internet services (on either the client or server end) should probably take a look.

197 of 259 comments (clear)

  1. It's about time! by Motherfucking+Shit · · Score: 5, Funny

    Finally, the scriptkiddie bit! Now we'll be able to drop all that pesky DDoS traffic with ease!

    --
    "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    1. Re:It's about time! by Black+Copter+Control · · Score: 1
      The moderator who marked it 'offtopic' obviously didn't read the RFC. I didn't even make it through the first paragraph before I realized it was an AF-RFC. At that point, I was too tired to continue.

      Time to go to bed.

      --
      OS Software is like love: The best way to make it grow is to give it away.
  2. I can see it now. by Renraku · · Score: 4, Funny

    The bit set to 1 indicates a pr0n site, the bit set to 0 indicates a non-pr0n site.

    --
    Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
    1. Re:I can see it now. by JWSmythe · · Score: 1

      So, running a porn site, should I only accept traffic with the bit set to 1? Obviously set to 0 is a benign user..

      Ah, doesn't matter anyways, most of my users try to set their bit to 2.. :)

      --
      Serious? Seriousness is well above my pay grade.
    2. Re:I can see it now. by JWSmythe · · Score: 2, Insightful


      Ok, I'll take the liberty to be off-topic.. Mod me down.

      I have friends in the military around the world. I'm sure as hell not going to be the one to throw rotten fruit at them, or call them baby killers when they come home. Ask any Vietnam vet how that feels.

      Our military aren't under orders to shoot anything that moves.. They're given legitimate military targets.. Our soldiers always have the option of not shooting, if it doesn't seem like a valid target. They don't waste bullets shooting into empty shacks. They spend them on targets that are very potentially out to kill them.

      If the Iraq gov't wants to portray Americans as targeting children and the elderly, that's their spin on it. Just as CNN makes it look like we only throw huge bombs at empty military buildings. Somewhere in the middle is the truth.

      When our troops come back, they'll be talkative. They always are. They'll tell you the kinds of targets they hit.. If there were guys in the building shooting at you, they're a valid target. Ask the troops who were effected by chemical weapons in the last war if Saddam played fair.

      If it turns out the Iraq military killed the family that lived there to make it base, that's why we're fighting this war.

      --
      Serious? Seriousness is well above my pay grade.
    3. Re:I can see it now. by Alan+Partridge · · Score: 1

      "or call them baby killers when they come home. Ask any Vietnam vet how that feels."

      but they DO KILL BABIES - you can see the dead and dying on Al Jazeera every day if you can live with yourself afterwards.

      --
      That was classic intercourse!
    4. Re:I can see it now. by Simon+Brooke · · Score: 2, Interesting
      Our military aren't under orders to shoot anything that moves.. They're given legitimate military targets.. Our soldiers always have the option of not shooting, if it doesn't seem like a valid target. They don't waste bullets shooting into empty shacks. They spend them on targets that are very potentially out to kill them.

      Like British tanks and buses full of unarmed women and children.

      --
      I'm old enough to remember when discussions on Slashdot were well informed.
    5. Re:I can see it now. by operagost · · Score: 1
      So do doctors who perform abortions, but that's perfectly okay with good left wing folks like yourself, isn't it?

      What about the kids killed in the WTC?

      --

      Gamingmuseum.com: Give your 3D accelerator a rest.
    6. Re:I can see it now. by JWSmythe · · Score: 2, Interesting

      Too bad the second BBC link doesn't have the full details clearly at the beginning of the story.

      The van drove up to the checkpoint. But rather than stopping or even slowing down, it continued at full speed through the checkpoint.

      If I was guarding a checkpoint, to make sure no one's driving a car bomb through, and they did the same manuver, I'd fire too.

      That's the easiest way to get a bomb through a checkpoint. Drive. Don't stop.

      Bin Laden did the same thing, except with airplanes full of men, women, and children. It was aparently easier than sneaking a bomb into the country.

      --
      Serious? Seriousness is well above my pay grade.
    7. Re:I can see it now. by JWSmythe · · Score: 1

      This is a more detailed story about the shooting.

      http://www.cnn.com/2003/WORLD/meast/04/01/sprj.irq .van.shooting/index.html

      They warned them to stop several times. The vehicle didn't stop.

      They fired warning shots over the vehicle. It didn't stop.

      They fired into the radiator and engine. It still didn't stop.

      They finally opened fire at the driver, stopping the vehicle.

      Want to see the same reaction? Try the same manuver at any military base. Just hop in your car, and drive straight through the front gate without stopping. It happens occasionally.

      A friend of mine was witness to a similiar event in the US, outside of war time, but it had a more peaceful ending.

      A paranoid/deranged woman was convinced that she was being chased, so she went through the security checkpoint at an Air Force base in the US at about 60mph. This wasn't during any wars or conflicts. The guards at the gate fired shots at her tires, but missed.

      She made it a few hundred yards into the base, and was confronted by hum-vee's and armed MP's.. She stopped the car, and fell to the ground, surrendering.

      The investigation made the papers.. It wasn't clear who she thought was following her, but she was convinced they were out to get her.. If she hadn't stopped, they would have shot her.

      I personally drove through that same gate many times. Every time, I stopped, showed my ID, and continued on. I even spent about an hour in that particular guard-house, although not working (filling out paperwork).

      The guards at checkpoints are armed for a reason. They're protecting a secured area. It's not a good place to see if you can drive through without stopping. Not without a serious death wish.

      --
      Serious? Seriousness is well above my pay grade.
    8. Re:I can see it now. by JWSmythe · · Score: 1

      You're amazing! They were just here, just before I got your message.. But, they were just verifying that I had my evil bit set. :)

      I don't think knowing what Bin Laden did on 9/11 is any secret. It seems to have been leaked to the press..

      --
      Serious? Seriousness is well above my pay grade.
    9. Re:I can see it now. by Zeinfeld · · Score: 1
      but they DO KILL BABIES - you can see the dead and dying on Al Jazeera every day if you can live with yourself afterwards.

      They would have only grown up to be terrorists.

      Oh sorry, must have watched too much Fox news there.

      Question for Fox news, why is Peter Arnett's interview to Iraqi TV worse than Rivera giving the Iraqi's details of coalition troop positions and plans?

      NBC meanwhile have a great graphic showing the balance of forces arround Baghdad, with the Iraqis outnumbered 2 to one. Only by all accounts the Coalition has only a division in the whole of Iraq and there are six Republican guard divisions in Baghdad.

      CNN are instead interviewing a GOP blimp still trying to convince people that the Iraqis are going to be giving the troops flowers just as soon as Saddam is out of the way. He is right about one thing, "The US can do anything it puts its mind to". Yes quite including loosing this war if they really try.

      Why did the Administration tell us that the war would be over in a week and a half (and yes the damn well did tell us that)? Even the French managed to last six weeks against the Germans! And the Germans were right next door so there were no supply chain issues.

      Support our troops, replace the idiot civilians who think you can take an entire country with a single division with people who have some sense. Replace Ari Fleicher with someone who does not tell people horseshit like claiming Saddam may be dead, if he is dead the regime must be one heck of a lot more robust than was claimed earlier. And most of all, stop the cowardly hiding behing the troops and the flag each time you make a mistake, criticism of Bush is not criticism of the troops.

      --
      Looking for an Information Security student project suggestion?
      Try http://dotcrimeManifesto.com/
    10. Re:I can see it now. by Alan+Partridge · · Score: 1

      who said I was left wing?

      I may even SUPPORT the murder of innocents in the pursuit of Bush's re-election. But the coalition weaponry most certainly IS killing the babies, children, men and women of Iraq. That's what weapons do.

      --
      That was classic intercourse!
  3. you are 2 hours early... by MarvinMouse · · Score: 3, Funny

    This is such an amazingly important invention, but you are 2 hours early on the release. No one was supposed to know that.

    Darn! You have already thwarted my evil plans yet again.

    --
    ~ kjrose
    1. Re:you are 2 hours early... by geodejo · · Score: 2, Funny

      Depends on your time zone! Last year I freaked out for a minute after reading Linus's post on April 2!

    2. Re:you are 2 hours early... by Plug · · Score: 4, Insightful

      Not all the world runs on your time clock. It's been April Fools Day for almost 16 hours at my time of posting...

    3. Re:you are 2 hours early... by AtariDatacenter · · Score: 1

      Sounds like the joke is on you! All the funny stuff won't be released until after April Fools for you.

    4. Re:you are 2 hours early... by Mac+Degger · · Score: 2, Funny

      Hehe...in regards to your sig...my mom thought me and my bro where serious computer criminals when we were talking about the hacks we had on our palmpilots :)

      --
      -- Waht? Tehr's a preveiw buottn?
    5. Re:you are 2 hours early... by 91degrees · · Score: 1

      Slashdot's server is set to GMT. This was posted in the early hours of April Fools day.

  4. In other news.... by VC · · Score: 4, Funny

    Microsoft have released a beowulf distro.
    Linus has joined redhat.
    Slackware is closing down.
    Linux now runs on single entangled electrons at MIT
    etc etc etc

    1. Re:In other news.... by Pseudonym · · Score: 4, Funny

      ...BSD is not dying.

      --
      sub f{($f)=@_;print"$f(q{$f});";}f(q{sub f{($f)=@_;print"$f(q{$f});";}f});
    2. Re:In other news.... by bozojoe · · Score: 1

      and
      Mac goes Mainframe

      --
      lick the cancle button (at least thats what our Chinese QA says)
    3. Re:In other news.... by Mr.+Neutron · · Score: 2, Funny

      IP Over Carrier Pidgeon implemented by Cringely
      Linux Kernel 2.6 to include DRM
      Slashdot becomes an MSN Featured Site
      IBM unveils first 1.0 exabyte ATAPI hard drive
      RIAA successfully lobbies for $1 tax on every MP3 file on the net

      --
      dinner: it's what's for beer
    4. Re:In other news.... by Com2Kid · · Score: 2, Funny
      • IP Over Carrier Pidgeon implemented by Cringely


      Don't give him any ideas.


      • Linux Kernel 2.6 to include DRM


      [tinfoil hat]
      The way things are going, there might not be much choice. . . .
      [/tinfoil hat]


      • Slashdot becomes an MSN Featured Site


      With all the MS ads, you mean it isn't already?


      • IBM unveils first 1.0 exabyte ATAPI hard drive


      IBM is out of the hard drive business, you should read /. more often. :)


      • RIAA successfully lobbies for $1 tax on every MP3 file on the net


      I am sure they are working on it. :)
    5. Re:In other news.... by Zork+the+Almighty · · Score: 2, Funny

      Widely known value of Pi in error, actually 3.15...

      --

      In Soviet America the banks rob you!
    6. Re:In other news.... by Zork+the+Almighty · · Score: 2, Funny

      Apple to sell PCs, no longer interested in "thinking different".

      --

      In Soviet America the banks rob you!
    7. Re:In other news.... by Yottabyte84 · · Score: 1

      RIAA successfully lobbies for $1 tax on every MP3 file on the net

      Yet another reason to use ogg.

    8. Re:In other news.... by sql*kitten · · Score: 1

      All your base are NOT belong to us!

    9. Re:In other news.... by Sentry21 · · Score: 1

      ...Apple will be around for years to come, say journalists.

    10. Re:In other news.... by giantsfan89 · · Score: 1

      Slashdot gets new domain name...

      slashdot.go.com

      --
      Don't ping my cheese with your bandwidth!
    11. Re:In other news.... by voot · · Score: 1

      it seems i have the last laugh for the RIAA, i converted to .wav and burned all my .mp3's to cd's. MUWHAHAHA

  5. two hours early, and already slashdotted by jenkin+sear · · Score: 1

    that's gotta be a record. I know subscribers get early access, but geez!

    --
    What a strange bird is the pelican, his beak can hold more than his belly can.
    1. Re:two hours early, and already slashdotted by JPriest · · Score: 1

      If a website is slashdoted and someone does not pipe in with "that has got to be a record", was it ever really slashdotted?

      --
      Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
  6. New Bit by Anonymous Coward · · Score: 1, Funny

    Hmm, a little bit of this and a little bit of that. Sounds like an old recipe from my grandma..

  7. ...and so it begins by stevens · · Score: 4, Funny

    I love April fool's day.

    Perl programmers may want to check out their beloved cpan.org site today, too. :-)

    1. Re:...and so it begins by MonMotha · · Score: 1

      One may also want to check out grsecurity.net.

      Apparently AOL/TW have gotten a lot more agressive at cracking down on TOS violations.

    2. Re:...and so it begins by chicagozer · · Score: 1

      hmmm...check the date on the RFC..methinks my yank is being chained. ZZ

      --
      ZZ
    3. Re:...and so it begins by amcguinn · · Score: 1

      It doesn't work! I tried to download that "FormMail" thing because I thought it looked really useful, but the link didn't work.

    4. Re:...and so it begins by Istealmymusic · · Score: 1
      --
      "The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
    5. Re:...and so it begins by vadim_t · · Score: 1

      Hehe!

      But I kind of liked what they did the other time. I think it was called "CJAN", Comprehensive Java Archive Network. It was great, I went there and suddenly found a lot of Java stuff on the front page. Took me a while to realize what was going on.

  8. A couple of mirrors by Motherfucking+Shit · · Score: 4, Informative

    Mirror 1

    Mirror 2

    To lighten the load.

    --
    "BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
    1. Re:A couple of mirrors by jdkincad · · Score: 1

      Heres another mirror.

      --
      The great advantage of having a reputation for being stupid: People are less suspicious of you.
  9. Patch for Cisco IOS needed by Degrees · · Score: 4, Funny
    Now, best practices will include setting this bit for all interfaces connected to Microsoft servers and AOL users.

    It'll be the Router Admin Full Employment Act of 2003!

    ;-)

    --
    "The most sensible request of government we make is not, "Do something!" But "Quit it!"
  10. Chomping at the bit by Brett+Glass · · Score: 4, Funny

    Does the DMCA impose penalties for modifying the bit?

    1. Re:Chomping at the bit by Sexy+Commando · · Score: 1

      No. DMCA does not make circumventing security mechanism illeagal. But ti would be sweet (or not) if it does.

  11. Well... by Anonymous Coward · · Score: 1, Funny

    Since the "evil" bit *MUST* be set in attack programs, I guess that will thwart all hacker attacks!! This RFC must have been sponsored by Micro$oft... After all, Microsoft makes hackers obsolete...

  12. the evil one by initnull · · Score: 1, Funny

    So saddam is part of TCP ?

  13. First evil comment by njchick · · Score: 1

    First post with the Evil flag set. If you are reading this comment, Slashdot is not RFC3514-compliant.

    1. Re:First evil comment by einhverfr · · Score: 3, Funny

      Or not a secure system. Insecure systems can choose to ignore the flag (as per RFC).

      My favorite quote of the RFC is:
      " This document defines the behavior of security elements for the 0x0
      and 0x1 values of this bit. Behavior for other values of the bit may
      be defined only by IETF consensus [RFC2434]."

      --

      LedgerSMB: Open source Accounting/ERP
  14. Yes it's a joke by tiltowait · · Score: 1

    And not the last....

    [In case you don't wanna bother or it's Slashdotted, it's about designating bits "evil" or not. Not that funny IMO, compared to some other good RFCs.]

    Last 4/1 the editors posted about 15 of these in a row. Moderators got punchy and the whole place went to... well... be prepared.

    1. Re:Yes it's a joke by SN74S181 · · Score: 2, Interesting

      Actually, some of the humor in this RFC is that it mocks the futile 'consensus' basis of all the RFCs.

      Take it just a little bit serious and you say to yourself 'Wait a minute, this isn't that funny. People really do believe a consensus-based network will scale well worldwide....'

  15. ROFL by Tensor · · Score: 1

    I was reading the txt, thinking this is the stupidest thing ever, before i realized it was April Fool's.

    ARggghhhhhh

    1. Re:ROFL by Coram · · Score: 1

      Likewise. I got as far as the bit definition before it clicked.

      --
      I say I ain't giving you no tree fiddy you goddamned Loch Ness monster, get yo own goddamned money!
    2. Re:ROFL by MrLint · · Score: 3, Funny

      How would one go about setting the evil flag bit when you use the avian transport layer?

    3. Re:ROFL by DCowern · · Score: 2, Informative

      Actually, "today" (1 April) is also the 13th anniversary of RFC1149.

      Check out its majesty: ftp://ftp.rfc-editor.org/in-notes/rfc1149.txt

      People were so much more creative back in 1990. ;-)

    4. Re:ROFL by rcw-home · · Score: 1
      How would one go about setting the evil flag bit when you use the avian transport layer?

      You can squeak an extra bit out of the eyebrow polarization for this purpose.

    5. Re:ROFL by qwertyphobia · · Score: 1

      ... and how do we deal with removing such packets from the network?

      I think we need to immediately start work on a patriot missile-style defence system for identifying and eliminating evil avian packets.

      A transport layer firewall for avian carriers. Just hink of the possibilities...

    6. Re:ROFL by Degrees · · Score: 1

      I'm pretty sure the avian transport layer sets the bit on you....

      --
      "The most sensible request of government we make is not, "Do something!" But "Quit it!"
    7. Re:ROFL by MrLint · · Score: 2, Funny

      Ya know I was thinking about my original post, and it occured to me taht Hitchcock's "the birds" is really an archetype for evil avian transport DDoS.

  16. Very Elegant by BlueTooth · · Score: 1

    This is a very elegant solution to most of the internets security problems. This could even prevent DDoS attacks! Does anyone know when the patched version of the SQL Slammer worm will be available, or should I just drop my firewall and let it install itself?

    --
    SPAM
  17. 100% Correct Spam Filters Now Possible by Persnickity · · Score: 4, Funny

    Please, please, please take this wonderful advance in technology and extend it to email. Then Spam can have a new header called "Evil: Yes". Then we can leverage the same technology to do perfect Spam filtering.

    --
    - Persnickity
    1. Re:100% Correct Spam Filters Now Possible by sqlrob · · Score: 2, Insightful

      Already covered in this RFC.

      Content-Type: application/evil

    2. Re:100% Correct Spam Filters Now Possible by Zak3056 · · Score: 1

      Please, please, please take this wonderful advance in technology and extend it to email. Then Spam can have a new header called "Evil: Yes". Then we can leverage the same technology to do perfect Spam filtering.

      The X-Evil header was implemented under RFC666. The first widely used email client to make use of the header was Outlook 2002, while the first MTA to do so was Exchange 2000.

      --
      What part of "shall not be infringed" is so hard to understand?
    3. Re:100% Correct Spam Filters Now Possible by kasperd · · Score: 1

      Content-Type: application/evil

      I think the RFC is flawed. Evil content come in so many flavours that a subtype is simply not enough to identify it. Instead a new top-level media type should have been defined so we could have evil/virus, evil/DoS, and evil/spam content-types.

      --

      Do you care about the security of your wireless mouse?
    4. Re:100% Correct Spam Filters Now Possible by WWWWolf · · Score: 1
      Content-Type: application/evil

      Maybe that's just a safeguard. Under normal conditions I'd think leaving content-type as is and setting "Content-Encoding: evil" would be better...

  18. Timing problem by jpetts · · Score: 2, Funny

    Hey: it's still before midnight where I am! I'll need to take this seriously for the next couple of hours...

    --
    Call me old fashioned, but I like a dump to be as memorable as it is devastating - Bender
  19. Must remember by the_other_one · · Score: 3, Funny

    Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

    Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.

    --
    134340: I am not a number. I am a free planet!
  20. Why computers crash, by Dr. Seuss by Mattygfunk1 · · Score: 4, Funny
    If a packet hits a pocket on a socket on a port, and the bus is interrupted at a very last resort, and the access of the memory makes your floppy disk abort, then the socket packet pocket has an error to report.

    If your cursor finds a menu item followed by a dash, and the double-clicking icon puts your Window in the trash, and your data is corrupted 'cause the index doesn't hash, then your situation's hopeless and your system's gonna crash!!

    If the label on the cable on the table at your house says the network is connected to the button on your mouse, but your packets want to tunnel to another protocol that's repeatedly rejected by the printer down the hall, and your screen is all distorted by the side effects of gauss, so your icons in the window are as wavy as a souse; then you may as well reboot and go out with a bang, 'cuz sure as I'm a poet, the sucker's gonna hang!

    When the copy of your floppy's getting sloppy in the disk, and the macro code instructions cause unnecessary risk, then you'll have to flash the memory and you'll want to RAM your ROM. Quick, turn off the computer and be sure to tell your Mom!

    Blatently pinched from - Twisted Monkey Entertainment

    _________________
    Cheap Web Site Hosting - recommended by some worker posting on slashdot!

    1. Re:Why computers crash, by Dr. Seuss by sinnergy · · Score: 3, Informative

      Please attribute properly :)

      http://people.cornell.edu/pages/elz1/clocktower/Dr Seuss.html

      The whole thing was created by Gene Ziegler. He gives a pretty good history of the poem as well as the full thing, which most people don't post.

    2. Re:Why computers crash, by Dr. Seuss by comet_11 · · Score: 1

      Want a laugh? Throw that into your TTS program of choice and kick the speed up to a bit above normal. Microsoft Mike was destined to be a rapper, I tell you!

      --
      By reading this comment, you immediately waive any and all rights regarding it.
  21. Don't forget RFC3251 as well by Billly+Gates · · Score: 2, Interesting

    More info is here

  22. The 128-bit strength indicator levels! by EvilNTUser · · Score: 3, Funny

    Unfortunately the RFC neglects to define what levels of evil the values of the 128-bit strength indicator maps to.

    Therefore I, on behalf of the United Corp^H^H^H^H^H States government, submit that the top values should be reserved for the following:

    2^127-n
    4: Unpatriotic activity.
    3: Terrorism. For up to date definition, see www.dhs.gov
    2: Attempt to secure personal communication by encryption
    1: Circumvention of copy protection mechanisms for purposes of piracy
    0: Circumvention of copy protection mechanisms for purposes of "fair use"

    Note that the last bit is reserved to indicate whether the packet originates from a foreign country.

    --
    My Sig: SEGV
  23. Here's the info... by TheSHAD0W · · Score: 1

    Cached in my journal

  24. Nasty! by mparaz · · Score: 1

    Now we were really rolling on the floor laughing on that one. Is there a link explaining why they chose that theme?

    1. Re:Nasty! by stevens · · Score: 5, Informative
      Is there a link explaining why they chose that theme?

      No link necessary. Matt's Script archive is well-known among Perl programmers as one of the densest collections of hole-ridden crappy code on the net.

      There's even a project to write secure, well-written clones of his scripts so the poor bastards stuck with his can drop-in something that won't allow remote exploits on their machine. :-)

    2. Re:Nasty! by miu · · Score: 1
      No link necessary. Matt's Script archive is well-known among Perl programmers as one of the densest collections of hole-ridden crappy code on the net.

      And the author is *very* defensive about it. I'm surprised he went along with the gag.

      --

      [Set Cain on fire and steal his lute.]
    3. Re:Nasty! by mrdlinux · · Score: 1

      Matt's Script archive is well-known among Perl programmers as one of the densest collections of hole-ridden crappy code on the net.

      Second only to CPAN, I suppose.

      --
      Those who do not know the past are doomed to reimplement it, poorly.
    4. Re:Nasty! by sheriff_p · · Score: 1

      Is he really? How about taking a look and seeing how he endorses the project to replace his scripts, hrm?

      Think *BEFORE* typing.

      --
      Score:-1, Funny
    5. Re:Nasty! by miu · · Score: 1
      Is he really? How about taking a look and seeing how he endorses the project to replace his scripts, hrm?

      Then he has grown up in the last six years.

      I mailed him patches several years ago for some of his scripts. He was very defensive and did not seem to understand cgi attack methods.

      --

      [Set Cain on fire and steal his lute.]
  25. I have security. by rice_burners_suck · · Score: 3, Funny
    Security implications? Bah, humbug. I have the most secure network anywhere. First of all, I use 100% wireless networking with no encryption whatsoever. I am using Windows operating systems, which are unbreakable in terms of security because nobody other than Microsoft, the most respectable organization in the world, has access to the source code, which is flawless in every way. Sharing is turned on for all drives with no passwords. As a matter of fact, there are no passwords on anything. And the computers are being kept on all the time. Private documents are stored on these computers, as are diaries, pictures, videos and other proofs of the illegal crimes my organization commits (see fine print below). As such, I firmly believe that no update to any aspect of my network needs to take place, as I am 100% safe from evil hackers and from those evil people who do not agree 100% with the viewpoints of Microsoft, the RIAA, the MPAA, AOL Time Warner, The Walt Disney Company and Saddam Hussein.



    The fine print: Aforementioned crimes are only illegal in Afghanistan and include, but are limited to, allowing women to walk around without being entirely concealed under a table cloth, teaching children how to read and write, and singing nursery rhymes.

    1. Re:I have security. by Daniel_Staal · · Score: 1

      You know, by some definitions that is a secure system.

      I mean, you allow everything, so the fact that everything is possible is just standard. You are as hardened as you have set out to be.

      --
      'Sensible' is a curse word.
    2. Re:I have security. by WWWAvenger · · Score: 1

      I'm going to teach my children I/O.

  26. HTTP link by apankrat · · Score: 2, Funny

    Here

    Also note that it's actually based on the ideas initially developed by HTCPCP protocol, which just turned 5 years.

    --
    3.243F6A8885A308D313
  27. A potential hole... by russotto · · Score: 3, Funny

    An attacker can take advantage of the quantum nature of reality to set this bit to an indeterminate/combined value influenced by the nature of the observer of the packet. An observer who knows the evil nature of the sender of the packet will see the "evil" bit set to one, as it should be. However, unsuspecting observers, including firewalls and potential victims, will see the bit set to zero and be fooled.

    The inherent subtlety of this attack is revealed by considering what happens when a security expert attempts to analyze the attack. As soon as he recognizes the evil nature of the attacker, the packets appear to have the 'evil' bit set, and his firewalls start dropping the packets, depriving him of further packets for analysis. The attack is thus even more precisely targeted towards the naive than an attack on Microsoft IIS.

    1. Re:A potential hole... by Bodhidharma · · Score: 1

      But, if the firewall observes the packet, the bit becomes fixed at zero so the security expert never becomes aware of it. But, if the security expert is paranoid and starts examining packets coming in to the firewall, his observations will cause the evil bit to be set on all packets.

      At least the Windows admins will be able to sleep since they know Microsoft would tell them if there was anything to worry about. Since there is nothing to worry about, no evil bit is set.

      --
      A dyslexic man walks into a bra.
  28. Evil by NickisGod.com · · Score: 3, Funny

    Is it time to bring out the April Fools Day Tree yet?

    Should I start opening the April Fools Day gifts?

    Serious question: Will this bit work over Carrier Pigeon?

    And one other thought, will Windows2003Server recognize it? Oh...they'll have to release the Service Pack because anything set to 0 won't get through because of a buffer overflow extension illegal operation segfault doo-hickey.

    Any other cliches missed?

    1. Re:Evil by Caraig · · Score: 2, Funny

      Considering that carrier pigeons used to carry TCP packets are already compliant with IPv4, then I'd say that the evil bit can be set.

      Usually, it can be detected for by a specially-designed packet sniffer: a freshly-washed car right beneath the carrier pigeons' flight path.

      I think a much more pressing ssue would be making carrier pigeons compatable with IPv6. Perhaps if there were two pigeons, and they carried the packet on a string held between them.....

      --
      "I am an Adept of Tantric VAX."
    2. Re:Evil by Mac+Degger · · Score: 1

      Ah, but then the question becomes: "What's the maximum ping of a pair of IPv6 pigeons?".

      --
      -- Waht? Tehr's a preveiw buottn?
    3. Re:Evil by HawkingMattress · · Score: 1

      Serious question: Will this bit work over Carrier Pigeon?

      Actually, it depends : an european pigeon, or a south african one ?

  29. Oh geez... by sfe_software · · Score: 4, Funny
    ...it's 4/1 already...

    I liked this bit (emphasis mine):

    0x0 If the bit is set to 0, the packet has no evil intent. Hosts,
    network elements, etc., SHOULD assume that the packet is
    harmless, and SHOULD NOT take any defensive measures. (We note
    that this part of the spec is already implemented by many common
    desktop operating systems.
    )

    0x1 If the bit is set to 1, the packet has evil intent. Secure
    systems SHOULD try to defend themselves against such packets.
    Insecure systems MAY chose to crash, be penetrated, etc.

    --
    NGWave - Fast Sound Editor for Windows
    1. Re:Oh geez... by BJH · · Score: 1

      I like this part myself:

      6. IANA Considerations

      This document defines the behavior of security elements for the 0x0
      and 0x1 values of this bit. Behavior for other values of the bit may
      be defined only by IETF consensus [RFC2434].


      Other values of the bit?

    2. Re:Oh geez... by delta407 · · Score: 1
      Actually, something else rather interesting:
      4. Processing of the Evil Bit

      Devices such as firewalls MUST drop all inbound packets that have the
      evil bit set. Packets with the evil bit off MUST NOT be dropped.
      Dropped packets SHOULD be noted in the appropriate MIB variable.
      Many [broken] routers and firewalls drop packets with reserved bit(s) set in various header fields of TCP and IP. This is one of the reasons Explicit Congestion Notification (see RFC 3168) has problems behind certain devices. Since all 'evil' packets must be marked as such and dropped accordingly, these manufacturers were quite forward-thinking.

      So, it turns out that several common products actually implement RFC 3514 without realizing it. :-)
    3. Re:Oh geez... by Angry+White+Guy · · Score: 1

      IETF consensus? Maybe they should have Stephen Hawking approve it before the IETF does.

      --
      You think that I'm crazy, you should see this guy!
    4. Re:Oh geez... by sfe_software · · Score: 1

      Other values of the bit?

      I hate to admit, I remember reading that paragraph, but didn't catch that :)

      --
      NGWave - Fast Sound Editor for Windows
    5. Re:Oh geez... by pi_rules · · Score: 1

      Nah, by far the funniest part is this:

      The bit field is laid out as follows:

      0
      +-+
      |E|
      +-+

      I laughed out loud on that one. Reminds me of those books Mr. Bunny's Guide to ActiveX and Mr. Bunnies Big Cup 'o Java

      Screenshots will be provided for developers trying to follow along but don't have monitors

    6. Re:Oh geez... by einhverfr · · Score: 1

      hehehehehe Doesn't this remind you of ActiveX control signing?

      --

      LedgerSMB: Open source Accounting/ERP
    7. Re:Oh geez... by Zork+the+Almighty · · Score: 1

      I liked this one too : "In networks protected by firewalls, it is axiomatic that all attackers are on the outside of the firewall. "

      --

      In Soviet America the banks rob you!
  30. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  31. Hehehehhe by einhverfr · · Score: 1

    I was actually wondering how this would help... Now I understand why.

    Trust me, this program is not malicious. ;-)

    --

    LedgerSMB: Open source Accounting/ERP
  32. Re:4/1/03 by hendridm · · Score: 1

    > Posted by jamie on Monday March 31, @09:25PM

    Perhaps they failed that all-to-important question when installing RedHat that asked, "Is your clock set to GMT or local time?"

  33. yep... by Robo210 · · Score: 1

    From the SHOULD dept. Something like this should happen, though I think its one of those "shoulda-know-better" things your mother told you about.

  34. If only real life was as simple by krammit · · Score: 2, Funny

    If only it was that easy to detect evil intent in real life...

    "Sally, cross your legs! His bit is set to 'evil'!"

    On second thought...

    --
    "Watch your cornhole, bud."
  35. I was about to write a looong message... by chicoy · · Score: 1

    and then, I thought, "this kind of obvious trolling only comes around April".

    A little bit early jamie (all the pun intended).

    --
    ~the keyboard is mightier than the pen.
  36. Re:4/1/03 by Pharmboy · · Score: 4, Insightful

    jumping the gun on April Fools Day a bit, aren't we?

    Thanks for the reminder.

    I am sitting here, reading the article before the replys here (yes, some of us really do before we post ;) and thinking "wtf is an evil bit?"

    I mean, the whole protocol thing is over my head, but I read anyway to maybe learn something. It took about 3 minutes of head scratching before I really looked at the url, return here suspicious and decide that I had been had.

    I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax ;)

    --
    Tequila: It's not just for breakfast anymore!
  37. zerg by Lord+Omlette · · Score: 1

    I sent an email to my TCP/IP professor asking if he could explain this RFC to us in class because I couldn't understand it, and he wrote back saying I just earned an F. ^^;;

    --
    [o]_O
  38. IPv6 evilness indicator and type code by 3.1415926535 · · Score: 1

    I don't think 256-bits of evilness strength and type code will be enough granularity for the amount of variety observed in the way certain popular operating systems crash in response to an attack.

  39. sex or war by lingqi · · Score: 4, Funny

    Actually I think somebody famous* established long time ago that sex, as strange as some of its involved rituals may seem to many at times, are a better alternative to war.

    I propose that instead anything coming from or going to a .gov extension has the eBit** set.

    *note: Larry Flint. Watch the movie.

    **I hereforth trademark this name.

    --

    My life in the land of the rising sun.

    1. Re:sex or war by Syberghost · · Score: 1

      Actually I think somebody famous* established long time ago that sex, as strange as some of its involved rituals may seem to many at times, are a better alternative to war.

      Well, if the Allies had gone along with that in World War II, the Jews would certainly have been fucked.

    2. Re:sex or war by The+Zody · · Score: 1

      Lysistrata, a comedy by Greek dramatist Aristophanes (c. 447 - c. 385 b.c.e.), tells the story of a group of women from opposing states who unite to end the Peloponnesian War. http://www.pecosdesign.com/lys/play.html "After matronly stormtroopers take over the building where public funds are kept, the women rise to end the war by withholding sex from their mates -- Until, desperate for intimacy, the men finally agree to lay down their swords and see their way to achieving diplomatic peace."

  40. Har har har by stratjakt · · Score: 1

    geek humor is so the opposite of funny

    Now, if Goldberg isnt really going to be at backlash, and that's an april fools joke, then THAT would sure suck.

    --
    I don't need no instructions to know how to rock!!!!
  41. Whoops! Should have read the RFC by Degrees · · Score: 1
    All interfaces inside the firewall are, by default, to not set the bit.

    I think I will set it for the IIS servers anyway. I can remove it the day Microsoft stops adding sabotage code to their products.

    Anyone care to place a bet? I need the URL of those 'Betting Pool' web sites. This one will need to run until at least the year 2050....

    ;-)

    --
    "The most sensible request of government we make is not, "Do something!" But "Quit it!"
  42. Re:Must remember by Pharmboy · · Score: 2, Funny

    Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.

    Which makes me think: Will the cable company terminate my account if I forget to set the evil bit when I am DDoSing someone, as a TOS violation?

    --
    Tequila: It's not just for breakfast anymore!
  43. Bad News by Crapflooder+Supreme · · Score: 1

    You'll have to write a RFC, and until then, you'll have to use "X-Evil:" instead and hope it catches on.

    --
    "Don't worry, it's not loaded." --Terry Kath
  44. Re:4/1/03 by CerebusUS · · Score: 1

    April Fool's Day.

    Also known as the one day a year I avoid /. like the plague. See you all on Wednesday.

  45. Re:4/1/03 by ergo98 · · Score: 3, Insightful

    I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax

    I'd also put down that about 80% of /. readers are releasing a collecting groan and muttering something along the lines of "Oh God...is it April 1st again...". I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.

  46. What a day! by Ridge · · Score: 5, Funny

    First this and now I noticed the W3C added an addendum to HTTP 1.1:

    10.5.4.1 503.1 Slashdotted

    The server is currently unable to handle the request due to a fucking slashdotting of the server. Visit slashdot.org for potential mirrors.

  47. Re:is anyone else missing the point here? by Commutative+Monoid · · Score: 1

    Only those that are unaware of the cultural nonsense that occurs on the first of April.

    --
    You have exactly 314 seconds to come up with a less retarded plot.
  48. April 1st RFCs are always the most important... by Bradee-oh! · · Score: 5, Informative

    There may be some strange cosmic significance about April 1st, or just a series of amazing coincidences, but many RFCs published on April 1st are of amazing importance.

    Potentially devastating Y10k problem

    Lifesaving method to temporarily reroute ip in cause of equipment failure

    Protocol to guarantee software engineer productivity and efficiency

    Addressing ipv6 with incredible bandwidth savings

    Planning ahead to Star Trek technology with current protocols and infrastructure

    I don't even know what this one is about...

    And many, many more. Any self-respecting network engineer should be especially familiar with all April 1st RFCs, in my opinion...

    --
    "This is Zombo Com, and welcome to you who have come to Zombo Com" - www.zombo.com
    1. Re:April 1st RFCs are always the most important... by John+Bayko · · Score: 1
      I don't even know what this one is about...

      That's 'cause the RFC number doesn't follow it's own standard. It should be RFC MMDLI (who can figure out what 2551 means? You need some sort of Greek math or something).

  49. lol by Mercury2k · · Score: 1

    Does this mean I wont be able to run my Windows update through my firewall now?

  50. Re:So 2003/04/01 starts in GMT? by Pharmboy · · Score: 1

    This is slashdot.org, not slashdot.org.us


    Technically, you are wrong. It IS uscentric. Quoting directly from the FAQ...

    Slashdot is U.S.-centric. We readily admit this, and really don't see it as a problem. Slashdot is run by Americans, after all, and the vast majority of our readership is in the U.S. We're certainly not opposed to doing more international stories, but we don't have any formal plans for making that happen. All we can really tell you is that if you're outside the U.S. and you have news, submit it, and if it looks interesting, we'll post it.

    sooo, according the guys that own the place, it IS slashdot.org.us and if you are not in the US, well, your welcome to join too.

    So it SHOULD have been posted later.

    Feel free to mod me up, i had to search awhile to find that quote, reducing the time I can spend downloading pr0n now.

    --
    Tequila: It's not just for breakfast anymore!
  51. Gotta love it.. by Snowpony · · Score: 1

    Ahh.. I love the smell of an April Fool's Joke first thing in the morning ;) (Seriously people - an EVIL bit and you expect people to honour it? Heh.. I wish! ). While we are at it - can we have a PR0N, VIRUS and SPAM bit as well? I would make my job so much easier ;)

    --
    Snowy Angelique Maslov - http://www.snowy.org/
  52. Re:4/1/03 by Pharmboy · · Score: 4, Funny

    I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.

    Well, ya they are predictable, they come every April 1....:)

    Perhaps if they just did a few random hoaxes a year, at different times, it would be a little more fun. As it is, its kind of like acting suprised when you get socks for christmas. And just as gratifying.

    --
    Tequila: It's not just for breakfast anymore!
  53. IP Packets are like people .... by i+am+fishhead · · Score: 1

    there is just a bit of evil in everyone's head.

  54. Hey, I recognize this security scheme! by eison · · Score: 2, Funny

    In networks protected by firewalls, it is axiomatic that all
    attackers are on the outside of the firewall. Therefore, hosts inside the firewall MUST NOT set the evil bit on any packets.


    Our IT group must have contributed to this RFC! Now I know exactly what to think of it... :)
    --
    is competition good, or is duplication of effort bad?
  55. Perspiring minds want to know.... by unitron · · Score: 4, Funny

    Enough about the evil bit, where are the "naughty bits"?

    --

    I see even classic Slashdot is now pretty much unusable on dial up anymore.

    1. Re:Perspiring minds want to know.... by ZorMonkey · · Score: 3, Funny
      Enough about the evil bit, where are the "naughty bits"?
      Oog. Dont sniff those packets...
  56. April Fool by james.mcarthur · · Score: 1

    The Evil Flag in the IP Header, LOL

  57. What are we going to do tonight, Brain? by The+Monster · · Score: 1
    Note to self: Remember to set "evil" bit to 1 when launching world domination attempt.
    I don't know if there's an RFC for this, but I believe Netiquette demands...
    banner WORLD DOMINATION > ~/.plan
    --

    [100% ISO 646 Compliant]
    SVM, ERGO MONSTRO.

  58. Re:In Other News by mlk · · Score: 1

    Microsoft already owns it.

    --
    Wow, I should not post when knackered.
  59. If we lobby hard enough by lpontiac · · Score: 2, Funny

    I bet we could get the US Congress to pass a law making it illegal to set this bit incorrectly.

  60. Office fun. by supabeast! · · Score: 1

    I am going to be distributing this at the office tomorrow and announcing that all of our hardware is going evil-bit-compliant. This is going to rock!

  61. Insightful? by einhverfr · · Score: 1

    OK, my question is which part of the joke did you not get? ;-)

    --

    LedgerSMB: Open source Accounting/ERP
  62. I'm not evil, I swear! by jemele · · Score: 2, Funny

    Fooled you - with my stupid bit~!

    have we forgotten that evil people often masquerade in sheep's clothing????
    stupid!
    joshua

  63. What would script-kiddy see in l337? by DJ+Rubbie · · Score: 2, Funny

    3514 translated into l337 sp34k is ESIA... Doesn't ring a bell, but Egoistic Scriptkiddy Ignoring Annihilation seems to fit...

    --
    Please direct all bug reports to /dev/null
  64. April fools by kyoko21 · · Score: 1

    Is this just me, or is this April's fool RFC kind of lame? I personally like the IP over Avian network. Anyone out there has a personal favorite?

    1. Re:April fools by Unnamed+Source · · Score: 1

      2795 was one of my favorites: The Infinite Monkey Protocol Suite (IMPS)

  65. Re:4/1/03 by Sebby · · Score: 1
    Actually, the first thing I saw was the date on the RFC, and thought to myself 'Gee, what a bad day to release one...' then I read on.

    Took me about 2 paragraphs before I finally did conclude it *was* an april fools joke.

    --

    AC comments get piped to /dev/null
  66. no comment by man_ls · · Score: 1

    I won't comment on the legitimatcy of the article due to the date (4/1) but, this RFC seems to be technically perfect, but flawed in every other way.

    Attacking systems MUST set the "evil" bit. Secure systems MUST drop the packets, insecure systems MAY chose their action -- drop, crash, give in.

    Basically, this system, you give implicit trust to the remote system on the end of the communications, and let that system determine the security your own network will take in response to the communications.

    Let one malicious user not flag his attack packets as evil, and the remote network will let him right in.

    Sounds like a plan!

  67. Re:4/1/03 by Sebby · · Score: 1
    "I am betting 1% of the readers come back and think the new protocol is a good thing before realizing its a hoax ;)"

    Course the thing is, they could come back here, post a reply thinking this was for real, then we'd all laugh at them, and they could just as easily turn around and say "Ha ha, had you going!" to get out of looking like a fool.

    --

    AC comments get piped to /dev/null
  68. Just notice it's also Troll Tuesday... by mangu · · Score: 1

    ...and with karma to burn... who said life isn't perfect?

  69. My Favorite by jdkincad · · Score: 1

    Some link layers, notably those based on optical switching, may bypass routers (and hence firewalls) entirely. Accordingly, some link-layer scheme MUST be used to denote evil. This may involve evil lambdas, evil polarizations, etc.

    --
    The great advantage of having a reputation for being stupid: People are less suspicious of you.
  70. Oh come on... by FIT_Entry1 · · Score: 1

    At least wait the hour and a half until April 1st.

  71. By testing the flag... by Snork+Asaurus · · Score: 1

    and responding accordingly you can prevent access of evil packets.

    --
    Sigs are bad for your health.
  72. Re:In Soviet Russia... by quinkin · · Score: 1
    China has recently decreed April 1st as Liars Day...

    Q.

    --
    Insert Signature Here
  73. Wow! by jkirby · · Score: 1

    What a concept. Lets just force the hackers to mark their packets as EVIL.

    Funny, reminds me of the Arian Carrier RFC :)

    --
    Jamey Kirby
  74. Re:4/1/03 by dacarr · · Score: 1

    Well... you'll know it's a problem if they post the Internet Sweeper warning (you know, that device that deletes everything attached to the 'net during a given period of time?) here on /.

    --
    This sig no verb.
  75. Re:4/1/03 by hamisht · · Score: 1
    jumping the gun on April Fools Day a bit, aren't we?

    Not over here in New Zealand - it's all over and done with.

  76. Previous April 1 RFCs by arvindn · · Score: 3, Informative
    There's a list here. I guess the most famous of them is the IP over avian carriers thing. On the subject of avians, google came out with a cool pigeonrank joke last year.

    Back to the RFCs: the list above doesn't seem exhaustive. I found some more: 12 networking truths RFC, telnet randomly lose option and Hyper Text Coffee Pot Control Protocol

    1. Re:Previous April 1 RFCs by mindriot · · Score: 1

      As for RFC 1149, it's also worth noting there was an implementation too...

  77. Re:4/1/03 by JWSmythe · · Score: 1

    I'm just worried about the small percentage that read it, and demand that the new feature be used by all of our software immediately..

    I'm betting I'll have no less than 4 Emails by noon asking how soon we cam implement it.. :)

    --
    Serious? Seriousness is well above my pay grade.
  78. Whee! by Fizzl · · Score: 1

    The 1st of appril is here =)

    Damn. I took is seriously for the first 5 lines :)

  79. 1 = EVIL! by DarwinDan · · Score: 1

    To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 [RFC791] header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

    Oh great! So now my firewall can at least tell me whether it likes a packet or not!

    --
    $DEITY bless $NATION
  80. Here's yer problem... by jose+c+rivera · · Score: 3, Funny

    somebody set this thing to "Evil."

  81. come again? by farrellj · · Score: 1

    Thank you.

    ttyl
    Farrell

    --
    CAN-CON 2019 - Ottawa's only book oriented Science Fiction Convention! October 18-20, Sheraton Hotel, Ottawa, Canada h
    1. Re:come again? by sconeu · · Score: 1

      I believe that was his point :-P

      --
      General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
  82. It isn't April 1st yet by Istealmymusic · · Score: 2, Insightful

    In my timezone, it is currently 10:30 of March 31st. Shouldn't the Internet community wait until it is April 1st everywhere before trying to implement this suggestion?

    --
    "The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
    1. Re:It isn't April 1st yet by f205v · · Score: 1

      1st of April AVERYWHERE merely last a fraction of nothing!!!!!!! When it is finally 1st of April 1 nanometer close to the changing date line, it's immedialtely 2nd of April 1 nanometer forward!!!!!! Ciao f205v

    2. Re:It isn't April 1st yet by indecision · · Score: 1
      In my timezone, it is currently 10:30 of March 31st. Shouldn't the Internet community wait until it is April 1st everywhere before trying to implement this suggestion?

      Its never 1 April everywhere. Don't believe me? Grab a globe and use a tennis ball for the sun. :)

    3. Re:It isn't April 1st yet by evilviper · · Score: 1

      Sure! Sounds great!!! And at exactly what time today will you be flatening the planet?

      --
      Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
  83. April 1st rubbish by 1s44c · · Score: 1


    Is anyone else sick to death of all this april the first BS?

    It's just not funny any more.

    Next year I'm not even opening a web browser.

  84. DO NOT SET "JOKE" SECURITY BIT ON WIN9X SYSTEMS! by LouisvilleDebugger · · Score: 1

    I want to call your attention to the fact that
    the Winsock32 stack in Windows 98 build 950B
    is sensitive to setting this high-order bit. I can
    appreciate the humor of the RFC, BUT DO NOT SET THIS
    BIT on packets inbound to legacy hosts running this
    operating system!

    This is related to the infamous TCPNODELAY stack
    exploit in the same OS. Patched systems should be okay.

    I would document this vulnerability in my own RFC,
    but unfortunately the textarea is too small to contain it without comment overflow.

    :) (In case you took one word of the above seriously...Happy April Fools Day from Kentucky! )

  85. another joke you probably missed in this by Imperator · · Score: 2, Funny
    6. IANA Considerations

    This document defines the behavior of security elements for the 0x0 and 0x1 values of this bit. Behavior for other values of the bit may be defined only by IETF consensus [RFC2434].
    (emphasis mine)
    --

    Gates' Law: Every 18 months, the speed of software halves.
  86. Bit errors ? by sudhakarprinceton · · Score: 1

    Fellow /.ers may recollect the "cool scientific paper" where the authors bomb DRAM chips with Xrays or more simply with 50-watt spotlight bulb to exploit Java and .NET virtual machines. That attack is very relevant to this new scheme proposed in this RFC.

    What if the new security bit flips? Wow! I just improved my result from 70% to 100% !!! I should waste no time in typing my latest paper.

    --Sudhakar.

  87. Can someone clarify this? by A+nonymous+Coward · · Score: 1

    It seems to me that by setting the EVIL bit, a packet thereby becomes less evil, in fact not evil at all, and thus should set the bit to 0, but of course then it would be truly evil, and back at square one are we.

    My head spins along with this bit. Can someone please clear this up? Is it a bit intended only for quantum computers?

  88. Re:4/1/03 by JMZorko · · Score: 1
    I was fooled for a bit (ooh! a pun!) as well, until I saw the "Evil" bit, then I knew :-)

    Regards,

    John

    --
    Falling You - beautiful
  89. Re:4/1/03 by fucksl4shd0t · · Score: 1

    I'm not being a spoilsport, but after a few years April Fools Day jokes start to seem a little formulaic and predictable.

    Taht's just because nobody around here has any imagination, otherwise April Fools would be a great day. Just think, my wife's going in for her ultrasound today. Do you really think the Doctor's gonna tell her the truth about the baby's sex? I don't.... at least, not if I were the Doctor.

    Doc: Looks like you're having a girl.

    Wife: But what's that pointy thing?

    Doc: It's her, uh, nose.

    Wife: That's not what my son's nose looked like...

    Doc: This one's Italian.

    Wife: Oh.

    Doc: Do you have any Italian in you?

    Wife: No, I don't.

    Doc: Do you want some?

    -- Baby's birthday --

    Wife: You said I was having a girl! This is a boy.

    Doc: April Fool's!

    --
    Like what I said? You might like my music
  90. Re:Wouldn't it be great if this went to Google New by AndroidCat · · Score: 1

    Oh sure, turn their servers into slag!

    --
    One line blog. I hear that they're called Twitters now.
  91. How do you set the Evil bit NewCode? by tqft · · Score: 1

    http://www.theage.com.au/articles/2003/03/31/10489 62694949.html

    --
    The Singularity is closer than you think
    Quant
  92. You forgot by spamtastic · · Score: 1

    your friendly NRA

  93. Re:4/1/03 by carini · · Score: 1

    I am betting that 2% wish to actually implement this in their software

  94. Great Suggestion by tres3 · · Score: 1
    Any chance we can get M$ to adopt this policy? That really would make security eaisier!! I read the whole RFC and figured it had to be a joke but I had forgotten the date. Is anyone keeping track of haw many of the ancient ones are going to pop up again this year? A "Quick Book Review" of the author's book: "Firewalls and Internet Security: Repelling the Wily Hacker", Cheswick & Bellovin:

    I haven't read the second edition but the first I read shortly after setting up my first Linux server and reading O'reiliey's TCP/IP book. I read it cover to cover (no, really) and thoroughly enjoyed it. It is a great book for those that are interested in network security; it has well told stories and good examples of best practices. I especially liked the way they described their logging machine: A server connected via a cat five wires that had seven of the eight pairs cut! The only pair left was the receive pair. Bad for TCP / good for UDP.

    • Microsoft to Open Source WindowsXP.
    • Stallman becomes the new marketing manager for Microsoft.
    • No flame bait post on slashdot.
    • A politician who actually understands technology gets elected.
    • A foolproof spam filter is announced.
    • Sadam to vacation in Washington DC. Brings Bin Laden along on the two for one special.
    • Most other countries in the world support Bush's International policies.
    • Ashcroft endorses the Policies of George Orwell (Oh yea, that's real)

    Happy 4/1 (or 1/4 in Europe)

  95. Re:4/1/03 by Zork+the+Almighty · · Score: 1

    I'm confused, doesn't slashdot post random hoaxes now ?

    --

    In Soviet America the banks rob you!
  96. Oh Great! by Flower · · Score: 1
    This RFC just killed my lucrative network security job. My boss sent me back to desktop support.

    You bastards!

    --
    I don't want knowledge. I want certainty. - Law, David Bowie
  97. Linux 2.4.20 patch by zcougar · · Score: 2, Informative
    You can find a patch for Linux 2.4.20 kernel at http://www.version6.net/patches/linux-2.4.20-rfc35 14.dif

    Enjoy! :-)

  98. Very good by pork_spies · · Score: 1

    I had got quite far into this before I realised you were taking the piss. Then finally the incredulity reached the tipping poinbt and my synapses connected the date with the ludicrous nature of the RFC. But, I admit it, you had me going for quite a bit...

  99. Nmap compliance! by spydir31 · · Score: 2, Interesting

    There now exists a patch for nmap which sets the evil bit on by default, available here
    also, more discussion on when the evil bit should be set.

  100. Re:4/1/03 by Pharmboy · · Score: 1

    I'm confused, doesn't slashdot post random hoaxes now ?

    No, those are just repeats and articles where the editor doesn't corroborate the facts. We just laugh about them to keep from crying.

    Hense the confusion.

    --
    Tequila: It's not just for breakfast anymore!
  101. APRIL FOOLS! by vch976 · · Score: 1

    HA HA...

    If anyone actually believed this... then I have a bridge for sale in SF.

    --
    If you dont like what I am saying, well then why dont you +++ATH0
  102. RFC 3514 by uohcicds · · Score: 1

    ho ho.

    Can we call the evil bit the "ming" bit instead?

    --
    It's not you: I'm just this horrifically socially awkward with everybody.
  103. Full text, ftp server slashdotted by oPless · · Score: 2, Informative

    Network Working Group S. Bellovin
    Request for Comments: 3514 AT&T Labs Research
    Category: Informational 1 April 2003
    The Security Flag in the IPv4 Header

    Status of this Memo

    This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

    Copyright Notice

    Copyright (C) The Internet Society (2003). All Rights Reserved.

    Abstract

    Firewalls, packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. We define a security flag in the IPv4 header as a means of distinguishing the two cases.

    1. Introduction

    Firewalls CBR03 , packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. The problem is that making such determinations is hard. To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 RFC791 header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1.

    1.1. Terminology

    The keywords MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL, when they appear in this document, are to be interpreted as described in RFC2119 .

    2. Syntax

    The high-order bit of the IP fragment offset field is the only unused bit in the IP header. Accordingly, the selection of the bit position is not left to IANA.

    The bit field is laid out as follows:

    0
    +-+
    |E|
    +-+

    Currently-assigned values are defined as follows:

    0x0 If the bit is set to 0, the packet has no evil intent. Hosts, network elements, etc., SHOULD assume that the packet is harmless, and SHOULD NOT take any defensive measures. (We note
    that this part of the spec is already implemented by many common desktop operating systems.)

    0x1 If the bit is set to 1, the packet has evil intent. Secure systems SHOULD try to defend themselves against such packets. Insecure systems MAY chose to crash, be penetrated, etc.

    3. Setting the Evil Bit

    There are a number of ways in which the evil bit may be set. Attack applications may use a suitable API to request that it be set. Systems that do not have other mechanisms MUST provide such an API; attack programs MUST use it.

    Multi-level insecure operating systems may have special levels for attack programs; the evil bit MUST be set by default on packets emanating from programs running at such levels. However, the system MAY provide an API to allow it to be cleared for non-malicious activity by users who normally engage in attack behavior.

    Fragments that by themselves are dangerous MUST have the evil bit set. If a packet with the evil bit set is fragmented by an intermediate router and the fragments themselves are not dangerous, the evil bit MUST be cleared in the fragments, and MUST be turned back on in the reassembled packet.

    Intermediate systems are sometimes used to launder attack connections. Packets to such systems that are intended to be relayed to a target SHOULD have the evil bit set.

    Some applications hand-craft their own packets. If these packets are part of an attack, the application MUST set the evil bit by itself.

    In networks protected by firewalls, it is axiomatic that all attackers are on the outside of the firewall. Therefore, hosts inside the firewall MUST NOT set the evil bit on any packets.

    Because NAT RFC3022 boxes modify packets, they SHOULD set the evil bit on such packets. "Transparent" http and email proxies SHOULD set the evil bit on their reply packets to the innocent client host.

    Some hosts scan other hosts in a fashion that can alert intrusion detection systems. If the scanning is part of a be

  104. More April RFC's by niminimi · · Score: 1

    748, 1097, 1149, 1313, 1437, 2549.
    This isn't exhaustive, the coffee-brewing protocol is missing &c.
    I like 2549 with the ascii-art pigeon.

  105. Re:4/1/03 by 1u3hr · · Score: 1

    I see "Posted by jamie on Tuesday April 01, @11:25AM". The times you see on the Slashdot pages are in your local time zone, as set on your preference page. (Don't remember what zone you see if you are an AC).

  106. Re:first? by khakipuce · · Score: 1
    It's been and gone over here?

    Damn this globalisation

    --
    Art is the mathematics of emotion
  107. HAHAHAHAHHAHAHA!!!!!!! by Chymaera · · Score: 1

    That was one of the rare things I run across on the internet that literally have me rolling on the floor laughing...Everyone in the library was staring at me. :) Ack...The librarian's coming in this direction...but it's the EVIL BIT! THE EVIL BIT!

  108. Re:before the link gets slashdotted.. by Kredal · · Score: 1

    K, that was funnier than the original story. Thanks for the laugh. (:

    --
    Whoever stated that signature sizes should be limited to one hundred and twenty characters can just go ahead and kiss my
  109. what about the "security" bit? by eirikma · · Score: 2, Interesting

    There used to be a "security" bit you could use to mark you packets as especially interesting (the do-not-route-thru-Iraq-bit) [rfc 791]. Is that feature obsoleted by this evil?

  110. An interesting legal question by supersat · · Score: 1

    If people don't protect their systems by checking this bit, and malicious packets ARE sent with this bit set, does this mean that they are partially responsible for any damage caused by the malicious packet? Are software vendors responsible for handling these packets properly? I can see the headlines now. Longhorn machine compromised by "evil" packets, Microsoft sued. From what I understand, even if MS is found 1% responsible and the attacker 99% responsible, MS would have to pay the majority of a large judgement since MS would almost certainly have more money than the attacker.

  111. Re:4/1/03 by yakovlev · · Score: 1

    Actually, conceptually this could be used as a good thing. An "evil bit" that meant "drop this packet" could be used as a safety on network security testing. If I want to simulate an attack on machine A, I tell machine A to ignore the "evil bit" while machine B will continue to honor it. I don't have to worry about machine B doing anything based on my test packets, since it will drop them on the floor based on the "evil bit."

    It could also be used to test firewalls for any possible damage done by malicious packets hitting the firewall and being dropped, in this case due to the "evil bit."

  112. The router could use Write Only Memory (Signetics) by SKarg · · Score: 1

    The router that implements this evil bit could send the packets to Write-Only-Memory.

    "In 1972 Signetics recognized April Fools day by printing a full color datasheet for a Write-Only Memory. This is a chip which accepts data but never reads it back. Suggested uses include a data logger for bombs. Graphs show "number of pins left versus number of insertions" and other useful data. A couple of pins are dedicated to 6.3 volt AC input... for the filaments, of course! A scanned version is here (page 1) and here (page 2) (these are 150k .JPGs)."

  113. Posted to early by ArchAngelQ · · Score: 1

    It wasn't april 1st yet when you posted this. C'mon, if you are going to go with slashdot tradition, at least be a bit clueful. And yeah, I know it's not entirely the poster's fault, the RFC was released to soon too, but it just shows that, as usual, most /. posters can't spot a real april fools day joke if it ran up and smacked them right in the head.

    Oh yeah, and, by by karma. Whatever.

  114. Why not to buy my books, by Dr. Seuss by yerricde · · Score: 1

    I boycott Dr. Seuss Enterprises because it submitted an amicus brief supporting the Bono Act. A K5 user once pretended to channel Dr. Seuss:

    graal:
    "Some are glad,
    Some are sad,
    And some are very, very bad.
    Why are they sad, and glad and bad?"

    pin0cchio:
    "I'll tell you why they are so sad:
    The Congress passed a law that's bad.
    The public domain has been sacked
    by what they called the 'Bono Act'.
    And this made Eric Eldred shout:
    'Let's get the courts to throw it out!'
    But in their ruling, the Supremes
    Told Larry Lessig, 'In your dreams.'
    The public seemed to've lost the fight
    For limits on the copyright.
    But all is not lost, to be sure,
    And you can help put reason back:
    Just ask your rep and senator
    To pass The Eric Eldred Act."

    Nothing is offtopic on April Trolls Day!
    --
    Will I retire or break 10K?
  115. This wont work... by jjeffrey · · Score: 1

    ....what about pen tests.... they may be doing evil but have no evil intent... we need a pseudo-evil bit too!

  116. Is this patentable? by ubeans · · Score: 1

    I bet we can this one trhough the U.S. patent office :)

  117. IP Evil bits jumping by ubeans · · Score: 1

    If the IP headers were jumping, couln't we set the Evil Knievel bit?

  118. Re:4/1/03 by abirdman · · Score: 1

    AMEN. If some lawmakers believe this, they will try to pass a law, guaranteed. It's what they do. It's all they do. If they didn't propose legislation about anything they perceived could rile up their constituents^h^h^hemployers, they'd be useless to society. Oh wait...

    --
    Everything I've ever learned the hard way was based on a statistically invalid sample.
  119. Am I the only one who sees uselessness of this by vijayant+dhankhar · · Score: 1

    This is wierd. So now the hacker will set his evil bit to 1 because he is evil? and who will make sure he dont send it as 0. The only use I see of this is to distinguish to a server in a autonomous system that the packet originated internally or its an external packet. So the server can make distinction based on the bit to its behaviour. Is that what this bit is intended for??