Slashdot Mirror
An Open Source Security Triple Play
Marcus Maciel writes to tell that Linux.com's Joe Barr recently took a look at OSSEC-HIDS, an open source host intrusion detection system. From the article: "According the OOSEC-HIDS Web site, it's more than a host intrusion detection system (IDS). It's also a security event manager and a security information manager, which makes it the security equivalent of a hat trick in hockey, a triple-play in baseball, or a rare triple-double in basketball. OSSEC-HIDS runs on both Windows and Linux/Unix. You can download the latest version along with the project's PGP public key, so you can verify the download." Linux.com and Slashdot are both owned by OSTG.
I'm so embarassed. I truly thought this was about physical building security with cameras and PIRs and shit.
To whom to I report to hand back my geek membership card?
Argh.
Exactly. What makes them think we'll understand any of that? We're nerds. Basketball? Hmm. How about pong?
Xserv
"I love lamp."
I just learned what that means! Yay Google.
While OSSEC HIDS looks like the beginnings of a good solution (aside from the name - sheesh - sounds like a sneeze) I'd like to see integration of projects like DShield.org and maybe some community-maintained updates for rootkit definitions and such. APF/BFD does this - why not OSSEC HIDS?
Gesundheit.
"It makes it the equivalent of massive hyperbole amongst rational discussion!"
Here is a list of what OSSEC can do if you are too lazy to RTFA:
- Log Analysis, with a powerful xml-based rules system
- File integrity checker
- Rootkit detection
- Active response (automatically ban hosts on critical alerts)
- Mail reporting
- Server/clients or local installation
It's GPL and runs on many *nix OS. I've tried OSSEC for a few months to monitor a few servers and I must say I'm pretty impressed with it. Its log analysis system is powerful and easy to understand. I've met a few false positives, but you can easily define your own rules to ignore some events. The project is a bit young, but development is very active. Definitely worth trying if you are interested in Unix security.
Ok so it's a security tool with 3 different "modules". Fantastic, probably a first in the software industry.
It's true that it's like a hat trick, triple-double, and that other thing, but if you don't know what any of those things are, it's also like a hole-in-three in golf, or three goals in three non-consecutive games of soccer, or to go in a non-sporting direction, three pieces of ham on a ham sandwich. But I guess the simplest way to explain it is that it does three seperate things. Three! I know it's a bit complicated, so I can explain further using many, many more analogies if need be. Just let me know.
Or Mortal Kombat. "FATALITY!"
The metaphores used in the summary indicate three *the same* things while the product in question does three *different* things.
I suspect the black hats use the same metaphors to describe success, including goooooooooooooooooal!
... How many things does it do again?
Is it anything like the ultra-rare "menage a quatre" of sexual intercourse?
A republic cannot succeed till it contains a certain body of men imbued with the principles of justice and honour.
Most people can not and will not understand anything at all unless it can be related to their everyday expieriences. And since most people spend more time consumed in sports than a korean Starcraft player spends in a games cafe, it's a safe bet that sports analogies will help carry the point across to those who would otherwise ignore it.
May the Maths Be with you!
...as in checkers?
--
Vote with all your heart, but get a healthy dosage of mass-media first. Or just don't vote at all!
You can't be ahead of the curve, if you're stuck in a loop.
Not to get anal, but a triple play is MUCH more rare than either a triple-double or a hat trick.
MLB: 30 teams x 162 games = 4860 games (possibly 2 triple plays per season or 1 every 2430 games)
NBA: 30 teams x 82 games = 2460 games (23 triple-doubles last season or 1 ever 106.95652173913043478260869565217 games)
NHL: 30 teams x 82 games = 2460 games (84 hat tricks last season or 1 every 29.285714285714285714285714285714 games)
Vocal minorities are often confused with silent majorities.
Except this is Slashdot, not ESPN. For clarity analogies should probably be restricted to politics, code, IT infrastructure and cars (failed).
Plus, of course, the analogy in the summary was so long by the time it finished I'd almost forgotten what the summary was about...
Everything in moderation, including moderation itself
It's actually quite useful, and not only from a security/intrusion standpoint; it reads the system logs and reports on errors. And the best thing about it is, it's self-learning! It will count the number of times a certain (low-level, as in "cannot find file" type) system error is encountered, and then, if it appears often enough on a regular basis it learns to ignore it. Very neat.
I just love this stuff!!! This is to me, what a good Duff is to Homer Simpson!!!
----- I have bad karma for a reason! -----
Why couldn't they have just SAID that instead of this ridiculous sporting analogy which sounds like rapid-fire buzzwords from a marketdroid? I couldn't resist tagging the article 'badsportinganalogy'.
Oolite: Elite-like game. For Mac, Linux and Windows
GEEK!!!...Oh, wait, Like you didn't know that :o)
----- I have bad karma for a reason! -----
Yeah, way geeky. Never could understand the disconnect between the average geek and sports statistics.
Vocal minorities are often confused with silent majorities.
You are not a true geek (and far from being anal ;-). Number of games is not teams x games_a_team_plays_in_a_season. You cannot count the games twice.
MLB: 162!/132!
NBA: 82!/52!
NHL: 82!/52!
Actually, since 2 teams are required for each game, there are only 1/2 as many games. So every thing you calculated is really 1/2 as likely as that. Also I am not a baseball fan, but I'm guessing there is little more than conjecture behind '2 triple plays per season'.
Nitpick: you seem to have counted each game twice. That does not change your point, though.
Totally wrong. There are no factorials
MLB: 162 x 30 / 2 (regular season)
~26 (league championships)
4 (World series when Red Sox win)
or 7 (normal World Series)
there is a proper virus that works on Mac-Intel, Windows, and Linux?
I prefer the "u" in honour as it seems to be missing these days.
This is like a car with three wheels! (?)
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
Of course we all remember that PGP verification only means that the download was signed off on by the person or persons in possession of the corresponding PGP private key, not that that person is necessarily competent or trustworthy.
PGP/GPG signing is great, and necessary, but not sufficient for trust.
- jon
Ganymede, a GPL'ed metadirectory for UNIX
just saying...
From Wikipedia:
A triple-double is a basketball term, defined as an individual performance in a game in which a player accumulates double-digit totals (i.e., 10 or more) in any three of these categories: points, rebounds, assists, steals, and blocked shots.
The most common way for a player to achieve a triple-double is with points, rebounds, and assists, though on occasion elite defensive players may record 10 or more steals or blocked shots in a game.
A triple-double is seen as an indication of an excellent all-around individual performance. In the American National Basketball Association, they are rare but not unheard-of, as the top players can accumulate around 10 (out of a possible 82) in a season. It should be noted that the criteria for an assist has been relaxed over time, making triple-doubles more common in today's game than it was prior to the 1980's
OSSEC is like a car that can take you places, make you a sandwich, and perform oral sex on you while driving. Better?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Great install script... but seems to not work if I try an installation location other than /var/ossec
The rule based "xml" for identifying problems in logfiles is great.
the active response doesn't work. I've tried everything EVERYTHING. and injecting all sorts of attacks didn't even cause the firewall script to block the ip.
I searched and tried, and fiddles, and cried. Nadda.
Each game counts as a game to each team. Each team plays 162 games in baseball, even if there are two teams per contest. You can only observe the opportunities to perform a triple play from the standpoint that you are playing defense half the time. You guys have confused your logic. Each game a team had the opportunity to defend for 27 outs. The other team has the exact same opportunity, except when the home team is winning after the top of the 9th inning is completed. Maybe this doesn't stand up the same with NBA or NHL teams due to variable lengths of possession, but it does in MLB. 30 teams x 162 *OPPORTUNITIES TO PERFORM A TRIPLE PLAY* (+/- 3 outs) = 4860 OPPORTUNITIES (2 in a season, or 1 every 2430). Suck on it.
Vocal minorities are often confused with silent majorities.