Slashdot Mirror


User: arivanov

arivanov's activity in the archive.

Stories
0
Comments
3,701
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 3,701

  1. Re:The Security Concerns on Sendmail Removed From NetBSD · · Score: 2, Insightful
    If you can run ps2pdf you can produce a PDF document of the extensive manual...

    The manual is good, but some of the insanities in it will be hard to understand without reading the Hanging Bat at least once.

    I have used the manual for many years before finally surrendering and buying the most recent Bat last year. Reading it definitely made a difference. After that quite a few of the seemingly absurd featurettes started making sense, because you can see why are they there in first place.

    Overall, thanks for the correction. I still stand by my words. Sendmail is for the kbd+book sysadmin subspecies. You should always have the latest Bat and the manual for the release you use on the edge of your desk.

  2. Re:The Security Concerns on Sendmail Removed From NetBSD · · Score: 3, Insightful
    Complex mail handling requirements such as

    An example off the top of my head and by the way a real one:

    • Rewrite all outgoing and interdepartamental traffic in a company with 100000+ employees so that their externally visible names comply strictly to the officially announced email addresses (John.Doe@bigcorp.com) and the uids (jd21768) are invisible. Do the same on incoming mail while taking final routing and any other information out of a directory.

    While it is possible to handle this in exim or postfix it will be quite painfull at this scale. In cases like this sendmail still remains ahead of the game for cases like this due to the better LDAP support and the inherently more flexible rewrite support.

    If you look in the Hanging Bat you will see quite a few more examples like this which everyone but a large corp admin will consider to be extremely obscure corner cases. In a large company you are likely to be asked for at least one of them quite often and this is what sendmail has been targeting for a long time. They have surrendered the ISP, SMB and small EDU market very long ago as it does not bring them enough support revenue.

    Recently exim is starting to step on sendmail's toes with the built in perl interpreter, built in SQL and filters it is still not there. Dunno about postfix, but I doubt it. Anything else aside some of the uses of sendmail rewrite rules out there are outright mad. Nobody in their sane mind should do things like this.

  3. Re:The Security Concerns on Sendmail Removed From NetBSD · · Score: 4, Insightful
    Honestly, I've never heard of anyone being hacked through sendmail either.. but that doesn't mean it didn't happen.

    I had. Several times back in 1996. Made me switch to qmail and after that to exim.

    As far as sendmail is concerned it is a good MTA provided that:

    • You have the money to pay for every edition of the "Hanging Bat" as it comes out. No point to even try doing anything moderately complex without it. Similarly you have to be a kbd+book person. Not all admins are.
    • You work for a large corp or edu which has fairly complex mail handling requirements. Less complex cases can happily get around using Exim or Postfix.
    • You intend to buy commercial software for some functions. The choice for commercial interfacing of archiving, compliance, AV, AntiSPAM on Unix is between milter and milter. Very few products interface into something else like exim filters.
  4. Re:DRM is meaningless on FSF, Political Activism or Crossing the Line? · · Score: 1
    If I am capable of writing and using general software ... - Good for you. Joe Sixpack isn't.

    It is simply impossible to enable general Fair Use without also enabling people to just remove the DRM. It is. Think of DRM as an authentication & authorisation scheme for data. That is what it is, nothing more, nothing less. And here is the problem with the current DRM crop. It does not comply with good A&A requirements.

    More specifically:

    • The entities in the transaction are not uniquely identified and mapped to the actual entities who engage in the transaction.
    • The transaction can be repudiated by the actual entity which is authorising it - the human who is buying the content.

    Both of these are an absolute anathema as far as designing any A&A scheme is concerned.

    The problem here is actually deeper. The current DRM crop is being pushed by pigopolists. They are afraid of identifying the end user and they are even more afraid of making the transaction non-repudiable.

    More specifically an A&A scheme is as strong as the overall chain. In this case it is as stong as the authenticity of the user on its end.

    If the pigopolists actually wanted to have a fully blown working DRM they would have to bite the bullet and make it tied up to a proper identity. This means responsibility which they simply do not want to accept. As one of my CS profs in a country which is not hell bent on PC used to say "You cannot have your dick in both hands and your soul in paradise. Either, or".

    Realistically, this is temporary. The pigopolists influence on DRM is coming to its end. It will be businesses and governments dictating what goes DRM-wise in 5 years from now. These want to tie things down to a proper identity do we like it or not. And this is likely to turn the entire scene upside down including the point where the pigopolists will go back to unencumbered formats to the avoid responsibilities of dealing with the actual end-user.

    By the way, just coming back to your example about development - personaly I will not use the certificate which authenticates my mortgage for development. This is just an example of course.

  5. Re:DRM is meaningless on FSF, Political Activism or Crossing the Line? · · Score: 1
    Step by step answers:

    I have the right to buy media and give them to another person as a gift, even if I have already watched it. - If you know the person's public part of the certificate you can buy it for them. If you would like to watch it you will have to shell out for yourself and for them. Tough, but that is the way the system is supposed to work in the first place.

    I have the right to buy dozens of mp3 players and resell them.. - True. But if they are empty. You are not entitled to resell the songs as per current law in most countries. As far as implementation - if the players have an RSA engine and can handle a PKI chain they can have your private key securely loaded. Any new owner will have to zap it to upload their content and will immediately lose access to all files on the device. Same is the case if the device happens to be your computer and these are your documents. As a matter of fact I would actually use a "subordinate" certificate signed by my main one, not my main one for crap like music. Just in case one of the devices has a security hole so I do not get my main cert stolen. In either case if the files get out and I have not declared the cert stolen and revoked it will be clear that it was me who has shared them out.

    What happens if I instead share the certificate with a large group of friends by handing them mp3 players which I bought (with their money)? - Two different concepts. Share the MP3 players - see above. Share the certificate - well you have just entitled these friends to empty your credit card, remortgage your house, sell your car and sign a message to your boss saying that he is a fuckhead. Wanna do it? Doubt it.

    What happens if a relative dies who has a large music collection, worth $100k? (Yes that's very hypothetical, but still...). - his certificate is revoked. From there on depends if the rights he bought are transferrable or not. If he bought transferrable rights there should be a mechanism for them to be transferred. If not - you can try asking him why did he buy them without the provision for someone to inherit it. He may have some trouble answering though.

    There is a caveat of course - rolling out PKI on such scale brings about the serious problem of how to manage certificate revocation on the scale of billions of certificates. So anyone rolling something like this out will have to solve it. It is difficult, but not impossible. In fact if all the efforts going into ponzi BS Sony-root-kit like scheme went into this it would have been here by now.

  6. Re:DRM is meaningless on FSF, Political Activism or Crossing the Line? · · Score: 1
    As far as consumer DRM I agree with you that it will never work in any of its current or near future forms because it is designed by cretinous incompetent idiots with a very remote grasp of cryptography and identity management. Best case scenario, they are trying to sell to a person while identifying the item sold with a device or software component and issuing the cert to the device or software component. Usually it is even worse - some form of security through obscurity or a combination of device/software certs with obscurity.

    You are wrong in the more general case.

    It will work from the moment when a consumer will be uniquely identified by a digital certificate(s) thoughout their life and the businesses selling data (including content) get their head out of their arse and start selling to the consumer as identified by this certificate(s). This solves all bloody fair use concerns because as long as I am using it or I have authorised it, I can use it. It is encrypted to my certificate. Case closed. Device and software component certificates should be used only as a method to secure device storage, not as an enforcement method.

    More importantly, it more and more looks like Vista, the next MS Office as well as some of its supporting infrastructure will offer these features to business. This means that in a correctly set up network there will be no more of these "who stole my laptop" or "who read my files" leaks because all documents will flow encrypted to some certificate and a central authority will dish out permissions on who can read and write to what. I definitely trust MSFT to cock up this one at ship date. Still, at least some companies out there will utilise the infrastructure to get this one right. Frankly, for all it is worth DRM is nothing but an authentication + authorisation applied to data. There is nothing inherently bad in the concept. It is the way it is used which is the problem, not the DRM itself.

  7. Re:Question on How Do Businesses Scale Their Bandwidth Needs? · · Score: 1
    That is the way I understood the question.

    And the answer is a series of questions in itself:

    • Do you use hosting for customer facing services? If not you are looking towards being multihomed to more than one provider and having the minimum bandwidth at which they agree to do that (usually T1 or E1).
    • Do you monitor your capacity utilisation? What is it showing at the moment. If not how can you judge if it is being utilised well? Similarly, if how do you know that your backup link provisions have sufficient capacity?
    • Do you use QoS and do you classify traffic and allocate different bandwidth allocations to different types of traffic? If you do you can usually get away with an E1/T1 up to 200 employees. If you do not you end up having to use several times more. Once again, if you monitor it you can have an excellent idea which types of traffic have a suppressed demand and which not.
    • Do you use proxies and force their use? Once again, do you monitor them?
    • Do you allow P2P and if so do you QoS it down? If you do not you should refraze the question as "How much would I like to sponsor resource thieves around the world on my company bill?".

    So on so fourth. Every company is different and there is no silver bullet solution.Even so, putting CBQ or HTB on the link is always a good start. Everything else aside it can give you a good idea what types of traffic have a suppressed demand and what types of traffic have reached a steady state. Once this information is available you can decide if more bandwidth is actually necessary.

    Alternatively you can use the dumbfuckistani penis extension approach known as "More Fiber is the solution to all humanity problems". Telcos will love you.

  8. Re:Big help on EU Court Blocks Passenger Data Deal with U.S. · · Score: 1
    Except the UK is the only place in the world trying to build one.

    Bollocks.

    First of all, every Shengen Country has one. This is part of the Shengen treaty requirements and they are interconnected as well. At the same time the level of surveilance in all of them is a fraction of the British one.

    In addition to that a number of countries which had a very troublesome history of illegal immigration to the original Shengen have had to get one or upgrade theirs to be allowed free access. Bulgaria, Romania, Poland, etc all had to either upgrade their existing mainframe based systems or to get new ones that comply with the Shengen requirements. Once again, the surveilance level in them is laughable.

    For example Bulgaria had a mainframe based system where taxes, social security, fines, even speeding tickets and minor misdemeanor fines were all linked to the national ID register since at least the 80-es. As a part of the conditions to allow Bulgarians free travel to Shengen it was upgraded and had the driver license database linked into it as well. The database also includes any foreigners who have travelled through the country since at least the late 90-es and is fed by electronic passport readers at all border entry points. As a result you can get a passport reissued in 3 hours in Sofia and one day anywhere else in the country provided that you pay the "fast service" fee. Same for driver license. Same for the ID card.

    Let's face it. As far as keeping their cittisen records in order UK is the laughing stock of Europe. Even the ex-warsaw pact backwater that has not even become part of the EU is 20+ years ahead of it.

  9. Re:Han shot first! on 'Final Edition' of Blade Runner to be Released · · Score: 3, Funny

    No.

    I do not see the ironic correlation.

    Oh an by the way. Dr. Jones shoots first. So does Prof. Ryan. So does President Marshall. So does...

    Always shoot first, ask questions later. The right way of doing things.

    Unfortunately no way to shoot the bastards who after that edit history to make it look like you shot second.

    Cheers,

  10. Re:Han shot first! on 'Final Edition' of Blade Runner to be Released · · Score: 1
    Wrong movie mate.

    Just in case, here you can check up if you show any of the indicators that WB will be successful to get some more money extorted from you for nothing.

    Oh, and Deckard shoots first.

  11. Re:Big help on EU Court Blocks Passenger Data Deal with U.S. · · Score: 2, Interesting

    UK is the wrong example. By far.

    UK does not have a centralised database of its cittisen information and there is a patchwork of agency databases which often conflict even within a single agency. As a result in order to compensate for this the UK govt and especially the Tony Bliar one constantly engages in all kinds of 1984-like schemes which end up being miserable failures.

    The rest of EU has long gotten over it. There the govt keeps less data on its cittisens, but it is usually of considerably higher quality and centralised. Similarly, there are plenty of safeguards on using the data. As a result it needs to watch them considerably less and the data protection safeguards actually work because you can easily get what govt has on you. In the UK you cannot. Evey agency has its own feudal database.

    As a further example, for the UK govt it is OK to declare that 0.03% of the population are criminals just because the database is complete shambles and it does not even bother to apologise for the fact.

    So on, so fourth.

    UK is the wrong example. For all practical purposes it is not Europe as far as data protection and privacy is concerned. It is Timbuktu.

  12. They already hold copyright on the word Tiananmen on China Passes Internet Copyright Legislation · · Score: 4, Insightful

    Let me guess what this will be used for.

    Copyright on the AIDS prevalence reports in the China rural population after the massive infections produced by various "buy your blood for money" scam artists of the late 90-es.

    Copyright on the documentation about the Three Gorges dam and its environmental assessment

    Copyright on the studies about the history of Tibet

    Copyright on the ...

  13. Re:What a couple of nerds... on Freshman MIT Students Automate Dorm Room · · Score: 1
    Seconded.

    In fact if you are a good engineer no need to be rich. Even Russian nerds apparently have had that for 25 years now

    For the American (and other) audience this is a rather lame attempt by the Russians to make a "Towering Inferno" like disaster movie. It has a hilarious sequence with a similar automation system build by the flight engineer. In fact it is considerably more advanced then the MIT student project.

    Namely, it does not have a red button. It has a pressure sensor in the most appropriate place instead. Under the bed. It activates itself at the appropriate time to supply appropriate atmosphere for the "logical continuation of the party".

    Actually, it is a must see for the aforementioned students. The movie has an even more hilarious sequence which depicts exactly what happens when a system like this ends up on the receiving end taking the anger of a seriously pissed off young lady.

  14. Re:They don't like real crypto. on China Files Case Against Intel's Wireless Network · · Score: 1

    The article is actually a piece of propaganda in its own right. While I am also allergic to Chinese standards efforts the article definitely distorts some of the facts. So let's put them right for a start.

    • Their standard proposal was not secret. It was an ISO submission for f*** sake. How that can be secret?
    • It is not any more proprietary than the current standard. The only difference is that in the current standard you have to shell out royalties to Intel and a few others while in their standard you have to shell royalties to them.

    As far as the technical merits of the proposals, the Chinese one was of comparable security, probably more lightweight implementation though much more quirks on the edges. Disclaimer:I am not WLAN chipset engineer and I do not have either standard proposal in front of me so this is IIRC when following the discussion.. IIRC it is an apples vs oranges similar to TD-CDMA vs FD-CDMA. Both have their merits, and while the Chinese proposal in both cases was more quirky it was not technically inferior. In the CDMA case both ended up in the standard.

    What the article omits is the politics behind this:

    • The current standard procedure in the computer world (not the Internet, just the hardware bit) is rigged towards American representation. While the IEEE is supposedly a National Standards body it ends up being "the" global standards body. How many Ethernet standards have gone further than IEEE to become an ISO? How many wireless? How many... ad naseum.
    • The Chinese submitted their proposal to ISO for the primary reason to force a reconsideration of the "globality" of the IEEE. They lost. Regardless of any strings pulled by Americans behind the scenes (and I bet there were a few), the ISO did not pick up a losing fight when it saw one.

    While I strongly dislike the actual background behind this case I wish the Chinese good luck on this one. Realistically it will not help them anyway. Still, anything that tries to put the things right as far as what is a national standard and what is a global standard is a good thing.

  15. Re:Of course on Oracle Exec Strikes Out At 'Patch' Mentality · · Score: 5, Informative

    No.

    Not at all in fact.

    Open Source has nothing to do with this and I would suggest that you actually do some research instead of parroting the usual "Open Source will fix all problems" mantra.

    Oracle has recently been shown to have up to 5 years turnaround to patch glaring security holes. This has reached the point where security researchers like Litchfield who have had an ongoing relationshop with Oracle for 10+ years do not want to work with any longer. Note, we are not talking sc1pt k1dd10tz sitting in their dad's basement here. The people in question consult banks, governments, large corps and cannot actually recommend them a working security policy because Oracle cannot get its head out of its arse and patch a security problem for multiple years after it has been reported to them.

    As a result people who used to work on Oracle problems and reported them in private to Oracle have started posting them openly "0 day" style or giving Oracle a 1 month fixed notice of an impending posting regardless of does it have a patch or not.

    Obviously Oracle is pissed.

    First of all it breaks all of their marketing bollocks about unbreakability and security to bits.

    Second it is threatening their sales to customers in regulated markets where security issues must be addresses within a fixed term after being known.

    This is the reason for them to rattle the "regulation" sabers and moan about a "patch culture". Open Source has nothing to do about it.

  16. Re:Hope they stop insanity on Amnesty International vs. Internet Censorship · · Score: 1
    First, only to find that your entire street of 20 houses (on similar contract) only has a 6KW powerline supplying it, so if you and your neighbours both try to run a 4KW airconditioner your screwed

    That is indeed the case. Been there, seen that. California saw it several times over the last 5 years. Italy saw it last year. Bulgaria saw it in 1984-1987. I Can go on with about 20-30 more examples. So, would you mind to get real and snap out of the dream please?.

    The electricity, water, telephone companies use contention as well.. It is not 50:1 like a residential ISP, but it is contended none the less. Different in each area.

  17. Re:Google? on Identifying and Avoiding Dishonest Hosting Providers? · · Score: 1

    Read my post carefully.

    I will post, and I post if I have bad experience with any internet provider (hosting or other). I simply do not use expletives. The moment you get into the realm of "sucks", "idiots", "fucked up", etc you can get whacked for slander and have libel tucked along with it in most countries.

    On top of that in many countries (UK for example) the victim can get your website shutdown instantaneously with a simple letter. The reason is that UK (and other countries) libel and slander laws actually hold the ISP responsible for any content you post. As a result they will shut you down at the first sign of legal conflict so that they do not have to pay a legal bill.

    Similarly, if you post on a forum you do not host the forum operator will kill your posts without even considering the possibility of desisting the request.

    So on so fourth.

  18. Re:Hope they stop insanity on Amnesty International vs. Internet Censorship · · Score: 1


    Well...

    I would actually like to be able to read the headers of emails I get. So will quite a few other people. Helps weed out at least some minor fraudsters out there.

    Similarly, I do not see anything wrong with paying for bandwidth, services, etc on a per item or per Kb basis.

    After all, let's get real. Internet is now a utility. We are reaching the point where governments are contemplating to make broadband access an essential service which is a right and Telcos are supposed to guarantee that 100% of the population is covered. Essentially it is on its way to become an essential service like phone or electricity.

    A connection to any other utility carries with it responsibilities. If the water pipe between the street and your house bursts you have to pay for the repairs and any damage to other properties. If you have a broken appliance which uses electricity without your knowledge, you pay per KW/h used. If you use a phone you pay for any premium services you have used. So on, so fourth.

    Frankly I do not see why Internet is supposed to be any different. I personally do not mind paying for my connection on a per Kb basis. Neither will 99% of the consumers if they are provided with clear, well defined and understandable billing criteria and billing information.

  19. Re:How about SPAM? on EU Considers Taxing SMS Messages, Email · · Score: 1

    The law does not work like this I am afraid. Not knowing is not a viable excuse. It may be a mitigating circumstance, but that is about it. And reading UK water T&C (most countries are not vastly different) you are liable for ANY damage caused by a leak within your premises. With no upper limit and nothing regarding knowing or not knowing in the T&Cs.

  20. Re:How about SPAM? on EU Considers Taxing SMS Messages, Email · · Score: 1

    If average Joe did not bother maintaining his Antivirus he must pay.

    After all the Internet has become a utility like water or electricity.

    If a water pipe leaks between the street and your premises you have to foot the bill for the leaked water and for any repairs. Same with electricity, gas, etc. So anyone advocating that Joe Average should have an access to the Internet as a minimal standard of living utility, should in also advocate that any expenses on it are treated accordingly.

    If Joe Average had a working AV/Firewall he should be entitled to have the Antivirus and/or AntiSpyware provider to reimburse any costs. Alternatively have insurance as a part of his Internet package the same way we pay insurance for broken pipes, insurance on your boiler, etc.

    This will solve zombies right away. I am all for it along with bandwidth based charging.

  21. Re:Yay! on House Committee Approves 'Net Neutrality' Bill · · Score: 4, Insightful
    The Internet doesn't need to be run on a Mafia-style extortion plan.

    Afraid to tell you. It is being run on a Mafia-style extortion plan in the US for a long time. Ask any network engineer about "peering with a Tier 1 provider".

  22. Re:Photo Op? on Refund of Long-Distance Telephone Taxes · · Score: 4, Interesting

    Neah... Forget it...

    After all his clone on this side of the pond did not bother getting on board of the HMS Illustrious to declare the end of the Great War with Germany finally over on the 24th November 2005.

    For the humour and history defficient out there:

    1. Britain introduced drinking establishment licensing laws to improve the quality of ammunition shipped to the German front in WWI and minimise the number of workers showing up to work incapacitated. Hurray for the war effort against the great enemy, hurray, hurray
    2. These laws stayed in force till 24th November 2005
    3. When the changes of the laws were discussed and introduced every single idiot neocon in the country was prophessing that the world will end on 24th November 2005 or soon thereafter. It is still there and still as boring as it was.

    And do not even get me started on income tax and napoleonic wars...

  23. Re:Google? on Identifying and Avoiding Dishonest Hosting Providers? · · Score: 2, Interesting

    That used to be the case.

    The world has gotten to be too litiguous for this. 5 years ago people would not have had any doubts before posting that a company sucks.

    Nowdays people will think 10 times before doing that. For example, if I have some shitty experience with a company I usually post the exact description of a problem I run into with all relevant details including a mail trail where applicable. No emotions. No expletives. I have noticed that I am not the only one doing this lately. Noone wants to get sued after all.

    If you search for "Company Name" + sucks you are likely to limit your set of results to posts by kids who do not think about having to deal with the fallout from their actions. In many cases they do not know what to do, how to do it, have not bothered to read the product description and do not know what they have bought.

    I usually use "Company Name" + problem for searches like this. It gives better results lately.

  24. Re:Freedom where art thou? on First Photos of MIT $100 Laptop · · Score: 1

    Err...

    Now find a teacher who will agree to teach directly on that material. Or students capable of assimilating that material especially in unabridged ole English. Same for the entire curriculum 1st to last year of school and all subjects please.

    On a more realistic note.

    Education requires curriculum. For the moment there is no free curriculum in English or any other language which a teacher can make use of on these laptops. There is no curriculum planned either.

    In addition to that it must be free as in speach, not in beer because different countries have to modify it to suit their needs including possible translation into local language. Anybody donating to that in the context of the 100$ laptop program?

    Even once the curicullum has been compiled, teachers need to be trained, educated and kept up to date with changes to it. That is what I mean by "properly educated teacher". They do not grow on trees. They cost money. Anybody donating to that in the context of the 100$ laptop program?

    Whatever we do, the laptop will not replace at least some of the didactic material necessary to teach. Once again anybody donating to that in the context of the 100$ laptop program?

    So frankly, for the time being it is one big technologist bullshit utopia which will achieve a fraction of what can be achieved for the same amount of money.

    I am happy that my original post made some people put actual pointers to other charities. Many of them are a better use for the money. Disclaimer: personally, I give directly to one or two places I know need it. No talebanoevangelical or other good-willing utopia BS middlemen involved.

  25. Re:Freedom where art thou? on First Photos of MIT $100 Laptop · · Score: 1
    Imagine, though, a $100 laptop that can download all the content of as many schoolbooks as they want.

    Really?

    Have you asked the authors and the publishers about this? They will immediately disagree with you (or their shareholders will).

    There is no point in donating to this program without donating to a program for putting a full curriculum worth of textbook material into the public domain first.