Slashdot Mirror


User: nosfucious

nosfucious's activity in the archive.

Stories
0
Comments
293
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 293

  1. Re:20 minutes? you mean, more like 20 seconds? on Survival Time for Unpatched Systems Cut by Half · · Score: 1

    It's so simple it probably doesn't even qualify as an exploit.

    If you have broadband:
    Install some samba client (or Client For Microsoft Networking on your WinPC), set the workgroup name to "Workgroup" and see how many people leave thier disks wide open to anyone. Don't need a rootkit, just mount thier drive! Extra points if you find that the administrator password is blank.

    Those few that actually have a password, probably haven't defined an account lockout or renamed the Administrator account (because they're logged in as Administrator). This allows virtually unlimited opportunities to dictionary/brute force thier Administrator account.

    Some ISP's filter these ports, some don't. Again, a firewall would help here too.

  2. Re:20 minutes? you mean, more like 20 seconds? on Survival Time for Unpatched Systems Cut by Half · · Score: 1

    Did you really net Microsoft Networking? Don't enable "File and Print Sharing" and don't enable "Client for Microsoft Networks". (Better yet, don't install it).

    Disable Messenger and Alerter service before being connected and there's a couple of viruses (and aggro from popups) stopped before they hit you.

    My ADLS router is NAT/port-forwarding/firewall enabled and I couldn't be happier. I can have one PC happily running P2P and the work laptop VPNs so I can fix work stuff ups remotely. A hardware device like this is dirt cheap and I can experiment to my hearts content with new and old boxes, vmware installs and no inbound connections are possible. With no inbound connections ... almost no chance of viruses/worms/bots/being owned. (Still be paraniod tho, assume that nothing is really secure)

    You didn't just get in a car and drive did you? No someone taught you at least some of the basics first. Even then, when you get in a car you still look around. Mirrors OK, seat belt OK, CD-Player OK, Brakes ... well there's a pedal where it should be ... OK. The same with an OS install. Default is NOT the way to go. If you need a server, secure it with only the services you need. Does your PC need to share a printer with the world? Didn't thinks so ... disable (don't install) damn MS networking services. Etc, ad inifintum, ameoba.

    Sheeesh.

  3. Re:Worst movie I've seen on What's the Worst Movie You've Ever Seen? · · Score: 1

    Pain and misery: The Core.

    Merely boring: Vanilla Sky.

    "The Core" nearly put me off my beer afterwards. Only movie I walked out on. Took the opportunity (when sober) to see it when killing time on a 13 hour flight. Still stank. Perhaps even worse the second time around. (yeah, I know, I must enjoy pain. I just couldn't belive that something could be so, so bad.)

    Vanilla Sky just put me to sleep.

  4. 3 applications? on More Details on Cut-Rate Windows OS For Asia · · Score: 1

    Is that with our without spyware?

  5. No magic bullet. on Thin Client Solutions For Libraries? · · Score: 1

    Thin client is no magic bullet, but it has been useful to me and my department. Unless there was a good reason, I wouldn't use it on a local LAN, but where speed of access was a factor (screen updates versus full file transfer via WAN/VPN).

    Example: One country connects to specific line of business applications hosted application at our Data Center. That application, whilst customised, still yanks a bucket load of data each query. Keeping the application local to the LAN yeilds 10^2 or 10^3 better performance. Also, the server is locked down to the wazoo and it runs all the time barring patches and deployments.

    We keep the server running, local IT keeps the clients running and programmers do thier best to break everything.

    Example2: A different line of business application is available around Europe, but this time hosted on a web server. Data entry clerks have access to two web sites and ONLY the web browser 1, the web mail portal and 2, the line of business application. 4th generation hand me down machines that run only the bare minimum to get the job done. (Technically zero client here, not thin client).

    My advice: Don't use Dell. IBMs are great for having working drivers and they update them regularly. XP has it useability flaws and licence issues, but is stable enough for daily use if you've the correct drivers, vetted the application software and disable the ability for users to install %FavouriteAppAndSpyware%. Remember to nail down NTFS even more than the default.

    Learn aboult policies under XP. One more source of stress, but many, many useful stress reducers too. Can really tighten the desktop and (re)deploy applications just by policy.

    If you really want to save $$$'s:
    - BSD/Linux with Samba server +
    - web-apps based on LAMP,
    - Star/Open Office on client,
    - Keep the point and drool interface for the client PC's (XP), if that's what your users want.

    The big licensing $$$ come from the server licence and CAL's and Office. And if you use Terminal Services, you now need a Terminal Services CAL for each device under 2003 ALSO.

  6. Re:Probably.. on Slate On Worms That Plug Security Holes · · Score: 1

    Mission critical servers shouldn't have open security holes like MS-Outlook installed. Bingo - no email worms. (OK, some brain dead applications like to have Outlook for the MAPI interface. Why cant they just use SMTP?) If Outlook has to be installed - DON'T READ YOUR EMAIL WITH IT.

    And you don't surf on a server. Use your workstation for that. There is a heap less viruses you have to worry about.

    You do still have to worry about buffer under/overruns, injections and the like. Turn unecessary services off and firewall the production sysetms off. Again a less to worry about.

    A configuration is a configuration. You fuck with my configuration and you'll get a punch in the face if I see. How can a "white" hat know what I've got and why I'm running it? A worm is a worm is a worm and is not welcome in my network.

  7. Re:Why IT is annoying on Are You Annoying? · · Score: 1

    Yeah, I agree. That sounds like incompetance. There should be a system for change. Networks and systems aren't static.

    If you're speaking to 10 people, either you don't know the system, they don't know the system (deliberate mis-informaiton perhaps), or there isn't a system.

    Ask someone, like a helpdesk, if there is an official channel to go through for getting something done. If there isn't speak to your boss, and get it moved upwards. It's affecting your ability to work (and the chance of your boss'es bonus).

    (Stuff the spell checker, where's the apostrophie checker when you need it!)

  8. Re:Badnarik 20004!!!!! on StorageTek Blocks 3rd Party Maintenance with DMCA · · Score: 1

    Actually, I think that preferential voting would be one good way, but also my solution would involve a very bad thing: More Politicians.

    Winner takes all election, especially in so called "houses of review" (the upper houses in Australian states), are a bad thing. Case in point: Victoria, Australia, where the Liberal Party held control for about 99% of 120 years. When the Liberals had a lower house majority, the Premier was more powerful than god. Labour mostly faced an uphill battle when in power.

    It would be much better if there was a way of sanely giving the US some proportional representation in thier senate. If the occasional independant (gangrenous green, loopy left and radical right) was selected, this would prevent a Dem/Rep gridlock from forming. It would mean that you might need 3 ~ 5 senators from each state, but with 50 states, that would be unworkable.

  9. Acronymns? on Mobile Cell Phone Towers For Disaster Relief · · Score: 1

    Shmacronmys.

    I'm half pissed after Portuagal beat Holland, and I can still remember IBM trying to call an air movement device an "Amd".

    Most of us called an AMD a "fan", however IBM though it meant "Air Movement Device".

    If course, DASD, (remember, I'm half pissed) is Direct Area Storage Device? Also called a disk?

    Just because it's an acronym, doesn't mean it is easier to say or remember.

    Now if I can just remember that my THC input device is also called a bong, i'll be very happy.

  10. So why don't ... on Court Says Customers May Take IPs Away From ISP · · Score: 1

    they and everyone else just refuse to recognise the movement of the IP addresses. This order will not affect anyone else in another country.

    Pretty useless to have an IP range if no one will route to it.* About the only result will be witless wonders walking away with various ranges, resulting in a (further) shortage of addresses.

    * Yes I know a NAT device could be used in conjunction with another IP address, however there are already three ranges assigned for use in a private intranets.

  11. Re:You'll never hear about the smart criminals. on A How-Not-To Guide to Cyber-Extortion · · Score: 1

    Well, I agree with you, 25 for a simple crime like that is stupid. Laws that impose unduly harsh penalties are never thought about in the opportunity type crimes.

    However, they're the rules of society. No one is focing you to live in that type of society.

    Unfortunetly, people with grey hair are scared of criminals. People with grey hair have lots of time on thier hands. They vote. Politicians will listen to voters. Not citizens, voters.

    In summary, if you don't like the laws: 2 options. Have the law changed OR move to a different society.

  12. Re:On in the US on Our Friend, The Meter · · Score: 1

    You're going to have to pay upfront, but the benefits will pay for themselves ... eventually.

    I don't think you'll see a great headline "cost saving", but it's the accumulated cost of not having to run a (mental or automated) conversion from miles to kilometers. This can be in staff time or your time.

    Car speedometers and other other measuring devices won't have to display a different number, even though they're showing the same amount (just according to a different standard). This has got to reduce product development cost which means a cheaper product (or more profits to the corporation).

    Multiply this out by a few million times and you'll see that it won't be too many years that adopting an internationally recognised standard will pay for iteself.

    Bite the bullet now, it'll only get more expensive as time goes on.

  13. Re:A soldier isn't a police officer... on Pentagon Seeks A Loophole In The Privacy Act · · Score: 1

    It must of been a shit life living under the various Communist regimes, however I'm not convinced that the US government is all that much better.

    Secret police, a volunteer network of informers, mystery abductions, hmmm. They all seem the standard tactice of the most oppressive regimes. Now the US has them too.

    Soldiers operatate at "maximum force". Eg, blow the fuckers out of existence. That's for war. Police should use "minumum force" and work both with and for the communities they serve.

    Be very, very scared if you live or come in to contact with the various "intelligence" and police areas of the US government.

  14. Re:UK spam laws on The Good and Bad of Data Collection · · Score: 1

    I've always wondered, if a credit reporting agency stuffed up, reported false information, any you suffered, could you sue them for defamation?

    I've having a similar situation where just because I insisted on my legal rights, my former real estage agent put me down as a bad tenannt. Whilst it is the truth, it certainly isn't in the "public interest".

    Truth is an absolute defence (in some jurisdications). What if they got it wrong? It think that may be actionable ...

  15. It's all obvious ... to a point on On Taking a Configuration Management Position? · · Score: 2, Interesting

    Random thoughts:

    Just one rule, get the highest person available to sign off on your rights and responsabilities. If no one higher that your direct boss will do it, forget it. (Minor variations: when you're part of a small team, but if you're big enough to nead CM, that's generally not a problem).

    As a guideline: Who, what, why, where, when. Answer those and you'll have a pretty good idea if you're being set up for a fall. As I said, get signed.

    CM is part of the so-called quality control. Who owns the quality process? Is is part of audit? Audit is a pretty powerful weapon to use. This mainly because it goes to third parties, like shareholders, stock market, tax authorities and the like. There's not a manager alive that wants thier name put down as the reason your company/department failed an audit.

    Alternatively, if configuration is part of your company's "product", then it can also be seen as part of reducing helpdesk and support costs. (Then get the best creative accountant in the company to help you book so called 'revenue' to your cost center).

    As part of my scope, I'm 'CM' workstations and server. This is both hardware and software. And I'm allowed to get this right before there is a roll out. My juniors have to follow the CM guidelines or they fix problems because of it on thier own time. Exceptions to the official spec have to be documented and approved (and does happen from time to time).

    Then sell your processes to the other project managers. Point out that actually following your guidelines will help them. For example: no fucking around installing new packages in addition to their own installation (because it's already done and already works), etc, etc. New software that works and is supported from day one, looks a lot more professional that one that has bugs, doesn't have the required support programs (Java version, DLL, Office Version, etc) and helpdesk training (you do have documents and training for your helpdesk?).

  16. Re:unbelievable.. on Worms Jack Up the Total Cost of Windows · · Score: 1

    And what Administrator isn't busy:
    1 Helping users, filling thier knowledge gaps or resolving hardware/software problems,
    2 Filling out bucket loads of paper work (Thank you Sarbannes-Oxley I really love how you've helped increase my workload),
    3 Ensuring all documentation is update (the actually useful documentation),
    4 Responding to management directives,
    5 Keeping up with useful security news (not Slashdot et al)
    6 Resolve other administrators fubars,
    7 Other administrivia (backups, logs, IT supplies, cable up for new workers, etc)

    Then comes the patch testing and installation. I don't know a real system admin that just sits around all day.

  17. You don't need to use windows update on Microsoft Security Updates for Pirated Windows? · · Score: 1

    You can find most of what you're looking for by going to the various bug advisories. Google is your friend if you're not sure of the location on MS. Sure, WindowsUpdate is a one stop shop and is convenient. There are at least two tools that will scan your machine and let you know what patches are required.

    One is by MS and another by Shavlik Technologies. Each downloads an XML file with the various bugs and the fixes.

    However, I have to test every patch before I deploy it, mainly so workstation don't go belly up. This place run on email and an AS/400 or 11. This means every platform. (NT Srv, NT Wks, 2000 pro and srv, XP, 2003). The only way I can do this is to have a damn CD filled with the raw patches and install by hand.

    Only then do they get approved for deployment.

    Also, having the CD (and a central download souce for myself), is good for giving a copy to users when they come a week after the latest virus/worm and tell me "my home PC doesn't work any more".

    I don't trust users to run WindowsUpdate and 99% are never going to have admin privlidges to thier work machine. It's already hard enough to keep control without users. (Cue Basil Fawlty-esqu: It's a great network, except for all those bloody users).

    If this all seams a bit jumbled, I haven't had my coffee quotient yet this morning and I'm still a little jumpy.

  18. Re:Worst software job ever on The Worst Development Job You've Ever Had? · · Score: 1

    Hah!

    Doing it on the cheap and nasty ensures YOU (The PHB) get the bonus and promotion. You'll never see that loser project again.

    If it works (i.e. compiles without error), then someother bozo will have to make it work. Then they get promoted.

    Once it works, then it will be yet somebody elses job to make it robust, secure and that other shit.

    Suffering delayed is somebody elses suffering.

  19. Re:That's 362-4360 on Portable Phone Numbers = Market for Cool Numbers · · Score: 1

    Actually that's 7 digits only in Sydney and Melbourne (at the time). Up until they big change-o, my parents house still had (locally) a 6 digit number. 55km from Melbourne.

    Being from Perth, it could have been six digits.

  20. I'm sure .... on 100 Year-Old Drug Halts Progress Of Alzheimer's · · Score: 1

    that Juan Antonio Samaranch was very pleased that Sidney was going to host the Olympic games but was very dissapointed when Sydney, New South Wales, Australia actually got them.

    On the other hand, Sydney did a nice job hosting the Olympic Games.

  21. Re:IBM won't dump windows anytime soon... on Where Will IBM Drop Windows? · · Score: 2, Insightful

    No. Not 10 directions at once. One direction --> directly towards the money.

    IBM support (off the top of my head) AIX, OS/400, Linux, Windows (various). Do they still support OS/2 (E-station) ? Any more? They once owned Lexmark, still have IBM badged printers. They badge PC's and make their own midrange and Mainframe computers.

    Want something IT? IBM will probably have an expert division waiting to help you get it done (at the right fee).

    I'll be very happy when I can get Operations Navigator running under linux. 5250 emulation is great. Some times a gui is also good.

    Having a name like IBM behind Linux is great. Yeah, not every detail is going to be nice, but the techs I've met at IBM, do really understand (technically and philosophically) Linux. (Anecdotal evidence score: a few)

  22. Re:moving jobs overseas on Tech Firms Defend Moving Jobs Overseas · · Score: 1

    Sort of.

    Lots of developed coutries with "Big Companies" are all facing the same problem.

    It's great for Company "XYZ" to move all posible jobs to the lowest bidder (offshore or wherever). But when EVERY company does this, well, that's a recession and good for NO company.

    Lets face it, there are only so many things you can do: grow it, build it, research it, manage it, run it, do it and think of it. Only the last means you'll be busy (i.e. run your own business), not necessarily earn a crust.

  23. Re:A quiet bus in a busy city... on Dutch Invention Uses Electric Engines For Wheels · · Score: 1

    Plenty of cities around the world use trams. Melbourne, Amsterdam, Geneva, Zurich to name just a handful. Most of these trams are nearly silent as they draw power from the overhead supply and just use the electric motor. Then there are other cities that use trolleybusses and these are almost as quiet.

    Pedestrians just adapt. Blind or otherwise seeing impaired pedestrians might have a slightly harder time, but I don't know one them that jaywalks.

    I don't think a "noise" argument is ever going to be much of a factor, instead, it might actually count a lot in its favour. Streets with plenty of diesel bleching busses tend to get a bit grubby and have less aethetic appeal than cleaner streets.

  24. Re:The Matrix on The Best and Worst Movies of 2003? · · Score: 1

    Yeah, and "The Core". I can't get the smell out of my nose still.

  25. Re:And women are just as responsible.... on Pretty Women Scramble Men's Sense Of The Future · · Score: 1

    Hmmm ... the old fashion furphy.

    It's not to impress men, but it is to outcompete the other women. Hence, they are disgusted and outraged when some else wears the same (or close enough) outfit. The only objective is to be or get "first pick".

    Men on the other hand have never had a hissy fit when someone else wears the exact same shade of black dinner suit/lounge suit/etc.

    As for "more visual" I'll leave that to explain p2p proliferation, Amsterdam and Hamburg.