Slashdot Mirror


User: arcade

arcade's activity in the archive.

Stories
0
Comments
672
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 672

  1. Re:OSDN, Audit ALL of your systems NOW. on Blow-by-Blow Account of the OSDN Outage · · Score: 2

    Defense in depth is a good philosophy to have, protecting against configuration mistakes.

    Of course.

    You are also protected if exploit code is run (say via a buffer overflow that changes hosts.deny).

    uh? That sounds pretty damn unlikely. The bufferoverflow could just as well execute a reverse-channel back to the attacker. Of course, you limit the possibilities of the attackers. However, you're now already talking about running services with known vulnerabilities.

    Firewalls can also protect against low-level attacks that don't attack the services/applications themselves.

    That is better done at core-routers.

    When properly configured, firewalls can be invaluable in logging traffic and otherwise keeping out unwanted traffic and IP spoofs -- and can do a far better job than simple packet filtering on a router.

    That is better done by snort, or any other decent IDS.

    I think it's pretty poor form to call someone else a dimwit when you're lacking a lot of info yourself. There's a reason that a firewall is industry-wide best practice for an Internet site or user network, and it's not because we're all dimwits

    I regularly call those that thinks running firewalls is the be-all or end-all of security for dimwits. Unplugging a firewall on a network you know isn't exactly a horrible thing to do.

    A Firewall is a good thing to have when you've got a network you don't have time to audit, and that doesn't have people to audit it on a regular basis. Its a good thing to have when you've got servers which you don't have any possibility of patching, or upgrading -- but that needs to be running some services (nonvulnerable) to the internet.

    Of course, you could do lots of these things with NAT-devices. (Which of course isn't a perfect solution neither).

    Blargh, I could rant on forever.
    --

  2. Re:OSDN, Audit ALL of your systems NOW. on Blow-by-Blow Account of the OSDN Outage · · Score: 2

    I need to add something here. Of couse, if its nonencrypted telnet, it shouldn't be used most of the time. If its a crisis - then change it to a scrappable password, let the servicengineer do his thing, then change it afterwards.

    Preferrably encrypted login should be used, of course. Be it ssh, telnet-ssl or whatever.


    --

  3. Re:OSDN, Audit ALL of your systems NOW. on Blow-by-Blow Account of the OSDN Outage · · Score: 3

    Point 1./ Why do you allow TELNET in to your routing/switching equipment from the outisde world? If a CISCO tech' with the password can do it then a hacker without the password likely can too.

    Bah, you're talking without knowing the parameters. For all you know, they could've enabled the telnet access on the outbound interface specifically for the checking/cisco rep, disabling it afterwards.

    Secondly -- if I remember correctly you can have pretty damn long passwords on ciscoequipment. We do not know the length of the password, but its highly probable that the password is 10+ characters. A bruteforce-attack is pretty damn difficult when you have to check 64^10 possibilities. According to my bc:

    arcade@lux:~$ echo 64^10 | bc
    1152921504606846976

    Now, that is a pretty impressive number of queries you've got to make to exhaust that pwd-space. To be quite frank -- I don't see the problem.

    Point 2./ If you are connected to the Internet in any way NEVER replace your firewall with a cross over cable. Basically at that stage you have your pants around your ankles, are bent over, with a big "Do Me Now!!!!!" sign on your butt!

    Oh, yes of course. If you don't have a firewall You are phooked!!

    Ehh? Excuse me? Why the fsck do a properly configured serverfarm need firewalls _at all_? Please, enlighten us with your wisdom oh dimwit.

    Firewalls _are not needed_ if you're not running services that _should not be running_ on servers for the internet.
    --

  4. Re:How to be a karma whore. on Slashdot Back Online · · Score: 2

    One little question: Who cares?

    If you by any chance think its a valid comment, then drag itover ffs. You cannot expect everybody to read both places.

    And listen you idiotic pup. Not everybody thinks that "Karma" is life, death and everything.


    --

  5. Re:non-typist rules on Ergonomic Laptop Keyboards? · · Score: 2

    Interesting, I've never done such a test, so I just did. Started my timer, and started pounding:

    After one minute had passed:

    arcade@lux:~$ wc endaentest
    4 149 745 endaentest

    Of course, there were some typing errors, and the formatting sucked (4 lines ;) - but still. Also, I type in norwegian - I don't know if the mean norwegian word is shorter than the mean english word. If it is, that may explain why I managed to rack the speed to 149wpm. :-)

    Also, note that in that, there was absolutely _NO SENSE_ in what I wrote. Of course, it was words, and they were in sentences - but I didn't type something very interesting. :-)


    --

  6. Re:Legit Peer-to-Peer? Its called "The Internet" on EFF Seeks Examples Of Legit P2P Use · · Score: 2

    Dude, your Athlon peecee running Linux is in absolutely no way, whatsoever, a peer of the cluster of 64-way UltraEnterprise 10K servers which power eBay.

    So, you think that ebays server dumps its packets right into /dev/null ? Funny I can see ebay then.

    I think you've misunderstood what a 'peer' actually is on the internet.


    --

  7. Legit Peer-to-Peer? Its called "The Internet" on EFF Seeks Examples Of Legit P2P Use · · Score: 4

    The entire Internet is built around the Peer-to-Peer principble. Of course, firewalls & NAT-devices break this principle all the time - but basically - Internet _is_ a peer-to-peer network.

    Some peers are called 'servers' since they contain more data and serve more people than others. Still, they are just peers.

    But, to get real examples. IRC-Botnets - the bots are connected to eachother, and talk to eachother. They maintain stability on IRC channels, or perform other functions.

    Another example, the good old fashioned 'talk' program is a nice peer-to-peer thingomajig.


    --

  8. Answer to question 2; on Report From The 2600 Appeal Hearing · · Score: 2

    2. What examples of fair uses absolutely require access to the work in its most modern, digital, uncorrupted, un-macrovisioned form? The only one that jumped out at me is making a backup copy in case the original is destroyed. But perhaps there are others.

    Obvious. A class teaching techniques in moviemaking, effectmaking and so forth would need the grapical _details_ of a scene in the most perfect form. If its not in the most perfect form, the class would be moot.

    Also, should a teacher be _required_ to own something as unlikely to own as a videocamera? I don't own one. I don't know anybody that owns one. You require everybody to buy something they wouldn't normally have.

    Also, at the moment most people have VHS machines, lots hav DVD. But, how many do you know that has an LP player? I don't. All my friends have CD players - and I don't know anybody with an LP one.

    In 10 years, who will have VHS casettes? Only very few people. In other words, you will need _special equipment_ to be able to make use of fair use.


    --

  9. Snow Crash is prior art. on Worlds.com Patents Quake-like Games? Kinda. · · Score: 2

    The book Snow Crash by Neil Stephenson describes the 'metaverse'.. It was released in 1992 - and desccribes the _exact_ thing the patent describes.

    The metaverse is a highly scalable architecture for three dimensional graphical, multi-user. interactive virtual world system. {blabla] The virtual world shows avatars (yes, the book uses avatars too) representing the other users [..]

    In short, the entire patent is a ripoff of Neil Stephensons book Snow Crash.

    Its a bogus patent. ;)


    --

  10. *Read* the article before you post. on How I Completed The $5000 Compression Challenge · · Score: 2

    Read the damn article before you post - he didn't use 'gunzip' in his proposition.


    --

  11. Re:/. Hypocracy on Scientology vs. Panoussis Ruling · · Score: 2

    You obviously hasn't read anything about Scientology. They're a mad cult. May I recomend Operation Clambake? for you ? Good. Now, go read the OT documents. The scientology "religion" is crazy. Those documents SHOULD be public. Go read'em.
    --

  12. Re:What difference does that make? on BIND Security Info For "Members Only"? · · Score: 2

    The funny thing is that the C bible isn't kosher in this case. ;)
    --

  13. Bah. I don't need it and I don't want it. on Making Linux Booting Pretty · · Score: 3

    I remember the first time I booted windows95. The first thing I cried out is "Where is all the bootup information??" . From beeing readily available before, now most of it was hidden.

    I don't want a penguin displayed during the bootup. I want the information, as it reveals if something isn't the way it should be, without having to fiddle with logging and other bullshit.

    Eye candy is nice, but not when it removes possibly Very Important Information.

    No penguin during bootup for me. I want the kernel info.


    --

  14. Re:losers in school on The Ordinary Slashdot User Answers · · Score: 2

    Computer "geeks" probably have more experience with depression and thei -dont-care-if-i-am-a-rejected-loser-because-i-am- intelligent syndrome

    And the solution, when you're the number one kid getting bullied in school is what?

    I for one am a Very Intelligent Computer Geek - and have always been so (always, as in, since the age of 6 or 7).

    You have to have something to look forward to, when you're going through the years of beeing bullied. I for one knew that the years would pass, and that when I grew up, I would become "much more" than the assholes.

    How right I was. :) When I look back on the bastards, I see a bunch of kids that are mostly drug addicts, or working as mechanics in some small garage.

    Some people get depressed. I didn't. I started my own BBS, and spent most of my time writing on it, discussing with people three times my age. They didn't know or care about my age - they cared about the discussions. That was _great_.


    --

  15. Re:Slashdot - get a grip and get some knowledge. on BugTraq No Longer Able To Publish MS Security UPDATED · · Score: 1

    "Operation Foot Bullet"
    That comment kicks serious ... umm, bottoms.


    Its ripped from Operation Clambake which flames the scientologists.

    :-)
    --

  16. Re:Slashdot - get a grip and get some knowledge. on BugTraq No Longer Able To Publish MS Security UPDATED · · Score: 2

    Actually, it's more subtle than that. SecurityFocus will still publish stuff about MS bugs

    Of course. Bugtraq will still have MicroSoft bugs, VULN-Dev will still be used to find errors in MS' programs. The point is, SecurityFocus.com is not allowed to store or redistribute Microsoft's webpages. Its all up to microsoft if they allow their entire advisories/webpages to be published. And frankly, I don't expect aleph1 to "write his own advisory based on MicroSoft ones". He is denied to just post the damn webpage. That is all. This just _isnt_ a "everybody flame microsoft for trying to stop mouths" case. Its a "Microsoft suck at distributing information about security vulnerabilities"-case.

    Not to mention the infamout credits

    At least they _give_ credit. That is the important thing.

    No, I don't think I'll miss the MS advisories..

    Me neither, they are too full of BS instead of the facts you want to get. There is a great posting to bugtraq today (or maybe it was yesterday) about the trouble with microsofts security bulletins. Mainly that they lack consistency in what to do when they update the information.


    --

  17. Slashdot - get a grip and get some knowledge. on BugTraq No Longer Able To Publish MS Security UPDATED · · Score: 3

    This is just pure irritating. Hemos should do his homework instead of flaming microsoft this time. First of all, what has happened is as follows:

    MicroSoft is issuing, like other companies Security Advisories. These distributable security advisories were posted to bugtraq and other mailinglists, and were up until a week ago. The point is, MicroSoft has changed their Security Advisory layout, to only include a URL to the description of the bug and so forth.

    Aleph1 is running Bugtraq, which is a full disclosure mailinglist, and one of the policies is that the signal-noise ratio should be as good as possible. To avoid noise "no-content" advisories are rejected. Advisories with nothing but URL's are considered no-content advisories.

    That means that Aleph1 will no longer be publishing microsofts new security alerts. Instead he tried to post one of the security bulletins from their webpages, and that microsoft claims copyright on. Well, too bad for them. MicroSoft is forgetting that they now have made sure that even _less_ security administrators will get to know about their products weaknesses, and even _less_ administrators will upgrade.

    In other words, they've done an Operation Foot Bullet. I don't complain though, as I don't run microsoft servers - and now have even more arguments when convincing companies I work for not to use their shitty products.

    Slashdot has in this case presented a very wrong view. Its aleph1 that is _rejecting_ microsofts security alerts because of them beeing NON-CONTENT. He is however not allowed to grab microsofts _webpages_ and publish them on bugtraq.


    --

  18. Re:real file type information? on Pro-Linux Mail Trojan Running Around · · Score: 2

    WRONG SOLUTION, damnit!

    You should never, ever let your OS take care of files. You should *always* open a program, and let the program try to open the files. Letting the operating system guess on the file types is doomed to failure, and its like -begging- to get infected by bad things.

    The idiot that moderated you up should be shot for stupidity.

    --

  19. Of course they should be allowed. on Should ISPs Be Allowed To Delete Your MP3s? · · Score: 2

    Of course the ISPs should be allowed to delete mp3's from their servers, if, and only if, that is their public policy - which are available through their webpages / or you've been informed about it in a proper manner.

    However, we as customers should choose not to use such an isp ;)


    --

  20. I don't care. :-) on Has Netscape's Browser Become Too Self-Serving? · · Score: 2

    I really couldn't care less.

    Mozilla / Netscape is the same as emacs. "Eighty Megabytes and Constantly Swapping".

    At the moment, I'm using netscape some of the time, and Konqueror a lot of the time. Konqueror is *the* new browser for Linux, in my humble opinion. :)

    Also, Opera from Opera Software seems to become a *great* browser. I used the Beta a bit, and was really impressed. It had a couple of bugs, but I think those will be fixed for the next release. When that happens, I will either use Konq or Opera fulltime (as I guess Konq has progressed until then too ;).


    --

  21. It breaks the dns-rfc. on Registrations Now Accepted For Asian Domain Names · · Score: 2

    Has there been an update to the DNS RFC allowing this? If I remember correctly, it do NOT allow special chars in the domainnames.

    Furthermore, does this limit those domains to 32 chars of length? (unicode, 2 bytes per char, dns system allows a maximum of 64 chars for domainnames .. but, that should probably be interpreted as bytes).

    Also, doesn't it kinda suck to make large parts of the net unavailable for most?

    --paddy
    --

  22. Re:Remove the ancient laws, or at least update'em. on What If There Was No Copyright Law? · · Score: 2

    You can sell linux if you want.
    --

  23. Re:Remove the ancient laws, or at least update'em. on What If There Was No Copyright Law? · · Score: 2

    The problem imho is not their ability to buy things, or to have a nice life with the money. My problem is that they gain power / influence, without doing anything themselves.

    Try reading the article I referred to in the ethical spectacle (you may have to dig a bit to find it, but it was in the october edition).


    --

  24. Re:Remove the ancient laws, or at least update'em. on What If There Was No Copyright Law? · · Score: 3

    Patents are so that I, who invent stuff, can secure the economic security for my offspring, and their offspring and so on.

    Don't get me started on this. Your offspring should start out the same way as everybody else. It makes me puke, when rich people, who has been rich for generations, goes ahead and brings the fortune to the nextgen, and the nextgen, and so forth.

    Everybody should have to earn their riches. Some people WILL of course gain something by their parrents being rich - but it should not be the standard. I would recomend reading the October edition of The Ethical Spectacle for a more elaborate view on this.

    Natrual? Yes! Just like trying to leech of others, they way you want it.

    I do not want to "leech of others" - I want to be able to use already publicated ways of doing things. If I know how to make a certain algorithm, I should be able to use it in my software - no matter who has "patented" it. If I know how to make a cool mousetrap, I should be able to make it - and produce it - without having to vade through the thousands of patented ways of killing a mouse in a trap.

    I don't *care* if someone invented it before me. I want to be able to reinvent, and use the things I reinvent, without having to wait for some stupid patent to expire.


    --

  25. Remove the ancient laws, or at least update'em. on What If There Was No Copyright Law? · · Score: 5

    Copyright laws should be removed. A controversial statement for sure. How can someone claim that such a right, should be removed?

    First of all, if I produce something, I shouldn't be able to earn money on that single product my entire life. If I make something, I should be able to sell it, but then I lose control over it.

    Patents *used* to be an incentive for research, and to open up formulas. Its not anymore. Either people keep it a tradesecret, or they patent it to prevent others from making "copies" for the next 20 years. Patents are no longer "so that the public gains from it in the long run". Patents are now in place to prevent people from making more efficient solutions, "for the next 20 years" - so that the creator may benefit mostly from it.

    The problem is, everybody else loses from the possibility of patents. If someone else things up the same thing, he can't use it, because someone else has *patented* it. Even if the second to come up with the idea, never had seen the product the first one patented.

    Back to copyright. If I made good music, I would be *glad* that people enjoyed my music so much that they shared it. I would be *glad* if people listened to my music. If I wanted money from it, i would make concerts and so forth. I should not sit with copyright on the material for the next 70 years or how long it is. After I had made it available, people should be able to share it, and enjoy it.

    The same goes for software.

    Of course, this removes the business oportunities to a great extent, or at least the current business oportunities. It wouldn't be possible to earn money the same way as today. Of course, you could sell CD's, "collectors editions" and so forth - which your hardcore fans would buy. You would get money from those who truly enjoyed your music, but not from those that listened to it once or twice.

    Furthermore, you would get money from concerts. People would pay to watch your concerts, and that would make you money.

    Oh, I could go on for ages and ages. I simply want copyright to be a thing of the past.


    --