> In a VM though. At least that will lower the chance of potential attack vectors considerably even if a program in said VM were shit on.
If you run your firewall / router in a VM, that means there's a physical box hosting it which is physically plugged directly into the internet, unprotected by the firewall. I'm not saying it can't be done reasonably safely, but that's certainly not my preference.
> So, in conclusion, I'll buy an OpenWRT-compatible router and flash it on because I am lazy.:)
Yep. I've been doing network security full time for almost twenty years and I would (and do) use OpenWRT, not only because I'm lazy, but because that's a team of people building something specifically for that role. Even with 20 years of security experience, I could overlook something regarding security and nobody would be checking my work.
I may switch to a Cisco ASA as my first line of defense, though. I happen to have one for lab purposes. I'm not sure I want to deal with Cisco's licensing keeping the thing updated and doing everything I want it to do, though.
> As far as other brands, I dislike Linksys, especially since the Cisco and Belkin days. The quality is simply not there anymore. Anyone have a good recommendation?
Further up this page someone posted a link to recent routers recommended for Tomato.
It is similar to parallel construction, but somewhat different (at least for one definition of parallel construction).
One definition of "parallel construction" would be: The intelligence agency provides some specific information to the police. The police make up some BS story about how they got that information. The police use that information as probable cause for a search.
There's no ideal solution, of the spies find an ongoing serious crime, but this is an improvement: The intelligence agency gives no specific information to the police. Just "you should look into what happens at ABC Club". The police have no probable cause at that point, they have to do old-fashioned police work. The police can ask neighbors about ABC Club, they can visit ABC Club when it's open to the public, etc. What the police CAN'T do is use the information from spies as probable cause, lying about the source of the information, because the spies didn't GIVE them any information.
> If you are allowed to submit "unverifiable" or what I call inscrutable evidence
This law says they are NOT allowed to submit the evidence found by spying. That's an important step, though not sufficient by itself.
The issue that arises then is if the spies find out about some criminal activity, and tell law enforcement about it, law enforecement might search the house to get admissible evidence. However, if the search is challenged, if the police are asked "why did you search?" - well that's a problem. Unless the police are allowed to refuse to answer that question, they'll lie. Which is why in my opinion the spies should not tell the police about the drug dealer. The spies should generally stick to traditional spy stuff, intelligence against other countries, foreign terrorists, etc. and ignore any crime they happen to come across. That way you don't get this improper use of spy techniques in criminal cases.
Very rarely, the intelligence agencies might come across a heinous crime IN PROGRESS. Imagine a serial killer who abducts his victims, holds them prisoner for two weeks, then kills them. We wouldn't want the spies to just ignore that, but we do want a general policy that spooks don't investigate domestic crime. One possible way to handle those very rare instances might be for the intelligence agent to tell the police only "Joe Blow is doing something very bad. You should check him out thoroughly, immediately." Then the police have to do the hard work of investigating without receiving any details that the spies came across, almost like they'd handle an anonymous tip. The difference being they know this tip isn't a prank, they really do need to investigate.
The law actually says they're not allowed to talk about anything they found by spying, or any spying methods. Nowhere does it give them permission to lie about any of it. Obviously some people will lie, but this law doesn't actually permit them to do so.
The first part of the law, saying they can't use the content of any conversation they've snooped on in court, has good and bad consequences, but I think that part is good overall because spying, which by it's nature must be sneaky, should be kept seperate from law enforcement, which should be as transparent as practicable. This is one way the US screwed up after 9-11, IMHO.
Prior to 9-11 in the US, the FBI and other law enforcement handled criminal matters, and were required by law to get search warrants, etc. The CIA and other spies were allowed to do things that police weren't allowed to do, BUT they weren't allowed to use that information in a criminal case or give the information to the FBI. So the intelligence agencies could spy on North Korean agents, and the FBI would investigate drug dealers, each working under rules appropriate* for their job. After 9-11, at was determined that it would be more effective if the CIA/NSA and FBI and other agencies cooperated more, sharing information. Maybe it's more effective in some ways, but it has meant that the NSA has become involved in simple criminal investigations of citizens. That's bad. The spy stuff should be reserved for national security stuff, IMHO.
* Obviously there can be, and has been, much debate about what's appropriate, but clearly what's appropriate for national security intelligence operations may be different than what's appropriate for domestic criminal investigations.
The large oil companies have at least $50 billion invested in renewable energy. Google it.
You mentioned storage technology and wind. Here's example news from just one week last year. Total SA, the French oil supermajor, spent $1.1 billion to buy the battery maker Saft Groupe SA, complementing its 2011 purchase of a majority stake in the solar-panel maker SunPower Corp on a Monday. The next day, Canadian pipeline company Enbridge Inc. it would pay $218 million for stakes in offshore wind farms as it attempts to double its low-carbon generating capacity.
> level of effort should never be a pricing metric, in much the same way that a surgeons salary should not
You may notice that becoming a surgeon requires a ton of effort. Therefore, people don't generally put out that level of effort unless they'll be well paid for it.
> at least priced high enough to entice everyone away from the black market.
There is no price, for any service, that customers are willing to pay and will entice everyone to do good rather than crime. Accountants get paid well to do things right, some choose crime instead. That'll always be true.
There are two sides to that. In a day I can run a suite of tools across a dozen such services. Those tools will find likely weak areas with little effort or time on my part. Over the next couple of days, I can explore the issues highlighted by the tools and quite possibly find an issue like this.
At current bug-bounty levels, I could probably earn a bit more than I could make at a salaried position, while setting my own hours and exploring the things that interest me. So prices are reasonably fair. Another way of looking at that is that skilled people DO in fact participate in bug bounty programs, so they find it worthwhile.
Yes, in theory committing crimes could be an easier way for people to make money, until they go to prison. A bank robber makes more per hour than a bank teller.
For single machines, like you say you can upgrade the metal OS without disturbing the guests (hopefully). If you have a cluster of 16 Snort nodes, or 32 storage servers, you just take each offline as you upgrade it, then it rejoins the cluster when ready. It's kind of reverse virtualization - the 16 pieces of hardware are virtually one service.
> public key from a website to encrypt your information too it
The reason that the web site's public key is signed by a party you trust, such as VeriSign, is to authenticate the web site. Without authentication, the public key you use to encrypt your bank transfer might be the bad guy's key, or it might be my my key, rather than the bank's key.
Without authentication, you don't know who you're securely sending your information TO. Authentication allows you tell the difference between these three scenarios:
You give them credit for Postscript and for pdf. Pdf is essentially Postscript, zipped, with some of the code commented out. So really they deserve credit just for Postscript.
Except that postscript was largely created at Xerox PARC, before John Warnock and Chuck Geschke left. Warnock and Geschke wanted Xerox to sell Postscript (then called Interpress) as a standalone product, but Xerox chose not to. So the two left and created Adobe to sell Xerox's idea.
So anyway their one great thing, Postscript, wasn't created by Adobe.
In the days when cross-browser Javascript/Actionscript was darn near impossible, Adobe Flash was *conceptually* a good idea - a plugin that carried the same dialect of JavaScript/Emacscript to every browser. Unfortunately they really, really suck at security.
Absolutely, if your WordPress blog needs about 1/4 the resources of a server, a virtual machine is a good way to do that. I offer that for our smallest customers. (We call it "Half Server", two cores and 8GB dedicated to each customer.)
If you need a cluster of 4, 40, or 400 nodes in your cluster of Squid proxies, the virtualization works the other way around - a true cluster is a rack row of machines that look and act like one. Each node, each piece of hardware, is an interchangeable and disposable part of of the whole. There's no reason to run a hypervisor on the nodes, the whole row, the whole cluster, is a virtual service.
> As soon as they do, nothing's stopping someone from decompiling or reverse-engineering their exploits, and then sending them in to Nintendo claiming ownership and collecting the reward.
It's called an "example". There are millions of servers that do almost nothing but run a bunch of Apache threads, many that do nothing but smtp, many that do nothing but nosql lookups, etc. It's very common, especially for companies with thousands of servers, to have servers dedicated to a single task.
Data center power is expensive. Mostly because it's reliable and redundant. And yes, every watt used is a watt of heat that has to be removed by the cooling system.
Suppose it was literally true that a data center was powered by a dedicated nuclear power plant. It costs about $12 billion to build a power plant. How many cores would you like to be able to power from your $12 billion investment? If I operated a big DC, I'd rather power a million low-power CPUs from my X gigawatts of power than only be able to use 100,000 power hungry CPUs.
Not that most DCs are powered by a dedicated power plant - you really want connections to at least TWO power plants, and you typically want to be in the datacenter business, not the power plant business.
Yes, that's the demand side of supply and demand. Also, they spend a couple hundred million or whatever building the system nationwide, and recovered that $xxx million plus the interest they paid (or could have received) on that $xxx million, 25 cents at a time. That's the supply side.
AFTER they spent however much to build it, the incremental cost to send one MORE text was low, but they needed to pay off the loan of $xxx million that they used to build it in the first place.
Confidentially and authentication go together because over the network you can't have confidentiality without authentication. You have to know whether or not you're talking to a man-in-the-middle.
> it is hidden for other wireless tech devices like mice etc that don't use Bluetooth, simply because you don't see the network selection and authentication doesn't mean it doesn't exist.
If you can't see it, and don't know what standards are used, don't assume there is any authentication or confidentially. I can eavesdrop on wireless keyboards sold by Microsoft and other companies.
> If it weren't for the RIAA & large music industry companies I bet there would be large sites where all artists could upload their music and users could search for a specific artist, by genre or similar to someone they'd heard
That's called Myspace. There are 53 million songs for you to choose from on Myspace.
Some people like that approach and use Myspace or similar sites to find music. MOST people don't want to sort through 53 million songs by artists of varying quality, and greatly varying production quality - even a really good artist can sound crappy if the sound engineers and others involved in producing the song don't do an excellent job. Most people would rather have *somebody else* sort through the artists and songs for them, arrange to have skilled technicians and producers work with the artist's who are pretty good, then deliver an album of predictable quality.
The first result in my Google search for "open ip camera firmware" looked pretty promising, so I'm guessing you have another requirement that none of those cameras meet? Using the open firmware DOES mean upgrading from the factory firmware, is that a major issue?
> Sent a video feed to other device on my network.
If your firewall or vlan restricts it to your local network only, how important is future firmware support? If it works today, with a standard/open protocol such as mpeg, and it's not connected to the internet, what future upgrades can be so important?
The current ruling is about *compensation*, not punitive damages. If he wants to file for punitive damages, he's now in a position to file for that. It's two separate things.
> Weather cannot reliably be forecasted, and anyone who's paid attention knows this.
Even just a radar map alone is sufficient to predict what the weather will be like *today*. Predicting a week out, you may as well just use the long-term average (summer will probably be hot).
Global warming is of course an entirely different ball of wax. Based on my efforts to find the most objective information I could find, it appears to be a lot like Saint Nickolas - a real thing, with a LOT of hype and fiction built up around it.
Slashdot Mirror
> In a VM though. At least that will lower the chance of potential attack vectors considerably even if a program in said VM were shit on.
If you run your firewall / router in a VM, that means there's a physical box hosting it which is physically plugged directly into the internet, unprotected by the firewall. I'm not saying it can't be done reasonably safely, but that's certainly not my preference.
> So, in conclusion, I'll buy an OpenWRT-compatible router and flash it on because I am lazy. :)
Yep. I've been doing network security full time for almost twenty years and I would (and do) use OpenWRT, not only because I'm lazy, but because that's a team of people building something specifically for that role. Even with 20 years of security experience, I could overlook something regarding security and nobody would be checking my work.
I may switch to a Cisco ASA as my first line of defense, though. I happen to have one for lab purposes. I'm not sure I want to deal with Cisco's licensing keeping the thing updated and doing everything I want it to do, though.
> I don't know of any reliable alternatives to run as firmware.
It looks like Tomato supports your router, as does dd-wrt.
https://www.myopenrouter.com/b...
https://www.myopenrouter.com/d...
> As far as other brands, I dislike Linksys, especially since the Cisco and Belkin days. The quality is simply not there anymore. Anyone have a good recommendation?
Further up this page someone posted a link to recent routers recommended for Tomato.
It is similar to parallel construction, but somewhat different (at least for one definition of parallel construction).
One definition of "parallel construction" would be:
The intelligence agency provides some specific information to the police.
The police make up some BS story about how they got that information.
The police use that information as probable cause for a search.
There's no ideal solution, of the spies find an ongoing serious crime, but this is an improvement:
The intelligence agency gives no specific information to the police. Just "you should look into what happens at ABC Club".
The police have no probable cause at that point, they have to do old-fashioned police work.
The police can ask neighbors about ABC Club, they can visit ABC Club when it's open to the public, etc.
What the police CAN'T do is use the information from spies as probable cause, lying about the source of the information, because the spies didn't GIVE them any information.
> If you are allowed to submit "unverifiable" or what I call inscrutable evidence
This law says they are NOT allowed to submit the evidence found by spying. That's an important step, though not sufficient by itself.
The issue that arises then is if the spies find out about some criminal activity, and tell law enforcement about it, law enforecement might search the house to get admissible evidence. However, if the search is challenged, if the police are asked "why did you search?" - well that's a problem. Unless the police are allowed to refuse to answer that question, they'll lie. Which is why in my opinion the spies should not tell the police about the drug dealer. The spies should generally stick to traditional spy stuff, intelligence against other countries, foreign terrorists, etc. and ignore any crime they happen to come across. That way you don't get this improper use of spy techniques in criminal cases.
Very rarely, the intelligence agencies might come across a heinous crime IN PROGRESS. Imagine a serial killer who abducts his victims, holds them prisoner for two weeks, then kills them. We wouldn't want the spies to just ignore that, but we do want a general policy that spooks don't investigate domestic crime. One possible way to handle those very rare instances might be for the intelligence agent to tell the police only "Joe Blow is doing something very bad. You should check him out thoroughly, immediately." Then the police have to do the hard work of investigating without receiving any details that the spies came across, almost like they'd handle an anonymous tip. The difference being they know this tip isn't a prank, they really do need to investigate.
The law actually says they're not allowed to talk about anything they found by spying, or any spying methods. Nowhere does it give them permission to lie about any of it. Obviously some people will lie, but this law doesn't actually permit them to do so.
The first part of the law, saying they can't use the content of any conversation they've snooped on in court, has good and bad consequences, but I think that part is good overall because spying, which by it's nature must be sneaky, should be kept seperate from law enforcement, which should be as transparent as practicable. This is one way the US screwed up after 9-11, IMHO.
Prior to 9-11 in the US, the FBI and other law enforcement handled criminal matters, and were required by law to get search warrants, etc. The CIA and other spies were allowed to do things that police weren't allowed to do, BUT they weren't allowed to use that information in a criminal case or give the information to the FBI. So the intelligence agencies could spy on North Korean agents, and the FBI would investigate drug dealers, each working under rules appropriate* for their job. After 9-11, at was determined that it would be more effective if the CIA/NSA and FBI and other agencies cooperated more, sharing information. Maybe it's more effective in some ways, but it has meant that the NSA has become involved in simple criminal investigations of citizens. That's bad. The spy stuff should be reserved for national security stuff, IMHO.
* Obviously there can be, and has been, much debate about what's appropriate, but clearly what's appropriate for national security intelligence operations may be different than what's appropriate for domestic criminal investigations.
The large oil companies have at least $50 billion invested in renewable energy. Google it.
You mentioned storage technology and wind. Here's example news from just one week last year. Total SA, the French oil supermajor, spent $1.1 billion to buy the battery maker Saft Groupe SA, complementing its 2011 purchase of a majority stake in the solar-panel maker SunPower Corp on a Monday. The next day, Canadian pipeline company Enbridge Inc. it would pay $218 million for stakes in offshore wind farms as it attempts to double its low-carbon generating capacity.
You mean to tell me that ride-sharing, aka car pooling, isn't a good full-time job!
Damn, now I'll have to switch jobs. I think my new job will be recycling my cans.
> level of effort should never be a pricing metric, in much the same way that a surgeons salary should not
You may notice that becoming a surgeon requires a ton of effort. Therefore, people don't generally put out that level of effort unless they'll be well paid for it.
> at least priced high enough to entice everyone away from the black market.
There is no price, for any service, that customers are willing to pay and will entice everyone to do good rather than crime. Accountants get paid well to do things right, some choose crime instead. That'll always be true.
There are two sides to that. In a day I can run a suite of tools across a dozen such services. Those tools will find likely weak areas with little effort or time on my part. Over the next couple of days, I can explore the issues highlighted by the tools and quite possibly find an issue like this.
At current bug-bounty levels, I could probably earn a bit more than I could make at a salaried position, while setting my own hours and exploring the things that interest me. So prices are reasonably fair. Another way of looking at that is that skilled people DO in fact participate in bug bounty programs, so they find it worthwhile.
Yes, in theory committing crimes could be an easier way for people to make money, until they go to prison. A bank robber makes more per hour than a bank teller.
For single machines, like you say you can upgrade the metal OS without disturbing the guests (hopefully). If you have a cluster of 16 Snort nodes, or 32 storage servers, you just take each offline as you upgrade it, then it rejoins the cluster when ready. It's kind of reverse virtualization - the 16 pieces of hardware are virtually one service.
> public key from a website to encrypt your information too it
The reason that the web site's public key is signed by a party you trust, such as VeriSign, is to authenticate the web site. Without authentication, the public key you use to encrypt your bank transfer might be the bad guy's key, or it might be my my key, rather than the bank's key.
Without authentication, you don't know who you're securely sending your information TO. Authentication allows you tell the difference between these three scenarios:
You -> Bank
You -> Me -> Bank
You -> Me
You give them credit for Postscript and for pdf. Pdf is essentially Postscript, zipped, with some of the code commented out. So really they deserve credit just for Postscript.
Except that postscript was largely created at Xerox PARC, before John Warnock and Chuck Geschke left. Warnock and Geschke wanted Xerox to sell Postscript (then called Interpress) as a standalone product, but Xerox chose not to. So the two left and created Adobe to sell Xerox's idea.
So anyway their one great thing, Postscript, wasn't created by Adobe.
In the days when cross-browser Javascript/Actionscript was darn near impossible, Adobe Flash was *conceptually* a good idea - a plugin that carried the same dialect of JavaScript/Emacscript to every browser. Unfortunately they really, really suck at security.
Absolutely, if your WordPress blog needs about 1/4 the resources of a server, a virtual machine is a good way to do that. I offer that for our smallest customers. (We call it "Half Server", two cores and 8GB dedicated to each customer.)
If you need a cluster of 4, 40, or 400 nodes in your cluster of Squid proxies, the virtualization works the other way around - a true cluster is a rack row of machines that look and act like one. Each node, each piece of hardware, is an interchangeable and disposable part of of the whole. There's no reason to run a hypervisor on the nodes, the whole row, the whole cluster, is a virtual service.
> As soon as they do, nothing's stopping someone from decompiling or reverse-engineering their exploits, and then sending them in to Nintendo claiming ownership and collecting the reward.
Thanks for the idea! ;)
It's called an "example". There are millions of servers that do almost nothing but run a bunch of Apache threads, many that do nothing but smtp, many that do nothing but nosql lookups, etc. It's very common, especially for companies with thousands of servers, to have servers dedicated to a single task.
Data center power is expensive. Mostly because it's reliable and redundant. And yes, every watt used is a watt of heat that has to be removed by the cooling system.
Suppose it was literally true that a data center was powered by a dedicated nuclear power plant. It costs about $12 billion to build a power plant. How many cores would you like to be able to power from your $12 billion investment? If I operated a big DC, I'd rather power a million low-power CPUs from my X gigawatts of power than only be able to use 100,000 power hungry CPUs.
Not that most DCs are powered by a dedicated power plant - you really want connections to at least TWO power plants, and you typically want to be in the datacenter business, not the power plant business.
Yes, that's the demand side of supply and demand. Also, they spend a couple hundred million or whatever building the system nationwide, and recovered that $xxx million plus the interest they paid (or could have received) on that $xxx million, 25 cents at a time. That's the supply side.
AFTER they spent however much to build it, the incremental cost to send one MORE text was low, but they needed to pay off the loan of $xxx million that they used to build it in the first place.
Confidentially and authentication go together because over the network you can't have confidentiality without authentication. You have to know whether or not you're talking to a man-in-the-middle.
> it is hidden for other wireless tech devices like mice etc that don't use Bluetooth, simply because you don't see the network selection and authentication doesn't mean it doesn't exist.
If you can't see it, and don't know what standards are used, don't assume there is any authentication or confidentially. I can eavesdrop on wireless keyboards sold by Microsoft and other companies.
> If it weren't for the RIAA & large music industry companies I bet there would be large sites where all artists could upload their music and users could search for a specific artist, by genre or similar to someone they'd heard
That's called Myspace. There are 53 million songs for you to choose from on Myspace.
Some people like that approach and use Myspace or similar sites to find music. MOST people don't want to sort through 53 million songs by artists of varying quality, and greatly varying production quality - even a really good artist can sound crappy if the sound engineers and others involved in producing the song don't do an excellent job. Most people would rather have *somebody else* sort through the artists and songs for them, arrange to have skilled technicians and producers work with the artist's who are pretty good, then deliver an album of predictable quality.
Without VLANs, you list devices are not allowed to access the internet. On Linksys, it's called Access Policy.
http://www.linksys.com/ph/supp...
Netgear probably has the same capability.
The first result in my Google search for "open ip camera firmware" looked pretty promising, so I'm guessing you have another requirement that none of those cameras meet? Using the open firmware DOES mean upgrading from the factory firmware, is that a major issue?
> Sent a video feed to other device on my network.
If your firewall or vlan restricts it to your local network only, how important is future firmware support? If it works today, with a standard/open protocol such as mpeg, and it's not connected to the internet, what future upgrades can be so important?
The current ruling is about *compensation*, not punitive damages. If he wants to file for punitive damages, he's now in a position to file for that. It's two separate things.
> Weather cannot reliably be forecasted, and anyone who's paid attention knows this.
Even just a radar map alone is sufficient to predict what the weather will be like *today*. Predicting a week out, you may as well just use the long-term average (summer will probably be hot).
Global warming is of course an entirely different ball of wax. Based on my efforts to find the most objective information I could find, it appears to be a lot like Saint Nickolas - a real thing, with a LOT of hype and fiction built up around it.
The "m" in dBm is milliwatts. So "dBm - power (in Watts)" is means "dB milliwatts in watts". Much like saying "MPH - speed (in feet per hour)".