BTW go read the transcripts of the deposition. When the lawyers for what's her face asked Bill weather or not he had sex with monica there was a long discussion about what they meant by sex. The republicans had drafted this lengthy document about what constituted sex and what didn't and like morons they did not include oral sex as sex. So Bill said he did not have sex with her as was defined in the document and therefore it was not a lie.
Really I am not kidding go read the transcripts it's very funny the had a chance to crucify him and blew it.
Also The Bush aldmnistration has laready told more lies and flipped on more issued then Bill did.
Korea, palestine, global warming, cyanide, ABM, kosovo all those positions Dubya took in the election and right after taking office are now being reversed 180 degrees. He is a bigger waffler then his dad was.
No I am not. Sorry the web is full of people who have nothing better to do then to hack into peoples computers just for fun. Not for altruism, not for profit just to have some fun and cause some damage.
Yes of course holding script kiddies responsible for their actions is exactly like shooting old ladies who have accidentally wondered into your property.
Bullshit. Loitering is against the law. The job of the police is to enforce the law and safeguard the citizens. If a citizen is feeling threatened by a suspicious person hanging around their neighborhood circling peoples houses and taking pictures of them it's the duty of the police to investigate who this person is and what they are doing.
You just want to commit crimes without the police getting in your face about it, so you whine about abuse of power. The real abuse of power is some script kiddie running a DDOS just because they can, or cracking into some system just because it's fun. Some people have no conscience and others are able to justify any destructive act they may have committed with pseudo political rants. We just put one of those guys in the grave today (McVeigh in case you never leave your computer) and I hope we put all the script kiddies in their place too. Behind bars.
Well sure it's in the INTENT. If I have a DHCP server then my INTENT is that this server serve my network. If OTOH a random person portscans my machine what possible INTENT might they have except to see if they can break in? The INTENT of 99% of portscanners is to break into your system if they can. What other possible INTENT could they have?
BTW apparantly you are not able to grasp the difference between the INTENT of a DHCP server or client (set up by me) to probe a specific port and the INTENT of a script kiddie to scan every port on every system on your network.
Internet started with a small set of highly trusted people and hosts. All of the core internet protocols have this trust presumption built into them. It's not the same world now. Sorry.
The days of leaving your server open to mail relay, rpc etc are long gone and will never come back thanks to the legion of script kiddies who have nothing to do but crack other machines and launch DDOS attacks against anybody they want to.
So no you may NOT presume that I am giving you something. You may NOT presume that any service I have on my machine is for you. Do not try to connect to my machine unless you know there is a service there AND have been told so via advertising, links, email, phone or otherwise that you are welcome it.
It's my machine and you keep your hands off it.
You have no reason to port scan me. NONE. If you are port scanning me it can only mean you mean to crack it.
Because logs are for after the fact. Logs don't prevent you from being hacked. Sure you can take precautions and you should but tripwire will tell you after the fact that you have been hacked. There is always cause to be afraid.
Hackers will attack your system via exploits that may not be known to you or even to the general public. There is always some delay between a hack being discovered and being published and fixed. So that "necessary" port may be sitting duck for a buffer exploit and you don't even know it yet. Also any hacker anywhere in the world can DOS you with off the shelf kits and there is nothing you can do about it.
I will restate. Anybody who is doing a portscan of your system is most probably looking to crack it. Maybe one or two percent of portscans are accidents or legitamate but the vast majority of them are people who are looking to take over your machine and commit crimes. If you detect a portscan you can be 99% sure the person who just portscanned you was looking to see they could break in. They have criminal intent.
Just because people are ripping of their employees that does not mean the portscanners should get a free ride. People do have the capability to worry about more then one security problem at a time. Some breaches are due to internal employees and some breaches are due to external hackers.
Just as internal employees are punished severely if caught so should the portscanners and the hackers.
Oh BTW are you seriously suggesting that crackers don't start with a nmap first thing? They just let loose with an attack on a random port without first checking to see if that port is available?
99 percent of all port scans being done are a prelude to an attack on your system. If somebody is portscanning your system you can be 99% sure they are looking to break into your system.
"And what about the suggestion that portscans should be used to verify the security claims of ISPs before subscribing."
Simple. Call up the ISP and ask for permission to do a portscan. If they don't let you move, on to another one.
You are speaking the microsoft doublespeak. Sure.NET platform is available for VC++ or foxpro but that is only good for any new apps you may want to write. All of your existing apps have to be re-written. You can not take an existing VC++ or foxpro app and have it run on the.net platform. You have to go back and re-write the app from scratch.
Unfortunately this is a slippery slope argument. What If I lock my door but the lock can be jimmied easaliy? What if somebody on the internet developes a skeleton key which now opens every lock with that brand? Now what? I locked my door like a responsible citizen but some script kiddie got a hold of a skeleton key and ransacked my house. Is it still my fault?
The problem is that even though you may be relatively responsible person there are bound to be security hacks that you don't know about. The burden should not be on me. IT should be on the person doing the breaking and entering. You can't just say but you should have changed your lock, it was known for three days that this skeleton key was in circulation.
"a lot of people who do have a good reason to scan there "
the only persons who have a good reason to scan are me and ony persons that I give specific permission to. Everybody else is doing it because they are trying to see if they can hack into my system.
Yup. As in don't come to my house unless you are invited. I am under no obligation to provide web services for you and unless I have told you that I am you should not check. Just presume I am not and go on your merry way. You have no right to check to see what I am providing to whom.
"Trying doors and windows: Using packaged exploits (parallels: It's easy; if it succeeds you are now able to walk around and do what you want; and any responsible person would have taken the simple measures to prevent its effectiveness)"
Nevertheless this could get you arrested. If you actually walk in then it's breaking and entering. Trying the door is actually trespassing because at that moment you are in my property. It could be argued that the minute you leave the sidewalk you are tresspassing in my property. The analog of that might be that the minute you probe a port without an advertised service you are a criminal.
BTW if you are in some neighborhood and are going around houses and taking pictures (you are logging your portscan right?) and such people will call the police. The police might take you downtown and have a talk with you. If you are able convince them that you are simply studying architecture then they'll probably let you go. If they don't buy it they will tell you to move along and file a report.
I just want the same right. If I see you portscan me I want to be able to call the police.
"Without portscanning, how do you find out what services a host provides to the public?"
Here is a novel idea.
Presume that there is no public services unless you have been told about them by the people who own the server. They are not obligated to provide you with anything. If a service is not advertised or nobody told you about it why are you looking for it?
Why are you seeing if a port is open? Better yet why do you want to know about the status of every single port on my machine? DO I know you? Did I say I was going to provide some service for you on my computer? Did I tell you about some service and forget to tell you the port?
Be honest. People running portscans are doing it because they want to hack your machine.
All cracks start with a portscan. Maybe in the one to two percent of the cases a portscan is done for benign reasons but really even you have to admit that most of the people portscanning you want to see if they can break in. Use portsentry and black hole people who portscan you. You'll see how many of them complain that they can't finish their portscan.
"Port scanning has nothing to do with breaking in."
You have got to be kidding me. Every hack starts with a portscan. When you say "looking" what you really mean is "casing the joint". You are walking around my house and trying to figure out how best to break in. What possible legitemate reason do YOU have for portscanning? If you want to know if I have FTP services for you ask me, better yet presume that it's not there becuase I did not tell you about it. If I wanted you to access my computer via FTP I would have let you know.
Also It's one thing wonder about wheather or not I have an FTP server and it's another to scan every single port on my machine. What is your justification for that?
I tell people to use portsentry. That way they can immediately blackhole anybody who does a portscan. Anybody who does a portscan is doing it because they want to hack your system. There is no other reason to do one.
These days the astro turfers outnumber the open source advocates. Look at the previous set of MS topics and you will see every single +5 moderated post is a pro MS post. The best way to get your karma up to 50 on slashdot is to say something nice about Bill gates or his company.
Of course anybody like me who points out this indisputable fact (go check for yourself) will get moderated down but I got karma to blow and can always get it back up by saying something nice about MS.
Postgres is great but it's really hard to set up in a windows environment. You can also use interbase which is equally at home in windows and linux. As a bonus it is supported by klyx and delphi natively.
Just a few points of clarification.
The VB from.NET is vastly different then the VB you are used to. You are pretty much going to have to learn a new language. VB.NET is to VB what C# is to C or C++. They may seem similar but all of your apps will have to be re-written from scratch.
Also the.NET platform will never support any language that MS does not like *cough* java *cough*.
And of course.NET is not cross platform.
I find all this talk of language independence very very funny. COnsider this.
Vast majority of the windows applications in this world are written in VC++, or VB or Delphi. Throw in java and you have the four most popular languages in the world. The.NET platform does not support any of them!. Every single app written in those languages has to be completely re-written from the ground up to work in the.NET platform in either c# or vb.net (I am presuming of course the eiffel# will not be such a huge draw).
Slashdot Mirror
Zdnet, devx, microsoft.com asphole etc are all very heavily pro MS. For every slashdot there are a hundred MSdots.
BTW go read the transcripts of the deposition. When the lawyers for what's her face asked Bill weather or not he had sex with monica there was a long discussion about what they meant by sex. The republicans had drafted this lengthy document about what constituted sex and what didn't and like morons they did not include oral sex as sex. So Bill said he did not have sex with her as was defined in the document and therefore it was not a lie.
Really I am not kidding go read the transcripts it's very funny the had a chance to crucify him and blew it.
Also The Bush aldmnistration has laready told more lies and flipped on more issued then Bill did.
Korea, palestine, global warming, cyanide, ABM, kosovo all those positions Dubya took in the election and right after taking office are now being reversed 180 degrees. He is a bigger waffler then his dad was.
No I am not. Sorry the web is full of people who have nothing better to do then to hack into peoples computers just for fun. Not for altruism, not for profit just to have some fun and cause some damage.
Yes of course holding script kiddies responsible for their actions is exactly like shooting old ladies who have accidentally wondered into your property.
Bullshit. Loitering is against the law. The job of the police is to enforce the law and safeguard the citizens. If a citizen is feeling threatened by a suspicious person hanging around their neighborhood circling peoples houses and taking pictures of them it's the duty of the police to investigate who this person is and what they are doing.
You just want to commit crimes without the police getting in your face about it, so you whine about abuse of power. The real abuse of power is some script kiddie running a DDOS just because they can, or cracking into some system just because it's fun. Some people have no conscience and others are able to justify any destructive act they may have committed with pseudo political rants. We just put one of those guys in the grave today (McVeigh in case you never leave your computer) and I hope we put all the script kiddies in their place too. Behind bars.
Well sure it's in the INTENT. If I have a DHCP server then my INTENT is that this server serve my network. If OTOH a random person portscans my machine what possible INTENT might they have except to see if they can break in? The INTENT of 99% of portscanners is to break into your system if they can. What other possible INTENT could they have?
BTW apparantly you are not able to grasp the difference between the INTENT of a DHCP server or client (set up by me) to probe a specific port and the INTENT of a script kiddie to scan every port on every system on your network.
Yes I agree though it's all in the INTENT.
Internet started with a small set of highly trusted people and hosts. All of the core internet protocols have this trust presumption built into them. It's not the same world now. Sorry.
The days of leaving your server open to mail relay, rpc etc are long gone and will never come back thanks to the legion of script kiddies who have nothing to do but crack other machines and launch DDOS attacks against anybody they want to.
So no you may NOT presume that I am giving you something. You may NOT presume that any service I have on my machine is for you. Do not try to connect to my machine unless you know there is a service there AND have been told so via advertising, links, email, phone or otherwise that you are welcome it.
It's my machine and you keep your hands off it.
You have no reason to port scan me. NONE. If you are port scanning me it can only mean you mean to crack it.
Because logs are for after the fact. Logs don't prevent you from being hacked. Sure you can take precautions and you should but tripwire will tell you after the fact that you have been hacked. There is always cause to be afraid.
Hackers will attack your system via exploits that may not be known to you or even to the general public. There is always some delay between a hack being discovered and being published and fixed. So that "necessary" port may be sitting duck for a buffer exploit and you don't even know it yet. Also any hacker anywhere in the world can DOS you with off the shelf kits and there is nothing you can do about it.
I will restate. Anybody who is doing a portscan of your system is most probably looking to crack it. Maybe one or two percent of portscans are accidents or legitamate but the vast majority of them are people who are looking to take over your machine and commit crimes. If you detect a portscan you can be 99% sure the person who just portscanned you was looking to see they could break in. They have criminal intent.
Just because people are ripping of their employees that does not mean the portscanners should get a free ride. People do have the capability to worry about more then one security problem at a time. Some breaches are due to internal employees and some breaches are due to external hackers.
Just as internal employees are punished severely if caught so should the portscanners and the hackers.
Oh BTW are you seriously suggesting that crackers don't start with a nmap first thing? They just let loose with an attack on a random port without first checking to see if that port is available?
99 percent of all port scans being done are a prelude to an attack on your system. If somebody is portscanning your system you can be 99% sure they are looking to break into your system.
"And what about the suggestion that portscans should be used to verify the security claims of ISPs before subscribing."
Simple. Call up the ISP and ask for permission to do a portscan. If they don't let you move, on to another one.
Anybody can DOS you anytime they want. There is nothing you can do about it.
Portsentry listens on ports you tell it to and when it detects a scan it can immediately run an ipchains rule to blakhole your ip address.
You are speaking the microsoft doublespeak. Sure .NET platform is available for VC++ or foxpro but that is only good for any new apps you may want to write. All of your existing apps have to be re-written. You can not take an existing VC++ or foxpro app and have it run on the .net platform. You have to go back and re-write the app from scratch.
Unfortunately this is a slippery slope argument. What If I lock my door but the lock can be jimmied easaliy? What if somebody on the internet developes a skeleton key which now opens every lock with that brand? Now what? I locked my door like a responsible citizen but some script kiddie got a hold of a skeleton key and ransacked my house. Is it still my fault?
The problem is that even though you may be relatively responsible person there are bound to be security hacks that you don't know about. The burden should not be on me. IT should be on the person doing the breaking and entering. You can't just say but you should have changed your lock, it was known for three days that this skeleton key was in circulation.
"a lot of people who do have a good reason to scan there "
the only persons who have a good reason to scan are me and ony persons that I give specific permission to. Everybody else is doing it because they are trying to see if they can hack into my system.
Yup. As in don't come to my house unless you are invited. I am under no obligation to provide web services for you and unless I have told you that I am you should not check. Just presume I am not and go on your merry way. You have no right to check to see what I am providing to whom.
"Trying doors and windows: Using packaged exploits (parallels: It's easy; if it succeeds you are now able to walk around and do what you want; and any responsible person would have taken the simple measures to prevent its effectiveness)"
Nevertheless this could get you arrested. If you actually walk in then it's breaking and entering. Trying the door is actually trespassing because at that moment you are in my property. It could be argued that the minute you leave the sidewalk you are tresspassing in my property. The analog of that might be that the minute you probe a port without an advertised service you are a criminal.
I guess it's intent then huh?
BTW if you are in some neighborhood and are going around houses and taking pictures (you are logging your portscan right?) and such people will call the police. The police might take you downtown and have a talk with you. If you are able convince them that you are simply studying architecture then they'll probably let you go. If they don't buy it they will tell you to move along and file a report.
I just want the same right. If I see you portscan me I want to be able to call the police.
"Without portscanning, how do you find out what services a host provides to the public?"
Here is a novel idea.
Presume that there is no public services unless you have been told about them by the people who own the server. They are not obligated to provide you with anything. If a service is not advertised or nobody told you about it why are you looking for it?
If he wanted you to play his game he would have told you about the port.
Why are you seeing if a port is open? Better yet why do you want to know about the status of every single port on my machine? DO I know you? Did I say I was going to provide some service for you on my computer? Did I tell you about some service and forget to tell you the port?
Be honest. People running portscans are doing it because they want to hack your machine.
All cracks start with a portscan. Maybe in the one to two percent of the cases a portscan is done for benign reasons but really even you have to admit that most of the people portscanning you want to see if they can break in. Use portsentry and black hole people who portscan you. You'll see how many of them complain that they can't finish their portscan.
"Port scanning has nothing to do with breaking in."
You have got to be kidding me. Every hack starts with a portscan. When you say "looking" what you really mean is "casing the joint". You are walking around my house and trying to figure out how best to break in. What possible legitemate reason do YOU have for portscanning? If you want to know if I have FTP services for you ask me, better yet presume that it's not there becuase I did not tell you about it. If I wanted you to access my computer via FTP I would have let you know.
Also It's one thing wonder about wheather or not I have an FTP server and it's another to scan every single port on my machine. What is your justification for that?
I tell people to use portsentry. That way they can immediately blackhole anybody who does a portscan. Anybody who does a portscan is doing it because they want to hack your system. There is no other reason to do one.
These days the astro turfers outnumber the open source advocates. Look at the previous set of MS topics and you will see every single +5 moderated post is a pro MS post. The best way to get your karma up to 50 on slashdot is to say something nice about Bill gates or his company.
Of course anybody like me who points out this indisputable fact (go check for yourself) will get moderated down but I got karma to blow and can always get it back up by saying something nice about MS.
Postgres is great but it's really hard to set up in a windows environment. You can also use interbase which is equally at home in windows and linux. As a bonus it is supported by klyx and delphi natively.
Just a few points of clarification. .NET is vastly different then the VB you are used to. You are pretty much going to have to learn a new language. VB.NET is to VB what C# is to C or C++. They may seem similar but all of your apps will have to be re-written from scratch.
.NET platform will never support any language that MS does not like *cough* java *cough*.
.NET is not cross platform.
.NET platform does not support any of them!. Every single app written in those languages has to be completely re-written from the ground up to work in the .NET platform in either c# or vb.net (I am presuming of course the eiffel# will not be such a huge draw).
The VB from
Also the
And of course
I find all this talk of language independence very very funny. COnsider this.
Vast majority of the windows applications in this world are written in VC++, or VB or Delphi. Throw in java and you have the four most popular languages in the world. The