I've actually had some organic produce items last about 2-3 times LONGER on the shelf than the other stuff. A lot of organic stuff doesn't have as much preservatives, so there are lifetime concerns. The Nature's Own 100% Whole Wheat you buy is among the best. I'm a sucker for Martin's Potato Roll bread, tho:)
I've had great success with the Martin's bread shelf life. I've had organic apples in my fridge for 4 days without dying, versus 3 days with the others which showed serious signs of aging on day 3.
Your comment about restaurants is quite accurate. Likely, the combination of cook-it-yourself and portion control was the largest factor in yours and the parent poster's results. It's good stuff. Congrats!
Thankfully places like Whole Foods exist for some of us. For an elite few in North Carolina, we have Earth Fare. Earth Fare was one of the first to ban anything with high fructose corn syrup from their shelves.
Harris Teeter, also isolated to the mid-southeast region, has a growing selection of organic products as well as their own "HT Naturals" line. I vote with my wallet and buy 99% of my stuff from the organic lines. "No ecosystem is without waste", however, so some things I buy aren't organic, but I make a point to not buy anything specifically with HFCS in it. (Well except for one small item.)
My grandmother shops Ingles in her area but it, too, is a mid-southeast chain. They are now carrying a small, but growing, selection of organic foods.
Any respectable grocer will have a 'feature request' form you can fill out. Stop by the customer service desk and ask them for organic stuff. One popular organic brand is Horizon Organic. Many organic lines also directly benefit the growers of these prodcuts so you can rest assured that the grower is getting a fair price and not being submitted to the Wal-Mart abuse.
It can be done, but it's tough and it's gonna cost. But if you're dedicated to the ideal, you can make your vote be heard. To further 'prove' the point to the grocers, you should apply for their respective "cult cards" (Harris Teeter VIC, Ingles Advantage, etc). These are shopping trend and tracking devices which tell the bean counters that you actually care about your items. Of course, you get to save a bundle (and not just on car insurance). My single self has has 'saved' (or cost-avoided) $353 year-to-date.
I dropped CSI:M off my TiVo at the first season's finale. I suffered and gave it a chance, but it was too horrible. CSI:NY didn't make it past episode 4 I think.
CSI:LV is the *only* CSI. Which is why it's called "CSI".
Use a client that has privacy options Gaim and don't forget to get the encrypt plug-in. Both work on Windows and unix variants. Gaim can be persuaded to work on OS X but the encrypt plugin is a different beast in that regard (would need more persuasion).
Well that depends. In some circles, one could argue that China and the US would inevitably join forces as a global super-power. This is exemplified in the series Firefly. It is certainly an interesting theory.
There was an episode where they had a competition to develop a new fuel thing, and Jessie smuggled moonshine in his car driving it to the show. He ran the engine off of moonshine so that Boss Hog and Sheriff couldn't find it when they tore his car apart looking for it.
If it wasn't a few tangents from the article topic, I'd scream MOD PARENT UP!! But I'll just settle for Steve, LnxAddct, you are the man! Superb and fantastic!
I'm glad to know someone else has such compelling logical arguments against the insane inanity. (no that's not a double-typo).
We are not out of IP addresses. That's a fallacy. Just read the link in parent's comment. Just recently, even, IANA released three "reserved"/8 blocks: 71/8, 72/8 and I think 73/8. These are all swip'd to the cable broadband monkeys. Many of us/you have 71.x.x.x IPs now.
I don't think it's entirely a "just don't care" attitude, but more of a "i'd rather spend my time doing $foo rather than fuck with my TV computing device". Oh sure the vast majority of geeks here can do the above-mentioned MythTV hack, but it'd just be silly given that TiVo is a very very viable solution (despite some recent issues).
Sadly, I do beleive the cable companies are using unfair practices to lock out DVR competition so they can float their own (often less functional) device locked down to their delivery medium. Why this hasn't gone straight to the SCOTUS is beyond me. (Cable companies should be wholesale convicted monopolies and seriously seriously spanked. Hard. With a very sharp razor-thin whip.)
Nonetheless, so long as a decent "i don't have to fuck with it at 4am" appliance exists, then the more complex devices will be less than mainstream. The better technology doesn't always win. (vhs v. beta, cisc v. risc, dos v. unix, nomad et. al. v. ipod,...)
Hence free market economy (excepting the above-mentioned cable rant).
Apple wasn't a convicted monopoly, either. They don't have a monopoly *AND* unfairly try to maintain that monopoly. Despite popular opinion, you *CAN* have a monopoly in the United States. You just can't do things to block existing and future competition from entering or competing in your market.
If no one likes the iPod, they can always go buy a Nomad or something else. There is mp3 player competition.
There is also portable video competition, but that market is so fresh and new that Apple certainly can (and will) have a monopoly. You can argue the 'leveraging' aspect. However, the legality becomes a problem if/when Apple uses unfair tactics to maintain their monopoly. That is when the DoJ steps in and generally spanks them.
Very true. However, I wonder if the grandparent poster was referring more to a out of nasal congestion. That can often lead to cold-like symptoms including runny nose, sneezing, sinus pressure, and even aches and pain. I recently had some congestion in my sinusoidal cavities and it took about a week and a half to get it all cleared and drained. It sucked.
I got it from wild temperature and humidity changes over a three day period (house -> outside in heat -> hot car -> cooled car with a/c -> outside in heat -> inside a/c store -> back outside -> back inside hot car -> coold car -> outside in heat -> house).
I did that above routine many many times over that weekend. By the following Tuesday I felt like crap. But I didn't have a real "cold" per se.
YES! PLEASE mod parent up! I agree one hundred thousand thousand thousand percent. (Well, don't mod parent up because of *my* opinion, but rather because his/her/its comment is dead-on accurate).
Except, of course, when you have to 'upgrade' your TV card (or whatever) to support certain new channels (or even if it just dies), and then the "new" card now enforces DRM crap in hardware (it's inevitable). Then you're no better off than TiVo, etc. Only a year or so behind.
The best bet is a.b.m on Usenet. Period. Grab the Xvid or VCD images and watch them with your Myth-a-like device.
It sucks, but it's also the truth:(
Re:Slowing down dictionary attacks
on
OpenSSH 4.2 released
·
· Score: 4, Informative
Bah, I should clarify (sorry for not doing this first and sounding like an ass):
By accepting only non-syn packets, you are opening yourself up to "ACK" attacks and old-school router-penetrating scans. Also, things like 'ippacket' can forge packets by setting arbitrary bits. If the 'ack' flag is set (or in the case of your rule, anything including RST, PSH, URG, and even the two reserved bits), then the packet will zing right through your rule.
In this instance, the packet will pass thru the firewall, on to the destination host, which will then reply accordingly:
* If the port is not open, it will reply with ICMP Port Unreach (Type 3, Code 3) signifying a host is alive.
* If the port is open and these flags don't make sense to the host (invalid ACK window, or a FIN/ACK received without a FIN, or an ACK without a SYN, etc) then the host will reply with RST for that port. Implying the host is alive and that port is open.
These responses will only lead to further probes, etc.
For those who preach NAT until the cows come home, this will still happen because your firewall is still gonna un-NAT it and send it onward.
NAT will offer no protection in this situation. (and please do remember that the entire intar-web-net doesn't run on NAT. NAT is not a magical security tool and offers very little advantage with a magnatude of disadvantages, especially for high-load servers)
The state table checks, first, to see if the packet parameters match what has already transpired, session-wise. You can adjust the state timeouts to decrease or increase the time a session will remain 'open'. Now if the sessions are closed, it's removed from the state table period. No reply attacks, etc. The classic "Mitnick" attack will be avoided, too.
The state has expectations of how the packets flowing through should be handled. If you put the "-m state" checks very early in your ruleset, watch it with "watch iptables -L INPUT -nv" and then watch with 'iptstate' in another window. You'll see the first packet of a session (the initial SYN) will go thru the ruleset and be placed in the state table (upon being accepted of course)
EVERY packet from now until the final FIN/FIN-ACK will be matched against the state table in memory. The rule you are watching will only have ONE hit (for that session) even if you're transferring billions of bytes. The remainder is checked against the state table. It's very very cool and very very efficient and quite fast.
Anyhoo.. just wanted to clarify *why* you shouldn't use the ! --syn parameter.
Slashdot Mirror
\what
\\the
\\\fuck
\\\\does
\\\this
\\\shit
\\mean
\?
Very good point about 'preservation'.
:)
I've actually had some organic produce items last about 2-3 times LONGER on the shelf than the other stuff. A lot of organic stuff doesn't have as much preservatives, so there are lifetime concerns. The Nature's Own 100% Whole Wheat you buy is among the best. I'm a sucker for Martin's Potato Roll bread, tho
I've had great success with the Martin's bread shelf life. I've had organic apples in my fridge for 4 days without dying, versus 3 days with the others which showed serious signs of aging on day 3.
Your comment about restaurants is quite accurate. Likely, the combination of cook-it-yourself and portion control was the largest factor in yours and the parent poster's results. It's good stuff. Congrats!
Thankfully places like Whole Foods exist for some of us. For an elite few in North Carolina, we have Earth Fare. Earth Fare was one of the first to ban anything with high fructose corn syrup from their shelves.
Harris Teeter, also isolated to the mid-southeast region, has a growing selection of organic products as well as their own "HT Naturals" line. I vote with my wallet and buy 99% of my stuff from the organic lines. "No ecosystem is without waste", however, so some things I buy aren't organic, but I make a point to not buy anything specifically with HFCS in it. (Well except for one small item.)
My grandmother shops Ingles in her area but it, too, is a mid-southeast chain. They are now carrying a small, but growing, selection of organic foods.
Any respectable grocer will have a 'feature request' form you can fill out. Stop by the customer service desk and ask them for organic stuff. One popular organic brand is Horizon Organic. Many organic lines also directly benefit the growers of these prodcuts so you can rest assured that the grower is getting a fair price and not being submitted to the Wal-Mart abuse.
It can be done, but it's tough and it's gonna cost. But if you're dedicated to the ideal, you can make your vote be heard. To further 'prove' the point to the grocers, you should apply for their respective "cult cards" (Harris Teeter VIC, Ingles Advantage, etc). These are shopping trend and tracking devices which tell the bean counters that you actually care about your items. Of course, you get to save a bundle (and not just on car insurance). My single self has has 'saved' (or cost-avoided) $353 year-to-date.
It works. It can be done.
two, one, one, two...that's 6.
:)
Dude, wear a condom! Pulling out didn't work did it?
If parent weren't an AC, I'd say mod parent up but...
:)
oh what the hell,
MOD PARENT UP!
But yes, the AC has explained exactly what I've tried to tell people for years now, has have my cluefull friends.
186 comments, and nearly all moded +Funny.
:)
I don't think this thread will have a single non-funny
Damnit! I'm *WHITE*, not "caucasian". I never have been to, nor am from, the land/province of "Caucasia".
What the hell is wrong with this planet. My skin is pale, white, whatever. Call me a cracker, whatever. But damnit, don't call me "caucasian".
Is this an RFC or some kind of dissenting argument? :)
Imagine a beowulf cluster of bionic hands!
I, for one, welcome our new bionic hand overlords!
Oblig! Oblig! Blig?
I dropped CSI:M off my TiVo at the first season's finale. I suffered and gave it a chance, but it was too horrible. CSI:NY didn't make it past episode 4 I think.
CSI:LV is the *only* CSI. Which is why it's called "CSI".
Do you people not turn on the Privacy options in Gaim?
Tools -> Privacy -> Only people on my buddy list -> OK
Use a client that has privacy options
Gaim and don't forget to get the encrypt plug-in. Both work on Windows and unix variants. Gaim can be persuaded to work on OS X but the encrypt plugin is a different beast in that regard (would need more persuasion).
Well that depends. In some circles, one could argue that China and the US would inevitably join forces as a global super-power. This is exemplified in the series Firefly. It is certainly an interesting theory.
There was an episode where they had a competition to develop a new fuel thing, and Jessie smuggled moonshine in his car driving it to the show. He ran the engine off of moonshine so that Boss Hog and Sheriff couldn't find it when they tore his car apart looking for it.
I'm an 80s kid and I just showed my age...
"Oh boy".
(hah! a double pun...)
If it wasn't a few tangents from the article topic, I'd scream MOD PARENT UP!! But I'll just settle for Steve, LnxAddct, you are the man! Superb and fantastic!
I'm glad to know someone else has such compelling logical arguments against the insane inanity. (no that's not a double-typo).
Thank you!
Three admins? 60 buildings? 3000+ nodes?
Dude, I can name 4 people in my county that need jobs. If your company can afford that much hardware and pain, then you can afford 4 more admins.
PLEASE hire someone!
I'm the farthest from a Microsoft apologist ( i hate them ), but
/. a few weeks ago. The official site is: http://research.microsoft.com/os/singularity/
They have the Singularity kernel in development, as pointed out here on
So perhaps they are moving in such a direction.
We are not out of IP addresses. That's a fallacy. Just read the link in parent's comment. Just recently, even, IANA released three "reserved" /8 blocks: 71/8, 72/8 and I think 73/8. These are all swip'd to the cable broadband monkeys. Many of us/you have 71.x.x.x IPs now.
So no, we are not out of IPs. There are plenty.
Acutally, I like "Yahoogle!"
I don't think it's entirely a "just don't care" attitude, but more of a "i'd rather spend my time doing $foo rather than fuck with my TV computing device". Oh sure the vast majority of geeks here can do the above-mentioned MythTV hack, but it'd just be silly given that TiVo is a very very viable solution (despite some recent issues).
...)
Sadly, I do beleive the cable companies are using unfair practices to lock out DVR competition so they can float their own (often less functional) device locked down to their delivery medium. Why this hasn't gone straight to the SCOTUS is beyond me. (Cable companies should be wholesale convicted monopolies and seriously seriously spanked. Hard. With a very sharp razor-thin whip.)
Nonetheless, so long as a decent "i don't have to fuck with it at 4am" appliance exists, then the more complex devices will be less than mainstream. The better technology doesn't always win. (vhs v. beta, cisc v. risc, dos v. unix, nomad et. al. v. ipod,
Hence free market economy (excepting the above-mentioned cable rant).
Apple wasn't a convicted monopoly, either. They don't have a monopoly *AND* unfairly try to maintain that monopoly. Despite popular opinion, you *CAN* have a monopoly in the United States. You just can't do things to block existing and future competition from entering or competing in your market.
If no one likes the iPod, they can always go buy a Nomad or something else. There is mp3 player competition.
There is also portable video competition, but that market is so fresh and new that Apple certainly can (and will) have a monopoly. You can argue the 'leveraging' aspect. However, the legality becomes a problem if/when Apple uses unfair tactics to maintain their monopoly. That is when the DoJ steps in and generally spanks them.
Hope that helps. I'm going back to bed.
Very true. However, I wonder if the grandparent poster was referring more to a out of nasal congestion. That can often lead to cold-like symptoms including runny nose, sneezing, sinus pressure, and even aches and pain. I recently had some congestion in my sinusoidal cavities and it took about a week and a half to get it all cleared and drained. It sucked.
I got it from wild temperature and humidity changes over a three day period (house -> outside in heat -> hot car -> cooled car with a/c -> outside in heat -> inside a/c store -> back outside -> back inside hot car -> coold car -> outside in heat -> house).
I did that above routine many many times over that weekend. By the following Tuesday I felt like crap. But I didn't have a real "cold" per se.
Ah the joys of life.
YES! PLEASE mod parent up! I agree one hundred thousand thousand thousand percent. (Well, don't mod parent up because of *my* opinion, but rather because his/her/its comment is dead-on accurate).
Except, of course, when you have to 'upgrade' your TV card (or whatever) to support certain new channels (or even if it just dies), and then the "new" card now enforces DRM crap in hardware (it's inevitable). Then you're no better off than TiVo, etc. Only a year or so behind.
:(
The best bet is a.b.m on Usenet. Period. Grab the Xvid or VCD images and watch them with your Myth-a-like device.
It sucks, but it's also the truth
Bah, I should clarify (sorry for not doing this first and sounding like an ass):
By accepting only non-syn packets, you are opening yourself up to "ACK" attacks and old-school router-penetrating scans. Also, things like 'ippacket' can forge packets by setting arbitrary bits. If the 'ack' flag is set (or in the case of your rule, anything including RST, PSH, URG, and even the two reserved bits), then the packet will zing right through your rule.
In this instance, the packet will pass thru the firewall, on to the destination host, which will then reply accordingly:
* If the port is not open, it will reply with ICMP Port Unreach (Type 3, Code 3) signifying a host is alive.
* If the port is open and these flags don't make sense to the host (invalid ACK window, or a FIN/ACK received without a FIN, or an ACK without a SYN, etc) then the host will reply with RST for that port. Implying the host is alive and that port is open.
These responses will only lead to further probes, etc.
For those who preach NAT until the cows come home, this will still happen because your firewall is still gonna un-NAT it and send it onward.
NAT will offer no protection in this situation. (and please do remember that the entire intar-web-net doesn't run on NAT. NAT is not a magical security tool and offers very little advantage with a magnatude of disadvantages, especially for high-load servers)
The state table checks, first, to see if the packet parameters match what has already transpired, session-wise. You can adjust the state timeouts to decrease or increase the time a session will remain 'open'. Now if the sessions are closed, it's removed from the state table period. No reply attacks, etc. The classic "Mitnick" attack will be avoided, too.
The state has expectations of how the packets flowing through should be handled. If you put the "-m state" checks very early in your ruleset, watch it with "watch iptables -L INPUT -nv" and then watch with 'iptstate' in another window. You'll see the first packet of a session (the initial SYN) will go thru the ruleset and be placed in the state table (upon being accepted of course)
EVERY packet from now until the final FIN/FIN-ACK will be matched against the state table in memory. The rule you are watching will only have ONE hit (for that session) even if you're transferring billions of bytes. The remainder is checked against the state table. It's very very cool and very very efficient and quite fast.
Anyhoo.. just wanted to clarify *why* you shouldn't use the ! --syn parameter.