Slashdot Mirror


User: SanityInAnarchy

SanityInAnarchy's activity in the archive.

Stories
0
Comments
12,413
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 12,413

  1. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    there is no such thing as a trusted network.

    I'd say the switch on my desk with exactly two boxes plugged into it is "trusted".

    It is this kind of foolish thinking (yes, please keep using clear text authentication), that keeps us real security professionals in business.

    When it's truly foolish -- for example, on a larger (corporate) network or over the Internet -- I second that sentiment, if only in that it makes you a softer target than me.

  2. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    In this case, not well -- but neither do any of the other things suggested.

    However, there are things that work well against wrenches. Here's a quick list:

    • Dead-man's switch -- if I'm not in contact for a certain amount of time, cut my access and force me to physically go there to gain access.
    • Panic password -- input the wrong one and my access is nuked.
    • Full-disk encryption, combined with panic password and/or too many tries. Input the right password and you get in. Input the wrong one and it nukes the key and/or ignites thermite.
    • Combine above with a TPM system to hold the key, so they can't simply create a disk image, and a tamper-sensitive case, to activate thermite if they try.
    • Run full-disk encryption inside the free space in another filesystem. You can do this recursively, so even if the wrench works, they can never be sure thatit worked -- there could always be another encrypted drive hidden in the last encrypted drive.
  3. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    any vulnerable computer on your lan makes all the rest of the computers vulnerable as well.

    Let me spell it out for you:

    Right now, my LAN is a switch, with two things plugged into it: My server and my laptop. If either of those are compromised, I'm hosed anyway.

    If I were to plug a vulnerable machine in, it's still a switched network, which means sniffing is impossible -- they'd have to actively MITM me, somehow without my server noticing. (DNS tricks are right out, as I refer to the server by IP.)

  4. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    Nope. I'm unemployed because the startup I was working for failed.

  5. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    Well, it's a potential vulnerability. Granted, no one's going to be able to get it with physical access, but take, for example, a system like Keychain, on OS X -- or KWallet, or GNOME has something similar.

    Sure, if they can capture keystrokes, or if they can piggyback on a program which has access to the keychain, you're hosed. But it's entirely possible that they wouldn't -- for example, if they've just SSH'd in, they'd have to either crack the keychain, or trick you into allowing them into an open keychain.

    Last I checked, svn basically refused to implement anything like this.

  6. Re:Yes, but watch for... on Verizon Refuses To Provide Complete IPv6 · · Score: 1

    What I would hope is that websites start getting aggressive at banning IPs of abusers anyway, even if there are false positives. Including an explanation of why, say, AOL is blocked might cause customers to complain to AOL.

  7. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 2, Insightful

    Let's see...

    don't forget to keep it updated.

    Done.

    do not use FTP based on normal user passwords.

    I don't use FTP.

    And HTTP based on normal user passwords.

    I don't have any HTTP service that I need http-auth for.

    And turn off rsh. And turn off telnet.

    What distro are you using that has these on by default?

    And make sure people don't use the same passwords for your critical servers and their external bank accounts and web services.

    I'm the only one with ssh to this box. And this article has scared me into disabling PasswordAuthentication -- not that any of my critical accounts have passwords anyway.

    And rip Subversion and CVS out

    I use Git.

    make sure that your POP and IMAP servers are SSL protected, always.

    I don't use POP, and I only use IMAP over OpenVPN or a LAN. I think OpenVPN > SSL, and I can physically see all computers connected to the LAN switch.

    And make sure that your SMTPAUTH is done enctypred.

    I don't have SMTPAUTH enabled. This is a potential flaw -- if someone can get onto a trusted network. Again, OpenVPN or LAN.

    And make sure that your boss does not send passwords to people via email.

    I'm unemployed.

    Now, you're right that strong passwords aren't nearly as good as strong keys. But they are sufficient, I think.

    Of course, I use a 4096-bit RSA key.

  8. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 1

    The SVN client does store passwords in plaintext.

  9. Re:Outward facing systems ... on Sloppy Linux Admins Enable Slow Brute-Force Attacks · · Score: 4, Informative

    If you've connected to it once, you've got the host's public key.

    Any user who generates their own key will trigger MASSIVE warnings from SSH, just as if you'd been MITM'd any other way.

  10. Re:Yes, but watch for... on Verizon Refuses To Provide Complete IPv6 · · Score: 2, Informative

    95% of the internet does not care or know about having a globally unique IP address will keep NAT a viable solution for a while.

    It used to be that I didn't care about that.

    Then my brother got himself banned from Slashdot by IP (while we were both teenagers).

    At that point, I started caring whether I shared an IP with someone I didn't trust, who was likely to get banned from somewhere. (The first, most obvious change was to convince my brother to stop trolling.)

    It may take awhile, but if people start finding themselves banned from, say, YouTube or Facebook by IP, they'll start caring about NAT.

    There's a reason people move away from AOL.

  11. Re:bullshit on Verizon Refuses To Provide Complete IPv6 · · Score: 1

    Or if you vote with your dollars by switching to another cell network or ISP... that Verizon buys.

  12. Re:host the servers in antigua on The Pirate Bay Sails To a New Home · · Score: 2, Insightful

    Small correction:

    If this were the actual case then Jay-Z could indeed make whatever remix he wanted from the White Album, publish that and he would then enjoy the protection of copyright for the prescribed amount of time.

    Actually, neither Jay-Z nor the Beatles wanted this to happen. It was someone else mixing both of them together.

    Anyway...

    Does this mean that on June 26th, 2014 an individual or company would then start selling copies of Windows 98?

    I don't see why not. In fact, I don't see why Microsoft wouldn't open source Windows 98.

    Now what about Microsoft Windows 98SE? It was first published in 1999, but one can argue that it is simply and updated version of the original. Should it be treated like the nth version of "The Joy of Cooking" and granted a new inception date for the protection of copyright?

    I don't see why not, so long as that doesn't apply to 98 (or the first edition of Joy of Cooking). Kind of like how id software has released the Quake 3 source code, and have almost certainly used that to build the Doom 3 engine, but have not released the Doom 3 source code.

    Now all things being equal, how far should the government go in the prosecution of those violating the protection granted under copyright?

    Well, that's the thing -- copyright used to be a civil matter, not a criminal matter.

    whatever the eventual conclusion it has to be enforced vigorously.

    Still doesn't work.

    I mean, we can argue all day that old movies should be up on Archive.org, but that's not going to stop new movies leaking onto The Pirate Bay before they're even in theaters.

    So, I do agree that copyright should at least be reformed. But as we move forward, there are really only two options:

    Either we, as a society, somehow find our way past this idea that someone needs a monopoly on their work to create that work, and we find a way to reward people without these restrictions...

    Or we start locking things down to the point where the free Internet is a memory.

    I don't really see a middle ground. The only way to vigorously enforce copyright that isn't laughably easy to defeat is pretty totalitarian -- you'd have to only allow approved communication over approved channels with approved devices. Even here, it's possible to defeat, it just gets harder as the tools for reverse engineering and free communication become rarer and less legal.

    The only real solution I see is to trend towards business models which don't presuppose that you'll be able to eradicate piracy -- which, in fact, compete with piracy as though it was a legitimate competitor.

    A simple example, via music: Just go on tour. Even playing bars, you'll likely actually make a living, compared to how little money you'd make working with the RIAA. And the best part is, you're providing an experience which cannot be duplicated -- people can record you all they want, all it does is give you free advertising.

    Another example: MMOs. It's much more difficult to reverse engineer the protocol and write a server from scratch than it is to simply strip DRM out of a single-player game. And even if you can do that, someone has to run the server, and it's likely to be a less populated, less enjoyable server than the legitimate ones.

  13. Re:Is this good news or bad? on Reddit Javascript Exploit Spreading Virally · · Score: 1

    And to reply to "what's it like"...

    For the most part, it's comparable to cable, because most sites aren't particularly fast. For example, my Ubuntu updates usually run at around 100 kilobytes per second.

    But, transferring files across town is exactly like being on a LAN -- speeds of 11 megabytes per second over SSH.

    As for the Internet, there's pretty much no quality of video that anyone's willing to stream that I can't easily handle, and I've seen torrents hit about 3 megabytes per second.

  14. Re:Is this good news or bad? on Reddit Javascript Exploit Spreading Virally · · Score: 1

    They might be working on it -- see youtube.com/html5. However, html5 lacks some basic stuff, like a way to go fullscreen, so it may be awhile yet.

    Actually, I should just change my sig. I was gonna move if I could find a job -- instead, I went back to school. And, this ISP doesn't seem to be enforcing the cap, at least on me, so I don't care.

  15. Re:Good on "Windows 7 Compatible" PCs Must Be 64-bit · · Score: 1

    Huh. I used ctrl+pageup/pagedown, which is supported by just about every tabbed program I've used.

    It doesn't matter much, as I no longer have any reason to use Visual Studio. But at the time, it wasn't just me, but no one on my team had the shortcut I wanted. So, I was forced to use Visual Studio to debug HD-DVD, but I saw pretty much zero advantage to using it over Eclipse for anything except that debugger.

  16. Re:Good on "Windows 7 Compatible" PCs Must Be 64-bit · · Score: 1

    If guess if I need PSP or Photoshop I can just use Gimp right?

    I never suggested that.

    While I think Gimp is fine for most of what people use Photoshop for, and much better than pirating or spending hundreds or thousands of dollars on software, I have seen things Photoshop does better than the Gimp.

    The rest of your list, though, I haven't seen. For example:

    The fact that you would even compare Visual Studio to Eclipse

    So, what does Visual Studio have that Eclipse doesn't?

    FL Studio to the FOSS "equivilents"

    I didn't. I said up front I had no idea what you were talking about. Maybe the FL stands for something I would recognize?

    3DSMax to Blender (possibly the funniest one in the list)

    You're right, I haven't used either.

    However, the people I've spoken to who have used both do tend to prefer Blender...

    And you completely fucking ignored Maya. I seem to remember Maya being the more professional tool, and they have native version for Windows/Mac/Linux.

  17. Re:What would you gain? on Legal Code In a Version Control System? · · Score: 1

    That's well and good once a law is passed, but while a bill is being created, it's changed quite often before it's actually voted on -- and once voted on, it might be rejected, changed, and voted on again.

    It's thus quite possible for a rider to get tacked on at the last minute, and not be noticed, because the bill is already quite huge, and anyone who bothered to read it earlier certainly isn't going to re-read the whole thing now.

    The point of a VCS here would be that even a bill which hasn't yet been passed, and is worded like a patch, you would still be able to read it in its entirety, and then read any changes simply as changes.

  18. Re:Git? on Legal Code In a Version Control System? · · Score: 1

    Indeed.

    The same could be done with SVN, but there just isn't an advantage to using SVN here.

  19. Re:Good on "Windows 7 Compatible" PCs Must Be 64-bit · · Score: 1

    Visual Studio -- Eclipse and KDevelop come to mind. I used Eclipse on Windows, when I had access to visual studio, mostly because I'd spent maybe a half hour looking for a keyboard shortcut to switch between open tabs -- Eclipse had one.

    FL Studio, I don't know what that is.

    3DSMax, Blender. You may claim it has a "dogshit interface", and you almost have a point -- but then, many people prefer it, and its interface.

    Plus there's, oh, Maya.

  20. Re:Good on "Windows 7 Compatible" PCs Must Be 64-bit · · Score: 1

    There are some contrived instances which might benefit significantly - but generally the gains are trivial.

    This was about performance of hacks to allow 32-bit apps and OSes to address more than 4 gigs of RAM. They do, indeed, impact performance.

    none of it means squat without app/driver support.

    Actually, it's the driver support that's a real bitch. App support... A 32-bit app can only address, what, 2 gigs of RAM? Still, that means I only need to be running three memory-hungry apps for it to start to make sense.

    they hope that with nowhere else to turn, 64-bit support will be forced to improve.

    Pretty much.

  21. Re:host the servers in antigua on The Pirate Bay Sails To a New Home · · Score: 1

    Put yourself in the VC's place. You have the cash to invest, and someone comes to you with an actual business plan, backed up by a decent demo, with realistic projections for sales. The VC asks, "How are you going to control distribution?"

    My response: "Why would I need to do that? Were you actually paying attention during the business plan presentation?"

    Unfortunately things likes games have a far shorter lifespan, whats col today might not be so cool 6 months from now and then its on the scrap heap but not because it was executed poorly or the writers and designers had poor imagination but because peoples taste in entertainment changes just that fast.

    Others, like Doom, last forever. And still others, like Nexuiz, evolve constantly.

    It's funny that you used an example like The Gimp, but you seem unable to grasp the idea that a game could be open source.

    So give me an actual reason why they should not profit from the efforts, why they should not earn whatever the market will bare on EVERY copy sold, and why they should expect people to buy one and then post it on TPB or some other equivalent?

    First, I should make one thing clear: I am not GP. I'm saying this pre-emptively because there's a common problem on Slashdot of assuming that the person replying to you is the same person you replied to.

    I don't agree that intellectual property makes absolutely no sense.

    The problem is that it's unenforceable.

    Remember Prohibition? While I believe it goes against the spirit of this country, you could indeed make a moral, financial, logical, or philosophical argument for banning liquor.

    The problem is, you can't ban liquor. Not only that, but the cost of trying to do so is too high -- organized crime. We're seeing the same thing with drugs, and the only reason we tolerate it is that the organized crime is mostly not in this country, it's in Mexico.

    So, intellectual property is similar. Whether or not it's a good idea, the costs of enforcing it are too high.

    In fact, it's less obvious with games, but let me illustrate that with music... At least here, it's probably possible to avoid infringing anything by recording every sound yourself. But there's a whole genre of music -- legitimate, interesting, creative music -- which is legally difficult or impossible.

    Go watch Good Copy Bad Copy. That's a movie you can legally pick up from your local torrent tracker, by the way.

    In particular, pay attention to The Grey Album and Girl Talk. The Grey Album would be difficult to make, following copyright law -- you'd need Jay-Z and The Beatles to agree, and you'd probably need tons of money to pay for it. But Girl Talk is actually impossible -- as he says, he'd need millions of dollars, and it'd take decades, assuming everyone agreed -- I don't think there's compulsory licensing for remixes.

    Yet without copyright, or simply ignoring the law, that kind of remixing suddenly works.

    Or, take your argument of risk... Apple refuses to implement Theora because they're concerned that someone may have "submarine" patents against it. But truthfully, there might be a submarine patent against anything -- . Patents have become so comprehensive, the patent office is so bad at filtering them, and the cost of a legal defense even if you're right is so high, that I don't see why anyone would take a risk on any sort of commercial software development, since it's impractical to ensure you're not infringing on something.

    Take away software patents, at the very least, and the cost is pretty much patent trolls and any company which only works on codecs. But we have plenty of companies who would benefit from better codecs, and it seems doubtful that we'd stop seeing codecs.

    And take away software patents, and suddenly, it's actually feasible for someone to build a computer business out of their garage -- as opposed to right now, where you'd have to h

  22. Re:Confirmed on Apple Wants Patents For Crippling Cellphones · · Score: 1

    The first was a nice summary, in that it showed both the "it's a failure" perspective, and the "It's done damned well in its first two days" perspective.

    The problem was more that they expected it to be a huge success, and it was only a moderate success that continued to snowball into an even huger success.

    No, it's the iPod that I remember people being underwhelmed by.

  23. Re:Confirmed on Apple Wants Patents For Crippling Cellphones · · Score: 1

    Could you elaborate?

    Well, aside from actively working with the Mono guys, for example...

    There's also CodePlex.

    Apple publishes the source code for the UNIX part of its operating system under an OSI license.

    There are tons of free Unixes out there, so this isn't really earth-shattering. The question is, what does it actually let you do to OS X?

    And the answer is, not much. The OS X GUI, which is the whole reason most people would want OS X in the first place, is opaque. It's been awhile, but last I checked, the Darwin included in OS X is heavily Tivo-ized -- you can get most of the source to it, but you can't compile your own version and expect it to run OS X.

    Also, I'm curious if anyone has attempted to completely remove Finder and the Dock, and have a usable system that can still run OS X apps. (If not actually remove from disk, at least ensure they aren't what's started on boot -- develop another shell, for instance.) Because you can run a replacement shell on Windows.

    Regardless, the only platform Microsoft has that's even close to as locked-down as the iPhone is the Xbox 360, and there don't seem to be nearly as many horror stories about their approval process there.

  24. Re:Confirmed on Apple Wants Patents For Crippling Cellphones · · Score: 1

    Remember when the iphone just came out and everyone thought they were crazy to get into an overcrowded handset market as an unproven player and Balmer said it would bomb, etc ?

    No I don't.

    I mean, yes, Ballmer said it would bomb. That's what Ballmer does. Did anyone else say it would bomb?

    I remember this thing being an instant hit, on launch day. Maybe they didn't realize what they had?

  25. Re:Confirmed on Apple Wants Patents For Crippling Cellphones · · Score: 1

    The summary what written by an idiot...ignorant...wildly sensationalized bit of bullshit...

    Ok, but you have to explain why -- you seriously ranted without a point for two paragraphs there.

    you don't have true device root on any phone, including FOSS projects like OpenMoko and Android.

    How so?

    My understanding is that there are, indeed, several Android forks which can be run on an Android device. Google is not suing them because such a project isn't allowed, but rather, because they included some proprietary Google apps like Gmail.

    carriers control their own network

    That is a choice. Obviously, not all carriers insist on such tight control of every device on their network.

    the FCC mandates a closed baseband.

    Which has what to do with allowing users the freedom to tinker with their own devices?

    There is nothing approaching an "unlimited, unfettered device," for obvious reasons.

    It's not obvious. Spell it out for us.

    To say that Apple is treading on your rights... BEFORE you buy the device is simply juvenile ranting.

    I never said Apple is treading on my rights. And is any criticism of a device I didn't buy, and have no intention of buying, automatically "juvenile ranting"?

    So much for journalism, I guess...

    If you stand back, you'll realize that the smartphones that "aren't crippled" (in your view) are actually the most lame.

    Oh?

    Android, a platform that announced its SDK and store before the iPhone, but can mange to keep up with Apple

    Be specific. In what way can't Android keep up with apple?

    If you say "sales", fine, but I don't use that as a measure of "lame".

    sniveling... real world.

    In the real world, if you wish to be taken seriously, you should make an argument with facts, not a pathetic half-troll of ad-homs.

    Try again.