Walnut Creek CDROM is www.cdrom.com. They're one of the principal sponsors of FreeBSD (and also support slackware, I don't know how extensively), and make their money selling stuff.
Check out the webpage (kind of an obvious place to look for your information;-). The OS is FreeBSD and the machine is a single-CPU Xeon, which quite happily maxes out the network bandwidth serving up to 5000 users at once.
Machine configuration information is here (again, you could have found it for yourself in about 2 seconds of looking, but what the hell;-)
Transfer stats for the machine are here (This one you can probably be excused for not finding yourself..)
Re:BSD's deserve a look...
on
Which BSD?
·
· Score: 1
I wonder if this pre-dates what we now call the BSD license, or whether (if not) Microsoft acknowledge the contribution anywhere. Anyone ever seen the reference?:-)
Re:The Linux emulation is not perfect!
on
Which BSD?
·
· Score: 1
This is a generic problem with SYSV shared memory; it is not reference-counted, and exists "anonymously" independent of the existence of any creating entity.
Re:OpenBSD and NetBSD merge...
on
Which BSD?
·
· Score: 1
Well, not to put too fine a point on it, the reason why Theo split from NetBSD was due to personality conflicts.
Re:Well, a guy I know says...
on
Which BSD?
·
· Score: 1
I'd modify this advice to be "listen to everyone, then ignore it and form your own opinions":-)
OpenBSD did fix a lot of buffer overflows and have made a blanket of pre-emptive changes which might possibly have resulted in a security problem somehow - but on the whole I think the benefits of the audit are overrated.
Don't get me wrong, I like the OpenBSD philosophy, but in practise none of the BSDs suffer problems from the base install - it's what you install AFTERWARDS (can you say "wuftpd"?) which will root you no matter what system you run.
The GPL does not allow you to place extra restrictions on the code beyond those contained in the GPL. The BSD license places extra restrictions (the advertising clause). QED.
'tis true, but I don't think it matters much. The FreeBSD philosophy is that if you want to use a port, you must either be running the OS from the same date, OR have installed the most recent version of the 'upgrade kit' package, which updates any changed files to account for broken dependencies.
The upside to the loss of fine-grained control is a better guarantee that the system will work together as one piece, and you don't have to play the dependency game getting it all interoperable.
It's no secret that FreeBSD is "behind the curve" relative to Linux in terms of commercial support - but it's definitely growing. It would be fairer to compare it to Linux conventions from 2 years ago, before it "made it big". Everything has to start from somewhere - a year ago something like this probably wouldn't have even been possible. By next year, who knows?
CTM is the system for people with transient internet connections - basically sends you all the diffs via mail, which you can then apply automatically to update your source.
Or you can do binary upgrades. It's true that it's not as easy to just do a binary update of, say, libc, but on the other hand you rarely need to.
You're comparing apples and oranges. 'make world' recompiles the entire OS, rpm -U just installs new binary packages. FreeBSD can also do this - see the 'upgrade' option in/stand/sysinstall. You can also install your packages this way (or use/usr/ports/x11/pib to do the same).
Dependency checking isn't an issue when you upgrade the system this way, because it comes as one cohesive unit, not n+1 parts which you have to do separately. For some this is a plus, others like the fine-grained control.
Brittanica haven't sold encyclopedias door to door for several years. I doubt whether the fact that a competitor has placed their wares online for free will cause the others to immediately changing their tactics.
Just stand behind the door and yell "I'm not home"..it's what I normally do.
Unfortunately, it was probably a business necessity that they made some changes - according to what I'd heard Encarta really gave them a walloping; who needs to buy a $2000 set of books when your PC came with something "the same" for free (or which you can buy for a few $$).
This seems like more of an attempt to undercut Microsoft, the folks who undercut them - instead of selling it cheaply, they now give it away for free.
> what's wrong with the/. model for > moderating an encyclopaedia?
The/. moderation model consider moderator _opinion_ about contributed comments, not whether or not they are factually correct, meet minimum editorial standards, etc. Those are vitally important for an information which you want people to be able to cite authoritatively.
In short, many of the comments people post here are off the top of their head, opinionated, or just dead wrong, yet get moderated well because either they convinced the moderator, the moderator agreed with the bias, or they just didn't know any better. A peer review model would work much better - in other words, just like the scientific community has used for decades.
The anonymity is the basis upon which the organisation can be fashioned. You need to actual recruit people, bring them together, and whatnot, but they can do so in a way which doesn't compromise the identities of the other parties. This may be secondary to a traditional physical organisation - online exchanges being used for convenience when necessary.
The big thing about a worm like I described would be its speed - with Melissa, we saw how fast and far a single-minded, stupid worm can go, and that one relies on human interaction to propagate! A worm which can execute hundreds of attack probes in a second and _actively_ pursue targets, is that much more virulent and dangerous by comparison. A human would surely have a better success/fail ratio against a given target, but who cares about that when your goal is not to penetrate a particular system, but to achieve wide-spread penetration of the entire internet.
As for the size aspect, that is definitely a factor. Perhaps this kind of thing isn't feasible today, but give it a year or so, when you won't be able to buy a new PC with less than 18GB hard drive space, when customers have more bandwidth than they know what to do with in order to just read the occasional webpage, etc. A large (multimegabyte) package would take a matter of seconds to enter your system, not something which is easy to react to, especially if you're asleep at the time.
The effect on the economy I mentioned is not from computer crashes directly - the worm wouldn't do much of that except possibly DoSing hosts it can't crack, to divert human resources away from the real problem. The effect is one of fear - that someone was able to root x% of the systems on the internet, in one go. Regardless of how many people actually get hit, or what the worm does, the point is that their carefully crafted self-delusion of security has suddenly been vapourised in one fell swoop, and the potential is there for ANYONE to come in and have their way with your data. THAT's what would hit the stock prices of MSFT, et al, hard.
Now, it's surely possible to prevent this by doing a good job of configuring things - probably most of the big networks have enough in place to stop a blind automaton like this. But it's not the individual targets which matter, but the average properties - we all know how badly configured most networks are, and there are studies which support this.
The point of terrorism isn't necessarily to take down a single target, but to cause mass publicity and mass terror by making use of targets of opportunity - the ones they CAN get.
> I'd add that using the Internet as it is > currently designed to communicate between > members of a terrorist organisation would not > be a good idea -- it goes against the "cell" > concept which is known to be the best way > to organise.
Au contraire. Using the internet the way most people do (i.e. only believing they're anonymous) would certainly defeat the concept of private terrorist cells, but on the other hand there are infrastructure like double-blind anonymous remailers, "onion routing", etc, which can be used to implement true anonymity (at some cost, up-front and ongoing).
These kinds of infrastructure already exist publicly, and I have no doubt that there are similar networks of a more underground nature in existence.
One hears rumours every now and then of "super-cracks"..some of them have made it here - spooky stuff which Should Not Have Been Possible. A lot of it (undoubtedly most of it) is fantasy, of course, but it makes you wonder..
I've often thought about what it would be possible for a well-funded agency to achieve in terms of penetration tools; a lot of systems (in fact, according to studies, most systems on the public internet) are vulnerable to really stupid holes, but the tougher nuts (probably the most individually interesting nuts) require more sophistication to attack.
However, given some decent programming expertise and resources, I'm sure it would be possible to create an intelligent automaton which contains a vast repertoire of cracker tricks, from the subtle to the overt, which could be pointed at a network (with suitable background research) and throw its bag of tricks at it until it gets inside, and from there rapidly subverting the connected trusted hosts. Giving the worm a wide variety of "stealth tools" to allow it to hide once inside would make it in practise almost invulnerable once entrenched.
This is not far removed from the "counter-ICE" intelligent tools of cyberpunk lore.
Obviously, this is not easy to do, but on the other hand the rewards for anyone who was able to create such a beast would be immense.
Some possibilities:
* Given that most networks on the internet are vulnerable (Reference: the folks who did the study using BASS recently - URL not handy at present), you could take down a goodly proportion of the hosts on the internet with a concerted attack (subvert widely-distributed systems for a while as a platform, then on D-day use them to launch all hell onto the internet). While this wouldn't have much effect on the Real World, it would cause an enormous resource committment to repair the damage, generate huge publicity, and even bigger "fear factor" among the people you don't penetrate. It would probably hit the economy pretty hard, actually..all a result of some aberrant ones and zeros - neat, huh?
* Variation: covert agent X injects the worm into the private (non-internet) network of a target - e.g. a foreign military network, or the operations management system of emergency services. Used in conjunction with other forms of attack, like frontal, obvious, "direct assault" electronic attacks to divert attention to the real attack, and ("conventional") physical attacks like bioweapons, this would create mass confusion, and potentially, mass destruction.
* Corporate blackmail: your worm finds its way into the network of a company you find politically objectionable, and then releases all security measures (deactivates firewalls, installs backdoors, alternate passwords, etc), and publishes them to the world, or to a competitor. Result: potential devastation of the company (loss of intellectual property, exposure of business secrets and practises, skeletons in the corporate closet, etc).
The internet worm of 198x was solved by people who were able to coordinate rapidly to analyse, solve and fix the entry mechanism. That (like more recent variants, like Melissa), was a one-track, stupid pathogen which was correspondingly easy to defeat once the vector was known.
Now imagine a worm which selectively exploits all known remote buffer overflows, many unknown (publicly) ones, denial of service attacks, TCP sequence spoofing, network sniffing, breaking of insecure protocols, ad infinitum, can hide stealthily within an operating system and network so the system's tools do not show its presence, which contains binary code that runs on every major OS, which responds to detected attempts to "capture" it by death and/or retaliation, etc etc.
How do you even begin to deal with that kind of thing on an enterprise level? You'd have to assume every machine is infected, and low-level wipe everything, being careful to distrust the existing data when you put it back. Then you'd have to patch every possible entrance mechanism onto the machine (difficult, given that Windows 9x machines are fundamentally unsecurable), and if you miss just ONE access hole then your machine is under again. Of course, this assumes you even know what you're dealing with, which is unlikely for the first few iterations, and you know about every vulnerability the worm is exploiting on your machine.
In principle, there's nothing stopping you from writing such a beast - individually the components are all well understood (except perhaps the "intelligence" behaviour which would have to be abstracted from human knowledge). In the face of an attack like this, the confusion would be enormous, when finally discovered and believed: "My solaris system got rooted by a RPC exploit". "That's okay, I don't run solaris. Hmm...my NT box is acting funny, though. Probably just needs a reboot..damn script kiddies".
This should be enough to make people very, very worried..given the notorious complacency of management towards security policy and implementation, and the continued daily proliferation of new remote exploits, it's a problem which is only growing in size, and it's a matter of time before Something Happens.
Sooner or later, someone is going to write this so-far (I hope) mythical ueber-worm, and when the Cybercalypse happens it's going to be a long week indeed for all of the professional sysadmins out there (and at the end of it, all they've got to look forward to is being fired for building a bad network, even if it wasn't their fault).
I only hope that once the network rebuilds, people learn to do better next time:-)
[This descent into paranoia sponsored by the Judean People's Front, that guy sitting on the computer behind you, and the number FNORD]
Can you imagine having to reboot your Microsoft Toaster 2005 in order to get the bread out? Gives a whole new meaning to the phrase "crash and burn":)
This isn't as far-fetched as it sounds. At one place where I worked there was a sequence of two buttons you could press on the phones which would cause them to lock up hard (the display lights would stay on, but nothing worked). In order to fix it, you had to reboot the phone by unplugging from the wall jack, waiting for the internal capacitor to drain, and then plugging it back in.
Slashdot Mirror
Walnut Creek CDROM is www.cdrom.com. They're one of the principal sponsors of FreeBSD (and also support slackware, I don't know how extensively), and make their money selling stuff.
;-). The OS is FreeBSD and the machine is a single-CPU Xeon, which quite happily maxes out the network bandwidth serving up to 5000 users at once.
;-)
Check out the webpage (kind of an obvious place to look for your information
Machine configuration information is here (again, you could have found it for yourself in about 2 seconds of looking, but what the hell
Transfer stats for the machine are here (This one you can probably be excused for not finding yourself..)
I wonder if this pre-dates what we now call the BSD license, or whether (if not) Microsoft acknowledge the contribution anywhere. Anyone ever seen the reference? :-)
This is a generic problem with SYSV shared memory; it is not reference-counted, and exists "anonymously" independent of the existence of any creating entity.
Well, not to put too fine a point on it, the reason why Theo split from NetBSD was due to personality conflicts.
I'd modify this advice to be "listen to everyone, then ignore it and form your own opinions" :-)
OpenBSD did fix a lot of buffer overflows and have made a blanket of pre-emptive changes which might possibly have resulted in a security problem somehow - but on the whole I think the benefits of the audit are overrated.
Don't get me wrong, I like the OpenBSD philosophy, but in practise none of the BSDs suffer problems from the base install - it's what you install AFTERWARDS (can you say "wuftpd"?) which will root you no matter what system you run.
The GPL does not allow you to place extra restrictions on the code beyond those contained in the GPL. The BSD license places extra restrictions (the advertising clause). QED.
Actually, Soft Updates originated in a version of SVR4, as described here.
'tis true, but I don't think it matters much. The FreeBSD philosophy is that if you want to use a port, you must either be running the OS from the same date, OR have installed the most recent version of the 'upgrade kit' package, which updates any changed files to account for broken dependencies.
The upside to the loss of fine-grained control is a better guarantee that the system will work together as one piece, and you don't have to play the dependency game getting it all interoperable.
Really? Well, I stand corrected! Thanks for the info
> "Since its inception in 1982, a singular vision,
> "The Network is the ComputerTM," has propelled
> Sun Microsystems, Inc."
Oh really? I thought marketing only thought up that slogan a year or two ago..
SunOS (sorry, Solaris Operating Environment) is ready for the Merced (sorry, Itanium) in exactly the same way as a wheel is ready for a car..
Blech..marketing..
WTF is System VII? ;-)
I'm pretty sure it was SVR4 which merged in a lot of the BSDisms.
It's no secret that FreeBSD is "behind the curve" relative to Linux in terms of commercial support - but it's definitely growing. It would be fairer to compare it to Linux conventions from 2 years ago, before it "made it big". Everything has to start from somewhere - a year ago something like this probably wouldn't have even been possible. By next year, who knows?
CTM is the system for people with transient internet connections - basically sends you all the diffs via mail, which you can then apply automatically to update your source.
Or you can do binary upgrades. It's true that it's not as easy to just do a binary update of, say, libc, but on the other hand you rarely need to.
You're comparing apples and oranges. 'make world' recompiles the entire OS, rpm -U just installs new binary packages. FreeBSD can also do this - see the 'upgrade' option in /stand/sysinstall. You can also install your packages this way (or use /usr/ports/x11/pib to do the same).
Dependency checking isn't an issue when you upgrade the system this way, because it comes as one cohesive unit, not n+1 parts which you have to do separately. For some this is a plus, others like the fine-grained control.
Brittanica haven't sold encyclopedias door to door for several years. I doubt whether the fact that a competitor has placed their wares online for free will cause the others to immediately changing their tactics.
Just stand behind the door and yell "I'm not home"..it's what I normally do.
And how many posts so far have said "what's the bet it's running NT?"
Insults work both ways.
Unfortunately, it was probably a business necessity that they made some changes - according to what I'd heard Encarta really gave them a walloping; who needs to buy a $2000 set of books when your PC came with something "the same" for free (or which you can buy for a few $$).
This seems like more of an attempt to undercut Microsoft, the folks who undercut them - instead of selling it cheaply, they now give it away for free.
> what's wrong with the /. model for
/. moderation model consider moderator _opinion_ about contributed comments, not whether or not they are factually correct, meet minimum editorial standards, etc. Those are vitally important for an information which you want people to be able to cite authoritatively.
> moderating an encyclopaedia?
The
In short, many of the comments people post here are off the top of their head, opinionated, or just dead wrong, yet get moderated well because either they convinced the moderator, the moderator agreed with the bias, or they just didn't know any better. A peer review model would work much better - in other words, just like the scientific community has used for decades.
The anonymity is the basis upon which the organisation can be fashioned. You need to actual recruit people, bring them together, and whatnot, but they can do so in a way which doesn't compromise the identities of the other parties.
This may be secondary to a traditional physical organisation - online exchanges being used for convenience when necessary.
The big thing about a worm like I described would be its speed - with Melissa, we saw how fast and far a single-minded, stupid worm can go, and that one relies on human interaction to propagate! A worm which can execute hundreds of attack probes in a second and _actively_ pursue targets, is that much more virulent and dangerous by comparison. A human would surely have a better success/fail ratio against a given target, but who cares about that when your goal is not to penetrate a particular system, but to achieve wide-spread penetration of the entire internet.
As for the size aspect, that is definitely a factor. Perhaps this kind of thing isn't feasible today, but give it a year or so, when you won't be able to buy a new PC with less than 18GB hard drive space, when customers have more bandwidth than they know what to do with in order to just read the occasional webpage, etc. A large (multimegabyte) package would take a matter of seconds to enter your system, not something which is easy to react to, especially if you're asleep at the time.
The effect on the economy I mentioned is not from computer crashes directly - the worm wouldn't do much of that except possibly DoSing hosts it can't crack, to divert human resources away from the real problem. The effect is one of fear - that someone was able to root x% of the systems on the internet, in one go. Regardless of how many people actually get hit, or what the worm does, the point is that their carefully crafted self-delusion of security has suddenly been vapourised in one fell swoop, and the potential is there for ANYONE to come in and have their way with your data. THAT's what would hit the stock prices of MSFT, et al, hard.
Now, it's surely possible to prevent this by doing a good job of configuring things - probably most of the big networks have enough in place to stop a blind automaton like this. But it's not the individual targets which matter, but the average properties - we all know how badly configured most networks are, and there are studies which support this.
The point of terrorism isn't necessarily to take down a single target, but to cause mass publicity and mass terror by making use of targets of opportunity - the ones they CAN get.
> I'd add that using the Internet as it is
:-)
> currently designed to communicate between
> members of a terrorist organisation would not
> be a good idea -- it goes against the "cell"
> concept which is known to be the best way
> to organise.
Au contraire. Using the internet the way most people do (i.e. only believing they're anonymous) would certainly defeat the concept of private terrorist cells, but on the other hand there are infrastructure like double-blind anonymous remailers, "onion routing", etc, which can be used to implement true anonymity (at some cost, up-front and ongoing).
These kinds of infrastructure already exist publicly, and I have no doubt that there are similar networks of a more underground nature in existence.
One hears rumours every now and then of "super-cracks"..some of them have made it here - spooky stuff which Should Not Have Been Possible. A lot of it (undoubtedly most of it) is fantasy, of course, but it makes you wonder..
I've often thought about what it would be possible for a well-funded agency to achieve in terms of penetration tools; a lot of systems (in fact, according to studies, most systems on the public internet) are vulnerable to really stupid holes, but the tougher nuts (probably the most individually interesting nuts) require more sophistication to attack.
However, given some decent programming expertise and resources, I'm sure it would be possible to create an intelligent automaton which contains a vast repertoire of cracker tricks, from the subtle to the overt, which could be pointed at a network (with suitable background research) and throw its bag of tricks at it until it gets inside, and from there rapidly subverting the connected trusted hosts. Giving the worm a wide variety of "stealth tools" to allow it to hide once inside would make it in practise almost invulnerable once entrenched.
This is not far removed from the "counter-ICE" intelligent tools of cyberpunk lore.
Obviously, this is not easy to do, but on the other hand the rewards for anyone who was able to create such a beast would be immense.
Some possibilities:
* Given that most networks on the internet are vulnerable (Reference: the folks who did the study using BASS recently - URL not handy at present), you could take down a goodly proportion of the hosts on the internet with a concerted attack (subvert widely-distributed systems for a while as a platform, then on D-day use them to launch all hell onto the internet). While this wouldn't have much effect on the Real World, it would cause an enormous resource committment to repair the damage, generate huge publicity, and even bigger "fear factor" among the people you don't penetrate. It would probably hit the economy pretty hard, actually..all a result of some aberrant ones and zeros - neat, huh?
* Variation: covert agent X injects the worm into the private (non-internet) network of a target - e.g. a foreign military network, or the operations management system of emergency services. Used in conjunction with other forms of attack, like frontal, obvious, "direct assault" electronic attacks to divert attention to the real attack, and ("conventional") physical attacks like bioweapons, this would create mass confusion, and potentially, mass destruction.
* Corporate blackmail: your worm finds its way into the network of a company you find politically objectionable, and then releases all security measures (deactivates firewalls, installs backdoors, alternate passwords, etc), and publishes them to the world, or to a competitor. Result: potential devastation of the company (loss of intellectual property, exposure of business secrets and practises, skeletons in the corporate closet, etc).
The internet worm of 198x was solved by people who were able to coordinate rapidly to analyse, solve and fix the entry mechanism. That (like more recent variants, like Melissa), was a one-track, stupid pathogen which was correspondingly easy to defeat once the vector was known.
Now imagine a worm which selectively exploits all known remote buffer overflows, many unknown (publicly) ones, denial of service attacks, TCP sequence spoofing, network sniffing, breaking of insecure protocols, ad infinitum, can hide stealthily within an operating system and network so the system's tools do not show its presence, which contains binary code that runs on every major OS, which responds to detected attempts to "capture" it by death and/or retaliation, etc etc.
How do you even begin to deal with that kind of thing on an enterprise level? You'd have to assume every machine is infected, and low-level wipe everything, being careful to distrust the existing data when you put it back. Then you'd have to patch every possible entrance mechanism onto the machine (difficult, given that Windows 9x machines are fundamentally unsecurable), and if you miss just ONE access hole then your machine is under again. Of course, this assumes you even know what you're dealing with, which is unlikely for the first few iterations, and you know about every vulnerability the worm is exploiting on your machine.
In principle, there's nothing stopping you from writing such a beast - individually the components are all well understood (except perhaps the "intelligence" behaviour which would have to be abstracted from human knowledge). In the face of an attack like this, the confusion would be enormous, when finally discovered and believed: "My solaris system got rooted by a RPC exploit". "That's okay, I don't run solaris. Hmm...my NT box is acting funny, though. Probably just needs a reboot..damn script kiddies".
This should be enough to make people very, very worried..given the notorious complacency of management towards security policy and implementation, and the continued daily proliferation of new remote exploits, it's a problem which is only growing in size, and it's a matter of time before Something Happens.
Sooner or later, someone is going to write this so-far (I hope) mythical ueber-worm, and when the Cybercalypse happens it's going to be a long week indeed for all of the professional sysadmins out there (and at the end of it, all they've got to look forward to is being fired for building a bad network, even if it wasn't their fault).
I only hope that once the network rebuilds, people learn to do better next time
[This descent into paranoia sponsored by the Judean People's Front, that guy sitting on the computer behind you, and the number FNORD]
There's an iso of the first (most important) CD on ftp.freebsd.org - check the announcement notes.
:)
:-)
Also, I'd invite you to give the install another shot - it's not a perfect installer, but it's also not that confusing if you read the screen
The installer is only of course a once-off, so once you get past that you're running free in the wide world of FreeBSD itself
Can you imagine having to reboot your Microsoft Toaster 2005 in order to get the bread out? Gives a whole new meaning to the phrase "crash and burn" :)
This isn't as far-fetched as it sounds. At one place where I worked there was a sequence of two buttons you could press on the phones which would cause them to lock up hard (the display lights would stay on, but nothing worked). In order to fix it, you had to reboot the phone by unplugging from the wall jack, waiting for the internal capacitor to drain, and then plugging it back in.
Denial-of-bread attacks could become commonplace once toasters start getting IP addresses. I'm not sure that's a world I want to live in :-)
No problem: take a sample from the original, insert in clone's gut, let colonise.
Worst case: some bad diahhorea for a few days.