Quite possibly. People that think they are "coders" when they cannot actually read and understand or construct code of any meaningful complexity would come up with just this kind of stupid idea. I saw this utter cluelessness some times when analyzing malware. People that obviously struggled to write a few bytes of assembler code wrapping malcode they got somewhere in really obviously stupid ways....
The self-image of stupid people is a fascinating thing (unless you get directly exposed to it).
Wrong. You need to get permission, but that is it. In some cases, you may not even need that, namely if they have "insecure" networks for testing things and the like and you have a server in one.
But running a scan against an IP with no knowledge of what that IP is doesn't prove any particular machine was insecure.
Indeed. In an extreme case, this could actually have been a tar-pitting demon running on an entirely different machine. I am not saying it was, but the scan tells you next to nothing, except that here is something you should look at more closely.
In fact that is the procedure used when you have people that do not really understand their jobs.
If people know what they do, there are quite a few ways this was not actually attackable. And there is no "squeaky clean" server set-up as soon as packages can reach it. For example, many nil-whits assume that if you do not get an answer form a TCP port (either TCP or ICMP), nothing is listening to data on it and it is securely firewalled. Not so. If packets can reach it, you can still use it unidirectionally. Had the pleasure of seeing some "professional" network administrators eyes bugging out when I demonstrated that to him a few years back.
But seeing these things would require actual understanding on what happens in the kernel network stack. I guess your site does not have that knowledge available either.
Since when? And actually, how would you get it into the "open ports list" in the first place without attaching a process to it? By modifying the kernel first? Because that is what it would take, ports do not open themselves magically, they get opened by processes requesting that and the requesting process is then responsible for servicing it. And if that process dies, the port gets closed by the kernel.
Seems to me you do not actually know how server ports work...
Unless you actually probe what process is running on a port, the mere fact that it is "open" does not tell you anything except that it is not firewalled and that something is running on it. The thing running on it could be/bin/false via inetd, and hence any connection would get closed immediately after establishment, and before any data exchange and hence pose no security risk as there is no attack surface.
This makes this whole story political, not technical.
My take on it would be to punish people that waste tax money just the same as people that evade taxes. That would be fair IMO. Of course, numerous "public servants" would go to prison for decades if that ever was implemented. Having these people out of the decision chain permanently would be a good thing.
While the levels of stupidity displayed is staggering, I do not think it grows. It is just more visible in the Internet-age as publishing things has become extremely cheap and is accessible to everyone.
Very much so. Attaching stuff to other stuff does not make the two work together in any sensible or useful way. They seem to completely miss that little problem.
Or they will find that the nice-looking areas are exactly the ones looking nice, but things like food and water stores or independent electricity generators and air-filters are sadly missing because they are expensive.
Alternatively, you can die a bit later than the rest of humanity. Like a rat in a hole. But "preppers" obviously do not have the intelligence to think that far, so they fall for this scam.
Seriously, this data should not even be recorded on such a site. And it it is, it should not even be written locally and immediately exported to a machine that is specially protected and not reachable from the Internet. So that is _two_ massive screw-ups right there.
You have a problem with language semantics. Obviously, the definition of "severe problem" you use here is something you dreamed up, and incompatible with general use.
And, incidentally, if discovered, it becomes a severe problem for those that wrote and own the software and possible those that use it. Fro example, it could then become subject to criminal penalties (i.e. personal ones) to continue to use the software.
And that proves what? It does prove that somehow you were assigned a son that has a personality similar to you. It does not prove it is genetic. Maybe he just decided to be reincarnated as the son of somebody that resembles him. (Pure speculation of course, but a valid explanation.) Unless, of course, you are a fundamentalist (i.e. fanatic) physicalist and without any proof or scientifically sound reason assume that your son's personality is just created by his physical (as understood today) configuration.
You should have a look at the society of the historic Soviet Union or Northern Korea. There they also manipulate and coerce people into being "happy".
The problem is that the one true freedom people have is to make their own choices. Removing that freedom by tricking them is not really any better than using direct coercion. In both cases the person is deprived of their essential freedom and, what is worse, of the opportunity to learn how to use it, i.e. how to grow as a person. In other words they are prevented from becoming adults and are treated like children that cannot make their own decisions. If that is not utterly evil, then I do not know what is.
Slashdot Mirror
Many words, no relevant content. Misdirection to cover up your display of ignorance would be my guess.
Quite possibly. People that think they are "coders" when they cannot actually read and understand or construct code of any meaningful complexity would come up with just this kind of stupid idea. I saw this utter cluelessness some times when analyzing malware. People that obviously struggled to write a few bytes of assembler code wrapping malcode they got somewhere in really obviously stupid ways....
The self-image of stupid people is a fascinating thing (unless you get directly exposed to it).
Wrong. You need to get permission, but that is it. In some cases, you may not even need that, namely if they have "insecure" networks for testing things and the like and you have a server in one.
But running a scan against an IP with no knowledge of what that IP is doesn't prove any particular machine was insecure.
Indeed. In an extreme case, this could actually have been a tar-pitting demon running on an entirely different machine. I am not saying it was, but the scan tells you next to nothing, except that here is something you should look at more closely.
In fact that is the procedure used when you have people that do not really understand their jobs.
If people know what they do, there are quite a few ways this was not actually attackable. And there is no "squeaky clean" server set-up as soon as packages can reach it. For example, many nil-whits assume that if you do not get an answer form a TCP port (either TCP or ICMP), nothing is listening to data on it and it is securely firewalled. Not so. If packets can reach it, you can still use it unidirectionally. Had the pleasure of seeing some "professional" network administrators eyes bugging out when I demonstrated that to him a few years back.
But seeing these things would require actual understanding on what happens in the kernel network stack. I guess your site does not have that knowledge available either.
Since when? And actually, how would you get it into the "open ports list" in the first place without attaching a process to it? By modifying the kernel first? Because that is what it would take, ports do not open themselves magically, they get opened by processes requesting that and the requesting process is then responsible for servicing it. And if that process dies, the port gets closed by the kernel.
Seems to me you do not actually know how server ports work...
Unless you actually probe what process is running on a port, the mere fact that it is "open" does not tell you anything except that it is not firewalled and that something is running on it. The thing running on it could be /bin/false via inetd, and hence any connection would get closed immediately after establishment, and before any data exchange and hence pose no security risk as there is no attack surface.
This makes this whole story political, not technical.
My take on it would be to punish people that waste tax money just the same as people that evade taxes. That would be fair IMO. Of course, numerous "public servants" would go to prison for decades if that ever was implemented. Having these people out of the decision chain permanently would be a good thing.
While the levels of stupidity displayed is staggering, I do not think it grows. It is just more visible in the Internet-age as publishing things has become extremely cheap and is accessible to everyone.
Sounds like the digital version has not been given the 30-50 years a technology needs to mature.
Very much so. Attaching stuff to other stuff does not make the two work together in any sensible or useful way. They seem to completely miss that little problem.
Indeed. Comes mostly from ignorance and arrogance. A lot of hot air, basically no substance.
They also massively underestimate how long it takes to really understand a technology and bring it to maturity.
And to add insult to injury, apparently nobody is responsible for that massive fuckup. It is just stealing from the taxpayer, no crime in that.
"Shown to be false" is not actually possible to do here. You must be soft in the head.
You do not need that. Rough similarity in body-structure and hiding his face will be enough.
Yeah, that will help when the starving zombie masses storm it...
Face it, there is no way to protect yourself. You can only die a little bit later, after cowering in a rat-hole for a while.
Or they will find that the nice-looking areas are exactly the ones looking nice, but things like food and water stores or independent electricity generators and air-filters are sadly missing because they are expensive.
Alternatively, you can die a bit later than the rest of humanity. Like a rat in a hole. But "preppers" obviously do not have the intelligence to think that far, so they fall for this scam.
Seriously, this data should not even be recorded on such a site. And it it is, it should not even be written locally and immediately exported to a machine that is specially protected and not reachable from the Internet. So that is _two_ massive screw-ups right there.
May aim is not to fix this issue. I am point thin out that "fixing" this could and likely will be hugely expensive and hence should not be attempted.
You have a problem with language semantics. Obviously, the definition of "severe problem" you use here is something you dreamed up, and incompatible with general use.
And, incidentally, if discovered, it becomes a severe problem for those that wrote and own the software and possible those that use it. Fro example, it could then become subject to criminal penalties (i.e. personal ones) to continue to use the software.
And that proves what? It does prove that somehow you were assigned a son that has a personality similar to you. It does not prove it is genetic. Maybe he just decided to be reincarnated as the son of somebody that resembles him. (Pure speculation of course, but a valid explanation.) Unless, of course, you are a fundamentalist (i.e. fanatic) physicalist and without any proof or scientifically sound reason assume that your son's personality is just created by his physical (as understood today) configuration.
You should have a look at the society of the historic Soviet Union or Northern Korea. There they also manipulate and coerce people into being "happy".
The problem is that the one true freedom people have is to make their own choices. Removing that freedom by tricking them is not really any better than using direct coercion. In both cases the person is deprived of their essential freedom and, what is worse, of the opportunity to learn how to use it, i.e. how to grow as a person. In other words they are prevented from becoming adults and are treated like children that cannot make their own decisions. If that is not utterly evil, then I do not know what is.
You might be an animal in that circumstances, I certainly would not. Who do you think created civilization?
And code violating copyrights is not a "severe problem hidden in there"? I would think it is.