|
12/25 |
2001/4/22 [Computer/SW/Security, Computer/SW] UID:21052 Activity:very high |
4/21 Do you like to code/hack? \_ Yes. \_ hack is a dirty word. \_ to "professionals", yes, but what about crypto and software and computer pioneers? \_ to me, it mean "threw together code quickly without much forethought", does it mean different to other people? |
2001/3/22 [Computer/SW/Security] UID:20880 Activity:nil |
3/20 tom's ridiculous and endless whining about ssh purged. if tom was a man he'd give himself twink points everytime he brings it up. you can login. ssh1 works fine. now stfu and get over it. |
2001/3/21-22 [Computer/SW/Security] UID:20875 Activity:low |
3/20 \_ what about the broken sshd? -tom \_ Its not broken. It works fine for SSHv1 and OpenSSH clients. Get a different client. \_ what would you call a server that violates protocols? I would call it broken. The fact that openssh clients also violate protocols doesn't make the server any less broken. And, once again, there's ABSOLUTELY NO ADVANTAGE TO USING OPENSSH. -tom \_ Totally there is! Open source! \_ Why don't we run both versions? Run the non-OpenSSH version of port 69 so that tom will shutup. \_ Uh, its free and it comes preinstalled with *BSD, MacOS X, Linux, etc. WTF would I want to download something extra from http://ssh.com that isn't nearly as well audited as OpenSSH and isn't free for corporate users? \_ what difference does it make whether it's free for corporate users? You would want to download it because IT SUPPORTS MORE CLIENTS. Are you really this stupid? -tom \_ Because some of us are corporate users, not gub'ment 'ployees. \_ we're not talking about what you install in your cube. you can connect to soda if it's not running openssh. -tom http://ssh.com's ssh server doesn't like _/ OpenSSH clients and it doesn't like NiftyTelnet SSH on the mac (ie it will randomly drop my connection and scp doesn't work right), both of which currently work with soda's OpenSSH server. No reason to switch since switching would reduce the number of clients that are supported. \_ Bullshit. I am using both openssh clients and NiftyTelnet with http://ssh.com's server and they work fine. -tom \_ since you clearly are not making any progress getting the powers that be to switch from OpenSSH, why don't you harass the OpenSSH people and get them to fix it? \_ So, you like the added bloat of having to start the ssh1 daemon every time an ssh1 client connects? Once OpenSSH supports shession rekeying (promissed in the next major release) there will be no reason not to use OpenSSH. |
2001/3/21-22 [Transportation/Car, Computer/SW/Security] UID:20873 Activity:very high |
3/21 Went for a regular cleanup but the medical bill sez the doc did root canal and 6 x-rays. It said I had to pay 20% of the copayment to the doc but the doc sez to just ignore it. what's going on and what should i do 'bout it? \_ mmm, medical insurance fraud. \_ the doc over-charges. If the actual charge is $100, the doc is reporting the cost to be $120, so the $20 you supposedly need to pay is included in the overcharged amount. It is a win-win situation for you and your doc. Pretend that you don't know about it and play along. \_ I already paid a fuckin $10 copayment, and the insurance is paying $725 for a $50 cleanup. What the fuck? \_ its called fraud. If you're annoyed about it talk to your \_ If that's the case, I think you should also charge the doc 20% for your "services". insurance provider to get yer doc busted. \_ This is why medicare and medicaid are going bankrupt. As a taxpayer, thanks! \_ Do you even know what medicare is? If you did you would be able to figure out that the original poster isn't even qualified for it. \_ liberal solution: spend more on medical/care to cover the fraud. ITS FOR THE CHILDREN! \_ Yeah, totally. I'd pay anything and give up all my freedoms so long as it was for the children. \_ That's your frequent flyer miles rebate. \_ I read an article in Smartmoney magazine saying that doctors are not earning as much as they used to. Many are working longer hours, selling their Porches, and putting their children in public instead of private schools. Also, they no longer small talk or develop a personal \_ They make the same, but they have to work harder for it. Tough. For $350,000 they can deal. There's a lot of competition driving down prices. Most of my doctors don't even charge me the co-payment (they "forget") so it's not like they miss that extra $10 from each patient. The fee schedule is all out-of-whack with reality thanks to HMOs. For example, buying a certain medication through my HMO = $10 copayment. Buying it "without insurance" = $6.50. That's why I *always* ask how much the drug is retail cost, and it's not limited to drugs. The HMOs are screwing the doctors and the patients. --dim \_ But HMOs are FOR THE CHILDREN! Don't you care about THEM!? relationship with their patients but go right to the diagnosis in a production line manner. \_ And this is supposed to excuse fraud? \- If this has really happened to you, you have a obligation to bring it up. It'd really bad to let them get away with this. This is hardly a Jean Valjean stealing a loaf of bread. |
2001/3/21 [Computer/SW/Security] UID:20865 Activity:very high |
3/20 Hi. it appears that people have been flaming ][e about vp-like administrative policies. In the future, please direct the mail to vice-president@csua.berkeley.edu (duh). - paolo \_ Jon's just pissed 'cuz he did more work than he had to \_ He's under no contractual obligation to do anything if he doesn't want to. \_ Just as the VP is under no obligation to do his job if he doesn't want to. I guess he should email poliburo about it. \_ Actually, the VP has obligations as outlined in the CSUA Constitution. If he is unable to perform these duties, he should resign. \_ he should email vp about it then. - paolo \_ I have paolo. I'm still waiting for you to do your job. -Jon \_ i'm not seeing anything new to root or vp, unless it's the .43 net thing which is solved already. - paolo \_ what about the broken sshd? -tom \_ Its not broken. It works fine for SSHv1 and OpenSSH clients. Get a different client. \_ what would you call a server that violates protocols? I would call it broken. The fact that openssh clients also violate protocols doesn't make the server any less broken. And, once again, there's ABSOLUTELY NO ADVANTAGE TO USING OPENSSH. -tom \_ Totally there is! Open source! with *BSD, MacOS X, LinSUX, etc. \_ Why don't we run both versions? Run the non-OpenSSH version of port 69 so that tom will shutup. \_ Uh, its free and it comes preinstalled with *BSD, MacOS X, Linux, etc. WTF would I want to download something extra from http://ssh.com that isn't nearly as well audited as OpenSSH and isn't free for corporate users? \_ what difference does it make whether it's free for corporate users? You would want to download it because IT SUPPORTS MORE CLIENTS. Are you really this stupid? -tom \_ Because some of us are corporate users, not gub'ment 'ployees. \_ since you clearly are not making any progress getting the powers that be to switch from OpenSSH, why don't you harass the OpenSSH people and get them to fix it? \_ So, you like the added bloat of having to start the ssh1 daemon every time an ssh1 client connects? Once OpenSSH supports shession rekeying (promissed in the next major release) there will be no reason not to use OpenSSH. \_ That's an old thing that he isn't fixing, not a new thing. \_ well, like Jon said, he's not doing his job. -tom \_ It's a student .org. No one cares but you. Run for VP. Oh wait, you can't. \_ what the fuck are you bitter, insignificant poor suffering morons whining about? \_ lack of asian chic? \_ azn chix p. \_ SKY? Is that you SKY? Is Muchandr dead? \_ Muchandr is not dead, but he looks like a shadow of his former rambunctious self, haunting Berkeley downtown. |
2001/3/19-20 [Computer/SW/Security] UID:20846 Activity:moderate |
3/19 Hi, I'm looking for a simple encryption program for PC/w2k. I want to create a directory and everything I copy into that directory gets encrypted. It can pop up a window and ask me for a passphrase. That's not a big deal. Is there something simple like that? \_ There was something or other PGP that could encrypt a partition... \_ PGPdisk \_ store your porn offsite. it'll be safer there. |
2001/3/15 [Computer/SW/Unix, Computer/SW/Security, Computer/SW/OS] UID:20794 Activity:nil |
3/14 My saiden/cory account is disabled and my http://www-inst.eecs.berkeley.edu/~myself page is gone. If I'm a grad student how long do I get to keep my account? I'd love to have http://www.cs.berkeley.edu/~myself to be up forever. \_ nmap http://www.cs.berkeley.edu to figure out what OS its running. Get out your root kit for that OS and get root. |
2001/3/14 [Computer/SW/Security] UID:20773 Activity:high |
3/13 When I ssh from my computer to this one machine, I get: No agent. But when I go to a different machine I get: Connection to authentication agent opened. How do I fix the "no agent" problem? \_ Let me read your mind... |
2001/3/13 [Computer/SW/Security] UID:20768 Activity:nil |
3/12 What command do you use to generate a new /etc/ssh_host_key and /etc/ssh_host_key.pub for a new machine? |
2001/3/13-14 [Computer/SW/Security] UID:20765 Activity:low |
3/12 Need a secure way to encrypt files? Try Pig Latin! (and you thought all those Pig Latin routines you learn in 61A would goto waste) http://www.cnn.com/2001/TECH/internet/03/12/napster.02/index.html \_ Uh huh.... \_ Okay, so it is illegal to systematically un-Pig-Latinify the file names. But what excuse does Napster have to not simple Pig-Latinify the list of song names that it's supposed to block, and match the new list with the file names? There's no law saying you can't compare encrypted info with encrypted info, right? |
2001/3/10-12 [Computer/SW/Security] UID:20745 Activity:high |
3/9 Whenever I attempt to scp something, I get the following error: "Warning: no access to tty (Bad file descriptor). Write failed flushing stdout buffer. stty: stdin isn't a terminal write stdout: Broken pipe" How do I fix this? \_ Remove stty & similar settings from .cshrc/.login/.profile or put them inside 'if ($?prompt)' so they don't run when scp connectes \_ What other sorts of things should I check for? It's still broken but there's a different error now. But there's a different error now. \_ whats the best way to check for that for sh/ksh? \_ 'if ($?prompt)' is a shitty hack by an newbie. The correct way to do this in any shell is via tty. Put the interactive stuff in your .profile into the following wrapper: if tty -s > /dev/null 2>&1 ; then : # your interactive stuff here fi \_ dont use "tty -s". use "test -t 0" \_ "test -t 0" is not portable, "tty -s" is. Some of us still have accounts on older machines and need a portable .profile. \_ Somewhat related: don't put interactive programs in your dot files either. Some coder monkey put "more blay.txt" at the end of his .cshrc and then complained to me that scp hadn't been working for a month. |
12/25 |
2001/3/9 [Computer/SW/Security, Computer/SW/OS/Solaris] UID:20737 Activity:nil |
3/9 I guess IBM joins M$ as a company whose platforms you can't trust for ecommerce: http://www.theregister.co.uk/content/8/17467.html Ever since they got on the "LinSUX" bandwagon, the IBM of old (the one whose information systems defended the governments of the free world) seems to be slowly but surely disappearing. At least there is still Trusted Solaris and OpenBSD. |
2001/2/22 [Computer/SW/Security] UID:20646 Activity:nil |
2/20 How come we are still running OpenSSH 2.3.0? Shouldn't we upgrade to the newer 2.5.1? Also I've read up on that IDEA cypher that tom keeps asking for, it turns out that IDEA is deliberately ommited from OpenSSh because there is a big security whole associated with it. I'm not sure why he wants it anyway, as the other supported methods are much better. \_ Let me try to explain this one more time. We have a choice of using a server which will support whatever client one of our users is using, with whatever configuration they want to use. Or we can use OpenSSH. No one has put forth a reason why OpenSSH is even theoretically better. So why are we running it? -tom \_ Because it's open and open is kewl. Ride bike! \_ OpenSSH is as good as FSecure in terms of protocol support and because its auditing practices are like OpenBSD it is proactively secure. Who knows what buffer overflows are in the commerical closed source alternatives. Besides, Tatu is a much more immature punk than Theo de Raat. \_ OpenSSH is absolutely not as good as FSecure in terms of protocol support. OpenSSH does not support session re-keying, which is a required part of the ssh2 protocol. The ssh server from http://www.ssh.com also supports this, and is, of course, open source. -tom \_ Okay explain to me why you need session re-keying. And Tatu's ssh from http://ssh.com may be "open source", but there are serious restrictions on who can and cannot use it. OpenSSH has no restrictions. \_ I need session re-keying because IT IS A REQUIREMENT OF THE PROTOCOL and therefore PROPERLY-FUNCTIONING SSH2 CLIENTS DO NOT WORK WHEN CONNECTED TO OPENSSH SERVERS. How many times does this need to be explained? -tom \_ Whatever. What is re-keying anyway? What does it do and why is it needed by the protocol? I mean SSH v2 seems to work find without it when using OpenSSH. Are you just being ANAL again? \_ Leave your ssh2 client idle for an hour or so when connected to an openssh server. It will freeze eventually and that makes SSH2 protocol support in OpenSSH useless for people who need it. \_ The fact that openssh does not support rekeying made its ssh2 protocol support nearly useless. Has this been fixed in 2.5.1? \_ Just short by one feature. No big deal. \_ This is a big deal for sites that need a working ssh2 protocol support \_ soda doesn't need ssh2. \_ fsecure ssh 2.3 and earlier have a flaw in their HMAC code. this is documented along with the openssh lack of rekeying: http://www.openssh.com/faq.html#2.3 --jon. |
2001/2/22 [Computer/SW/Security] UID:20644 Activity:nil |
2/21 Using Fsecure's (ssh v2.0.13) i attempted to do a vary large scp -r wich began fine and copied about 223 megs of files before it hung and is not doing anything. On two other machines i got about 13 (of a planned 70) megs worth of files transferred before it stopped and hung there. Has anyone experienced anything like this? What is going on? What should I do? \_ Use OpenSSH. I copy gigs (cd images) with it and have had no problem. \_ thanks, but i already had an rsync binary for these systems and i just popped that on there and ran it over ssh and all was well. |
2001/2/21 [Computer/SW/OS/Linux, Computer/SW/Security] UID:20637 Activity:nil |
2/19 http://www.securityfocus.com/bid/2364 Potentially major security hole in linux kernels up through 2.2.18 \_ Shocking. A security hole in a linux kernel... who wooda thunk it? \_ no. it is _all_ kernels, we verified this last night you want to change, in /usr/src/linux/sysctl.c (around line 1125, the line that reads int l, len to size_t l, len. - paolo |
2001/2/17 [Computer/SW/Security] UID:20620 Activity:moderate |
2/16 Anyone here running SRP telnet? The URL is: http://www-cs-students.stanford.edu/~tjw/srp It looks better than SSH (no lawsuit, Open vs. DataFellows, etc). I know its from the farm (but hell, some of are grad students there). \_ I wrote some papers with Tom, he's a pretty sharp guy. I think SRP is more secure than SSH, the only problem is that nobody uses it. Also, if I recall correctly, it doesn't encrypt anything after the login. |
2001/2/16-18 [Computer/SW/Security, Computer/SW/Unix] UID:20609 Activity:kinda low |
2/16 I've got a (very) remote Solaris 7 box that I lost the root password to (been a long time). I do have a non-privileged account on the box. Box is on the internet and it's not been patched in awhile. Any suggestions on methods/tools to recover root? I hate to have to go cross-country and hook up a CDROM drive to it. TIA (and sorry, no, I cannot post the hostname) \_ yeah, I also lost the soda root pw, and can't get to the box to hook up a CDROM. Any ideas? \_ Uh huh. "You" have a remote Solaris 7 box that "you lost" the root password to, and you need help to get it "back". \_ I'd suggest a search on <DEAD>www.wannabe-hacker-dork-info.com<DEAD> Look, if you can't find very basic info like this on the net, you have no business having root to anything. \_ Giving you the benefit of the doubt, you should probably at least identify yourself if not the hostname if you want to have at least a chance of the rest of the motd monkeys treating you as anything other than a wannabe script kiddie. Requests like this are obviously by default suspiciousa, and anonymity only solidifies certain assumptions. |
2001/2/15 [Computer/SW/Security] UID:20602 Activity:very high |
2/14 I can't connect to soda using SSH Secure Shell from SSH Communications Security. I know I can use TTSSH, but is this normal? I get a "Packet integrity error". I can connect via SSH1 to other computers ... \_ I believe this is what tom keeps complaining about. Why don't you get a different SSH client. \_ or just get rid of tom's account. \_ why don't we get a working SSH server? F/Secure implements the protocol correctly. -tom |
2001/2/13 [Computer/SW/Security, Computer/SW/OS] UID:20580 Activity:nil |
.nuS eht morf detapissid si taeh woh sa yaw emaS _\ .toidi ,loof a eb t'noD ?flesruoY _\ !toidi na ton s'ohw enoemos _\ .lairetam gnilooc a gnitalba ro gnitaropave ni ssam fo tol a etsaw ot tnaw uoy sselnu ,eciohc ylno rey s'ti ,erehpsomta on evah uoy nehw tub ,si noitcudnoc sa taeh fo dir gnitteg ta tneiciffe sa t'nsi noitaidar ydob kcalB .srotaidar esu yeht _\ ME ycneuqerf wol ,derarfni _\ .niaga gnitsop erofeb "eulc" pu gnikool yb trats ot tnaw thgim uoy ,yranoitcid eht fo gnikaeps dna ,hO .noitseuq eht gnisserdda yaw yna ni ro gnirewsna yllautca tuohtiw ,noitamrofni deriuqca ylisae htiw pu flesmih gniffup si loof siht taht gniyas m'I yllautca ,oN _\ .suoixonbo dna diputs gnieb tsuj erew uoY .uoy pleh t'now yranoitcid eht tub yrt eciN _\ .llew sa "suoiceps" dna "citnames" spahreP .yranoitcid eht ni "yrtsihpos" pu kool -- pleh deen uoy spahreP _\ .muucav a si ecaps taht esimerp eslaf eht n desab si "...woh ]ps[mucav a si ecaps fI" .si ti tahw rof tcaf fo noitcerroc elpmis a esingocer ot sseleulc oot era sretsop dtom emos ,yletanutrofnU .gniyas saw I tahw s'tahT .seY _\ .muucav a ton si ecaps taht yas ot gniyrt tsuj si sih kniht I _\ ?seicnavelerri citoidi gnituops tsuj uoy era rO ?taeh tnacifingis sevomer sag fo ytisned wol siht taht tressa ot gniyrt uoy erA ?tniop ruoy s'tahW _\ .derusaem yllanosrep t'nevah I .yas yeht oS .ecaps peed ni sretemitnec cibuc 01 rep mota negordyh 1 ylhguoR .muucav erup/eurt a t'nsi ecapS _\ ?tfarcecaps a ni detapissid taeh si woh mucav a si ecaps fI 21/2 .stsop dtom ruoy sa devirtnoc dna sseltniop sa si efil ruoy esuaceb esuoh eht fo tuo ssa tnagorra ,taf ,yzal ruoy gnikcik si mom rey ,sdrow rehto nI _\ .naelc ot ssel reh sevael ti sa tnemegnarra wen eht ekil lliw diam ehT .oot ,htnom txen esuoh eht gnitaroceder ,haey hO .dtom eht tide ot emit evah llits I dna %01 ni gnittup ,serugif 6 elbatrofmoc gnikam m'I ,serianoillim -itlum-itlum-itlum era stnerap ym ,rehgih si egagtrom yM _\ )hcus dna stnemtsevni aiv erom nrae I tub ,ssel si yralas yM .gniht erugif 6 taht drawot emocni yralas-non redisnoc t'nod I ,WTB( .hcir eldi eht fo rebmem eb ot noos - .detsevnier era sdnedivid rehto eht lla ,nwo I dnuf latum elgnis a no sdnedivid yb derevoc si erutidnepxe ylraey ym tub ,tnempiuqe retupmoc ro sehtolc yub I yllanoisaccO .)om/ecnanetniam 02$ ,om/ecnarusni 05$ ,om/sag 05$( rac ym dna )om/96$( LSD era evah I stsoc gnirrucer ylno ehT .ereht stsoc no kcab tuc I os ,stnerap ym htiw emoh ta evil I .tnuoocca tekram yenom ym otni yltcerid tser eht ,PPSE ot %01 ,)k(104 ot %51 m'I _\ .ekam ew hcum woh fo daetsni dneps ew elttil woh no etepmoc ot deen ew taht das s'ti hguohtlA .rehtie serugif 6 gnikam ton m'I dna ,)k(104 ym ot %11 gnitubirtnoc dna )elbitcuded-xat-non( stnerap ym ot om/K1$ gnidnes dna htnom a tnemyap egagtrom 0062$ gnikam m'I _\ .rehtie serugif 6 gnikam ton gnikam m'I dna tnuocca tekram yenom ym otni tisoped tcerid yb raey a K04 ~ gnivas m'I ?K54 ~ ?ekam uoy od hcum woH .K02 ylnO _\ yug lagurf- .serugif 6 gnikam ton m'I dnA .yaw taht raey a K02 gnivas ot elba m'I .tnuocca taht morf wardhtiw reve TON OD dna tnuocca sgnivas a otni kcehcyap ruoy fo noitrop a tup ot tisoped yllacitamotua esU !siht thguorht tnew ew thguoht I ,yeH _\ !lreP _\ .yenom hcum oot stsoc elif txet a ,ekorb era uoy fI _\ .siht od ot elif txet nialp a esu tsuj I _\ .txen eht ot refsnart dna egap a fo mottob eht ta pu ti ddA .)esnepxe( - ro )tisoped( + saw ti fi drocer uoy erehw eno tsal a dna noitpircsed a ni etirw uoy erehw rehtona ,noitcasnart a fo etad eht ni etirw uoy erehw nmuloc eno evah uoY .sselyap ro sgnol morf koobeton 01.0$ a gnisu ekam nac uoY .regdel a dellac stI _\ .teehsdaerps yna naht siht ta retteb era yenoM tfosorciM dna nekciuQ _\ .sesnepxe ym kcart gnipeek trats ot teehsdaerps gnikcik-ssa na rof gnikool ma I .ekorb ma I 21/2 .haissem repel ot woB _\ ?toidi na tsuj uoy era ro tniop a evah uoy oD _\ .)lairetam deripxe thgirypoc tsael ta ro( lagel yletelpmoc gnirahs elpoep rof redrah ti sekam tsuj retspan nwod gnisolc taht si ssenisub retspan elohw siht tuoba dnatsrednu t'nod I tahW _\ .roop me ekam .seibab yrc eht dna esuac eht era yehT .acillatem ttocyob _\ .erehwyna taht ees t'ndid I ?meht tsniaga delur egduj ehT _\ ! /daolnwod/moc.hsemi.www//:ptth ta hsemi tuokcehc ,tuokcalb retspaN a tuoba deirrow era uoy fo yna fI 21/2 .siht gnidaer er'uoy fi uoy era os tub driew tib A .enod llew yreV ."?uohT trA erehW ,rehtorB hO" ees oG 21/2 neuy -- ?nekorb si gnihtemoS .eromyna taht od t'nseod ti yadot tuB .drowssap emit-eno eht rof sksa dna yek eht stnirp ti erehw ptf TN ym htiw krow ot desu tI .egnarts s'tahT _\ ?dnammoc laretil eht hguorht esu nac I dnammoc a ereht si .drowssap emit-eno eht retne ot tpmorp on si ereht tub yeks htiw ptf 59niW esu ot gniyrt ma I 21/2 P: nedraG evilO ro s'noyL _\ .deirram teg ro pu ti eviG .demood er'uoY _\ .daetsni kooc ot dediced--hpargeleT no airottarT inazzaM ta noitavreser ym dellecnac tsuj I ,oslA .yadrutaS no dekcehc I nehw tfel ecaps dah yeht ,egelloC no anailiciS al airottarT yrT _\ .raey tsal ecin ylbanosaer saw taht ecalp a otni klaw ot elba yllautca saw I _\ .aedi doog a si gniht gnikooc eht ,WTB .emit txen reilrae nalP .oga skeew owt neve snoitavreser teg t'ndluoc uoY _\ snoitavreser teg nac I ,tuo reh ekat ll'I _\ .neht tuo reh ekaT .yadsruhT no rehtegot kcab teG .yadot reh pmuD _\ .smelborp ruoy lla evlos lliw ti ,deirram teG _\ .tae ew elihw dna eraperp I elihw revres ekirtsretnoc ym no retspan morf 3pm gnidaolnwod eb t'nac I taht naem t'nseod siht tuB .ecalp eht etaroced dna naelc em pleh ot retsis ym dna kooc ot mom ym teg dluohs I taht tnem uoy taht demussa I "kooc" yb _\ ... tub ,siht wenk ydaerla snados tsom epoh I .revres ekirtsretnuoc ruoy no sdaolnwod retspaN ,dnuorgkcab eht ni gniralb VT ,stnecsednacni ton -- sesruoc lareves ,erawrevlis ,rennid tileldnac naem ew ,"kooc" yb _\ .rebmemer lliw ehs gnihtemos si erutseg eht ,laem tneced a kooc t'nac uoy fi nevE .lufgninaem erom hcum hcum si reh rof gnikooC .gnivas htrow ton ylbaborp s'ti neht ,pihsnoitaler eht "evas" ot FG ruoy enid dna eniw ot deen uoy fi _\ .yaD-V rof sseletad -- .tser eht ni llif nac uoy kniht I .ecalp citnamor a ot tuo reh ekaT .etalocohc illedrarihg emos dna evots roodtuo na dnif dna lwob a ni )...cte ,sananab ,seirrebwarts ,wedyenoh deppohc( stiurf emos teG .em rof dekrow taht pit tresed ecin a s'ereH .tsaf yllaer kooc ot woh nrael retteb d'uoy tub snoitavreser teg t'ndluoc uoy taht gniht doog a eb thgim ti ,esac taht nI .reh rof rennid gnikooc yb stniop erom erocs yllaitnetop dluoc uoY .snoitavreser o/w elbaliava syawla era .rJ slraC dna ,kcarC eht ni kcaJ ,gniK regruB ,sdlanoDcM _\ ?pihsnoitaler ruo evas I nac ro sselepoh yletelpmoc ti sI .dekoob si gnihtyreve dna ,yad senitnelaV rof snalp rennid ekam ot gniyrt ,dnuora gnillac m'I !dewercs os ma I 21/2 .adoC ro SFA yrt esaelp ,retnuomotua eht ot ytilanoitcnuf ralimis deen uoy fI ).esaCraelC diputs fo esuaceb emit eht lla deneppah siht dnA .ylnaelc ti toober neve t'ndluoc uoy dna xob nuS ruoy esu t'ndluoc uoy ,ytivitcennoc tsol ro nwod tnew sretsam +SIN/SIN eht ro srevres eht fo yna fi dna ocsiC ta sexob ruo lla no sfotua dah eW .ereht neeb ev'I ,em tsurT( .smelborp fo stros lla evah lliw uoy ,gninnur ti teg uoy fi nevE .eugalp eht ekil dediova eb dluohs taht SOP yletelpmoc a stI ?retnuomotua eht htiw od ot gniyrt uoy era yltcaxe tahw dnA lmth.sfotua/SFotuA_dmA/moc.gnitlusnoc-xunil.www//:ptth :QAF retnuomotuA eht fo trap siraloS eht ta kool a ekaT .dednemmocer ton tub ,elbissop si ti seY _\ ?elbissop neve siht sI .siralos rednu +SIN gninnur TUOHTIW seirotcerid emoh tnuomotua ot gniyrt m'I ?sQAF rehto yna ereht erA .gnikrow gniht nmad eht teg ot elba ton llits m'I tub gro.plehnus.www morf retnuomotua no sQAF eht dewollof I 21/2 ?scamEX ni siht od I od woH .ni dedaol teg selif cc ym lla dna cc.* F-C X-C od nac I scame nI 21/2 .ila dna mot fo evisulcni si rosnec dnA .rotatum ,rekun ,rosnec ,llort fo evisulcni si resol .tnadnuder era eseht fo emos _\ *| tnias *| rennis *| revol | enorc *| rehtom *| nediam *| hctib |* bjt *| bjt rof gnikool | rekot thgindim | rekoms | rekoj | rennis | revol | rennirg | rekcip *| desuma tsuj ***| ?huh ?dtom *| stniop kniwt gninrae *| llort tnarongi *| llort diputs *| llort duorp | bsp! ****| bsp ***| ila **| mot *| )resol( gnahck *************| resol *| rotamrofer dtom *| rotatum dtom | rekun dtom ]DEROSNEC[ uoy ,rosnec _\ *| rerosnec dtom ***| retrotsid dtom ****| retsop dtom ******| redaer dtom :)a( ma I emit eht fo tsoM .lloP 21/2 .llehs htiw liam reiht daer nem laer _\ uf kcal ylraelc uoy ,enip gnisu er'uoy fi _\ sessylu- .)ados no toor gnieb tuohtiw .e.i( yrotcerid emoh ym ni siht llatsni ot uf eht kcal I teb I hguoht ,doog skooL _\ /ed.eniltalf.enip4pgp//:ptth ?enip4pgp deirt uoy evaH _\ sessylu- ?tpircs yalpsid dna crenip rieht fo snoitrop tnaveler eht spahrep em dnes yeht dluoc dna pgp /w enip esu ydobyna seoD .smelborp o/w esu I metsys rehtona no skrow ti ecnis pgp htiw krow nac enip wonk I tub ,ttum ta kool lliw i dna detaicerppa noitsegguS _\ .)ytsur teg t'nod slatrom su erus ekam ot( esaeler yreve sgalf gifnoc pgp segnahc yllufesoprup maet tnempoleved ttum eht ,rebmemeR .edargpu uoy litnu haeY _\ .llew yrev pgp htiw setargetni ttum .ttum ot hctiws dluohs uoy _\ sessylu- .gnikrow t'nsi pu tes I tpircs "hsc.yalpsid" eht ro putes snoitpo sretlif eht tog ev'I yaw eht tuoba htS ?ados no rof .ceps enip htiw yllacitamotua htiw krow ot pgp gnitteg rof QAF a ereht sI 21/2 .relooc si u- tros _\ .)stsop ym ngis t'nod i yhw si siht dna( POT- .toidi na m'i ,sknahT .kcits eulc kciht a htiw gnikcahw doog a evresed i hguoht sa leef I ,yoB _\ '++}_${nees$ sselnu tnirp' en- lrep :redro lanigiro sti ni elif eht peek ot tnaw uoy fi ,rO _\ qinu | tros | oof _\ ?elif a morf setacilpud LLA pirts ot yaw ysae na si tahW .rehtona eno ot tnecajda era taht setacilpud spirts ylno qinu 21/2 .yrassecen sa strop gnippam dna )tuo semoc 1.4.2 htiw gnihtemos litnu( SFresieR htiw ekardnaM-xuniL gninnur ,xob TAN a dniheb enihcam eht gnivael er'ew ,elpoep wef a htiw gnitlusnoc retfa ,sknahT _\ .suoivbo t'nsaw taht esac ni ,eulc on sah tnadnopser sihT _\ .)sQaR eht no )stelvreS & PSJ tpecxe( derugifnoc dna dellatsni-erp si ffuts bew ytfin taht lla( llew ytterp ffuts bew od dna paehc ytterp era yeht ,4/3QaR )nuS AKA( tlaboC eht ta kool a ekat XUSniL htiw ecnailppa gnivres bew detacided a tnaw uoy fI .siraloS dna DSB* naht reisae hcum XUSniL no nur ot .cte ,snoisnetxE egaPtnorF ,stelvreS ,PSJ ,)nuS AKA tlaboC AKA tfoSilihC dellac ynapmoc a aiv ,xuniL no elbaliava si PSA $M sey( PSA ,PHP ekil ffuts bew looc ytfin teg nac uoy ecnis ,gnivres bew rof XUSniL gninnur ffo retteb eb ylbaborp dluow uoY .)XUSniL ekilnu ,3v stroppus DSBnepO ,SFN tnaw uoy fi tub ,ABMAS tnaw uoy gnimussa m'I( gnirahs elif dna PTMS rof DSBnepO nur dluow I _\ ?sesoprup ruo rof retteb si hcihw ,enod dna dias si lla nehW .yawyna yad yb yad ti eruces ot woh nrael dluohs ew dna ,detroppus ylediw s'ti taht si taH deR rof tnemugra ehT .seloh ytiruces rof reffus ot enorp ssel er'ew ,seibwen sa ,taht si DSBnepO rof tnemugra ehT .pukcab gnidulcni ,ereh secivres etargim ylwols dna pu xuniL taH deR ro DSBnepO rehtie tup ot ekil dluow eW .gnivres elif dna ,PTMS ,gnivres bew rof K2niW gninnur seineew ezodniW er'eW 21/2 .yldipar etiuq daerps ot dnet sesuriv eseht dlrow swodniW eht ni stoidi fi arohtelp a stsixe ereht ecnis dnA .lavivrus rieht rof resu eht fo ycoidi eht no dneped sesuriv esehT .epoN _\ .swolBniW esu t'nod I dalG ?s09 ylrae eht fo mroW tenretnI eht ekil egdelwonk ppA/SO ro lliks gnidoc laer yna eriuqer t'nseod "suriv" siht ,oS _\ .margorp eht snur hcihw ,ti no kcilc-elbuod ot dnet sresu ;elbatucexe na tsuj si eno sihT _\ ?krow siht seod woH ?margorp gniweiv eht naht rehtar egami reiht gnitucexe trats ot margorp gniweiv eht ni swolfrevo reffub tiolpxe yeht od ,lareneg nI ?suriv a eb nac egassem liame a woh dnatsrednu etiuq t'nod I .cificeps swodniw eb ot smees ti tub ,ereht tuo suriv liame wen a si ereht taht smees ti dna 30-1002-AC yrosivdA TREC daer tsuj I 21/2 |
2001/2/13-14 [Computer/SW/Mail, Computer/SW/Security] UID:20575 Activity:high |
2/12 Is there a FAQ for getting pgp to work with automatically with pine spec. for on soda? Sth about the way I've got the filters options setup or the "display.csh" script I set up isn't working. -ulysses \_ The happy ending. Somebody fixed something because the filter works all of a sudden. Note that, if anybody else has a problem, check out /usr/local/bin/pgpdecode. \_ you should switch to mutt. mutt integrates with pgp very well. \_ Yeah until you upgrade. Remember, the mutt development team purposefully changes pgp config flags every release (to make sure us mortals don't get rusty). \_ Suggestion appreciated and i will look at mutt, but I know pine can work with pgp since it works on another system I use w/o problems. Does anybody use pine w/ pgp and could they send me perhaps the relevant portions of their pinerc and display script? -ulysses \_ Have you tried pgp4pine? http://pgp4pine.flatline.de \_ Looks good, though I bet I lack the fu to install this in my home directory (i.e. without being root on soda). -ulysses \_ if you're using pine, you clearly lack fu \_ real men read thier mail with shell. \_ pinesh! pinesh! pinesh is the Standard!!! Uhh... \_ In bourne shell a paging mail reader is about 5-10 lines of code. A real man can type it all in on the command line. \_ Just add these to your .pinerc, nothing else needed: display-filters=_BEGINNING("-----BEGIN PGP")_ /usr/local/bin/pgp -f sending-filters=/usr/local/bin/pgp -feast _RECIPIENTS_ \_ Can I still send emails to people who doesn't have PGP software? \_ are you chinese? -ali \_ That is NOT all you have to do. |
2001/2/12-13 [Computer/SW/Security, Computer/SW/Unix] UID:20571 Activity:high |
2/12 I am trying to use Win95 ftp with skey but there is no prompt to enter the one-time password. is there a command I can use through the literal command? \_ That's strange. It used to work with my NT ftp where it prints the key and asks for the one-time password. But today it doesn't do that anymore. Something is broken? -- yuen \_ Today (2/13) I tried again, and it works okay now. You just type the one-time password at the "Password:" prompt. -- yuen |
2001/2/9-10 [Computer/SW/Security] UID:20554 Activity:nil |
2/9 ssh has vunerability. Integer overflow. Openssh is safe. \_ Take that, Tom! Take that, Bowlarama! Take that, Convenience Mart! Take that, Nuclear Power Plan--oh, fiddlesticks. \_ Bowlarama! Good times! |
2001/2/9 [Computer/SW/Security] UID:20548 Activity:very high |
2/8 Question about ssh or need confirmation. - purpose of using ssh is to avoid information that I read at my terminal not being seen by someone in between the traffic, so does that mean if my terminal is being mornitored (i.e., my employer or network admin is watching my console at a remote terminal), they will only see garbled messages? - or does ssh only ensures data send between soda and my terminal not being intercepted, but once information gets displayed on my screen, a mornitoring agent can just capture the screen and still see every key stroke I type in or every message I am reading? \_ work on your fucking english \_ hahhaha...having a hard time reading? I don't see the others have any problem. Can you just point out one flaw so that I can fix it. \_ double negative, run-on sentence, fragmentary phrase, passive voice, misspelling. And that's just the first sentence. \_ ssh encrypts data on the network between your host and wherever you ssh to ( in this case, soda). If your host has been compromised by whomever might be monitoring you, there is little ssh (or anything else for that matter) can do to stop you from being monitored. \_ here's what I do at work: swap around the keycaps on my keyboard. You should see the security people tearing their hair out! muahhaha! \_ how does that help really? \_ security through obscurity. though the right way to do this is to use a qwerty keyboard in dvorak mode. and remove the 'W'. |
2001/2/7-8 [Computer/SW/Security] UID:20529 Activity:nil |
2/7 http://www.nwfusion.com/news/2001/0205ddos.html No light at the end of the tunnel for preventing/protecting against DDoS attacks. \_ This is not an engineering problem, but a law enforcement problem. |
2001/2/6 [Computer/SW/Security] UID:20512 Activity:nil |
2/3 Speaking of ssh, could soda admins generate new 'n fixed ssh host keys so that we don't have to edit our known_hosts file every time soda is switched from openssh to commerical ssh1 and then back to openssh? \_ They could. I hope they have better things to do or you'd just ignore the errors like everyone else. \_ It is pretty time consuming to copy a file. I give you that. \_ I ssh to soda from about seven different systems. It is kind of annoying to have to update known_hosts file on all of them whenever soda admins change their mind about which version of sshd to run. -original poster \_ we should just have the ssh1 ssh2 and openssh binaries each of which get called after a case statement depending on /dev/rand then tom can bitch all he wants, and he will be a happy tom. \_ redhat 7.1 uses SSH Version OpenSSH_2.3.0p1 \_ And your point is? I was not advocating using one implementation of ssh or another. What I say is that the soda admins should generate new ssh host keys so that people's clients don't compalain every time sshd is switched to openssh and then back to data fellows ssh1. The current keys are 1023bit and the sshd1 fails to acknowledge that. |
2001/2/6-5/17 [Computer/SW/Security, Computer/SW/Unix] UID:20503 Activity:nil 53%like:19809 |
02/02 OS updated. Bugs to root. Complaints on wall/motd will be ignored. \_ And so will complaints to root, apparently. Give me root for 30 seconds and I'll fix the sshd problem. -tom \_ tom is the last person that ought to have root on soda. \_ yeah, I was only the VP for a year. -tom |
2001/2/1-2 [Transportation/Airplane, Computer/SW/Security] UID:20496 Activity:nil |
2/1 Tomorrow's Groundhog day! \_ http://www.intellicast.com says it's going to be cloudy in Oakland tomorrow. So spring arrives soon? |
2001/1/31-2/1 [Computer/SW/Security, Computer/SW/Unix] UID:20485 Activity:very high 57%like:20472 |
1/31 Regarding the Soda MkV bios password, why not just reset BIOS? \_ i could, but it's old and may not like it so if there's a less invasive method, i'm all up for it, otherwise i will \_ sign your fucking posts paolo \_ Check for a bios password hack on the net. Never know.... \_ what kind of bozo would put a BIOS password on a machine in a machine room \_ One who knows just how many other people have access to the machine room and just how often some of them fail to make sure the door closes all the way when they leave. \_ get a fucking clue \_ Uhm, yeah, and? A bios password will somehow save you? Sigh... find a crack or hack for it on the net. And oh yeah, as the above said, get a fucking clue. \_ umm, judging by the posters present difficulty, i'd say Yeah a bios pwd. may save you. Not everyone has the same skill set and sometimes just making things a bit more difficult for an intruder is all it takes. There are plenty of people who just check for unlocked doors. I bet you leave yours unlocked, because, hell, they can always break a window. \_ never said it would save you, just that being in the machine room doesn't make it any more or less useful to set one than a machine left in a public place. |
2001/1/31-2/1 [Computer/SW/Security, Computer/SW/OS/Windows] UID:20480 Activity:moderate |
1/30 In NT, when I try to open or delete a file and it says "The process cannot access the file because it is being used by another process", is there a way to find out which process is using the file? Thx. \_ lsof \_ handleex.exe, http://www.sysinternals.com \_ Is Filemon from the same site better for this purpose? \_ reboot \_ That won't find out and it also won't release the file if the file is opened again at startup or login. If you don't know what you're tal-- nevermind. It's the motd. Go right ahead. \_ If you don't know, you're Tal. -- talg #1 fan. \_ chill. the answer is meant as a joke. \_ This is Berkeley. That wasn't funny. |
2001/1/27-28 [Computer/SW/Security] UID:20447 Activity:moderate |
1/26 anyone ever heard of a linux kernel patch that prevents non root users from seeing the processes of other users? what's it called? \_ it's called "stupid" \_ What's "stupid" about it? Gosh, maybe this is for something "stupid" like an ISP that allows shell access but wants to do some stuff to keep users from invading each other's privacy? Yeah, that's really "stupid". You're right. Who would want something "stupid" like that? \_ it's called uclink2 \_ reference to "uclink2" shows one's age. guess what? there's no Web under Evans anymore either! \_ http://www.openwall.com \_ I don't think you need to patch the kernel.. I think this is the default behavior if you make ps, top, and whatnot !setuid root/mem/whatever. |
2001/1/25 [Computer/SW/Mail, Computer/SW/Security] UID:20429 Activity:nil |
1/24 Anybody know of any web-based newsgroups that allow you to post a question? urlP. \_ uh, your question doesn't make sense. you can access usenet newsgroups via your favourite web browser... there are tons of bulletin board type things all over the web... what the hell are you asking? \_ For example, http://www.dejanews.com allows you to read articles, but you can't post a question. Using a news reader client, I can connect to various public news servers that will allow you to post. However, port 119 (NNTP) is shut down on the network, so I can't use any of the news readers. My only option is to go over the web, and most web-based newsgroups that I know of only allow you to read, not post. Question remains - are there any web-based public newsgroups that allow you to post? \_ you can't post to http://deja.com as an anonymous bastard. you need to register with them and go through http://my.deja.com |
2001/1/19-21 [Computer/SW/Security, Computer/SW/OS, Computer/SW/Unix] UID:20373 Activity:nil |
1/19 http://fusionone.com is finally charging people for syncing files. Let's boycott. \_ I just signed up for "Free sync for life". What are you talking about? \_ after using it for about 6 months, I got an email saying "email sync is free for life. upgrade to premium account if you want to continue using file sync." \_ Holy shit! Someone on the net is trying to make money from their web based service! That sucks! Let's boycott the net! The net wants to be free! |
2001/1/15-17 [Computer/SW/Security] UID:20329 Activity:moderate 60%like:20332 |
1/15 Who provides the time service at the number POP-CORN (767-2676)? \_ "Kernel" Sanders \_ You do not need to dial "POPCORN" to hear the time. You just need to dial 767, plus 4 other digits. ANY 4 other digits. So now you this, hopefully you can figure out who provides this service (No, it isn't some strange group of people). \_ You mean it's PacBell? So it only works in Northern California? \_ It's certainly affiliated with the telco somehow, but this did _not_ exist in SoCal last time I checked, so it's not a universal PacBell feature \_ Does not work in SoCal, even though Pacific Bell is my telco (some areas are Verizon). --dim \_ in LA it's 853-1212 (or possibly any four digits). you can find out what it is anywhere by calling 411 and asking for the number for the time. welcome to the universe. more interesting is the number to dial that repeats your own number back to you. it varies depending on Central Office, and the phone co doesn't want you to have it. sf mission area readback #: 211-0022 berkeley: ? \_ Yep. \_ It worked in Reno when I lived there, but that's also PacBell land. -alan- \_ That's not the official number anyways. Only for bwd compat \_ what's the number to get the phone number of the phone you are dialing from? \_ You have been abused by the motd formatting god. \_ I think it used to be 1-800-MY-ANI-IS, but they changed the password to it. -geordan \_ Ah, I still remember the good 'ole 80s \_ in maryland, they dont have the 767 (popcorn) feature and i find that i miss it. is there some web page that tells you where you can call up if you need to know the time when youre not in norcal? i tried a number of key search words on the web (time service, etc) and had no luck. -hahnak \_ RTFM (RTFphone book) or check providers home page |
2001/1/15-16 [Computer/SW/Security] UID:20325 Activity:high |
1/15 any plans to start running ssh2d ? \_ OpenSSH didn't work, the other ssh2d is not free, so no. \_ The other ssh2d is free for soda's purposes. -tom \_ What about http://www.ssh.com/products/ssh/download.html |
2001/1/11 [Computer/SW/Security, Computer/SW/OS/Windows] UID:20295 Activity:high |
01/11 If you or anyone you know is running a version of Borland's Interbase released in the past 8 years, forward the following information: http://www.kb.cert.org/vuls/id/247371 http://www.interbase2000.com [yes, this is a /. repost; urgency justifies it, as far as i'm concerned] -alexf \_ Uh, "compiled into the source between 92 and '94". Does interbase come as partial source + binaries-with-no-source? What about the whole open source many eyes thing? If someone can sneak in a back door account for 6+ years, what's the point of it all? Might as well use MS products for all the good OS did in this case. Normally, I'd purge this as /. repost but I find this interesting although not urgent. \_ it was not open-source whatsoever until ~6 months ago. being a huge body of code, it's not too surprising that it took 5 months to find the backdoor (especially since no one would've been looking for it directly) \_ uh, why would anyone be running Interbase. -tom \_ good question. not my concern. -alexf \_ My point is, it's not urgent because no one is running it. -tom \_ grow up man. the real world won't always conform to your sense of aesthetics. at your age you should have learned that by now. \_ ^no one^no one you know of there's a large difference between the two \_ ^no one likely to be reading the MOTD you twink^ \_ ah so tom knows everyone reading the motd (and everyone else those people know; see original tom doesn't know me: 3 tom doesn't know me: 4 post). impressive, tom. Let's try a motd poll -- tom knows me: 0 tom doesn't know me: 6 and if i ever meet the bastartd, ill kick his ass:2 |
2001/1/10-11 [Computer/SW/Security] UID:20284 Activity:high |
1/9 I've inherited an old Xylogics annex box which I'd like to set up so I can dial-up remotely via modem to access the consoles on my four home servers. Any suggestions on how to configure this? URLs would be fine. thanks! \_ Install sshd. Dialup? What millenium is this? If you must, I suggest you contact Xylogics and see if they have a manual online or can ship you a new one for a few bucks. \_ gee, does sshd run at the boot prompt? \_ How else am I to access my home system consoles except by dialup? Anyways, I found the documentation on Nortel's home page. After much frustration (their search engine SUCKS and it's slow) found some docs, but of course they are WRONG. Bunch of misspelled configuration parameters. But I think I have it finally figured out thru ESP. sheesh. Now all I need is a 2nd (working) modem. page. After much frustration (their search engine SUCKS and page-design is slow) found some docs, but of course they are WRONG, after downloading the huge PDF files. Bunch of misspelled configuration parameters to lead you astray. But I think I have it finally figured out thru my psychic abilities. sheesh. Now all I need is a 2nd (working) modem. \_ buddy system. put null modem cables between systems and make sure you don't crash all of them out to the boot prompt at the same time. \_ You mean using one workstation as the "annex" that has the modem? Ah, but then I wouldnt get to utilize and set up this annex box i got. has the modem? Good idea. Ah, but then I wouldnt get to utilize and set up this annex box i got at least not in the most ideal configuration. \_ This is what I was talking about with ssh but some smart ass deleted it. You can run ssh on each box and have: A->B->C->D->A serial connections. Thus the only way you get screwed is if you don't have net or box A and B are down, you need to get to B but A is dead and unrecoverable from D. It can happen but I doubt your home is a 24x7x365 site. \_ You can be easily screwed. |
2001/1/6-16 [Computer/SW/Security] UID:20249 Activity:kinda low |
01/05 Anyone else with @home in Berkeley (I'm northside) experience REALLY crappy service since the beginning of November? Bandwidth is still good but latency has gone up from 40ms to >200ms. \_ After 1.5 yrs of "experience" with @home on Berkeley southside, the one thing I've learned is that how your service gets fucked is not correlated 90% of the time with how your neighbors' service gets fucked. Everyone's gets fucked up once in a while, but asking other people in the area doesn't produce significant trends. -alexf \_ yup, exact same problem with @home here... up to 50% packetloss at times. it sucks. -jlau \_ I'm sorry. I'll try to restrict my pingfloods/nmaps next time. - .home user. \_ nephew from norway doing ping -f's w/o root access again? |
2001/1/5 [Computer/SW/Security] UID:20240 Activity:nil |
1/3 If I ssh from machine foo to machine bar and sshd is trojaned on bar, then they cant get my passphrase because it is sent encrypted, right? But if I login with my password, can they get that? \_ your "passphrase" never leaves your machine, because that's supposed to decrypt your local ssh ID key. Your "password" is encrypted to hand over to sshd. So sshd gets to see your login password for machine bar. It also gets to see anything ELSE you type that goes to machine bar. |
2001/1/3-4 [Computer/SW/Mail, Computer/SW/Security, Computer/Theory] UID:20228 Activity:nil |
1/2 I've been getting the following error message repeatedly lately. The authenticity of host 'quasar.cs.berkeley.edu' can't be established. RSA key fingerprint is 14:1f:b3:63:83:6a:fe:73:4e:fa:64:30:9c:9f:c3:c8. Is this a problem w/ quasar or is it the soda ssh client? Why doesn't it allow me to add quasar to my list of trusted hosts? |
2000/12/26-28 [Computer/SW/Security] UID:20178 Activity:high |
12/26 anybody ever dealt with Amazon's customer service? I ordered an m100 that never arrived. I'm trying to get them to give me some credit back in addition to refunding my money. They only offered a $10 gift certificate. Pisses me off. Anybody ever milked them for more? \_ I have used Amazon.co.uk and Amazon.de's customer service, and it was actually pretty good. \_ I got jacked trying to buy a Handspring Platinum. Normally they are pretty good (I returned a Palm Viix after two months), but this pisses me off. I used a promotional code giving me a $50 discount and they are crediting the $50 to my account (AMZN-ELECTRONIC ?) \_ So you buncha wankers are honestly upset that Amazon won't let you fuck them over for hundreds of bucks? \_ Toys R Us gave me $50 last year for missing my shipment. |
2000/12/21-23 [Computer/SW/Security] UID:20153 Activity:moderate |
12/20 Why is OpenSSH prefered over SSH1? Aren't all those bad ass patented algorithms better than the free ones? Does this mean no RSA? \_ OpenSSH is not preferred over SSH. -tom \_ Depends. You want code from the OpenBSD guys or from whoever? There's no magic in the non-Open version you'll be missing out on. \_ except working support for the SSH2 protocol and IDEA. -tom \_ OpenSSH works just fine with IDEA, you just have to enable it (and in OpenSSL). \_ ssh2? Yes... and? So what? What are you doing that ssh1 isn't good enough for? \_ Connecting from a Mac, for one. Connecting with an ssh2 client, for another. -tom \_ OK, let's see. #1 is wrong.. I connect from a mac to ssh1 servers all the time, and #2 is a tautology. Boy, you're a bright one, tom. \_ I "connect" from a Mac to ssh1 servers, but the software available has insufficient features. And #2 isn't a tautology if you are someone running a system that has to be accessed remotely (such as, just about every machine running ssh). -tom \_ How many machines with _only_ ssh2 clients have you worked with? \_ I have had to install ssh2 servers so people with only ssh2 clients could connect. Real world. -tom |
2000/12/19-20 [Computer/SW/Database, Computer/SW/Security] UID:20126 Activity:high |
12/19 One of my major performance bottlenecks is the need to log every entry in a single log file. This leads to contention for write access lock to the file, delaying each process. What to do? \_ write to per process log file, and have a background process coalesce log files together. \_ this method provides the most concurrency \_ or write to sockets with a separate process listening on each, handling the logging. \_ this method is easy and most similar to what you're already doing \_ use a real db engine \_ for something this simple it might not be worth paying for one. plus, it gives this guy job security. |
2000/12/17-18 [Computer/SW/Security, Computer/SW/Unix] UID:20119 Activity:nil |
12/17 http://www.nipc.gov/warnings/assessments/2000/00-062.htm \_ yeah. "Energy Crisis" |
2000/12/17 [Computer/SW/Unix, Computer/SW/Security] UID:20111 Activity:nil |
12/14 Why is it that the motd is not auto displayed when I login? \_ I would think this is a good feature. \_ yes, but it probably would be better to let the .hushlogin file control it, which right now doesn't seem to do anything. |
2000/12/17 [Computer/SW/Security] UID:20109 Activity:nil |
12/14 Speaking of ebusiness... http://www.eeye.com \_ hacked page archived at www.csua/~mikeh/eeye-index.html \_ My IP is blocked. Has eeye blocked everyone? \_ yes |
2000/12/17 [Computer/SW/Security, Computer/SW/OS/Windows, Computer/SW/Unix] UID:20104 Activity:insanely high |
12/16 I need Windoze software that will prohibit my employees from visiting specified web sites on the Internet (like http://cnn.com). This should be server software, so that I do not have to run out and install it on all the workstations. Does anyone have any recommendations? \_ route -add -reject <subnet> or route -add -blackhole <subnet> on your border router. \_ Yeah. Eat shit and die. \_ what company? I'll build a site serving a mirror of http://cnn.com (i.e. a simple solution to your stupid policies) \_ Thanks, but all I really want is plug-and-play Windows software. \_ The easiest thing to do is point their DNS entries to 127.0.0.1 or your corporate intranet or something. Do it on the DNS you have their workstations pointing to for name resolution. All childish "the information wants to be free!" Berkeley idiocy replies removed. --graduated from Cal and joined real world \_ I can point my machine at a different DNS server by editing /etc/resolv.conf or whatever, thus a rejecting route or a blackhole is the only soln. \_ no. You can't. Why not? Because you're a non-techie at a large company with a no-surf policy and you don't know jack shit about that. If it were a unix box you wouldn't have root at this person's company. \_ Thanks, but I do want to let them access most web sites except ones I exclude. Is there a plug-and-play solution? \_ Yes. Like I said, you add things like http://cnn.com to your local DNS as something else. Everything else works. \_ The easiest solution is to get a switch and a proxy server that can do transparent redirection of http requests to force them all through the proxy which does filtering. (Set up one with enough space to do caching and you'll also lower bandwidth usage and increase access speed.) Look at products from companies such as Alteon, Foundry, and Cisco on the switch side, and NetApp's NetCache or something similar on the proxy side. \_ Why? Do you like pissing your employees off? Are you trying to convince them all to quit? \_ Not all companies are like that. Not everyone can go get a better job in 24 hours. Obviously these are windows no-techie 8-6 slaves there to do what they're told and nothing more. These people are entirely fungible. |
2000/12/12-13 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:20086 Activity:high |
12/12 Something happened to CSUA server again? This morning I was unable to ssh in, I have to delete the known.hosts file to resolve the problem... \_ weird ssh problems this morning. Looks like the tcp/80 forwarder to soda's sshd was getting web requests! \_ Me too! \_ http://dailynews.yahoo.com/h/nm/20001212/tc/linux_shell_dc_1.html http://dailynews.yahoo.com/h/nm/20001212/bs/ibm_linux_dc_1.html \_ if it's good enought for shell and ibm... \_ I guess ECC Ram and hot swap disks and scalable processing just aren't what Shell Oil needs. \_ maybe they asked for help and got turned off when a freebsd user mouthed them off? \_ they should have contacted an OpenBSD or NetBSD user. \_ i've never had a weird problem with openssh, teraterm, putty, etc. \_ No problems with OpenSSH on *BSD (inlcuding MacOSX) or NiftyTelnet on MacOS. \_ openssh sucks. We should install ssh 2.3.0. -tom \_ freebsd sucks. we should install linux 2.2.17 -!tom \_ it really does -!!tom |
2000/12/12-13 [Computer/SW/Security] UID:20078 Activity:low |
12/11 Does anyone know of a Palm application designed to store passwords, credit card info, etc. that has encryption, requires password entry for access, enables you to sync with your PC, access all the info on your PC, and import/export the info between your PC application and, for example, a tab seperated text file? -asb (if you send me email, please send it to asb@eci.ucsb.edu) \_ Speaking of UCSB, my ex-roomie was a sorority girl from UCSB who came to attend Boalt School of Law. I did not have sex with her, but at least she got into a better school than Hastings. \_ Forget about your silly whims, it doesn't fit the plan. |
2000/12/12-14 [Computer/SW/Security] UID:20077 Activity:nil |
12/12 Is it possible to keep the same key each time SSH is changed/ upgraded? \_ They key has never changed. The problem lies in the fact that soda has a really really old key the 2 ssh programs treat the keys differently. Really old version of ssh created 1023 bit keys instead of 1024 and ssh has continued to lie about the keysize. OpenSSH's sshd, on the other hand tells the truth. This confuses your ssh client. -mikeh \_ I think that you can fix this by editing the length field for the key in your $HOME/known_hosts file. |
2000/12/12-2001/2/2 [Computer/SW/Security] UID:20076 Activity:nil |
12/12 We have switched versions of sshd since the OpenSSH one was hanging. Mail root if you witness odd behavior. -root |
2000/12/12-13 [Computer/SW/Security, Computer/SW/WWW/Server] UID:20073 Activity:nil |
12/11 What are the security implecations of allowing the Delete method? Does apache allow that by default? Does it really mean that any user could send a header commanding your server to delete any file that nobody is able to write? If so, how do you disable this methd? \_ Something like <Directory /> Deny all Allow GET PUT other-explicit-methods-you-like </Directory> |
2000/12/9 [Computer/SW/Security] UID:20055 Activity:nil |
12/8 SSH question. Any idea why I am getting this error: Invalid SSH_AUTH_SOCK `', it should contain at least one /. and it gets set to "agent-socket-21980" instead of SSH_AUTH_SOCK=/tmp/ssh-user/agent-socket-21980 ? |
2000/12/6-8 [Computer/SW/Security] UID:20022 Activity:high |
12/6 Does @home allow services? No. Y'all were wrong yesterday. http://www.home.com/qa.html#server <DEAD>www.athome.att.com/faq.html#server<DEAD> \_ Genius, you're reading the generic @home agreement. The local Bay Area one I signed when I got my service doesn't say I can't \_ but effective. I run an ebusiness from an @home site. - small traffic, high price one, and haven't had any probs. run a service. It only says I can't resell net or run a business and I'm responsible for my own security. In fact the agreement is chock full of warnings about hax0rz if I run a service but *never* says I can't. Thank you for using @home in the SF Bay Area. \_ The one I signed in Fremont explicitly says I can't run a server, and I get scanned for running NNTP every day --dbushong \_ Disallowing and preventing are entirely different. \_ Hey, that's naughty! \_ but effective. I run an ebusiness from an @home site. - small traffic, high price one, and haven't had any and he's had no problems either. @home doesn't seem to mind/care. ----ranga probs. \_ My brother runs a Cobalt Qube3 with web/ftp/nat/ssh and he has had no problems. @home doesn't seem to mind/care. ----ranga |
2000/12/6 [Computer/SW/Security] UID:20014 Activity:nil |
12/5 If you run xdm rather than ssh-agent xinit, is there some way to use ssh-agent for everything and not just "ssh-agent xterm" ? \_ yes. \_ More helpfully: put the line eval `ssh-agent` near the beginning of your .xsession. |
2000/12/6-7 [Computer/SW/Security] UID:20011 Activity:nil |
12/5 I am trying to write a report on SSH does anyone know why X11 forwarding makes a host more vulnerable to attack? Any good sites to find information on the weak spots of SSH? I have the RFC but don't know enough write about weak points of SSH. -nesim \_ If a bozo user types 'xhost +' on either end of the connection, then all the ssh in the world won't keep others from sniffing their keystrokes via X. \_ The argument goes as follows: if you ssh from your trusted host, to an untrusted host, then from there to a trusted host, and run X clients off of the remote trusted host, SHOCKER: root on the untrusted host might be able to do something nasty. Fucking duh. I hate it when shit like this gets called a security hole. Once and for all, people: YOU CAN NOT PROTECT YOURSELF FROM A MALICIOUS root USER. PERIOD. (Please don't cite non-unix operating systems or some silly securelevel hack as way of counter"proof") |
2000/12/5-7 [Computer/SW/Security, Computer/SW/WWW/Server] UID:20009 Activity:very high |
4/249 I think my employer logs all web traffic. Is there any free software I can run to block this? Like a proxy or some sort? Thanks. \_ http://www.anonymizer.com if you don't want to pay for ssl service do the following: 1. setup apache+ssl at home 2. write a cgi that takes in url request and then forwards it to anonymizer and parses the response to get rid of the annoying tags. 3. configure your browser to use your home box as a proxy Other options include hacking junkbuster to support https. \_ j is that you? \_ you idiot, I can't even log into soda from work thanks to a certain wonderful firewall. \_ yes theres plenty of ways to do this. \_ obhttp://www.zeroknowledge.com (it's what it was meant for - i.e. people not knowing what you are doing exactly) \_ How to check that the company logs all web traffic? \_ write a bot that hammers a bunch of sites, such as http://apple.com, http://sun.com and http://microsoft.com. run it on your machine and all the other machines you can get your hands on. Clueless admins will think that its 'software updates' or some such thing. Your real traffic will be obscured by the noise. Eventually the will give up and realize that logging is stupid. |
2000/12/4 [Computer/SW, Computer/SW/Security] UID:19990 Activity:insanely high |
12/4 E-COmmerce sucks. COmputer science rewls. \_ Got fired from http://dogfood.com? \_ Doing work sucks, playing around with a hobby rules. Good luck guy, hope you can come up with something intersting for the academic community to attack. \_ You got your whole life to find something that you like to do and that someone will pay you for doing. Get to it. If you can read the MOTD, it's not hard to get there from this point in your life. \_ Computer science doesn't pay for my Armani collection and my awsome Boxster -paper millionaire \_ But I am perfectly happy with blue jeans and t-shirt, and my little Miata. |
2000/12/3-4 [Computer/SW/Security] UID:19986 Activity:low |
12/1 Say I want to encrypt some text files that I don't use that often (eg, sent-mail files). Is there any command line util better than crypt available to do this? Maybe something that uses the new DES standard? (I don't want to attempt spelling it) \_ Use "pgp -e". \_ Does this have a batch mode for (de|en)crytpting multiple files? \_ You mean the new AES standard. (And Rijndael isn't _that_ hard to spell) \_ If you're some anthropologist used to garbage 'languages' from the underlife, maybe. |
2000/12/2-4 [Computer/SW/Security] UID:19978 Activity:high |
12/01 Anyone get TeraTerm + ssh to work connecting to Soda? I changed the protocol to blowfish, but SSH mysteriously drops after attempting to connect. (Alternatively, a list of win32 ssh clients would be usefull--I didn't find the ones on the csua www page to be useful.) \_ It works for me. Does it give any error messages when it disconnects? Can it connect to other machines than soda? \_ Here is the obligatory why don't you install a real os with a real ssh client follow up. \_ I installed it on my dad's Windows98 box to login when I visit them and had no problems (other than getting a new key when we went to Mark VI). -- bcmuller \_ Worked fine for me as well, and I've installed it on several different machines (win98, win2k, winnt 4) \_ Are you sure you're using Tera Term Pro and TTSSH? \_ Works for me, too. -ausman \_ sshd has been acting up - there have been random times when it has refused connections. From what I know mikeh has been considering installing the old ssh. This is information dated last week - paolo |
2000/11/29-30 [Computer/SW/Security] UID:19951 Activity:high |
11/29 So, i have host based ssh authentication going; i think. How to test? If i try to use scp from an authorized user/host it still prompts me for a password. Does that mean i don't have it set up correctly? (i'm using openssh) \_ If you mean you want to use a .shosts file, you need to: * make sure the server has: RhostsRSAAuthentication yes IgnoreRhosts no * put the hostname (and optionally username) in ~/.shosts for the target user (on the server) * ssh from the _server_ to the _client_ using the same hostname that the client will reverse as (i.e. if your client is 1.2.3.4, and 1.2.3.4 reverses as <DEAD>joebob.example.com<DEAD>, ssh <DEAD>joebob.example.com<DEAD>) If your client is a windows box, this is more complicated and you'll need to configure your client software to generate and use an ssh host key. Make sure the host key is in ~/.ssh/known_hosts * ssh -v server from the client to test --dbushong --uglydbushong |
2000/11/29 [Computer/SW/Security, Recreation/Dating] UID:19943 Activity:nil |
11/28 http://www.wired.com/news/culture/0,1284,40369,00.html \_ Sign up fast before they run out!! Finally, women that geeks have a chance with! |
2000/11/28-29 [Computer/SW/Security] UID:19938 Activity:nil |
11/28 With SSH, when we change our password for the account do we have to regenerate the one time pass phrass? \_ Nope, they're separate. |
2000/11/28-12/4 [Computer/SW/Security, Computer/SW/Unix] UID:19937 Activity:kinda low |
11/28 NIS question. My nsswitch.conf has the line passwd: files nis nisplus To me this says that the user should be looked for in the passwd file first, then checked for in NIS, then NIS+... Yet when the NIS server isn't available, I have to wait for a huge timeout before I'm finally logged in (yes, there is an entry in the passwd file). Why does this happen and how do I get the expected behavior? -mogul \_ It's probably doing something other than a passwd lookup. You'll have to truss the process to find out what. -tom \_ Or you can check for other nis lines in the nsswitch.conf automount, group, hosts may all be blocking on nis lookup. It may be something in your .login/.profile/.[t]cshrc file causing an nis lookup as well (like having someone else's homedir referenced in your path). --scotsman \_ If it's stalling in .cshrc, I think there is some option you can set in .cshrc to show you where. Put a line with 'set verbose' or something at the top of .cshrc And if you have root, then login as root and see if the problem still exists. Since root has simpler dotfiles and should have no remotely mounted home dir, you can use it to narrow down the possible problem. You might also modify nsswitch.conf \_ Yes, but only if I log into another client served by NIS. My home directory gets mounted from my main machine. On my machine, the passwd home directory entry is set to the local directory so it doesn't go through autofs... -mogul to remove nis and nisplus and see what happens. Make sure you have another xterm open however just in case modifying nsswitch.conf locks you out. Also try getent passwd YOURUSERNAME and see if it says what you think it should be (i.e. is your home dir really on your local desktop disk?) Also check /var/*/messages file for errors \_ what's in the groups line? is your default group in a file or in nis? initgroups usually takes forever \_ groups line was fine, but my group was missing from local /etc/group. Still didn't solve the problem though. I will try tom's suggestion when I return to work. -mogul \_ These things are often due to DNS problems. \_ is your home directory auto-mounted? could be the auto mounter maps are stored on the nis server. \_ Try: passwd: files nis [NOTFOUND=return] nisplus -- ivy |
2000/11/16-17 [Computer/SW/Security] UID:19808 Activity:moderate |
11/16 Do we want to copy over the old ssh host key? Or is it a feature? \_ The host key has not changed. ssh has. We're now using OpenSSH. \_ Oh course the host key has been changed. Otherwise I wouldn't get this when trying to login: \_ Due to a bug, old ssh created a 1023bit key instead of a 1024 bit key. It advertized it as 1024bits. OpenSSH tells the truth that it's 1023, which makes your ssh client unhappy. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! \_ ooh! Someone could be eavesdropping on you right now (man-in-the-middle attack)! ..... \_ you can fix this by editing your ~/.ssh/known_hosts file. next to the csua key, change the length from 1024 to 1023. |
2000/11/16-19 [Computer/SW/Security] UID:19804 Activity:nil |
11/16 Why does the new sshd reject cipher type IDEA on Mk6? \_ because the new sshd does not support IDEA. \_ Why not? \_ Is it possible to build openssh with IDEA support? \_ Probably because IDEA is patent encumbered, where 3DES and Blowfish (and twofish, and rijndael, etc) are not. |
2000/11/15 [Computer/SW/Security] UID:19783 Activity:high |
11/14 ssh question. I cant get a .shosts file to work, I think it has something to do with this error Remote: Your host key cannot be verified: unknown or invalid host key. Any idea what I need to fix? \_ You need to add the client's host key (/etc/ssh_host_key.pub) to the server's known hosts file (/etc/ssh_known_hosts). The filenames vary; try adding "/usr/local" at the beginning, and try replacing "etc" with "etc/ssh". |
2000/11/10 [Computer/SW/Security] UID:19705 Activity:nil |
11/9 I'm having a problem with pam and openssh. Anyone know what the /etc/pam.d/sshd file ought to look like? |
2000/11/5 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:19647 Activity:high |
11/5 http://www.cnn.com/2000/TECH/computing/11/02/mideast.webwar/index.html \_ wow. maybe l33t h4c0rs can go there to get mecenary jobs. \_ 3733t HaxX0rz w1LL k1cK y)u 1n the nu7z. \_ religion sucks. It does nothing but bring an endless lists of wars and senseless deaths. \_ not to mention kicking people in the nuts. |
2000/11/1 [Computer/SW/Security] UID:19622 Activity:moderate |
11/1 Can someone pls fix POP and IMAP access to soda? Thx. \_ I never seem to get a break around here. - someone \_ Done. -root \_ It seems to be broken again. Can you fix it again? \_ Done, again. If you have any idea what's causing inetd to hang, let us know. -root \_ Yes. root can do it. \_ P(E|E) = 1 |
2000/10/29 [Computer/SW/Security, Computer/SW/OS/Windows] UID:19593 Activity:nil |
10.29 http://www.theregister.co.uk/content/1/14265.html |
2000/10/27 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:19580 Activity:nil |
10/26 http://www.cnn.com/2000/WORLD/meast/10/26/israel.cyberwar.ap |
2000/10/25-26 [Computer/SW/Apps/Media, Computer/SW/Security] UID:19565 Activity:moderate |
10/25 http://www.pantyraider.com \_ Now why don't they have something like predicateRaider? Now that might hold my attention. \_ is that like ContextFreeGrammarRaider and LR1Raider?? \_ woo woo! \_ How about corporateRaider? That would be *interesting*. \_ almost related: http://www.phonebashing.com |
2000/10/12-13 [Computer/SW/Unix, Computer/SW/Security] UID:19460 Activity:high |
10/11 Pointer to how to make a secure ftp connection from cory to csua? \_ man scp \_ use ssh to port forward a port from cory to soda, then use ftp -P to connect to that forwarded port. Don't forget to use passive mode. \_ it's -p ftp -P 9001 \_ ssh -L 9001:csua:21 ssh -L 9002:csua:20 (can you do these two at once?) ftp -p -P 9001 localhost \_ I tried this ssh -L 9001:csua:21 from home and it just spit the usage info back at me. So i tried it locally (i.e. from HERE) and it did the same thing. \_ You need to add the remote host: ssh -L 9001:csua:21 csua \_ I had tried that but it just logs me in! \_ The port forwarding is a side-effect. As long as you are logged in, the port forwarding is on. I suggest using scp unless you really, really need ftp. -- jsjacob |
2000/10/9-10 [Computer/SW/Security] UID:19445 Activity:high |
10/9 Shouldn't we upgrade to OpenSSH/OpenSSL soon? \_ why "should" we? -shac \_ Because of inherent weaknesses in the SSHv1 protocol that are corrected in SSHv2 which \_ must protect uber-super-sekrit soda crap?!? is implemented by OpenSSH. \_ and why then should we use OpenSSH instead of the free (to academic institutions) ssh2 server? -tom \_ OpenSSH default install allows connections to/from Either SSH 1or2 and at least one of the commercial SSH2 servers doesn't pretend to attempt validation on bad names. (not that that matters on SODA) -crebbs \_ the ssh2 server also allows connections to/from either ssh 1 or 2. -tom |
2000/10/6-7 [Academia/Berkeley/CSUA, Computer/SW/Security, Computer/SW/Unix] UID:19430 Activity:nil 52%like:19447 |
10/6 Readline enabled wallall in /csua/bin/wallall-rl. man readline for details. Mail root to let them know how much you want this to be the default. Bugs to mogul. -mogul |
2000/10/2-3 [Computer/SW/Security] UID:19396 Activity:nil 75%like:19390 |
10/02 Going to India next month and need a ssh client there. How do I log onto Soda if I am far away, and don't have permission to download any ssh client there? \_ http://www.csua.berkeley.edu/ssh \_ thats a ssh-in-your-web-browser java implementation of ssh. IMHO it is pretty darned good. \_ you can also use s/key. http://www.CSUA.Berkeley.EDU/skey-howto.html \_ I like the windows program for skey at http://www.yak.net/skey it also includes binaries for dos, mac, sunos, ultrix, and source |
2000/10/2 [Computer/SW/Security] UID:19390 Activity:nil 75%like:19396 |
10/02 How do I log onto Soda if I am far away, and don't have permission to download any ssh client? \_ http://www.csua.berkeley.edu/ssh \_ thats a ssh-in-your-web-browser java implementation of ssh. IMHO it is pretty darned good. |
2000/9/29 [Computer/SW/Security] UID:19367 Activity:nil |
9/29 http://www.eros-os.org/essays/capintro.html |
2000/9/27-28 [Computer/SW/Security, Finance/Investment] UID:19337 Activity:nil |
9/26 E*Trade security problem: http://www.sfgate.com/cgi-bin/article.cgi?file=/chronicle/archive/2000/09/26/BU22755.DTL |
2000/9/26 [Computer/SW/Security, Computer/SW/OS/Windows] UID:19326 Activity:kinda low |
9/25 For DOS programmers, is there a version of Borland C 4.5 (or any other version for DOS) run-time library that has a qsort() routine that works with huge pointers (__huge *)? Thanks. \_ Watcom does. You're fundamentally not going to get clib routines from a compiler which doesn't support flat-mode memory access like Watcom does with DOS4GW. |
2000/9/21-22 [Computer/SW/Security] UID:19307 Activity:kinda low |
9/20 A friend of mine got hacked through wu-ftpd, (right about the time I was wisely moving to proftpd). He was woken up by the irregular clicks of his hard drive and was able to disconnect them. They were attempting to install a root-kit called "anivnew" Has anyone heard of it? Where can i find more info? [i've searched the web to no avail]. There was a "ps" command, which i can see how it would be useful to disguise what was going on, but it seems to work correctly (i.e. i can't figure out what kind of activity it doesn't report). Also there is an SSHD serve included in the kit. WHY? (A poster mentioned that they want to secure their "victim" site but that seems like an inadequate explanation). \_ Well, duh. This wu-ftpd problem has been reported and fixed months ago. Anyone who still runs the old vulnerable version deserves to be hacked IMHO. \_ By replacing sshd, they can patch it to 1) Sniff passwords 2) create a backdoor 3) Disable logging \_ By using sshd they can hide better from intrusion detection & tracking systems \- btw, do you know what version the trojan sshd claims to be? there might still be a way for a good IDS to detect it. if you can mail me the src or binary, i would apprecaite it. would like to work on a detection heuristic for our IDS. --psb \_ proftpd had a remote root hole not too long ago... (doesn't hold a candle to wu' though =) \_ that one apparently never got exploited \_ In the same way that openbsd reports long lists of exploits and holes, mostly, they are proactively discovered and patches released before the rest of the world knows about them. All software projects have bugs. Some are fixed before they get abused, others are fixed after. I prefer the former. \_ USE WINDOWS! |
2000/9/15-18 [Computer/SW/Security] UID:19258 Activity:nil |
9/15 Someone mentioned a security hole proftpd versions post 1.2.0pre9 (though the web page seems to think anything after 1.2.0pre9 is o.k.) Can someone tell point me to specifics. I'm running pre10, but older than the date that was specified. More info please. \_ if there was one, it would probably be in the bugtraq archives on http://securityfocus.com \_ yes, see http://securityfocus.com; no successful exploits are known yet (or, if there are, they've been an extraordinarily well-kept secret). And yes, older pre10's are still [theoretically] vulnerable. |
2000/9/8-10 [Computer/SW/Security] UID:19206 Activity:nil |
9/7 Goddamnit. Why do web sites / hosts limit the length of passwords? Ooh, increased security by reducing the hashable characters. Good idea \_ Because most people are stupid and would forget anything longer than their own first name. |
2000/9/6-7 [Computer/SW/Security] UID:19179 Activity:nil |
9/6 Does anyone know if there's an SSH extension for Windows Telnet? I'm having trouble with the Whacked out Java SSH. It can't run well when using Pine or Pico. Sorry if this screen looks messed up. I can't see what I'm typing in Pico. --pcjr \_ dont fucking use pine or pico. \_ F-Secure SSH \_ http://www.zip.com.au/~roca/ttssh.html |
2000/9/6-7 [Computer/SW/Security, Computer/SW/Unix] UID:19178 Activity:moderate |
9/6 I would like to install some software for the CSUA community. I have mailed root about it but got no response. Am I going about it the wrong way? \_ Obviously, you have wronged root at some point in the past. Better backup your home directory. ;) \_ This one is just for you. \_ Well, that's sound advice even I haven't wronged root. So thanks. \_ The politburo decided answering root mail was a waste of time so kicked everyone off root who actually answered root mail. \_ Actually that was mikeh. |
2000/8/28 [Computer/SW/Security, Computer/SW/OS/OsX] UID:19105 Activity:high |
08/27 Does anyone know of any SSH and/or scp clients available for the Macintosh (free or otherwise)? Thanks -dans \_ F/Secure SSH http://www.datafellows.com NiftyTelnet SSH http://www.lysator.liu.se/~jonasw/freeware/niftyssh Do a fuckin' web search next time. -tom Do a web search next time. -tom \_ you could even have looked on www-inst or www.csua (localhost). *duh* \_ Did both. Asked the motd in case I missed anything. Anybody know if the version of F-Secure for the Mac on eecs-inst is the full version or an evaluation version? -dans \_ If you've read it, remove your fucking motd entry. \_ BTW, this one's not legal in US until 20 Sept I believe (RSA patent needs to run out or something) |
2000/8/16 [Academia/Berkeley/CSUA/Motd, Computer/SW/Security] UID:19013 Activity:nil |
8/14 Is there anyone with root access in the CSUA office during the summer? If so, who are they and approximately what time/days are they there? Thanks. \_ call in the afternoon. sometimes one of us is around. -root \_ Who do I email to set up an appointment? staff@csua or root@csua? (unless you mean to call literally....) \_ yeah you can call 1 510 I DONT CARE bitch ass mutherfreak. </MOTD> --------------------------- [ cut here ] --------------------------- ------------ [that's it, nothing else to see, scuddle along now] ------------ dHHHbo._ dHF""HHHHb. dHH _ "HHHHb. HHH_'o "HHHHHb. HHFo "HHHHHHbo. HHH\`, HHHHHHHHHHho._ HFHH`._,'HHH' `HHHHHHb_ ____ P "HHHHH\HP "HHF:. `._ ,-'"" "-. "HHFHHF F" :::..""" "-. `. F PF , \ \ F j\ / ; `. | j `. ` A \ | | ;_ . 8 \ J F\_,'| "`-----.\ j `. \ F j F | F / \ \ ____ ,.. J J | | F j `. ,'" ""--/::::-_ | F_j F J / `. : ._`::::-_ F J____J J j `-_ __,.----"`--._ ::::; F | | F _.--' `. ""---" | F | _.------'"" : J J | ' \ "`. F F l _____.....--"""-. "; __.-""- J """"" `-. ;. (.___...-' "-.j |
2000/8/15-17 [Computer/SW/Security] UID:19000 Activity:nil |
8/15 URL for freeware windows ssh client? Doesn't have to do anything fancy. Only using it to login to a remote ssh-only box to run one script for a user. I don't care about emulation quality, features, or anything else beyond basic ssh'ing ability. No demoware with interactive nags, delays and self bombing timers. I want to install this for the user just once and forget about it forever. Thanks! \_ http://www.employees.org/~satch/ssh/faq/ssh-faq-2.html#ss2.2.3 \_ Found what I needed. Thanks again! |
2000/8/15-16 [Computer/SW/Security] UID:18995 Activity:low |
8/14 Is there anyone with root access in the CSUA office during the summer? If so, who are they and approximately what time/days are they there? Thanks. \_ call in the afternoon. sometimes one of us is around. -root \_ Who do I email to set up an appointment? staff@csua or root@csua? (unless you mean to call literally....) \_ yeah you can call 1 510 I DONT CARE bitch ass mutherfreak. |
2000/8/14-15 [Computer/SW/Security] UID:18980 Activity:moderate |
8/14 I have installed proFTPD and want to change the banner, which announces what it is, i have altered /etc/welcome.msg and that has changed half of it but not all. How can i change the rest? \_ Use the source, Luke! \_ Careful. Remote root security hole in proftpd's older than July 28th. --dbushong \_ Arg. I installed proFTPD because it's supposed to be MORE secure \_ Try ncftpd. It isn't based on the same shitty ancient ftpd source as almost everything else out there. \_ As did I. Its track record of one remote root in however many years >>>> wuftpd's "root hole of the month" And, yes, I like the apache-style config. --dbushong |
2000/8/11-14 [Computer/SW/Security] UID:18965 Activity:high |
8/11 Can anyone recommend a good network monitoring program? We have multiple Sun Servers and a buncha PC's, on a 100-BaseT subnet. \_ mrtg? \_ Memorize References to Tron Game? \_ look it up on google \_ What exactly are you going to monitor? \_ Would like to pinpoint any problem areas, slowness, lack of response, highest use, etc. \-sounds you want to monitor the network, not monitor *over* the network, in which case ping, traceroute etc. are not what you want. mrtg is pretty nice and has a lot of uses. but to answer your question: if you want to be serious about this, you get to get someone who really understands this stuff and is well-briefed about your network topology, your priorities and other local conditions. too many people spend lots of money on these big industrial strength solutions like sun net manager or that hp open whatever when a halfway clueful person can cobble something together from free stuff that meets your needs better. but they have to know exactly what you want to monitor. it is a very different matter to continuously watch for suspicious stuff security-wise vs. once a week snap- shots for capacity planning to have off-line stuff in place that can be quickly brought online to diagnose things. it is a differnt problem to get exact info about one "class c" vs. get 95% accurate info about a couple of classBs, but to be able to get it really fast, also depends whether you have privilaged acess to routers, whether you are worried about denial of service [a realy problem with a lot of monitoring setups] --psb service [a real problem with a lot of monitoring setups] --psb \_ is it all one ethernet? how many routers you got? \_ Sorry to be anal, but ping, traceroute and snmpwalk work for me. \_ ping and traceroute are practically useless for monitoring a local network. -tom \_ Depends on the size and subnetting. We use ping, traceroute and snmpwalk with some homebrew perl/java cgi frontends for managing/maintaining our heavily switched/routed lab nets at cisco. \_ gee, if it's switched and routed it's not local. \_ local to me means everything on my side of the BFR (I mean 12000 GSR). If you think local all on the same switch, I beg to differ. I might agree for all on the same VLAN. |
2000/8/10 [Computer/SW/Security] UID:18945 Activity:moderate |
8/9 I just installed openSSH --with-tcp-wrappers on my Redhat 6.2 box and outgoing functonality works great but when i try to connect using eith ssh1 or 2 i save a key but then "password authentication fails." I am quite certain i am using the right username/password combo. What could be going wrong? I can still telnet in, there is nothing in the hosts.allow/deny files that could be causing this. \_ ssh -v \_ Read the FAQ on OpenSSH. You need to modify pam.conf or something like that to get it to work. --PeterM \_ not pam.conf, /etc/pam.d/sshd, look in ~peterm/sshd \_ You need to instal openbsd where it "just works". \_ or freebsd 4.x, or debian linux (apt-get install ssh) |
2000/8/7-8 [Computer/SW/Security] UID:18905 Activity:high |
8/6 <DEAD>www.svmagazine.com/2000/week33/features/Story01.html<DEAD> Months later, the public was let in on the joke. Naughton had agreed to give technical assistance, including writing software, to the FBI in exchange for a lighter sentence. Neither Naughton, the U.S. Attorney's office nor the FBI will comment on the nature of his work. \_ We'll find out the details this week. \_ moral of the story-- YOU ARE BEING WATCHED. Think twice before you post on motd, wall, email, or download porn. Everything is taken as literal, even in the so called internet fantasy world. \_ and dont forget to encrypt your pr0n \_ zbeny bs gur fgbel-- LBH NER ORVAT JNGPURQ. Guvax gjvpr orsber lbh cbfg ba zbgq, jnyy, rznvy, be qbjaybnq cbea. Rirelguvat vf gnxra nf yvgreny, rira va gur fb pnyyrq vagrearg snagnfl jbeyq. \_ naq qbag sbetrg gb rapelcg lbhe ce0a \_ Thank God I use my own encryption method to edit the motd. \_ I think this was all an elaborate plot by the FBI to get a young, extremely talented programmer to sign his life away on some classified government project. He was probably targetted because they saw that he was a super smart guy in an unstable marriage who visited sex channels on IRC. |
2000/8/2-3 [Computer/SW/Security] UID:18847 Activity:kinda low |
8/1 The java SSH client we have running does not use https:// so i assume that when i put in my password it gets sent plain text. isn't the whole idea of dis-allowing telnet was to aviod the sending of plain text passwords? \_ nothing to do with it. the http part is just to download the ssh client locally. from there, you run ssh which creates a secure connection to the remote host (which is where your password gets transmitted). \_ What (s)he said. Of course, if you're really paranoid, you should care that you didn't download the java ssh client via https, because someone who noticed you fetch it a lot could hijack your download and replace the safe app with a compromised one. Unlikely? Sure! But then again... you're using ssh instead of telnet, so.... \_ I thought this would be a problem too. But when running unsigned Java applets, aren't network connections restricted to the host that the applet was loaded from? This wouldn't eliminate the vulnerability, but it would at least limit it. (A rogue program would have to be set up on the web server which listened for connections from hacked ssh clients.) \_ That's the theory. You trust it in practice? |
2000/7/29 [Computer/SW/Security, Computer/HW] UID:18811 Activity:moderate |
7/28 Hi-Tech and all the other cheap places in Berkeley have gone under. Where is a cheap, but decent in terms of service, place to buy a computer in SF (or Berkeley). \_ Central Computer has been our OEM of choice for a while. -nweaver \_ For a personal computer, buy parts from out of state and assemble. For your company, buy Dell. \_ God forbid a part doesn't work. Ah, to live in L.A. near hundreds of OEM vendors. |
2000/7/28-29 [Computer/SW/Security] UID:18808 Activity:kinda low |
7/28 What are the security implications of using a network time server? \_ If someone nasty can control your clock precisely it may make it easier for them to guess the values that will be generated by psuedo-random algorithms seeded with the current time. If those are used to form keys or such, security may be weakened. However, many security protocols, such as Kerberos & NIS+, require computers to have relatively close ideas of the current time so that they can prevent replay attacks by rejecting packets with far-off timestamps. |
2000/7/28-29 [Computer/SW/Security] UID:18807 Activity:high |
7/28 That web-based ssh client we have is Phat,K-RAD and 2C00l. i want to implement that on my server so i can access it if at a comp. without ssh. What are the security implications? \_ It posts your username/password and session log to alt.security.gotcha, but is otherwise pretty safe. |
2000/7/26-27 [Computer/SW/Security, Computer/SW/OS/Solaris] UID:18771 Activity:nil |
7/24 Is there a way to install WindowMaker on a Solaris machine without root access? Any url/pointer? \_ ./configure --prefix=/someplace/youcanwriteto/ make make install and then you're done. Not very hard. |
2000/7/21-22 [Computer/SW/Security] UID:18746 Activity:high |
7/21 Is there a way to get root access given (unlimited) access to console on a sparc20 box with solaris 2.5.1? The pricks in IS&T are taking over a month to fix some things on my desktop machine and I really need to take care of several of them to get anything done, at risk of pissing off IS&T. Please withhold the "if you don't know how to do this, you shouldn't have root anyway" flames; i know how to fix what I want fixed, while not fucking up anything else. \_ Well, if the other things fail you could try: <DEAD>phrack.infonexus.com/search.phtml?view&article=p53-9<DEAD> I haven't done this, and don't know whether it will work with your model+keyboard. --Galen \_ Thank you kindly. This worked like a charm after a few small corrections (s/1\@/@/g). \_ How do you find the memory address of the process? ps -lp gives me a ? for ADDR \_ It didn't do that for me; make sure you're running /usr/bin/ps though (/usr/ucb/ps, for one, has entirely different flags). If that fails, poke around in /proc/$$/, it's probably visible from somewhere in there (try bytes 0x48-0x4B of /proc/$$/psinfo). Make sure to check the current contents of *(process_pointer)+0x18 first, and see if it matches your current ruid (or risk clobbering something random in memory) \_ Boot from CD. -tom \_ No CD drive (or floppy for that matter) \_It is likely that your box was installed over network and the install server is still acting as boot/install server. In this case you can boot of the network by typing "boot net" from open boot prom. This is equivalent to booting from CD. Of course, this wouldn't work if boot prom is password protected. In this case you might need to swap the prom chip. Though, if your box is also locked then you can't get root without breaking things. \_ Borrow a cdrom - the CSUA has a sun-compatible one. \_ unless of course they set a prom password, in which case you're pretty hosed. \_ or swap in a prom. Or swap in a disk with your favored configuration. With physical access it's always possible. -tom \_ Mmm..physical access.. *drool* \_ They all say they know how to fix what they want fixed without fucking up anything else. Why don't you talk to their manager or have your manager talk to their manager? If it's truly preventing you from getting work done then it's a big deal and i'm an intern. it's not _/ taking matters into your own hands will just mask a problem. Maybe IS&T is short-staffed and enough complaints will allow them to hire, for example. --dim \_ IS around here is absolutely hopeless. Trust me, this is the last resort. \_ Well, if the other things fail you could try: <DEAD>phrack.infonexus.com/search.phtml?view&article=p53-9<DEAD> I haven't done this, and don't know whether it will work with your model+keyboard. --Galen |
2000/6/19-20 [Computer/SW/Security] UID:18498 Activity:high |
6/19 Any suggestions for a Win98 SSH client? \_ F-Secure but you have to pay $$$ \_ Yes. Go get a real OS. \_ teraterm is pretty stable and has some nifty features (eg recognizing most xterm escapes and imitating unix cut'n'paste behavior with respect to right/middle clicks) \_ TeraTerm plus TSSH. I'm using it right now. See: http://www.csua.berkeley.edu/ssh-howto.html \_ I'm using "SSH Windows Client" that I found from the same page. -- yuen \_ I use it at home and at work. Works great. |
2000/6/14-16 [Computer/SW/Security] UID:18465 Activity:high |
6/14 I have written a program that "pipes" port1 to port2 on a machine [so if you do say telnet foo 25 that can automatically send to to port 19, chargen]. Is there a way to grab all the unbound ports and map them to chargen, to deter people scanning my machine? Will that be an expensive program to run? I don't want to launch one version of the process for each port. Thanks! \_ Why are you even doing this? You're reinventing the wheel. Just use the IP firewall rules built into your OS to port forward a range of ports. \_ I want to turn this on and off. Also not all OSes support IP firewall. Would like to do this at the application level. Can you tell me how to listen on all the unbound ports like inetd? \_ Sheesh, get a real os. What are you using? win 3.1? \_ It's actually a vintage box; running a hacked-up TCP/IP stack for CP/M. I'm using it as a low-load web server \_ inetd doesn't listen on all unbound ports - it listens on the ports listed in inetd.conf. You could write a program that looped through all possible port numbers and bound them (if your OS supports opening 64k fd's in a single process) but that would prevent any other app from being able to bind a listening port. \_ N0H0ZERZ! \_ If the ports are unused what's the big deal? You can't stop a scan. And if you have insecure services running on other ports, your program won't help that either. What are you trying to do? What's the point? Your program won't do anything useful for you. \_ An easier thing to do is run FreeBSD 4.x and in /etc/rc.conf set tcp_restrict_rst="YES" This will cause connections to ports with nothing listening to hang until timed out. This pretty much kills portscanning. --dbushong \_ Who cares? Let em scan. Security through obfuscation and irritation is not security. You're only slowing down the inevitable. \_ If you don't believe in "security through obfuscation" you won't mind sharing all your passwords with me. \_ That's different. A password is obscure in a way that in order to crack it, you need to try a bunch of random combinations before you can get it right. Security through obscurity is where a backdoor exists but you just hid it somewhere. It's the difference between a key to your house and hiding that key under the mat. The key is like the password. Hiding the key under the mat the the obscure part. Obviously, most prowlers will usually look under the mat first before actually cracking the windows. \_ A password is not obfuscation. Hiding your buggy service on a random port and making it hard to scan is obfuscation. Given a few extra minutes your s00per sekret buggy service will turn up. My ssh passphrase won't. You know I could give you my ssh passphrase and it won't help you get into any of the machines I run but you wouldn't undersand why. Damn, it's so sad there's no real ugrad security classes. It shows. \- i was thinkign about writing a something to wedge the iss scanner specifically. am trying to decide whether to do it at a tcp level [long time outs etc.] or generate random data on port 80, when talking to nfsd, mountd etc. i am also thinking about using xinetd. would be interested in more discussion on this. --psb |
2000/6/12-14 [Computer/SW/Security] UID:18446 Activity:moderate |
6/11 Anybody know if encryption routines (DES, IPsec related, etc) can be parallelized? Does adding more CPUs and writing some parallel software speed things up? \_ Look at the source code. Much of the time, what can be parallelized is done at a fine grain level (vector data, level, loop level, instruction level, etc...) in which case, adding CPU's won't do you any good. If it's thread level paralellism, then yes. Go to http://mit.edu's web site and search for Krste Asonovic (he was a PhD student here w/ Patterson). His thesis has a good explaination. Also look at the spring 2000 cs252 website. I think someone did a project on encryption algorithms. -jeff \_ IPSEC isn't an encryption routine--IPSEC ESP just makes provision for tunnel encryption and key exchange for whatever crypto you're using. -John the Nitpicker \_ No. \_ It depends on the feedback mode used. If the cyper is running in ECB mode, yes, but it's a bad mode of operation otherwise. the most common mode, CFB mode, has a dependency between blocks and can't be parallelized. -nweaver \_ is that a mathematically proven statement or a "can't _easily_ be paralellized"? \_ Do you understand what you're talking about? If step B depends on the result of step A before it can be started, IT'S IMPOSSIBLE TO RUN A & B IN PARALLEL. \_ Do YOU understand what YOU are talking about? There's more than one way to split a task into blocks, and parallelism need not apply at global level to be useful. A complete mathematical proof of nweaver's statement would be quite difficult. \_ Not so. It's been done before in superscalar processors using load value prediction and trivial computation predictions. \_ CFB can not be parallelized beyond the parallelism inherant in the encryption of a single block, because of the dependency. CFB of block N is computed by encrypting the value of N xor the last block. -nweaver \_ look, computation prediction is NOT trivial!! \_ CFB encyption can NOT be parallelized beyond the parallelimsm inherant in the encryption of a single block, because of the cyclic dependency. You need to completely encrypt one block before you can begin encrypting the next block. CFB DECRYPTION however, can be parallelized between blocks. -nweaver |
2000/5/24-26 [Computer/SW/Security] UID:18336 Activity:low |
5/24 I want to make my FS encrypted so that no one can take out my linux harddrive, hook it up to another computer that they have root on and see my files. I want only my password to be able to access those files. Anyone know of such a FS package? Doesn't have to be distributed like NFS. \_ try cfs (it has a debian package in non-us). User-mode, IIRC. \_ hello, does anyone know the status of the Alex file system from cmu [not andrew]. has that been abandoned? is there a sucessor [is nebula any good?]. will it run on solaris? --psb \_ Re-formatted. \_ Who would bother? If they stick a gun to your head, you'll very happily give them the password and suck their cock, too. |
2000/5/16-18 [Science/GlobalWarming, Computer/SW/Security] UID:18283 Activity:high |
5/16 http://www.wired.com/news/politics/0,1283,36339,00.html Question: How exactly can you distinguish Voice traffic from other traffic, esp. when you can tunnel it over another protocol like http or you encrypt it using SSL and such? What the hell do the telco's want regulated? \_ It's just political clap trap noise. \_ But, technically, unencrypted voice traffic is hella easy to detect, regardless of protocol. Anyone who knows basic signal processing can write the code. -blojo \_ what's the easy trick? does the spectrum for speech look very specific? -ali \_ What you would basically do is: (a) look for signals that have most of their energy in the 500Hz-4KHz range. (b) The amount of energy and its centroid oscillate / fluctuate with periods that are O(.25 seconds). Basically you can look at docs for any of the recent vocoders and see what circumstances they focus on reproducing... fortunately recognition that something is probably a voice is a lot easier than recognizing what the voice is saying. -blojo \_ Key phrase: unencrypted. Solution: encrypt it. \- you know the NSA has a patent on automatically IDing FAX and some other kinds of traffic. --psb \_ i've got something that fluctuates at 4 Hz right down here. -ali \_ Wow. That sounds painful...or unsatisfying. Not sure which.... |
2000/4/25-26 [Computer/SW/Security] UID:18110 Activity:very high |
4/24 Are there instructions on how to use the Java SSH client at http://soda.csua.berkeley.edu/ssh - clueless \_ got that right \_ You need instructions on how to use this? This is a joke right? \_ OK - this is one of those cases like you're the only person that hears any weird sounds coming from your car, but your mechanic doesn't when you bring it to the shop. What happened was that when connected to certain networks, say at work, the Java ssh client would not know http://soda.csua.berkeley.edu, and return an error to that effect. Thus, the cause for clueless-ness. However, on less prohibitive networks, say at home via dial-up ISP provider or dsl, I have no problems, which would invite a "got that right" comment. So, now another clueless question is - does this ssh client run over http or another protocol? Why does it work in some cases and not others? More than happy to read all about ssh if you got a pointer/url, especially for this Java ssh implementation. - Longer than necessary, clueless \_ Well it runs ssh's network protocol, to port 22 on soda. Odds are if its not connectin you're behind a tightwad firewall that blocks outgoing tcp/22. -ERic \_ You might also being having DNS troubles resolving names from behind the firewall. I know Sun's firewall does wierd DNS hiding and you need a super special ssh client to get out. - seidl \_ might also try running ssh in verbose mode to gather clue |
2000/4/11-13 [Computer/SW/Security] UID:17974 Activity:nil |
4/11 When I dialup from home, I use screen in my shell so that if I get disconnected, I can dial back in and reconnect my screen and thus not loose any work. Is there something similar I can do with my X apps also? (xterms, emacs, etc). I suppose I can run vnc on my workstation at school, but vnc is slow and not secure. \_ YOu can vnc over ssh. \_ Doesn't ssh break the connection when you hang up? \_ w/ static IPs, use ssh w/o keepalives, and ssh/X will persist short interruptions or long ones if all is idle. |
2000/4/11-12 [Computer/SW/Security] UID:17965 Activity:low |
4/10 Why is ssh2 better than ssh1? Aside from sftp. I'd like a pointer to technical reasons why ssh2 has improved security. (Yes, I already spent some time looking.) --PeterM \_ well, the ssh2 protocol was written more from the ground up rather than as modifications to a hack to a neat idea. --jon \_ I can see in general how rewriting the code would improve it, but what particular attacks are now harder/impossible? --PeterM \_ pure marketting + revenue |
2000/4/3 [Computer/SW/Security, Computer/HW] UID:17913 Activity:high |
4/2 Is there a program that will continually monitor when a file gets appended to and display it to stdout (like a security log monitor)? \_ simple way might be to use: tail -f FILENAME \_ might be? That's _the_ way. How much easier can it get? No bullshit, no coding, no side effects, included in every *nix. Even Linux has it. |
2000/3/30 [Computer/SW/Unix, Computer/SW/Security] UID:17890 Activity:nil |
3/28 -nick is login "nick" already \_ No it's not - the other nick |
2000/3/22-23 [Computer/SW/Security] UID:17825 Activity:insanely high |
3/22 SHIT! My linux gateway running ipchains got cracked. How? --PeterM \_ Run a BSD. Any BSD. No, really. Linux sucks. \_ How about: BSD security >> Linux security, but Linux is getting there \- realistically i think there are just more linux root kits floating around. same reason more solaris boxes get cracked than say ultrix.irix machines. --psb \_ In my experience, VMS security >> HP security >> SUN security >> IRIX security >> Linux security >> Windows security. IRIX really sucks and SGI ships the OS wide-open. --dim \- i work in this area so my data is based on a lot of machines and not just on my experience. most people cracking systems are just trying a lot of doors and arent picking locks. the doors the usually get into arent necessarily the easiest ones to pick but the ones with the most spare keys floating around or the most likely to have been left unlocked. VMS machines arent cracked because very few people have access to them, or sources etc. i agree solaris security is better than irix security but there are more suns and more peopel have access to suns ... hence more solaris root kits. --psb. solaris root kits. a lot of the weeinie crackers dont even know the difference ... you see people using solaris eject cracks on irix machines all the time. you know you are dealing with a clown when a cracker's editor of choice is pico. [which it is more and more often these days] --psb \_ I agree completely. I just wanted to point out how much IRIX sucks. --dim \- back in the old days suns used to "ship" with + in /etc/hosts.equiv. it only took a few years for sun to admit they had their head up their ass on on that one. SGI was even more intrasigent about the lp/guest etc accounts. whenever you would complain to SGI they would either point to "small print" or defend what they did with "we know better" ... well apparently "the market" knew better. --psb \_ sendmail, dns, irc, ftp, what else are you running? \_ no ftp, irc. Running sendmail as an smtp server for the internal network, but blocking connections from outside. Running DNS. Nothing else that I know of offhand. \_ move DNS serving to an internal machine. This will take some of the load off and also close a potential security hole. I also switched to to postfix which seems to be more secure than sendmail. \_ In recent history, all of those other daemons have had a lot more security problems than sendmail. \_ I haven't seen as many CERT warnings about postfix as for sendmail and qmail. \- what version of named? are you running named unprivilaged and chrooted? this was a common attack on freebsd. --psb \_ what are your rules? wuftpd supposedly has some buffer overflow exploits. \_ "no ftp"? \_ RedHat 6.1? \_ an inside job? \_ a blown job? |
2000/3/14 [Academia/Berkeley/CSUA, Computer/SW/Security] UID:17763 Activity:kinda low |
3/14 http://www.csua.berkeley.edu/~benchan/entreprise/CYBERARMS.html \_ Is commerce allowed on CSUA? \_ No. \_ but this is eCommerce! It's downright unamerican not to encourage eCommerce! \_ Squish! |
2000/3/13-14 [Computer/SW/Security, Computer/SW/Apps/Media, Computer/Networking] UID:17759 Activity:moderate |
3/13 At work each "phone" jack has an ethernet port, digital phone, analog phone, and a fax port. Anybody know where I can get a jack like that? I couldn't find it at homedepot. -trying to rewire my house. \_ Just unscrew the one at work. (Someone else's office) \_ http://www.l-com.com sells just about every possible connector or cable for many different applicaqtions. they should have whatever jack you need, and i think they can do online orders via web. \_ Did you look in the catalogs? (http://www.blackbox.com for example) \_ under your desk? *grin* \_ I liked it better when the area admin was under my desk. |
2000/3/8 [Computer/SW/Unix, Computer/SW/Security, Computer/SW/OS/Windows] UID:17713 Activity:nil |
3/7 What are people using to do S/MIME on Unix? I don't know which M to RTFM. (I've used a thawte digital certificate to read/ send encrypted mail in windows, but don't like going over there every time to read encrypted mails... Thanks |
2000/3/2-3 [Computer/SW/Security] UID:17677 Activity:moderate |
3/2 "He was plotting it for around two weeks, jokingly, saying he was going to extort money from these companies. Then all of a sudden he got dared to do it, and 10 minutes later Yahoo! was down. He never made extortion demands," the source said. We should all be thankful he got scared and didn't carry out his next idea, and that no one else feels the need to do this either," the source wrote. "He had a DDoS (distributed denial of service) tool that he wrote installed on all of his hacked boxes. He was planning on using all 1,000 machines in a combined attack on the Root Nameservers, flooding the Nameservice ports with UDP packets." "He is safe and he knows it, he deleted all evidence off his machine. ...He is very well aware that there isn't any way to prove a smurf attack after the fact." http://www.msnbc.com \_ Hear that tjb? They're on to you! |
2000/3/1-2 [Computer/SW/Security, Computer/SW/OS/Windows] UID:17667 Activity:moderate |
2/29 http://www.gnu.org/philosophy/amazon.html#whyBoycott http://www.oreilly.com/ask_tim/amazon_patent.html \_ USE WINDOWS. WAREZ REWLZ. LINUX SUX. \_ Uh huh, communists and a guy who made his millions on the copyright system which is the printed version of the patent system. I'm impressed. I'm also stoned, stupid, and a libertarian. \_ There is a BIG difference between the patent system and the copyright system. You can have two books that describe how to use the same algorithm, in detail, and not violate copyright. But the way the PTO is going, you wont be able to have two separate programs that use the same algorithm, without violating patents. \_ Bullshit. Stop repeating the ignorant drivel from the slashdot crowd and do your own research. Start with a law degree. "But I don't need no stinkin' law degree to know that my rights to other people's work is being infringed!" \_ One of the cornerstones of patent law is that no one should be allowed to patent prior art (something which someone has done before) nor any trivial extention of prior art (something which would be obvious to anyone in the field even without it having already been done) The trick is that the patent office's track record for letting prior art leak into patents is abysmal. [Dubious reference to prior art accidentally deleted] \_ Please quote the spec example and provide URL. If it was that simple the judge would not have granted an injunction. That's only done when there is a high probability of victory. If the example you claim is in the cookie spec covered the whole patent, then B&N's lawyers could have easily not only not been on the wrong end of the injuction, but could have had the patent declared invalid long before now. Patent law isn't as simple as slashdot makes it out. \_ Were any of the online brokers up and running in 1997? Any one of their stock purchase systems would constitute prior art if in place then. -mel \_ No, it wouldn't. You have no idea what a patent even is. It is defined by the claims, not the oft and over quoted summaries printed on slashdot and other anti-IP sites. Violate so much as a single minor claim and you're infringing on some- one else's property. |
2000/3/1-2 [Computer/SW/OS/Windows, Computer/SW/Security] UID:17664 Activity:nil |
2/29 does an ssh client for windows 3.11 exist? thanks. \_ USE WINDOWS MAN. LINUX SUX. WINDOWS REWLZ. ANYONE WHO'S ANYONE USES WINDOWS. LINUX USERS ARE FREAKS MAN. \_ Win32 programs have been known to run on 3.11 systems. Try TeraTerm ssh (free) or F-Secure (maybe free if you're on campus). \_ There was an article in the merc this week saying that SSH Communications & SANS were giving away free SSH to .edu's but I can't find anything on http://ssh.com or http://sans.org. Anyone know anything about it? |
2000/2/25 [Recreation/Dating, Computer/SW/Security] UID:17622 Activity:nil |
2/25 Pro-immigration drivel deleted. That was not a reason to allow queers to marry. That was a reason to deny foreigners easy access to our shores. I abhore the practice of foreigners, mostly women, prostituting themselves out to gain status here. We should eliminate that possibility equally for everyone. |
2000/2/22-23 [Computer/SW/Security, Computer/SW/Unix] UID:17587 Activity:moderate |
2/22 Is it possible for Soda to create a web mail interface similar to http://mail.yahoo.com to access emails on soda? \_ No. Soda is a computer and has not yet achieved sentience. Use POP or IMAP or forward your mail to luser@@yahoo.com. \_ Soda still allows POP and IMAP? I thought that the whole point of turning off telnet/ftp/etc was to prevent some twinks from sending their passwords in clear text over the net. So, what's the point of turning off telnet and ftp if POP and IMAP are still running? \_ There is no point, only trolls. \_ You may email your request to the entity known as "Soda". \_ I was looking at something called 'mailman' a while ago. It'd require nothing more than a few cgi scripts and a cron job that copies your mail into a directory off your public_html/. They started charging for mail man, though, and I haven't had time for it since. Mail me if interested. -John \_ there are at least a dozen different mail->web gateways listed on http://freshmeat.net \_The OCF got acmemail up and running in a few hours -jones \_http://secure.OCF.Berkeley.EDU/cgi-bin/acme/acmemail.cgi |
2000/2/11-13 [Computer/Networking, Computer/SW/Security] UID:17494 Activity:very high |
2/11 Why can't they stop all these DoS with a simple TCP source quench? My understanding is that if the incoming data rate passes a certain threshold, you can simply ask the the upstream sender to slow down or drop packets. So why don't the end points just do this so that the systems don't go down? \_ But then if that's true and the upstream sender starts dropping packets, it will still appear the same to the clients that the server has crashed. The effect is the same. Right? -- yuen \_ Sort of, my understanding is that you can do a source quench on one or more source IP's, so when you send a quench the message propogates all the the way back to the source. When the router's closest to the source start dropping, it will look like (from the source's perspective) the destination has gone away. Other source IP's won't be affected. \_ Source quench idea doesn't work necessarily because the idea of source quench assumes that the sending host is co-operative, not hostile. When the sending host has been root compromised, the compromise could change the behavior to make it ignore source quench requests. Also, a lot of the source IPs are being spoofed, so you don't even know who the real sources are. \_ The attacks are a lot more complicated than just "send lots of packets to yahoo". -tom \_ So where can I get a description about how these attacks work. And I'm not looking for the garbage in the general press. \_ http://www.securityfocus.com \_ http://staff.washington.edu/dittrich/misc/tfn.analysis \_ http://staff.washington.edu/dittrich Look in the papers where he analyizes trinoo, tfn and stracheldaht. Best analysis of them I have seen. -ausman \_ while (1) { httpget("yahoo.com"); } And now you know! \_ This is hardly untraceable since your IP will show up in access_log. My understanding is that the attacks have been untraceable, so they must involve header rewritting or session hijack or something. \_ No. _some one's_ IP appears in the log. Who is to say httpget() isn't mushing the IP or using a proxy or doing a million other things? \_ The problem with DoS attacks is not that they're crashing the machines, but that they're preventing normal users from accessing the service. Your suggestion does nothing to change this. \_ If you or your upstream routers block/quench based on the sending rate of a source IP, then you could filter the DoS traffic (high incoming rate) and still allow most normal users (low incoming rate) to connect. I think that is is a L3 analogy to the hammer filters in some ftp servers. \_ Except that many of the attacks consist of a low incoming rate per IP address from thousands of different addresses. Telling real traffic from attack is harder than you think. \_ Pull network cable, sell stock, go home. \_ Wrong order! \_ You want to sell at the high moments before it crashes to make sure you soak it for every last bit. After all, who knows better when it's going down than you? It'll take a while for others to notice. \_ I opened a joint broker account with my girlfriend and placed $1000 in it, telling her that whatever is in it when engagement comes would be the price of her diamond ring. GE didn't go fast enough for her, so we went into Checkpoint Software, and it went from $1000 to $4000 in 4 months, and has been going through the roof since the DoS attacks. Do you think my girlfriend might be involved? \_ She hired me to do it. I get half the account, she gets the other half for her ring. Expect it to continue upwards until you're engaged. \_ I knew she was involved! I once suggested to her that instead of a diamond ring, I can give her a super cool Sun workstation. To my surprise, even though she is a nerdy (but very beautiful, in my opinion) computer science student, she didn't like the idea very much. If you can convince her otherwise, it would be a great favor for me! \_ She is much smarter than you think. Diamonds are forever. Sun workstations become obsolete. She also realizes that you may in fact wish to fondle the sun hardware instead of twiddle her bits. And when the workstation becomes old, Sun allows you to trade it in for a newer model, perhaps giving you certain ideas she finds threatening. |
2000/2/9-10 [Computer/SW/Security] UID:17468 Activity:low |
2/9 I would like to start using PGP for communications. Problem is that the machine at work won't let me install freeware PGP for WinNT (I'm not an admin nor do I play one on TV). I thought there was an impl in PERL somewhere but can't find anything about it. Does anyone have a list of PGP impls handy? And if so could you share? \_ PGP? For what? You think the NSA and Evil HAx0rz are listening in to your love letters to your SO? |
2000/2/9-10 [Computer/SW/Security] UID:17463 Activity:insanely high |
2/8 After the recent attacks against the big boys of dot com how does a guy prevent further Denial of service (DoS) from happening to his own cos. - curious \_ You don't. You can filter some of the crap but never be totally safe from it with current protocols and technology. \_ why not just change the filter properties? \_ Which devices do you own that can filter 1 gigabit per second without crashing while still letting the good traffic through? And what if the DoS consists of properly formed http calls? What are you going to filter? \_ so i guess you need to call an upstream isp to put in the proper filters? \_ Idiot! \_ Argh! TROLL! \_ well, isn't that what they did to stop the http://cnn.com attack? \_ Yeah, they turned on the "filter_DoS_packets" rule in the routers. Some new guy had turned it off and no one noticed. \_ so i guess you don't know then, huh? \_ I think when they upgraded to dos version 2.11, everything was ok. \_ what are you going to filter, when the DoS looks EXACTLY like lots of normal traffic packets? Is the 'Slashdot Effect' a malicious attack, or just your site suddenly becoming very popular. Either way, your site is basically down. \_ are you sure DoS packets look exactly like normal packets? \_ Of course not. They have the DoS flag set. \_ so i guess you don't know then, huh? \_ The dos upgrade to v2.11 fixed it. \_ A possibility would be to make your company site a moving target. Have sevearal locations/IP's you can use. When one IP gets hit with the big DoS, change your DNS entry ( you set your TTL low ahead of time, right?), and move your site to the new IP. \_ That'll work, uh... never. DoS kiddies just get the new IP the same as everyone else. Welcome to the internet. \_ ACK! I've been trolled! \_ if you have to ask, you don't know \_ thanx for stating the obvious \_ Unplug net cable. \_ If companies with hundreds of millions of dollars at stake can't prevent it, what the hell makes you think you can? \_ Because I read a zdnet article about how to stop it. \_ it's so ironic, that zdnet was attacked and shutdown for 2 hours this morning. \_ Very little. Try not to be a tempting target. The way the big sites were attacked recently was by distributed clients running on many windows boxes infected with a remotely activated virus. There wasn't any obvious TCP stack bug problem with the servers or anything, they just got overwhelmed by tons of valid-looking hits. Short of weird heuristics, there's very little you can do about this. \_ What about authenticated IP? -- network newbie \_ Won't stop traffic floods, which is what they're getting hit with. \_ First define authenticated IP, then figure out how much your business will lose by cutting off all the random web users who don't use it. \_ Why don't we all start attacking http://www.microsoft.com and bring down the Evil Empire(TM)? |
2000/2/7-8 [Computer/SW/Security, Computer/SW/Unix] UID:17447 Activity:high |
2/7 POP-3 Question: I want to run a popd at home (such as qpopper) so that my parents can check thier mail without having to login to the mail server at home. From what I can tell from the RFC's POP seems to be an insecure protocol, in that it sends passwords as plain-text. Is it possible to run a secure POP server, or can I at least have the POP passwds in a file other than /etc/passwd (like .htaccess)? \_ Use APOP or ssh port forwarding. Using APOP would be probably less hassle for non-*nix users. You still need to send a clear text password, however, it is not the same as a user's unix password. If a user is using *nix, fetchmail + ssh port forwarding is the way to go. -akop \_ the APOP password is not clear-text; it's MD5 encoded I believe. -tom \_ Couldn't get APOP to work correctly in the released version of qpopper. Besides it looked like APOP didn't work with Netscape. \_ APOP does not work with Netscape. But it does work fine with qpopper. -tom \_ "My parents use *nix!" \_ My mom has been a Unix user/hacker since the PDP-11 was a new machine. Its not a user issue, I'm just trying to minimize logins to the mail server (also the firewall/nat box). \_ Then maybe you should be asking yermom for advice. \_ I would ask my mom (not yermom) for advice, but she is currently out of the country. \_ Then she doesn't need her email right now, does she? I don't release any GPL'd code until my mom has QA'd, debugged, and approved the release. \_ http://www.linuxdoc.org/HOWTO/mini/Secure-POP+SSH.html also, fetchmail can do APOP (but not netscape mail) \_ Go for IMAP+SSL - then they can use netscrape or MS LookOut! \_ Which server should I try? From just looking at the homepages for Cyrus (CMU) and Imapd (WU) I couldn't tell if either supported SSL. \_ Use either with the SSL wrapper from the ssl toolkit. |
2000/1/27-28 [Computer/SW/OS/FreeBSD, Computer/SW/Security] UID:17349 Activity:high |
1/26 Are the security benefits of mounting /usr partition in read-only mode worth the trouble of rebooting your server whenever you install OS patches or updates? -sysadm \- this isnt worth doing ... at least not on solaris. spend a little more energy on keeping md5 checksums --psb \_ an ounce of prevention is wourth a pound of "AAAa! We've been hacked, FIX IT!" \_ Depends on your needs. Extra security vs convenience. In general, I'd say don't do stuff like this unless you're sure you need to. That you have to ask says you probably don't need it. \_ Most of the time you have to reboot after installing OS patches & updates anyway. \_ Ok I will modify my question. What about simple and yet important updates that DON'T require a reboot. I'd rather restrart a service than reboot. -sysadm \_ what's going to stop some cracker from just remounting /usr r/w, changing stuff, and then having a ball ? I dont see any benefit in the world of mounts with -o remount or -u (bsd) -ERic \_ The only security benfit is to block script kiddies. Crackers with half a clue can get right past it. \_ You NEED TO BE ROOT to remount. the whole point is to make it more difficult for them to get it \_ Eye 0wn3d y00!111 |
2000/1/23-24 [Computer/SW/Security, Computer/SW/WWW/Server] UID:17302 Activity:nil |
1/21 Anyone have a page where I can find stuff on headers for our apache web server? We have authentication, though we've realize that caching really is another issue entirely and would like our pages to have the same behavior as the portals (e.g., yahoo, aol) re browser based email authentication \_ http://www.hamsterdance.com \_ Don't go to hamsterdance. You're looking for http://windowsupdate.microsoft.com. \_ Would you care to try again except use English and format to between 76 and 80 columns? \_ Reformatted to fit on 80-column punchcard. - motd punchcard god |
2000/1/18-19 [Computer/SW/Security, Finance/Investment] UID:17263 Activity:high |
1/18 Is E*TRADE FDIC insured? Thx. \_ They are a brokerage not a bank. They have SIPC and backup private insurance. Read their web site. (BTW do you really want an account with E*TRADE? I haven't had an account there but heard their customer service is impossible. You might find this useful: http://www.gomez.com.) \_ Very useful site. Thanks. \_ I have an account with them. I've only had to ask one question but got a response within 24hrs. But that's just once, so take it as you will. \_I have had nothing but trouble w/ Etrade. It is hard to connect with them during the day, it takes days for them to respond to emails, and you have to wait >>>1h to talk to a customer service rep when you call. I prefer Datek, even though they offer fewer services. \_ E*TRADE is completely incompetent. They are awful. --aaron \_ How about http://www.schwab.com \_ schwab has pretty good service. Problem is their commission costs for trades are pricey \_ Why do people use/need customer support that much? I would think that once you get things setup, you don't need that much customer support \_ try doing a brokerage transfer. -tom |
2000/1/14-17 [Computer/SW/Security] UID:17241 Activity:nil |
1/14 can't find ssh client for win 3.11. help? (and pls don't suggest to upgrade to win 95/98/NT.) thanks in advance. \_ LINUX! RIDE BIKE! \_ I think you can just telnet the non-secure way, use the one-time password generator at http://www.csua.berkeley.edu/skey or elsewhere to generate the one-time password, then manually type the password in your non-secure telnet. \_ F-Secure ssh for Win32 will run on Win 3.11 -sony \_ http://www.zip.com.au/~roca/ttssh.html \_ Can you run java? If so: http://www.mindbright.se/mindterm |
2000/1/11 [Computer/SW/Security] UID:17211 Activity:high |
1/10 Why don't we use SSH Ver.2? (I think there was an explanation somewhere but i can't find it) \_ No one supports SSH 2. \_ SSH2 costs too much \_ Exactly. SSH1 is freeware while SSH2 is available for purchase only. |
1999/12/22-23 [Recreation/Dating, Health/Men, Computer/SW/Security] UID:17085 Activity:high |
12/21 So I'm looking for Logo information -- I go to bh's Web page, and just below his photo is a link inviting me to "Take a look at my son Heath." NO WAY!!! bh actually found a female to get intimate with him? Is/was bh married? Or is this some kind of weird I-hate-my-family-so- I'll-pick-a-new-one thing like benco and his "fathers" Allman and McKusick? \_ he adopted a 12 year old boy. single parent. unmarried. \_ no, 11 \_ Some morons let that total bug eyed freak get his molestor's dirty fat little paws on a helpless child which he promptly posted pictures of on the net? WTF is this country coming to? Next, they'll let queers marry. \_ You obviously don't know BH personally. So quit trolling. FYI, there's no law (or reason) against posting your kids' pictures on the net, he wanted a kid for nearly a decade, and had to put up with the social service system (which is ridiculously biased against men) for that long, and has a master's in clinical psychology to show for the statement that he's capable of caring for the kid properly. \_ Oh yeah, I went to school so I must know all about kids! You're so completely clueless and dense. There's a very good reason they don't give children to unmarried men. The only shock is that they let freakoid have one after *any* number of years of trying. Normal people who want kids try out this thing called "marriage" and they "have sex" and "procreate". Try it sometime... or in your case, please don't. The gene pool is sufficiently polluted. \_ I agree. Lezbo "couple" adoptions and sperm inseminations should be banned by law. |
1999/12/19-21 [Computer/SW/Security] UID:17070 Activity:kinda low |
12/18 Is anyone aware of an existing scp interface for Wind0ze? \_ Not a chance. \_ http://bmrc.berkeley.edu/people/chaffee/winntutil.html about 1/2 way down the page -mikeh \_ This is bogus. \_ How so? It works for me. -mikeh \_ It doesn't properly follow the specs. \_ Clarify? \_ Read the spec and compare. |
1999/12/1 [Politics/Foreign/Asia/China, Computer/SW/Security] UID:16982 Activity:very high |
11/30 http://www.gn.apc.org/pmhp/ehippies/action/index.htm \_ death to the protesters. We need martial law. Every single protester on TV ended up being an unemployed laborer who basically wants us to pay $75 for a made-in-America Tickle Me Elmo. DEATH TO THE MEATHEADS! USE MORE RUBBER BULLETS! \_ The TV coverage was biased beyond belief. You've been taken by the mass media. Use your mind, not your TV remote. The WTO is evil. One-World Government is evil. I don't hate you, but I do pity you. --eyes open, TV off \_ PAT! PAT! PAT! PAT FOR PRESIDENT!!!! HE'LL SAVE US FROM THOSE ONE-WORLD FOREIGN JOB-STEALING DEVILS!!!!!! \_ Pat is an idiot. I don't care about your job. I care about your air. \_ This is called a "Denial of service attack", not a "sit-in". Dont kid yourselves, this is bordering on illegal, if not actually illegal. The webpage owners are setting themselves up for "Incitement to commit a crime" or something. And personally, I hope they get arrested on those charges. \_ guess what, sit-ins are illegal too. And if you see how it is set up it won't do anything unless tons of people participate \_ It would be far better to just have a petition, with thousands of names. otherwise,it will beseen as a few hundred people trying to interfere with "progress". This is an artificial attempt to magnify the effect that a few hundred people can have. Because if it actually made thousands of people actually "sign" their names, clinton would actually listen. \_ Are you really this stupid? Do you know hte difference between a sit-in and a petition? Sheesh... kids. \_ They're making the dangerous assumption that the average Joe actually *cares* enough to turn on his WebTV and point it at a WTO Web site in the first place . . . \_ Who the hell do you think stopped the WTO today? The streets were packed with average Joes you cynical fuck nut. \_ now THAT (unfortunately) will have an effect. Killing the web site with a DOS attack, will not. \_ I chose not to participate in the DOS. It seemed pointless. I'm still opposed the WTO and in favor of almost any protest opposing the WTO. \_ For what its worth the WTO is a serious issue, deserving alot more attention than its given in the media. Whether the US should be in the WTO is questionable, and bringing China into the WTO would be a blunder. \_ WTO rules! Don't turn US into inward-looking Ming dynasty China! Unilateralism will make the US into a leader without followers! \_ shut up achoi \_ Who's that? \_ Don't turn the US into a lackey of the One World Government. By the people, for the people. Not whatever tiny scrap of empowerment the OWG _lets_ you have. The WTO is evil. \_ Fuck the WTO, the UN, and all One World Government stupidity. \_ of course, this idea does not exclude the similar idea that the WTO rioters all deserve a swift kick to the head while being dunked in toilet water diarrhea. Moron fuck-ups. \_ No. They deserve to be honored as the heros they are. The anti-WTO protesters have a very clear idea of what's going on. If you looked up from your Quake3 once in a while and looked around, you might also. Death to the WTO and all other One World Governemtn anti-people organisations. \_ PAT! PAT! PAT! PAT FOR PRESIDENT!!! HE'LL SAVE US FROM THOSE FOREIGN ONE-WORLDER JOB-STEALING DEVILS!!! \_ It's not about jobs. It's about clean air and water. |
1999/11/30-12/1 [Computer/SW/Mail, Computer/SW/Security] UID:16980 Activity:high |
11/30 Is there a way to use trn to connect to an NNTP server that requires a login and password? -brianm \_ trn4 supports NNTP authentication, and despite being in beta for the last 4 years is more stable than 3.6 \_ Right. Where in the man page or documentation is the explanation of how to actually authenticate? |
1999/11/22-24 [Computer/SW/Security] UID:16939 Activity:low |
11/22 http://www.landoverbaptist.org \_ This is a parody Web site for those who haven't figured it out. \_ No. We're complete and total morons who would be lost without you to explain things for us. If it wasn't for your brilliant guidance, we'd never have found the truth about Santa Claus or the Tooth Fairy either. (But please, can you tell us, is Trevor Buckigham for real? He's even more unbelievable than the Tooth Fairy...) \_ TB is for real. Some of us have even met him. \_ What? You're saying the TF isn't real? Then where'd all that money come from, wise guy?! \_ No, the funny bit is the mailbag. -John \_ No, the depressing bit is the mailbag. |
1999/11/20-22 [Computer/SW/Security, Computer/SW/Unix] UID:16927 Activity:moderate |
11/18 /var/mail at 100%. Got mail? Get rid of it.. \_ Root is evil! Buy more disk! Ride bike! Linux wouldn't have run out of disk with the new beta3 of the mail compressing file system, mcfs!!! \_ we need philfs \_ We already have philcompress. root can just use that on /var/mail. -- ilyas \_ philfs would use philcompress automatically though, and there's no telling what other nifty features Phillip would include. |
1999/11/14-15 [Computer/SW/OS/Linux, Computer/SW/Security] UID:16879 Activity:nil |
11/11 Skey for Linux - Do you know how to compile it / where to get a version that's later than 1995? Thanks! \_ http://rpmfind.net \_ rufus \_ it sho' is hard to find, suh |
1999/11/14-16 [Computer/SW/Security, Computer/SW/Unix] UID:16871 Activity:high |
11/14 I know they're generally a pretty lame alternative, but how would people/root/politburo feel about running a webmail server on soda for folks who'd like to check their mail by browser? Mind you, I'm not suggesting a public free mail server, but currently I have nothing but proxied http net access, and I wasn't about to suggest port-redirecting http on scotch to ssh the way mconst did with telnet (yay!) I have been playing with MailMan from http://www.endymion.com with the idea of having cron move my mail to a restricted directory so I could read it via shell account as well as browser. Has anyone ever considered an https server on scotch/soda so http passwords wouldn't be sent in cleartext? Just some thoughts... -John \_ I'd prefer to respond to this over mail. --root \_ in my personal experience, root usually replies something and then just delete my mail. fuck root. \_ YOU NO CONJUGATING VERB MUST LIKING VERY MUCH ON \_ What do these acronymns stand for? BOAT GETTING GO TO BACK WHERE YOU COME FROM LEARNED ENGLISH SO MANY DIFFICULT! -(fucker) \_ Go home, fuckered, stop blabbering on the motd. \_ At least (fucker) is funny. What have you contributed recently? \_ Fuck you. FOAD --Jon \_ What does this acronymn stand for? \_ Heyyyy, take that back. meanness to roots is not tolerated. you must write with respect. --Consumer Affairs Department \_ .forward \_ Have you thought of getting non-proxy net access? \_ I currently forward my mail from soda, and I have a mail address and non-proxy net access with a provider. I was simply playing around with ways to get my mail off soda through a firewall for the fun of it, and thought that maybe, perhaps, possibly, people might be interested in having me invest some time to set it up. Obviously not, since I haven't gotten any feedback except from the usual too-chickenshit-to-sign-your-name peanut gallery. -John \_ I never sign my name but I didn't add anything to this thread until now. --too-chickenshit-to-sign-my-name-monkey \_ install IMAP & TWIG on a machine with APACHE-SSL |
1999/11/10-12 [Computer/SW/Security, Computer/SW/OS/Windows] UID:16858 Activity:very high |
11/10 Anyone heard of a "BubbleBoy Virus"? Thx. __/~*##$%@@@******~\-__ /f=r/~_-~ _-_ --_.^-~--\=b\ 4fF / */ .o ._-__.__/~-. \*R\ /fF./ . /- /' /|/| \_ * *\ *\R\ (iC.I+ '| - *-/00 |- \ ) ) )|RB (I| ( [ / -|/^^\ | ) /_/ | *)B (I(. \ `` \ \m_m_|~__/ )_ .-~ F/ \b\\=_.\_b`-+-~x-_/ .. ,._/ , F/ ~\_\= = =-*###%#x==-# *=- =/ ~\**U/~ | i i | ~~~\===~ | I I \\ / // i\ \\ ( [ (( I@) ))) ) \_\_VYVU_/ || * | | * *\ /* /I\ *~~\ /~-/* / \ \ ~~M~\ ____----=~ // /WVW\* \|\ ***===--___ MOTD NUKED HAVE A NICE DAY \_ It can be a problem if you run IE5 and Windows scripting host on win98. In which case you deserve it. -John __/~*##$%@@@******~\-__ /f=r/~_-~ _-_ --_.^-~--\=b\ 4fF / */ .o ._-__.__/~-. \*R\ /fF./ . /- /' /|/| \_ * *\ *\R\ (iC.I+ '| - *-/00 |- \ ) ) )|RB (I| ( [ / -|/^^\ | ) /_/ | *)B (I(. \ `` \ \m_m_|~__/ )_ .-~ F/ \b\\=_.\_b`-+-~x-_/ .. ,._/ , F/ ~\_\= = =-*###%#x==-# *=- =/ ~\**U/~ | i i | ~~~\===~ | I I \\ / // i\ \\ ( [ (( I@) ))) ) \_\_VYVU_/ || * | | * *\ /* /I\ *~~\ /~-/* / \ \ ~~M~\ ____----=~ // /WVW\* \|\ ***===--___ MOTD NUKED HAVE A NICE DAY \_ OrCAD still sucks \_ Any URL where I can find a warning from CERN? \_ Any URL where I can find a warning from CERT? \_ If CERT issued a warning it would be on their web site. Since it's not, they haven't bothered. They don't issue alerts for every new MS virus or they'd be spending all their time doing that. \_ Open outlook. Go to Tools/options/security. Set to 'restricted'. Go to IE's tools/options/security/restricted. Set everything to disabled. Learn lesson that M$ never learned about keeping data separate from code. Thou shalt not make active data types. \_ Windows Update. Eyedog control ActiveX patch. Problem dealt with. \_ obFormatHardDiskInstallLinux \_ Linux? I thought we're talking about security not k00lness? The mindless Linux crowd pisses me off just as much as the equally ignorant Windows crowd. -pissed off by stupidity \_ actually I'm a Windoze user that posted the ob comment \_ Gach! Surrounded! It's hopeless! \_ If you want extra secure use OpenBSD. If you want complete security unplug your network from your computer. \_ Never mind; I was high on crack at the time. -Phil \_ Impersonating Phil in the motd should be a squishable offense. Doing so as badly as the above person should be a capital offense. \_ But the network IS the computer. Phil told me! \_ Non-Phil forgeries deleted. -Phil \_ Non-Phil forgeries deleted. -Non-Phil \_ damn philforge don't work worth a damn... \_ be even more secure, unplug the computer. \_ Whoa! This is stunningly original! Can I quote you on this? |
1999/11/2 [Computer/SW/Security, Computer/SW/OS/OsX] UID:16811 Activity:insanely high |
11/1 How secure is the www Java ssh terminal? Can't someone still intercept packets going through your browser? \_ The real answer you're looking for is "No, not really". Don't forget, the Java doesn't run on the site you got it from, it's like a downloaded program and is run _locally_ in your browser. The outgoing traffic is encrypted by the ssh code. _However_, if someone really had it in for you, they could intercept the ssh java code as you downloaded it the first time you went to that URL and replace it with compromised java code. --dbushong \_ or attach a debugger or read your process data via /proc... \_ yes, if they have root access to your machine, kill -SEGV your client and analyze the core file. But that's true for any ssh client (not just the java version). \_ if you're going to be that way about it, all they have to do is intercept data going to/from your tty, and you'd never know. \_ I don't have a tty. \_ or attach a debugger or read your process data via /proc or just secretly replace the ssh binary or hack the socket system calls to log or . . . Short answer: You must trust root, because they can do anything they want to you. \_ I don't trust root. I only use a Macintosh because it has the best security. You never hear about Mac servers getting broken into. \_ That's because you never hear about Mac servers. \_ What do you think Apple is running? Mac rulez, unix dr00lez@! \_ soda [12] telnet http://www.apple.com http Trying 17.254.0.91... Connected to http://www.apple.com Escape character is '^]'. HEAD / HTTP/1.0 HTTP/1.1 500 Server Error Server: Netscape-Enterprise/3.6 SP3 Date: Tue, 02 Nov 1999 22:21:38 GMT Content-length: 305 Content-type: text/html Connection: close Connection closed by foreign host. Apple is runnig MacOS? \_ Netscape for Macintosh, dummy! You dr00le!!!1 \_ There isn't an Enterprise for Mac. Look at their web site. |
1999/10/30-31 [Computer/SW/Security, Computer/SW/Unix] UID:16798 Activity:very high |
10/30 I accidentally posted my hostname and root password to usenet. Help! \_ how stupid are you? change the password, and get on with life. \_ I DID! It was posted again! I think I have a virus! Help! \_ I DID! It was posted again! I think I have a virus! Help! \_ how stupid are you to respond to him? \_ Help! I'm stuck under a bridge and can't get out! ACK! |
1999/10/25-27 [Computer/SW/Security, Computer/SW/Unix] UID:16765 Activity:very high |
10/24 alumni.eecs is down again. Could someonw with root powers check it out? thanks! \_ mail root@alumni.eecs. heh. \_ tried that before. no one checks root email there. \_ I was joking. \_ root@ucsee.eecs, http://ucb.org.ucsee \_ actually, the machine itself is up (it's ping-able) but the telnet service isn't. Been seeing some weird things with alumni/ucsee machines today. :-( \_ Time for a three-finger salute? \_ REBOOT! REBOOT! REBOOT IS THE STANDARD! \_ Hmm... single-user mode perhaps? \_ Then a single-finger salute is in order. \_ OK it's up, but old mail still needs to be delivered. Dunno whose responsibility that is. |__ Hey jon, feeling a bit tense about alumni.eecs? \_ FOAD --jon \_ PLUR --jon \_ I'd help you but I quit for reasons that anybody, who has typed uname on alumni, can figure out. The other sysadmins have graduated. Given that you have a csua account, one wonders why you would even want your alumni account back up. But if I have any spare time from cs 152 I'll see if I can get it going again. --jeff \_ how about replacing alumni? would anyone be willing to do it if I donate an old sparc lx? \_ You really think a $50 computer will help? \_ it's better than the current alumni. \_ email jon@soda; he may be willing. \_ I hate that machine. I don't know why I bother with it. Fuck ultrix, fuck clueless users who think they are entitled to services, and fuck flaky hardware. --jon *just* enough crochety and cluess alums (who don't seem to understand that the machine is run by student volunteers rather than paid admins) to make life as a sysadmin there awfully annoying. \_ what? are you mocking that bad ass DEC Station 3100 running Ultrix, the best OS ever? running Ultrix? running Ultrix, the best OS ever? \_ PLUR --jon \_ FOAD --jon \_ Well (speaking from some personal experience), not only does alumni.EECS have the DS/Ultrix thing going against it, but it also has a user base with *just* enough crochety and clueless alums (who don't seem to understand that the machine is run by student volunteers rather than paid admins) to make life as a sysadmin there incredibly annoying. I appreciate having the "@alumni.EECS.Berkeley" mailing address, and would be more than willing to throw in my share of cash for a replacement machine, but can understand why the current caretakers would want to throw in the towel. Maybe the dept. should take over the hostname for some kind of mail-forwarding arrangement, or some competent alum volunteers should step forward to take a share of root-type responsibilities . . . -- former root@alumni.EECS person \_ Nonononono, as a crotchety clueless alum, I insist we stand by tradition and have students continue trying to support dead hardware running a badly b0rken bsd clone from 10 years ago. I'll tell ya, Back In My Day, we were lucky to have \_ FOAD --jon a 4 meg sun 3/50 with swap mounted remotely on another sun over a 10mbit shared networked. You youngin's today... whine whine whine.... \_ PLUR --jon --- clueless crotchety alum PLUR an acronym for? \_ FOAD --jon \_ pardon my cluelessness but what is FOAD an acronym for? \_ you left out "and sharing the same swap server with 20 other machines was a small price to pay..." \_ I thought of that but didn't want to re-edit to add it in. Any other clueless \_ FOAD --jon crotchety alum would've known what I was talking about. still time! (Oh yeah, and FOAD.) \_ I volunteered less ancient h/w before, but no one reads root email on alumni. I think alums should volunteer h/w, but sysadmin should \_ PLUR --jon be a student service for someone who wants to learn sysadmin stuff. still time! (Oh yeah, and PLUR.) \_ Its still down for some reason after a brief uptime... \_ FOAD --jon \_ Because it's an ancient piece of crap. \_ It's back up now, so move your files off of it while there's still time! (Oh yeah, and FOAD.) \_ As an alum, I definitely wouldn't mind making donations of cash, or hardware to keep alumni alive. This should be an organized effort, though. Something that is sanctioned and kept alive from generation to generation. \_ Too late. The powers that be are talking about making a subscription mail forwarding $ervice. \_ <DEAD>alumni.csua.berkeley.edu<DEAD> mail forward? |
1999/10/16-18 [Computer/SW/Security, Computer/SW/WWW/Server] UID:16714 Activity:nil |
10.15 Apache on RedHat- set UserDir to public_html in httpd.conf, with no specific directory permissions. I still get "Forbidden You don't have permission to access /~{user} on this server." What do I have to set to make this work? \_ look in your error log for chrissakes. -tom \_ Oh. Thanks. \_ You likely need to make sure that both the public_html dir AND the USER directory are WORLD executable. -crebbs |
1999/10/15-17 [Computer/SW/Security, Computer/SW/Unix] UID:29932 Activity:kinda low |
10/14 /var/mail is full; clean up your crap! top ten mail hosers: jenlam 7488 jam 7832 tonytung 7968 alvinwoo 8232 ramses 8496 moraleda 8720 robin 8832 klee 9680 suzuki 12032 rico 12160 \_ Hey root, why don't you move these hozer's mail spools to their home directories? \_ root would rather have users police themselves. fucker. \_ the various root users know that sometimes when they try to deal with sloppy users' mail for them they sometimes get "rm" confused with "mv". |
1999/10/13-14 [Computer/SW/Security] UID:16702 Activity:high |
10/13 So, say i want to ssh to another site that allows it. How do i do it? "ssh http://siteName.com" returns the error that the host key is not found and asks me over and over if i want to keep connecting. \_ say yes you idiot. \_ Well, I'll be damned. that WORKED! (o.k., o.k., in defense of my idiocy, when was the last time you had to type in "yes" to answer a computer's yes-no question? I typed 'y' for fuck's sake. I even tried 'Y' just in case. But the IDEA of typing 'yes' never even entered my mind. \_ Obviously you are not an emacs user. You therefore don't deserve to be able to ssh. \_ If Cal gave you a degree, give it back. If not yet, drop out and go to Stanford. |
1999/10/13-14 [Computer/SW/Security, Computer/SW/Unix] UID:16698 Activity:low |
10/13 Anybody know of a free proxy server out there? I just need something very very simple no fancy features. Thanks. \_ natd. much more transparent than using a proxy server. \_ wingate or winroute. \_ What type of Proxy? HTTP only? If so, Squid, Apache, & CERN (listed in order of proxy-studliness - don't bother with CERN anymore - apache's overkill for just a proxy, squid kicks ass) \_ squid kicks its own ass. The only reason it stays up is because the start script is basically ' while true; do squid ; done' \_ is Squid GNU software? I couldn't find it on the gnu sites. where can I find it? Thanks. Password Thief Ransacks AOL 3:00 a.m. Password-stealing emails slip into AOL accounts and make off with user passwords by the thousands, according to the email service used to launch the attacks. Critics says it's the latest in a pattern of neglect by AOL. By Chris Oakes. \_ Thank you Wired News! \_ "Password-stealing emails"? Is this social engineering, or some K-RAD N3W PASSWURD ST3AL1NG HACK1NG V1RUZ????/??? \_ Standard "click on idiot.exe" in html email to send your password to random account bullshit. The only fault AOL has is having a browser available to it's customers that allows them to run an .EXE from a hyper link. |
1999/10/13 [Computer/SW/Security] UID:16697 Activity:nil |
Password Thief Ransacks AOL 3:00 a.m. Password-stealing emails slip into AOL accounts and make off with user passwords by the thousands, according to the email service used to launch the attacks. Critics says it's the latest in a pattern of neglect by AOL. By Chris Oakes. |
1999/10/11-12 [Computer/SW/Security] UID:16689 Activity:high |
10/10 Does sshd on soda have an idle timeout? Or is it something that I need to configure on my client? I keep getting "connection reset by peer" messages after about 10 minutes or so. \_ There's an option in ssh that lets you do keepalives. You might also be behind a firewall that timesout too quickly. \_ Yeah, I'm aware of keepalives. It doesn't seem to help. The firewall that I'm behind is a simple Linux ipchains one. I don't *think* it has any idle timeouts. Weird. \_ ipchains masquerading has a 15-minute timeout by default. You can raise it to (say) one day: "ipchains -MS 86400 0 0". See "man ipchains" for details. \_ Thanks for the info. Is that 15 minutes default timeout listed somewhere in the man page? I didn't see it. \_ It's not in the manpage, but it is mentioned in /usr/doc/HOWTO/IPCHAINS-HOWTO (section 4.1.5). \_ Soda's keepalives are currently set for 24 hours, so if you're getting hozed after ten minutes, somethings fucked on your end. |
1999/10/6-9 [Computer/SW/Security] UID:16672 Activity:nil |
10/6 When I am logged in via SSH, is all the data I type encrypted and safe from sniffing, or just the login/password pair? \_ All is encrypted using 3DES \_ Oh boy, not RedHat again. Try linuxconf or netcfg or appropriate module in /lib/modules/2.2.5/net \_ and people who write dumb shit like this would be taken out and beaten to death as the crowds cheer? |
1999/10/6-8 [Computer/SW/Mail, Computer/SW/Security] UID:16671 Activity:high |
10/6 What is the reason for ssh being suid root? \_ ssh is setuid root for .shosts authentication. The client connects to the server, proves its identity using its host key, and then sends your username to the server. You can't write a fake client that sends someone else's username because the client connects from a reserved port (that's why it has to be setuid root). You can't run a fake client as root on your own linux box because you don't have the real client's host key. make a fake client that sends someone else's username because the host key is only readable by root. If you don't use .shosts authentication, your ssh client does not need to be setuid. --mconst \_ The remote server connects back to check or what? I don't see how your description prevents me from hacking my own client and handing them my own user generated server key. \_ It checks against it's own list of known keys (in the system directory or the user's directory) \_ Huh? Waitasec... so I hack my own client to return a key I've created which I'm falsely telling the server is a valid key for my host. How does it know I haven't made a hacked client? There's too many pronouns floating around confusing me. Thanks. \_ The server only trusts hosts it's talked to before and saves their public keys for future reference. The only way to spoof that is break into the client and find it's private key (which is only readable by root on Unix boxes so non-root people can't do evil shit with it). \_ Hmmm.. ok.. but what if the only prior server contact was with my hacked client? \_ Then the user was a moron if they added your hacked client's key & hostname to their .shosts \_ the server /etc/known_hosts file is maintained by the sysadmin. sshd won't add new hosts to it. \_ Ok, got that. I still don't see why I can't hack my own client to feed all bad info to the remote server from first contact to potential security violation. If my client is the only source of info for the remote server and I've hacked my client to send false data, how does the other side know? \_ it doesn't, but it has no reason to care either. You only get to login if your host in the .shosts and your key matches what the server thinks your host key is. Otherwise you lose. |
1999/10/4-5 [Computer/SW/Languages/Misc, Computer/SW/Security, Computer/SW/Unix] UID:16660 Activity:high |
10/4 does anyone know how to script the password for rsync over ssh? \_ Don't. Instead use RSA rhosts, that is: on the target machine (the one you'll be sshing _to_), put the hostname and username you'll be sshing from into the file ~/.shosts (man rhosts for format). Then make sure you ssh at least once from the target machine and the target account _back_ to the machine you'll be normally running rsync on to get its host key in place. Then your script won't need to type a password, but it's much much more secure than a real .rhosts file. Yadda yadda.. security risk since you don't need to type a password as that user yadda yadda. --dbushong \_ huh? No, use the authorized_keys file, to avoid spoofing. \_ This is the approach I've used. --PeterM |
1999/9/30-10/2 [Computer/SW/Security] UID:16630 Activity:moderate |
9/29 This is probably a dumb question, but why don't .htaccess files work on soda? I am guessing it has something to do with web access loads and the such but I was just wondering if there was some sort of official reason. \_ They do work, but thre are some things they wont do. What problems are you seeing with them? \_ Trying to do server side javascript includes and just simple password security. More just to see how they are done than anything else so it is not that important -fucking moron \_ I'm not sure about the javascript includes, but the password security stuff should work if you get it configured properly. \_ The official reason is that you are a fucking moron. This is supported by your inability to sign your post \_ And where's your signature? \_ Hey! That's not fair! Don't bring facts into this! |
1999/9/28-30 [Computer/SW/WWW/Server, Computer/SW/Security] UID:16614 Activity:high |
9/28 Hi -- say Im using apache+openssl, but Im using basic (not digest) http authentication for a dir under https; is that initial password transaction encryped over ssl? In other words, do I make basic http auth more secure (non-sniffable) by using openssl, or am I still screwed. Yes, I could sniff the packets, but Im lazy:) \_ Get your lazy ass outta your chair, pick up your Visa, and buy Stronghold! \_ apache+openssl is working fine and free -- I just had the above question, that's all. Do ya know the answer? \_ And illegal in the US, but who cares about that... \_ if you're too damn lazy to run "tcpdump 443 | strings", you \_ They can have my STRONG CRYPTO when they pry it out of my cold, dead hands!!!!~@~@!!!@~@!@! \_ You'd be the first to give up your strong crypto when the MIB show at your door. Talk is cheap. \_ It's not the men in black coming after you it's RSA's lawyers with patent infringement lawsuits. \_ What color suits do lawyers tend to wear these days? \_ if you're too damn lazy to run "tcpdump port 443 | strings", you deserve to get hacked, then fired. \_ I think a more important issue (it turns out) is client caching of the password, so it's a bad idea anyway.... \_ I thought it was legal as long as you didn't use any of the patented crypto code like idea and rsa. --marc \_ I refuse to use anything unless my use is considered a violation of patent, copyright, or arms control laws. |
12/25 |