| WIKI | FAQ | Tech FAQ | |
 http://csua.com/feed/ | |
| ||||||
| 11/23 |
| 2004/1/8 [Computer/SW/Security] UID:11716 Activity:kinda low |
1/7 I know soda runs a browser based ssh login scheme but I've never
had to use it so I know nothing about it. Now for various unimportant
reasons I need the same thing running on my home machine. What is
the name of the software that soda uses for this and where can I get
it? Thanks!
\_ Easier is just download putty ssh when you need it.
\_ Google for "mindterm", or just grab it from soda. There's different
versions. It is a 'ssh1' client implemented in java. -ERic
URL is http://www.mindbright.se/mindterm
\_ and an excellent FAQ for getting to systems from behind networks
with firewalls administered by idiot/bofh network admins:
http://www.tldp.org/HOWTO/Firewall-Piercing
\_ It sounds to me like he is looking for server software, not a client.
\_ OP here to clarify: a friend who recently can ssh out from a corp
\_ OP here to clarify: a friend who recently who ssh out from a corp
network no longer can. they only have some sort of http proxy to
the public net now. I'm looking for a way for them to abuse the
corp http proxy to ssh to remote hosts outside the corp net. I
thought the soda solution was running some sort of proxy abusing
ssh client which is why I asked about that.
\_ I could never get mindterm to work right with http proxies.
Mindterm2 has no problems, though. Run it as a local jarfile
if you have funky security settings. -John
ssh client which is why I asked about that.
\_ Thanks! |
| 2004/1/6 [Computer/SW/Security] UID:11680 Activity:nil |
1/6 How do I post to newgroup with an email account I don't have access
to? Thanks.
\_ Use your mad el8 haxz0r skillz! |
| 2003/12/22 [Computer/SW/Security] UID:11560 Activity:nil 75%like:10794 |
12/21 Anybody have any good or bad things to say about http://togetherhost.com? |
| 2003/12/13-14 [Computer/SW/Security] UID:11447 Activity:nil |
12/13 Why do yahoo, ebay, and a host of other sites that require a
password and may contain personal information still default to
use non SSL to transmit passwords? Several times I've forgotten
to click the elective secure login button!
\_ it puts more load on their systems, and really, they don't give
a shit about your account, unless they're providing financial
services.
\_ yes.. extra load on their systems.. also some people are in
environments where https is not an option. if you haven't
noticed, whenever you access something they think is trully
sensitive they switch to requiring https and ask for your
"security key" which is separate from your password |
| 2003/12/12 [Computer/SW/Security, Computer/Companies/Yahoo] UID:29714 Activity:nil |
12/12 Yahoo to use msg authentication for email:
http://www.newscientist.com/news/news.jsp?id=ns99994459
\_ That's like, so yesterday, and stuff |
| 2003/12/12-13 [Computer/SW/Unix, Computer/SW/Security] UID:11435 Activity:nil |
12/12 what in the hayell is <DEAD>writeme.com<DEAD>? like free webmail with no website? \_ see http://www.mail.com and try signing up. \_ aaaaaah hchaaaaaaa! cheerz. but no. \_ ??? http://mail.com offers many @domain options including <DEAD>writeme.com<DEAD>. What do you mean by your statement above? |
| 2003/12/12-13 [Computer/SW/Editors, Computer/SW/Mail, Computer/SW/Security] UID:11423 Activity:nil |
12/11 Does anyone know of a free SFTP client for MacOS 9? --dim
\_ http://versiontracker.com |
| 2003/12/11 [Computer/SW/OS/SCO, Computer/SW/Security] UID:11402 Activity:nil |
12/10 SCO's claim of a DDOS attack probably false:
http://www.groklaw.net/article.php?story=20031210163721614 |
| 2003/12/3 [Computer/SW/Security, Computer/SW/Graphics] UID:11295 Activity:low |
12/2 Research on Ecstacy is Clouded by Errors
http://www.nytimes.com/2003/12/02/science/02ECST.html
\_ Not surprising. Most people I've seen on X aren't the greatest
examples of lucidity.
\_ uh, the scientists who ran the flawed study weren't
the ones on ecstacy. in fact nobody in the study was.
\_ Whoosh!
\_ Whoa. Someone commented on an URL link without reading the
URL? SHOCKER!
\_ Okay. It was a joke. Sorry for confusing you.
\_ INCLUDE YOUR CHILDREN WHEN BAKING COOKIES
\_ NEW STUDY FOR OBESITY LOOKS FOR LARGER TEST GROUP.
\_ PROSTITUTES APPEAL TO POPE
\_ ALL DRUG ADDICTS HAVE EATEN A POTATO AT SOME
POINT IN THEIR LIVES.
\_ Y'all gonna keep them brain doctors working when you're 60. |
| 2003/11/25-26 [Computer/SW/Security] UID:11223 Activity:nil |
11/25 When I do "ssh machine command" it keeps asking me for password.
The weird thing is that it only happens on certain machines. Why
is that and how do I make it so it never prompts for a password? Thx
\_ create private keys
\_ man ssh-keygen, man ssh-agent
\_ Also man ssh, search for shosts.
\_ shost-like authentication is not enabled by default in newer
implementations of OpenSSH. Just use the key authentication. |
| 2003/11/23-24 [Recreation/Dating, Computer/SW/Security] UID:11197 Activity:low |
11/23 A friend has a website that's become very popular recently (no, it's
not porn). Up until now he's been relying on the kindness of strangers
to host it but recently the large amount of bandwidth it's taking up
has made that no longer an option. I'm trying to help him figure out
how/where to host his site, any advice would be appreciated. The
site had a recent spike in popularity which may or may not continue,
the last few days it's used up about 13 GB of bandwidth a day. It
doesn't need a lot of storage space (< 100 MB).
\_ http://www.communitycolo.net be sure your friend's site
is not for profit! No porn! -brain
\_ 13 gigs a day!?! wow, and it's really not porn? What is it.
That is a crazy amount of traffic for a non porn site.
\_ warez, mp3, porn. pick 2.
\_ no, none of these... it's just gotten some press in the last
few days. -op
\_ so what's the site?
\_ it's gotta be friendster, no?
\_ 13GB/(24 * 60 * 60) = 150KB/s or 1.2 Mb/s
This is not enough to fill a T1. How can CS students really
be this dense?
\_ Traffic is a spikey thing. Peaks of 10 times
your average traffic are not uncommon.
\_ Perhaps. But I work at a site that is not even
in the top 500 of web sites and we do 200X this
much traffic. Lots of sites that aren't porn do
much more than 13GB/day.
\_ it is a hell of a lot of traffic for a site that is
being run on dontated bandwidth.
\_ he just doesn't have the right friends. 1.5mbs
would barely show on the graph where I am.
\_ BitTorrent.
\_ http://FreeCache.org |
| 2003/11/11 [Computer/SW/Security] UID:11029 Activity:nil |
11/11 11:11:11 has passed.
\_ it isn't the year 1111
\_ Alright, what's the deal with 11:11:11? Is this one of those
mystical stoner things like 4:20 that no one understands the
origin of but everyone quotes?
\_ the 4:20 thing comes from a police code for marijuana.
-nonstoner
\_ That's a widely circulated but well-debunked myth. There
was a group of stoners from Cupertino or somewhere in the
south bay who called themselves the Waldos and got high
after school at 4:20 in the early 80's. I can't provide
URLs demonstrating that it's not the police code anywhere
but a little googling should provide it. -sometimesstoner
\_ a minute to remember those who have made sacrafices in the
fields of battle in service of our country. Hate the
Commander in Chief, but do not hate the foot soldier.
\_ Veteran's Day, originally Armistice Day, was held on
November 11th to celebrate the close of WWI. Supposedly
the terms of the armistice were signed around 11am |
| 2003/10/30 [Computer/SW/Security] UID:10865 Activity:high |
10/30 Somebody once mentioned editing the motd via scp. How does that work?
\_ See, when you edit by scp, you're off by one whole day.
\_ err, think about it. What does scp do? It copies files.
Copy, edit, copy back.
\_ Yes, thank you. I'm wondering *why* someone would do that,
instead of editing it on soda.
\_ to attempt greater anonymity, duh. |
| 11/23 |
| 2003/10/30 [Computer/SW/Security] UID:10857 Activity:nil |
10/29 Is there a way to turn off encryption of the data stream in openssh?
Encryption during the authentication process is fine and good, but
sometimes I want to transfer files across a fast network on slow
machines, and the data encryption becomes the bottleneck rather than
the network. I've check the manpage, but the openssh guys seem a little
fascist about encryption. Thanks.
\_ telnet rcp
\_ weird how a bunch of dudes writing security software would be so
anal about all that encryption stuff, huh?
\_ there's anal, then there's too anal.
\_ go ahead and write your own encryption method and compile it
in and just have it not encrypt. the source is always built
with an option to let the user change methods. use it.
\_ you can build it yourself with a null cipher, or just live with
-c arcfour as one of the faster ones. btw, if you are transfering
smallish files, tar cf - | ssh tar xf - will gain much more than
tinkering with ciphers on the crappy scp protocol.
\_ I would think that part of a secure transmission is ensuring that
the data stream hasn't been tampered with. If you don't encrypt
everything, someone could possibly inject bad data. |
| 2003/10/29 [Computer/SW/Security, Computer/SW/SpamAssassin, Computer/SW/Unix] UID:10836 Activity:nil |
10/28 Someone give me a quick way of installing/using spamassassin? Thanks!
\_ man spam
\_ can I install spamassassin as non-root on a machine that I don't
have root on, like... company machine, school, etc?
\_ yes but it's easier with root. with some tiny clue you can
do it as non-root. you're mostly changing paths around.
\_ ok I just installed it with non-root. However it only
filters 50% of the rules. Should I make it learn it
on a frequent basis (e.g. sa-learn --spam mail/spam) or
is there a better way? Also is razor a good thing to have? |
| 2003/10/22 [Computer/SW/Security] UID:10732 Activity:nil |
10/21 Security researcher and security content analyst positions at
Zone Labs. See ~sky/job/{zone,zone2}.txt. Sorry I was too
lazy to format nice. WARNING: may require sitting for for
extended periods of time. (More positions will be added soon)
Email sking@zonelabs.com
--sky
\_ do I have to bend over too? :(
\_ sygate is far more superior
\_ I respect your opinion... just curious why you think so.
thanks. --sky
\_ 1) sky is not on my favorite person list, 2) i have no contact
:( --sky _/
or association with zone labs beyond being a user, 3) your
lack of english skills are painful, 4) sygate sucks donkey dick.
I tried these and several others and zonelabs was the best at
dealing with rogue apps calling home. zonelabs + winroute for
port and protocol screening make a really good combo.
\_ Do you actually know sky, or is your opinion of the gent
strictly based on motd? -mice
\_ Either way, I wouldn't blame the poster for his/her
opinion. I've had more than my fair share of problems in
the past, which manifest themeselves both in my real
life interactions with people and in the motd. --sky |
| 2003/10/20-21 [Finance, Recreation/Food, Computer/SW/Security] UID:10707 Activity:low |
10/20 Ever wonder why you get some much junk mail? It's because the United
States Postal Service encourages such practice!
http://www.usps.com/features/fourstepstodirectmail.htm
\_ of the corporations, by the corporations and for the corporations...
\_ Yeah, they're self supporting.
\_ poor trees.
\_ theyre grown on tree farms for the purpose. so of like your
\_ theyre grown on tree farms for the purpose. sort of like your
lunch.
\_ yes the forests of Canada, Madagascar and Burma
are one vast tree farm.
\_ yawn. no one is chopping trees in madagascar to get
paper to send you junk mail. it takes 50,000 trees
to print *each* edition of the sunday NYT. you think
they're stripping madagascar? no, it's all tree farm
trees raised for that purpose.
\_ poor cows.
\_ and poor wheat and corn and everything else grown for
us to murder and eat. |
| 2003/10/10-12 [Reference/BayArea, Computer/SW/Security] UID:10580 Activity:nil |
10/10 Any recs. for the cheapestpossible cell service in the bay area that is
more-or-less decent? Only need for occasional use. Want to minimize
the $/month.
\_ Never used it myself, but they say MetroPCS is good if you only
call within bay area.
\_ Thanks, but I am looking for the CHEAPEST. MetroPCS is $35/mo
\_ I don't think you're gonna find any cheap plans below $30
these days with most providers. My gf's sister and parents
have a really old plan of $10 a month, and Verizon's gonna
kick them off the plan in few months. Perhaps you should
look into prepaid cells. AT&T and Virgin has 'em.
\_ Cingular also has prepaid. $0.35/minute for peak time
and $0.10/minute at off peak. Prepaid card starts
at $10 and must be refilled every 30 days. $20 and
above card expires 90 days. I think you get to keep
any leftover $ everytime you refill your account.
\_ Thanks, that's what I was thinking of
\_ http://www.attwireless.com/personal/prepaid
You can get wireless for as low as $10/45 day
period. Minutes will roll-over if you recharge
your acct before the minutes expire. |
| 2003/10/10-11 [Computer/SW/Security, Computer/SW/Unix] UID:10568 Activity:nil |
10/10 pretty entertaining AI/20 Questions website:
http://y.20q.net:8095/btest for anonymous login
<DEAD>q.20q.net/q.cgi?N<DEAD> to register, which makes it way
more entertaining.
Things I didn't know
The Earth's core is not something you can wear
You don't squeeze the Earth's core out of a bottle
The Earth's core is not in a traditional engagement ring
\_ Things I didn't know
A programmer is not fuzzy
\_ Bunny is, though.
A programmer might carry people
A programmer does bite
A programmer is not used to measure something
\_ Thing I didn't know
You don't put things in a testicle
\_ A mobile phone probably has leaves... and is a domesticated animal
\_ Things I didn't know
Religion is not made of plastic
Men might not find religion erotic
Religion is artificially built by human beings
\_ Can some one please install the *ancient* 'animal game' on soda
so these people can get their sillyness fix? Thanks. |
| 2003/10/3-5 [Computer/SW/Security, Computer/Domains] UID:10457 Activity:nil |
10/3 About freakin time...
http://boston.internet.com/news/article.php/3087071
\_ what? why? i found their search page a fresh and welcome change
to my dull typo-filled life. |
| 2003/10/2-3 [Computer/SW/Security] UID:10430 Activity:low |
10/2 someone posted a web page to access our soda mail, what was it
again? thx.
\_ I think it was shot down as insecure.
\_ John says everything is insecure so we should just do it. |
| 2003/10/1 [Computer/SW/Security, Computer/SW/Unix] UID:10391 Activity:nil |
9/30 I'm not a very mathy person, but I've found myself in dire need of
a good root-finding algorithm. I've currently got a piece of
software that uses Mueller's Method -- but it sometimes generates
whack results that crash a rather twitchy third party piece of
software as it iterates. The curves I'm examining can be assumed to
be monotonic. Can I do better than Mueller's, or am I SOL? TIA. -mice
\_ Use Mathworld to look up 'root finding' and find the root finding
method which will work best for the kind of function you have.
Using mathworld for this sort of thing is a good meta-skill to learn.
\_ you'd probably find a numerical analysis text more useful than
mathworld. try checking one out at a college library if you can.
there are not that many root-finding methods that are actually
used much in real life.
\_ One technique to explore-- see if you can parameterize your
curve on some region of interest by a [0,1] lambda. I.e.. munge
your algebra around until you can get a diff from root as a
function of some linear parameter. If your curve is nice,
consider golden section or binary search. Another thing to do
is just chop up lambda into increments, evaluate diff, and
pick the best guess at root (or refine search in a region of
the best approx from a linear visit across lambda). Not the
niftiest method in the universe, but it gets the job done. |
| 2003/10/1-3 [Computer/SW/Security, Computer/SW/WWW/Server] UID:10390 Activity:nil |
10/1 OpenSSL vulnerabilities. Patchpatchpatch...
http://www.openssl.org/news/secadv_20030930.txt -John
\_ is it enough to get install the new ssl rpm or does my mod_ssl
need to be recompiled?
\_ depends on whether mod_ssl is linked statically or not. I believe
it's not since the only new RedHat updates that showed up today
are openssl ones. In general, they a rarely use static linking,
so to update a library, you just need to install the new library
rpm and not worry about the applications that use it.
\_ My new plan. Fuck ssh/ssl. I'm changing all external connections
to vpn-only and then filtering the shit out of who is allowed to
even try to connect to that.
\_ Oh *that* will work. Because we all know that every VPN
solution out there is utterly foolproof and secure. Nobody
ever cracked DES or IOS. Blanket statements like that are
incredibly ignorant and dangerous (although if it makes you
feel safer, go ahead.) There is nothing fundamentally
wrong with OpenSSH/SSL--no computer or software is or
will ever be 100% secure. Just patch the fucking thing
and get on with your life. There'll be others. -John
\_ You're so ... manly! when you talk about security, John.
It makes my heart go "thump! thump! thump!" Can I have
your love child? Your IPSEC key?
\_ DOS vulnerability. Not remote exploit. |
| 2003/9/29 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:10359 Activity:nil |
9/29 What do you guys use to SFTP your files from soda to home Winbox?
I use WinSCP but it hangs too often. Thx.
\_ cygwin scp
\_ SecureCRT + zmodem
\_ SecureFX
\_ Putty's pscp. Though FileZilla works too. Both are free.
\_ http and mozilla |
| 2003/9/24-25 [Computer/SW/Security] UID:10315 Activity:high |
9/24 For Wind0ze users: SecureCRT or PuTTy, cost notwithstanding?
\_ putty seems perfectly sufficient for my needs. but i am using it
as i would a glass tty, so your needs may differ.
\_ never used putty, but SecureCRT has been more than adequate for
my needs.
\_ SecureCRT. I haven't tried PuTTy recently though. I like
SecureCRT's binding of PageUp/PageDown to scrollback, and reading
from my ssh private key files automatically, which are the same as
in my Cygwin ssh. I don't like that CPU goes to 100% and I can't
close the window when output is coming too fast.
\_ TTSSH is another free alternative. I like it, though if you don't
care about cost SecureCRT may be better.
\_ Is SecureCRT free? Last time I checked it has a trial period.
\_ My only beef with putty is that the config is in the registry. It's
X-tunnelling works great, etc. (TTerm can't tunnel IIRC.)
\_ Another great thing about putty is that it comes with
ssh-agent like functionality.
\_ Teraterm can definitely tunnel. Maybe the only bad thing about
Teraterm/TTSSH is it only supports ssh1. I like it.
\_ The only bad thing is that your secure client isn't secure?
\_ Have been using putty for over 2 years now (when forced to use a
windows machine, that is), and have been very satisfied with it. It
just seems to work right, no matter what, carry no bloat and
have no annoyances. Quite possibly the cleanest windows app that
I've used in a long, long time. -alexf
\_ Putty is very basic and simply works. If I could get work to pay
for SecureCRT, I'd use that instead.
in my Cygwin ssh. |
| 2003/9/24 [Computer/SW/Security, Computer/HW/Drives] UID:10308 Activity:nil |
9/23 I have some data tapes that I haven't touched in 5 years. I used
nbackup in DOS on a 486 to make the tapes. Using the same program
on the same computer, I am trying to restore those files. I was
able to open the tapes, but when I try to restore, it says
"Cannot access tape drive" or just keeps asking me to insert the
tape when it's already inserted. Is it possible that the tape is
old and that the data is lost, or is the problem more likely the
tape drive? How can I retrieve this data?
\_ Does it say this for *every* tape? Unless *all* your tapes have
been damaged by some environmental event or they were shitty tapes
to start with, it is more likely the tape drive is shot. If you
have a unix box with the right tape drive you should be able to
at least use dd to read raw data from the tapes as a test.
\_ Actually, since I posted that, I was able to get some data
from one of the tapes. But then it kept giving me error
messages again. I looked closely at the tape, and the tape
is physically only connected to one spool (this was not the
case originally), and it's not as easy as you might think
to get it back on the other spool neatly.
\_ I had this same thing happen years ago. There is an
"end of tape" optical sensor in the drive, and if it
gets dusty, the drive unspools the tapes. You could
try to put the tape back together after cleaning the
dust out of the drive, but I suspect you might be out
of luck. This is why I abandoned tapes, and switched
to hard disks backups. and disks don't make that
annoying whining sound when searching for files. Look
in the Sunday paper and get a 150GB disk for $90. use
an old extra computer as a backup server, or get an
external drive, but either way, make sure to spin it
up often: hard disks can die from stiction if left
unused in an "off" state for too long (years). |
| 2003/9/23-25 [Computer/SW/Security] UID:10293 Activity:kinda low |
9/22 OpenSSH 3.7.1p2 (portable, ie non-OpenBSD) has been released.
There are multiple vulnerabilities with the PAM auth code in
3.7.1p1, so if you use PAM (Solaris/Linux) you should upgrade.
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106432248411636&w=2
\_ Is there an sshd that just works? I'd be happy with a v2 sshd
without holes that just allows simple logins. Any other features
after that would be a bonus. Any suggestions? Please?
\_ Sigh. OpenSSH "just works". It's just that its vulnerabilities
are declared and found more frequently than commercial SSH
daemons. Not saying those are any better or worse, but you are
deluding yourself if you think that any piece of cryptographic
software is "secure" just because no bugs are ever publicly
announced. Patching system components is a part of life as a
sysadmin, get used to it. -John
\_ I am all for opensource but doesn't it bring as much harm
as benefit in terms of security? Sure patchs are made on
more frequently, but isn't it much easier in theory to find a
bug to exploit when the source is available than otherwise?
\_ Do you occasionally look at Bugtraq? I suggest you do,
if only to make it clear that having a commercial program
doesn't add much in the way of security. Ask Microsoft.
"Better the devil you know"... -John
\_ I'm not making my point. I can see that. I don't care
who wrote it or why or where it comes from. I just want
an sshd with minimal features and fewer holes than what
openssh has. If you don't know of one, thanks, that's
ok.
\_ would you prefer to know that holes are being found and
patched at the cost of having to upgrade, or instead
not know about holes and ignore upgrades in ignorant bliss?
\_ I'm not making my point. I can see that. I don't care
who wrote it or why or where it comes from. I just want
an sshd with minimal features and fewer holes than what
openssh has. If you don't know of one, thanks, that's
ok.
\_ You're very clear--I'm simply saying that OpenSSH
is pretty much "it" for open-souce sshd, and with
the non-open source ones, no, you probably won't be
patching so often, but that says nothing about the
amount of holes in them. -John
\_ I don't care if the alternative is commercial or not. I just
want something I won't be patching three times in a week. I'm
not concerned with open vs commercial philosophy.
\_ It's nothing to do with commercial or open source. It's
a question of security. If all you care about is not
patching something, then don't run OpenSSH. This is
what's known as 'sticking your head in the sand'. And
yes, what you don't know _can_ hurt you. Your call. -John
\_ I'm not making my point. I can see that. I don't care
who wrote it or why or where it comes from. I just want
an sshd with minimal features and fewer holes than what
openssh has. If you don't know of one, thanks, that's
ok.
\_ Argh! Nooo! Is this a joke? I had already had to upgrade OpenSSH
on nearly 200 hosts -twice- during last week.
What the #$(@)@*!!
\_ Pride goeth before a fall.
\_ Pride goes before destruction, a haughty spirit
before a fall. Proverbs 16:18
\_ That's why it makes sense to wait to upgrade. OpenSSH
*always* has one or two patches out within a week. --dim
\_ wait a week to upgrade while getting hacked in the meantime?
swell idea, i wish i'd thought of it.
\_ There are no known exploits for this vulnerability, nor for
most of the ones being found lately. "It is uncertain
whether these errors are potentially exploitable,
however, we prefer to see bugs fixed proactively." --dim
\_ so says them. securityfocus paints a different picture.
in any case, better safe than sorry.
\_ More than once the "new" OpenSSH has been more flawed
than the original. An example was when the privilege
separation code was first added. It is common for
the OpenSSH folks to fix a bug and then have to
fix their fix. Hence, we are at p2 already. Just wait
for the bozos to figure it out unless the bug is
easily exploited. --dim
\_ they're not exactly fixing their fix. they somewhat
hastily made a release with *new* functionality,
which was probably not well-tested. so just patch
the old 3.6.1p2 and you're fine.
\_ Jesus fucking Christ! Is there a simple v2 sshd out there that
just works?! I don't need all the whiz bang features, just a
login shell. If it could port forward that would be a bonus
but I could survive without it if it meant I could stop the
upgrade madness.
\_ what's this whole upgrade madness? it's been a while since
the last major openssh scare. fwiw, maybe you should've just
patched 3.6.1 and been done with it.
\_ lsh might be what you are looking for. Keep in mind that
OpenSSH has a larger user base, developer base and h4x0r
base so gets more auditing.
\_ and lsh had its own remote exploitable bug days later.
so what's the difference.
http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106432248411636&w=2 |
| 2003/9/23-24 [Computer/SW/Security] UID:10287 Activity:nil |
9/22 I know of MindTerm, as well as a whole slew of httpstunnel
ssh-over-https scripts; does anyone know of a java applet which
combines the two? -John |
| 2003/9/17-18 [Computer/Networking, Computer/SW/Security] UID:10233 Activity:nil |
9/16 What's the cheapest internet access to be had in (west) Berkeley?
It's for my sister, a student... and I don't think piggybacking
onto someone's wireless is an option. Speed isn't important.
Thanks.
\_ Get dialup for $8 a month.
\_ Who has dial-up for $8 a month?
\_ i have dialup for $6.95 a month.
\_ NetZero. The ads are free too...
\_Netzero isn't free anymore.
\_ I haven't used it, but the last time I was looking, I got a couple
reccomendations to http://www.access4less.net $6/mo and supposedly good
service (can't vouch for this, apple-fan(atic) roommate went
and signed up for their partner earthlink) |
| 2003/9/17 [Computer/SW/Security, Computer/Rants] UID:10227 Activity:nil |
9/16 Shutterfly on http://fuckedcompany.com. Add this to my list of a few days ago about why *not* to use them. \_ Who cares if Best Buy is or isn't using them? It's a good service. -tom \_ Because they're a dotcom with no parent company, too many staff, high prices and one less big customer. I just hope you keep an original of all your pictures and copies of everything your friends have shared with you. When they go, they're going to go POP! really fast. \_ I ended up going with http://pbase.com. Yeah, it's a pay service ($23/yr), but it had all the features I wanted in an attractive package. |
| 2003/9/17-20 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:10225 Activity:nil 74%like:10214 |
9/16 OpenSSH 3.7.1 released (fixes a buffer mgmt error):
http://marc.theaimsgroup.com/?l=openbsd-announce&m=106375547524560&w=2
OpenBSD: http://www.openssh.com/openbsd.html
Portable: http://www.openssh.com/portable.html
[ updated to 3.7.1 since 3.7 had a bug ]
emacs user was here
\_ I had a beta version of 097b ssl installed so I got the 4/10/03
version and the compile and install went clean but the ssh client
still says its using the old version.... I then recompiled and
installed ssh and same thing. I've tried a few other things but
nothing works. Any hints? There's no rpm for my system and
the compile isn't the issue anyway. Thanks!
\_ Have you killed and restarted sshd? Do you know where
your make install is putting things--is it the same place
your startup scripts are running them from? -John
\_ ssh -v shows the old openssl version. It has nothing
to do with sshd. It's getting it from
/usr/lib/libcrypto.so.8.0 according to ktrace. I don't
see where the openssl install is supposed to replace or
install a newer version of this file.
\_ If you build openssl from src it puts the libs
in /usr/local/ssl/lib or /usr/local/lib (depends
on your os). If you want your new version to
override the system installed default, then just
rename the version in /usr/lib and make a symlink
to the new version (provided you can build a .so
on your arch). If you are using *BSD you should
probably fetch the latest version of /usr/src/lib
and rebuild that way.
\_ Arrr!
\_ Avast! |
| 2003/9/16 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:10214 Activity:nil 74%like:10225 |
9/16 OpenSSH 3.7 released (fixes a buffer mgmt error):
http://marc.theaimsgroup.com/?l=openbsd-announce&m=106373074626260&w=2
OpenBSD: http://www.openssh.com/openbsd.html
Portable: http://www.openssh.com/portable.html |
| 2003/9/13-15 [Computer/SW/Security] UID:10183 Activity:nil |
9/13 Which online photo sharing websites do you guys prefer?
\_ shutterfly. -tom
\_ http://www.csua.berkeley.edu/~login
\_ snapfish.
\_ Decide what you need. Here's the service summary on the 3 major
sites:
snapfish: uses Kodak paper and machines, lowest prices, but
ships from east coast so it takes a little longer
to get prints sent here, maybe an extra 2-3 days.
ofoto: owned by kodak but uses fuji equipment, etc. slightly
more expensive but you'll get your pics a day or two
sooner because they're printing locally,
shutterfly: same idea as ofoto except they're still a dotcom
and dont have large company backing them so they
have to charge more and they could go under and
take your pictures with them at any time. i
believe they use a variety of smaller development
firms, thus the higher prices since they don't get
the same kind of bulk rates snapfish and ofoto can.
If you're not printing and only want the free online storage
and the ability to share, it doesn't really matter. Bits are
bits, yes?
\_ ofoto requires your visitors to log on to view your
pictures, so it does really matter. -tom
\_ if they didn't then deep linking directly to photos
would allow rampant abuse of storage and bandwidth for
non-customer uses. It isn't 1998 anymore. They need
to control costs and make profit or die.
\_ that is easy enough to prevent without making someone
need to have an account. Just check the referal.
\_ See my comment about 1998. If they can get you to
sign up, you're more likely to continue using the
service. If you won't signup, what do they need
you for anyway?
\_ I'm just pointing out that your first argument
was flawed. As to the second, well, there are
two options I can go with that don't require
a visitor to sign in. All other things being
equal guess which choice is better?
\_ We have a different idea of what constitutes
abuse. To me if you're not a paying customer
or bringing in other paying customers yet
you're sucking bandwidth and storage, you're
useless to the company. True, it's only
really abuse if they allow it to happen and
in this case they're not. Additionally,
they're taking steps to try to get more
paying customers which is a good thing for
any business. We're splitting hairs at this
point. Since the accounts are free, it's
all pretty much the same in that regard.
There's probably a csuamotd/csuamotd account
on all three already. :-)
\_ no, because if I'm using the service I'm
also probably paying for prints and the
like. The point is by making people
need to log in to see my pictures I'm
going to go with one of the other two
and when I want to get prints I'll
get them from the company where I've
put my photos. Bandwidth and storage is
still pretty damn cheap compared to other
costs and it is pretty easy to catch the
serious abuses. (Say just give every
use a dl/day limit). |
| 2003/9/2-3 [Computer/SW/Security] UID:29520 Activity:insanely high 80%like:10043 |
9/2 What is the average density of yermom? I don't have anything to
measure weight near me and I need that info soon. Ok tnx.
\_ STFW? there's got to be something about this online somewhere.
\_ Use the scale at the post office. It also depends on the paper.
\_ I cannot easily access a post office right now. I need to
come up with a very rough estimate of lost of book. I have
only rulers in my disposal.
E.g. phone books are pretty light considering their sizes.
\_ I cannot access a post office right now. I need to estimate
very roughly the weight of many boxes of books with only rulers
and helpful info from the motd. If you have a big book and can
measure both its weight and dimensions, please let me know. Tnx.
\_ I know. Find a computer book at your office. Measure its
dimensions. Go to http://Amazon.com, and try to order 100 copies of
that book. See what the shipping charge is, and backward-
calculate its weight according to the shipping method. Then
cancel your order at the last step.
\_ That's a pretty good idea. Though you don't even need to do
this--Amazon should include the dimensions of the book. |
| 2003/8/29-30 [Computer/SW/Security] UID:10013 Activity:nil |
8/29 How does ssh generate the fingerprint for the rsa public key?
When I echo <pubkey from ssh_host_rsa_key.pub> | openssl sha1
I get a different fingerprint than what ssh shows me, but when
I look at the actual key they are the same.
\_ umm, you know doing that sums the string 'pubkey', and not
your actual key right?
\_ he does now.
\_ I figured it was obvious that 'pubkey' ment the public
key from /etc/ssh/ssh_host_rsa_key.pub. I've fixed it.
\_ cat /etc/ssh/ssh_host_rsa_key.pub | openssl sha1
\_ the right answer is ssh-keygen -l -f <keyf> |
| 2003/8/27-28 [Computer/HW/Memory, Computer/SW/Security] UID:29482 Activity:moderate |
8/27 I just gave a security presentation to a bunch of MBA students working
on a market strategy for http://www.giwano.com Aside from a mildly
unfortunate name, they have a cute idea, but it seems slightly
gimmicky to me. While I can think of nice roles for some kind of
"secure" storage like these, what's the almighty motd's opinion? -John
\_ sounds like hogwash. Either the user can't get data between the
two systems, or it's vulnerable to attack. -tom
\_ what do you have in mind re: unfortunate name? gitano? guano?
\_ Puerile, but yes. And as the PC (that's what it is) runs
XP, it is vulnerable to attack--the idea is to use the
flash memory between the two PC units to manually move
sensitive data back and forth. It's got a built-in KVM
switch to let you work on both units, so you could connect
the internal unit to a 'sensitive' network and share it with
PCs there. Or something. I think the idea has some merit,
but they're going about it all weird. -John
\_ Isn't this just reinventing sneaker net? --dim
\_ I tried to figure out exactly what they're doing but wasn't willing
to invest that much time doing so. Can you explain it in a few
short sentences? Generally, people with important data seem happy
with their current level of security. If they weren't then you'd
see products from the major vendors (EMC, Hitachi, IBM, Netapp, etc)
to address the issue. You don't but I wish them well anyway. |
| 2003/8/26 [Computer/SW/Security, Computer/SW/Unix] UID:29470 Activity:high |
8/26 http://nosuch.com/music/webtones.cgi \_ hm... I don't think this is that cool. \_ The arbiter has spoken! \_ more an attempt to stimulate conversation than to arbitrate. what do other people think? just seems to me like there are many arbitrary ways one could generate music from a web page, gif, whatever, and the results of thsi weren't particularly compelling musically. |
| 2003/8/15-16 [Computer/SW/Security, Computer/SW/Unix] UID:29359 Activity:low |
8/15 D00DZ GN00 WUZ 0WNZ!
http://csua.org/u/3xw (story.news.yahoo.com)
http://www.cert.org/advisories/CA-2003-21.html
\_ rms:rms |
| 2003/8/14-15 [Computer/SW/Security] UID:29342 Activity:high |
8/13 Read your Soda mail on the web: http://dev1.bnet.org/imp No warranties, but you can mail me w/ questions/comments. IMP does this semi-securely(?) using IMAPS (port 993). -abe \_ so wait, it uses imap-ssl but you suggest we login via plain text http? brilliant. why not just use something like http://www.mail2web.com instead? \_ who would trust your site anyway? if people want something like \_ and to connect to it over straight http... this, csua should just install squirrelmail or something. \_ Which could very easily be used to gather passwords. Come on, people... SSH tunnels and IMAPS are really not that hard to set up. --scotsman \_ Not that easy if you are on some webterminal while on vacation. \_ I found that going to the putty download page and running from there often worked to ssh in. \_ Of course I could easily use it to gather passwords. CSUA *should* install something like IMP (or squirrelmail, or whatever), but they haven't, so this is an alternative. of course, you have to trust me and my server (which I probably wouldn't). -op \_ not for "you" to gather passwords. for a man-in-the-middle between you and the hapless user. --scotsman \_ I guess it's about like http://csua.org/u but it's a potential security/privacy hazard. So, if I may speak for the motd, we thank you but respectfully decline. \_ Um. It's nothing like http://csua.org/u the url shortener doesn't have anything to do with your login on soda. and it doesn't \_ um. the reading comprehension thing again. -not 2 up open you up to having your account nabbed by a sniffer. Again I say come on... --scotsman \_ um. the reading comprehension thing again. -not 2 up \_ Wow that's great! It uses my MSPassPort(c), right? I use my MSPassPort(c) for everything! But if you're not MSPassPort(c) compatible your site will never grow! \_ guys, come on. It's a PROOF OF CONCEPT. Give the guy a break. Change your password and give it a try, then change it back. If it's cool maybe we could sign a petition to install similar stuff on trusted CSUA machines. Now if only we could petition a Recall on Poliburo, that'd be even better. \_ arnie for csua president! \_ Why would you trust a CSUA machine? \_ I trust any CSUA Linux/BSD machine over any corrupt and disfunctional CSUA Poliburo any time. \_ it is a nice program, thank you!! |
| 2003/8/11-12 [Computer/SW/Security, Computer/SW/Unix] UID:29315 Activity:kinda low |
8/11 http://www.craigslist.org/eby/eng/14754592.html They claim there's a "Secret password" encoded in there but it looks like every other "we don't have enough money" job posting to me. I'd never apply for a job like this but I'd like to know if there really is a "secret password" in there. \_ Read down the first letters of the first five paragraphs. I want 30% of your first month's salary. \_ bingo \_ Kinda sad actually. I thought it would be harder to find. \_ BSPTEFEEA? WTF does that mean??? \_ It means "you will continue to draw unemployment" |
| 2003/8/10-12 [Computer/SW/Security] UID:29299 Activity:very high |
8/10 I'm looking for an encryption software package for windows 2000 that
works on a per-directory or drive basis and is transparent. Meaning
once I authenticate myself I can create files or copy stuff into the
folder and it'll be encrypted automatically. Word, Excel, TurboTax,
etc should all work with this encrypted folder. For individual files
I can use pgp. But when working with a lot of files, I prefer not to
think and just dump the files into a directory. I'll buy the software.
Not looking for free stuff. Thanks.
\_ Whatever you do, avoid EFS. It has its uses, but its key management
is immature and difficult to manage. You may also want to have a
look at Utimaco Safeguard Easy (it's not on a per-directory basis,
but might give you something to work with.) -John
\_ for enterprise level you might consider a NAS or SAN product like
the datafort from Decru. the nas product does per file encryption
on the fly.. plus can do end-end cryption btwn it and your desktop.
for just local storage, i recommend either f-secure or pgpdisk,
both create a virtual volume on the local drive and maintain a
file system structure w/in that volume. from experience w/ both,
pgpdisk at least used to be easier to use. you can find it at
http://www.pgp.com of course. -shac
\_ You can also try BestCrypt. You can mount an encrypted file as a
removable drive. I've been using it for more than three years
now to keep my personal stuff secure on my work laptop.
http://www.jetico.com
\_ Steganos Security Suite. Tools include Steganos Safe (like PGPDisk),
Internet Trace Destructor, Email Encryption, Shredder, Password
Manager
\_ Which tools work on both Linux and Windows platforms?
\_ here is my stupid question. Where do you guys store your
private key ring when you are using any of these product?
the very same laptop/computer that you are encrypting upon?
\_ This is the problem. Probably the best place to store
a private encryption key is on something like a smart card,
which can itself be PIN-code protected. One of the main
weaknesses of most drive encryption products (this is my
beef with EFS) is that it's nearly impossible to keep
track of peoples' private encryption keys--Entrust does a
good job of this, I'm not sure of other PKIs (MS does not.)
Ideally you'd have the keys somewhere local and secure
(like a hardware token inside a protected container) as
well as archived *very* securely for recovery purposes in
something like an encrypted CA/RA database. For everyday
encryption (aunt Hilda's secret recipes, your porn) storing
keys in something like a GPG keyring should be enough. -John
\_ My PGP foo is weak. Please explain. So what if I store
all the key stuff in the same laptop? I thought that
without my passphrase people can't possibly crack it?
That's the whole point of the bigger and bigger sizes
I keep hearing about. E.g. 1024 vs 2048 bit encryption.
\_ OK when you lose your encryption keys, you have a
problem. A PKI (public key infrastructure) is a
mechanism that issues keys for encryption and
your transfer rates will sky rocke while your disk usage will
signing etc. and, ideally, archives your private
encryption key in a safe place. PGP/GPG work
differently, instead of having authoritative say
"Joe is OK", you have this idea of a "web of trust"
where you trust peoples' keys by consensus. Key
size, to oversimplify it, just affects how hard it
is to crack something by brute force. And as for
storing all your keys in one place, look at it like
a normal keychain--if you put all your keys on it
and it gets lost or stolen, you have a problem--you
should probably use a key safe or something. Hence
the password protection or storing it on some
secure medium, like a smart card. For some slightly
outdated docs on how a PKI (not PGP) works, have
a look at http://ospkibook.sourceforge.net -John
\_ I use PhilCrypt with the compression option. Works with all OS's,
local, over NFS, HTTP, etc to NAS, SAN, with udp, tcp, iscsi, you
name it! PhilCrypt is the best and the compression option means
your transfer rates will sky rocket while your disk usage will
actually go down the more data you add to your PhilCrypt DataVault!
Get "PhilCrypt DataVault Deluxe" (includes PhilCompression and
advanced management features)! |
| 2003/8/8-10 [Computer/SW/Security, Computer/SW/RevisionControl] UID:29286 Activity:moderate |
8/8 Is there any way to run a cvs server without root such that it can
support windows users without ssh.
\_ man pserver
\_ no joy.
\_ another way is to download cygwin, install it in windows,
use the cvs via ssh at the command line - danh
\_ man pserver
\_ no joy.
\_ Um.. okay, read up on pserver on the cvs howto page.
\_ You can use .rhosts file. Better to use ssh such as plink though. |
| 2003/8/8-10 [Computer/SW/Security] UID:29277 Activity:low |
8/7 Is it just me or is Soda's POP3/IMAP security certificate broken?
\_ Does anyone besides me read CSUA mail on the web (i use imp)?
\_ Yup, it expired. |
| 2003/7/30 [Computer/SW/Security, Computer/SW/Unix] UID:29175 Activity:kinda low |
7/29 I've been struggling with cygwin all day and getting nowhere.
I'm trying to get it to run init and startup xinetd, sshd, etc
from /etc/rc.d/rc?.d just like on a real unix box and I'm not
getting anywhere. There's an error in the init.d/functions file
which prevents anything running properly and when I try running
xinetd by hand, it runs as my user and not SYSTEM even though
I setuid'd xinetd.exe and tried a bunch of other things. Has
anyone here got any of this working and if so, please tell me
how explaining very very slowly because I'm feeling really
stupid right now. And no google didn't help at all. Thanks!
\_ there is a cyg program to install your sshd (and anything
else) as an NT service. Set that to start automagically
and you will be good to go. google for "cygwin sshd
install" and i'm sure you will find it. |
| 2003/7/25 [Politics/Domestic/California, Computer/SW/Security] UID:29134 Activity:kinda low |
7/24 Any recommendations for high-speed access in La Palma, Ca? I have
SBC for phone service, but ironically, I can't get the Yahoo/SBC DSL
deal where I live.
\_ try using http://www.dslreports.com to search |
| 2003/7/23-27 [Computer/SW/Security, Consumer/CellPhone] UID:29119 Activity:high |
7/23 Anyone have any experience checking their soda email thru t-mobile's
"t-zones" service? I just got a new phone that I'm messing around
with and it seems pretty cool except for a couple glitches that I've
been calling tech support about and wondering if anyone's gotten it
to work right. thanks. - rory
\_ http://www.ntk.net/2003/07/25/dohbad.gif -John
\_ Who the heck came up with that name. "combination skin and oily
\_ you need an exfoliating mMode cleanser. - rory
\_ rory! I fantasize about giving you a bikini wax.
\_ WTF is going on here.
\_ Probably the same people who tried putting a computer store
in the old Weird Stuff building in Sunnyvale (across from the
old Fry's) and decided T-Zone was a much cooler name than
Technology Zone. Didn't last long.
T-zones let me check my email ANYWHERE!" -chialea
\_ I haven't had any luck, except through very basic SSH
access through my P800.
\_ and does anyone use the t-mobile internet (unlimited gprs for
19.99 on top of voice plan)? does it suck? --karlcz
\_ I think the rates have changed. I'm getting 1MB for 2.99,
and I can upgrade to unlimited bandwidth for $10.
\_ that is for t-zones WAP service. tmobile internet
lets you use your phone (or pcmcia card) as a gprs
network interface for your laptop, pda, etc.
\_ I know a couple people with t-mobile and they are angrier about
lock of service than even the cingular users I know. Data, voice,
neither seem to work worth a damn. No wonder if is so cheap.
\_ I heartily disagree... perhaps the problem is your friends'
phones? I recently switched to a Nokia 6610 (been using
t-mobile for a while) and service dramatically improved. I'm
almost never w/out connection. Plus, their customer service
is fantastic. extremely helpful phone people. I lost my
previous phone and was given a full month credit just because.
\_ out of curiosity where in bay area are you?
\_ Manhattan. heh
\_ I get full signal in mid-peninsula and south bay. But I haven't
tried east bay where my friend has almost no signals.
\_ Update: alright, so I figured out the problem, but would like to
come up with a better solution. When I check my soda email with
my phone via POP3, it leaves all my msgs on the server but moves
them off the spool to a mailbox file named "mbox" in my home dir.
Usually I check my email with Outlook Express, which as far as I
can tell, just checkes for msgs on the spool. Is there any way
I can get these two different mail-checking methods to work
together? is this standard behavior?
\_ you have pop3 over ssl working with soda? i never got that
working
\_ I use pop3 over an ssh tunnel. ie, localhost:110 on my home
machine |
| 2003/7/15-16 [Computer/SW/Security] UID:29048 Activity:nil |
7/15 http://lwn.net/Articles/39909 Bruce Schneier's crypto-gram, scroll down and read the last part. |
| 2003/7/10-11 [Computer/SW/Security] UID:28998 Activity:moderate |
7/10 What is a good way to check to see if a host is alive when ICMP is
blocked? Attempting an ssh connection to it stinks if the host is down,
since the client takes a long time to give up. Other ideas? --dim
\_ Interesting, you'd need to know a service that is always up
when the host is up. If ssh is running, you could try
telnet host 22
\- not true
with udp --psb
when the host is up. then netcat that port.
'netcat hostname 22'
\- you cannot tell the difference between a host that is
blackholing you and one that is down ... i.e. you arent
getting any FIN/RST/ACK etc. i suppose you can hit random
udp ports and look for icmp port unreachables ... basically
you either need to know/guess something about the machine
to pick the "single" highest probability technique or
you need to OR together a bunch of tests, some of which
are expensive. i am assuming you are a few hops away
and you want an active rather than passive technique. --psb
\_ Port scan 'em.
\_ Call the sysadmin or send email and ask. If you're the admin,
then look at the screen. |
| 2003/7/10-11 [Computer/SW/Security, Computer/SW/WWW/Server] UID:28992 Activity:nil |
7/9 So, what are the cheapest "trusted" SSL certs out there?
\_ Get a standard Windows install, open MMC, look in the certificates
snap-in for trusted root certificates, go through those. Or failing
that, in the 'security' settings of any browser under whatever
incarnation of a 'certificate authorities' listing you have.
(Thawte no longer exists.) What do you need a trusted root CA
chain for? You can very often get away with issuing your own.
-John
\_ http://instantssl.com, price starting at $50
http://geotrust.com, price starting at $150
Never used either of them, so YMMV. |
| 2003/7/9-10 [Politics/Domestic/California, Computer/SW/Security] UID:28981 Activity:very high |
7/9 Diebold voting machines easily hackable:
http://www.scoop.co.nz/mason/stories/HL0307/S00065.htm
Why on earth would you use Microsoft Access to do something as
important as tabulating votes?
\_ because you care more about short-term profit than democracy?
\_ Well, there goes their profit.
\_ how is there profit in using a shrink wrap ware instead of a
free one? they're stupid but not for the reason you feel.
\_ thanks guys, once in a while this anti-corporate, "they
are all a bunch of evil greed heads" draws me in and i
forget that the answer is almost always "people are
stupid" rather than "people are evil", it's good that
\_ How about making software as "product" and subject to
product reliability law suit? duh
there are others who realize that and can remind me when
i forget. -phuqm
\_ only criminals would hack into systems. let law enforcement
do its job, fucker
\_ hmm, these sound like the words of a criminal who is aware
just how unlikely the "job" is to get done. You know, that
or a Troll. -phuqm
\_ Or corrupt/zealous/partial/party-affiliated voting officials
\_ That makes them criminals, DUH!
\_ hah! the great long tradition of police protecting voting...
\_ how about making software as a "product" (instead of this
licensing nonsense) and subject to product reliability law suit? |
| 2003/7/7 [Computer/SW/Security] UID:28943 Activity:low |
7/6 Is there any way to get scp to not overwrite a file that exists on
the remote host?
\_ Use rsync instead. You can use rsync through ssh for the
encryption and auth.
\_ Unison is a nice tool for syncing things between two machines. |
| 2003/7/2-3 [Computer/Domains, Computer/SW/Security] UID:28898 Activity:high |
7/2 I need to renew my domains soon. I'm currently registered under
http://joker.com but with the high cost of the euro, I think I'll switch.
Can anyone recommend a registrar for this? Does it cost money
to switch?
\_ http://godaddy.com It does not cost additional money to switch
\_ It looks like they offer only 5 subdomains with the basic
package. Can I add more? How much would they cost?
\_ http://www.tubgirl.com has the best domain registration service.
\_ but not quite as good as www.goatse.cx |
| 2003/7/1 [Computer/SW/Security, Computer/SW/OS/Windows] UID:28886 Activity:nil |
7/1 What's a .pif file?
\_ http://www.google.com/search?q=what+is+a+pif+file
\_ brilliant! |
| 2003/6/25-26 [Computer/SW/Security] UID:28837 Activity:high |
6/25 Does anyone have any day-to-day experience with encrypting
many (O(100s of MBs)) of files on their hard drives? For
instance, if you have a laptop with all of your electronic
bank statements/etc on it, and wanted to encrypt these with
a key that you have on a compact flash or something similar?
I know it is doable, but I'm wondering if it is in a way that
is still usable?
\_ why not use an encrypting file system...
\_ MS EFS has somehighly annoying problems, like making it
really easy to accidentally generate new keys (which are
not backed up easily.) Look at CFS under FreeBSD. -John
\_ The critical point would still be key management, right?
You don't want to have the key on the machine if it
gets stolen, but you still want fairly normal access to
the files... Put it on a "secret" web page so that you
can download it to use? Or on compact flash? Does
anyone do this kind of thing?
\_ but that would be cheating.
\_ is there any free/open source encrypted file system?
\_ pffft. You might as well just format the drive now.
\_ Abe's Linux Encrypted Filesystem howto:
http://www.abeowitz.com/crypto
Also I've seen similar stuff with windows that uses a
vxd to add encrypted filesystem support and mounts an
encrypted block file.
\_ no relation. -abe
\_ Just tell your g/f that you look at porn. Stop trying to hide
it from her. |
| 2003/6/24 [Computer/SW/Database, Computer/SW/Security, Reference/Law/Visa] UID:28824 Activity:high |
6/24 Oh god. I wish the EU (useless bunch of poltroons) would get at
least a semblance of a backbone.
http://www.theregister.co.uk/content/55/31380.html
Does anyone know more about new biometric passports the US is supposed
to be issuing? I'd frankly much rather deal with the hassle of a
visa with my Swiss passport than submit to this. -John
\_ Maybe it's just me, but John seems to talk about his Swiss passport
pretty frequently.
\_ Biometrics are such a huge mistake. No one seems to be addressing
the issue that if your biometrics are compromised, there is no way to
issue new ID--well, without replacing your eyes. -emarkp
\_ Hm? Perhaps I'm misunderstanding the process: you have an ID
or passport with your retinal scan/fingerprints on it. They
scan your ID, compare it to a db of such things, and then you
put your eye/hand to the scanner and verify that you are who
the system says you are. Are you saying that someone could
hack the db and sub their own particulars for yours and so take
your bank account? If so, you now have their fingerprints /
ret. scan on file-- should be fairly easy to find the duplicates
in the system and arrest the perp.
\_ No, if someone else can ID themself with your biometrics or
subvert the system somehow, you're screwed. You can't get
different biometrics. -emarkp
\_ What are we talking here? Fake fingerprint gloves?
False retinal scan contacts? Not saying it can't be done
but quite a stretch, no?
\_ Actually it's quite easy to fake out the fingerprint
thing. The retinal scans can be horribly difficult
obtain accurately at times. The real problem is identity
theft and proving that it wasn't you who shifted your
bank account/stock portfolio/real estate to party X.
VERY tough to dispute.
\_ I fail to see how biometrics makes this worse;
right now you're being authenticated on your
signature, which is way easier to forge than
even the simplest biometric. -tom
\_ It's not worse. It makes id theft much more
difficult. I'm more for dual source
authentication. Bio + PIN. However, businesses
might make it much harder to dispute id theft
and make corrections since it is technically so
difficult. I fear an overreliance on tech.
\_ I think this has less to do with tech, and
more to do with the nature of big business
and bureaucracy. Bureaucracy and silly
overhead happen just fine without any
technology at all. What you'd hope is that
intelligent policies will be put into place
to deal with situations that the tech makes
'unlikely'.
\_ You'll submit and you'll like it.
\_ Grey matter! Grey matter! |
| 2003/6/12 [Computer/SW/Security, Computer/SW/RevisionControl] UID:28711 Activity:high |
6/11 Which of the free email accounts are the most reliable? I have a
http://netscape.net account that recently has been getting flaky. Anyone
have any recommendations for yahoo, hotmail, or anything else? Thanks.
\_ CSUA
\_ You have broadband? Host yourself.
\_ No broadband. I need to use a web-based provider.
\_ http://www.horde.org/imp
http://www.squirrelmail.org
Work a charm, fast, and I'd trust them a lot more
than a free mail provider. -John
\_ Work a charm, foreigner!
\_ Fine. "They work very nicely", you
pedantic hun. -John
\_ That's Normandic Anglo-Saxon to you.
\_ How about trailer trash honky? |
| 2003/6/10 [Computer/SW/Mail, Computer/SW/Security] UID:28688 Activity:high |
6/9 is anyone using the following SSH client? Is it any good?
ssh windows client
version: Aug 4 1998 (32)
by: Cedomir Igaly, 1995/1998
Revision: 2.100
\_ If you're just looking for a recommendation, either SecureCRT
or TeraTerm Pro have worked well for me.
\_ Agree with the above, or putty (simply because it's the first google
hit on a search for putty, and is a single executable of about 500k.
i call it my tissue paper ssh client) --scotsman
\_ I use the free non-commercial ssh client from http://ssh.com. Works fine
and allows for easy file transfers.
\_ It also has the advantage of recognizing urls and letting you
click on them, which i like since i follow every link posted
on CSUA. It has the disadvantage of being very bugy.
\_ buggs ar eprobabyl frm cdoing typos, eh?
\_ PuTTY works very nicely:
http://www.chiark.greenend.org.uk/~sgtatham/putty
\_ Indeeed, I switched from TTerm to putty and haven't looked back
(the single executable/no install is very nice). It does X
tunnelling which IIRC TT doesn't.
\_ Actually, TT tunnelling is pretty good, and does X fine.
\_ Yup, and teraterm cut/paste is much more friendly. Also
its UI is much leaner, which I prefer. TeraTerm will also
do serial connections, which IIRC putty does not.
\_ Does TT do protocol 2 yet?
\_ Not the last time I checked. That's the *only* reason
to use putty.
\_ cygwin
\_ SecureCRT, hands down! Putty is not bad, but SecureCRT has
almost everything you ever wanted in a telnet client. Ultra
robust, highly customizable. |
| 2003/6/5 [Computer/SW/Languages/Misc, Computer/SW/Security] UID:28642 Activity:high |
6/4 Does anyone know if there's a web interface for FORTRAN? Basically,
I want to write and run FORTRAN programs from a Web browser without
having to install anything on my desktop. Thanks!
\_ no
\_ Hmmm. If your goal is just to write FORTRAN programs without
installing on your computer, you could SSH into soda and
use g77. Is using a web browser really important? Maybe
the Java SSH interface would suffice.
\_ Thanks for that thought. I have a need where it would be more
than just myself and not all my users would have an SSH
client... I just figured Web browsers are ubiquitous. Also, I
was hoping for a richer UI. Any other thoughts?... I
appreciate any ideas.
\_ How about install a VNC server? VNC has java applet client
and it works reasonably well.
\_ The problem with VNC is all users share the same desktop. So
if two people needed to work on their own project, they
couldn't. I didn't mention this as a requirement previously
so I definitely appreciate the suggestion... but I cannot use
it. Please keep 'em coming, though.
\_ you can run them from a browser as a cgi like anything else.
writing them is no different than any other web based input system
that you see message boards,etc using.
\_ In other words, you mean use an HTML TEXTAREA where the
programmer can write his/her code; but when the submit button
is clicked, the code is fed to the FORTRAN compiler on the
server?
\_ something like that. In short I mean "use CGI". that's what
it's there for.
\_ more stupid idea. How about install an X-client on the
FORTRASH computer, install an X-server on your own computer,
and access that way? It will resolve the problem. I know,
you said you don't want install anything on your computer, but
i personally think an x-server should be an exception: everyone
should installed X-server (and FTP server :p )
\_ and a kazaa server and put at least 200 gigs online so we can
all share because the information wants to be free!!! you're
truly brilliant in a k-12 sort of way. |
| 2003/6/4 [Computer/SW/OS/Linux, Computer/SW/Security] UID:28627 Activity:high |
6/2 So why did Anonymous Motd Censor remove the DIY Cruise Missle link?
\_ No one can truly understand the motives of AMC. Anyway here is the
link: http://www.interestingprojects.com/cruisemissile
\_ thanks for restoring the link. Now even I am curious and
want to build a pulsejet myself :p
\_ Because it had nothing to do with RIDE BIKE! or USE LINUX! of
course, which are the only topics that are allowed to be of any
interest to the "Berkeley computer science community". |
| 2003/5/20-21 [Computer/SW/Unix, Computer/SW/Security] UID:28496 Activity:moderate |
5/20 sun gurus, please help. My ultra 5 had some problem getting out of
suspend. I had to power cycle and do nvram-default to get it to boot
up normal again. Everything is up now. But the system is EXTERMELY
slow. I don't see any processes hogging up memory or anything strange.
I think the previous bad suspend left some bad stuff around that's
screwing up the system. What should I look for to get it back to
normal again? Thanks!
\_ It's an ultra5. How fast could it ever have been?
\_ I type 'top' and it takes 10 seconds for the display to come up.
Similarly with other commands. It's not environment related
because using the same dot files on another machine works just
fine.
\_ vmstat, iostat
\_ Don't use suspend. There is no point and it has problems. --dim
\_ When suspend hoses me I try this from the ok prompt:
boot -s
when it asks for the root password, I hit control D.
The machine should then come up fine. I login
as root, I remove /.CPR or /var/.CPR and edit
/etc/power.conf so I don't get hosed again. If you chmod
/usr/openwin/bin/sys-suspend not to be executable, that
will prevent accidentally suspending via the sleep key. -ax
\_ Just pkgrm the power related packages.
\_ pkgrm(in this order): SUNWcprx SUNWcpr SUNWpmux SUNWpmowm
SUNWpmowu SUNWpmowr SUNWpmr SUNWpmu |
| 2003/5/19-20 [Computer/SW/Security, Politics/Domestic/SocialSecurity] UID:28490 Activity:nil |
5/19 My refinance showed someone (LA) is using my SSN. What can I do?
Who do I report this to? This is a serious question. thx.
\_ First contact the police. One of the things they will do is
give you a form with a lot of different crdit agencies to
contact. Contact all major credit card companies as well.
Although you can get a free credit check if you suspect fraud
you get the wimpy version, so you want to shell out 25 bucks
for the full one you can double check. Hell, you probably want
to do it every couple of months for the next half year or so.
Yes it is a bitch, I've been there before, but it the long
run things got corrected and the person stopped using my SSN.
\_ Call your local SS office. They will give you the number of the SS
Inspector General. That office handles stuff having to do with SS
fraud and criminal activity.
\_ And the IRS. When you contact the three credit agencies,
ask to put a freeze or a fraud report on your listings.
\_ See if you can get an address and kill them. |
| 2003/5/12 [Science/GlobalWarming, Industry/Startup, Computer/SW/Security] UID:28410 Activity:very high |
5/11 http://www.workingassets.com - just a decent phone company that puts money toward good (progressive) causes (for when your email to your congressman stops making you feel good). \_ Shouldn't they be giving the service free!?? Capitalist swine - you are a sell out. \_ yermom gives it out for free and she's still swine. \_ If they are the cheapest and give (your) money away, then this is great. o/w give your own money away, and get the charitable deduction for yourself. \_ the nice thing about opting for world conscious services such as this one is that you show market preference for that type of corporation ethic. other companies will clean up their act if they see that the conscious stick gets customers. \_ wow.... I didn't know people actually believed that.... \_ Kinda like the U.N. I imagine. \_ Except the UN doesn't make a profit, isn't at all 'world conscious', doesn't provide real services, has no competition, and continues collecting money from it's 'members' no matter how well or poorly it does providing no incentive to improve, and has no effective means of controlling either it's own members or it's own staff, officers, and executives who don't ever get reviewed, demoted, fired, or replaced, and is trying to take over the entire world and reduce your national level rights to zero. Yeah, kinda like that. \_ Except for the profit thing, this sounds exactly like Microsoft! \_ You think the UN and MS are in cahoots? |
| 2003/5/8-9 [Computer/SW/Security] UID:28377 Activity:high |
5/8 I'm suing someone and it turns out that he gave me a fake address
and I can't serve the paper. What should I do now?
\_ why don't you post this to the motd three or four *more* times?
\_ hire a private detective.
\_ This is correct, assuming you don't have a cheaper option.
(Like a phone book.) I can put you in touch with a good one.
-jrleek
\_ What's the guy's name? Maybe we know him. Or is it a fake name?
And you still haven't told us what information you do have on him:
driver's license, license plates, etc.
\_ If the above does not work, but you have his real name and a
general idea of where he lives, you can petition the court for
service by publication. However, that should be a last resort
because it can get somewhat expensive.
\_ I have his real name and a general idea of where he lives.
What is service by publication and how much is it?
\_ Service by publication means that you take out ad
space in the local newspaper(s) saying "Hey, I am
suing you - Call me for details." If the person fails
to answer within a certain time, you can take that
person's default. Then you hire a private investigator
to find the person and his assets. The cost depends on
the judge, particularly on how many publications and
for how long - check your local rules, but hopefully,
you are in a situation where you can recover costs
and fees. Also, lest I forget, service by publication
generally does not work for small claims matters, but
once again, check your local rules. |
| 2003/5/7-8 [Computer/SW/Security, Computer/SW/OS/Windows] UID:28364 Activity:high |
5/7 "Microsoft Plans Toilets With Web Access "
http://csua.org/u/e60
Now, who wants to use a keyboard that has been touched by a thousand
other people while they wiped their butts and genitals?
\_ Only a thousand?
\_ This is a question you may not want to address to motd users.
\_ Well, you used the lab computers, didn't you?
\_ Oh no! And I was eating my sandwich with bare hands too!
\_ Yeah I always used gloves if you used it before me.
\_ This was on the motd almost a week ago.
\_ yes, although there was no explicit mention of genitals the
first time.
\_ Great, more shitty products.
\_ I'd hate to be in there when the server crashed. |
| 2003/4/30-5/1 [Computer/SW/Security, Computer/SW/Unix] UID:28273 Activity:low |
4/30 So can someone comment on the problem(s) with /var? Why does it keep
filling up, what are people doing to fix the problem each time? Maybe
somebody here already knows a longterm solution.
\_ It is some attachment problem. It goes away on its own.
Jon thinks it is related to SA. I cannot tell anymore than
that because I do not have root. You should email root or
the politburo for answers to questions like this. -ausman
\_ actually, it goes away when someone with root comes along
and cleans out whatever file(s) causing the prob. |
| 2003/4/28-29 [Computer/SW/Security] UID:28247 Activity:kinda low |
4/27 I share a shell-SSH-SCP account using ssh-keys.
Is there a way to log SCP access history of the other users.
\_ don't share accounts. and no you can't create a log that you can't
delete.
\_ What about a log that could be deleted? possible?
The intent of the log is not to log the technically
sophisticated folks who could delete it, but to
keep track of the stupid people. Where can I get
web-hosting with multiple accounts and a group as well? |
| 2003/4/20-21 [Computer/SW/Security] UID:28175 Activity:nil |
4/20 John, a question about swiss bank accounts (since you're there). I've
heard some news that they're going to stop issuing those secret
accounts where you don't need any ID to open one. Is that true?
And do you know of any banks there that use biometric data to access
the account? Like retinal scan or some finger printing device.
Thanks.
\_ There haven't been any id-less Swiss bank accounts for a very
long time now. A 'numbered' account simply means that once
you open an account, there is no longer an association between
your name and the account #--you lose the number, you're screwed.
Swiss banks nowadays do a lot of checking to make sure cash isn't
"dirty"--this includes verifying your ID. The main attraction is
the secrecy you get once the account is open. They generally don't
tell anyone. For even more confidentiality and better service, I'd
look at Liechtenstein. Also, I know of no banks that do biometric
ID for the type of money that you or I are looking at. And for
very large accounts (> $5 million) the service is usually personal
("private banking"). There's still a huge legal gap regarding
biometric ID and digital non-repudiation in most countries. I'd
be glad to ask around, though. -John
\_ If the account # and some password or passphrase is the only
thing you need to to access the account, isn't that dangerous?
If either of the two is stolen you're screwed since they don't
check IDs (rather there's no ID to check). That's why i thought
of some biometric system. |
| 2003/4/17 [Computer/SW/Security] UID:28156 Activity:very high |
4/17 In veneration of his computer science forbears, it is decided that Dan
Holliman will change his name to Dan Hollerith. danh, we expect
compliance and certifying documentation from the Social Security
Administration in a reasonably short time. Thank you and good night.
\_ huh?
\_ Perhaps a reference to the hollerith format flag in Fortran77?
-- ulysses |
| 2003/4/15-16 [Computer/SW/Security] UID:28135 Activity:very high |
4/15 What is a one-time pad, and why is it considered bad/insufficient
for security?
\_ Yeah, why is a one-time pad insufficient? Snicker. - !OP
\_ a one-time pad IS insufficent if it is the only thing
you are using for security. There better be some intelligent
system for sharing one-time pads/keeping them secure, etc.
Stop being an ass.
\_ So you're saying a one-time pad is insufficient if it is used
stupidly? Is there a security protocol that is sufficient
even if used stupidly?
\_ I'm saying that used alone it is far from sufficent because
there are far too many unresolved issues.
\_ declaring war on iraq
\_ which begs the question: if your system is idiot-proof,
won't someone just build a better idiot?
\_ It's an encryption algorithm: to send a (say) 5K message to your
friend, first generate 5K of random bits (the "pad") and share
those secretly with your friend. Then, to send your message,
just xor each bit with the corresponding bit from the pad. You
can't ever reuse pad data; you have to generate new random bits
for each message you want to send (hence the "one-time").
This algorithm is cool because it's provably unbreakable: if
someone sees your encrypted message, but has no information about
your pad, then it's impossible for them to decrypt your message.
However, this algorithm is usually not practical, because you have
to secretly share 5K of pad data for each 5K message you want to
send. (For comparison, an ordinary private-key encryption
algorithm like AES lets you secretly share a small key (128 to
256 bits) and then use that key to encrypt as much data as you
want.)
\_ because you're all being stupid and noone signs their names:
OTPs are useful for when you have only occasional trustworthy
contact with your sender/receiver (in-person contact, trusted
monthly courier ...), and have a need to share relatively short
messages in a highly secure fashion.
to respond to some of the points attempted above:
1) if you have a way to get someone a pad in a secret [trusted]
way, why not use the same way to transmit the message?
Because the way you transfer the pad may not be available
when a message needs to be sent.
2) if you get part of the pad, you can decrypt part of the message.
If you get an AES key, which is comparable in size to the
supposed partial pad, you get the whole message.
Issues of key management aside (which affect all crypto systems),
OTP offers the user high confidence at the expense of convenience
(large, non-reusable keys) and reliance on periodic OTP refreash.
(large, non-reusable keys) and reliance on periodic OTP refresh.
--4554660b1f82fae1e048ff6c1874d31b
\_ I think everyone who cares already knew that, since among
other things the OTP is about the simplest cryptosystem
imagineable. you have been trolled.
\_ only so that I could get the guy below to respond.
sometimes you gotta take a troll to get a better troll.
--3210615175eaa726402a9001bf8dbc6a
\_ OTP does not offer high confidence except in highly
controlled environments because there is no way to
perform adequate message authentication in OTP:
1) If the recv'd msg is off by even one bit/char the
message won't make any sense. While single bit/char
errors might be noticed in the decrypted PT,
multi-bit/char errors that can change the content of
the message without being detected (this depends on
the language, but for things like english the
probability of detecting multi-bit/char errors is not
that high).
2) If OTP is used for messages transmitted via a public
channel the big problem is that there is no way to
ensure that the message you recv'd was transmitted by
the person that should have sent it. In some cases
an attacker can mount a DOS on the system by tx'ing
fake messages.
\_ Why is it one-time? Why can't the same pad be used again to
transmit a different message to the same receiver?
\_ If a pad is reused, a pattern is formed in the ciphertext
which can be exploited by an opponent via a Analysis in
Depth Attack. Some of the venona decodes were the result
of the Russians reusing the same pad for multiple (different)
messages. |
| 2003/4/15-16 [Computer/SW/Security] UID:28129 Activity:very high |
4/14 So I quit my company 2 months ago but I'm still getting paycheck
from them. I'm pretty sure something's wrong with the accounting.
I guess it's just a matter of time before they find out. Can they
legally withdraw money from my account when they find out?
\_ accepting a paycheck from a job you no longer work at
is fraud, end of story. return the money and get on with
your life.
\_ Tell the payroll office about it now, and don't be helpful about
returning the money you have. You can hope that interdepartmental
politics will keep payroll from contacting legal and you might get
to keep it. The moral thing is something else of course... but
you did quit, so maybe they screwed you over? Eh...
\_ Blow up the accounting office or hack their computers. Be a MAN!
\_ of course. it's their money.
\_ it depends. If you're getting paper paychecks then no. But they
can sue you for it and will win. If you're EFT then yes they can.
Either way, I wouldn't spend the money until they're out of
business plus a year.
\_ Why can't the guy quit while he's ahead? That is, close the
bank account.
\_ Because they'll just sue him and he'll lose. Welcome to the
world of adults where accountability exists. Silly rabbit.
\_ No. BUT... Since you know you're not working for them, any money
received works as a claim of fraud. Since it's been a couple of
months and probably a good amount of money recieved, you could be
charged with embezzlement and felony fraud. Notify the company and
arrange to return the money. If you withdrew against this money,
it adds credence to the charges. After two months of getting checks,
you'll be hard pressed to claim ignorance and proving "good will"
in notifying the company of the error. Return the dough and hope
they don't ask for interest back.
\_ This happened to me and a fellow coworker at Cisco. He told them
after the first paycheck arrived and they told him to keep it...
I mailed them after receiving three paychecks (~$5K) and they
never mailed me back but stopped sending checks. A few months
later I deposited the checks into a money market account. I didn't
touch the money for two years. It's been three years since. ymmv. |
| 2003/4/9 [Computer/SW/Security] UID:28051 Activity:nil |
4/9 If I have access to a POP box full of mail, what's the easiest
way to get all the messages currently in the box forwarded to
somebody. I don't have access to the mail spool for this POP
box.
\_ fetchmail from the pop account and then forward. |
| 2003/4/5-6 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:28002 Activity:high |
4/5 On the http://netzero.com Terms and Conditions: * Software Downloads. As part of the NetZero Service, NetZero may from time to time download software owned by NetZero or third parties to your computer. Your use of the NetZero Service constitutes your consent to such downloads. What is this about? What type of software would they want to download to my computer? Is this to scan the files on my computer, or likely something more innocuous? \_ something to do with ads maybe? \_ why do you want to use netzero anyway? there are other choices that are cheaper and have worked okay for me. e.g., joi internet. \_ Thanks for the tip! I'll switch to joi. \_ does joi require you to use their own software? \_ no. \_ Welcome to Gator hell. Tried Ad-aware @ http://lavasoft.com? \_ Ad-aware sucks. Get Spybot Search and Destroy \_ It probably means pop up and other ad crap, data mining, and similar spyware crap. Legally it means *anything* they want and they're on safe legal ground. Some third party ware installed via them steals your CC or tax info and you're a victim of ID theft? You're SOL. Don't be cheap, get real net service without T&C like this. \_Just hack Netzero and get around their software. I used to do it when their accounts were free. \_ Why bother? |
| 2003/4/1-2 [Computer/SW/Security] UID:27947 Activity:low 63%like:27920 |
4/1 OpenSSH 3.6.1 is out. Fixes some interoperability problems with
other implementations.
Portable: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.6.1p1.tar.gz
OpenBSD: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-3.6.1.tgz
\_ Thanks, installed. --mconst |
| 2003/3/31-4/1 [Computer/SW/Security] UID:27920 Activity:low 63%like:27947 |
3/30 OpenSSH 3.6 will be out shortly. Changes include RSA blinding
and proper handling of priv. sep. when root login is permitted.
Portable: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.6p1.tar.gz
OpenBSD: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-3.6.tgz
\_ Thanks -- I've installed it in /usr/local/bin. --mconst
\_ thanks |
| 2003/3/26-27 [Computer/SW/Security, Computer/SW/Unix] UID:27858 Activity:moderate |
3/26 I just upgraded to Bind 9.2.2 and it seems that I can no longer
get responses from roots a and b (the other root serves work
fine). I've checked the routing, I can get to a and b, I just
can't get a response from them. Anyone else have this problem?
Any suggestions about where to start debugging? tia.
\_ I had a different problem. bind8 stopped being able to query
the root nameservers at all. So I upgraded to bind9.
--scotsman |
| 2003/3/26 [Computer/SW/Security] UID:27853 Activity:nil |
3/25 Anyone know if ther are providers that will sell DSL service
without phone service? I've had it with AT&T/Comcast. --jwm |
| 2003/3/20-21 [Computer/SW/Security] UID:27768 Activity:high |
3/20 anywhere to get an SSH2 client, someone just stole my SSH 1 since
i am using teratermpro and ssh for it (ie: a friend stole it)
\_ putty is a free ssh client for Windows.
\_ http://software.berkeley.edu or http://www.ssh.com if you're not a student
\_ stole it?
\_ huh? I thought teratermpro is free at first place. |
| 2003/3/19-20 [Computer/SW/Unix, Computer/SW/Security] UID:27751 Activity:high |
3/19 How did mconst fix /var, and what was wrong with it?
\_ The mail I sent to root is now in ~mconst/pub/var-mail. --mconst
\_ thanks, that was informative. Shouldn't that file be made
unreadable by non-root though?
\_ I think everything in there is public information -- but
please let me know if I missed something. --mconst
\_ I'm sorry, I meant /var/account/acct. It seems like
it contains somewhat private information of little use
to non-sysadmin types.
\_ You're absolutely right. Fixed, thanks. --mconst
\_ Does anybody else find this polite exchange as
refreshing as I do?
\_ Actually...yes. -mice
\_ PURE. REFRESHING. MCONST.
\_ Someone was trying to rotate accounting logs, and failed
miserably. |
| 2003/3/13 [Politics/Domestic/911, Computer/SW/Security] UID:27686 Activity:very high |
3/13 http://www.usatoday.com/usatonline/20030313/4942670s.htm "Much of the information on Mohammed's laptop computer was protected by an encryption code that CIA analysts cracked easily, U.S. intelligence officials said." It was probably RSA or PGP. What else is he likely to have used? Something from MS? \_ They threated to kill his preteen kids if he didn't give them the password. \_ Damn those unsecure end nodes. \_ Microsoft Visual ROT13++ \_ Microsoft Active Visual 2ROT13#. \_ Be sure to download the first three patches and upgrade before using. The fourth patch allows you to encrypt, but won't decrypt non-MS ROT13 encryptions. They are still working on it... \_ This stuff is getting so old it's not even funny anymore. \_ This stuff is still funny, because it is still the case, despite how long it has been the case. \_ Any system in which the key is shorter than the message is an inherently weak system. The only one "safe" encryption system is OTP (and even that is not safe if you have your own Guardian of Forever) \_ Guardian of Forever? Is this some nerdy book/tv/movie reference? \_ Here's a cookie for you. \_ I'm serious. What is it? \_ Watch TOS Ep. 28. \_ so what the fuck is TOS? \_ You do realize that no one is obligated to answer your question, yes? \_ Your geekdom passport has been revoked. \_ 'cause we all know jocks r00l. \_ oh no! What WILL I do? Oh that's right, have a life. Never mind. \_ Sorry, but we don't buy it. You've already proven you have no life by posting here. |
| 2003/3/12-13 [Computer/SW/Security] UID:27668 Activity:very high |
3/12 Call me paranoid. How likely is it for someone to decode traffic
sent to/from an ssh connection? The encryption is done end-to-end,
so if the govt is getting a copy of every packet between two boxes
is it possible for them to crack it? I'm not a technical guy BTW,
I just know the high level functionality of these things.
\_ If they really REALLY care and are willing to wait a couple of
weeks before the traffic is decoded and have some insane amount
of computer power... pretty unlikely. There is a reason this stuff
scares the shit out of the powers that be.
\_ It is much easier for them to attack at the unencrypted endpoints
\_ If the government wants to see your shit, they can get a tap for
your keyboard or put a van outside your home/office and read your
monitor. You're only fooling yourself thinking ssh will really
keep the United States' Federal Government from reading your shit.
I suggest you find a good defense lawyer and send good-bye notes to
your family and friends.
\_ any URLS with stories from people this has happened to?
\_ http://www.you.com.au/news/1009.htm
\_ If you are using SSHv1 there is a possibility that someone could
read your traffic. If you are using SSHv2 (AES128-HMAC SHA1) your
traffic will be unbreakable for the next several billion years
assuming that (1) the RSA factoring problem is impossibly hard,
(2) the Discrete Log problem is impossibly hard, (3) SHA1 is a
true 1 way hash and can't be inverted in less than 2^80 tries,
and (4) there are no weaknesses in the AES S-BOX.
There is a further concern among some about the way that HMAC
is performed in the SSH protocol, iirc SSH does E(K,P) HMAC(K,P)
rather than the more secure IPSEC method E(K1,P) HMAC(K2,E(P)).
I'll look this up in my notes and post later on.
\_ It might take decades, or even centuries, but the quantum
computers are coming.
\- we've broken ssh session keys when we were "really really
interested". ok tnx.
\_ what size session keys and did you break them using
brute force or via some other method?
\- "we measure computing power in acres"
\_ how much ct did you need?
\_ who's 'we'?
\_ "ok tnx" is the hallmark of PSB, and PSB works
at LLBL, so he could have "acres of computing power"
Was that you, PSB? |
| 2003/3/6-8 [Computer/SW/Security, Computer/SW/Unix] UID:27610 Activity:low |
3/5 All of a sudden my DNS server is not resolving http://mail.yahoo.com or http://calendar.yahoo.com. Everythign else I try seems to work. What could cause this? \_ is Earthlink your ISP by any chance? \_ no, why, do they have hte same problem? this is on my own dns server running BIND8.x \_ ; <<>> DiG 8.3 <<>> http://calendar.yahoo.com ;; res options: init recurs defnam dnsrch ;; res_nsend to server default -- 127.0.0.1: Connection timed out |
| 2003/3/5-6 [Computer/SW/Security] UID:27602 Activity:nil |
3/4 Any recommendations for a website, email, and DNS service provider? |
| 2003/3/5 [Recreation/Pets, Computer/SW/Security] UID:27600 Activity:high |
3/4 This is good:
jose CP 67.121.94.23 3:14PM 1:39 cat /etc/motd.public
How do you cat something as short as the motd for over 1.5 hours?
"So the guy at the bar says, 'that's no cat, that's my wife!'" hahahh!
\_ you can pipe it through "more"
\_ I guess... why not just 'more $file'?
\_ because $file expands to whatever $file is before the command
is execed.
\_ I was being generic. I'll spell it out for the anal among
you and try again, "why not just 'more /etc/motd.public'?
\_ or losing an ssh connection while executing the command.
\_ Doesn't sshd use tricks to detect such stale sessions and kill
them off, including all applications that belong to the same
session?
\_ maybe but it's pretty funky dropping a connection in the split
second it takes to cat the motd. im suspicious of this behavior. |
| 2003/2/28-3/1 [Computer/SW/Security] UID:27563 Activity:very high |
2/28 How come csua doesn't support imap, even when it's from csua itself?
\_ imap is disabled, but imaps (imap + ssl) is enabled in
/etc/inetd.conf.
\_ the certificate is self-signed though. wouldn't imap-over-ssh
be more secure?
\_ feel free to donate enough money for a verisign
cert. imaps also works straight out of the box
with Outlook and doesn't require running a ssh tunnel
\_ and you trust soda's SSH key why?
\_ I use the same key on all my production systems.
\_ And this helps why? Your SSH fu is weak. Train
harder.
\_ that way if I lose root i can login from anywhere
else just about because i use a passphraseless key.
soda's key is also on the auth'd list so its cool.
\_ that way if one of your machines is compromised
the '1337 h4x0r's have 0wn3d all your machines!
\_ And self-signed certs are insecure why? Your PKI fu is weak
train harder.
\_ do you memorize the signature on the certificate? at
least with ssh, i need to verify the key only once.
\_ A self signed cert presented by a server is equivalent to
yermom presenting a potential csua stud with a notarized
medical certifciate stating that the person presenting
this certificate is yermom and that she doesn't have any
up enough to go for it PKI fu boi!
the certificate is yermom and that she doesn't have any
stds where yermom was the both the obgyn who wrote up the
certificate and notary who signed it. Maybe you are hard
up enough that you'd go for it PKI fu boi...
\_ I only read email I have personally decrypted
with a PGP passphrase I store on a keychain attached
to my body at all times. I am also very attractive. |
| 2003/2/27-28 [Computer/SW/Security, Computer/SW/OS/Windows] UID:27551 Activity:moderate |
2/27 13823 files on a brand new w2k machine with no other software
installed. I remember copying dos from floppy to floppy using one
drive and had to do 26 disk swaps to get all the files....
\_ Uh, my copy of DOS 6 is only about 3 or 4 floppies.
\_ Did you count all the hidden files?
\_ There were only 1 or 2 which http://sys.com put on for me after a few
more swaps.
\_ DOS 3.2 -- 2 LD 5.25" floppies.
\_ DOS 1.1 -- 1 360k floppy.
\_ MacOS 1.0 -- 1 400k floppy. 127k used, 273k free. |
| 2003/2/27 [Computer/SW/Security] UID:27549 Activity:high |
2/26 MAPI gurus - do you know how to get encryption on MAPI? The online
docs are nasty, i've even looked at lotus's docs out of despereation
still nothing.
\_ Notes uses a proprietary 'encryption' algorithm. Little is known
about it. If you really want a certain degree of assurance that
your mapi connections aren't being snooped, think about running
ipsec. There aren't many MAPI security docs, period. -John
\_ XOR!
\_ 2ROT13! |
| 2003/2/27-28 [Computer/SW/Security, Computer/SW/Unix] UID:27548 Activity:high |
2/26 Wasn't csua passwd was compromised the other time? Could the hacker
had placed some program on csua that snoops our email? I think my
email account has been snooped on. I send out a email to a friend
giving him my server ip and port, but someone else visited my server
since my friend was not able to access my server. I got a foreign
ip accessed my server.
\_ obUsePGP!
\_ obUsePGP! If you send messages in the clear anyone can read them.
\_ PGP is useless until it is made more transparent. Even the people
who invented it have agreed on this. The existing tools are simply
too difficult to use and even people with clue end up sending
clear text or gibberish by accident half the time.
\_ The 'people'? Perhaps you mean the person, namely Phil
Zimmerman? And what you've just suggested does not sound
very much like the sort of thing Phil Zimmerman would say.
Could you post a citation so we know you're not talking out of
your ass here? If you are just talking out of your ass, could
you make a point of sticking your head up your ass before
doing this in the future so we don't have to listen to your
blather? Thanks.
\_ <Sigh> The most notable "blather" is Whitten & Tygar (1999).
cited in the GNU privacy handbook, chapter 5.
cited in the GNU privacy handbook, chapter 5. You are, of
course, correct that it does not very much sound like
something Phil Zimmerman would say.
\_ What makes you think it's not a problem on your friend's end?
\_ it may be possible too since the company uses MS Exchange and
Outlook, but they are very good at patching up the security
holes. =D Have you ever had nimda.a/e on you machine? if you
see httpodbc.dll in all your root drives, your machine is
infected with nimda.e. Most likely a hacker has already placed
a backdoor in your computer...
\_ More likely you were just port scanned.
\_ but he wouldn't know the exact path of the file to call even he
finds out that port is open. I had NAT forward that port to my
my server. And the web app is under a specific context-root, also
the file is has a unique url mapping. I see the visitor access
that exact path right after my email went out (well a few minutes
later).
\_ Foreign eh? Which country?
\_ foreign=alien=non-local
\_ You really should email root about this.
\_ Ya, that way root will be more careful about reading ppl's email.
Seriously though, what are the odds of someone having the
patience to go through and read your email? Did you look in your
apache logs to see what IP it was that looked up your site?
\_ Don't knock the propensity of individuals to do what normal
people like you and I would consider a complete lack of a
life for intrusive purposes. Security through obscurity
or even anonymity is not a good idea. -John
\_ last time I checked the IP belonged to http://prophetfinance.com, I
took a look at it subnet ips, they tranlated to greet, pride,
lust, stalin, roosevelt, churchill, etc <DEAD>.prophetfinance.com<DEAD>. It
is probably managed by some Russian sys-admin since he seems to
name the servers with Russian leaders.
\_ Churchill and greet are my favorite Russian leaders!
\_ Okay, machines with people names are name of Russsian
leaders. Damn, always some block head nit-picking posts while
totally ignoring the main point
\_ if you use a completely specious argument to back up your
contention that it's a Russian sysadmin and you get called
on it, I don't think it qualifies as nit-picking
\_ What is your site anyway?
\_ just some stuff to test my web configuration. |
| 2003/2/24-25 [Computer/Domains, Computer/SW/Security] UID:27509 Activity:very high |
2/24 Okay, I know this type of question has been asked before, but
here goes. I'm currently using http://domaindirect.com for my
registrar--they also handle my email (1 pop account + 5
forwarding addresses + catch-all). The problem is that they
only provide www forwarding (with perhaps "url keeper" which
wraps the page in a frame and it still looks like the domain,
but is a pretty cheesy technique). Anyway, I'd like to move to
a hosting service that allows me to keep the same (or better)
email services, and do either web hosting or aliasing to (say)
a http://dyndns.org site. domaindirect costs about $35/yr. and I'd
like it to be cheap, but I'm willing to pay more for better
service if necessary. Suggestions?
\_ DynDNS
\_ Um, did you notice that I mentioned dyndns? Do they handle
hosting? Do they handle email redirects? Do I have to run my own
mail server? Everything I checked about dyndns shows that it's a
partial solution, not a complete one.
\_ Um, did you notice that I mentioned dyndns? Do they
handle hosting? Do they handle email redirects? Do I
have to run my own mail server? Everything I checked
about dyndns shows that it's a partial solution, not a
complete one.
\_ http://gandi.net is cheap. They won't do hosting but they'll handle
mail forwarding and aliasing. the downside is they are in
Europe and you'll get all your e-mail in French (and English).
\_ I have had 5 domains with gandi for > 3 years now. They are
great, their service is fast, their TOS are unambiguous.
Regarding the DNS, you can do it with the public DNS service.
Look at http://soa.granitecanyon.com -- I found it very
difficult to get working, though, but it does work. And it's
free. -John |
| 2003/2/24 [Computer/SW/Security, Computer/SW/Unix] UID:27506 Activity:high |
2/24 http://csua.org/u/9db -finally they arrest the strike leaders. I wonder if that means oil will finally drop; the strike is 30% of the reason oil's been going up. \_ Yeah, I guess if getting rid of a corrupt political leader interferes with your getting a cheap tankful of gas by jailing a few brave souls, then god speed to ya'. \_ Gosh, in that case, would you like to join the general strike to remove a corrupt politician who gained his position through unconstitutional manipulation of a a corrupt electoral system? At the least, you wouldn't mind if we shut down the economy for a few days to do so, right? \_ if the people of the United States had enough savvy and guts to do just that I'd help in any way I could. \_ Yawn. Your own media spent months trying to prove your assertion and failed. Go back to alt.conspiracy. |
| 2003/2/21 [Computer/SW/Security, Transportation/PublicTransit] UID:27485 Activity:nil |
2/21 http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2003/02/21/MN240732.DTL Crowd counting article restored, you censoring bastard. |
| 2003/2/14-15 [Computer/Rants, Computer/SW/Security] UID:27415 Activity:moderate |
2/14 What is a good internet phone card for calling China? Thanks.
\_ I usually use http://www.cybercalling.com I don't know how it
compares to others. Is 3.3 cent good price for calling
compares to others. I thought it has good prices for China,
Taiwan, and even US. Is 3.3 cent good price for calling
within the US?
\_ http://www.pincity.com : 4.9 cents (using local access #)
http://www.onesuite.com : 3.9 cents (using local acesss #) |
| 2003/2/13-14 [Computer/SW/Security] UID:27400 Activity:low |
2/13 Looking for <DEAD>anonymizer.com<DEAD> like websites that are free. Thanks. \_ like water for chocolate. \_ get a colo somewhere and run squid on it. set up the acls so you and your friends can access it by others can't. Enable https to http proxying and you've got all of the features of anonymizer for next to nothing. |
| 2003/2/12-7/5 [Computer/SW/Security] UID:27380 Activity:moderate |
2/11 At what point (in the course of my login) does DISPLAY get set,
and what does it get set to? I'm able to open X windows locally
(using Exceed) from soda, but not from another box I have access
to. On this other box, DISPLAY is not set and I'm trying to
figure how to set it. Thanks.
\_ Depends on the OS & login method.
\_ please expound or provide a link? the offending box is
running red hat, and I'm logging in over ssh.
\_ The remote system's sshd should be setting it. Make sure
that X forwarding is enabled on the remote system and on
your local system (try using ssh -v and looking for the
"X11 forwarding" lines); you might also want to make sure
your dotfiles aren't resetting your DISPLAY variable to
something wrong.
\_ Can you figure out your local machine's IP address and then manually
do "setenv DISPLAY local-IP-addr:0.0" after logging in to the other
box?
\_ Try ssh -X
\_ ssh -x |
| 2003/2/7-8 [Computer/Domains, Computer/SW/Security] UID:27337 Activity:nil |
2/6 Anybody have experience with http://pair.com for web hosting? Any other recommendations for quality, affordable web hosting? What about hooking up my own computer to a fat pipe somewhere? \_ my friends like http://pair.com. i like <DEAD>zapatec.com<DEAD> |
| 2003/2/7-8 [Recreation/Dating, Computer/SW/Security] UID:27330 Activity:high |
2/6 What's the best remote flower delivery service?
\_ Calling a florist in the remote area and being very exact in
what you want (or give them free rein to create).
\_ Don't use FTD or other large service. I agree with the first
reply. --aaron
\_ Except a lot of florists are part of the FTD network.
And they will deliver FTD's standard arrangements. Ask
them if they are a FTD member before you order.
\_ What's wrong with FTD? -florally clueless
\_ http://FTD.com was the first commercial launch of a Java website
\_ and then?
\_ Fuck Valentine's Day. Fuck it right in the ear.
\_ BDG? Is that you??
\_ this sounds more like doesn't-work-with-cable-modem
guy (DWWCMG)
\_ What?
\_ ERROR: EAR HOLE TOO SMALL.
\_ ~payam/squick.vt
\_ If recipient is in SF, I've always gone with http://frenchtulip.com
\_ I love Rose and Radish in SF myself, 415-864-4988. --chris
\_ Is that a hint?
\_ /usr/sbin/in.rflowersd
\_ I hope that you are ordering flowers for your ex-wife's
funeral. If you are ordering flowers for your girlfriend,
DON'T. You might think that you are being nice, caring,
considerate, etc. but in reality you are being drawn into
a bottomless pit of despair. You cannot imagine the endless
nightmare that your life will become if you allow yourself
to be drawn any further into this woman's web. If you do
not heed my advice the day will come when you will wish
that you had tied a noose around your neck rather than a
bow-tie.
\_ Now that's more like it! bdg #3 fan
\_ bdg, sign your post |
| 2003/2/6-7 [Computer/SW/Languages/C_Cplusplus, Computer/SW/Security] UID:27322 Activity:low |
2/5 I picked up this year's Taxcut and it won't import last year's turbotax
files. I'm gettign idiotic errors where it either wants to treat my
TT file as a TC file and then reports a corrupt file or it looks for
a TC named .T01 file when it's clearly a TT .tax file. I've played
around with filenames and even looked at hex editing the binaries. Is
anyone else trying to do the same thing? Is it working for you?
\_ importing is highly over-rated. Name, address, soc security, etc
can be easily typed in. The only other thing you need to worry
about is carryover capital losses (stock). It's more complicated
if you run a small business and need schedule C. But you probably
don't run a business.
\_ Hmm. Well that sucks. Thanks for the info. |
| 2003/2/4-5 [Computer/SW/Unix, Computer/SW/Security] UID:27305 Activity:high |
2/4 Anyone here use samhain? Any opinions?? (It claims to detect LKMs)
What is your favorite IDS/checksum program?
\_ Isn't that a Danzig song?
\_ snort
\_ don't be cheap, buy a IDS blade that goes into your router or
switch. It offers much higher performance and it's more
manageable.
\- that cant detect something like people doing rlogin -> ssh ->
su and typing root passwd onthe net can it? you can use BRO.
but it sounds like the above person is looking for something
run on the filesystem, like tripwire. i use veracity which
might not be right for you. --psb
\_ I don't use anything at all. SSH2 ports open to world+dog if you
can guess the root password, you get the whole site! Over 5
million active usable credit cards just waiting for the taking!
And the best part is we wouldn't even know you'd broken in and
stolen everything if you weren't an idiot about it. |
| 2003/2/4 [Computer/SW/Security] UID:27299 Activity:nil |
2/3 Soda's very own Nick Weaver makes news again.
http://news.com.com/2100-1001-983197.html?tag=fd_top
\_ So he's a "security expert" now?
\_ Yes he is. |
| 2003/2/1 [Computer/SW/Security, Computer/HW] UID:27266 Activity:moderate |
1/31 I find that http://terraserver.microsoft.com is not detailed enough. And I've been googling for another one. Can't seem to find another free server that provide satellite photos. I used another service before a few years back but can't remember the site anymore. Anybody know? \_ Call your local congressman today, and ask them to approve funding for the Total Information Awareness program. Soon, the server you seek will come into existence. Though your access to it may be on the 'need to know' basis... \_ Yermom won't show up on any civilian quality sat. photos. \_ Unfortunately, yermom does. \_ You're thinking of the military quality army boot sats. \_ No, I'm thinking "Yermom is SO fat ..." \_ her blood type is "crisco" \_ TIA program stillborn. Just another random pentagon concept that went nowhere. |
| 2003/1/21 [Computer/SW/Security] UID:27164 Activity:high |
1/20 Is there any tool on an SGI running IRIX 6.5 to play a .mp3 or .mid
file? I don't have root access. Thanks.
\_ um... build something in your homedir? If you don't have write
access to the sound device, you're just SOL.
\_ Oh, I'm sure there are plenty of tools running IRIX 6.5 |
| 2003/1/20-21 [Computer/SW/Security, Computer/SW/Languages, Computer/SW/Apps] UID:27161 Activity:high |
1/20 I have a pdf file that contains type 3 font. Since it is bitmapped
I can understand why it does not scale nicely, but why does it look
jagged even at 100% on acrobat reader while the print out looks fine?
How can I convert it to type 1 font? The program dvistripp.exe
that google points me to no longer seems to exist. Ok tnx.
\_ does this file have anything to do with ps2pdf? -chialea
\_ Yes typically I have the ps file and convert it to pdf using
ps2pdf or distiller. I don't have access to the original tex
or dvi files, however. --op
ps2pdf or distiller. It seems to be the problem of the ps
file, since many other ps files converts just fine. I don't
have access to the original tex or dvi files, btw. --op
\_ ps2psd does not do the right thing. |
| 2003/1/18 [Computer/SW/Security] UID:27141 Activity:moderate |
1/17 Do any other search engines besides google cache?
\_ I think the question is do any others provide public access to
their caches... I'm sure any reasonable search engine does
caching on some level. |
| 2003/1/9-10 [Computer/SW/Security, Computer/SW/RevisionControl] UID:27040 Activity:very high |
1/9 I need an archive/revision-control system that keep the repository,
which is left a relative public system, encrypted. CVS does not seem
to do that. What is an (free/open-source) alternative?
\_ Do you mean "encrypted on disk" or "requires encrypted
transmission"? CVS does the latter; you need to set CVS_RSH=ssh
and do some more config on the server (there are howtos online).
For the former, maybe a file system that encrypts data to disk?
\_ I mean that the (CVSROOT) repository is encrypted on disk.
I don't need heavy weight encryption. It is to thwart
opportunistic voyeur. -- OP
\_ rot13.
\_ rot26!
\_ chmod 600 your cvsroot |
| 2002/12/30 [Computer/SW/Security] UID:26940 Activity:nil |
12/31 Essential System Administration by Frisch refers to a "wheel group"
as being an added security feature for the assignment of root
privileges. Question: How is this an added security feature when
having the stolen root password allows login as root anyways? The
author also mentions that this feature is not available in Linux, but
used in BSD type OS's.
\_ False assumption. Given a wheel group, you can disallow external
logins by root altogether. This leaves at the very least a username
trail if the source IP is spoofed. |
| 2002/12/24 [Computer/SW/Security, Reference/Military] UID:26898 Activity:nil |
11/22 [stupid airport security thread deleted.]
\_ mandatory firearm safety training for everyone. give every
passenger a gun with rubber bullets. terrorism problem solved.
\_ Sheep |
| 2002/12/20-21 [Computer/SW/Security] UID:26874 Activity:high |
12/20 Is there a way to get SSH to do keepalives (for firewalls/dial-up
sessions with inactivity timeouts?) I currently do ssh -X and send
an xclock over it, but I usually have more than one host open, and
things get a bit cluttered. -John
\_ the inband keepalive is daemon configurable
\_ the inband keepalive is daemon configurable -shac
\_ I just have a script that echoes a character to the screen every 10
minutes. -- yuen
\_ Put "KeepAlive Yes" in /etc/ssh/sshd_config
\_ The line is already there. Guess it doesn't work.
\_ My office fw filters that so I do the same thing yuen does.
\_ KeepAlive actually sends out-of-band so.. it's not what it
seems.. you actually want ClientAliveInterval which sends
inband.. however its ssh2 only and some ssh clients will
barf when they see this packet.. if your client doesnt
barf at it, then it will keep your session alive -shac |
| 2002/12/17-18 [Recreation/Dating, Computer/SW/Security] UID:26831 Activity:insanely high |
12.16 Does anyone here get the economist? my subscription expired two days
ago and i want online access to an article called "Trapeze artists".
if you could post it in /csua/tmp it would be most appreciated
--tia.
\_ So why not resubscribe, rather than steal?
\_ Are you planning to resubscribe?
\_ I just did, and I have the print version of the article, but I
want to forward the article to a friend. Yes, I could scan it
or snail mail him the original, but that's a pain. Or I could
wait a month or two for my new subscription to kick in, but that
is more lame.
\_ Post a url to the article and your friend's email address
\_ So you're asking someone else to commit copyright crimes and then
put their name on it for you?
\_ yes, I am actually. thanks for clarifying the situation
though. prick.
and I will forward it for you.
\_ Thief.
\_ copyright violation is not theft. look up thief and theft in the
dictionary.
\_ Sure it is. You're taking or making use of something that
isn't yours without permission that normally costs money for
access. Take the rest of your argument to slashdot or k5
where you'll find like minded thieves who care.
\_ that's not theft. theft involves taking away. "making use"
of something -- which isn't even a thing, is not theft.
for you to say otherwise is just like my stating you are
a cunt.
\_ Yeah whatever. Take it to slashdot. In the meantime
do you mind if I have sex with your gf? It's not like
my making use of her while you're busy with copyright
violations is denying you your use of her.
\_ This is wrong on so many levels.
\_ Just another victory against copyright violators.
\_ i'm not the OP. i'm just saying it isn't theft.
\_ It only "normally costs money" because of a perversion
enshrined into law. Should breathing air cost money, too?
Would you support such a law, if passed? |
| 2002/12/15-17 [Computer/Companies/Google, Computer/SW/Security] UID:26819 Activity:moderate |
12/13 I was reading somewhere something that implied that google's popularity
algorithm could tell if the link to your site in someone's page was
"hidden." Can someone here confirm: if I have a link to may page on
another page that is either a.) The same color text as background or
b.) a "spacer" image that is a link. Will Google discount that link?
\_ No one knows how google really works. A form of security through
obscurity to protect their pagerank thing.
12/now Hey do ya think we could get the motd any shorter and more boring?
Let's see: 1) a link to chapter 1 of an old book, 2) trivial dns
lookup issue, 3) emacs question with joke answer. Why bother even
having a writable motd if it's going to be stripped of *everything*
worth reading? There's no technical questions/answers, no cool
stuff about, well... *anything*! And it's always worse on the
weekend when there's fewer bored people at work to add new things.
[*laugh* and then the same idiot deletes this whole thing]
\_ If you're so strapped for amusement that you rely on the motd,
I weep for you.
\_ weep away, just stop erasing everything. just because im pathetic
doesn't mean im not right about others stripping the motd.
\_ who knows? what makes these fucking censors tick? why do they
want the motd to become pointless? mysteries we may never know.
\_ Instead of trying to beat the system, why don't you just try to
make your page better and more relevant? How hard do you really
think it is to detect that technique? Can you guess how many
people we have who work on quality full-time to prevent this kind
of thing? --aaron@google
\_ because, 1.) I am starting a new service which competes with
long-existing services, Since I am funding this all myself,
I can not affort to pay SEO's to place "legitimate" links on
their already ranked web sites. 2.) Part of the service i am
offering to clients is that there page will not link back to
my page which in turn links to a bunch of their competitors.
This basically hozes me, since my competition creates sites
that then link back to themselves, racking up points, but i
am not going to be able to do this. Because of this, my site
could very easily be much better and "more relevant" and still
not have as high a score as my competition. -cuek_saja@yahoo.com
\_ If your site is good, people will come, regardless of what
you do. If your site is bad, people will not come,
regardless of what you do. If you are starting to ask these
sorts of questions now you have already lost.
\_ BS. If they can't find the site, they'll never know
whether it's good or not.
\_ Consider: http://www.google.com didn't have to circumvent
google. People found it because it was good. Be
good, don't be evil.
\_ As for your second question, i think the color trick would
be easy to dectect but the image trick would be hard. |
| 2002/12/10 [Computer/SW/Security, Computer/Theory] UID:26779 Activity:high |
12/9 Story on Blum at http://www.nytimes.com/2002/12/10/science/physical/10COMP.html Question - why is Blum "Professor Emeritus" of the CS dept when in fact he was happy enticed from Berkeley and is now ensconced at CMU with a full and productive lab? \_ Hey man, like what a traitor! I can't believe that! I'm just like ya know totally stunned and completely bummed! And like he ya know stole an emerity thingy from us! Man! \_Who said anything about him being a traitor? Just wondering why he has this title, which means "Retired but retaining an honorary title corresponding to that held immediately before retirement" when he's anything but retired. \_ From Webster's Revised Unabridged Dictionary (1913) [web1913]: Emeritus \E*mer"i*tus\, a. [L., having served out his time, p. p. of emerere, emereri, to obtain by service, serve out one's term; e out + merere, mereri, to merit, earn, serve.] Honorably discharged from the performance of public duty on account of age, infirmity, or __long and faithful services__; -- said of an officer of a college or pastor of a church. \_ enticed by his wife, no less. \_ yet another reason why marriage is evil. - bdg fan #3 |
| 2002/12/9 [Computer/SW/Security, Computer/SW/OS/Windows] UID:26754 Activity:high |
12/8 Has anyone been able to get sound working when running DOS 6.22
under VMWare? I want to play old DOS games and having no sound
sucks. thx. --sky
\_ I know there is a windows program that emulates an old sound
blaster so old dos games can use sound, maybe oyu can hunt that
down and use it?
\_ VDMSound? http://ntvdm.cjb.net
\_ sweet. I will try that. thx --sky
\_ It works great! --sky
\_ Maybe http://dosbox.zophar.net Doesn't do protected mode tho.
\_ there are several dos emulators around. Which game?
\_ old DOS adventure games. VDMSound seems to work with
them all. --sky
\_ which ones? (just curious)
\_ space quest, king's quest, monkey island, maniac mansion
\_ for the LucasArts games, you should use ScummVM instead.
http://scummvm.sourceforge.net |
| 2002/11/25-26 [Computer/SW/Security] UID:26630 Activity:high |
11/25 How do I get openssh to work with s/key? I've got skey working and
have passwords, but having trouble making openssh use them.
\_ obGoogle
\_ Google on "skey openssh" gives a million links on
the old ssh vulnerability
\_ Why not just use password-encrypted authorization keys?
\_ ChallengeResponseAuthentication yes
in sshd_config. -geordan (who dares to give actual answers)
\_ what should I then see when I do ssh -v in the
allowed authentications? publickey,password,
keyboard-interactive ?
should I continue to login as user or user:skey ?
do I need to change /etc/passwd or anything else ?
\_ Hm. keyboard-interactive is my guess. I don't
actually remember how to activate S/Key from the
client; I remember that OS X's ssh did it by default.
Why do you want to be using s/key with ssh, anyway?
-geordan
\_ sshing from untrusted machines
Tried this, but still didn't work. Any urls that
are openSSH specific?
\_ http://openssh.org? |
| 2002/11/22 [Politics/Domestic/California, Computer/SW/Security] UID:26597 Activity:nil |
11/20 How can I verify Soda's certificate?
...
\_ No. You can't add self signed certs to your cert store.
\_ yes, you can... the easiest way is if the machine is using
the same cert for https... you can import it simply using
IE... otherwise you need to manuall add import it, but it
can be done.
\_ Does the CSUA have a https site? Still haven't found
the self-signed cert ... -OP
\_ Not all versions of OE/IE support this.
\_ Really? That's dumb. Another reason not to use Lookout(tm)
\_ A self signed cert has no meaning in the PKI
model, since all it says that you vouch that
you are who you claim you are. If you really
want to implement the cert mgmt correctedly
there is no reason to allow such certs into
the cert store.
\_ Point taken. Where can I view this cert, and how was it
generated, for technical curiosity's sake? And does the
CSUA have a cert for https? -OP
\_ http://www.openssl.org has all the goodies
\_ By the way, is self-signed certificate different from
a certificate that was signed by an untrusted CA (say
you have setup a certificate authority within your company
for signing certificates)
\_ self-signed: signed by untrusted (your own) CA
\_ I like the original minty green certs best, but some of the more
orange flavored ones that came later were ok too.
\_ Before being bought out by RSA, Xcert minted their own brand for
a promo ... labeled obviously as: "XCerts"! -OP
\_ Sweet!
\_ Another approach if you really want secure POP is to set up
SSH forwarding on a local port to csua:110, then just set up
Outlook to retrieve email across the SSH (i.e., localhost: 110). |
| 2002/11/17-18 [Computer/SW/Security] UID:26571 Activity:kinda low |
11/17 the last five paragraphs of from this article:
http://www.cnn.com/2002/TRAVEL/11/16/airport.security.ap
__
Ed Karabinus, 56, was a security manager at Shepard Air Force Base
in Texas last winter when he traveled through Dallas-Fort Worth
International Airport and encountered inefficient screeners who
didn't speak English.
He decided to become a screener himself. He took the test, and in
March he was one of 61 people hired as supervisors. Eight months
later, he has been promoted to federal security director, a new
category of federal law enforcement officer, overseeing both Wichita
Falls Municipal Airport in Texas and nearby Lawton Municipal Airport
in Oklahoma.
Federal security directors earn between $108,400 and $150,000 a year.
Karabinus, who now drives a used Mercedes, motivates his screeners
by saying, "Look where I went, guys, in eight months."
--
DAMN, where can I get a job like that?
\_ There are always special people in all sorts of jobs doing really
well. They are the exceptions, not the rule. The typical airport
security jock is making $8.50/hr and will get a COLA in 2 years to
$8.75/hr.
\_ They are federal employees now making more than that. I don't
know how much more, but more than $17k/yr certainly. |
| 2002/11/15-17 [Computer/SW/P2P, Computer/SW/Security] UID:26558 Activity:nil |
11/15 http://journalism.berkeley.edu/projects/biplog Coming soon, a real hostname. -dans |
| 2002/11/14 [Computer/SW/Security, Computer/SW/Unix] UID:26540 Activity:very high |
11/13 back to the question regards to my problem of being f*cked up
by sys admin cuz they changed the UIDs... during the process
changing user ID, is hard-link ever used to accomplished the task?
I read somewhere that if hard-link is not being used carefully,
I may never able to get those files couting against my quota
unless the other person happened to deleted the file. Is that
true?
\_ Please supply host IP address, login name and password
and I'll check it out for you. It's too hard to debug with
so little, random, information.
\_ 198.137.241.41, gwb, bombiraq
\_ Sounds like you need to pay a contractor to go in there and fix
this idiot's mess. While you're at it, fire the stupid bastard
because he's making the rest of us look bad. --real sysadmin
\_ maybe your sysadmin is a BOFH who is persecuting you because you
just can't seem to use english properly.
\_ Napalm the fuckin bastard. -John
\_ thanks to all (except that grammar/spelling nazi, who didn't
really contribute anything useful).
For those who never step out of bay area / berkeley: you
would be suprised that sheer concentration of *GOOD*
system admin here at Cal, and alarming number of those
who are considered as mideocre at best at for the rest of
the world, even in an academic setting (where my account is)
For the rest... thanks for putting up with all sort of mis-
spellings and grammar errors from me.
\_ Actually a lot of the world has some pretty stellar
sysadmins; however, usually they lack a good academic
environment in which to hone their skills and find out about
others doing the same stuff. So they often end up doing crap
jobs tucked away in some company somewhere, underpaid and
underappreciated. I'm enjoy introducing people like that to
others in the field by organizing BOFs and the likes; I'm
always amazed at how little contact some of the good tech guys
have to the rest of the world. And I still say there are
enough decent good root-types to go ahead and napalm the
fuckin bastard. -John
\_ Ever owned a cat, John? Or are you just spouting?
\_ Yes and yes. -!john |
| 2002/11/13-14 [Computer/SW/Security] UID:26535 Activity:moderate |
11/13 http://privacy.yahoo.com/privacy/us/pixels/details.html \_ Your point? \_ I believe (s)he wants us all to click on that opt-out link. \_ bugnosis? |
| 2002/11/6-7 [Computer/SW/Security] UID:26428 Activity:kinda low |
11/5 Which free version of PGP provides a PGPDisk that works in WindowsXP?
I'm considering the International and CTK variants. Is any version
more secure or trustworthy than another?
\_ PGP is pretty good.
\_ HA HA HA HA HA HA HA HA. ha. ha. ugh. --aaron
\_ Screw it. PGP6.5.8ckt_build08 failed to install on XP, and
PGP6.0.2i could not read my PGPDisks made by PGP6.0.2 Desktop
Security in Windows2000. Now my question is: What other pretty
good encryption tools are there that does what PGPDisk does?
-OP
\_ nai actually stopped developing pgpdisk before XP and before their
latest versions of PGP.. and even announced that they would be
killing off pgpdisk entirely.. then sold of pgp to the current
PGP Corp. which says they will have support for XP in v8.0
which is currently in beta. check http://www.pgp.com -shac
\_ Thanks. I'm looking for something _FREE_, and their Freeware
products do not include PGPDisk.
\_ Cheap bastard. Pay for it if you want quality products with
full features. These people have to eat (sushi and Vik's
takeout daily) and pay rent (okay, well, condo association
fees) and buy shoes (and private school tuition and cell
phones) for their kids. |
| 2002/11/5-6 [Computer/SW/Security, Computer/SW/Database] UID:26423 Activity:nil |
11/05 What form of encryption is used for system passwords? Is it
possible to use that same form in mysql? I would like to be able to
take a users encrypted password from sql (which needs to be usable
through mysql) and give them a system account once they have jumped
through additional hurdles. Is this possible? how? URLs appreciated.
\_ ??? What's the project goal?
\_ man crypt |
| 2002/10/22 [Computer/SW/Languages, Computer/Rants, Computer/SW/Security] UID:26275 Activity:high |
10/21 Is there any service that takes email and sends regular mail?
Like bill pay, but with email instead of checks. I should be
able to set up "sendees" and they could print and send my emails
to them. Then i could correspond with my amish friends!
\_ don't you have a printer, stamps, paper, and envelopes?
\_ I'm VERY LAZY and am willing to pay someone else to
specialize in that and get the economies of scale.
\_ http://www.usps.com/mailingonline
\_ cool, thanks. |
| 2002/10/17-18 [Computer/SW/Unix, Computer/SW/Security] UID:26234 Activity:insanely high |
10/17 Is there a really easy way to forward all port 80 packets to another
machine? I want to migrate my web (but not mail/smtp/etc) packets to
a new machine. I don't want any sort of HTTP redirects because I want
the transition to be "seemless". Does my question even make sense?
\_ seamless
\_ Any firewall software can do this. Or you can point the DNS
name at your new web server and use MX'es to keep the mail on
the existing server. Or use mod_rewrite. -tom
\- writing a generic "port forwarder" to listen on localhost:tcp/###
and fwd that to A.B.C.D:### is pretty straght forward programming
exercise. in fact it is possible ssh can do it for you. i have a
tool i suppose i can send you which forwarded the pop protocol
but it should work for WEEB by just changing the port number.
[all WEEB is tcp, right?]. i seem to remember after looking at a
breakin there was some crackerware to do this too. --psb
\ are you calling nc "crackerware"?
\_ This is what I was going to do. Either this or just use ssh to
do the forwarding until I complete the migration.
do the forwarding until I complete the migration. But I was
hoping that someone had already written something (or gotten
netcat to work as such) so that I don't reinvent the wheel...
and don't have to worry about implementing error handling and
so forth.
\_ DNS! Why does no one use DNS for this stuff? The world wasn't
meant to be hard coded IPs. They made DNS for a reason. You don't
need clunky firewall kludges if you made proper use of DNS. You
wannabe sysadmins are getting more dangerous by the day. Please
tell me this isn't a commercial site.
\_ because dns wont forward port 80 packets. DNS will send all
packets to that hostname elsewhere. This is why a smart admin
will point several names at the same host, each name for each
service on the host, and then they can move the ip in the name
for that service without affecting the other services. I.e.
csua www service is 'www.csua', not 'soda.csua' (even those two
names point to the same IP), so we can move www service if
necessary without screwing other services.
If you weren't so smart, firewall-NAT /packet forwarding/
is your only option. -ERic
\_ Thank you for the description of "proper use of DNS" as
mentioned above. Anyone who doesn't know that DNS doesn't
forward packets needs to give up the root shell.
\_ DNS switches are not "seemless". Even if you have your TTL set
properly, there is a whole world of improperly set up DNS servers
(and microsoft DNS clients that mad-cache) that will not get up-
dated the instant you want them to. (Of course, just leaving the
service up at site 1 for a while is probably better than port
forwarding everything with good ol' nc -The SysAdmin.
\_ Gosh, you mean you actually figured out how to do a seamless
service migration with DNS? Wow. That was hard, huh?
\_ 1) You are a dumbass, as everyone else already pointed.
2) Even if what you said were correct (which it isn't), have you
considered the possibility that some people might be hard-
coding the IP's?
\_ 1) No one said any such thing. Learn to read.
2) It's correct and anyone who hard coded the IP's is a total
moron at step zero and shouldn't have root which was
already addressed earlier. If you could read, you'd have
read that, too.
3) Learn to read. Thanks.
\_ [ inane baiting deleted. ]
\_ OP here. Here's my solution:
www stream tcp nowait nobody /usr/local/bin/nc nc my.remote.host 80
im reposting my solution for the third time:
tcpserver 0 80 nc ncc 80 |
| 2002/10/15-16 [Computer/SW/Security] UID:26195 Activity:kinda low |
10/15 FYI OpenSSH 3.5 is out.
\_ Interesting. Is there a ChangeLog somewhere that summarizes
the changes in this release. In particular, I am wondering
if PAM and auditing problems have been fixed in Solaris
when privilege separation is enabled.
\_ ftp://ftp.ca.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog |
| 2002/10/15-16 [Computer/SW/Security] UID:26191 Activity:high |
10/15 I don't have a long dist carrier. I usually use 10-10-321, 811, 220,
etc. What's a good plan to use?
\_ http://www.onesuite.com Cheap, no hassles, portable.
\_ http://www.onesuite.com/faqs.htm#G13 , you can get 20 free
minuts (hey that's like 60 cents)!
but why don't they just bill the telephone like others?
\_ onesuite is actually a calling card which you can access
through a 1-800 number or local numbers. it is not a traditioal
long distance carrier. |
| 2002/10/15 [Computer/Rants, Computer/SW/Security] UID:26185 Activity:very high |
10/14 Why all the H1B posts? Our jobs, esp support and QA are already being
exported to countries like India and China. There was a report from
60 Minutes that says a few phone companies already shifted their
phone support ops to India. They even train the workers to be
knowledgeable about the American culture (football, beer, etc).
Face it, many jobs are indeed exportable. IT is just a glorified
auto/steel/whatever industry.
\_ You're a Cal grad and doing phone support and QA? Jesus F. Christ!
Did you graduate with a degree in English or something?
\_ I thought Jesus' middle initial was 'H'.
\_ You don't know what the 'F' is for?
\_ Agreed, IT = auto = steel = dockworkers. However, since most
motd readers are sys admins, they confuse themselves with
real software engineers and architects. We're not worried
about H1B workers.
\_ uh, it's the software development that can be easily exported,
not the sysadmin work. Think autoworker vs. policeman. -tom
\_ *laugh* As a sysadmin, the last thing I'm worried about is my
job getting exported to another country. No sysadmin confuses
what they do with what a coder monkey does. When a coder monkey
fucks up, you get a bug which gets caught by QA (in India). When
a sysadmin fucks up, the whole shop goes down. No one is going
to ship their servers to India. Silly troll, cookies are for
kids!
\_ Recently had trouble with an http://amazon.com order. Emailed them
(the only way to reach them) and all I got were replies
from folks with Indian-looking names. All replies either
had good english or good scripts or both. I suspect
amazon support may be outsourced?
\_ I have never gotten good customer service of any kind from
an Asian-outsourced helpdesk. In fact, this is the main reason
why I refuse to buy anything from http://Amazon.com anymore.
My experience with US helpdesk workers is mixed, although mainly
positive (unless you're dealing with a fucked up company like Sony.
The only consistently good tech support I've gotten was from Irish
call centers (most European tech firms redirect English-language
calls there.) -John
\_ Was on the phone with a Netapp chick in Singapore last night.
She didn't fix my problem but had a sexy voice so I still logged
the call as a "10" in their customer service records.
\_ I have never gotten good customer service of any kind
through the phone, period. Almost.
\_ B&H over the phone seems okay.
\_ Exporting software jobs is the best thing that ever happened to
the software industry. Perhaps now, we will realize that many
engineering positions are filled by glorified, semi-skilled
typists (software). Let's face it- software systems are LARGE
nowadays- but innovation is the crux of value, not WPM. Stop
complaining about your obsolete job. Coding is a monkey task
that should be outsourced, not protected by some archaic notion
of an ivory tower of academia.
\_ Which is why I would recommend moving up to a more architectural
or managerial level, to avoid your job being 'exported'. I agree,
coding, not only a 'monkey task' as the above posted noted, is
often considered a thankless job. Don't shoot the messenger, this
is what I heard.
\_ Put it this way. Number of engineers produced per year in US:
65000, in China 700000, and their quality is improving.
\_ This is exactly the kind of reasoning upper management uses to
justify H1b's shortly before they get a http://fuckedcompany.com entry.
Because if 1 american engineer can do it in X days, then 10 H1b
engineers can do it in X/10 days. Right? Good math. |
| 2002/9/28 [Computer/SW/Security, Computer/SW/Unix] UID:26038 Activity:nil |
9/28 I installed mysql 3.23.52_1 via pkg_add and I'm trying to set the
root password-- but I don't know the default password. This is a
fresh installation, and I'm using
% /usr/local/bin/mysqladmin -u root password 'blah'
/usr/local/bin/mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user: 'root@localhost' (Using password: NO)'
% /usr/local/bin/mysqladmin -u root -p password 'blah'
Also fails, because I don't know the stinking password. I've tried
the system's root password, "root", "toor", and various foul
language. |
| 2002/9/13 [Computer/SW/Security] UID:25874 Activity:kinda low |
9/12 Has anyone else noticed that their ssh session tends to die as
soon as they get notified of new mail?
\_ never happens to me.
\_ Mine is kindof twisted. If I have newmail running in the backgrnd
I cannot seem to log out of my ssh session cleanly (it just hangs
after the logout). But if I kill the newmail process prior to
logging out, it works fine. (this is on a Debian Linux). Clues?
\_ just a guess -- does newmail open an X connection?
\_ try ssh -v when making connections. without debugging info you
don't stand a chance. |
| 2002/9/12 [Computer/SW/Security] UID:25859 Activity:nil |
9/11 I hate people who block ping requests, it is so annoying and of so
little (in fact i'd go as far as to say NO) security value.
\_ some people just block all icmp.. for valid security reasons -shac |
| 2002/9/11-12 [Computer/SW/Security, Computer/SW/Unix] UID:25851 Activity:low |
9/11 Is it commonly accepted to use rsync between two machines using a
null passphrase? I haven't found any good workaround. The next best
thing would be to type the key once per reboot, but that is
inconvenient and the key stays in memory. So... after a few days of
googling, root+null passphrase is the best I could come up with.
\_ If it's a low security site, you can do the null passprase to a
junk account and then have cron or whatever copy/move the files
out. jailed shells and what-not are easy enough to setup without
jumping through too many flaming hoops. Are these both internal
machines? Maybe NFS is the answer?
\_ Install ssh, rsync over ssh instead of rsh and use a passkey. |
| 2002/9/9 [Computer/SW/Security] UID:25820 Activity:high |
9/8 Is @cal forwarding down again all day? What the hell? It's an
embarrassment to Berkeley! Shit I should've never trusted them
in the first place!! My ISP is far more reliable! They suck
you in with a permanent email forwarding address and then the
service goes down for days. Bunch of idiots!!!
\_ Is there a number we can call about the service?
\_ This gives Cal a bad name, just like the programming contest
and Cal Football.
\_ We've won our past three games against 5th tier teams!
\_ I think it may have come back up. |
| 2002/9/4-5 [Academia/Berkeley/CSUA, Computer/SW/Security] UID:25767 Activity:very high |
9/3 I'd like to donate equipments (eg 160G HD) so that I can influence
politburo members into giving me root access. How do I go about
doing that? P.S. I'm an alumni
\_ alumnus (possibly alumna) or alum
\_ are you female? I think most of them are tired of making love
to mr.hand
\_ rosie Palm and her five sisters are h07!
\_ The Palm SEXtet (pun intended) will make you blind!
\_ You mean *Miss* Hand? Or are they gay?
\_ No, you're just 100% clueless.
\_ mail politburo. ask. -chialea
\_ chialea! I want to kiss you! :-)
\_ are you an eastcoast or westcoast stalker of hers? !fan
\_ you're freaky
\_ No, they're dreamy! --chialea #1 fan #1 fan
\_ a.k.a. chialea
\_ Incorrect.
--chialea #1 fan #1 fan
\_ you're going about it the wrong way. you need to bribe a single
root person, not the whole politburo. you don't want official
access, just access. social hacking.
\_ is that how paolo got root?
\_ Speaking of bribing, have the recent politburo requested
alumni support yet for this year?
\_ still not getting it. you dont support politburo for root,
you buy some kid a few beers. sheesh. must i spell out
*everything* for you?
\_ Not looking for root, just wondering about funding.
\_ maybe they can request funding for a SCSI RAID card.
\_ if you're cute, you screw for root.
\_ The secretary?
\_ Good things I'm not sexy@csua anymore -chialea
\_ Get real. Sleep with csua root users instead of popping
5 bucks for cheap beer? Son, not all sex is good sex.
You should go for the beer option. |
| 2002/8/29-30 [Computer/SW/Security] UID:25734 Activity:high |
8/29 Do you guys have a different password for every single account you
own -- email, website, server, bank, etc?
\_ Yes.
\_ I have tiers of security-- like very secure, medium, and not at all
secure. Usually as I retire my very secure passwords, I move them
down to the lower tiers... except for the lowest level, which is
almost always just based on my name or something.
\_ I do this too. I wonder how commmon it is.
\_ How do you remember all the passwords? I have like 10 passwords
for maybe 30 accounts. I can never remember which to use for
what, except for the accounts I use daily.
\_ I use the same password for all my accounts, home, work, root,
hotmail, http://yermom.com pr0n sites, my secret password with Visa, my
home security company, everything.
\_ Have you been to http://yermom.com? What a fucking stupid website! |
| 2002/8/29-30 [Computer/SW/Security] UID:25732 Activity:high |
8/29 Has anyone tried DMA? Does it really work? I'm afraid to use it for
the same reason why I don't click on "unsubscribe me" from spams.
\_ Yes it works. Both for mail and phone-based junk. It works best if
you also request that the credit agencies not release your info as
well and you foregoe mail forwarding when you move.
\_ Those work very well for me, together with calling up companies
to cancel junk catalogs under whoever's names and my address.
--yuen
\_ Direct memory access? I love it. Great stuff. Works great and
less filling at the same time! Better than rogaine
\_ No but I've tried MDA. Is DMA some other analogue?
\_ Direct Marketing Association, Inc. http://www.the-dma.org
The posters are talking about DMA's Mail Preference Service which
helps you stop junk mail.
helps you stop junk mail. Saves time and trees. |
| 2002/8/29-30 [Computer/SW/Security] UID:25731 Activity:low |
8/29 Is there a website that tells you the elevation above sea-level
of all the cities in the US (at least the major ones)?
\_ No. I have encrypted all of my copywritted material
using an encryption algorithm based on US city elevation data,
and releasing it now would be in violation of the DMCA.
If you try to download that information from the web, I'll
DOS your server. -GIAA
\_ Uh, Yeah, the first link from the google query:
"us major cities elevation above sea level" -googled |
| 2002/8/27 [Computer/SW/Security, Computer/SW/Unix] UID:25705 Activity:high |
8/27 Is there a CSUA policy about deleting accounts of those who have died?
Or is it a respect sort of thing to keep the account for the deceased?
\_ There are deceased?
\_ gene kan
\_ What happened to him?
\_ He Cobained.
\_ gene can do what?
\_ was he active CSUA?
\_ How about deleting accounts for those who have been inactive for a
long time?
\_ and... why?
\_ To reclaim disk space? Free up login names and UIDs? Reduce
chance of break-ins since those people won't be changing
their passwords periodically?
\_ As if people who never really used their accounts are using
a lot of disk, someone else wants their name, we're near
out of UIDs or more than 1% of you slack bastards has
changed your password in the last 6 years....
\_ reclaim unused uids? Doesn't the account creator just
add a new uid after the highest used one? Are we even
anywhere near starvation for uids?
types.h lists the uid as:
typedef u_int32_t uid_t;
So thats what, 4 billion possibilities? I see only 2400
or so passwd entries. Try another excuse to delete
unused accounts...
To reduce chance of break-ins? I'd argue to delete the
active accounts -- theyre the ones most likely to have
their password leaked ( via social engineering , trojaned
software, or other means) or shared on another
site.
\_ ok genius so then why should the accts not
be deleted?
\_ The burden of proof is on those who desire
change in a functional environment. They should
not be deleted because there is no reason to and
it would waste someone's time to do so. Why
*should* any accounts be deleted?
\_ How come at line 2437 in /etc/passwd the UID goes up to
10958, but then at line 2438 it starts from 1003 again?
\_ I saw that old login names like achoi or choice no
longer exist.
\_ achoi/choice is now android. -geordan
\_ So any future Albert Choi or Ah-Ching Hoi can
re-use the login achoi.
\_ *hint* |
| 2002/8/26-27 [Computer/SW/Security, Computer/SW/OS/Windows] UID:25694 Activity:high |
8/26 After I save a file in win95, I need to process it from DOS prompt
(to use with sftp for putty for example). I find the file name to be
"currupted" - it's shorter and contains strange characters like "~".
I know this must be a feature from MS but how to get around it and
access the file from DOS using the real file name?
\_ try using cygwin
\_ the win95 shell displays that because it's DOS and DOS doesn't
do more than 8.1 filenames. Just use those shorter names
(i believe they show up correctly in windows), use the long name
with quotes around it (i think that works) or better yet
upgrade to win 2000.
\_ if you use the short file name with scp, you'll lose the long file
name on the other side. you need to double quote the LFN to do
what you're talking about. or as the above say use cygwin or w2k.
\_ By "DOS prompt", do you mean the DOS window in Win95, restarting
Win95 in DOS mode, or plain MS-DOS 6.xx?
\_ Enclose your long/full name with double quotes.
\_ Use double quotes.
\_ I think double quotes will do the trick. |
| 2002/8/26 [Computer/SW/Security] UID:25689 Activity:moderate |
8/26 Any recommendations for web hosting services with good latency from
campus? Looking for cheap service to host low traffic www site.
\_ Low latency? You're playing quake from your campus office? |
| 2002/8/20-21 [Computer/SW/Mail, Computer/SW/Security] UID:25623 Activity:very high |
8/20 using gpg i want to associate someones public_key with a wildly
different alias that they also use to mail me encrypted text.
I skimmed the long man-page but didn't find it.
\_ you really think the nsa cant read your text in real time? get
real. they can spot the gpg signature and flag your packets to
make certain a human reads the messages. sheesh. dont you know
the best way to hide is in plain sight where your traffic looks like
everyone else's and only the computers will read (and ignore) it?
\_ (!OP): I don't care about the NSA. I care about business
competitors, 1337 haxors, and the like.
\_ w3 @1r3d33 0wNz y00.
\_ (TOP) o.k. i love to ecourage trolls..
1) I'm trading commercial "secrets" not military ones so I
don't much care if some cypher-wonk in the basement of
the pentagon reads my mail.
2) By encrypting traffic "they"re not interested in i'm making
their job harder, if only a little, which makes me happy.
\_ What mail client do you use to (en|de)crypt mail w/ gpg?
\_ mutt
\_ pine. (flame away)
\_ So you trust foreign governments such as the French who are
known to engage in industrial espionage for their
corporations not to steal your data and hand it over to
your competitors? So much to learn, so little time.... |
| 2002/8/19 [Computer/SW/Security, Computer/SW/Unix] UID:25608 Activity:nil |
8/19 http://www.kuro5hin.org/story/2002/8/19/2952/21932 - php gui sucks. \_ gui's are bad. |
| 2002/8/15 [Computer/SW/Security] UID:25563 Activity:very high |
8/15 I am familar with SSH1 but just put SSH2 on my computer.
With SSH1, I know I put the contents of his identity.pub file in my
authorized_keys file. With SSH2, what is the analogous procedure?
Do I do something with the snippet that begins
"---- BEGIN SSH2 PUBLIC KEY ----" which he sent me? Where do I
put that on my server? Thanks!
\_ It depends on what kind of keys you use (SSH1 or SSH2 keys),
what client do you use, and whether the server is running
openssh or commercial sshd. In case of soda, you have to upload
your public key to your account, convert it to the format the openssh
understands using ssh-keygen command and then append it to your
.ssh/authorized_keys2 file.
\_ I think I need to add something in the .ssh2 directory.
I am running with "SSH-1.99-2.4.0 SSH Secure Shell".
\_ yes, consult the ssh2 man page
\_ place the public key (the entire file from '---- BEGIN...'
to '---- END SSH2 PUBLIC KEY ----' in a file under .ssh2
then create a .ssh2/authorization file containing the
line 'Key pubkeyfilename' (where pubkeyfilename is the
name of the public key file you just created) - max |
| 2002/8/8 [Computer/Domains, Computer/SW/Security] UID:25524 Activity:high |
8/8 If I use <DEAD>foo.bar.com<DEAD> in a root .rhosts file, can someone who controls DNS server in his own domain set up one of his addresses to reverse to <DEAD>foo.bar.com<DEAD> and get into my machine? \_ If you're using rsh? Probably. ssh, if you have it configured to, will check to see if the remote machine's host key is correct. \_ Yes I know this wont work for ssh. I think with rsh the only trick is to get him to look at your DNS server. If you can do that, I think it will work. |
| 2002/8/1-2 [Computer/SW/Security] UID:25470 Activity:high |
8/1 Bugtraq reports that openssh-3.4p1 was trojanned on http://ftp.openbsd.org, and its mirrors. \_ Link? And Is that what happened to csua? \_ http://online.securityfocus.com/archive/1/285492/2002-07-29/2002-08-04/0 \_ Don't think so. That seems to have affected the openssh-portable port. \_ which... soda runs... \_ dont bring facts into this. this is the motd, damn it! \_ It's okay, they didn't. \_ no it doesn't: $ telnet soda 22 Trying 128.32.112.233... Connected to http://soda.CSUA.Berkeley.EDU. Escape character is '^]'. SSH-1.99-OpenSSH_3.4 \_ genius wtf do you think that is? If it isn't an openbsd machine and it's running openssh, it's the portable one \_ I believe the FreeBSD uses the non-portable openssh too, perhaps with their own patches. If FreeBSD was using portable openssh, you'd see a version string that looks like this: SSH-1.99-OpenSSH_3.4p1 \_ Hi. You're an idiot. \_ Recent FreeBSD base system uses 3.4p1. There are also two ports: security/openssh and security/openssh-portable, which are a patched OpenBSD version and the portable version, respectively. Soda is running the former, AFAIK. --dbushong \_ The only installed openssh port I see is: /var/db/pkg/openssh-3.4_4 \_ What's the bottom line? Is soda's current version compromised? \_ I don't think so. Plus, the compromise is just a side effect of the build, and (supposedly) should not affect the built executables. \_ No. The MD5 on the src tar ball in /usr/ports/distfiles matches the correct MD5: MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2 soda$ cd /usr/ports/distfiles/ && md5 openssh-3.4.tgz MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2 \_ Here is what I've heard from a reliable source: (sorry, no url) "If you didn't rebuild OpenSSH from scratch in the past 36 hours you don't have to worry about it and the trojaned code was replaced with a clean copy by 6am PDT. The trojan was that someone added a line to a Makefile such that during compilation, a socket is opened to a hacked machine once an hour to await "commands" (or example, open a shell, or die). The OpenSSH code base wasn't touched. The hacked machine was wiped early early this AM. I haven't heard anything about whether the SunOS 4.1.X FTP server (the OpenSSH project hosts there because the people who offered to host it there have lots of bandwidth) was hacked, or if this was some kind of inside job from someone who had appropriate levels of access on that host. Like you doctor always said, check your md5 checksums and your PGP sigs. The FreeBSD "ports" system does that automatically and refused to build and install the tainted coded." |
| 2002/7/29 [Computer/SW/Security] UID:25436 Activity:nil |
7/29 Can some one tell us some definitive info about what's going on
with pop? it hasn't worked since the ip change. Do I need to
change port number?
\_ The sort-of official, and thoroughly unannounced answer is that
clear-text POP/IMAP has been disabled since the recent compromise.
You can only use SSL enabled POP/IMAP clients. Hopefully we will
soon have localhost clear-text service available for those who
prefer to ssh tunnel instead of trying to find an SSL enabled
mail client --scotsman
\_ okay, what settings do I use for POP3 over SSL? port 995?
\_ Y'know. looking at things, I don't see POP3s enabled..
I'd have to say mail root. --scotsman
\_ wasn't this always the case? I was never able to use POP w/
clear-text password remotely and have been ssh tunneling for
about the last year. - rory
\_ On a somewhat related note, is telnet / skey going to be
reenabled, or is it permanently disabled? |
| 2002/7/25 [Computer/SW/Unix, Computer/SW/Security] UID:25422 Activity:insanely high |
7/25 Just curious. How come 'last' shows the date went backwards? thx.
mikeh ttyA7 128.32.112.194 Thu Jul 25 01:09 - 01:11 (00:01)
root ttyv1 Thu Jul 25 01:08 - 01:09 (00:00)
root ttyv0 Thu Jul 25 01:07 - 01:08 (00:01)
emarkp ttyv3 Wed Jul 24 23:36 - 23:36 (00:00)
mehlhaff ttyA4 63.201.156.21 Wed Jul 24 23:30 still logged in
root ttyv2 Wed Jul 24 23:24 - 23:46 (00:22)
root ttyv1 Wed Jul 24 22:51 - 23:46 (00:54)
mikeh ttyv0 Wed Jul 24 22:50 - 23:47 (00:56)
reboot ~ Wed Jul 24 22:50
shutdown ~ Wed Jul 24 22:44
root ttyA1 10.32.43.51 Wed Jul 24 22:17 - shutdown (00:26)
mikeh ttyA1 10.32.43.51 Thu Jul 25 03:54 - 22:17 (18:23)
jon ttyA3 10.32.43.51 Thu Jul 25 03:07 - 03:08 (00:00)
root ttyA4 10.32.43.51 Thu Jul 25 03:00 - shutdown (19:43)
root ttyA1 10.32.43.51 Thu Jul 25 02:44 - 03:54 (01:10)
mikeh ttyA1 10.32.43.51 Thu Jul 25 02:44 - 02:44 (00:00)
root ttyA0 10.32.43.51 Thu Jul 25 01:45 - shutdown (20:59)
reboot ~ Thu Jul 25 01:35
\_ that's why it's called 'last'. it shows from most to least recent
who has logged in.
\_ so you saying july 24 is more recent than july 25? |
| 2002/7/25-26 [Computer/SW/Security] UID:25416 Activity:moderate |
7/25 Is there any ETA of a full report about the compromise? For
instance-- how long ago did the hack take place? Where did it
originate? How was it discovered? Was ssh-keygen hacked? Do we
need to replace our keys? Are we supposed to change ALL of our
passwords, or just ones that we used in the past X days?
\_ Also, what _isn't_ known about the hack?
\_ we believe that nweaver was responsible. --h@x0r
\_ Are we going to ask for the death penalty?
\_ Can't hurt to change your passwords and ssh keys anyhow... |
| 2002/7/25-2003/1/5 [Computer/SW/Security] UID:25415 Activity:nil |
07/25 Yes, soda's ssh, sshd, and sudo were compromised. Changing all
of your passwords is advised. Services that are down now will
come up in due time. --ajani |
| 2002/7/25 [Computer/SW/Security, Academia/Berkeley/CSUA/Troll] UID:25414 Activity:high |
7/25 Anybody know what's happening with alumni.eecs? Can't seem to ssh in.
\_ Last I herd they were having problems with secure shell.
\_ Sounds like they got 0wnz0red
\_ well, they told me because csua's ssh was trojaned, all accts
which have anything to do with soda is disabled. Talk to root
to reactivate it.
\_ csua's ssh was trojaned? when did this happen?
\_ Shoulda used coitus interruptus, but abstinence is
the best choice!
\_ You better be fucking kidding because there's nothing about
this on /etc/motd.official. If soda got owned we have the
right to know about it and root has a responsibility to tell.
I'd like to see official word on motd.official whether this is
true or not. This isn't funny if you're making it up.
\_ What even not funnier is how you're being such
a dick about asking for this information.
\_ Excuse me while I beg for critical security information.
Oh please please please let me know sometime after you
graduate what the fuck was going on. Security isn't a
joke and users shouldn't be left guessing wtf happened
or how much they might be fucked over. And for you
personally, fuck you, you know nothing fool.
\_ And for you personally, if your files and
whatever else are so critically dependent on
soda being completely secure, get your own
machine and connection and maintain it.
\_ Found on http://ucb.org.csua (7/24):
Soda.csua is down because it was compromised. It will
hopefully be fixed tomorrow. Galen
\_ which is unfortunately not very helpful when soda is the
only machine from which one can read ucb.*
\_ Try http://groups.google.com?
\_ how about a secondary webserver on, say, scotch that
gives news and downtime type stuff for soda. new A
record <DEAD>news.csua.berkeley.edu<DEAD>, etc.
\_ If you asked him really nicely, perhaps dbushong would
be willing to do something like this at http://www.csua.org
I'll bet you'd have better chances if you volunteered
to do the coding so that he could just post it.
\_ I know dbushong. dbushong is a good friend of
mine. and you, sir... wait.. what was i saying?
Really. Dave just runs http://csua.org. He doesn't
know or care about the daily goings on of soda.
This is something the politburo can and, i'm going
out on a limb here, should do.
\_ Ok that's a start, how about some info on how long it's
been compromised, what sort of compromise, how badly,
what were the hackers doing, what got installed, etc?
\_ Nice attitude. And how much have you contributed to
this group and its equipment lately? |
| 2002/7/25-26 [Academia/Berkeley/CSUA, Computer/SW/Security, Computer/SW/Unix] UID:25413 Activity:low |
7/25 Thanks to the root types who have been working hard to clean up the
recent mess on soda and in EECS in general. The masses are pleased
to have soda return. --PeterM
\_ Word.
\_ Hmm, is POP and IMAP still down?
\_ All praise the great root types!
\_ No HTTP service either
\_ Your work means a lot to us. Inability to use soda drives me nuts,
especially since I use it for love emails.
\_ specifically much praise is due to mikeh. He put alot of time into
the reinstall and cleaning up of things. 'course everybody put
effort in. |
| 2002/7/16-18 [Computer/SW/Security] UID:25372 Activity:high |
7/16 How do I generate a public key compatible for openssh on an SSH
(commercial) machine? openssh uses single-line keys, while
ssh uses multiline keys.
\_ I got out a text editor and re-arranged the entries to match. It
was lame but it worked.
\_ see openssh ssh-keygen man page
\_ If you're trying to use pre-existing keys and convert them this
won't do it for you but it will generate new ones in either
format.
\_ Yes it will, you apparently haven't read the manpage.
\_ Not in my version which is relatively recent.
-x This option will read a private OpenSSH DSA format file and print
a SSH2-compatible public key to stdout.
-X This option will read a unencrypted SSH2-compatible private (or
public) key file and print an OpenSSH compatible private (or pub-
lic) key to stdout.
\_ Yes and where's the option for ssh1? |
| 2002/7/13 [Computer/SW/Security, Computer/SW/Unix] UID:25347 Activity:moderate |
7/12 Anyone know of a lightweight secure ftp program like secure fx?
Putty PsFtp is *too* lightweight.
\_ try WinSCP
\_ ssh secure shell client for windows, available on http://depot.berkeley.edu
if you can't access http://depot.berkeley.edu, maybe you shouldn't be on
a machine that is supposedly for undergrads.
\_ I wake up every morning and try to fuck up everyone else's
day just a little bit too, cool! |
| 2002/7/6 [Computer/SW/Security] UID:25292 Activity:low |
7/5 What is the purpose of having subkeys in the PGP/GPG encryption
scheme?
\_ for rounds. |
| 2002/7/6-8/9 [Computer/SW/Security] UID:25290 Activity:nil |
07/05 Apache upgraded, bugs to dev-null@soda. In the future if you
see a problem mail root rather than venting on the motd. Yes,
we read bugtraq, as is demonstrated by the fact that security
issues are normally handled quickly. --Galen |
| 11/23 |