Computer SW Security - Berkeley CSUA MOTD
Berkeley CSUA MOTD:Computer:SW:Security:
Results 451 - 600 of 1108   < 1 2 3 4 5 6 7 8 >
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2018/11/21 [General] UID:1000 Activity:popular
11/21   

2004/1/8 [Computer/SW/Security] UID:11716 Activity:kinda low
1/7     I know soda runs a browser based ssh login scheme but I've never
        had to use it so I know nothing about it.  Now for various unimportant
        reasons I need the same thing running on my home machine.  What is
        the name of the software that soda uses for this and where can I get
        it?  Thanks!
        \_ Easier is just download putty ssh when you need it.
        \_ Google for "mindterm", or just grab it from soda. There's different
            versions.  It is  a 'ssh1' client implemented in java. -ERic
            URL is http://www.mindbright.se/mindterm
        \_ and an excellent FAQ for getting to systems from behind networks
           with firewalls administered by idiot/bofh network admins:
           http://www.tldp.org/HOWTO/Firewall-Piercing
        \_ It sounds to me like he is looking for server software, not a client.
        \_ OP here to clarify: a friend who recently can ssh out from a corp
        \_ OP here to clarify: a friend who recently who ssh out from a corp
           network no longer can.  they only have some sort of http proxy to
           the public net now.  I'm looking for a way for them to abuse the
           corp http proxy to ssh to remote hosts outside the corp net.  I
           thought the soda solution was running some sort of proxy abusing
           ssh client which is why I asked about that.
           \_ I could never get mindterm to work right with http proxies.
              Mindterm2 has no problems, though.  Run it as a local jarfile
              if you have funky security settings.  -John
           ssh client which is why I asked about that.
              \_ Thanks!
2004/1/6 [Computer/SW/Security] UID:11680 Activity:nil
1/6     How do I post to newgroup with an email account I don't have access
        to? Thanks.
        \_ Use your mad el8 haxz0r skillz!
2003/12/22 [Computer/SW/Security] UID:11560 Activity:nil 75%like:10794
12/21   Anybody have any good or bad things to say about http://togetherhost.com?
2003/12/13-14 [Computer/SW/Security] UID:11447 Activity:nil
12/13   Why do yahoo, ebay, and a host of other sites that require a
        password and may contain personal information still default to
        use non SSL to transmit passwords?  Several times I've forgotten
        to click the elective secure login button!
        \_ it puts more load on their systems, and really, they don't give
           a shit about your account, unless they're providing financial
           services.
           \_ yes.. extra load on their systems.. also some people are in
              environments where https is not an option. if you haven't
              noticed, whenever you access something they think is trully
              sensitive they switch to requiring https and ask for your
              "security key" which is separate from your password
2003/12/12 [Computer/SW/Security, Computer/Companies/Yahoo] UID:29714 Activity:nil
12/12   Yahoo to use msg authentication for email:
        http://www.newscientist.com/news/news.jsp?id=ns99994459
        \_ That's like, so yesterday, and stuff
2003/12/12-13 [Computer/SW/Security, Computer/SW/Unix] UID:11435 Activity:nil
12/12   what in the hayell is <DEAD>writeme.com<DEAD>?  like free webmail with no
        website?
        \_ see http://www.mail.com and try signing up.
                \_ aaaaaah hchaaaaaaa!  cheerz.  but no.
                   \_ ???  http://mail.com offers many @domain options
                      including <DEAD>writeme.com<DEAD>.  What do you mean by
                      your statement above?
2003/12/12-13 [Computer/SW/Editors, Computer/SW/Mail, Computer/SW/Security] UID:11423 Activity:nil
12/11   Does anyone know of a free SFTP client for MacOS 9? --dim
        \_ http://versiontracker.com
2003/12/11 [Computer/SW/OS/SCO, Computer/SW/Security] UID:11402 Activity:nil
12/10   SCO's claim of a DDOS attack probably false:
        http://www.groklaw.net/article.php?story=20031210163721614
2003/12/3 [Computer/SW/Security, Computer/SW/Graphics] UID:11295 Activity:low
12/2    Research on Ecstacy is Clouded by Errors
        http://www.nytimes.com/2003/12/02/science/02ECST.html
        \_ Not surprising.  Most people I've seen on X aren't the greatest
           examples of lucidity.
           \_ uh, the scientists who ran the flawed study weren't
              the ones on ecstacy.  in fact nobody in the study was.
              \_ Whoosh!
           \_ Whoa.  Someone commented on an URL link without reading the
              URL?  SHOCKER!
              \_ Okay.  It was a joke.  Sorry for confusing you.
              \_ INCLUDE YOUR CHILDREN WHEN BAKING COOKIES
                 \_ NEW STUDY FOR OBESITY LOOKS FOR LARGER TEST GROUP.
                    \_ PROSTITUTES APPEAL TO POPE
                       \_ ALL DRUG ADDICTS HAVE EATEN A POTATO AT SOME
                          POINT IN THEIR LIVES.
        \_ Y'all gonna keep them brain doctors working when you're 60.
2003/11/25-26 [Computer/SW/Security] UID:11223 Activity:nil
11/25   When I do "ssh machine command" it keeps asking me for password.
        The weird thing is that it only happens on certain machines. Why
        is that and how do I make it so it never prompts for a password? Thx
        \_ create private keys
        \_ man ssh-keygen, man ssh-agent
           \_ Also man ssh, search for shosts.
              \_ shost-like authentication is not enabled by default in newer
                 implementations of OpenSSH. Just use the key authentication.
2018/11/21 [General] UID:1000 Activity:popular
11/21   

2003/11/23-24 [Recreation/Dating, Computer/SW/Security] UID:11197 Activity:low
11/23   A friend has a website that's become very popular recently (no, it's
        not porn). Up until now he's been relying on the kindness of strangers
        to host it but recently the large amount of bandwidth it's taking up
        has made that no longer an option. I'm trying to help him figure out
        how/where to host his site, any advice would be appreciated. The
        site had a recent spike in popularity which may or may not continue,
        the last few days it's used up about 13 GB of bandwidth a day. It
        doesn't need a lot of storage space (< 100 MB).
        \_ http://www.communitycolo.net          be sure your friend's site
                is not for profit!  No porn!            -brain
        \_ 13 gigs a day!?! wow, and it's really not porn?  What is it.
           That is a crazy amount of traffic for a non porn site.
           \_ warez, mp3, porn.  pick 2.
              \_ no, none of these... it's just gotten some press in the last
                 few days. -op
                 \_ so what's the site?
                \_ it's gotta be friendster, no?
           \_ 13GB/(24 * 60 * 60) = 150KB/s or 1.2 Mb/s
              This is not enough to fill a T1. How can CS students really
              be this dense?
              \_ Traffic is a spikey thing.  Peaks of 10 times
                 your average traffic are not uncommon.
                 \_ Perhaps. But I work at a site that is not even
                    in the top 500 of web sites and we do 200X this
                    much traffic. Lots of sites that aren't porn do
                    much more than 13GB/day.
                    \_ it is a hell of a lot of traffic for a site that is
                       being run on dontated bandwidth.
                       \_ he just doesn't have the right friends.  1.5mbs
                          would barely show on the graph where I am.
        \_ BitTorrent.
           \_ http://FreeCache.org
2003/11/11 [Computer/SW/Security] UID:11029 Activity:nil
11/11   11:11:11 has passed.
        \_ it isn't the year 1111
           \_ Alright, what's the deal with 11:11:11?  Is this one of those
              mystical stoner things like 4:20 that no one understands the
              origin of but everyone quotes?
              \_ the 4:20 thing comes from a police code for marijuana.
                 -nonstoner
                 \_ That's a widely circulated but well-debunked myth.  There
                    was a group of stoners from Cupertino or somewhere in the
                    south bay who called themselves the Waldos and got high
                    after school at 4:20 in the early 80's.  I can't provide
                    URLs demonstrating that it's not the police code anywhere
                    but a little googling should provide it. -sometimesstoner
              \_ a minute to remember those who have made sacrafices in the
                 fields of battle in service of our country.  Hate the
                 Commander in Chief, but do not hate the foot soldier.
                 \_ Veteran's Day, originally Armistice Day, was held on
                    November 11th to celebrate the close of WWI.  Supposedly
                    the terms of the armistice were signed around 11am
2003/10/30 [Computer/SW/Security] UID:10865 Activity:high
10/30   Somebody once mentioned editing the motd via scp.  How does that work?
        \_ See, when you edit by scp, you're off by one whole day.
        \_ err, think about it.  What does scp do?  It copies files.
           Copy, edit, copy back.
           \_ Yes, thank you.  I'm wondering *why* someone would do that,
              instead of editing it on soda.
              \_ to attempt greater anonymity, duh.
2003/10/30 [Computer/SW/Security] UID:10857 Activity:nil
10/29   Is there a way to turn off encryption of the data stream in openssh?
        Encryption during the authentication process is fine and good, but
        sometimes I want to transfer files across a fast network on slow
        machines, and the data encryption becomes the bottleneck rather than
        the network. I've check the manpage, but the openssh guys seem a little
        fascist about encryption. Thanks.
        \_ telnet rcp
        \_ weird how a bunch of dudes writing security software would be so
           anal about all that encryption stuff, huh?
           \_ there's anal, then there's too anal.
              \_ go ahead and write your own encryption method and compile it
                 in and just have it not encrypt.  the source is always built
                 with an option to let the user change methods.  use it.
        \_ you can build it yourself with a null cipher, or just live with
           -c arcfour as one of the faster ones.  btw, if you are transfering
           smallish files, tar cf - | ssh tar xf - will gain much more than
           tinkering with ciphers on the crappy scp protocol.
        \_ I would think that part of a secure transmission is ensuring that
           the data stream hasn't been tampered with. If you don't encrypt
           everything, someone could possibly inject bad data.
2003/10/29 [Computer/SW/Security, Computer/SW/SpamAssassin, Computer/SW/Unix] UID:10836 Activity:nil
10/28   Someone give me a quick way of installing/using spamassassin? Thanks!
        \_ man spam
        \_ can I install spamassassin as non-root on a machine that I don't
           have root on, like... company machine, school, etc?
           \_ yes but it's easier with root.  with some tiny clue you can
              do it as non-root.  you're mostly changing paths around.
                \_ ok I just installed it with non-root. However it only
                   filters 50% of the rules. Should I make it learn it
                   on a frequent basis (e.g. sa-learn --spam mail/spam) or
                   is there a better way? Also is razor a good thing to have?
2003/10/22 [Computer/SW/Security] UID:10732 Activity:nil
10/21   Security researcher and security content analyst positions at
        Zone Labs.  See ~sky/job/{zone,zone2}.txt.  Sorry I was too
        lazy to format nice.  WARNING: may require sitting for for
        extended periods of time.  (More positions will be added soon)
        Email sking@zonelabs.com
        --sky
                                      \_ do I have to bend over too? :(
        \_ sygate is far more superior
           \_ I respect your opinion...  just curious why you think so.
              thanks.   --sky
           \_ 1) sky is not on my favorite person list, 2) i have no contact
    :( --sky _/
              or association with zone labs beyond being a user, 3) your
              lack of english skills are painful, 4) sygate sucks donkey dick.
              I tried these and several others and zonelabs was the best at
              dealing with rogue apps calling home.  zonelabs + winroute for
              port and protocol screening make a really good combo.
              \_ Do you actually know sky, or is your opinion of the gent
                 strictly based on motd?                     -mice
                 \_ Either way, I wouldn't blame the poster for his/her
                    opinion.  I've had more than my fair share of problems in
                    the past, which manifest themeselves both in my real
                    life interactions with people and in the motd.  --sky
2003/10/20-21 [Finance, Recreation/Food, Computer/SW/Security] UID:10707 Activity:low
10/20   Ever wonder why you get some much junk mail?  It's because the United
        States Postal Service encourages such practice!
        http://www.usps.com/features/fourstepstodirectmail.htm
        \_ of the corporations, by the corporations and for the corporations...
        \_ Yeah, they're self supporting.
        \_ poor trees.
           \_ theyre grown on tree farms for the purpose.  so of like your
           \_ theyre grown on tree farms for the purpose.  sort of like your
              lunch.
                \_ yes the forests of Canada, Madagascar and Burma
                   are one vast tree farm.
                   \_ yawn.  no one is chopping trees in madagascar to get
                      paper to send you junk mail.  it takes 50,000 trees
                      to print *each* edition of the sunday NYT.  you think
                      they're stripping madagascar?  no, it's all tree farm
                      trees raised for that purpose.
              \_ poor cows.
                 \_ and poor wheat and corn and everything else grown for
                    us to murder and eat.
2003/10/10-12 [Reference/BayArea, Computer/SW/Security] UID:10580 Activity:nil
10/10   Any recs. for the cheapestpossible cell service in the bay area that is
        more-or-less decent?  Only need for occasional use.  Want to minimize
        the $/month.
        \_ Never used it myself, but they say MetroPCS is good if you only
           call within bay area.
           \_ Thanks, but I am looking for the CHEAPEST.  MetroPCS is $35/mo
              \_ I don't think you're gonna find any cheap plans below $30
                 these days with most providers.  My gf's sister and parents
                 have a really old plan of $10 a month, and Verizon's gonna
                 kick them off the plan in few months.  Perhaps you should
                 look into prepaid cells.  AT&T and Virgin has 'em.
                 \_ Cingular also has prepaid.  $0.35/minute for peak time
                    and $0.10/minute at off peak.  Prepaid card starts
                    at $10 and must be refilled every 30 days.  $20 and
                    above card expires 90 days.  I think you get to keep
                    any leftover $ everytime you refill your account.
                    \_ Thanks, that's what I was thinking of
                        \_ http://www.attwireless.com/personal/prepaid
                           You can get wireless for as low as $10/45 day
                           period. Minutes will roll-over if you recharge
                           your acct before the minutes expire.
2003/10/10-11 [Computer/SW/Security, Computer/SW/Unix] UID:10568 Activity:nil
10/10   pretty entertaining AI/20 Questions website:
        http://y.20q.net:8095/btest for anonymous login
        <DEAD>q.20q.net/q.cgi?N<DEAD>  to register, which makes it way
        more entertaining.

        Things I didn't know
        The Earth's core is not something you can wear
        You don't squeeze the Earth's core out of a bottle
        The Earth's core is not in a traditional engagement ring
        \_ Things I didn't know
           A programmer is not fuzzy
                \_ Bunny is, though.
           A programmer might carry people
           A programmer does bite
           A programmer is not used to measure something
        \_ Thing I didn't know
           You don't put things in a testicle
        \_ A mobile phone probably has leaves... and is a domesticated animal
        \_ Things I didn't know
           Religion is not made of plastic
           Men might not find religion erotic
           Religion is artificially built by human beings
        \_ Can some one please install the *ancient* 'animal game' on soda
           so these people can get their sillyness fix?  Thanks.
2003/10/3-5 [Computer/Domains, Computer/SW/Security] UID:10457 Activity:nil
10/3    About freakin time...
        http://boston.internet.com/news/article.php/3087071
        \_ what? why? i found their search page a fresh and welcome change
           to my dull typo-filled life.
2003/10/2-3 [Computer/SW/Security] UID:10430 Activity:low
10/2    someone posted a web page to access our soda mail, what was it
        again? thx.
        \_ I think it was shot down as insecure.
           \_ John says everything is insecure so we should just do it.
2003/10/1 [Computer/SW/Security, Computer/SW/Unix] UID:10391 Activity:nil
9/30    I'm not a very mathy person, but I've found myself in dire need of
        a good root-finding algorithm.  I've currently got a piece of
        software that uses Mueller's Method -- but it sometimes generates
        whack results that crash a rather twitchy third party piece of
        software as it iterates.  The curves I'm examining can be assumed to
        be monotonic.  Can I do better than Mueller's, or am I SOL?  TIA. -mice
        \_ Use Mathworld to look up 'root finding' and find the root finding
           method which will work best for the kind of function you have.
           Using mathworld for this sort of thing is a good meta-skill to learn.
        \_ you'd probably find a numerical analysis text more useful than
           mathworld. try checking one out at a college library if you can.
           there are not that many root-finding methods that are actually
           used much in real life.
        \_ One technique to explore-- see if you can parameterize your
           curve on some region of interest by a [0,1] lambda.  I.e.. munge
           your algebra around until you can get a diff from root as a
           function of some linear parameter.  If your curve is nice,
           consider golden section or binary search.  Another thing to do
           is just chop up lambda into increments, evaluate diff, and
           pick the best guess at root (or refine search in a region of
           the best approx from a linear visit across lambda).  Not the
           niftiest method in the universe, but it gets the job done.
2003/10/1-3 [Computer/SW/Security, Computer/SW/WWW/Server] UID:10390 Activity:nil
10/1    OpenSSL vulnerabilities.  Patchpatchpatch...
        http://www.openssl.org/news/secadv_20030930.txt  -John
        \_ is it enough to get install the new ssl rpm or does my mod_ssl
           need to be recompiled?
           \_ depends on whether mod_ssl is linked statically or not. I believe
              it's not since the only new RedHat updates that showed up today
              are openssl ones. In general, they a rarely use static linking,
              so to update a library, you just need to install the new library
              rpm and not worry about the applications that use it.
        \_ My new plan.  Fuck ssh/ssl.  I'm changing all external connections
           to vpn-only and then filtering the shit out of who is allowed to
           even try to connect to that.
                \_ Oh *that* will work.  Because we all know that every VPN
                   solution out there is utterly foolproof and secure.  Nobody
                   ever cracked DES or IOS.  Blanket statements like that are
                   incredibly ignorant and dangerous (although if it makes you
                   feel safer, go ahead.)  There is nothing fundamentally
                   wrong with OpenSSH/SSL--no computer or software is or
                   will ever be 100% secure.  Just patch the fucking thing
                   and get on with your life.  There'll be others.  -John
                   \_ You're so ... manly! when you talk about security, John.
                      It makes my heart go "thump! thump! thump!"  Can I have
                      your love child?  Your IPSEC key?
        \_ DOS vulnerability.  Not remote exploit.
2003/9/29 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:10359 Activity:nil
9/29    What do you guys use to SFTP your files from soda to home Winbox?
        I use WinSCP but it hangs too often.  Thx.
        \_ cygwin scp
        \_ SecureCRT + zmodem
                \_ SecureFX
        \_ Putty's pscp.  Though FileZilla works too.  Both are free.
        \_ http and mozilla
2003/9/24-25 [Computer/SW/Security] UID:10315 Activity:high
9/24    For Wind0ze users: SecureCRT or PuTTy, cost notwithstanding?
        \_ putty seems perfectly sufficient for my needs.  but i am using it
           as i would a glass tty, so your needs may differ.
        \_ never used putty, but SecureCRT has been more than adequate for
           my needs.
        \_ SecureCRT.  I haven't tried PuTTy recently though.  I like
           SecureCRT's binding of PageUp/PageDown to scrollback, and reading
           from my ssh private key files automatically, which are the same as
           in my Cygwin ssh.  I don't like that CPU goes to 100% and I can't
           close the window when output is coming too fast.
        \_ TTSSH is another free alternative. I like it, though if you don't
           care about cost SecureCRT may be better.
        \_ Is SecureCRT free?  Last time I checked it has a trial period.
        \_ My only beef with putty is that the config is in the registry.  It's
           X-tunnelling works great, etc.  (TTerm can't tunnel IIRC.)
           \_ Another great thing about putty is that it comes with
              ssh-agent like functionality.
           \_ Teraterm can definitely tunnel. Maybe the only bad thing about
              Teraterm/TTSSH is it only supports ssh1. I like it.
              \_ The only bad thing is that your secure client isn't secure?
        \_ Have been using putty for over 2 years now (when forced to use a
           windows machine, that is), and have been very satisfied with it. It
           just seems to work right, no matter what, carry no bloat and
           have no annoyances. Quite possibly the cleanest windows app that
           I've used in a long, long time.  -alexf
        \_ Putty is very basic and simply works.  If I could get work to pay
           for SecureCRT, I'd use that instead.
           in my Cygwin ssh.
2003/9/24 [Computer/SW/Security, Computer/HW/Drives] UID:10308 Activity:nil
9/23    I have some data tapes that I haven't touched in 5 years.  I used
        nbackup in DOS on a 486 to make the tapes.  Using the same program
        on the same computer, I am trying to restore those files.  I was
        able to open the tapes, but when I try to restore, it says
        "Cannot access tape drive" or just keeps asking me to insert the
        tape when it's already inserted.  Is it possible that the tape is
        old and that the data is lost, or is the problem more likely the
        tape drive?  How can I retrieve this data?
        \_ Does it say this for *every* tape?  Unless *all* your tapes have
           been damaged by some environmental event or they were shitty tapes
           to start with, it is more likely the tape drive is shot.  If you
           have a unix box with the right tape drive you should be able to
           at least use dd to read raw data from the tapes as a test.
             \_ Actually, since I posted that, I was able to get some data
                from one of the tapes.  But then it kept giving me error
                messages again.  I looked closely at the tape, and the tape
                is physically only connected to one spool (this was not the
                case originally), and it's not as easy as you might think
                to get it back on the other spool neatly.
                 \_ I had this same thing happen years ago. There is an
                    "end of tape" optical sensor in the drive, and if it
                     gets dusty, the drive unspools the tapes. You could
                     try to put the tape back together after cleaning the
                     dust out of the drive, but I suspect you might be out
                     of luck.  This is why I abandoned tapes, and switched
                     to hard disks backups. and disks don't make that
                     annoying whining sound when searching for files. Look
                     in the Sunday paper and get a 150GB disk for $90. use
                     an old extra computer as a backup server, or get an
                     external drive, but either way, make sure to spin it
                     up often:  hard disks can die from stiction if left
                     unused in an "off" state for too long (years).
2003/9/23-25 [Computer/SW/Security] UID:10293 Activity:kinda low
9/22    OpenSSH 3.7.1p2 (portable, ie non-OpenBSD) has been released.
        There are multiple vulnerabilities with the PAM auth code in
        3.7.1p1, so if you use PAM (Solaris/Linux) you should upgrade.

        http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106432248411636&w=2
        \_ Is there an sshd that just works?  I'd be happy with a v2 sshd
           without holes that just allows simple logins.  Any other features
           after that would be a bonus.  Any suggestions?  Please?
           \_ Sigh.  OpenSSH "just works".  It's just that its vulnerabilities
              are declared and found more frequently than commercial SSH
              daemons.  Not saying those are any better or worse, but you are
              deluding yourself if you think that any piece of cryptographic
              software is "secure" just because no bugs are ever publicly
              announced.  Patching system components is a part of life as a
              sysadmin, get used to it.  -John
              \_ I am all for opensource but doesn't it bring as much harm
                 as benefit in terms of security?  Sure patchs are made on
                 more frequently, but isn't it much easier in theory to find a
                 bug to exploit when the source is available than otherwise?
                 \_ Do you occasionally look at Bugtraq?  I suggest you do,
                    if only to make it clear that having a commercial program
                    doesn't add much in the way of security.  Ask Microsoft.
                    "Better the devil you know"...  -John
                    \_ I'm not making my point.  I can see that.  I don't care
                       who wrote it or why or where it comes from.  I just want
                       an sshd with minimal features and fewer holes than what
                       openssh has.  If you don't know of one, thanks, that's
                       ok.
                 \_ would you prefer to know that holes are being found and
                    patched at the cost of having to upgrade, or instead
                    not know about holes and ignore upgrades in ignorant bliss?
                    \_ I'm not making my point.  I can see that.  I don't care
                       who wrote it or why or where it comes from.  I just want
                       an sshd with minimal features and fewer holes than what
                       openssh has.  If you don't know of one, thanks, that's
                       ok.
                        \_ You're very clear--I'm simply saying that OpenSSH
                           is pretty much "it" for open-souce sshd, and with
                           the non-open source ones, no, you probably won't be
                           patching so often, but that says nothing about the
                           amount of holes in them.  -John
              \_ I don't care if the alternative is commercial or not.  I just
                 want something I won't be patching three times in a week.  I'm
                 not concerned with open vs commercial philosophy.
                 \_ It's nothing to do with commercial or open source.  It's
                    a question of security.  If all you care about is not
                    patching something, then don't run OpenSSH.  This is
                    what's known as 'sticking your head in the sand'.  And
                    yes, what you don't know _can_ hurt you.  Your call. -John
                    \_ I'm not making my point.  I can see that.  I don't care
                       who wrote it or why or where it comes from.  I just want
                       an sshd with minimal features and fewer holes than what
                       openssh has.  If you don't know of one, thanks, that's
                       ok.
        \_ Argh! Nooo! Is this a joke? I had already had to upgrade OpenSSH
           on nearly 200 hosts -twice- during last week.
           What the #$(@)@*!!
           \_ Pride goeth before a fall.
              \_ Pride goes before destruction, a haughty spirit
                 before a fall. Proverbs 16:18
           \_ That's why it makes sense to wait to upgrade. OpenSSH
              *always* has one or two patches out within a week. --dim
              \_ wait a week to upgrade while getting hacked in the meantime?
                 swell idea, i wish i'd thought of it.
                 \_ There are no known exploits for this vulnerability, nor for
                    most of the ones being found lately. "It is uncertain
                    whether these errors are potentially exploitable,
                    however, we prefer to see bugs fixed proactively." --dim
                    \_ so says them. securityfocus paints a different picture.
                       in any case, better safe than sorry.
                       \_ More than once the "new" OpenSSH has been more flawed
                          than the original. An example was when the privilege
                          separation code was first added. It is common for
                          the OpenSSH folks to fix a bug and then have to
                          fix their fix. Hence, we are at p2 already. Just wait
                          for the bozos to figure it out unless the bug is
                          easily exploited. --dim
                          \_ they're not exactly fixing their fix. they somewhat
                             hastily made a release with *new* functionality,
                             which was probably not well-tested. so just patch
                             the old 3.6.1p2 and you're fine.
        \_ Jesus fucking Christ!  Is there a simple v2 sshd out there that
           just works?!  I don't need all the whiz bang features, just a
           login shell.  If it could port forward that would be a bonus
           but I could survive without it if it meant I could stop the
           upgrade madness.
           \_ what's this whole upgrade madness? it's been a while since
              the last major openssh scare. fwiw, maybe you should've just
              patched 3.6.1 and been done with it.
           \_ lsh might be what you are looking for. Keep in mind that
              OpenSSH has a larger user base, developer base and h4x0r
              base so gets more auditing.
              \_ and lsh had its own remote exploitable bug days later.
                 so what's the difference.

        http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=106432248411636&w=2
2003/9/23-24 [Computer/SW/Security] UID:10287 Activity:nil
9/22    I know of MindTerm, as well as a whole slew of httpstunnel
        ssh-over-https scripts;  does anyone know of a java applet which
        combines the two?  -John
2003/9/17-18 [Computer/Networking, Computer/SW/Security] UID:10233 Activity:nil
9/16    What's the cheapest internet access to be had in (west) Berkeley?
        It's for my sister, a student... and I don't think piggybacking
        onto someone's wireless is an option.  Speed isn't important.
        Thanks.
        \_ Get dialup for $8 a month.
           \_ Who has dial-up for $8 a month?
              \_ i have dialup for $6.95 a month.
        \_ NetZero.  The ads are free too...
           \_Netzero isn't free anymore.
        \_ I haven't used it, but the last time I was looking, I got a couple
           reccomendations to http://www.access4less.net $6/mo and supposedly good
           service (can't vouch for this, apple-fan(atic) roommate went
           and signed up for their partner earthlink)
2003/9/17 [Computer/Rants, Computer/SW/Security] UID:10227 Activity:nil
9/16    Shutterfly on http://fuckedcompany.com.  Add this to my list of a few days
        ago about why *not* to use them.
        \_ Who cares if Best Buy is or isn't using them?  It's a good
           service.  -tom
           \_ Because they're a dotcom with no parent company, too many staff,
              high prices and one less big customer.  I just hope you keep an
              original of all your pictures and copies of everything your
              friends have shared with you.  When they go, they're going to
              go POP! really fast.
        \_ I ended up going with http://pbase.com. Yeah, it's a pay service ($23/yr),
           but it had all the features I wanted in an attractive package.
2003/9/17-20 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:10225 Activity:nil 74%like:10214
9/16    OpenSSH 3.7.1 released (fixes a buffer mgmt error):
        http://marc.theaimsgroup.com/?l=openbsd-announce&m=106375547524560&w=2
        OpenBSD: http://www.openssh.com/openbsd.html
        Portable: http://www.openssh.com/portable.html
        [ updated to 3.7.1 since 3.7 had a bug ]

emacs user was here
        \_ I had a beta version of 097b ssl installed so I got the 4/10/03
           version and the compile and install went clean but the ssh client
           still says its using the old version....  I then recompiled and
           installed ssh and same thing.  I've tried a few other things but
           nothing works.  Any hints?  There's no rpm for my system and
           the compile isn't the issue anyway.  Thanks!
                \_ Have you killed and restarted sshd?  Do you know where
                   your make install is putting things--is it the same place
                   your startup scripts are running them from?  -John
                   \_ ssh -v shows the old openssl version.  It has nothing
                      to do with sshd.  It's getting it from
                      /usr/lib/libcrypto.so.8.0 according to ktrace.  I don't
                      see where the openssl install is supposed to replace or
                      install a newer version of this file.
                        \_ If you build openssl from src it puts the libs
                           in /usr/local/ssl/lib or /usr/local/lib (depends
                           on your os). If you want your new version to
                           override the system installed default, then just
                           rename the version in /usr/lib and make a symlink
                           to the new version (provided you can build a .so
                           on your arch). If you are using *BSD you should
                           probably fetch the latest version of /usr/src/lib
                           and rebuild that way.
        \_ Arrr!
           \_ Avast!
2003/9/16 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:10214 Activity:nil 74%like:10225
9/16    OpenSSH 3.7 released (fixes a buffer mgmt error):
        http://marc.theaimsgroup.com/?l=openbsd-announce&m=106373074626260&w=2
        OpenBSD: http://www.openssh.com/openbsd.html
        Portable: http://www.openssh.com/portable.html
2003/9/13-15 [Computer/SW/Security] UID:10183 Activity:nil
9/13    Which online photo sharing websites do you guys prefer?
        \_ shutterfly.  -tom
        \_ http://www.csua.berkeley.edu/~login
        \_ snapfish.
        \_ Decide what you need.  Here's the service summary on the 3 major
           sites:
                snapfish: uses Kodak paper and machines, lowest prices, but
                          ships from east coast so it takes a little longer
                          to get prints sent here, maybe an extra 2-3 days.
                ofoto: owned by kodak but uses fuji equipment, etc.  slightly
                       more expensive but you'll get your pics a day or two
                       sooner because they're printing locally,
                shutterfly: same idea as ofoto except they're still a dotcom
                            and dont have large company backing them so they
                            have to charge more and they could go under and
                            take your pictures with them at any time.  i
                            believe they use a variety of smaller development
                            firms, thus the higher prices since they don't get
                            the same kind of bulk rates snapfish and ofoto can.
                If you're not printing and only want the free online storage
                and the ability to share, it doesn't really matter.  Bits are
                bits, yes?
                \_ ofoto requires your visitors to log on to view your
                   pictures, so it does really matter.  -tom
                   \_ if they didn't then deep linking directly to photos
                      would allow rampant abuse of storage and bandwidth for
                      non-customer uses.  It isn't 1998 anymore.  They need
                      to control costs and make profit or die.
                      \_ that is easy enough to prevent without making someone
                         need to have an account.  Just check the referal.
                         \_ See my comment about 1998.  If they can get you to
                            sign up, you're more likely to continue using the
                            service.  If you won't signup, what do they need
                            you for anyway?
                            \_ I'm just pointing out that your first argument
                               was flawed.  As to the second, well, there are
                               two options I can go with that don't require
                               a visitor to sign in.  All other things being
                               equal guess which choice is better?
                               \_ We have a different idea of what constitutes
                                  abuse.  To me if you're not a paying customer
                                  or bringing in other paying customers yet
                                  you're sucking bandwidth and storage, you're
                                  useless to the company.  True, it's only
                                  really abuse if they allow it to happen and
                                  in this case they're not.  Additionally,
                                  they're taking steps to try to get more
                                  paying customers which is a good thing for
                                  any business.  We're splitting hairs at this
                                  point.  Since the accounts are free, it's
                                  all pretty much the same in that regard.
                                  There's probably a csuamotd/csuamotd account
                                  on all three already.  :-)
                                  \_ no, because if I'm using the service I'm
                                     also probably paying for prints and the
                                     like.   The point is by making people
                                     need to log in to see my pictures I'm
                                     going to go with one of the other two
                                     and when I want to get prints I'll
                                     get them from the company where I've
                                     put my photos.  Bandwidth and storage is
                                     still pretty damn cheap compared to other
                                     costs and it is pretty easy to catch the
                                     serious abuses.  (Say just give every
                                     use a dl/day limit).
2003/9/2-3 [Computer/SW/Security] UID:29520 Activity:insanely high 80%like:10043
9/2     What is the average density of yermom?  I don't have anything to
        measure weight near me and I need that info soon.  Ok tnx.
        \_ STFW?  there's got to be something about this online somewhere.
        \_ Use the scale at the post office.  It also depends on the paper.
           \_ I cannot easily access a post office right now.  I need to
              come up with a very rough estimate of lost of book.  I have
              only rulers in my disposal.
           E.g. phone books are pretty light considering their sizes.
           \_ I cannot access a post office right now.  I need to estimate
              very roughly the weight of many boxes of books with only rulers
              and helpful info from the motd.  If you have a big book and can
              measure both its weight and dimensions, please let me know. Tnx.
              \_ I know.  Find a computer book at your office.  Measure its
                 dimensions.  Go to http://Amazon.com, and try to order 100 copies of
                 that book.  See what the shipping charge is, and backward-
                 calculate its weight according to the shipping method.  Then
                 cancel your order at the last step.
                 \_ That's a pretty good idea.  Though you don't even need to do
                    this--Amazon should include the dimensions of the book.
2003/8/29-30 [Computer/SW/Security] UID:10013 Activity:nil
8/29    How does ssh generate the fingerprint for the rsa public key?
        When I echo <pubkey from ssh_host_rsa_key.pub> | openssl sha1
        I get a different fingerprint than what ssh shows me, but when
        I look at the actual key they are the same.
        \_ umm, you know doing that sums the string 'pubkey', and not
           your actual key right?
           \_ he does now.
           \_ I figured it was obvious that 'pubkey' ment the public
              key from /etc/ssh/ssh_host_rsa_key.pub. I've fixed it.
              \_ cat /etc/ssh/ssh_host_rsa_key.pub | openssl sha1
                 \_ the right answer is ssh-keygen -l -f <keyf>
2003/8/27-28 [Computer/SW/Security, Computer/HW/Memory] UID:29482 Activity:moderate
8/27    I just gave a security presentation to a bunch of MBA students working
        on a market strategy for http://www.giwano.com  Aside from a mildly
        unfortunate name, they have a cute idea, but it seems slightly
        gimmicky to me.  While I can think of nice roles for some kind of
        "secure" storage like these, what's the almighty motd's opinion?  -John
        \_ sounds like hogwash.  Either the user can't get data between the
           two systems, or it's vulnerable to attack.  -tom
        \_ what do you have in mind re: unfortunate name? gitano? guano?
                \_ Puerile, but yes.  And as the PC (that's what it is) runs
                   XP, it is vulnerable to attack--the idea is to use the
                   flash memory between the two PC units to manually move
                   sensitive data back and forth.  It's got a built-in KVM
                   switch to let you work on both units, so you could connect
                   the internal unit to a 'sensitive' network and share it with
                   PCs there.  Or something.  I think the idea has some merit,
                   but they're going about it all weird.  -John
                   \_ Isn't this just reinventing sneaker net? --dim
        \_ I tried to figure out exactly what they're doing but wasn't willing
           to invest that much time doing so.  Can you explain it in a few
           short sentences?  Generally, people with important data seem happy
           with their current level of security.  If they weren't then you'd
           see products from the major vendors (EMC, Hitachi, IBM, Netapp, etc)
           to address the issue.  You don't but I wish them well anyway.
2003/8/26 [Computer/SW/Security, Computer/SW/Unix] UID:29470 Activity:high
8/26    http://nosuch.com/music/webtones.cgi
        \_ hm... I don't think this is that cool.
           \_ The arbiter has spoken!
              \_ more an attempt to stimulate conversation than to
                 arbitrate. what do other people think? just seems to
                 me like there are many arbitrary ways one could
                 generate music from a web page, gif, whatever, and the
                 results of thsi weren't particularly compelling musically.
2003/8/15-16 [Computer/SW/Security, Computer/SW/Unix] UID:29359 Activity:low
8/15    D00DZ GN00 WUZ 0WNZ!
        http://csua.org/u/3xw (story.news.yahoo.com)
        http://www.cert.org/advisories/CA-2003-21.html
        \_ rms:rms
2003/8/14-15 [Computer/SW/Security] UID:29342 Activity:high
8/13    Read your Soda mail on the web: http://dev1.bnet.org/imp
        No warranties, but you can mail me w/ questions/comments.
        IMP does this semi-securely(?) using IMAPS (port 993). -abe
        \_ so wait, it uses imap-ssl but you suggest we login via
           plain text http? brilliant. why not just use something
           like http://www.mail2web.com instead?
        \_ who would trust your site anyway? if people want something like
           \_ and to connect to it over straight http...
           this, csua should just install squirrelmail or something.
        \_ Which could very easily be used to gather passwords.  Come on,
           people... SSH tunnels and IMAPS are really not that hard to set up.
           --scotsman
           \_ Not that easy if you are on some webterminal while on vacation.
                \_ I found that going to the putty download page and running
                   from there often worked to ssh in.
        \_ Of course I could easily use it to gather passwords. CSUA *should*
           install something like IMP (or squirrelmail, or whatever), but they
           haven't, so this is an alternative. of course, you have to trust
           me and my server (which I probably wouldn't). -op
           \_ not for "you" to gather passwords.  for a man-in-the-middle
              between you and the hapless user. --scotsman
           \_ I guess it's about like http://csua.org/u but it's a potential
              security/privacy hazard.  So, if I may speak for the motd,
              we thank you but respectfully decline.
              \_ Um.  It's nothing like http://csua.org/u  the url shortener doesn't
                 have anything to do with your login on soda.  and it doesn't
                 \_ um. the reading comprehension thing again. -not 2 up
                 open you up to having your account nabbed by a sniffer.
                 Again I say come on... --scotsman
                 \_ um. the reading comprehension thing again. -not 2 up
        \_ Wow that's great!  It uses my MSPassPort(c), right?  I use my
           MSPassPort(c) for everything!  But if you're not MSPassPort(c)
           compatible your site will never grow!
        \_ guys, come on. It's a PROOF OF CONCEPT. Give the guy a break.
           Change your password and give it a try, then change it back.
           If it's cool maybe we could sign a petition to install similar
           stuff on trusted CSUA machines. Now if only we could petition
           a Recall on Poliburo, that'd be even better.
           \_ arnie for csua president!
           \_ Why would you trust a CSUA machine?
                \_ I trust any CSUA Linux/BSD machine over any corrupt and
                   disfunctional CSUA Poliburo any time.
        \_ it is a nice program, thank you!!
2003/8/11-12 [Computer/SW/Security, Computer/SW/Unix] UID:29315 Activity:kinda low
8/11    http://www.craigslist.org/eby/eng/14754592.html
        They claim there's a "Secret password" encoded in there but it
        looks like every other "we don't have enough money" job posting
        to me.  I'd never apply for a job like this but I'd like to know
        if there really is a "secret password" in there.
        \_ Read down the first letters of the first five paragraphs. I want 30%
           of your first month's salary.
           \_ bingo
           \_ Kinda sad actually. I thought it would be harder to find.
           \_ BSPTEFEEA? WTF does that mean???
              \_ It means "you will continue to draw unemployment"
2003/8/10-12 [Computer/SW/Security] UID:29299 Activity:very high
8/10    I'm looking for an encryption software package for windows 2000 that
        works on a per-directory or drive basis and is transparent.  Meaning
        once I authenticate myself I can create files or copy stuff into the
        folder and it'll be encrypted automatically.  Word, Excel, TurboTax,
        etc should all work with this encrypted folder.  For individual files
        I can use pgp.  But when working with a lot of files, I prefer not to
        think and just dump the files into a directory. I'll buy the software.
        Not looking for free stuff.  Thanks.
        \_ Whatever you do, avoid EFS.  It has its uses, but its key management
           is immature and difficult to manage.  You may also want to have a
           look at Utimaco Safeguard Easy (it's not on a per-directory basis,
           but might give you something to work with.)  -John
        \_ for enterprise level you might consider a NAS or SAN product like
           the datafort from Decru. the nas product does per file encryption
           on the fly.. plus can do end-end cryption btwn it and your desktop.
           for just local storage, i recommend either f-secure or pgpdisk,
           both create a virtual volume on the local drive and maintain a
           file system structure w/in that volume. from experience w/ both,
           pgpdisk at least used to be easier to use. you can find it at
           http://www.pgp.com of course. -shac
        \_ You can also try BestCrypt.  You can mount an encrypted file as a
           removable drive.  I've been using it for more than three years
           now to keep my personal stuff secure on my work laptop.
           http://www.jetico.com
        \_ Steganos Security Suite.  Tools include Steganos Safe (like PGPDisk),
           Internet Trace Destructor, Email Encryption, Shredder, Password
           Manager
        \_ Which tools work on both Linux and Windows platforms?
        \_ here is my stupid question.  Where do you guys store your
           private key ring when you are using any of these product?
           the very same laptop/computer that you are encrypting upon?
                \_ This is the problem.  Probably the best place to store
                   a private encryption key is on something like a smart card,
                   which can itself be PIN-code protected.  One of the main
                   weaknesses of most drive encryption products (this is my
                   beef with EFS) is that it's nearly impossible to keep
                   track of peoples' private encryption keys--Entrust does a
                   good job of this, I'm not sure of other PKIs (MS does not.)
                   Ideally you'd have the keys somewhere local and secure
                   (like a hardware token inside a protected container) as
                   well as archived *very* securely for recovery purposes in
                   something like an encrypted CA/RA database.  For everyday
                   encryption (aunt Hilda's secret recipes, your porn) storing
                   keys in something like a GPG keyring should be enough.  -John
                   \_ My PGP foo is weak.  Please explain.  So what if I store
                      all the key stuff in the same laptop?  I thought that
                      without my passphrase people can't possibly crack it?
                      That's the whole point of the bigger and bigger sizes
                      I keep hearing about.  E.g. 1024 vs 2048 bit encryption.
                        \_ OK when you lose your encryption keys, you have a
                           problem.  A PKI (public key infrastructure) is a
                           mechanism that issues keys for encryption and
           your transfer rates will sky rocke while your disk usage will
                           signing etc. and, ideally, archives your private
                           encryption key in a safe place.  PGP/GPG work
                           differently, instead of having authoritative say
                           "Joe is OK", you have this idea of a "web of trust"
                           where you trust peoples' keys by consensus.  Key
                           size, to oversimplify it, just affects how hard it
                           is to crack something by brute force.  And as for
                           storing all your keys in one place, look at it like
                           a normal keychain--if you put all your keys on it
                           and it gets lost or stolen, you have a problem--you
                           should probably use a key safe or something.  Hence
                           the password protection or storing it on some
                           secure medium, like a smart card.  For some slightly
                           outdated docs on how a PKI (not PGP) works, have
                           a look at http://ospkibook.sourceforge.net  -John
        \_ I use PhilCrypt with the compression option.  Works with all OS's,
           local, over NFS, HTTP, etc to NAS, SAN, with udp, tcp, iscsi, you
           name it!  PhilCrypt is the best and the compression option means
           your transfer rates will sky rocket while your disk usage will
           actually go down the more data you add to your PhilCrypt DataVault!
           Get "PhilCrypt DataVault Deluxe" (includes PhilCompression and
           advanced management features)!
2003/8/8-10 [Computer/SW/Security, Computer/SW/RevisionControl] UID:29286 Activity:moderate
8/8     Is there any way to run a cvs server without root such that it can
        support windows users without ssh.
        \_ man pserver
           \_ no joy.
        \_ another way is to download cygwin, install it in windows,
           use the cvs via ssh at the command line - danh
        \_ man pserver
           \_ no joy.
              \_ Um.. okay, read up on pserver on the cvs howto page.
        \_ You can use .rhosts file.  Better to use ssh such as plink though.
2003/8/8-10 [Computer/SW/Security] UID:29277 Activity:low
8/7     Is it just me or is Soda's POP3/IMAP security certificate broken?
        \_ Does anyone besides me read CSUA mail on the web (i use imp)?
        \_ Yup, it expired.
2003/7/30 [Computer/SW/Security, Computer/SW/Unix] UID:29175 Activity:kinda low
7/29    I've been struggling with cygwin all day and getting nowhere.
        I'm trying to get it to run init and startup xinetd, sshd, etc
        from /etc/rc.d/rc?.d just like on a real unix box and I'm not
        getting anywhere.  There's an error in the init.d/functions file
        which prevents anything running properly and when I try running
        xinetd by hand, it runs as my user and not SYSTEM even though
        I setuid'd xinetd.exe and tried a bunch of other things.  Has
        anyone here got any of this working and if so, please tell me
        how explaining very very slowly because I'm feeling really
        stupid right now.  And no google didn't help at all.  Thanks!
        \_ there is a cyg program to install your sshd (and anything
           else) as an NT service.  Set that to start automagically
           and you will be good to go.  google for "cygwin sshd
           install" and i'm sure you will find it.
2003/7/25 [Politics/Domestic/California, Computer/SW/Security] UID:29134 Activity:kinda low
7/24    Any recommendations for high-speed access in La Palma, Ca?  I have
        SBC for phone service, but ironically, I can't get the Yahoo/SBC DSL
        deal where I live.
        \_ try using http://www.dslreports.com to search
2003/7/23-27 [Consumer/CellPhone, Computer/SW/Security] UID:29119 Activity:high
7/23    Anyone have any experience checking their soda email thru t-mobile's
        "t-zones" service? I just got a new phone that I'm messing around
        with and it seems pretty cool except for a couple glitches that I've
        been calling tech support about and wondering if anyone's gotten it
        to work right. thanks.                  - rory
        \_ http://www.ntk.net/2003/07/25/dohbad.gif  -John
        \_ Who the heck came up with that name. "combination skin and oily
           \_ you need an exfoliating mMode cleanser.           - rory
                \_ rory!  I fantasize about giving you a bikini wax.
                   \_ WTF is going on here.
           \_ Probably the same people who tried putting a computer store
              in the old Weird Stuff building in Sunnyvale (across from the
              old Fry's) and decided T-Zone was a much cooler name than
              Technology Zone.  Didn't last long.
           T-zones let me check my email ANYWHERE!" -chialea
        \_ I haven't had any luck, except through very basic SSH
           access through my P800.
        \_ and does anyone use the t-mobile internet (unlimited gprs for
           19.99 on top of voice plan)?  does it suck?  --karlcz
           \_ I think the rates have changed. I'm getting 1MB for 2.99,
              and I can upgrade to unlimited bandwidth for $10.
              \_ that is for t-zones WAP service.  tmobile internet
                 lets you use your phone (or pcmcia card) as a gprs
                 network interface for your laptop, pda, etc.
        \_ I know a couple people with t-mobile and they are angrier about
           lock of service than even the cingular users I know.  Data, voice,
           neither seem to work worth a damn.  No wonder if is so cheap.
           \_ I heartily disagree... perhaps the problem is your friends'
              phones? I recently switched to a Nokia 6610 (been using
              t-mobile for a while) and service dramatically improved. I'm
              almost never w/out connection. Plus, their customer service
              is fantastic. extremely helpful phone people. I lost my
              previous phone and was given a full month credit just because.
                \_ out of curiosity where in bay area are you?
                   \_ Manhattan. heh
          \_ I get full signal in mid-peninsula and south bay.  But I haven't
             tried east bay where my friend has almost no signals.
        \_ Update: alright, so I figured out the problem, but would like to
           come up with a better solution. When I check my soda email with
           my phone via POP3, it leaves all my msgs on the server but moves
           them off the spool to a mailbox file named "mbox" in my home dir.
           Usually I check my email with Outlook Express, which as far as I
           can tell, just checkes for msgs on the spool. Is there any way
           I can get these two different mail-checking methods to work
           together? is this standard behavior?
           \_ you have pop3 over ssl working with soda? i never got that
              working
              \_ I use pop3 over an ssh tunnel. ie, localhost:110 on my home
                 machine
2003/7/15-16 [Computer/SW/Security] UID:29048 Activity:nil
7/15    http://lwn.net/Articles/39909
        Bruce Schneier's crypto-gram, scroll down and read the last part.
2003/7/10-11 [Computer/SW/Security] UID:28998 Activity:moderate
7/10    What is a good way to check to see if a host is alive when ICMP is
        blocked? Attempting an ssh connection to it stinks if the host is down,
        since the client takes a long time to give up. Other ideas? --dim
        \_ Interesting, you'd need to know a service that is always up
           when the host is up. If ssh is running, you could try
           telnet host 22
                                                             \- not true
                                                                with udp --psb
           when the host is up. then netcat that port.
           'netcat hostname 22'
           \- you cannot tell the difference between a host that is
              blackholing you and one that is down ... i.e. you arent
              getting any FIN/RST/ACK etc. i suppose you can hit random
              udp ports and look for icmp port unreachables ... basically
              you either need to know/guess something about the machine
              to pick the "single" highest probability technique or
              you need to OR together a bunch of tests, some of which
              are expensive. i am assuming you are a few hops away
              and you want an active rather than passive technique. --psb
        \_ Port scan 'em.
        \_ Call the sysadmin or send email and ask.  If you're the admin,
           then look at the screen.
2003/7/10-11 [Computer/SW/Security, Computer/SW/WWW/Server] UID:28992 Activity:nil
7/9     So, what are the cheapest "trusted" SSL certs out there?
        \_ Get a standard Windows install, open MMC, look in the certificates
           snap-in for trusted root certificates, go through those.  Or failing
           that, in the 'security' settings of any browser under whatever
           incarnation of a 'certificate authorities' listing you have.
           (Thawte no longer exists.)  What do you need a trusted root CA
           chain for?  You can very often get away with issuing your own.
                                                                -John
        \_ http://instantssl.com, price starting at $50
           http://geotrust.com, price starting at $150
           Never used either of them, so YMMV.
2003/7/9-10 [Politics/Domestic/California, Computer/SW/Security] UID:28981 Activity:very high
7/9     Diebold voting machines easily hackable:
        http://www.scoop.co.nz/mason/stories/HL0307/S00065.htm
        Why on earth would you use Microsoft Access to do something as
        important as tabulating votes?
        \_ because you care more about short-term profit than democracy?
           \_ Well, there goes their profit.
           \_ how is there profit in using a shrink wrap ware instead of a
              free one?  they're stupid but not for the reason you feel.
                \_ thanks guys, once in a while this anti-corporate, "they
                   are all a bunch of evil greed heads" draws me in and i
                   forget that the answer is almost always "people are
                   stupid" rather than "people are evil", it's good that
           \_ How about making software as "product" and subject to
              product reliability law suit? duh
                   there are others who realize that and can remind me when
                   i forget. -phuqm
        \_ only criminals would hack into systems.  let law enforcement
           do its job, fucker
           \_ hmm, these sound like the words of a criminal who is aware
              just how unlikely the "job" is to get done.  You know, that
              or a Troll. -phuqm
           \_ Or corrupt/zealous/partial/party-affiliated voting officials
              \_ That makes them criminals, DUH!
           \_ hah!  the great long tradition of police protecting voting...
        \_ how about making software as a "product" (instead of this
           licensing nonsense) and subject to product reliability law suit?
2003/7/7 [Computer/SW/Security] UID:28943 Activity:low
7/6     Is there any way to get scp to not overwrite a file that exists on
        the remote host?
        \_ Use rsync instead.  You can use rsync through ssh for the
           encryption and auth.
        \_ Unison is a nice tool for syncing things between two machines.
2003/7/2-3 [Computer/Domains, Computer/SW/Security] UID:28898 Activity:high
7/2     I need to renew my domains soon.  I'm currently registered under
        http://joker.com but with the high cost of the euro, I think I'll switch.
        Can anyone recommend a registrar for this?  Does it cost money
        to switch?
        \_  http://godaddy.com    It does not cost additional money to switch
           \_ It looks like they offer only 5 subdomains with the basic
              package.  Can I add more?  How much would they cost?
        \_ http://www.tubgirl.com has the best domain registration service.
           \_ but not quite as good as www.goatse.cx
2003/7/1 [Computer/SW/Security, Computer/SW/OS/Windows] UID:28886 Activity:nil
7/1     What's a .pif file?
        \_ http://www.google.com/search?q=what+is+a+pif+file
           \_ brilliant!
2003/6/25-26 [Computer/SW/Security] UID:28837 Activity:high
6/25    Does anyone have any day-to-day experience with encrypting
        many (O(100s of MBs)) of files on their hard drives?  For
        instance, if you have a laptop with all of your electronic
        bank statements/etc on it, and wanted to encrypt these with
        a key that you have on a compact flash or something similar?
        I know it is doable, but I'm wondering if it is in a way that
        is still usable?
        \_ why not use an encrypting file system...
                \_ MS EFS has somehighly annoying problems, like making it
                   really easy to accidentally generate new keys (which are
                   not backed up easily.)  Look at CFS under FreeBSD.  -John
           \_ The critical point would still be key management, right?
              You don't want to have the key on the machine if it
              gets stolen, but you still want fairly normal access to
              the files...  Put it on a "secret" web page so that you
              can download it to use?  Or on compact flash?  Does
              anyone do this kind of thing?
           \_ but that would be cheating.
           \_ is there any free/open source encrypted file system?
              \_ pffft.  You might as well just format the drive now.
           \_ Abe's Linux Encrypted Filesystem howto:
              http://www.abeowitz.com/crypto
              Also I've seen similar stuff with windows that uses a
              vxd to add encrypted filesystem support and mounts an
              encrypted block file.
              \_ no relation. -abe
        \_ Just tell your g/f that you look at porn. Stop trying to hide
           it from her.
2003/6/24 [Computer/SW/Database, Computer/SW/Security, Reference/Law/Visa] UID:28824 Activity:high
6/24    Oh god.  I wish the EU (useless bunch of poltroons) would get at
        least a semblance of a backbone.
        http://www.theregister.co.uk/content/55/31380.html
        Does anyone know more about new biometric passports the US is supposed
        to be issuing?  I'd frankly much rather deal with the hassle of a
        visa with my Swiss passport than submit to this.  -John
        \_ Maybe it's just me, but John seems to talk about his Swiss passport
           pretty frequently.
        \_ Biometrics are such a huge mistake.  No one seems to be addressing
           the issue that if your biometrics are compromised, there is no way to
           issue new ID--well, without replacing your eyes.  -emarkp
           \_ Hm?  Perhaps I'm misunderstanding the process:  you have an ID
              or passport with your retinal scan/fingerprints on it.  They
              scan your ID, compare it to a db of such things, and then you
              put your eye/hand to the scanner and verify that you are who
              the system says you are.  Are you saying that someone could
              hack the db and sub their own particulars for yours and so take
              your bank account?  If so, you now have their fingerprints /
              ret. scan on file-- should be fairly easy to find the duplicates
              in the system and arrest the perp.
              \_ No, if someone else can ID themself with your biometrics or
                 subvert the system somehow, you're screwed.  You can't get
                 different biometrics. -emarkp
                 \_ What are we talking here?  Fake fingerprint gloves?
                    False retinal scan contacts?  Not saying it can't be done
                    but quite a stretch, no?
                    \_ Actually it's quite easy to fake out the fingerprint
                       thing. The retinal scans can be horribly difficult
                       obtain accurately at times. The real problem is identity
                       theft and proving that it wasn't you who shifted your
                       bank account/stock portfolio/real estate to party X.
                       VERY tough to dispute.
                        \_ I fail to see how biometrics makes this worse;
                           right now you're being authenticated on your
                           signature, which is way easier to forge than
                           even the simplest biometric.  -tom
                           \_ It's not worse. It makes id theft much more
                              difficult. I'm more for dual source
                              authentication. Bio + PIN. However, businesses
                              might make it much harder to dispute id theft
                              and make corrections since it is technically so
                              difficult. I fear an overreliance on tech.
                              \_ I think this has less to do with tech, and
                                 more to do with the nature of big business
                                 and bureaucracy.  Bureaucracy and silly
                                 overhead happen just fine without any
                                 technology at all.  What you'd hope is that
                                 intelligent policies will be put into place
                                 to deal with situations that the tech makes
                                 'unlikely'.
        \_ You'll submit and you'll like it.
           \_ Grey matter! Grey matter!
2003/6/12 [Computer/SW/Security, Computer/SW/RevisionControl] UID:28711 Activity:high
6/11    Which of the free email accounts are the most reliable? I have a
        http://netscape.net account that recently has been getting flaky. Anyone
        have any recommendations for yahoo, hotmail, or anything else? Thanks.
        \_ CSUA
        \_ You have broadband?  Host yourself.
                \_ No broadband. I need to use a web-based provider.
                        \_ http://www.horde.org/imp
                           http://www.squirrelmail.org
                           Work a charm, fast, and I'd trust them a lot more
                           than a free mail provider.  -John
                           \_ Work a charm, foreigner!
                                \_ Fine.  "They work very nicely", you
                                   pedantic hun.  -John
                                   \_ That's Normandic Anglo-Saxon to you.
                                      \_ How about trailer trash honky?
2003/6/10 [Computer/SW/Mail, Computer/SW/Security] UID:28688 Activity:high
6/9     is anyone using the following SSH client?  Is it any good?
                ssh windows client
                version: Aug 4 1998 (32)
                by: Cedomir Igaly, 1995/1998
                Revision: 2.100
        \_ If you're just looking for a recommendation, either SecureCRT
           or TeraTerm Pro have worked well for me.
        \_ Agree with the above, or putty (simply because it's the first google
           hit on a search for putty, and is a single executable of about 500k.
           i call it my tissue paper ssh client) --scotsman
        \_ I use the free non-commercial ssh client from http://ssh.com. Works fine
           and allows for easy file transfers.
           \_ It also has the advantage of recognizing urls and letting you
              click on them, which i like since i follow every link posted
              on CSUA.  It has the disadvantage of being very bugy.
              \_ buggs ar eprobabyl frm cdoing typos, eh?
        \_ PuTTY works very nicely:
           http://www.chiark.greenend.org.uk/~sgtatham/putty
           \_ Indeeed, I switched from TTerm to putty and haven't looked back
              (the single executable/no install is very nice).  It does X
              tunnelling which IIRC TT doesn't.
              \_ Actually, TT tunnelling is pretty good, and does X fine.
                 \_ Yup, and teraterm cut/paste is much more friendly.  Also
                    its UI is much leaner, which I prefer.  TeraTerm will also
                    do serial connections, which IIRC putty does not.
                 \_ Does TT do protocol 2 yet?
                    \_ Not the last time I checked.  That's the *only* reason
                       to use putty.
        \_ cygwin
        \_ SecureCRT, hands down! Putty is not bad, but SecureCRT has
           almost everything you ever wanted in a telnet client. Ultra
           robust, highly customizable.
2003/6/5 [Computer/SW/Languages/Misc, Computer/SW/Security] UID:28642 Activity:high
6/4     Does anyone know if there's a web interface for FORTRAN?  Basically,
        I want to write and run FORTRAN programs from a Web browser without
        having to install anything on my desktop.  Thanks!
        \_ no
        \_ Hmmm. If your goal is just to write FORTRAN programs without
           installing on your computer, you could SSH into soda and
           use g77. Is using a web browser really important? Maybe
           the Java SSH interface would suffice.
           \_ Thanks for that thought.  I have a need where it would be more
              than just myself and not all my users would have an SSH
              client... I just figured Web browsers are ubiquitous.  Also, I
              was hoping for a richer UI.  Any other thoughts?... I
              appreciate any ideas.
        \_ How about install a VNC server?  VNC has java applet client
           and it works reasonably well.
           \_ The problem with VNC is all users share the same desktop.  So
              if two people needed to work on their own project, they
              couldn't.  I didn't mention this as a requirement previously
              so I definitely appreciate the suggestion... but I cannot use
              it.  Please keep 'em coming, though.
        \_ you can run them from a browser as a cgi like anything else.
           writing them is no different than any other web based input system
           that you see message boards,etc using.
           \_ In other words, you mean use an HTML TEXTAREA where the
              programmer can write his/her code; but when the submit button
              is clicked, the code is fed to the FORTRAN compiler on the
              server?
              \_ something like that.  In short I mean "use CGI".  that's what
                 it's there for.
        \_ more stupid idea.  How about install an X-client on the
           FORTRASH computer, install an X-server on your own computer,
           and access that way?  It will resolve the problem.  I know,
           you said you don't want install anything on your computer, but
           i personally think an x-server should be an exception: everyone
           should installed X-server (and FTP server :p )
           \_ and a kazaa server and put at least 200 gigs online so we can
              all share because the information wants to be free!!!  you're
              truly brilliant in a k-12 sort of way.
2003/6/4 [Computer/SW/Security, Computer/SW/OS/Linux] UID:28627 Activity:high
6/2     So why did Anonymous Motd Censor remove the DIY Cruise Missle link?
        \_ No one can truly understand the motives of AMC. Anyway here is the
           link: http://www.interestingprojects.com/cruisemissile
           \_ thanks for restoring the link.  Now even I am curious and
              want to build a pulsejet myself :p
        \_ Because it had nothing to do with RIDE BIKE! or USE LINUX! of
           course, which are the only topics that are allowed to be of any
           interest to the "Berkeley computer science community".
2003/5/20-21 [Computer/SW/Unix, Computer/SW/Security] UID:28496 Activity:moderate
5/20    sun gurus, please help.  My ultra 5 had some problem getting out of
        suspend.  I had to power cycle and do nvram-default to get it to boot
        up normal again.  Everything is up now.  But the system is EXTERMELY
        slow.  I don't see any processes hogging up memory or anything strange.
        I think the previous bad suspend left some bad stuff around that's
        screwing up the system.  What should I look for to get it back to
        normal again?  Thanks!
        \_ It's an ultra5.  How fast could it ever have been?
           \_ I type 'top' and it takes 10 seconds for the display to come up.
              Similarly with other commands.  It's not environment related
              because using the same dot files on another machine works just
              fine.
              \_ vmstat, iostat
        \_ Don't use suspend. There is no point and it has problems. --dim
        \_ When suspend hoses me I try this from the ok prompt:
                boot -s
           when it asks for the root password, I hit control D.
           The machine should then come up fine.  I login
           as root, I remove /.CPR or /var/.CPR and edit
           /etc/power.conf so I don't get hosed again.  If you chmod
           /usr/openwin/bin/sys-suspend not to be executable, that
           will prevent accidentally suspending via the sleep key.  -ax
           \_ Just pkgrm the power related packages.
           \_ pkgrm(in this order): SUNWcprx SUNWcpr SUNWpmux SUNWpmowm
              SUNWpmowu SUNWpmowr SUNWpmr SUNWpmu
2003/5/19-20 [Politics/Domestic/SocialSecurity, Computer/SW/Security] UID:28490 Activity:nil
5/19    My refinance showed someone (LA) is using my SSN. What can I do?
        Who do I report this to? This is a serious question. thx.
        \_ First contact the police.  One of the things they will do is
           give you a form with a lot of different crdit agencies to
           contact.  Contact all major credit card companies as well.
           Although you can get a free credit check if you suspect fraud
           you get the wimpy version, so you want to shell out 25 bucks
           for the full one you can double check.  Hell, you probably want
           to do it every couple of months for the next half year or so.
           Yes it is a bitch, I've been there before, but it the long
           run things got corrected and the person stopped using my SSN.
        \_ Call your local SS office.  They will give you the number of the SS
           Inspector General.  That office handles stuff having to do with SS
           fraud and criminal activity.
           \_ And the IRS. When you contact the three credit agencies,
              ask to put a freeze or a fraud report on your listings.
        \_ See if you can get an address and kill them.
2003/5/12 [Science/GlobalWarming, Industry/Startup, Computer/SW/Security] UID:28410 Activity:very high
5/11    http://www.workingassets.com - just a decent phone company that puts
        money toward good (progressive) causes (for when your email to
        your congressman stops making you feel good).
        \_ Shouldn't they be giving the service free!??  Capitalist swine -
           you are a sell out.
           \_ yermom gives it out for free and she's still swine.
        \_ If they are the cheapest and give (your) money away, then this
           is great. o/w give your own money away, and get the charitable
           deduction for yourself.
           \_ the nice thing about opting for world conscious services such
              as this one is that you show market preference for that type
              of corporation ethic. other companies will clean up their act
              if they see that the conscious stick gets customers.
              \_ wow.... I didn't know people actually believed that....
              \_ Kinda like the U.N. I imagine.
                 \_ Except the UN doesn't make a profit, isn't at all 'world
                    conscious', doesn't provide real services, has no
                    competition, and continues collecting money from it's
                    'members' no matter how well or poorly it does providing
                    no incentive to improve, and has no effective means of
                    controlling either it's own members or it's own staff,
                    officers, and executives who don't ever get reviewed,
                    demoted, fired, or replaced, and is trying to take over
                    the entire world and reduce your national level rights to
                    zero.  Yeah, kinda like that.
                    \_ Except for the profit thing, this sounds exactly
                       like Microsoft!
                       \_ You think the UN and MS are in cahoots?
2003/5/8-9 [Computer/SW/Security] UID:28377 Activity:high
5/8     I'm suing someone and it turns out that he gave me a fake address
        and I can't serve the paper. What should I do now?
        \_ why don't you post this to the motd three or four *more* times?
        \_ hire a private detective.
           \_ This is correct, assuming you don't have a cheaper option.
              (Like a phone book.)  I can put you in touch with a good one.
                -jrleek
        \_ What's the guy's name?  Maybe we know him.  Or is it a fake name?
           And you still haven't told us what information you do have on him:
           driver's license, license plates, etc.
        \_ If the above does not work, but you have his real name and a
           general idea of where he lives, you can petition the court for
           service by publication. However, that should be a last resort
           because it can get somewhat expensive.
                \_ I have his real name and a general idea of where he lives.
                   What is service by publication and how much is it?
                   \_ Service by publication means that you take out ad
                      space in the local newspaper(s) saying "Hey, I am
                      suing you - Call me for details." If the person fails
                      to answer within a certain time, you can take that
                      person's default. Then you hire a private investigator
                      to find the person and his assets. The cost depends on
                      the judge, particularly on how many publications and
                      for how long - check your local rules, but hopefully,
                      you are in a situation where you can recover costs
                      and fees. Also, lest I forget, service by publication
                      generally does not work for small claims matters, but
                      once again, check your local rules.
2003/5/7-8 [Computer/SW/Security, Computer/SW/OS/Windows] UID:28364 Activity:high
5/7     "Microsoft Plans Toilets With Web Access "
        http://csua.org/u/e60
        Now, who wants to use a keyboard that has been touched by a thousand
        other people while they wiped their butts and genitals?
        \_ Only a thousand?
        \_ This is a question you may not want to address to motd users.
        \_ Well, you used the lab computers, didn't you?
           \_ Oh no!  And I was eating my sandwich with bare hands too!
           \_ Yeah I always used gloves if you used it before me.
        \_ This was on the motd almost a week ago.
           \_ yes, although there was no explicit mention of genitals the
              first time.
        \_ Great, more shitty products.
        \_ I'd hate to be in there when the server crashed.
2003/4/30-5/1 [Computer/SW/Unix, Computer/SW/Security] UID:28273 Activity:low
4/30    So can someone comment on the problem(s) with /var?  Why does it keep
        filling up, what are people doing to fix the problem each time?  Maybe
        somebody here already knows a longterm solution.
        \_ It is some attachment problem. It goes away on its own.
           Jon thinks it is related to SA. I cannot tell anymore than
           that because I do not have root. You should email root or
           the politburo for answers to questions like this. -ausman
           \_ actually, it goes away when someone with root comes along
              and cleans out whatever file(s) causing the prob.
2003/4/28-29 [Computer/SW/Security] UID:28247 Activity:kinda low
4/27    I share a shell-SSH-SCP account using ssh-keys.
        Is there a way to log SCP access history of the other users.
        \_ don't share accounts.  and no you can't create a log that you can't
           delete.
            \_ What about a log that could be deleted? possible?
               The intent of the log is not to log the technically
               sophisticated folks who could delete it, but to
               keep track of the stupid people. Where can I get
               web-hosting with multiple accounts and a group as well?
2003/4/20-21 [Computer/SW/Security] UID:28175 Activity:nil
4/20    John, a question about swiss bank accounts (since you're there).  I've
        heard some news that they're going to stop issuing those secret
        accounts where you don't need any ID to open one.  Is that true?
        And do you know of any banks there that use biometric data to access
        the account?  Like retinal scan or some finger printing device.
        Thanks.
        \_ There haven't been any id-less Swiss bank accounts for a very
           long time now.  A 'numbered' account simply means that once
           you open an account, there is no longer an association between
           your name and the account #--you lose the number, you're screwed.
           Swiss banks nowadays do a lot of checking to make sure cash isn't
           "dirty"--this includes verifying your ID.  The main attraction is
           the secrecy you get once the account is open.  They generally don't
           tell anyone.  For even more confidentiality and better service, I'd
           look at Liechtenstein.  Also, I know of no banks that do biometric
           ID for the type of money that you or I are looking at.  And for
           very large accounts (> $5 million) the service is usually personal
           ("private banking").  There's still a huge legal gap regarding
           biometric ID and digital non-repudiation in most countries.  I'd
           be glad to ask around, though.   -John
           \_ If the account # and some password or passphrase is the only
              thing you need to to access the account, isn't that dangerous?
              If either of the two is stolen you're screwed since they don't
              check IDs (rather there's no ID to check). That's why i thought
              of some biometric system.
2003/4/17 [Computer/SW/Security] UID:28156 Activity:very high
4/17    In veneration of his computer science forbears, it is decided that Dan
        Holliman will change his name to Dan Hollerith. danh, we expect
        compliance and certifying documentation from the Social Security
        Administration in a reasonably short time. Thank you and good night.
        \_ huh?
           \_ Perhaps a reference to the hollerith format flag in Fortran77?
              -- ulysses
2003/4/15-16 [Computer/SW/Security] UID:28135 Activity:very high
4/15    What is a one-time pad, and why is it considered bad/insufficient
        for security?
        \_ Yeah, why is a one-time pad insufficient?  Snicker. - !OP
         \_ a one-time pad IS insufficent if it is the only thing
            you are using for security.  There better be some intelligent
            system for sharing one-time pads/keeping them secure, etc.
            Stop being an ass.
            \_ So you're saying a one-time pad is insufficient if it is used
               stupidly?  Is there a security protocol that is sufficient
               even if used stupidly?
                \_ I'm saying that used alone it is far from sufficent because
                   there are far too many unresolved issues.
                \_ declaring war on iraq
                \_ which begs the question: if your system is idiot-proof,
                   won't someone just build a better idiot?
        \_ It's an encryption algorithm: to send a (say) 5K message to your
           friend, first generate 5K of random bits (the "pad") and share
           those secretly with your friend.  Then, to send your message,
           just xor each bit with the corresponding bit from the pad.  You
           can't ever reuse pad data; you have to generate new random bits
           for each message you want to send (hence the "one-time").

           This algorithm is cool because it's provably unbreakable: if
           someone sees your encrypted message, but has no information about
           your pad, then it's impossible for them to decrypt your message.
           However, this algorithm is usually not practical, because you have
           to secretly share 5K of pad data for each 5K message you want to
           send.  (For comparison, an ordinary private-key encryption
           algorithm like AES lets you secretly share a small key (128 to
           256 bits) and then use that key to encrypt as much data as you
           want.)
        \_ because you're all being stupid and noone signs their names:
           OTPs are useful for when you have only occasional trustworthy
           contact with your sender/receiver (in-person contact, trusted
           monthly courier ...), and have a need to share relatively short
           messages in a highly secure fashion.
           to respond to some of the points attempted above:
           1) if you have a way to get someone a pad in a secret [trusted]
              way, why not use the same way to transmit the message?
              Because the way you transfer the pad may not be available
              when a message needs to be sent.
           2) if you get part of the pad, you can decrypt part of the message.
              If you get an AES key, which is comparable in size to the
              supposed partial pad, you get the whole message.
           Issues of key management aside (which affect all crypto systems),
           OTP offers the user high confidence at the expense of convenience
           (large, non-reusable keys) and reliance on periodic OTP refreash.
           (large, non-reusable keys) and reliance on periodic OTP refresh.
           --4554660b1f82fae1e048ff6c1874d31b
           \_ I think everyone who cares already knew that, since among
              other things the OTP is about the simplest cryptosystem
              imagineable. you have been trolled.
              \_ only so that I could get the guy below to respond.
                 sometimes you gotta take a troll to get a better troll.
                 --3210615175eaa726402a9001bf8dbc6a
           \_ OTP does not offer high confidence except in highly
              controlled environments because there is no way to
              perform adequate message authentication in OTP:
              1) If the recv'd msg is off by even one bit/char the
                 message won't make any sense. While single bit/char
                 errors might be noticed in the decrypted PT,
                 multi-bit/char errors that can change the content of
                 the message without being detected (this depends on
                 the language, but for things like english the
                 probability of detecting multi-bit/char errors is not
                 that high).
              2) If OTP is used for messages transmitted via a public
                 channel the big problem is that there is no way to
                 ensure that the message you recv'd was transmitted by
                 the person that should have sent it. In some cases
                 an attacker can mount a DOS on the system by tx'ing
                 fake messages.
        \_ Why is it one-time?  Why can't the same pad be used again to
           transmit a different message to the same receiver?
           \_ If a pad is reused, a pattern is formed in the ciphertext
              which can be exploited by an opponent via a Analysis in
              Depth Attack. Some of the venona decodes were the result
              of the Russians reusing the same pad for multiple (different)
              messages.
2003/4/15-16 [Computer/SW/Security] UID:28129 Activity:very high
4/14    So I quit my company 2 months ago but I'm still getting paycheck
        from them. I'm pretty sure something's wrong with the accounting.
        I guess it's just a matter of time before they find out. Can they
        legally withdraw money from my account when they find out?
        \_ accepting a paycheck from a job you no longer work at
           is fraud, end of story.  return the money and get on with
           your life.
        \_ Tell the payroll office about it now, and don't be helpful about
           returning the money you have.  You can hope that interdepartmental
           politics will keep payroll from contacting legal and you might get
           to keep it.  The moral thing is something else of course... but
           you did quit, so maybe they screwed you over?  Eh...
        \_ Blow up the accounting office or hack their computers.  Be a MAN!
        \_ of course.  it's their money.
        \_ it depends.  If you're getting paper paychecks then no.  But they
           can sue you for it and will win.  If you're EFT then yes they can.
           Either way, I wouldn't spend the money until they're out of
           business plus a year.
        \_ Why can't the guy quit while he's ahead?  That is, close the
           bank account.
           \_ Because they'll just sue him and he'll lose.  Welcome to the
              world of adults where accountability exists.  Silly rabbit.
        \_ No. BUT... Since you know you're not working for them, any money
           received works as a claim of fraud. Since it's been a couple of
           months and probably a good amount of money recieved, you could be
           charged with embezzlement and felony fraud. Notify the company and
           arrange to return the money. If you withdrew against this money,
           it adds credence to the charges. After two months of getting checks,
           you'll be hard pressed to claim ignorance and proving "good will"
           in notifying the company of the error. Return the dough and hope
           they don't ask for interest back.
        \_ This happened to me and a fellow coworker at Cisco. He told them
           after the first paycheck arrived and they told him to keep it...
           I mailed them after receiving three paychecks (~$5K) and they
           never mailed me back but stopped sending checks. A few months
           later I deposited the checks into a money market account. I didn't
           touch the money for two years. It's been three years since. ymmv.
2003/4/9 [Computer/SW/Security] UID:28051 Activity:nil
4/9      If I have access to a POP box full of mail, what's the easiest
        way to get all the messages currently in the box forwarded to
        somebody. I don't have access to the mail spool for this POP
        box.
        \_ fetchmail from the pop account and then forward.
2003/4/5-6 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:28002 Activity:high
4/5     On the http://netzero.com Terms and Conditions:
                * Software Downloads. As part of the NetZero Service,
                NetZero may from time to time download software
                owned by NetZero or third parties to your computer.
                Your use of the NetZero Service constitutes your
                consent to such downloads.
        What is this about?  What type of software would they want to
        download to my computer?  Is this to scan the files on my computer,
        or likely something more innocuous?
        \_ something to do with ads maybe?
        \_ why do you want to use netzero anyway? there are other choices that
           are cheaper and have worked okay for me. e.g., joi internet.
                \_ Thanks for the tip!  I'll switch to joi.
           \_ does joi require you to use their own software?
                \_ no.
        \_ Welcome to Gator hell.  Tried Ad-aware @ http://lavasoft.com?
           \_ Ad-aware sucks. Get Spybot Search and Destroy
        \_ It probably means pop up and other ad crap, data mining, and similar
           spyware crap.  Legally it means *anything* they want and they're
           on safe legal ground.  Some third party ware installed via them
           steals your CC or tax info and you're a victim of ID theft?  You're
           SOL.  Don't be cheap, get real net service without T&C like this.
         \_Just hack Netzero and get around their software. I used to do it
           when their accounts were free.
           \_ Why bother?
2003/4/1-2 [Computer/SW/Security] UID:27947 Activity:low 63%like:27920
4/1     OpenSSH 3.6.1 is out. Fixes some interoperability problems with
        other implementations.
        Portable: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.6.1p1.tar.gz
        OpenBSD:  ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-3.6.1.tgz
        \_ Thanks, installed.  --mconst
2003/3/31-4/1 [Computer/SW/Security] UID:27920 Activity:low 63%like:27947
3/30    OpenSSH 3.6 will be out shortly. Changes include RSA blinding
        and proper handling of priv. sep. when root login is permitted.
        Portable: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-3.6p1.tar.gz
        OpenBSD:  ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-3.6.tgz
        \_ Thanks -- I've installed it in /usr/local/bin.  --mconst
        \_ thanks
2003/3/26-27 [Computer/SW/Security, Computer/SW/Unix] UID:27858 Activity:moderate
3/26    I just upgraded to Bind 9.2.2 and it seems that I can no longer
        get responses from roots a and b (the other root serves work
        fine). I've checked the routing, I can get to a and b, I just
        can't get a response from them. Anyone else have this problem?
        Any suggestions about where to start debugging? tia.
        \_ I had a different problem.  bind8 stopped being able to query
           the root nameservers at all.  So I upgraded to bind9.
           --scotsman
2003/3/26 [Computer/SW/Security] UID:27853 Activity:nil
3/25    Anyone know if ther are providers that will sell DSL service
        without phone service?  I've had it with AT&T/Comcast. --jwm
2003/3/20-21 [Computer/SW/Security] UID:27768 Activity:high
3/20    anywhere to get an SSH2 client, someone just stole my SSH 1 since
        i am using teratermpro and ssh for it (ie: a friend stole it)
        \_ putty is a free ssh client for Windows.
        \_ http://software.berkeley.edu or http://www.ssh.com if you're not a student
        \_ stole it?
        \_ huh? I thought teratermpro is free at first place.
2003/3/19-20 [Computer/SW/Security, Computer/SW/Unix] UID:27751 Activity:high
3/19    How did mconst fix /var, and what was wrong with it?
        \_ The mail I sent to root is now in ~mconst/pub/var-mail.  --mconst
           \_ thanks, that was informative.  Shouldn't that file be made
              unreadable by non-root though?
              \_ I think everything in there is public information -- but
                 please let me know if I missed something.  --mconst
                 \_ I'm sorry, I meant /var/account/acct.  It seems like
                    it contains somewhat private information of little use
                    to non-sysadmin types.
                    \_ You're absolutely right.  Fixed, thanks.  --mconst
                       \_ Does anybody else find this polite exchange as
                          refreshing as I do?
                          \_ Actually...yes.       -mice
                          \_ PURE.  REFRESHING.  MCONST.
        \_ Someone was trying to rotate accounting logs, and failed
           miserably.
2003/3/13 [Politics/Domestic/911, Computer/SW/Security] UID:27686 Activity:very high
3/13    http://www.usatoday.com/usatonline/20030313/4942670s.htm
        "Much of the information on Mohammed's laptop computer was protected
        by an encryption code that CIA analysts cracked easily, U.S.
        intelligence officials said."  It was probably RSA or PGP.  What else
        is he likely to have used?  Something from MS?
        \_ They threated to kill his preteen kids if he didn't give them
           the password.
           \_ Damn those unsecure end nodes.
        \_ Microsoft Visual ROT13++
           \_ Microsoft Active Visual 2ROT13#.
              \_ Be sure to download the first three patches and upgrade
                 before using. The fourth patch allows you to encrypt, but
                 won't decrypt non-MS ROT13 encryptions. They are still working
                 on it...
                 \_ This stuff is getting so old it's not even funny anymore.
                     \_ This stuff is still funny, because it is still
                        the case, despite how long it has been the case.
        \_ Any system in which the key is shorter than the message is an
           inherently weak system. The only one "safe" encryption system
           is OTP (and even that is not safe if you have your own Guardian
           of Forever)
           \_ Guardian of Forever?  Is this some nerdy book/tv/movie reference?
              \_ Here's a cookie for you.
                 \_ I'm serious.  What is it?
                    \_ Watch TOS Ep. 28.
                        \_ so what the fuck is TOS?
                           \_ You do realize that no one is obligated to
                              answer your question, yes?
                           \_ Your geekdom passport has been revoked.
                              \_ 'cause we all know jocks r00l.
                              \_ oh no!  What WILL I do?  Oh that's right,
                                 have a life.  Never mind.
                                 \_ Sorry, but we don't buy it.  You've
                                    already proven you have no life by
                                    posting here.
2003/3/12-13 [Computer/SW/Security] UID:27668 Activity:very high
3/12    Call me paranoid.  How likely is it for someone to decode traffic
        sent to/from an ssh connection?  The encryption is done end-to-end,
        so if the govt is getting a copy of every packet between two boxes
        is it possible for them to crack it?  I'm not a technical guy BTW,
        I just know the high level functionality of these things.
        \_ If they really REALLY care and are willing to wait a couple of
           weeks before the traffic is decoded and have some insane amount
           of computer power... pretty unlikely.  There is a reason this stuff
           scares the shit out of the powers that be.
           \_ It is much easier for them to attack at the unencrypted endpoints
        \_ If the government wants to see your shit, they can get a tap for
           your keyboard or put a van outside your home/office and read your
           monitor.  You're only fooling yourself thinking ssh will really
           keep the United States' Federal Government from reading your shit.
           I suggest you find a good defense lawyer and send good-bye notes to
           your family and friends.
                \_ any URLS with stories from people this has happened to?
                   \_ http://www.you.com.au/news/1009.htm
        \_ If you are using SSHv1 there is a possibility that someone could
           read your traffic. If you are using SSHv2 (AES128-HMAC SHA1) your
           traffic will be unbreakable for the next several billion years
           assuming that (1) the RSA factoring problem is impossibly hard,
           (2) the Discrete Log problem is impossibly hard, (3) SHA1 is a
           true 1 way hash and can't be inverted in less than 2^80 tries,
           and (4) there are no weaknesses in the AES S-BOX.
           There is a further concern among some about the way that HMAC
           is performed in the SSH protocol, iirc SSH does E(K,P) HMAC(K,P)
           rather than the more secure IPSEC method E(K1,P) HMAC(K2,E(P)).
           I'll look this up in my notes and post later on.
           \_ It might take decades, or even centuries, but the quantum
              computers are coming.
           \- we've broken ssh session keys when we were "really really
              interested". ok tnx.
                \_ what size session keys and did you break them using
                   brute force or via some other method?
                   \- "we measure computing power in acres"
                        \_ how much ct did you need?
                \_ who's 'we'?
                        \_ "ok tnx" is the hallmark of PSB, and PSB works
                           at LLBL, so he could have "acres of computing power"
                           Was that you, PSB?
2003/3/6-8 [Computer/SW/Security, Computer/SW/Unix] UID:27610 Activity:low
3/5     All of a sudden my DNS server is not resolving http://mail.yahoo.com or
        http://calendar.yahoo.com. Everythign else I try seems to work. What could
        cause this?
        \_ is Earthlink your ISP by any chance?
           \_ no, why, do they have hte same problem? this is on my own dns
              server running BIND8.x
        \_
        ; <<>> DiG 8.3 <<>> http://calendar.yahoo.com
        ;; res options: init recurs defnam dnsrch
        ;; res_nsend to server default -- 127.0.0.1: Connection timed out
2003/3/5-6 [Computer/SW/Security] UID:27602 Activity:nil
3/4     Any recommendations for a website, email, and DNS service provider?
2003/3/5 [Recreation/Pets, Computer/SW/Security] UID:27600 Activity:high
3/4     This is good:
jose             CP       67.121.94.23      3:14PM  1:39 cat /etc/motd.public
        How do you cat something as short as the motd for over 1.5 hours?
        "So the guy at the bar says, 'that's no cat, that's my wife!'" hahahh!
        \_ you can pipe it through "more"
           \_ I guess...  why not just 'more $file'?
              \_ because $file expands to whatever $file is before the command
                 is execed.
                 \_ I was being generic.  I'll spell it out for the anal among
                    you and try again, "why not just 'more /etc/motd.public'?
        \_ or losing an ssh connection while executing the command.
          \_ Doesn't sshd use tricks to detect such stale sessions and kill
             them off, including all applications that belong to the same
             session?
          \_ maybe but it's pretty funky dropping a connection in the split
             second it takes to cat the motd.  im suspicious of this behavior.
2003/2/28-3/1 [Computer/SW/Security] UID:27563 Activity:very high
2/28    How come csua doesn't support imap, even when it's from csua itself?
        \_ imap is disabled, but imaps (imap + ssl) is enabled in
           /etc/inetd.conf.
           \_ the certificate is self-signed though.  wouldn't imap-over-ssh
              be more secure?
                \_ feel free to donate enough money for a verisign
                   cert.  imaps also works straight out of the box
                   with Outlook and doesn't require running a ssh tunnel
              \_ and you trust soda's SSH key why?
                 \_ I use the same key on all my production systems.
                    \_ And this helps why?  Your SSH fu is weak.  Train
                       harder.
                       \_ that way if I lose root i can login from anywhere
                          else just about because i use a passphraseless key.
                          soda's key is also on the auth'd list so its cool.
                          \_ that way if one of your machines is compromised
                             the '1337 h4x0r's have 0wn3d all your machines!
              \_ And self-signed certs are insecure why?  Your PKI fu is weak
                 train harder.
                 \_ do you memorize the signature on the certificate?  at
                    least with ssh, i need to verify the key only once.
                \_ A self signed cert presented by a server is equivalent to
                   yermom presenting a potential csua stud with a notarized
                   medical certifciate stating that the person presenting
                   this certificate is yermom and that she doesn't have any
                   up enough to go for it PKI fu boi!
                   the certificate is yermom and that she doesn't have any
                   stds where yermom was the both the obgyn who wrote up the
                   certificate and notary who signed it. Maybe you are hard
                   up enough that you'd go for it PKI fu boi...
                   \_ I only read email I have personally decrypted
                      with a PGP passphrase I store on a keychain attached
                      to my body at all times.  I am also very attractive.
2003/2/27-28 [Computer/SW/Security, Computer/SW/OS/Windows] UID:27551 Activity:moderate
2/27    13823 files on a brand new w2k machine with no other software
        installed.  I remember copying dos from floppy to floppy using one
        drive and had to do 26 disk swaps to get all the files....
        \_ Uh, my copy of DOS 6 is only about 3 or 4 floppies.
        \_ Did you count all the hidden files?
           \_ There were only 1 or 2 which http://sys.com put on for me after a few
              more swaps.
        \_ DOS 3.2 -- 2 LD 5.25" floppies.
        \_ DOS 1.1 -- 1 360k floppy.
        \_ MacOS 1.0 -- 1 400k floppy. 127k used, 273k free.
2003/2/27 [Computer/SW/Security] UID:27549 Activity:high
2/26    MAPI gurus - do you know how to get encryption on MAPI?  The online
        docs are nasty, i've even looked at lotus's docs out of despereation
        still nothing.
        \_ Notes uses a proprietary 'encryption' algorithm.  Little is known
           about it.  If you really want a certain degree of assurance that
           your mapi connections aren't being snooped, think about running
           ipsec.  There aren't many MAPI security docs, period.  -John
           \_ XOR!
                \_ 2ROT13!
2003/2/27-28 [Computer/SW/Security, Computer/SW/Unix] UID:27548 Activity:high
2/26    Wasn't csua passwd was compromised the other time?  Could the hacker
        had placed some program on csua that snoops our email?  I think my
        email account has been snooped on.  I send out a email to a friend
        giving him my server ip and port, but someone else visited my server
        since my friend was not able to access my server.  I got a foreign
        ip accessed my server.
        \_ obUsePGP!
        \_ obUsePGP! If you send messages in the clear anyone can read them.
          \_ PGP is useless until it is made more transparent. Even the people
             who invented it have agreed on this. The existing tools are simply
             too difficult to use and even people with clue end up sending
             clear text or gibberish by accident half the time.
             \_ The 'people'?  Perhaps you mean the person, namely Phil
                Zimmerman?  And what you've just suggested does not sound
                very much like the sort of thing Phil Zimmerman would say.
                Could you post a citation so we know you're not talking out of
                your ass here?  If you are just talking out of your ass, could
                you make a point of sticking your head up your ass before
                doing this in the future so we don't have to listen to your
                blather?  Thanks.
                \_ <Sigh> The most notable "blather" is Whitten & Tygar (1999).
                   cited in the GNU privacy handbook, chapter 5.
                   cited in the GNU privacy handbook, chapter 5. You are, of
                   course, correct that it does not very much sound like
                   something Phil Zimmerman would say.
        \_ What makes you think it's not a problem on your friend's end?
           \_ it may be possible too since the company uses MS Exchange and
              Outlook, but they are very good at patching up the security
              holes. =D  Have you ever had nimda.a/e on you machine? if you
              see httpodbc.dll in all your root drives, your machine is
              infected with nimda.e.  Most likely a hacker has already placed
              a backdoor in your computer...
        \_ More likely you were just port scanned.
          \_ but he wouldn't know the exact path of the file to call even he
          finds out that port is open.  I had NAT forward that port to my
          my server.  And the web app is under a specific context-root, also
          the file is has a unique url mapping.  I see the visitor access
          that exact path right after my email went out (well a few minutes
          later).
          \_ Foreign eh? Which country?
             \_ foreign=alien=non-local
        \_ You really should email root about this.
           \_ Ya, that way root will be more careful about reading ppl's email.
              Seriously though, what are the odds of someone having the
              patience to go through and read your email? Did you look in your
              apache logs to see what IP it was that looked up your site?
                \_ Don't knock the propensity of individuals to do what normal
                   people like you and I would consider a complete lack of a
                   life for intrusive purposes.  Security through obscurity
                   or even anonymity is not a good idea.  -John
              \_ last time I checked the IP belonged to http://prophetfinance.com, I
              took a look at it subnet ips, they tranlated to greet, pride,
              lust, stalin, roosevelt, churchill, etc <DEAD>.prophetfinance.com<DEAD>. It
              is probably managed by some Russian sys-admin since he seems to
              name the servers with Russian leaders.
              \_ Churchill and greet are my favorite Russian leaders!
                \_ Okay, machines with people names are name of Russsian
                leaders.  Damn, always some block head nit-picking posts while
                totally ignoring the main point
                \_ if you use a completely specious argument to back up your
                   contention that it's a Russian sysadmin and you get called
                   on it, I don't think it qualifies as nit-picking
        \_ What is your site anyway?
          \_ just some stuff to test my web configuration.
2003/2/24-25 [Computer/Domains, Computer/SW/Security] UID:27509 Activity:very high
2/24    Okay, I know this type of question has been asked before, but
        here goes. I'm currently using http://domaindirect.com for my
        registrar--they also handle my email (1 pop account + 5
        forwarding addresses + catch-all).  The problem is that they
        only provide www forwarding (with perhaps "url keeper" which
        wraps the page in a frame and it still looks like the domain,
        but is a pretty cheesy technique). Anyway, I'd like to move to
        a hosting service that allows me to keep the same (or better)
        email services, and do either web hosting or aliasing to (say)
        a http://dyndns.org site.  domaindirect costs about $35/yr. and I'd
        like it to be cheap, but I'm willing to pay more for better
        service if necessary.  Suggestions?
        \_ DynDNS
           \_ Um, did you notice that I mentioned dyndns?  Do they handle
              hosting?  Do they handle email redirects?  Do I have to run my own
              mail server?  Everything I checked about dyndns shows that it's a
              partial solution, not a complete one.
           \_ Um, did you notice that I mentioned dyndns?  Do they
              handle hosting?  Do they handle email redirects?  Do I
              have to run my own mail server?  Everything I checked
              about dyndns shows that it's a partial solution, not a
              complete one.
        \_ http://gandi.net is cheap. They won't do hosting but they'll handle
           mail forwarding and aliasing. the downside is they are in
           Europe and you'll get all your e-mail in French (and English).
           \_ I have had 5 domains with gandi for > 3 years now.  They are
              great, their service is fast, their TOS are unambiguous.
              Regarding the DNS, you can do it with the public DNS service.
              Look at http://soa.granitecanyon.com -- I found it very
              difficult to get working, though, but it does work.  And it's
              free.  -John
2003/2/24 [Computer/SW/Security, Computer/SW/Unix] UID:27506 Activity:high
2/24    http://csua.org/u/9db -finally they arrest the strike leaders.
        I wonder if that means oil will finally drop; the strike is 30%
        of the reason oil's been going up.
        \_ Yeah, I guess if getting rid of a corrupt political leader
           interferes with your getting a cheap tankful of gas by
           jailing a few brave souls, then god speed to ya'.
           \_ Gosh, in that case, would you like to join the general
              strike to remove a corrupt politician who gained his
              position through unconstitutional manipulation of a
              a corrupt electoral system?  At the least, you wouldn't
              mind if we shut down the economy for a few days to do so,
              right?
                \_ if the people of the United States had enough savvy and
                   guts to do just that I'd help in any way I could.
                \_ Yawn.  Your own media spent months trying to prove your
                   assertion and failed.  Go back to alt.conspiracy.
2003/2/21 [Computer/SW/Security, Transportation/PublicTransit] UID:27485 Activity:nil
2/21    http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2003/02/21/MN240732.DTL
        Crowd counting article restored, you censoring bastard.
2003/2/14-15 [Computer/Rants, Computer/SW/Security] UID:27415 Activity:moderate
2/14    What is a good internet phone card for calling China?  Thanks.
        \_ I usually use http://www.cybercalling.com  I don't know how it
           compares to others.  Is 3.3 cent good price for calling
           compares to others.  I thought it has good prices for China,
           Taiwan, and even US.  Is 3.3 cent good price for calling
           within the US?
        \_ http://www.pincity.com  : 4.9 cents (using local access #)
           http://www.onesuite.com : 3.9 cents (using local acesss #)
2003/2/13-14 [Computer/SW/Security] UID:27400 Activity:low
2/13    Looking for <DEAD>anonymizer.com<DEAD> like websites that are free. Thanks.
        \_ like water for chocolate.
        \_ get a colo somewhere and run squid on it. set up the acls
           so you and your friends can access it by others can't. Enable
           https to http proxying and you've got all of the features
           of anonymizer for next to nothing.
2003/2/12-7/5 [Computer/SW/Security] UID:27380 Activity:moderate
2/11    At what point (in the course of my login) does DISPLAY get set,
        and what does it get set to? I'm able to open X windows locally
        (using Exceed) from soda, but not from another box I have access
        to. On this other box, DISPLAY is not set and I'm trying to
        figure how to set it. Thanks.
        \_ Depends on the OS & login method.
           \_ please expound or provide a link? the offending box is
              running red hat, and I'm logging in over ssh.
              \_ The remote system's sshd should be setting it.  Make sure
                 that X forwarding is enabled on the remote system and on
                 your local system (try using ssh -v and looking for the
                 "X11 forwarding" lines); you might also want to make sure
                 your dotfiles aren't resetting your DISPLAY variable to
                 something wrong.
        \_ Can you figure out your local machine's IP address and then manually
           do "setenv DISPLAY local-IP-addr:0.0" after logging in to the other
           box?
        \_ Try ssh -X
           \_ ssh -x
2003/2/7-8 [Computer/Domains, Computer/SW/Security] UID:27337 Activity:nil
2/6     Anybody have experience with http://pair.com for web hosting?
        Any other recommendations for quality, affordable web hosting?
        What about hooking up my own computer to a fat pipe somewhere?
        \_ my friends like http://pair.com. i like <DEAD>zapatec.com<DEAD>
2003/2/7-8 [Recreation/Dating, Computer/SW/Security] UID:27330 Activity:high
2/6     What's the best remote flower delivery service?
        \_ Calling a florist in the remote area and being very exact in
           what you want (or give them free rein to create).
        \_ Don't use FTD or other large service. I agree with the first
           reply. --aaron
           \_ Except a lot of florists are part of the FTD network.
              And they will deliver FTD's standard arrangements.  Ask
              them if they are a FTD member before you order.
           \_ What's wrong with FTD? -florally clueless
           \_ http://FTD.com was the first commercial launch of a Java website
              \_ and then?
        \_ Fuck Valentine's Day.  Fuck it right in the ear.
           \_ BDG?  Is that you??
                \_ this sounds more like doesn't-work-with-cable-modem
                   guy (DWWCMG)
                   \_ What?
           \_ ERROR:  EAR HOLE TOO SMALL.
              \_ ~payam/squick.vt
        \_ If recipient is in SF, I've always gone with http://frenchtulip.com
           \_ I love Rose and Radish in SF myself, 415-864-4988. --chris
              \_ Is that a hint?
        \_ /usr/sbin/in.rflowersd
        \_ I hope that you are ordering flowers for your ex-wife's
           funeral. If you are ordering flowers for your girlfriend,
           DON'T. You might think that you are being nice, caring,
           considerate, etc. but in reality you are being drawn into
           a bottomless pit of despair. You cannot imagine the endless
           nightmare that your life will become if you allow yourself
           to be drawn any further into this woman's web. If you do
           not heed my advice the day will come when you will wish
           that you had tied a noose around your neck rather than a
           bow-tie.
           \_ Now that's more like it! bdg #3 fan
           \_ bdg, sign your post
2003/2/6-7 [Computer/SW/Languages/C_Cplusplus, Computer/SW/Security] UID:27322 Activity:low
2/5     I picked up this year's Taxcut and it won't import last year's turbotax
        files. I'm gettign idiotic errors where it either wants to treat my
        TT file as a TC file and then reports a corrupt file or it looks for
        a TC named .T01 file when it's clearly a TT .tax file. I've played
        around with filenames and even looked at hex editing the binaries.  Is
        anyone else trying to do the same thing?  Is it working for you?
        \_ importing is highly over-rated.  Name, address, soc security, etc
           can be easily typed in.  The only other thing you need to worry
           about is carryover capital losses (stock).  It's more complicated
           if you run a small business and need schedule C.  But you probably
           don't run a business.
           \_ Hmm. Well that sucks.  Thanks for the info.
2003/2/4-5 [Computer/SW/Unix, Computer/SW/Security] UID:27305 Activity:high
2/4     Anyone here use samhain?  Any opinions?? (It claims to detect LKMs)
        What is your favorite IDS/checksum program?
        \_ Isn't that a Danzig song?
        \_ snort
        \_ don't be cheap, buy a IDS blade that goes into your router or
           switch.  It offers much higher performance and it's more
           manageable.
           \- that cant detect something like people doing rlogin -> ssh ->
              su and typing root passwd onthe net can it? you can use BRO.
              but it sounds like the above person is looking for something
              run on the filesystem, like tripwire. i use veracity which
              might not be right for you. --psb
        \_ I don't use anything at all.  SSH2 ports open to world+dog if you
           can guess the root password, you get the whole site!  Over 5
           million active usable credit cards just waiting for the taking!
           And the best part is we wouldn't even know you'd broken in and
           stolen everything if you weren't an idiot about it.
2003/2/4 [Computer/SW/Security] UID:27299 Activity:nil
2/3     Soda's very own Nick Weaver makes news again.
        http://news.com.com/2100-1001-983197.html?tag=fd_top
        \_ So he's a "security expert" now?
           \_ Yes he is.
2003/2/1 [Computer/SW/Security, Computer/HW] UID:27266 Activity:moderate
1/31    I find that http://terraserver.microsoft.com is not detailed enough. And
        I've been googling for another one.  Can't seem to find another free
        server that provide satellite photos.  I used another service before
        a few years back but can't remember the site anymore.  Anybody know?
        \_ Call your local congressman today, and ask them to approve funding
           for the Total Information Awareness program.  Soon, the server you
           seek will come into existence.  Though your access to it may be on
           the 'need to know' basis...
        \_ Yermom won't show up on any civilian quality sat. photos.
                \_ Unfortunately, yermom does.
                   \_ You're thinking of the military quality army boot sats.
                       \_ No, I'm thinking "Yermom is SO fat ..."
                          \_ her blood type is "crisco"
           \_ TIA program stillborn.  Just another random pentagon concept that
              went nowhere.
2003/1/21 [Computer/SW/Security] UID:27164 Activity:high
1/20    Is there any tool on an SGI running IRIX 6.5 to play a .mp3 or .mid
        file?  I don't have root access.  Thanks.
        \_ um... build something in your homedir?  If you don't have write
           access to the sound device, you're just SOL.
        \_ Oh, I'm sure there are plenty of tools running IRIX 6.5
2003/1/20-21 [Computer/SW/Languages, Computer/SW/Apps, Computer/SW/Security] UID:27161 Activity:high
1/20    I have a pdf file that contains type 3 font.  Since it is bitmapped
        I can understand why it does not scale nicely, but why does it look
        jagged even at 100% on acrobat reader while the print out looks fine?
        How can I convert it to type 1 font?  The program dvistripp.exe
        that google points me to no longer seems to exist.  Ok tnx.
        \_ does this file have anything to do with ps2pdf? -chialea
           \_ Yes typically I have the ps file and convert it to pdf using
              ps2pdf or distiller.  I don't have access to the original tex
              or dvi files, however.  --op
              ps2pdf or distiller.  It seems to be the problem of the ps
              file, since many other ps files converts just fine.  I don't
              have access to the original tex or dvi files, btw.  --op
              \_ ps2psd does not do the right thing.
2003/1/18 [Computer/SW/Security] UID:27141 Activity:moderate
1/17    Do any other search engines besides google cache?
        \_ I think the question is do any others provide public access to
           their caches... I'm sure any reasonable search engine does
           caching on some level.
2003/1/9-10 [Computer/SW/Security, Computer/SW/RevisionControl] UID:27040 Activity:very high
1/9     I need an archive/revision-control system that keep the repository,
        which is left a relative public system, encrypted.  CVS does not seem
        to do that.  What is an (free/open-source) alternative?
        \_ Do you mean "encrypted on disk" or "requires encrypted
           transmission"?  CVS does the latter; you need to set CVS_RSH=ssh
           and do some more config on the server (there are howtos online).
           For the former, maybe a file system that encrypts data to disk?
           \_ I mean that the (CVSROOT) repository is encrypted on disk.
              I don't need heavy weight encryption.  It is to thwart
              opportunistic voyeur.  -- OP
              \_ rot13.
                 \_ rot26!
              \_ chmod 600 your cvsroot
2002/12/30 [Computer/SW/Security] UID:26940 Activity:nil
12/31   Essential System Administration by Frisch refers to a "wheel group"
        as being an added security feature for the assignment of root
        privileges.  Question: How is this an added security feature when
        having the stolen root password allows login as root anyways?  The
        author also mentions that this feature is not available in Linux, but
        used in BSD type OS's.
        \_ False assumption.  Given a wheel group, you can disallow external
           logins by root altogether.  This leaves at the very least a username
           trail if the source IP is spoofed.
2002/12/24 [Computer/SW/Security, Reference/Military] UID:26898 Activity:nil
11/22   [stupid airport security thread deleted.]
        \_ mandatory firearm safety training for everyone.  give every
           passenger a gun with rubber bullets.  terrorism problem solved.
        \_ Sheep
2002/12/20-21 [Computer/SW/Security] UID:26874 Activity:high
12/20   Is there a way to get SSH to do keepalives (for firewalls/dial-up
        sessions with inactivity timeouts?)  I currently do ssh -X and send
        an xclock over it, but I usually have more than one host open, and
        things get a bit cluttered.  -John
        \_ the inband keepalive is daemon configurable
        \_ the inband keepalive is daemon configurable -shac
        \_ I just have a script that echoes a character to the screen every 10
           minutes.  -- yuen
        \_ Put "KeepAlive Yes" in /etc/ssh/sshd_config
           \_ The line is already there.  Guess it doesn't work.
           \_ My office fw filters that so I do the same thing yuen does.
           \_ KeepAlive actually sends out-of-band so.. it's not what it
              seems.. you actually want ClientAliveInterval which sends
              inband.. however its ssh2 only and some ssh clients will
              barf when they see this packet.. if your client doesnt
              barf at it, then it will keep your session alive -shac
2002/12/17-18 [Recreation/Dating, Computer/SW/Security] UID:26831 Activity:insanely high
12.16   Does anyone here get the economist? my subscription expired two days
        ago and i want online access to an article called "Trapeze artists".
        if you could post it in /csua/tmp it would be most appreciated
        --tia.
        \_ So why not resubscribe, rather than steal?
        \_ Are you planning to resubscribe?
           \_ I just did, and I have the print version of the article, but I
              want to forward the article to a friend. Yes, I could scan it
              or snail mail him the original, but that's a pain. Or I could
              wait a month or two for my new subscription to kick in, but that
              is more lame.
                \_ Post a url to the article and your friend's email address
        \_ So you're asking someone else to commit copyright crimes and then
           put their name on it for you?
                \_ yes, I am actually. thanks for clarifying the situation
                   though. prick.
                   and I will forward it for you.
        \_ Thief.
           \_ copyright violation is not theft. look up thief and theft in the
              dictionary.
              \_ Sure it is.  You're taking or making use of something that
                 isn't yours without permission that normally costs money for
                 access.  Take the rest of your argument to slashdot or k5
                 where you'll find like minded thieves who care.
                 \_ that's not theft. theft involves taking away. "making use"
                    of something -- which isn't even a thing, is not theft.
                    for you to say otherwise is just like my stating you are
                    a cunt.
                    \_ Yeah whatever.  Take it to slashdot.  In the meantime
                       do you mind if I have sex with your gf?  It's not like
                       my making use of her while you're busy with copyright
                       violations is denying you your use of her.
                       \_ This is wrong on so many levels.
                         \_ Just another victory against copyright violators.
                            \_ i'm not the OP. i'm just saying it isn't theft.
                   \_ It only "normally costs money" because of a perversion
                      enshrined into law. Should breathing air cost money, too?
                      Would you support such a law, if passed?
2002/12/15-17 [Computer/Companies/Google, Computer/SW/Security] UID:26819 Activity:moderate
12/13   I was reading somewhere something that implied that google's popularity
        algorithm could tell if the link to your site in someone's page was
        "hidden."  Can someone here confirm: if I have a link to may page on
        another page that is either a.)  The same color text as background or
        b.) a "spacer" image that is a link.  Will Google discount that link?
        \_ No one knows how google really works.  A form of security through
           obscurity to protect their pagerank thing.

12/now  Hey do ya think we could get the motd any shorter and more boring?
        Let's see: 1) a link to chapter 1 of an old book, 2) trivial dns
        lookup issue, 3) emacs question with joke answer.  Why bother even
        having a writable motd if it's going to be stripped of *everything*
        worth reading?  There's no technical questions/answers, no cool
        stuff about, well... *anything*!  And it's always worse on the
        weekend when there's fewer bored people at work to add new things.
        [*laugh* and then the same idiot deletes this whole thing]
        \_ If you're so strapped for amusement that you rely on the motd,
           I weep for you.
           \_ weep away, just stop erasing everything. just because im pathetic
              doesn't mean im not right about others stripping the motd.
        \_ who knows?  what makes these fucking censors tick?  why do they
           want the motd to become pointless?  mysteries we may never know.
        \_ Instead of trying to beat the system, why don't you just try to
           make your page better and more relevant? How hard do you really
           think it is to detect that technique? Can you guess how many
           people we have who work on quality full-time to prevent this kind
           of thing? --aaron@google
            \_ because, 1.) I am starting a new service which competes with
               long-existing services,  Since I am funding this all myself,
               I can not affort to pay SEO's to place "legitimate" links on
               their already ranked web sites. 2.)  Part of the service i am
               offering to clients is that there page will not link back to
               my page which in turn links to a bunch of their competitors.
               This basically hozes me, since my competition creates sites
               that then link back to themselves, racking up points, but i
               am not going to be able to do this.  Because of this, my site
               could very easily be much better and "more relevant" and still
               not have as high a score as my competition. -cuek_saja@yahoo.com
               \_ If your site is good, people will come, regardless of what
                  you do.  If your site is bad, people will not come,
                  regardless of what you do.  If you are starting to ask these
                  sorts of questions now you have already lost.
                  \_ BS.  If they can't find the site, they'll never know
                     whether it's good or not.
                     \_ Consider: http://www.google.com didn't have to circumvent
                        google.  People found it because it was good.  Be
                        good, don't be evil.
             \_ As for your second question, i think the color trick would
                be easy to dectect but the image trick would be hard.
2002/12/10 [Computer/SW/Security, Computer/Theory] UID:26779 Activity:high
12/9    Story on Blum at
http://www.nytimes.com/2002/12/10/science/physical/10COMP.html
        Question - why is Blum "Professor Emeritus" of the CS dept when in
        fact he was happy enticed from Berkeley and is now ensconced at CMU
        with a full and productive lab?
        \_ Hey man, like what a traitor!  I can't believe that!  I'm just like
           ya know totally stunned and completely bummed!  And like he ya know
           stole an emerity thingy from us!  Man!
                \_Who said anything about him being a traitor?  Just wondering
                why he has this title, which means "Retired but retaining an
                honorary title corresponding to that held immediately before
                 retirement" when he's anything but retired.
        \_ From Webster's Revised Unabridged Dictionary (1913) [web1913]:
           Emeritus \E*mer"i*tus\, a. [L., having served out his time, p.
           p. of emerere, emereri, to obtain by service, serve out one's
           term; e out + merere, mereri, to merit, earn, serve.]
           Honorably discharged from the performance of public duty on
           account of age, infirmity, or __long and faithful services__; --
           said of an officer of a college or pastor of a church.
        \_ enticed by his wife, no less.
           \_ yet another reason why marriage is evil.  - bdg fan #3
2002/12/9 [Computer/SW/Security, Computer/SW/OS/Windows] UID:26754 Activity:high
12/8    Has anyone been able to get sound working when running DOS 6.22
        under VMWare?  I want to play old DOS games and having no sound
        sucks.  thx.  --sky
        \_ I know there is a windows program that emulates an old sound
           blaster so old dos games can use sound, maybe oyu can hunt that
           down and use it?
           \_ VDMSound? http://ntvdm.cjb.net
              \_ sweet.  I will try that.  thx  --sky
                 \_ It works great!  --sky
        \_ Maybe http://dosbox.zophar.net Doesn't do protected mode tho.
        \_ there are several dos emulators around.  Which game?
           \_ old DOS adventure games.  VDMSound seems to work with
              them all.  --sky
              \_ which ones? (just curious)
                 \_ space quest, king's quest, monkey island, maniac mansion
                    \_ for the LucasArts games, you should use ScummVM instead.
                       http://scummvm.sourceforge.net
2002/11/25-26 [Computer/SW/Security] UID:26630 Activity:high
11/25   How do I get openssh to work with s/key? I've got skey working and
        have passwords, but having trouble making openssh use them.
        \_ obGoogle
                \_ Google on "skey openssh" gives a million links on
                   the old ssh vulnerability
        \_ Why not just use password-encrypted authorization keys?
        \_ ChallengeResponseAuthentication yes
           in sshd_config. -geordan (who dares to give actual answers)
                \_ what should I then see when I do ssh -v in the
                   allowed authentications? publickey,password,
                   keyboard-interactive ?
                   should I continue to login as user or user:skey ?
                   do I need to change /etc/passwd or anything else ?
                   \_ Hm.  keyboard-interactive is my guess.  I don't
                      actually remember how to activate S/Key from the
                      client; I remember that OS X's ssh did it by default.
                      Why do you want to be using s/key with ssh, anyway?
                      -geordan
                        \_ sshing from untrusted machines
                           Tried this, but still didn't work. Any urls that
                           are openSSH specific?
                           \_ http://openssh.org?
2002/11/22 [Politics/Domestic/California, Computer/SW/Security] UID:26597 Activity:nil
11/20 How can I verify Soda's certificate?
       ...
       \_ No. You can't add self signed certs to your cert store.
          \_ yes, you can... the easiest way is if the machine is using
             the same cert for https... you can import it simply using
             IE... otherwise you need to manuall add import it, but it
             can be done.
             \_ Does the CSUA have a https site?  Still haven't found
                the self-signed cert ... -OP
             \_ Not all versions of OE/IE support this.
          \_ Really? That's dumb. Another reason not to use Lookout(tm)
             \_ A self signed cert has no meaning in the PKI
                model, since all it says that you vouch that
                you are who you claim you are. If you really
                want to implement the cert mgmt correctedly
                there is no reason to allow such certs into
                the cert store.
                \_ Point taken.  Where can I view this cert, and how was it
                   generated, for technical curiosity's sake?  And does the
                   CSUA have a cert for https?  -OP
                       \_ http://www.openssl.org has all the goodies
                \_ By the way, is self-signed certificate different from
                   a certificate that was signed by an untrusted CA (say
                   you have setup a certificate authority within your company
                   for signing certificates)
                       \_ self-signed: signed by untrusted (your own) CA
       \_ I like the original minty green certs best, but some of the more
          orange flavored ones that came later were ok too.
          \_ Before being bought out by RSA, Xcert minted their own brand for
             a promo ... labeled obviously as: "XCerts"! -OP
             \_ Sweet!
         \_ Another approach if you really want secure POP is to set up
            SSH forwarding on a local port to csua:110, then just set up
            Outlook to retrieve email across the SSH (i.e., localhost: 110).
2002/11/17-18 [Computer/SW/Security] UID:26571 Activity:kinda low
11/17   the last five paragraphs of from this article:
        http://www.cnn.com/2002/TRAVEL/11/16/airport.security.ap
        __
        Ed Karabinus, 56, was a security manager at Shepard Air Force Base
        in Texas last winter when he traveled through Dallas-Fort Worth
        International Airport and encountered inefficient screeners who
        didn't speak English.

        He decided to become a screener himself. He took the test, and in
        March he was one of 61 people hired as supervisors.  Eight months
        later, he has been promoted to federal security director, a new
        category of federal law enforcement officer, overseeing both Wichita
        Falls Municipal Airport in Texas and nearby Lawton Municipal Airport
        in Oklahoma.

        Federal security directors earn between $108,400 and $150,000 a year.

        Karabinus, who now drives a used Mercedes, motivates his screeners
        by saying, "Look where I went, guys, in eight months."
        --
        DAMN, where can I get a job like that?
        \_ There are always special people in all sorts of jobs doing really
           well.  They are the exceptions, not the rule.  The typical airport
           security jock is making $8.50/hr and will get a COLA in 2 years to
           $8.75/hr.
           \_ They are federal employees now making more than that. I don't
              know how much more, but more than $17k/yr certainly.
2002/11/15-17 [Computer/SW/P2P, Computer/SW/Security] UID:26558 Activity:nil
11/15   http://journalism.berkeley.edu/projects/biplog
        Coming soon, a real hostname. -dans
2002/11/14 [Computer/SW/Security, Computer/SW/Unix] UID:26540 Activity:very high
11/13   back to the question regards to my problem of being f*cked up
        by sys admin cuz they changed the UIDs... during the process
        changing user ID, is hard-link ever used to accomplished the task?
        I read somewhere that if hard-link is not being used carefully,
        I may never able to get those files couting against my quota
        unless the other person happened to deleted the file.  Is that
        true?
        \_ Please supply host IP address, login name and password
           and I'll check it out for you. It's too hard to debug with
           so little, random, information.
           \_ 198.137.241.41, gwb, bombiraq
        \_ Sounds like you need to pay a contractor to go in there and fix
           this idiot's mess.  While you're at it, fire the stupid bastard
           because he's making the rest of us look bad.  --real sysadmin
        \_ maybe your sysadmin is a BOFH who is persecuting you because you
           just can't seem to use english properly.
        \_ Napalm the fuckin bastard.  -John
           \_ thanks to all (except that grammar/spelling nazi, who didn't
              really contribute anything useful).
              For those who never step out of bay area / berkeley: you
              would be suprised that sheer concentration of *GOOD*
              system admin here at Cal, and alarming number of those
              who are considered as mideocre at best at for the rest of
              the world, even in an academic setting (where my account is)
              For the rest... thanks for putting up with all sort of mis-
              spellings and grammar errors from me.
             \_ Actually a lot of the world has some pretty stellar
                sysadmins;  however, usually they lack a good academic
                environment in which to hone their skills and find out about
                others doing the same stuff.  So they often end up doing crap
                jobs tucked away in some company somewhere, underpaid and
                underappreciated.  I'm enjoy introducing people like that to
                others in the field by organizing BOFs and the likes;  I'm
                always amazed at how little contact some of the good tech guys
                have to the rest of the world.  And I still say there are
                enough decent good root-types to go ahead and napalm the
                fuckin bastard.  -John
                \_ Ever owned a cat, John?  Or are you just spouting?
                   \_ Yes and yes.  -!john
2002/11/13-14 [Computer/SW/Security] UID:26535 Activity:moderate
11/13   http://privacy.yahoo.com/privacy/us/pixels/details.html
        \_ Your point?
           \_ I believe (s)he wants us all to click on that opt-out link.
                \_ bugnosis?
2002/11/6-7 [Computer/SW/Security] UID:26428 Activity:kinda low
11/5    Which free version of PGP provides a PGPDisk that works in WindowsXP?
        I'm considering the International and CTK variants.  Is any version
        more secure or trustworthy than another?
        \_ PGP is pretty good.
                   \_ HA HA HA HA HA HA HA HA. ha. ha. ugh. --aaron
        \_ Screw it.  PGP6.5.8ckt_build08 failed to install on XP, and
           PGP6.0.2i could not read my PGPDisks made by PGP6.0.2 Desktop
           Security in Windows2000.  Now my question is: What other pretty
           good encryption tools are there that does what PGPDisk does?
           -OP
        \_ nai actually stopped developing pgpdisk before XP and before their
           latest versions of PGP.. and even announced that they would be
           killing off pgpdisk entirely.. then sold of pgp to the current
           PGP Corp. which says they will have support for XP in v8.0
           which is currently in beta. check http://www.pgp.com -shac
           \_ Thanks.  I'm looking for something _FREE_, and their Freeware
              products do not include PGPDisk.
              \_ Cheap bastard.  Pay for it if you want quality products with
                 full features.  These people have to eat (sushi and Vik's
                 takeout daily) and pay rent (okay, well, condo association
                 fees) and buy shoes (and private school tuition and cell
                 phones) for their kids.
2002/11/5-6 [Computer/SW/Database, Computer/SW/Security] UID:26423 Activity:nil
11/05   What form of encryption is used for system passwords?  Is it
        possible to use that same form in mysql?  I would like to be able to
        take a users encrypted password from sql (which needs to be usable
        through mysql) and give them a system account once they have jumped
        through additional hurdles.  Is this possible? how? URLs appreciated.
        \_ ???  What's the project goal?
        \_ man crypt
2002/10/22 [Computer/SW/Languages, Computer/Rants, Computer/SW/Security] UID:26275 Activity:high
10/21   Is there any service that takes email and sends regular mail?
        Like bill pay, but with email instead of checks.  I should be
        able to set up "sendees" and they could print and send my emails
        to them.  Then i could correspond with my amish friends!
        \_ don't you have a printer, stamps, paper, and envelopes?
           \_ I'm VERY LAZY and am willing to pay someone else to
              specialize in that and get the economies of scale.
        \_ http://www.usps.com/mailingonline
            \_ cool, thanks.
2002/10/17-18 [Computer/SW/Security, Computer/SW/Unix] UID:26234 Activity:insanely high
10/17   Is there a really easy way to forward all port 80 packets to another
        machine? I want to migrate my web (but not mail/smtp/etc) packets to
        a new machine. I don't want any sort of HTTP redirects because I want
        the transition to be "seemless". Does my question even make sense?
                              \_ seamless
        \_ Any firewall software can do this.  Or you can point the DNS
           name at your new web server and use MX'es to keep the mail on
           the existing server.  Or use mod_rewrite.  -tom
           \- writing a generic "port forwarder" to listen on localhost:tcp/###
           and fwd that to A.B.C.D:### is pretty straght forward programming
           exercise. in fact it is possible ssh can do it for you. i have a
           tool i suppose i can send you which forwarded the pop protocol
           but it should work for WEEB by just changing the port number.
           [all WEEB is tcp, right?]. i seem to remember after looking at a
           breakin there was some crackerware to do this too. --psb
                                  \ are you calling nc "crackerware"?
           \_ This is what I was going to do. Either this or just use ssh to
              do the forwarding until I complete the migration.
              do the forwarding until I complete the migration. But I was
              hoping that someone had already written something (or gotten
              netcat to work as such) so that I don't reinvent the wheel...
              and don't have to worry about implementing error handling and
              so forth.
        \_ DNS!  Why does no one use DNS for this stuff?  The world wasn't
           meant to be hard coded IPs.  They made DNS for a reason.  You don't
           need clunky firewall kludges if you made proper use of DNS.  You
           wannabe sysadmins are getting more dangerous by the day.  Please
           tell me this isn't a commercial site.
           \_ because dns wont forward port 80 packets.  DNS will send all
              packets to that hostname elsewhere.  This is why a smart admin
              will point several names at the same host, each name for each
              service on the host, and then they can move the ip in the name
              for that service without affecting the other services.  I.e.
              csua www service is 'www.csua',  not 'soda.csua' (even those two
              names point to the same IP), so we can move www service if
              necessary without screwing other services.
              If you weren't so smart, firewall-NAT /packet forwarding/
              is your only option. -ERic
              \_ Thank you for the description of "proper use of DNS" as
                 mentioned above.  Anyone who doesn't know that DNS doesn't
                 forward packets needs to give up the root shell.
           \_ DNS switches are not "seemless".  Even if you have your TTL set
              properly, there is a whole world of improperly set up DNS servers
              (and microsoft DNS clients that mad-cache) that will not get up-
              dated the instant you want them to.  (Of course, just leaving the
              service up at site 1 for a while is probably better than port
              forwarding everything with good ol' nc  -The SysAdmin.
              \_ Gosh, you mean you actually figured out how to do a seamless
                 service migration with DNS?  Wow.  That was hard, huh?
           \_ 1) You are a dumbass, as everyone else already pointed.
              2) Even if what you said were correct (which it isn't), have you
                 considered the possibility that some people might be hard-
                 coding the IP's?
              \_ 1) No one said any such thing.  Learn to read.
                 2) It's correct and anyone who hard coded the IP's is a total
                    moron at step zero and shouldn't have root which was
                    already addressed earlier.  If you could read, you'd have
                    read that, too.
                 3) Learn to read.  Thanks.
              \_ [ inane baiting deleted. ]
        \_ OP here. Here's my solution:
        www stream tcp nowait nobody /usr/local/bin/nc nc my.remote.host 80
        im reposting my solution for the third time:
        tcpserver 0 80 nc ncc 80
2002/10/15-16 [Computer/SW/Security] UID:26195 Activity:kinda low
10/15   FYI OpenSSH 3.5 is out.
        \_ Interesting. Is there a ChangeLog somewhere that summarizes
           the changes in this release. In particular, I am wondering
           if PAM and auditing problems have been fixed in Solaris
           when privilege separation is enabled.
           \_ ftp://ftp.ca.openbsd.org/pub/OpenBSD/OpenSSH/portable/ChangeLog
2002/10/15-16 [Computer/SW/Security] UID:26191 Activity:high
10/15   I don't have a long dist carrier. I usually use 10-10-321, 811, 220,
        etc. What's a good plan to use?
        \_ http://www.onesuite.com  Cheap, no hassles, portable.
           \_ http://www.onesuite.com/faqs.htm#G13 , you can get 20 free
              minuts (hey that's like 60 cents)!
              but why don't they just bill the telephone like others?
              \_ onesuite is actually a calling card which you can access
                 through a 1-800 number or local numbers.  it is not a traditioal
                 long distance carrier.
2002/10/15 [Computer/Rants, Computer/SW/Security] UID:26185 Activity:very high
10/14   Why all the H1B posts? Our jobs, esp support and QA are already being
        exported to countries like India and China. There was a report from
        60 Minutes that says a few phone companies already shifted their
        phone support ops to India. They even train the workers to be
        knowledgeable about the American culture (football, beer, etc).
        Face it, many jobs are indeed exportable. IT is just a glorified
        auto/steel/whatever industry.
        \_ You're a Cal grad and doing phone support and QA?  Jesus F. Christ!
           Did you graduate with a degree in English or something?
           \_ I thought Jesus' middle initial was 'H'.
              \_ You don't know what the 'F' is for?
        \_ Agreed, IT = auto = steel = dockworkers.  However, since most
           motd readers are sys admins, they confuse themselves with
           real software engineers and architects.  We're not worried
           about H1B workers.
           \_ uh, it's the software development that can be easily exported,
              not the sysadmin work.  Think autoworker vs. policeman.  -tom
           \_ *laugh* As a sysadmin, the last thing I'm worried about is my
              job getting exported to another country.  No sysadmin confuses
              what they do with what a coder monkey does.  When a coder monkey
              fucks up, you get a bug which gets caught by QA (in India). When
              a sysadmin fucks up, the whole shop goes down.  No one is going
              to ship their servers to India.  Silly troll, cookies are for
              kids!
        \_ Recently had trouble with an http://amazon.com order. Emailed them
           (the only way to reach them) and all I got were replies
           from folks with Indian-looking names. All replies either
           had good english or good scripts or both. I suspect
           amazon support may be outsourced?
        \_ I have never gotten good customer service of any kind from
           an Asian-outsourced helpdesk.  In fact, this is the main reason
           why I refuse to buy anything from http://Amazon.com anymore.
           My experience with US helpdesk workers is mixed, although mainly
           positive (unless you're dealing with a fucked up company like Sony.
           The only consistently good tech support I've gotten was from Irish
           call centers (most European tech firms redirect English-language
           calls there.)  -John
           \_ Was on the phone with a Netapp chick in Singapore last night.
              She didn't fix my problem but had a sexy voice so I still logged
              the call as a "10" in their customer service records.
           \_ I have never gotten good customer service of any kind
              through the phone, period.  Almost.
              \_ B&H over the phone seems okay.
        \_ Exporting software jobs is the best thing that ever happened to
           the software industry.  Perhaps now, we will realize that many
           engineering positions are filled by glorified, semi-skilled
           typists (software).  Let's face it-  software systems are LARGE
           nowadays-  but innovation is the crux of value, not WPM.  Stop
           complaining about your obsolete job.  Coding is a monkey task
           that should be outsourced, not protected by some archaic notion
           of an ivory tower of academia.
        \_ Which is why I would recommend moving up to a more architectural
           or managerial level, to avoid your job being 'exported'. I agree,
           coding, not only a 'monkey task' as the above posted noted, is
           often considered a thankless job. Don't shoot the messenger, this
           is what I heard.
        \_ Put it this way.  Number of engineers produced per year in US:
           65000, in China 700000, and their quality is improving.
           \_ This is exactly the kind of reasoning upper management uses to
              justify H1b's shortly before they get a http://fuckedcompany.com entry.
              Because if 1 american engineer can do it in X days, then 10 H1b
              engineers can do it in X/10 days.  Right?  Good math.
2002/9/28 [Computer/SW/Security, Computer/SW/Unix] UID:26038 Activity:nil
9/28    I installed mysql 3.23.52_1 via pkg_add and I'm trying to set the
        root password-- but I don't know the default password.  This is a
        fresh installation, and I'm using
% /usr/local/bin/mysqladmin -u root password 'blah'
/usr/local/bin/mysqladmin: connect to server at 'localhost' failed
error: 'Access denied for user: 'root@localhost' (Using password: NO)'
% /usr/local/bin/mysqladmin -u root -p password 'blah'
        Also fails, because I don't know the stinking password.  I've tried
        the system's root password, "root", "toor", and various foul
        language.
2002/9/13 [Computer/SW/Security] UID:25874 Activity:kinda low
9/12    Has anyone else noticed that their ssh session tends to die as
        soon as they get notified of new mail?
        \_ never happens to me.
        \_ Mine is kindof twisted. If I have newmail running in the backgrnd
           I cannot seem to log out of my ssh session cleanly (it just hangs
           after the logout). But if I kill the newmail process prior to
           logging out, it works fine. (this is on a Debian Linux). Clues?
           \_ just a guess -- does newmail open an X connection?
        \_ try ssh -v when making connections.  without debugging info you
           don't stand a chance.
2002/9/12 [Computer/SW/Security] UID:25859 Activity:nil
9/11    I hate people who block ping requests, it is so annoying and of so
        little (in fact i'd go as far as to say NO) security value.
        \_ some people just block all icmp.. for valid security reasons -shac
2002/9/11-12 [Computer/SW/Security, Computer/SW/Unix] UID:25851 Activity:low
9/11    Is it commonly accepted to use rsync between two machines using a
        null passphrase? I haven't found any good workaround. The next best
        thing would be to type the key once per reboot, but that is
        inconvenient and the key stays in memory. So... after a few days of
        googling, root+null passphrase is the best I could come up with.
        \_ If it's a low security site, you can do the null passprase to a
           junk account and then have cron or whatever copy/move the files
           out.  jailed shells and what-not are easy enough to setup without
           jumping through too many flaming hoops.  Are these both internal
           machines?  Maybe NFS is the answer?
        \_ Install ssh, rsync over ssh instead of rsh and use a passkey.
2002/9/9 [Computer/SW/Security] UID:25820 Activity:high
9/8     Is @cal forwarding down again all day? What the hell? It's an
        embarrassment to Berkeley! Shit I should've never trusted them
        in the first place!! My ISP is far more reliable! They suck
        you in with a permanent email forwarding address and then the
        service goes down for days. Bunch of idiots!!!
        \_ Is there a number we can call about the service?
        \_ This gives Cal a bad name, just like the programming contest
           and Cal Football.
           \_ We've won our past three games against 5th tier teams!
        \_ I think it may have come back up.
2002/9/4-5 [Academia/Berkeley/CSUA, Computer/SW/Security] UID:25767 Activity:very high
9/3     I'd like to donate equipments (eg 160G HD) so that I can influence
        politburo members into giving me root access. How do I go about
        doing that? P.S. I'm an alumni
                                \_ alumnus (possibly alumna) or alum
        \_ are you female? I think most of them are tired of making love
           to mr.hand
           \_ rosie Palm and her five sisters are h07!
              \_ The Palm SEXtet (pun intended) will make you blind!
           \_ You mean *Miss* Hand?  Or are they gay?
              \_ No, you're just 100% clueless.
        \_ mail politburo. ask. -chialea
           \_ chialea!  I want to kiss you!  :-)
              \_ are you an eastcoast or westcoast stalker of hers? !fan
              \_ you're freaky
                 \_ No, they're dreamy!  --chialea #1 fan #1 fan
                                            \_ a.k.a. chialea
                                               \_ Incorrect.
                                                  --chialea #1 fan #1 fan
        \_ you're going about it the wrong way.  you need to bribe a single
           root person, not the whole politburo.  you don't want official
           access, just access.  social hacking.
           \_ is that how paolo got root?
           \_ Speaking of bribing, have the recent politburo requested
              alumni support yet for this year?
              \_ still not getting it.  you dont support politburo for root,
                 you buy some kid a few beers.  sheesh.  must i spell out
                 *everything* for you?
                 \_ Not looking for root, just wondering about funding.
                    \_ maybe they can request funding for a SCSI RAID card.
                 \_ if you're cute, you screw for root.
                    \_ The secretary?
                       \_ Good things I'm not sexy@csua anymore -chialea
                    \_ Get real. Sleep with csua root users instead of popping
                       5 bucks for cheap beer?  Son, not all sex is good sex.
                       You should go for the beer option.
2002/8/29-30 [Computer/SW/Security] UID:25734 Activity:high
8/29    Do you guys have a different password for every single account you
        own -- email, website, server, bank, etc?
        \_ Yes.
        \_ I have tiers of security-- like very secure, medium, and not at all
           secure. Usually as I retire my very secure passwords, I move them
           down to the lower tiers... except for the lowest level, which is
           almost always just based on my name or something.
           \_ I do this too.  I wonder how commmon it is.
           \_ How do you remember all the passwords?  I have like 10 passwords
              for maybe 30 accounts.  I can never remember which to use for
              what, except for the accounts I use daily.
        \_ I use the same password for all my accounts, home, work, root,
           hotmail, http://yermom.com pr0n sites, my secret password with Visa, my
           home security company, everything.
           \_ Have you been to http://yermom.com?  What a fucking stupid website!
2002/8/29-30 [Computer/SW/Security] UID:25732 Activity:high
8/29    Has anyone tried DMA? Does it really work? I'm afraid to use it for
        the same reason why I don't click on "unsubscribe me" from spams.
        \_ Yes it works. Both for mail and phone-based junk. It works best if
           you also request that the credit agencies not release your info as
           well and you foregoe mail forwarding when you move.
           \_ Those work very well for me, together with calling up companies
              to cancel junk catalogs under whoever's names and my address.
              --yuen
        \_ Direct memory access?  I love it.  Great stuff.  Works great and
           less filling at the same time!  Better than rogaine
        \_ No but I've tried MDA.  Is DMA some other analogue?
           \_ Direct Marketing Association, Inc.  http://www.the-dma.org
              The posters are talking about DMA's Mail Preference Service which
              helps you stop junk mail.
              helps you stop junk mail.  Saves time and trees.
2002/8/29-30 [Computer/SW/Security] UID:25731 Activity:low
8/29    Is there a website that tells you the elevation above sea-level
        of all the cities in the US (at least the major ones)?
        \_ No.  I have encrypted all of my copywritted material
           using an encryption algorithm based on US city elevation data,
           and releasing it now would be in violation of the DMCA.
           If you try to download that information from the web, I'll
           DOS your server.  -GIAA
        \_ Uh, Yeah, the first link from the google query:
        "us major cities elevation above sea level" -googled
2002/8/27 [Computer/SW/Security, Computer/SW/Unix] UID:25705 Activity:high
8/27    Is there a CSUA policy about deleting accounts of those who have died?
        Or is it a respect sort of thing to keep the account for the deceased?
        \_ There are deceased?
           \_ gene kan
              \_ What happened to him?
                 \_ He Cobained.
              \_ gene can do what?
           \_ was he active CSUA?
        \_ How about deleting accounts for those who have been inactive for a
           long time?
           \_ and... why?
              \_ To reclaim disk space?  Free up login names and UIDs?  Reduce
                 chance of break-ins since those people won't be changing
                 their passwords periodically?
                 \_ As if people who never really used their accounts are using
                    a lot of disk, someone else wants their name, we're near
                    out of UIDs or more than 1% of you slack bastards has
                    changed your password in the last 6 years....
                 \_ reclaim unused uids?  Doesn't the account creator just
                    add a new uid after the highest used one?   Are we even
                    anywhere near starvation for uids?
                    types.h lists the uid as:
                        typedef u_int32_t       uid_t;
                    So thats what, 4 billion possibilities?  I see only 2400
                    or so passwd entries.  Try another excuse to delete
                    unused accounts...

                    To reduce chance of break-ins?   I'd argue to delete the
                    active accounts -- theyre the ones most likely to have
                    their password leaked ( via social engineering , trojaned
                    software, or other means) or shared on another
                    site.
                    \_ ok genius so then why should the accts not
                       be deleted?
                       \_ The burden of proof is on those who desire
                          change in a functional environment.  They should
                          not be deleted because there is no reason to and
                          it would waste someone's time to do so.  Why
                          *should* any accounts be deleted?
                    \_ How come at line 2437 in /etc/passwd the UID goes up to
                       10958, but then at line 2438 it starts from 1003 again?
                    \_ I saw that old login names like achoi or choice no
                       longer exist.
                       \_ achoi/choice is now android. -geordan
                          \_ So any future Albert Choi or Ah-Ching Hoi can
                             re-use the login achoi.
                             \_ *hint*
2002/8/26-27 [Computer/SW/Security, Computer/SW/OS/Windows] UID:25694 Activity:high
8/26    After I save a file in win95, I need to process it from DOS prompt
        (to use with sftp for putty for example). I find the file name to be
        "currupted" - it's shorter and contains strange characters like "~".
        I know this must be a feature from MS but how to get around it and
        access the file from DOS using the real file name?
        \_ try using cygwin
        \_ the win95 shell displays that because it's DOS and DOS doesn't
           do more than 8.1 filenames. Just use those shorter names
           (i believe they show up correctly in windows), use the long name
           with quotes around it (i think that works) or better yet
           upgrade to win 2000.
        \_ if you use the short file name with scp, you'll lose the long file
           name on the other side.  you need to double quote the LFN to do
           what you're talking about.  or as the above say use cygwin or w2k.
        \_ By "DOS prompt", do you mean the DOS window in Win95, restarting
           Win95 in DOS mode, or plain MS-DOS 6.xx?
        \_ Enclose your long/full name with double quotes.
        \_ Use double quotes.
        \_ I think double quotes will do the trick.
2002/8/26 [Computer/SW/Security] UID:25689 Activity:moderate
8/26    Any recommendations for web hosting services with good latency from
        campus? Looking for cheap service to host low traffic www site.
        \_ Low latency?  You're playing quake from your campus office?
2002/8/20-21 [Computer/SW/Mail, Computer/SW/Security] UID:25623 Activity:very high
8/20    using gpg i want to associate someones public_key with a wildly
        different alias that they also use to mail me encrypted text.
        I skimmed the long man-page but didn't find it.
        \_ you really think the nsa cant read your text in real time?  get
           real.  they can spot the gpg signature and flag your packets to
           make certain a human reads the messages.  sheesh.  dont you know
           the best way to hide is in plain sight where your traffic looks like
           everyone else's and only the computers will read (and ignore) it?
           \_ (!OP): I don't care about the NSA. I care about business
              competitors, 1337 haxors, and the like.
              \_ w3 @1r3d33 0wNz y00.
           \_ (TOP) o.k. i love to ecourage trolls..
                1)  I'm trading commercial "secrets" not military ones so I
                    don't much care if some cypher-wonk in the basement of
                    the pentagon reads my mail.
                2)  By encrypting traffic "they"re not interested in i'm making
                    their job harder, if only a little, which makes me happy.
                \_ What mail client do you use to (en|de)crypt mail w/ gpg?
                   \_ mutt
                   \_ pine.  (flame away)
                \_ So you trust foreign governments such as the French who are
                   known to engage in industrial espionage for their
                   corporations not to steal your data and hand it over to
                   your competitors?  So much to learn, so little time....
2002/8/19 [Computer/SW/Security, Computer/SW/Unix] UID:25608 Activity:nil
8/19    http://www.kuro5hin.org/story/2002/8/19/2952/21932 - php gui sucks.
        \_ gui's are bad.
2002/8/15 [Computer/SW/Security] UID:25563 Activity:very high
8/15    I am familar with SSH1 but just put SSH2 on my computer.
        With SSH1, I know I put the contents of his identity.pub file in my
        authorized_keys file.  With SSH2, what is the analogous procedure?
        Do I do something with the snippet that begins
        "---- BEGIN SSH2 PUBLIC KEY ----" which he sent me?  Where do I
        put that on my server?  Thanks!
        \_ It depends on what kind of keys you use (SSH1 or SSH2 keys),
           what client do you use, and whether the server is running
           openssh or commercial sshd. In case of soda, you have to upload
           your public key to your account, convert it to the format the openssh
           understands using ssh-keygen command and then append it to your
           .ssh/authorized_keys2 file.
           \_ I think I need to add something in the .ssh2 directory.
              I am running with "SSH-1.99-2.4.0 SSH Secure Shell".
              \_ yes, consult the ssh2 man page
              \_ place the public key (the entire file from '---- BEGIN...'
                 to '---- END SSH2 PUBLIC KEY ----' in a file under .ssh2
                 then create a .ssh2/authorization file containing the
                 line 'Key pubkeyfilename' (where pubkeyfilename is the
                 name of the public key file you just created) - max
2002/8/8 [Computer/Domains, Computer/SW/Security] UID:25524 Activity:high
8/8     If I use <DEAD>foo.bar.com<DEAD> in a root .rhosts file, can someone who controls
        DNS server in his own domain set up one of his addresses to reverse
        to <DEAD>foo.bar.com<DEAD> and get into my machine?
        \_ If you're using rsh?  Probably.  ssh, if you have it configured
           to, will check to see if the remote machine's host key is
           correct.
           \_ Yes I know this wont work for ssh.  I think with rsh the only
              trick is to get him to look at your DNS server.  If you can do
              that, I think it will work.
2002/8/1-2 [Computer/SW/Security] UID:25470 Activity:high
8/1     Bugtraq reports that openssh-3.4p1 was trojanned on http://ftp.openbsd.org,
        and its mirrors.
        \_ Link?  And Is that what happened to csua?
           \_ http://online.securityfocus.com/archive/1/285492/2002-07-29/2002-08-04/0
           \_ Don't think so.  That seems to have affected the
              openssh-portable port.
              \_ which... soda runs...
                 \_ dont bring facts into this.  this is the motd, damn it!
                    \_ It's okay, they didn't.
                 \_ no it doesn't:
                    $ telnet soda 22
                    Trying 128.32.112.233...
                    Connected to http://soda.CSUA.Berkeley.EDU.
                    Escape character is '^]'.
                    SSH-1.99-OpenSSH_3.4
                    \_ genius wtf do you think that is?  If it isn't an openbsd
                       machine and it's running openssh, it's the portable one
                       \_ I believe the FreeBSD uses the non-portable openssh
                          too, perhaps with their own patches. If FreeBSD was
                          using portable openssh, you'd see a version string
                          that looks like this: SSH-1.99-OpenSSH_3.4p1
                       \_ Hi.  You're an idiot.
                       \_ Recent FreeBSD base system uses 3.4p1.  There are
                          also two ports: security/openssh and
                          security/openssh-portable, which are a patched
                          OpenBSD version and the portable version,
                          respectively.  Soda is running the former, AFAIK.
                          --dbushong
              \_ The only installed openssh port I see is:
                 /var/db/pkg/openssh-3.4_4
        \_ What's the bottom line? Is soda's current version compromised?
           \_ I don't think so.  Plus, the compromise is just a side effect
              of the build, and (supposedly) should not affect the built
              executables.
           \_ No. The MD5 on the src tar ball in /usr/ports/distfiles
              matches the correct MD5:
              MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2
              soda$ cd /usr/ports/distfiles/ && md5 openssh-3.4.tgz
              MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2
           \_ Here is what I've heard from a reliable source: (sorry, no
              url)
              "If you didn't rebuild OpenSSH from scratch in the past 36
              hours you don't have to worry about it and the trojaned
              code was replaced with a clean copy by 6am PDT. The trojan
              was that someone added a line to a Makefile such that during
              compilation, a socket is opened to a hacked machine once an
              hour to await "commands" (or example, open a shell, or die).
              The OpenSSH code base wasn't touched. The hacked machine was
              wiped early early this AM.

              I haven't heard anything about whether the SunOS 4.1.X FTP
              server (the OpenSSH project hosts there because the people
              who offered to host it there have lots of bandwidth) was
              hacked, or if this was some kind of inside job from someone
              who had appropriate levels of access on that host.

              Like you doctor always said, check your md5 checksums and your
              PGP sigs. The FreeBSD "ports" system does that automatically
              and refused to build and install the tainted coded."
2002/7/29 [Computer/SW/Security] UID:25436 Activity:nil
7/29    Can some one tell us some definitive info about what's going on
        with pop?  it hasn't worked since the ip change.  Do I need to
        change port number?
        \_ The sort-of official, and thoroughly unannounced answer is that
           clear-text POP/IMAP has been disabled since the recent compromise.
           You can only use SSL enabled POP/IMAP clients.  Hopefully we will
           soon have localhost clear-text service available for those who
           prefer to ssh tunnel instead of trying to find an SSL enabled
           mail client --scotsman
           \_ okay, what settings do I use for POP3 over SSL?  port 995?
              \_ Y'know.  looking at things, I don't see POP3s enabled..
                 I'd have to say mail root. --scotsman
           \_ wasn't this always the case? I was never able to use POP w/
              clear-text password remotely and have been ssh tunneling for
              about the last year.              - rory
        \_ On a somewhat related note, is telnet / skey going to be
           reenabled, or is it permanently disabled?
2002/7/25 [Computer/SW/Security, Computer/SW/Unix] UID:25422 Activity:insanely high
7/25    Just curious. How come 'last' shows the date went backwards? thx.
mikeh            ttyA7    128.32.112.194   Thu Jul 25 01:09 - 01:11  (00:01)
root             ttyv1                     Thu Jul 25 01:08 - 01:09  (00:00)
root             ttyv0                     Thu Jul 25 01:07 - 01:08  (00:01)
emarkp           ttyv3                     Wed Jul 24 23:36 - 23:36  (00:00)
mehlhaff         ttyA4    63.201.156.21    Wed Jul 24 23:30   still logged in
root             ttyv2                     Wed Jul 24 23:24 - 23:46  (00:22)
root             ttyv1                     Wed Jul 24 22:51 - 23:46  (00:54)
mikeh            ttyv0                     Wed Jul 24 22:50 - 23:47  (00:56)
reboot           ~                         Wed Jul 24 22:50
shutdown         ~                         Wed Jul 24 22:44
root             ttyA1    10.32.43.51      Wed Jul 24 22:17 - shutdown  (00:26)
mikeh            ttyA1    10.32.43.51      Thu Jul 25 03:54 - 22:17  (18:23)
jon              ttyA3    10.32.43.51      Thu Jul 25 03:07 - 03:08  (00:00)
root             ttyA4    10.32.43.51      Thu Jul 25 03:00 - shutdown  (19:43)
root             ttyA1    10.32.43.51      Thu Jul 25 02:44 - 03:54  (01:10)
mikeh            ttyA1    10.32.43.51      Thu Jul 25 02:44 - 02:44  (00:00)
root             ttyA0    10.32.43.51      Thu Jul 25 01:45 - shutdown  (20:59)
reboot           ~                         Thu Jul 25 01:35
        \_ that's why it's called 'last'.  it shows from most to least recent
           who has logged in.
           \_ so you saying july 24 is more recent than july 25?
2002/7/25-26 [Computer/SW/Security] UID:25416 Activity:moderate
7/25    Is there any ETA of a full report about the compromise?  For
        instance-- how long ago did the hack take place?  Where did it
        originate?  How was it discovered?  Was ssh-keygen hacked?  Do we
        need to replace our keys?  Are we supposed to change ALL of our
        passwords, or just ones that we used in the past X days?
        \_ Also, what _isn't_ known about the hack?
           \_ we believe that nweaver was responsible. --h@x0r
        \_ Are we going to ask for the death penalty?
        \_ Can't hurt to change your passwords and ssh keys anyhow...
2002/7/25-2003/1/5 [Computer/SW/Security] UID:25415 Activity:nil
07/25   Yes, soda's ssh, sshd, and sudo were compromised. Changing all
        of your passwords is advised. Services that are down now will
        come up in due time. --ajani
2002/7/25 [Computer/SW/Security, Academia/Berkeley/CSUA/Troll] UID:25414 Activity:high
7/25    Anybody know what's happening with alumni.eecs?  Can't seem to ssh in.
        \_ Last I herd they were having problems with secure shell.
        \_ Sounds like they got 0wnz0red
          \_ well, they told me because csua's ssh was trojaned, all accts
             which have anything to do with soda is disabled.  Talk to root
             to reactivate it.
             \_ csua's ssh was trojaned?  when did this happen?
                \_ Shoulda used coitus interruptus, but abstinence is
                   the best choice!
             \_ You better be fucking kidding because there's nothing about
                this on /etc/motd.official.  If soda got owned we have the
                right to know about it and root has a responsibility to tell.
                I'd like to see official word on motd.official whether this is
                true or not.  This isn't funny if you're making it up.
                \_ What even not funnier is how you're being such
                   a dick about asking for this information.
                   \_ Excuse me while I beg for critical security information.
                      Oh please please please let me know sometime after you
                      graduate what the fuck was going on.  Security isn't a
                      joke and users shouldn't be left guessing wtf happened
                      or how much they might be fucked over.  And for you
                      personally, fuck you, you know nothing fool.
                        \_ And for you personally, if your files and
                           whatever else are so critically dependent on
                           soda being completely secure, get your own
                           machine and connection and maintain it.
                \_ Found on http://ucb.org.csua (7/24):
                   Soda.csua is down because it was compromised. It will
                   hopefully be fixed tomorrow.  Galen
                   \_ which is unfortunately not very helpful when soda is the
                      only machine from which one can read ucb.*
                      \_ Try http://groups.google.com?
                   \_ how about a secondary webserver on, say, scotch that
                      gives news and downtime type stuff for soda.  new A
                      record <DEAD>news.csua.berkeley.edu<DEAD>, etc.
                      \_ If you asked him really nicely, perhaps dbushong would
                         be willing to do something like this at http://www.csua.org
                         I'll bet you'd have better chances if you volunteered
                         to do the coding so that he could just post it.
                         \_ I know dbushong.  dbushong is a good friend of
                            mine.  and you, sir...  wait.. what was i saying?
                            Really.  Dave just runs http://csua.org.  He doesn't
                            know or care about the daily goings on of soda.
                            This is something the politburo can and, i'm going
                            out on a limb here, should do.
                   \_ Ok that's a start, how about some info on how long it's
                      been compromised, what sort of compromise, how badly,
                      what were the hackers doing, what got installed, etc?
                      \_ Nice attitude. And how much have you contributed to
                         this group and its equipment lately?
2002/7/25-26 [Computer/SW/Unix, Computer/SW/Security, Academia/Berkeley/CSUA] UID:25413 Activity:low
7/25    Thanks to the root types who have been working hard to clean up the
        recent mess on soda and in EECS in general.  The masses are pleased
        to have soda return.  --PeterM
        \_ Word.
        \_ Hmm, is POP and IMAP still down?
        \_ All praise the great root types!
        \_ No HTTP service either
        \_ Your work means a lot to us.  Inability to use soda drives me nuts,
           especially since I use it for love emails.
        \_ specifically much praise is due to mikeh.  He put alot of time into
           the reinstall and cleaning up of things.  'course everybody put
           effort in.
2002/7/16-18 [Computer/SW/Security] UID:25372 Activity:high
7/16    How do I generate a public key compatible for openssh on an SSH
        (commercial) machine?  openssh uses single-line keys, while
        ssh uses multiline keys.
        \_ I got out a text editor and re-arranged the entries to match.  It
           was lame but it worked.
        \_ see openssh ssh-keygen man page
           \_ If you're trying to use pre-existing keys and convert them this
              won't do it for you but it will generate new ones in either
              format.
              \_ Yes it will, you apparently haven't read the manpage.
                 \_ Not in my version which is relatively recent.
     -x      This option will read a private OpenSSH DSA format file and print
             a SSH2-compatible public key to stdout.

     -X      This option will read a unencrypted SSH2-compatible private (or
             public) key file and print an OpenSSH compatible private (or pub-
             lic) key to stdout.
                \_ Yes and where's the option for ssh1?
2002/7/13 [Computer/SW/Security, Computer/SW/Unix] UID:25347 Activity:moderate
7/12    Anyone know of a lightweight secure ftp program like secure fx?
        Putty PsFtp is *too* lightweight.
        \_ try WinSCP
        \_ ssh secure shell client for windows, available on http://depot.berkeley.edu
           if you can't access http://depot.berkeley.edu, maybe you shouldn't be on
           a machine that is supposedly for undergrads.
           \_ I wake up every morning and try to fuck up everyone else's
              day just a little bit too, cool!
2002/7/6 [Computer/SW/Security] UID:25292 Activity:low
7/5     What is the purpose of having subkeys in the PGP/GPG encryption
        scheme?
        \_ for rounds.
2002/7/6-8/9 [Computer/SW/Security] UID:25290 Activity:nil
07/05   Apache upgraded, bugs to dev-null@soda. In the future if you
        see a problem mail root rather than venting on the motd. Yes,
        we read bugtraq, as is demonstrated by the fact that security
        issues are normally handled quickly. --Galen
2018/11/21 [General] UID:1000 Activity:popular
11/21   
Results 451 - 600 of 1108   < 1 2 3 4 5 6 7 8 >
Berkeley CSUA MOTD:Computer:SW:Security:
.