Computer SW Security - Berkeley CSUA MOTD
Berkeley CSUA MOTD:Computer:SW:Security:
Results 901 - 1050 of 1108   < 1 2 3 4 5 6 7 8 >
Berkeley CSUA MOTD
 
WIKI | FAQ | Tech FAQ
http://csua.com/feed/
2017/10/18 [General] UID:1000 Activity:popular
10/18   

2009/2/10-13 [Computer/SW/Security, Computer/SW/Unix] UID:52552 Activity:nil
2/10    I have an sh file that does a mount.. the mount does an
        authentication. I previosly stored the username and password
        from zenity prompts. However, I can't get a return on the password
        field. The following only works on the username:
        mount -t davfs "http://blahblah.com/BLahUser11" /mountdir << EOF
        ${username}
        ${password}
        EOF
        It gets stuck at the password. Any thoughts? thanks
        \_ Expect?
          \_ the username gets passed and a carriage return then a prompt
                for the password is there but the ${password} doesnt get
                put in nor carriage return. so script is stuck
                \_ /usr/bin/expect
                  \_ can't use expect. this is an automated installer on other
                    persons machines. I would have to apt-get expect
                    No way to do it just with EOFs?
                    \_ would "for i in 1; do echo $username; sleep 1; \
                              echo $password"; done | mount -t ..." work?
                       It really depends on how the password is being read.
                        \_ that didnt work... same behavior
                    \_ No, this is one reason tools like Expect were invented.
                       See, e.g.,
                       http://www.noah.org/wiki/Pexpect#Q:_Why_not_just_use_a_pipe_.28popen.28.29.29.3F
                        \_ thanks.. i guess i have no choice :) excellent!
                           \_ Well, that's not to say you couldn't make a very
                              stripped down version of an expect-like tool
                              that does what you want, and ship that. Maybe
                              someone else has already done it.
                                \_ or use Perl Expect or Python Expect.
2009/1/15-23 [Computer/SW/Languages/Java, Computer/SW/Security] UID:52394 Activity:nil
1/15    http://cwe.mitre.org/top25
        2009 CWE/SANS Top 25 Most Dangerous Programming Errors
        \_ "Avoid inconsistent messaging that might accidentally tip off
           an attacker about internal state, such as whether a username
           is valid or not."  Really?  Fuck you buddy.  I don't always
           remember what my goddamn username was on your stupid fucking
           site.  Just tell me if I got it wrong thank you very much.
           (Just like if my password doesn't conform to the rules for
           what a valid password is FUCKING TELL ME WHAT THE RULES ARE.
           Any attacker knows that information and giving it to me may
           remind me what password I used so please, make our lives
           easier.)
           \_ at that level of frustration i would just choose another
              website for that service, or go see the store in person.
              \_ http://Buy.com offers no helpful hints, but their prices are
                 good. Does make me want to strangle people, though. -!pp
                 \_ I wish there was a counter/way to determine how with
                    online stores i can be assured of creating jobs/ buying
                    american.  I am wondering how much we are screwing
                    ourselves into a longer recession by sending a job
                    overseas by saving five dollars.  I think i'd rather
                    pay the extra $20.
                    \_ My last three http://Buy.com purchases all shipped from
                       American companies.
2009/1/11-15 [Computer/SW/Security] UID:52358 Activity:nil
1/11    http://www.americanstinker.com/2008/01/barack_obama_and_israel.html
        \_ well hopefully he has good Secret Service security.
2009/1/5-9 [Politics/Domestic, Computer/SW/Security] UID:52317 Activity:nil
1/5     http://indiacgny.org/php/showContent.php?linkid=200&partid=96&sub=sub2  IRONY
2009/1/2 [Computer/SW/Security] UID:52311 Activity:nil
1/1     Is email still down?  My outgoing email seems to be not working.
        Also ssh password login seems to be not working (but certificate works).
        Thanks and Happy New Year.
2008/12/26-28 [Computer/SW/Security, Academia/Berkeley/CSUA/Motd] UID:52296 Activity:kinda low
12/26   Motd is dead for good, RIP Motd. You will be missed. :(
               \_ What about soda?
Date: Sun, 28 Dec 2008 11:56:41 -0800
From: Steven Schlansker <stevenschlansker@berkeley.edu>
To: announce@csua.berkeley.edu
Subject: [CSUA Announce] Soda back up!
Hey guys,
Unfortunately http://soda.csua.berkeley.edu crashed over the Christmas break
when I was out of town and none of the rootstaff with cardkey access to
Soda could get in.  About a day's worth of mail was bounced
unfortunately - if you got a bounce message, just try to resend your
email and it'll go through now.  Sincerest apologies - I simply couldn't
make it back to Berkeley any faster.
Hopefully everything will be running OK for now.  We're still waiting on
our shipment of a new server...  the latest ETA is the 10th.  Then I
will be rebuilding it (with the help of the rootstaff and some new
hopefully up-and-coming root members!) and we'll put it into production
as fast as we can!
Hope everyone's holidays find them well,
Your VP
Steven Schlansker
_______________________________________________
Announce mailing list
Announce@vermouth.csua.berkeley.edu
http://vermouth.csua.berkeley.edu:1337/cgi-bin/mailman/listinfo/announce
2008/12/18-2009/1/2 [Computer/SW/Security] UID:52280 Activity:nil 50%like:52218
12/18   Hi, is there a how-to to access csua with ftp?
        \_ man scp
          \_ Thanks that did it.
2008/12/2-7 [Computer/SW/Security] UID:52141 Activity:nil
12/2    Thomas Sowell is awesomely cantankerous in his most recent column
        I love this line: Working in a homeless shelter is widely regarded as
        "community service" as if aiding and abetting vagrancy is necessarily
        a service, rather than a disservice, to the community.
        \_ What a pompous idiot is a pompous idiot!  What a shocker!  And
        \_ Wow! A pompous idiot is a pompous idiot!  What a shocker!  And
           look!  Nazis!  Hitler!
        \_ For chrissake.  A great deal of homelessness is due to untreated
           mental illness.  How about this:  "treating heart disease is
           aiding and abetting unhealthy lifestyles..."
        \_ The Hoover Institude is not paying him to write reasonable,
           thoughtful opinion pieces where he deals fairly with the root
           causes of whatever the hell he's writing about this week.
2008/11/16-17 [Computer/Networking, Computer/SW/Security, Computer/SW/Unix] UID:51999 Activity:low
11/16   Can I use my SBC Yahoo! DSL login name "xxx@sbcglobal.net" and password
        for the DSL at someone else's home?
        \_ Why don't you try it...
        \_ Don't check your email at your mistress' house.
2017/10/18 [General] UID:1000 Activity:popular
10/18   

2008/11/7-13 [Academia/Berkeley/CSUA, Computer/SW/Security] UID:51875 Activity:nil
11/7    Does this guy have a soda account?
        http://www.mercurynews.com/ci_10926276?source=rss (online stalker)
        \_ boring
        \_ I wonder if Sold Intel Secrets To AMD guy has a soda account.
2008/10/31-11/2 [Computer/SW/Security, Computer/SW/Unix] UID:51769 Activity:nil
10/31   As root, is there a way to make "passwd" give the same "too short"
        and other bad password errors (or at least warn in those cases)? This
        is on linux.
2008/10/29-31 [Computer/SW/Security] UID:51721 Activity:nil
10/29   Bruce Schneiner et al. have released their submission for the new
        SHA replacement:
        http://www.schneier.com/blog/archives/2008/10/the_skein_hash.html
        \- btw, worth looking at the MD6 design if you are interested in
           this stuff. multicore scalability a "tier 1" goal.
2008/10/23-28 [Computer/SW/Security, Computer/SW/Unix] UID:51654 Activity:nil
10/23   Woman charged with crime for "killing" (deletion really) of online
        character:
        http://tinyurl.com/6lspuv
        \_ she is weak. SHe should have created her own character
           and then do a backstab on his ass. - turin
2008/10/16-17 [Computer/SW/Security, Politics/Domestic/Election] UID:51551 Activity:nil 50%like:51512
10/15   Secret Service says no one said "Kill him" at Palin rally
        http://www.timesleader.com/news/breakingnews/Secret_Service_says_Kill_him_allegation_unfounded_.html
2008/10/9 [Computer/SW/Security, Computer/SW/Unix] UID:51447 Activity:nil
10/8    http://www.scribd.com/doc/4964973/Worst-Captchas-of-All-Time
        Worst captchas of all time. Some stupid, some funny.
2008/9/21-23 [Computer/SW/Security, Politics/Domestic/SocialSecurity] UID:51253 Activity:nil
9/21    Obama's Social Security Whopper
        http://www.newsweek.com/id/160179
        \_ if you say so
2008/9/20-23 [Recreation/Dating, Computer/SW/Security] UID:51244 Activity:kinda low
9/20    Etiquette question: my gf's boss invited her to his son's bar-mitzvah.
        What is a proper attire to wear for non Jewish women? Black & white
        only? Long sleeves only? Can you have color? Can you take
        pictures? Thanks.
        \_ Ok my gf just wore long dress. Turns out they had a super fancy
           one with 200 people attending. They spent ~$30K on a bar-mitzvah.
           Is that how much they normally cost? It's very impressive.
           \_ $30K was more than my wedding, a LOT more. If you're spending
              that much on a 13 year old kid, it says a lot about how much
              you value bar-mitzvah. Or it could just mean that Jewish
              people ARE rich!
        \_ Mazel Tov! Think in terms of what you would wear to go to church,
           remembering that the actual Bar Mitzvah ceremony will be part of
           a service at a synagogue. Think in terms of a dress, a nice pants
           suit, or a skirt and nice top. Dress shoes and, if cooler weather,
           stockings. Nothing flashy or showing much flesh. There is typically
           no need for a head covering--if the congregation likes women to
           have head coverings, there'll have something in the lobby for you
           to put on. Colors are okay, although subdued would be best.
           A card including a check made out to the son is best, which you
           can give to the father anytime except during the service. If you've
           been invited to a party or a reception afterwards, that's a good
           time. It's traditional in Judaism to give money in multiples of $18,
           so think something like $54 or $72 or $90, depending on what you
           can afford and whether you've been invited only to the service or
           to a party afterward. In terms of the service, it will be a
           combination of English and Hebrew. The boy will recite prayers in
           Hebrew, and a portion of the Torah (what you may call the Old
           Testament) in Hebrew. There may also be a short speech in English.
           Just stand when the congregation stands and sit when they sit. If
           you understand the prayers and are comfortable reciting them with
           the congregation, do so, otherwise it's okay, since you're a
           visitor, just to read along in the prayer book (called a Siddur).
           \_ Give a card that says "In lieu of a gift, my tax dollars
              were sent to Israel".
              \_ LOL good one!!! It's almost Seinfeld material.
                 \- ok tnx
2008/9/16-19 [Computer/SW/Security, Politics/Domestic/SocialSecurity] UID:51192 Activity:nil
9/16    <DEAD>retirementplans.vanguard.com/VGApp/pe/pubnews/SocialSecurityAndWorking.jsf?SelectedSegment=LivinginRetirement<DEAD>
        Why Social Security fucks everyone up. Earn too much? Get nothing!
        \_ Your reading comprehension is poor. You don't get nothing, you
           just get reduced benefits. That Vanguard page doesn't mention that
           your later benefits are actually increased because of working
           later.
        \_ You are right, we should let Morgan Stanley run Social Security,
           they will do a good job of protecting our retirement money.
2008/8/6-10 [Computer/SW/Security] UID:50801 Activity:nil
8/6     What kind of captcha would you love to see? List them here:
        -Hot or not?  TOTALLY
        -Male or Female?
        -Gay or not?
        -Geek or not?
        -enormous breasts or regular size breasts?
        \_ Chinese, Japanese or Korean?
           \_ That would also serve as a test to weed out whites.
                \_ Oh come one.  It's been demonstrated that Asians can't
                   tell each other apart either.
        \_ What's "captcha"?  Thx.
           \_ STFW.  Or just read http://en.wikipedia.org/wiki/Captcha
              \_ I see.  But then what does hot or female or gay above have
                 to do with Captcha?
                 \_ Hard to program something to automate that check. It used
                    to be impossible to write a program to recognize the
                    distorted letters and numbers used in older Captcha's, but
                    technology has caught up.
        \_ http://www.badhackerz.com/full-appz/11087-rapidshare-turbo-download-reads-new-cat-captchas.html
2008/7/30-8/5 [Science/Electric, Computer/SW/Security] UID:50729 Activity:nil 78%like:50725
7/29    Pepperspray vs. taser, round #1:
        http://www.brickhousesecurity.com/self-defense-personalsecurity.html
        http://preview.tinyurl.com/5sjfz5 [infowars.com]
        http://videos.caught-on-video.com/Player.aspx?fileid=513DC6A2-FF6A-40F9-9893-589AC926FCCE&p=0 (taser takes down a BULL)
2008/7/29-30 [Science/Electric, Computer/SW/Security] UID:50725 Activity:nil 78%like:50729
7/29    Pepperspray vs. taser, round #1:
        http://www.brickhousesecurity.com/self-defense-personalsecurity.html
        http://www.infowars.com/articles/ps/tasers_vs_pepper_spray_evaluation_of_police_weapons.htm
        http://videos.caught-on-video.com/Player.aspx?fileid=513DC6A2-FF6A-40F9-9893-589AC926FCCE&p=0 (taser takes down a BULL)
2008/7/28-8/5 [Computer/SW/Security] UID:50711 Activity:nil
7/28    Everyone's captcha hacked:
        http://blogs.zdnet.com/security/?p=1418
        \_ I still like the idea of making real people solve captchas to get
           porn or torrents or the like.  Captchas that are actually used by
           other sites.
2008/7/20-23 [Computer/SW/Security, Computer/HW/Laptop] UID:50640 Activity:nil
7/20    Does my encrypted disk LVM everything partition scheme make my
        laptop consume a lot more power than if I weren't using encrypted
        LVM?
2008/7/15-23 [Computer/SW/Security] UID:50581 Activity:nil
7/14    anyone know this guy?
        A disgruntled city computer engineer has virtually commandeered
        San Francisco's new multimillion-dollar computer network,
        altering it to deny access to top administrators even as he
        sits in jail on $5 million bail, authorities said Monday.
        http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/07/14/BAOS11P1M5.DTL&tsp=PSB
        \_ The article is short on technologies involved.  It sounds vaguely
           like he commandeered their domain's administrator account.
           \- i suspect waterboarding would be successful in this case.
              \_ Is that you in the sfgate comments?
                 \- no, i didnt not read the comments.
                    \_ probably better that way.  they make me sad.
        \_ I enjoy how the article says there is no known motive.  Anyone who
           has hung out with disgruntled sysadmins know that no motive is
           needed.
        \_ No, but he is the poster child for a BOFH. I wish I knew him,
           so I could shake his hand.
           \_ Having worked with IT guys who couldn't comprehend the fact that
              IT is fucking support and not an ends to itself I wish I knew
              IT is f***ing support and not an ends to itself I wish I knew
              him so I could kick him in the balls.
              \_ Depends. IT can be support or it can be an ends to itself.
                 For the city I'd say IT is a big part of what they do.
                 \_ IT by itself is nothing.  IT is a tool to make other
                    tasks easier.  I accept that.  Keep the tools running
                    is an honorable job.  Just admit that's not what you
                    are doing.
                    \_ Well it depends. I think you are too limited in
                       your scope. There are a lot of situations where the
                       tool is more important than the operator. Making a
                       job so simple that a monkey can do it is one of the
                       areas where IT can help and in those instances I
                       think the IT adds more value than the actual "doers".
                       At that point where IT is contributing more
                       significantly to the bottom line I wouldn't say it
                       is a supporting role anymore, but a key role.
                       Addendum: What role you would say IT plays at companies
                       like eBay?
                       \_ Or Amazon, with the EC2 project?
        \_ it might be a big Peoplesoft install.
        \_ He made $149,269 working for the gov't, which is not bad now is it?
           \_ Previous motd postings lead me to believe that this makes him
              rich. Still won't make $5m bail, though.
           \_ This is a lot of money, almost as much as I make as a Director
              in the private sector. Maybe those public sector IT geeks are
              overpaid afterall...
              \_ Plus he can't get fired even when he's clearly got issues and
                 he probably has better benefits than you do, too.
2008/7/13-23 [Computer/SW/Security] UID:50553 Activity:nil
7/13    Illegal Immigrants prosecuted for social security fraud:
        http://preview.tinyurl.com/6c4wm6 [nyt]
        Prof. Camayd-Freixas essay re same:
        http://blogs.ilw.com/gregsiskind/files/camayd.pdf
2008/7/2-6 [Politics/Domestic/911, Computer/SW/Security] UID:50453 Activity:kinda low
7/2     On the torture debate (or maybe just flame fest), the claim that
        torture doesn't work is true most of the time but untrue some of the
        time.  Most of the reasoning for pro-torture positions doesn't make
        sense to me, I feel like its not logical to give support to something
        that doesn't produce results while the same time being oppressive.
        The one thing I think I can see is that I make a decision that I
        would rather have a little less security to have more human rights/
        civil liberties.  When Patrick Henry said "Give me liberty of give me
        death" he didn't mean unless he might get hurt.  I can understand
        that if you won't tolerate any threat to your personal security (at
        least any threat outside of our government) it would be in your best
        interest to want them to torture anyone they thought might be involved
        in terrorism.  But to me that seems like a cowardly approach, a
        minimal risk to yourself is worth the gain in liberty for all.  Its
        easy to see that deaths from terrorism << torture/government repress-
        ion. -mrauser
        \- the ticking time bomb scenario has long been "the standard"
           classroom hypo after THE TROLLY PROBLEM for the tension between
           UTILITARIAN theories [cost-benefit analysis] and DEONTOLOGICAL
           theories [torture is wrong. the exact reason it is wrong depends
           on the flavor of deontology, but probably "the standard" again
           is the kantian one but maybe simpler to understand is the RDWORKIN
           "RIGHTS AS TRUMPS" view ... mostly this is beyond the scope of a
           motd discussion]. but the "i only care about me" sort of begs
           the question ... since a core question of moral philosophy is
           "what do we own other" and you're pretty much saying "nothing"
           "what do we owe others" and you're pretty much saying "nothing"
           in that "degenerate" case. EGOISM may be an apt description of a
           lot of people, but it's not really a philosophy [although i
           suppose maybe FWNIETZSCHE might have spun it into one, but i am
           not really an expert on FWN ... and that is also beyond the
           scope of the motd]. here is a problem with the "results
           oriented" view: do you think it would be categorically wrong
           to say torture a family member of the terrorist ... say KSM's
           wife and kids ... if that would be a highly effective way of
           producing results. if you want "the standard" critiques of
           utilitarianism, see BERNARD WILLIAMS [formerly UCB Dept Philosophy,
           now dead] and AMARTYA SEN ... at the core, utilitariamsism
           "does take persons/rights seriously. Williams also has a very
           influential critique of deontology, but that may be a little
           hard to follow.
           \_ I've heard of the ticking time bomb, and its pretty easy to feel
              saying you would torture the guy, because in this magical fantasy
              he is directly responsible for the bomb being there and you know
              that there must be a bomb so there is a perverse justice in
              torturing him to make him tell you.  But as a real world example,
              it holds no water, because how often do you KNOW that there is
              a threat and the person in front of you has specific knowledge
              of it.  You torture without this information, in the hopes of
              getting it.  Another scenario, say a terrorist kidnaps someone's
              family and then tells that person where they put a bomb in a
              building, but they tell that person if they tell the authorities
              they will kill thier family.  So do you torture a complete
              innocent who has a self interest in not telling you the info?
              Here is a scenario which is nearly as plausible as the ticking
              time bomb, but I don't think anyone could feel good about either
              option.  The problem to me is that torture is used in ambigious
              situations with a presumed guilt or presumed having of the info.
              I think that because torture can really never be used with
              certainty, it should never be used at all.  Plus, there is a
              strong argument that it leads to false confessions and false in-
              formation just as long as it leads to good ones. -mrauser
              \_ look up "a fortiori"
           \_ Your writing is only partially intelligible. What was your
              "i only care about me" and "what do we own other" sentence
              referring to?
2008/6/25-7/14 [Computer/SW/Security] UID:50380 Activity:nil
6/25    some XCF or CSUA person had a web page about a project they were
        working on where I set up a machine, and you set up a machine
        somewhere, and they both passively back each other, i believe with
        an encryption key so i can't read your backups.  when your disk
        catches on fire, i just give you a copy of your data.  anyone remember
        the name of this?
        \_ crashplan?
        \_ You might be thinking about oceanstore:
           http://oceanstore.cs.berkeley.edu
           But its a slightly different concept and more massively distributed.
2008/6/19-23 [Computer/SW/Security] UID:50314 Activity:low
6/19    "One in three IT staff snoops on colleagues: survey"
        http://news.yahoo.com/s/nm/20080619/lf_nm_life/technology_snooping_dc
        \_ Weird, I go way way way out of my way to not snoop on coworkers.
           If I get someone to enter in a password, I look the other way.
           I want to keep out of trouble.
           If I get someone to enter in a password, I start studying the
           backside of the really hot chick in HR at the other end of the room
           so I really have no idea what their password is.  I want to keep
           out of trouble.
           \_ I do the same because I respect their privacy.
              \_ Yeah, I decided very early on in my career that I was not
                 going to abuse my priveledges to invade other's privacy. I
                 going to abuse my privileges to invade other's privacy. I
                 would fire anyone I caught doing that.
2008/6/17-20 [Computer/SW/Security] UID:50283 Activity:nil
6/17    We currently have AT&T (used to be SBC) for local phone service.
        However these guys really suck, and my wife hates them.  Is there an
        alternative local land-line service provider in the Bay area?
        \_ Hello, telco monopoly.   You want alternate business, voice-overIP
          on a non-AT&T internetconnection, or get a cell phone.
2008/6/9-12 [Computer/SW/Languages/C_Cplusplus, Computer/SW/Security] UID:50194 Activity:nil
6/8     CSUA code guru please help. I need to see my random number
        generator with a good seed (I just need random 18 bit
        identifiers). The usual time(NULL) is OK, except my program
        might be invoked faster than once a second, and seeding using
        time() produced the same result. I tried clock() but it seems
        to return 0. My program needs to be run in Linux/DOS (Watcom
        32bit compiler), so I prefer to stick with standard API.
        What's a good way to get some randomness without using special
        time function that goes into millisecond precision? Poke at
        some random bytes? Allocate a random array? This is in C. If
        I allocate say a 64byte block, and XOR the uninitialized
        memory, is there any guarantee that it will be a different
        64byte block the next time my program is run? Thanks!
        \_ What are you doing this for?  If it's encryption why are
           reimplementing the (really difficult to get right) wheel?
           If it's not encryption what is it that needs high quality
           random numbers?
           \_ I need to assign ID that are unique within a day to
              something 30 bit. I am thinking seconds_since_midnight
              (17 bits) + a random number (13 bits). If I simply seed
              using time(), my rand() will generate the same number if
              invoked within a second. So I am now seeding it using
              the XOR of time() with 64 uninitialized int on the stack
              (again XORed together). This seems to do the trick.
              \_ Huh? You only need to seed once. After that you have a
                 supply of random numbers you can draw on. So just seed by
                 time when you start the program. Or are you thinking you
                 are going to invoke main() many times per second? I don't
                 know what you are doing here so it's hard to give good
                 feedback, but think in terms of "now I have a stream of
                 random numbers and I just need to use them."
                 \_ The program exists after generating one ID.
                    \_ Do you mean "exits"? S/w like SSH uses prngd to
                       get around this problem.
        \_ Use another random number generator to generate the random seed for
           your random number generator!  Oh wait ......
        \_ What is wrong with rand?
        \_ Easiest just to bite the bullet and use non-ANSI C functions.
           The random array allocations are not at all guaranteed.
        \_ seed it with time and getpid.   Expecting unintialized memory
           to have random data runs the risk some chowderhead will take your
           code and comment it out when it generates warnings.
           \_ Does DOS even have PIDs? Wtf is even using DOS these days...
              \_ Embedded applications like digital cameras, I guess.
                 http://www.datalight.com/products/romdos
        \_ you could try opening and reading from a dummy file and then using
           clock to seed.  That way you'll block on IO and the amount of time
           you do that should be relatively random.
           \_ I thought about it again and this wouldn't be a good idea
              especially if you are running the progam often.  What will happen
              is that the file's memory page will be in cache after the first
              read and you won't have good random behavior.  You could try
              file writes, but in general this is not a very strong
              randomness anyways. -pp
        \_ You're not a Debian contributor are you?
2008/5/29-6/1 [Computer/SW/Security] UID:50082 Activity:nil
5/29    Major jump in unemployment benefits for continuing claims
        4Q corporate earnings forecast to be solid
        http://www.tickerforum.org/cgi-ticker/akcs-www?getimagenr=5939
        (chart)
        \_ No Outside Links / Please Sign In
           Access to large images, or links from outside sites, are not permitte\
d unless you are signed into the board.  Thank you, Management
           Access to large images, or links from outside sites, are not
           permitted unless you are signed into the board.  Thank you,
           Management
           \_ sorry
2008/5/21-23 [Computer/SW/Security, Computer/SW/Unix] UID:50023 Activity:nil
  5/21  remember the big guy who runs Comic Relief in downtown berkeley?
        he died, at 50, on monday:
        http://blogsearch.google.com/blogsearch?q=%22rory%20root%22
        http://www.comicsreporter.com/index.php/rory_root_1958_2008
        \_ "Worst. News. Ever"
2008/5/15-23 [Computer/SW/Security] UID:49961 Activity:nil
5/15    How is Facebook's authentication system different from OpenID?
        http://developers.facebook.com/documentation.php?doc=auth
        \_ I think the point might be that it is not?   We should get dans
           back on the motd, I bet he knows.  I miss his 50 lines tangents
           sometimes.
           \_ Conceptually it's the same as OAuth (which merged/is merging
              with OpenID).  AFAIK, Facebook's lack of support for OAuth
              is a political hedge to protect Facebook's 'walled garden'.
              -dans
2008/4/26-30 [Computer/SW/Security, Computer/Companies/Google] UID:49838 Activity:low
4/26    is Google Chat through the web browser encrypted?  My sweetie
        spends all day chatting with me via Google Chat in gmail
        "oh baby i want to **** your **** and then *** *** **** **
        ** *** ***" and "* **** **** *** **** in ** *** *****".
        Could some nosy sysadmin packet sniff her?
        \_ Like this really happened with a live woman.
           \_ Actually I'm not joking!  It's great.
        \_ Get her a soda account, then you can both log in via ssh and
           chat away to your heart's content.
           \_ most likely she's not a UCB student
2008/4/21-5/2 [Computer/SW/Security] UID:49787 Activity:nil
4/21    Yahoo Instant Messenger is not encrypted. Are there chat programs
        that are a bit more secure than YIM?
        \_ what OS are you using?
        \_ What are your goals? Corporate security, or preventing your wife
           from eavesdropping on you? If you're using IM for internal company
           communication, you shouldn't be using anything where you don't
           control the server; deploy an internal messaging server instead.
           Jabber-based servers are popular for this.
        \_ I think AIM supports encryption (at least it seems to when I'm
           using iChat or Adium).  I think GTalk supports encryption as well.
        \_ Beware of webcams pointing at your screen!
        \_ There is encryption but it's a pain in the ass sometimes.
        \_ Both you and your mistress log on to soda using ssh.  Then run the
           good o' "talk" program.
           good o' "talk" program.  You two will have a more intimate
           experience than using popular chat programs, coz now you can see
           every keystroke by the other instead of just line by line.
           every keystroke by the other instead of just line by line.  (Imagine
           all kinds of real-time animation you can do with the '-' key and the
           backspace key.)
           what animation you can do with the '-' key and the backspace key.)
        \_ install adium or pidgin-otr.  Trust in nikitab.
2008/4/17-23 [Computer/SW/Security, Politics/Domestic/SocialSecurity] UID:49771 Activity:nil
4/16    I've heard that you don't pay social security on income above $90K.
        Is this correct?  Does that mean ~$8000 a year is the most you ever
        pay?
        \_ Yes, though the limit goes up every year.
        \_ My 2007 W-2 said my Social Security Wages is $97500.
           \_ Yes, that was the limit this year. There is no limit for Medicare.
           \_ Yes, that was the limit this year. There is no limit for
              Medicare.
2008/3/17-21 [Industry/Jobs, Computer/SW/Unix, Computer/SW/Security] UID:49482 Activity:nil
3/17    http://market-ticker.denninger.net
        Former sysadmin says Fed measures not addressing root of problem,
        IBs/banks will eventually be taken to woodshed
        \_ Once again, who cares if he is a sysadmin?
           \_ It dovetails nicely with the background of most of the
              pontificators on the motd.  What's not to like?  We really
              need to get this guy a soda account!
              \_ If sysadmins had run Bear Sterns the company would still
                 be solvent right now.
              \_ He's got tech skills.  I've got tech skills.  Therefore I
                 care what he says about the economy...?  Huh?
                 He may be 100% on the mark but having tech skills does not
                 make his writing on the economy any more interesting.
2008/2/29-3/4 [Computer/SW/Security] UID:49303 Activity:nil
2/28    Hi do I allow only a certain SSH key to run a particular command?
        \_ Look for LocalCommand in ssh_config(5). Unless you're
           literally asking what you seem to be asking, in which case
           you're probably out of luck.
        \_ Read the manpages for authorized_keys file if you're using
           openssh.  You can specify the "absolute command" in there, or
           have it call a wrapper and have it process the
           $SSH_ORIGINAL_COMMAND variable.
           \- see /tmp/authorized_keys.acl-sample for an example.
              who is asking?
2008/2/28-3/4 [Computer/SW/Security, Computer/SW/Unix] UID:49282 Activity:nil
2/28    Is anyone's IMAP password no longer working?
        \_ for the past two or three days, connecting to mead.  :(
        \_ It works for me.  Could you please tell me when you stopped
           being able to log in, and what error message you get?  --mconst
2008/2/26-3/4 [Transportation/Airplane, Computer/SW/Security] UID:49257 Activity:nil
2/26    Documentary team says bomb ingredients can still be smuggled onto
        airplanes:
        http://preview.tinyurl.com/39basa (telegraph.co.uk)
        http://preview.tinyurl.com/yqflv9 (thisislondon.co.uk)
        The TSA disagrees:
        http://preview.tinyurl.com/3b6agt (tsa.gov/blog)
        \_ Airport screening is all about making people *feel* safer and
           very little about actually making people safe.
           \- no, it is about political CYA.
2008/2/25-26 [Computer/SW/Security, Computer/SW/OS/Windows, Computer/SW/SpamAssassin] UID:49243 Activity:nil 80%like:49239
2/24    Facebook comscore numbers slipping
        http://preview.tinyurl.com/24p9n8 (techcrunch.com)
        http://preview.tinyurl.com/2hug7v (hollywoodreporter.com)
        Over to you, dans
        \_ dans doesn't work at facebook
           \_ Slide feeds at the pig trough which is facebook apps:
              http://adonomics.com/company/Slide
2008/2/21-25 [Computer/HW/Memory, Computer/SW/Security] UID:49208 Activity:nil
2/21    Cold Boot Attacks Against Disk Encryption:
        http://www.schneier.com/blog/archives/2008/02/cold_boot_attac.html
        http://citp.princeton.edu/memory
2008/2/19-22 [Computer/SW/Security, Finance/Investment] UID:49189 Activity:nil
2/19    http://tinyurl.com/2ymrrc (yahoo.com)
        GOOG filing warns on near-revenue growth on reduction of accidental
        clickthroughs
        \_ Wow.  I didn't know they were making money from deceiving click
           regions.
           \_ the monkey wants to be clicked
2008/2/15-18 [Computer/SW/Security, Computer/SW/Virus] UID:49158 Activity:nil
2/15    Digital photo frames carry viruses:
        http://preview.tinyurl.com/2w6uc9 (sfgate.com)
2008/1/30-2/2 [Recreation/Computer/Games, Computer/SW/Security] UID:49034 Activity:moderate
1/30    One of my friend in china is asking me to sign up a world of
        warcarft account for him. I am not too familiar with this
        game, I am going to buy the game from Amazon, and use the
        CD-key to sign up an account. Do I need to tie my credit card
        with the account? Since the online game is fee based, I'd
        imagine I need a credit to get this to work, if so, then I'll
        tell him I can't do it. If I don't need a credit card, then I
        will do it. Does anyone on the motd play this game? Can you
        enlighten me? Thanks!
        \_ Friends don't let friends play the World of Warcraft.
           Mothers Against World of Warcraft.
           \_ Is this guy a "friend" or an actual friend?
        \_ Tell him you can't and let him figure out if you're wrong.
        \_ Sometimes these games allow you to buy a monthly usage card online
           but I don't know if warcraft requires a cc for signup or has the
           monthly thing.  I don't understand why your friend can't just sign
           themself up?
           \_ He claims that he's in China and he can't sign up. How
              do I prove he's wrong?
              \_ 1.5 Chinese World of Warcrack players?
              \_ Go to China and sign up.
                 \_ Remote-Desktop into your friend's machine in China,
                    and sign up.
              \_ He can't sign up for US servers, only on Chinese WoW servers.
                 There's millions more WoW players in asia than there are in
                 the US, but they are all on asian WoW servers.
        \_ It's true.  If you are a good friend, don't help him to play
           WoW in any way.
        \_ he probably wants you tot get a US version of the game so that
           he can get access to US servers. The Chinese version will send him
           to chinese servers.   His play experience will likely suck due to
           more lag, but whatever.   If he plans to go into gold farming there
           might be more market for his 'product' than if he were on a
           china server -- however that's against the game's ToS.  Anyway, you
           can buy the boxed game and  send it over.
           If you try to install and sign in, it will either ask for gamecard
           or credit card info to get the WoW account started. I'd recommend
           not taking that step.   -ERic
           \_ He might also be trying to make a conduit account.  I don't play
              Wow, but my understanding it that the Chinese Gold farmers nead
              dealers (conduits) on the US side to deliver their wares.
              \_ they have plenty of hacked accounts to do this with.
           \_ I can think of a host of reasons why a chinese person might want
              an account on US servers -- most of them involving some from of
              ToS violation -- but there are a few legitimate ones. Maybe he
              wants to play with US friends/aquaintances.  I'm willing to give
              them the benefit of doubt. However, whatever you do don't log
              into the US game (sign up the account) with your own user
              information and/or cerdit card if you plan on handing the account
              over. This makes YOU the 'customer of record' -- the owner of
              the account, responsible for whatever mischief your Chinese
              "friend" wants to commit with it. -ERic
              \_ that's like trying to legitimize one's use of bittoreent
                 because one uses it to download Linux ISO's, when the reality
                 is most of one's use is really restricted-copyright mp3's and
                 videos.  Most likely the intended use of this cross-region WoW
                 account is illegitimate.  Gold Farming, selling gold taken
                 from hacked WoW accounts, etc...
        \_ Very helpful replies. Thanks everyone! I am going to just say no. ;)
2008/1/25-2/2 [Computer/SW/Security] UID:49013 Activity:nil
1/25    Societe Generale uncovers massive fraud - Yahoo! News:
        http://www.csua.org/u/kkq
        After reading the whole article, I still don't understand how the fraud
        worked.
        \_ You mean you're supposed to understand anything by reading
           Yahoo! News?
           \_ It's an AP story.
2008/1/21-31 [Computer/SW/Security] UID:48980 Activity:nil
1/21    I'm trying to set up Thunderbird at with with gmail via IMAP.
        There is a proxy at work such that if I want to view a web page
        using Firefox or IE, it prompts me for my network login and
        password before it lets me onto the web.  When I try to get my mail
        in Thunderbird, it won't connect to the server.  I already tried
        setting the config option to tell it the proxy server address and
        port number.  But it still won't connect.  What can I do to get this
        to work, or is it possible that they have it set up at work that no
        matter what I do, it won't work?
        \_ It is likely that your firewall doesn't allow outbound traffic
           on the IMAP ports.  You might be able to SSH tunnel it from
           soda.  -tom
           \_ ssh is also blocked at work.  I guess I'm out of luck? -op
              \_ Try corkscrew.  http://www.agroman.net/corkscrew
                 You'll need to run a sshd on port 443 in most cases, though.
                 \_ Getting a router that can run dd-wrt or some other
                    firmware is a relatively easy way to get the sshd
                    if you don't want to leave your computer on all day.
              \_ Maybe this is a sign you should quit your job at the Kremlin.
2007/12/4-7 [Computer/SW/Security] UID:48744 Activity:low
12/4    Dunno if this is common knowledge ... msft wireless peripheral
        crypto cracked ... --psb
      http://www.theregister.co.uk/2007/12/03/wireless_keyboard_crypto_cracked
        \_ a one byte pad hardly counts as crypto
        \_ I guess this doesn't work for the Xbox 360 controllers.
        \_ I don't get it, Bluetooth isn't secure either, is it?
2007/11/20-26 [Computer/SW/Security] UID:48667 Activity:nil
11/20   Okay, password login failed for me again.  How do I set up my soda acct
        so that I can login using SSL public key?
        \_ One tutorial here: http://www.modwest.com/help/kb20-90.html
           \_ I can't get it working from that.  Either putty won't load the
              key generated on soda, or soda rejects my key generated from
              putty.  Has anyone done this with putty on windows?
              \_ You need to import the key you got from soda, into
                 Puttygen on the windows side, then use the resulting key.
                 \_ Excellent, that did it.  Thanks very much. -op
           \_ Condensed into step-by-step here: /tmp/publickey_putty_instruct
              Please feel free to correct/distribute. --erikred
2007/11/18-21 [Computer/SW/Security] UID:48654 Activity:nil
11/17   I need a wiki package that uses sqlite, and lets me
        give out username/passwords to limit editing and viewing access
        to certain sections.  Any suggestions?  Thanks.
        \_ http://wikimatrix.org
2007/10/18-20 [Computer/SW/Security] UID:48376 Activity:kinda low
10/18   Subversion woes. We want to be able to go to other developers'
        directories and type "svn status -q" to automate scripts.
        Now when I do something like this:
          user1@:~user2/dev/blah> svn status
          svn: Can't open '.svn/blah/_file.tmpl.tmp': Permission denied
        However there is no file named _file.* anywhere! What's going on?
        \_ it's trying to create a temp file in a directory where you don't
           have write access.  -tom
        \_ Use svn, save a ausman today!
        \_ Use svn, save a german shepherd today!
2007/10/7 [Computer/SW/Security, Recreation/Humor] UID:48254 Activity:nil 50%like:48227
10/3    Is that a Real Doll?  Wow!  So real!
        http://www.youporn.com/watch/13668 \_ Another one:
        http://www.youporn.com/watch/212 \_ It'd be more real if the skin
        is not as glossy.  \_ HA! Funny how he pulled out and squirted
        on his left hand
           so that he wouldn't have to clean up the doll. Now in real
           sex... Oh well, I guess it's better than no sex.
2007/9/27-10/2 [Computer/SW/Security] UID:48199 Activity:nil
9/27    Does anyone have experiences with OpenId and/or TypeKey as to
        minimize the effort spent on your web app authentication? How easy is
        it to integrate these 3rd party components into your web apps?
2007/9/3 [Computer/SW/P2P, Computer/SW/Security, Computer/SW/Unix] UID:47877 Activity:nil
9/3     So I was watching the Today Show this morning and in the crowd of
        jackasses trying to get on TV, some dude kept emphatically showing a
        home made sign that simply said, "lemonparty.org." None the wiser, I
        fired up my laptop, curious as to what could possibly be at
        http://lemonparty.org. I wondered why he was smiling so mischievously,
        shaking his sign in the air each time the camera had him in the frame.
        Could it be some family reunion site? A wedding announcement? A site
        devoted to lovers of lemons? Oh no, I would not be so lucky.

        No sir -- or ma'am -- it was a photograph of three geriatric men
        engaged in very passionate adult loving. And by loving, I mean a good
        old fashioned three-way.

        Of course, I couldn't let it go at this. I had to find out more about
        http://lemonparty.org, as it seemed like an inside joke to which I was not
        privy. A friendly google search yielded several results, all informing
        me that http://lemonparty.org is supposedly a shock site, in the ranks of
        loopback.jpg, http://tubgirl.com and goatse.cx. Now, I'm not sure if the
        shock value or http://lemonparty.org packs the same punch as the
        aforementioned peers, but I can only imagine a suburban housewife or
        lonely grandpa typing the web site in as I did, because, well, they
        too had nothing better to do.

        So why am I sharing this? I honestly don't know, other than I needed
        to purge my conscience. I think this was either one of the most
        wonderfully subversive things I've seen on TV in a long time, or one
        of the more disturbing ones (although I doubt there are many young
        kids watching the Today show on Labor Day). But, hey, old guys need to
        get it on, too, I suppose; so lemonparty indeed!
        \_ Yucks!  It's amazing enough that that guy can get it up.
2007/8/28 [Computer/SW/Security, Computer/SW/OS/Windows] UID:47776 Activity:moderate
8/27    google QA automation stuff, can someone view these videos
        and tell me if they're worth watching?  thanks.
        http://www.youtube.com/view_play_list?p=7D3E685B59779C16
2007/8/24 [Computer/SW/Security, Computer/SW/Unix] UID:47749 Activity:high
8/24    Anybody experiencing login authentication problems?  I cannot login
        using my login and passwd thru ssh on the SECOND attempt and on:
        ie, when I do ssh csua, it works once, but not afterwards.
        Then when I do ssh http://csua.berkeley.edu, it works once, but not afterwards.
        I can STILL login when I use a machine that use ssh authorized public
        keys (with the ssh passwd), but not the unix login/passwd.

        After I login, when I do a passwd, I get the *new* LDAP passwd prompt
        that allows me to change the passwd, but only once.  After that,
        I can no longer access that LDAP prompt (seems like the LDAP server
        is rejecting any requests from a particular host after first attempt),
        but instead I get the *old* unix passwd change prompt that won't take
        *any* of my passwds:

        (current) UNIX password:
        passwd: Authentication failure
        passwd: password unchanged

        After about an hour, if I do passwd, I get the new LDAP prompt again--
        but only once again.  Basically the LDAP prompt comes back in about
        once every hour.

        If an admin is reading this please help.  Seems like the LDAP server
        is down and/or unix passwd is out of sync.  Thanks.          --pchen
2007/8/24 [Computer/SW/Security, Computer/SW/Unix] UID:47748 Activity:nil
8/24    Anybody experiencing login authentication problems?  I cannot login
        with unix passwd thru ssh, although I was able to login using my ssh
        auth keys/cert.  Then when I type passwd to change the passwd,
        I'm getting an LDAP passwd change prompt--but only once: if I type
        passwd again, I get the Unix passwd change prompt.  In any case,
        it won't accept my old passwd nor allow me to change the passwd.
        What's going on?  Also mail is not working (nothing sent nor received).
        I emailed root and get no response yet.  If an admin is reading
        this please help.  Thanks.  -pchen
2007/8/18-20 [Computer/SW/Security, Computer/SW/Unix] UID:47652 Activity:kinda low 80%like:47603
8/17    hey root you wanna restore /csua/bin/mtd one day?
        \_ did you mail root about it?
           \_ do you really have to mail root when all of
              /csua/bin/ disappears?
              \_ empirical evidence would say, "yes, you do".  -!root
           \_ yeah.
2007/8/16-22 [Computer/SW/Security, Computer/HW/Drives] UID:47623 Activity:kinda low
8/20    I am looking for personal NAS... you know, an large intestinal
        harddrive that I can access data everywhere.  Idealy, I want be
        able to set up.  so it streams mp3 music as well, any recommendations?
        \_ USB 2.0 or GigE?

        \_ thinking about connect the harddrive to my router, and be able to

           access it outside the LAN.
           \_ I hear 'mediatomb' might be what you're looking for.
           \_ how's it supposed to deal with access control? Or is it just

              going to be anohter open WAREZ site?
        \_ http://www.archive.org/web/petabox.php
        \_ apache + basic auth + hard drive?
        \_ "intestinal"?
2007/8/13 [Computer/SW/Security, Computer/SW/Unix] UID:47605 Activity:nil
8/13    hey root would you engage in scrotal inflation?  thanks
        \_ Have you emailed root?  Because the motd.public isn't the preferred
           contact method.
           \_  I did.
            \_ Hey root, i think Spamassassin is dead too.
               \_ I think root is too busy leveling in WoW.
2007/8/13 [Computer/SW/Security, Computer/SW/Unix] UID:47603 Activity:kinda low 66%like:47566 80%like:47652
8/13    hey root would you restore /csua/bin/mtd ? thanks.
        \_ Have you emailed root?  Because the motd.public isn't the preferred
           contact method.
           \_  I did.
            \_ Hey root, i think Spamassassin is dead too.
               \_ I think root is too busy leveling in WoW.
2007/8/11-15 [Computer/SW/Security] UID:47589 Activity:nil
8/11    TSA can't find a guy who bypassed security checks:
        http://urltea.com/174l (usatoday.com)
2007/8/6-22 [Computer/SW/Security] UID:47541 Activity:nil
8/6     Another entry for the "no duh" department:
        "WASHINGTON (AFP) - The US government cannot account for more than half
        of all small arms given to Iraqis in the hope of bolstering their
        security forces, raising fears the weapons may have found their way to
        insurgent groups, according to a new congressional probe."
2007/7/14-16 [Reference/Law/Court, Computer/SW/Security] UID:47292 Activity:nil
7/13    Another good Conservative railroaded by Fitzgerald:
        http://www.freerepublic.com/focus/f-chat/1865420/posts
2007/7/8-10 [Computer/SW/Security] UID:47225 Activity:nil
7/8     Those employed by the oil industry had more children than any other
        industry, while those employed in journalism and hotel service
        had the lowest.
        http://neuropolitics.org
2007/6/21-24 [Politics/Domestic/HateGroups, Computer/SW/Security] UID:47033 Activity:nil
6/21    Powell was threatened by the KKK to not run for presidency.  Did Obama
        receive such thread also?
        \_ He was the first candidate to be assigned a secret service detail.
           Glean from that what you will.
           \_ Well, a canidate must request secret service protection.  So, he
        \_ We don't threaten nobody but we support all Republicans   -kkk
           \_ Well, a candidate must request secret service protection.  So, he
              asked for it.  There may or may not be a good reason for that.
              \_ I think the above statement is incorrect.
           \_ Hillary, as First Lady, has had it since 1992.
2007/6/8-11 [Computer/SW/Security, Computer/SW/Unix] UID:46892 Activity:low
6/8     I was talking to an acquaintance who said that his workplace was
        slowly evolving to a stated goal of taking superuser privileges
        away from the sysadmins in an effort to maintain a strict CM
        and, I assume in some way, lower costs - possibly by hiring
        trained monkeys to deploy pre-built images. I am curious what the
        IT theories are behind this. Is this a crackpot method of system
        management or is there some established theory behind this? Has
        anyone else seen this happen at their work? What were the results?
        My kneejerk reaction is that this is a Very Bad Thing, but maybe
        there's something to it.
        \_ Depends.  Are they mostly Windows?  Mostly UNIX?  Who still has
           superuser access?  Are they highly responsive?  It can be made to
           work.  But unless it's driven by competent IT management, it could
           be LOTS o' PAIN
           \_ All UNIX. I assume the idea is that if a change needs to be
              made then it is rolled out from some central server
              somewhere and no admins ever touch the individual workstations
              for any reason except perhaps hardware failure.
        \_ CM?
           \_ configuration management
        \_ No, this is in keeping with Best Practices surrounding security,
           especially the notion of "least privelege" which is to say that
           especially the notion of "least privilege" which is to say that
           people should have the permissions they need to do their job
           and no more. I personally think this is fine, but only works
           after an organization reaches a certain maturity and size.
           You need at least enough people so that you can have an on-call
           page rotation for the "root" team and another one for the
           "admin" team. Email if you want to talk about this some more
           this is something I have thought about quite a bit. -ausman
           http://en.wikipedia.org/wiki/Principle_of_least_privilege
           http://www.csua.org/u/ivq (Forrester Research)
2007/5/31-6/4 [Computer/SW/Security] UID:46802 Activity:nil
5/31    PHP-related question:  a web app I'm using recently moved from
        CRYPT_STD_DES to CRYPT_MD5 for password hashing.  On the off chance
        anyone's faced a similar problem (I am having trouble getting a
        reply from the developers), am I missing something fundamental or
        am I just fucked if I want to migrate my existing userbase without
        having to reset their passwords?  -John
        \_ Can you provide auth'ing off of DES while re-encrypting and storing
           the new MD5?
           \_ Don't think so.  It looks to me like this was just kind of
              a planning fuckup. :-(  -John
              \_ I was going to suggest the same as the above person.  It is
                 "the standard" way of dealing with this.  If you can't do
                 that and apparently don't have access to the source, you're
                 hosed.  Sorry.  Maybe you can redirect them to some other
                 page you do have control of and rewrite their passwords from
                 there.
2007/5/25-28 [Computer/SW/Security] UID:46754 Activity:nil
5/25    I would like to write a script to login to a windows machine remotely
        and start a simulation (basically a poor man's version of a Windows
        Beowulf cluser). The simplest way to do this seems to be to run sshd
        on cygwin. Are there better ways? (Obviously, one better way would be
        to install LINUX, but that isn't possible in the near term). Thanks.
        \_ There are some OpenSSH implementations for Windows you can install
           without the full cygwin implementation.
           \_ Can you list some? Thanks.
           \_ copSSH works well for me. -!pp
              \_ What is the advantage of copSSH over cygwin+sshd? From the
                 (brief) webpage for copSSH it sounds like it is cygwin+sshd.
2007/5/11-14 [Computer/SW/Security, Computer/SW/OS/Windows] UID:46589 Activity:nil
5/11    Hackers use Windows Update to reliably download their malicious code:
        http://preview.tinyurl.com/2dorvr (computerworld.com)
2007/4/30-5/4 [Computer/SW/Security] UID:46482 Activity:nil
4/30    Can someone recommend a website that provides the same service as
        cafepress, with custom t-shirt designs, but that does not censor?
        I want to make shirts that I know would get censored at cafepress,
        based on past bad experiences with them.
2007/4/13 [Computer/SW/Languages, Computer/SW/Security, Computer/SW/Unix] UID:46294 Activity:nil
4/13    Can someone w/ root fix this:
        $ ls -l /dev/null
        crw------- 1 root csua 1, 3 2007-01-25 19:41 /dev/null
2007/4/9-10 [Computer/Networking, Computer/SW/Security] UID:46239 Activity:nil 66%like:46247
4/9     Free W-Fi on Transbay buses:
        http://www.actransit.org/news/articledetail.wu?articleid=ae8a49cd
2007/3/31-4/6 [Reference/Law/Court, Computer/SW/Security] UID:46167 Activity:nil
3/31    Anti-plagarism service sued for copyright infringement:
        http://urltea.com/321 (washingtonpost.com)
        \- hello if you are interested ... really interested ... I have
           put the complaint at:
           http://home.lbl.gov:8080/~psb/Ephemeral/TurnItIn-complaint.pdf
           \_ Thanks.
        \_ Am I the only one who really doesn't like TurnItIn but
           really hope they win because of what it might mean for
           fair use rights?
2007/3/28-31 [Computer/SW/Security, Computer/SW/Unix] UID:46132 Activity:nil
3/28    What controls the order of files in regards to which file is displayed
        as the root file of a webpage? Specifically, I have to have a
        index.php in my root directory, but I want my webpage to display
        home.php. How can I do this? Thanks.
        \_ Just figured it out myself, using .htaccess! -op
2007/3/23-27 [Computer/SW/Security, Computer/SW/Unix] UID:46068 Activity:nil
3/23    hey root can you turn 'PINGS' to soda.csua back on?
        thanks
        \_ Hey, root, can you disable this h0zer's motd-editing cron-job pls?
        \_ and what's up with crippling traceroute?  It needs setuid to
            function.
            > traceroute scotch
            traceroute: icmp socket: Operation not permitted
2007/3/13-14 [Computer/SW/Security] UID:45950 Activity:nil
3/13    OpenSSH 4.6 is out:
        http://undeadly.org/cgi?action=article&sid=20070308183425
        Portable Version:
        ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-4.6p1.tar.gz
        OpenBSD Version:
        ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-4.6.tar.gz
2007/3/4-6 [Computer/SW/Security] UID:45863 Activity:nil
3/3     What is the cheapest option for internet access for somebod my parents
        who just need to do some email a couple of hours a week and nominal
        amounts of web browsing?  Some kind of dialup service?  They have a
        mac, in case that makes a difference, and live in the South Bay.
        Fast access at $30-$50/mo, not worth it for them, especially since
        they travel for months at a time.
        \_ Jyno has $9.95/mo dialup, but for just $3/mo more you can get
           a fractional DSL line from http://Sonic.net. Actually, I see these
           same prices from dslextreme, my current DSL provider, though
           to get that dial-up price, you have to buy a whole year.
2007/3/2 [Computer/SW/Security] UID:45856 Activity:nil
3/2     Paypal has a new security key:
        http://preview.tinyurl.com/ytr6zn (consumerist.com)
2007/2/25-3/1 [Computer/SW/Security, Computer/HW/Drives] UID:45817 Activity:nil
2/25    The top page of Fry's Electronic's (outpost) no longer shows
        the [Retail] Store Locator. Are they getting rid of the stores?
        \_ I doubt it:
           http://www.prnewswire.com/cgi-bin/stories.pl?ACCT=104&STORY=/www/story/02-05-2007/0004520005&EDATE=
           http://preview.tinyurl.com/ysdl54 (prnewswire.com)
2007/2/20-22 [Computer/SW/Security, Computer/SW/WWW/Server] UID:45782 Activity:high
2/20    Any recommendations on a cheap/easy-to-use digital signature system?
        \- i dunno exactly wat you are looking for or what the status of this
           project is, but if the obvious [gnupg] wont do, you can google
           for AKENTI. --psb
        \_ What do you want exactly?  A toolkit for digitally signing various
           files?  OpenSSL is free.  It is, however, a pain in the ass to use,
           but, once you know what you want to do with it, you probably won't
           ever have to figure it out again. -dans
           \_ Mostly documents that are federally mandated in the development
              process of medical software. The team is somewhat distributed, so
              I was hoping for something fairly easy to use.  Years ago I'd
              have used PGP, but I don't know how things have progressed and
              what a good (preferably open) system is.
        \_ GnuPG is fairly easy to use and its free. Many commercial apps use
           it for digital signatures: http://gnupg.org
           \_ Yeah, I pretty much agree.  If price is the key, find a decent
               frontend to gnupg and tweak it to fit your needs.  If usability
               is key, it's worth buying a copy of PGP.  Both support the
               OpenPGP standard.  OpenSSL is too low level for what you want.
               -dans
               \_ GnuPG seems to be the way to go. I've got everything figured
                  out except verifying signatures. Thanks for the advice. -op
                  \_ This is from memory, not the man page, but I think it was
                     something like gpg --verify.  Or are you trying to do
                     something more complicated? -dans
                     \_ You're right that --verify is the command line
                        solution, but I was going for something in a GUI. It
                        turns out that GPGee (Win Explorer extension) has that
                        ability, and works great. Thanks again. -op
2007/2/18-23 [Computer/SW/Security, Consumer/TV] UID:45771 Activity:nil
2/18    I have a Tivo.  I don't have service.  I'm not going to get service.
        What is cool that I can do with the Tivo?
        \_ eat it?
        \_ prop open doors?
2007/2/17 [Computer/SW/WWW/Browsers, Computer/SW/Security] UID:45765 Activity:nil
2/17    http://www.foxnews.com/story/0,2933,252541,00.html
        Mormon University says YouCant to YouTube.
2007/2/13-17 [Computer/SW/Security, Computer/SW/WWW/Server] UID:45734 Activity:nil
2/13    The personal webpages are now up
        \_ Ming-Hay
        \_ Thanks. Something seems a little messed up w/ the server config.
           The front page produces a server error for me, and the server
           is returning lists of files rather index.html for directories.
           \_ Agreed, things are fubar.  I've written/tweaked/debugged an
              Apache config or twenty in my day so I'd be happy to look things
              over and help out, just ask.  That said, I'm shockingly busy at
              the moment, so I may not be the quickest source of help.  You
              may want to turn personal public_html directories off until you
              fix this as the current config does leak information, which has
              (IMO, minor) security implications.  If you're a soda user, you
              can prevent people from browsing your public_html directories
              over the web until this is fixed with the following:
              chmod og-r ~/public_html
              -dans
2007/1/28-2/1 [Computer/SW/Security, Computer/SW/Unix] UID:45607 Activity:moderate
1/28    Where does inbound mail get spooled now? I had no problem moving
        my old spool to /var/mail/$USER, but where is the new mail
        spooling? (Yes, I read soda-changes.) Nothing is ending up in
        /var/mail/$USER/new. Should it be?
        \_ Do you have .procmailrc setup?  If so, I needed to add
           an additional rule at the end (after setting up the
           DEFAULT=/var/mail/loginname):
           DEFAULT=/var/mail/$USER):

           :0:
           $DEFAULT

           If I didn't do that, my mail just shows up as a single
           "msg.xxx" in the /var/mail/loginname directory.
           "msg.xxx" in the /var/mail/$USER directory.
        \_ nope, it's on a different server normal people don't have access
           to.  it's called 'seperation of services'.  The next time
           someone breaks into http://soda.csua.berkeley.edu, mail will
           continue to be delivered since they can't break into
           the machine that is handling delivery of email.  Were you
           in CS?  Do you remember how all the instructional machines
           didn't store your email on your local machine?  Same theory.
           \_ So I have to use IMAP or POP now? Is that right? I used to
              use UCB mail.
           \_ It certainly wasn't stored *locally* on every machine, but
              it was available via NFS on instructional machines.
              It looks to me like it /should/ be showing up on soda.  I presume
              'mead-mail' is where it's getting delivered-to on mead anyways.
              lrwxrwxrwx 1 root root 22 2007-01-24 00:58 /var/mail -> /mnt/oh/0X0-mead-mail/
              lrwxrwxrwx 1 root root 22 2007-01-24 00:58 /var/mail ->
              /mnt/oh/0X0-mead-mail/
        \_ Absent procmail interference, mail should spool to the Maildir under
           /var/mail/$USER.  If that's not happening for you, something is wrong.
           /var/mail/$USER.  If that's not happening for you, something is
           wrong.
2007/1/26-30 [Computer/SW/Security, Computer/SW/Unix] UID:45598 Activity:nil
1/26    Thanks root people!
        \_ Many thanks!
2007/1/18-25 [Computer/SW/Security] UID:45558 Activity:nil
1/18    Are the accounts on soda reactivated?  Looks like ssh is up, but I
        don't know if it's me not remembering the password I set it to
        after the last reactivation or if accounts aren't activated.
        \_ So you just typed your password (maybe several of them) into a box that might or
            might not actually be soda?
        \_ So you just typed your password (maybe several of them) into a box
           that might or might not actually be soda?
            \_ People should really use DSA public-key auth. It saves typing
               in passwords and prevents situations like what you described.
            \_ heh heh. heh heh. all your passwords belong to us.
                                                    \_ are
            \_ I did the same thing but since I don't remember my password
               anyway, "they" are welcome to hack away at whatever random
               stuff I was trying.  :)
        \_ Soda is up for root and politburo login right now, but not yet for
           general login.  Hopefully it will be up for general login soon,
           sorry about it taking so long. -mrauser
           \_ Thank you for your efforts. --erikred
              \_ Concur! Many thanks! --dim
2006/12/29-30 [Computer/SW/Security, Academia/Berkeley/CSUA/Motd] UID:45510 Activity:high
12/29   There have been a lot of complaints regarding soda reliability and
        users not volunteering their time and effort to help. Obviously,
        it wouldn't make sense for every user to be given root access so
        they can volunteer. Instead, why don't we use motd for people to
        contribute concrete suggestions (not just to start flame wars) to
        improve soda reliability and security? I'll start:
        - Tripwire
        - Maybe going back to a *BSD
        - Sendmail is complicated and filled with holes. Why not use an
          alternative MTA?
          \_ Also, there use to be this message "Last logged in from..."
             I used to look at to see where my account was last used.
          \_ From being a part of the new-rebuild considerations, yes, no,
             and yes. --michener
          \_ Run soda in a virtual machine.
2006/12/28-30 [Computer/SW/Security] UID:45508 Activity:insanely high
12/28   Soda will be down tomorrow December 29, 2006 for maintenance
        service.  We hope to keep the downtime as short as possible.
        - minghay (CSUA President)
        \_ You hozer.  What about my screen uptime and low pty IDs? - jvarga
        \_ You mean like less than 3weeks this time?
           \_ Hey, shut yer trap.  This machine is run by volunteers.  If
              you want to put time into it then step up.  I don't volunteer
              but I don't bitch at the people who do.  I appreciate their
              efforts and donation of their time to a shared resource.
              \_ I dropped by the office relatively early in the downtime.
                 No one with root was around any time that day (I was there
                 for like 4 hours).  Mconst dropped in a bit later to check
                 in as well, but he had only limited access (soda root, but
                 not keg, etc).  A few years ago, pburo nuked a number of
                 people from their root access.  I said then it was a bad
                 idea.  If current pburo wants to rectify that and increase
                 their root-base, I say more power to them.  And I'd be glad
                 to volunteer.  --scotsman
                 \_ Having a shorter list of volunteers is obviously going to
                    limit how much time is available to take care of soda.  My
                    gripe with the person above is that they're bitching out
                    (however many) people there are to take care of things,
                    all of whom are volunteers.  It's a free service, the
                    price is right, I'm happy that other people have maintained
                    it all these years with no expensve to myself and I
                    appreciate those efforts.  When things go bad it is
                    frustrating but I don't feel I'm owed anything by any of
                    them.
              \_ Exchange of money is not the only way to establish
                 responsibility.
                 \_ Money?  What?  Who said money?  The people running this
                    machine are donating their time.   That is what the word
                    "volunteer" means.  It certainly isn't worth anything on
                    a resume.  What are you talking about?
                    \_ You're reading the above comment wrongly.  The fact
                       that someone is a volunteer doesn't absolve them
                       of responsibility to do what they've volunteered to
                       do; quite the opposite.  A lame-ass is a lame-ass
                       whether he's being paid or not.  -tom
                       \_ They're not absolved but if you don't like the
                          quality and performance provided by other volunteers
                          you have two real choices: shut up and acknowledge
                          whatever little you're getting is for nothing in
                          return or volunteer to do it yourself and do a
                          better job.  Bitching them out without volunteering
                          doesn't improve the situation.  It only makes it
                          worse.  I shouldn't have to explain why.
                          \_ As I said above, pburo.past nuked the volunteers.
                             pburo.current, if they want/need the volunteers,
                             would have them if they say so.  Get on wall,
                             guys.  Ask.
                             \_ Volunteer.  Send a note to pburo asking what
                                they need help with.  If you did and they
                                ignored it or said they don't need any help
                                then that's that on the volunteer front.
              \_ So what do we need to do in order to get root? (Other
                 than, obviously, hack in like everyone else.)
                 \- you know, sloda has always been run by volunteers
                    and by any measure the current incarnation should be
                    a lot less work than the apollo, sequent, vax etc
                    days. i could be wrong, but i dont think it's ever
                    been down for as long as it was ~1 mo ago. i think
                    people have been tremendously appreciative of mr jvarga...
                    and if that appreciation hasnt extended to the pburo
                    at large, my personal perception is there appears
                    reasonable basis for that differentiation.
                    \_ My gut feeling is that Cal students today are not
                       nearly as Unix proficient as they were back in the
                       days. Most donations come in the form of Windows
                       boxes and students today could care less about
                       Unix. So these "soda volunteers" are really just
                       alumni and not the current breed.
                       \_ Whoever the volunteers are, they are still freely
                          providing service to the community with zero
                          compensation and a lot of flack for the times things
                          aren't perfect.  As far as proficiency goes, *nix is
                          a lot easier now than "back in the day" so uber m@d
                          sk1llz are no longer required to get class work or
                          anything else done on a *nix box.  This is just the
                          nature of technology.  I'll bet the average
                          teen/college boy in the 50s knew a hell of a lot
                          more about his car than *anyone* on soda/csua does
                          today.  That isn't necessarily a bad thing.
                                  \- my point is that maintainance should
                                     take less time, e.g in the age of
                                     cheep disks, a machine that doesnt have
                                     to be racked up in a machine room,
                                     standardized buses etc. anyway, his
                                     standardized buses etc. anyway, this
                                     seems to me to be mostly a leadership
                                     failure not a technical matter ...
                                     e.g. it's not a mostly a failure of
                                     e.g. it's not mostly a failure of
                                     knowledge, but of decisionmaking,
                                     communication etc.
                          \_ However, those of us who have been around dealt
                             with the same difficulties and complaints when
                             we were in pburo/on root.  And I can safely say
                             we never had a month long outage.  If you don't
                             want to/can't actually provide the service,
                             scrap it.  We'll survive...  But IMO, and IME,
                             having the alumni around and happy is a good
                             thing for those who want the professional
                             networking opportunities and knowledgebase that
                             comes with them.
        \_ http://csua.com/?entry=45397
           "I'm willing to wager $100 that Soda will be up for another 3 months
            or less before it is completely down for at least 3 days again."
           We'll see how long soda is down this time.
           \_ Are you helping with this maintenance to help make sure things go
              smoothly or just bitching from the sidelines?
        \_ A quick update from the ex-pres, secretary, and one of the few UGs
           with any *nix-fu. (whoever said that it's starting to be lacking is
           spot on). I have good news, and the good news is that our new VP
           doesn't suck. He rules. He's def. reading rootmail (something Ed
           never did), has a *lot* of Debian knowledge and experience, and is
           preparing to, you know, GET SHIT DONE. As a volunteer. Which is awesome.
           And something that Ed never did (this from being president over him).
           Right now, the holdup is that apparently there's no cardkey access for
           the moment but hopefully within a day or two, there will be much
           tinkering. I think (and hope) y'all will see the difference :)
           Take heart sodans! --michener
           \- lack of cardkey access never stopped us in the old days ...
              "oh look, the door is open". :-)
2006/12/2-8 [Computer/Networking, Computer/SW/Security] UID:45410 Activity:low
12/2    I have only two internet choices-- Verizon and Time Warner Cable.
        I've tried Verizon's 3Mbps/512Kbps service with 12 month commitment.
        In practice I only get 2.2Mbps/225Kbps and Verizon is unable to
        bump up the speed saying that they're unable to guarantee speed
        due to distance and whatever bullshit they said. Now my 12 month
        commitment is up I'm trying out Time Warner. I subscribed to
        their 10Mbps/512Kbps service which costs slightly more
        than their 6Mbps/512Kbps tier. Again, in practice, I'm only
        getting 3.5Mbps/200Kbps which is LESS THAN HALF of what they
        promised. Once again, they're giving me bullshit about distance
        and how they don't guarantee speed. Anyone have similar problems
        with their providers?
        \_ Wah, wah.  Cry me a river.  The service is cheap because it's
           consumer grade.  If you want an SLA, get a real connection.  And if
           your Verizon service is DSL, what they're telling you about
           distance isn't bullshit.  Distance from the local CO dictates a
           physical limit to the maximum speed your DSL line can run at.
           If you can get DSL service from Speakeasy, consider it.  Speakeasy
           can't rewrite the laws of phsyics, and their consumer plans still
           won't have an SLA, but, in my experience, they are a cut above all
           the other DSL/Cable providers.  How are you measuring your line
           speed, anyway?  It's actually really hard to do this accurately,
           and I have yet to see a point and click web tool for testing speed
           that does so. -dans
2006/11/30-12/8 [Computer/SW/Security, Computer/SW/Unix] UID:45402 Activity:nil
11/29   Pathetic Google engineers:
        http://valleywag.com/tech/revisit/man-in-google-lap-pool-217775.php
        http://www.valleywag.com/tech/dating/another-chance-to-crash-googles-holiday-party-217736.php
2006/11/21-12/30 [Computer/SW/Security, Computer/SW/Unix] UID:45359 Activity:nil
11/21   Bad stuff happened.  Root is working on restoring all services to
        normal.  Please email root if something is not installed or is on the
        fritz[0rz] (according to michener). - jvarga
        \_ How would we be able to tell?  Logins are still disabled, according to
            someone named "jvarga"... (2006-11-22 07:30)
           \_ You have to be THIS tall to enter...
        \_ Please email activate@csua.berkeley.edu to get your account
           reactivated.
2006/11/8-9 [Computer/SW/Security] UID:45263 Activity:nil
11/8    OpenSSH 4.5 is out:
        http://www.openssh.org/txt/release-4.5
        ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-4.5.tar.gz
        ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-4.5p1.tar.gz
2006/10/31-11/1 [Computer/SW/Languages/Java, Computer/SW/Security] UID:45045 Activity:moderate
10/31   Mainframes are back!
        http://www.cnn.com/2006/TECH/biztech/10/30/reviving.mainframes.ap
        \_ Mainframes never left.
           \_ There are big differences between 1) X is here, 2) X is coming
              back, and 3) X left. Fucking dumb shit, how did you even
              get into Cal?
              \_ I didn't get into Cal.  I dropped out of college so I could
                 spend more time on the motd and wall hanging out with smart
                 people like you hoping one day I can learn to comprehend
                 English as well as you.  No, wait, you are a babbling fool
                 who wrote something completely off topic and non-responsive
                 because you can't understand basic English.
                 \_ Bwaaahhhhhhh!!1!  You are teh suck!!!!1!!!!!!!!1!!
        \_ "The university saved money upfront by selecting a mainframe that
           runs at less than top capacity. Then on days when computing loads
           are heavier, the school can buy a short-term boost of extra
           processing power. Network managers call IBM, which remotely tunes
           the mainframe to deliver better performance."  Interesting.
           \_ *laugh*.  This is how the IBM mainframe division has always
              worked except in the 'old days' they sent a tech out at some
              outrageous hourly rate who opened the back, hit a button to turn
              on the extra cpus+planes+memory/etc that was already in the box.
              So now they just remotely login and tweak some software variable
              limit like "max speed = max speed + 50", logout and send a bill.
              This is almost as good a scam as MS making their money on CALs.
2006/10/27-30 [Computer/SW/Security] UID:45013 Activity:low
10/27   Anybody tried the "PDF decryptor" or "PDF password delete" type of
        software?  I have a PDF form file that won't let me save.  I'm
        considering getting one of those type of software to unlock the
        file.  I really don't want to pay to try it out though.  Are there
        free open source PDF unlock programs?  Thanks.
        \_ I've used Elcomsoft's (of "Free Dmitry Sklyarov!" fame) PDF
           decryptor.  Worked fine.  Its legality is dubious, though.
           \_ How so?  It's my understanding (correct me if wrong, please)
              that documents legitimately in your possession are covered
              by various fair use clauses, i.e. you're not stealing trade
              secrets, that sort of thing.  As for pdfs, unlocking them is
              trivial unless they're encrypted, in which case you're SOL--
              I don't know of anything that can handle this easily.  -John
              \_ I meant the legality of obtaining Elcomsoft's eBook
                 Processor itself, which was posted to the 'net after
                 Sklyarov was arrested.  I'm not referring to the
                 legality of decrypting (which should be legal based on
                 fair use rights, but OTOH there's that thing called the
                 DMCA).  And yes, Elcomsoft's program does decrypt PDFs.
                 \_ I thought there were two kinds of pdf encryption--the
                    access encryption and actual data encryption, and that
                    Elcomsoft only dealt with the latter.  -John
2006/10/12-13 [Computer/SW/Security, Computer/SW/Unix] UID:44782 Activity:nil
10/11   Star Wars characters USB thumb drives:
        http://tinyurl.com/kjg53 (gizmodo.com)
2006/10/4-6 [Computer/HW/Laptop, Computer/SW/Security] UID:44664 Activity:nil
10/4    motd routing nerds, help me out.
        let's say i am torrenting stuff on my laptop.  I want
        of course my SSH connections to be responsive and fast,
        but the upstream torrenting gets in the way.  Could i
        implement QOS somehow on my local machine and improve
        SSH?  I'm running Linux.  Would I have to make a virtual
        machine somewhere on my laptop and run QOS in that?  Thanks!
        \_ or just use your torrent client's builtin bw limit options
           \_ no no you don't understand, have you ever used QOS
              on a router before?  You can make your SSH packets
              have a higher priority than your web or torrent packets,
              reducing the latency for your ssh sessions.  If you limit
              the upstream of your torrents... your downstream becomes
              slower
              \_ sympathy factor crashes like rock. back in my day we got 300
                 baud and we were glad for it!
              \_ if you're bottlenecked on the inbound, no amount of
                 fiddling with your router's QoS settings is going to help.
                 Maybe if you could fiddle with your ISP's router, but I
                 suspect they won't be sympathetic to your torrent leeching
                 needs.
                 If you're bottlenecked on the outbound, limit your torrent
                 clients' upload speeds (or play with QoS).  It doesn't take
                 backing off much to give huge improvements to ssh and/or
                 other interactive programs.
                 clients upload speeds (or play with QoS).
           \_ get a faster pipe, whiner
        \_ So-called "gaming routers" can put preferences on ports.  That's
           quick solution.
           \_ Not only is this a quick solution, but an excellent solution.
              I bought a DLINK gaming router and never looked back. I get
              the best of all worlds-- filling up the pipe AND get small
              latency for ssh and X11 related things.
           \_ agree that this is one way to do it.  increase priority for
              port 22 outgoing (router should also be smart enough to
              prioritize incoming packets for the session), and back off your
              upstream torrent cap a bit until you're satisfied.
2006/9/27-28 [Computer/SW/Security, Computer/SW/OS/FreeBSD] UID:44580 Activity:nil
9/27    OpenSSH 4.4 is leftist
        http://www.openssh.org/txt/release-4.4
        OpenBSD src:
        http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-4.4.tar.gz
        OpenBSD src signature:
        http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/openssh-4.4.tar.gz.asc
        Portable src:
        http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-4.4p1.tar.gz
        Portable src signature:
        http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-4.4p1.tar.gz.asc
2006/9/27-28 [Computer/Networking, Computer/SW/Security] UID:44564 Activity:low
9/27    I'm currently using http://johncompanies.com and getting close to their
        40G/month bandwidth quota. I'm already paying $47/month for 5G disk
        storage and 40G/month bandwidth, and while the customer service
        has been superb, I'm a bit budget conscious and a bit reluctant to
        pay $80/month to johncompanies for the next level of service. I'm also
        a big socialist, and I support proletarian revolution. I've
        been contemplating a few options. For example, maybe I can get cable
        modem with 768kbps uplink/upstream for $50/month, which will be
        adaquate to serve 50-60G of content per month and has the positive
        side effect of having a much bigger disk storage over what I'm
        getting now at johncompanies. Is hosting at home a ridiculous
        idea or is it feasible?
        \_ Do you have a real server room environment?  Do you have a
           usage agreement that allows you to fill your pipe all month
           long?  No.
        \_ If you don't need a full jailed environment, JC is overkill.  Just
           host w/ el cheapo web provider.  If you need the custom env, it's
           probably worth the price.  JC are pretty easy to talk to, though.
           Mail them about what you want to do and ask for suggestions.  They
           might even refer you to someone who could better meet your needs.
           ("They" probably meaning "John")  --dbushong
           \_ Do you work at or an affiliate of johncompanies?
           \_ Overkill is when you need 40G bandwidth but got 1000G. The op
              said he's going over the 40G bandwidth quota so his hosting
              choice isn't exactly "overkill".
2006/9/25-27 [Computer/SW/Security] UID:44517 Activity:nil
9/25    Does anyone know if there's a way for mail.app to use different
        connection profiles for various accounts?  I have 2 imaps accounts
        which I need to connect to via an ssh tunnel at a client's; so
        normally it'd be "host.x.com:993" but I would like to switch
        quickly to "localhost:10993" without going through the "edit
        account" rigmarole...thanks for any help.  -John
        \_ Why not just create two separate accounts and activate the
           one that you need.
           \_ Fair point, I didn't think of that, thanks.  -John
2006/9/18-20 [Computer/SW/Security, Computer/SW/Unix] UID:44435 Activity:nil
9/18    Any reason that /dev/null is rw by root only?
        crw------- 1 root root 1, 3 Sep 13 12:56 /dev/null
2006/9/16-19 [Politics/Foreign/Asia/China, Computer/SW/Apps/Media, Computer/SW/Security] UID:44403 Activity:nil
9/15    Software in China helps w/ sentencing:
        http://news.com.com/2102-1012_3-6115154.html?tag=st.util.print
        "The software can avoid abuse of discretionary power of judges as a
         result of corruption or insufficient training."
        \_ What about the verdict part?
           \_ That's easy:
              if(political_activist || causing trouble) guilty=true;
2006/9/15-19 [Computer/SW/Security, Computer/SW] UID:44387 Activity:nil
9/15    Looking for recommendations (prefer Bay Area?) for ISP/company
        that can run a small-business web-site (products list, help
        pages, shopping cart) and handle their email (web-mail & IMAP access)
        My friend currently has a small business but is not satisfied
        with his current ISP/web-design firm handling his .com domain far
        in LA.  They are slow to respond to web-site change requests,
        and they have dropped connections, broken shopping carts,
        customer complaints and slow employee web-mail access.
        \_ Is your friend's current company called http://dreamhost.com? Have you
           looked into other hosting companies like http://shopping.yahoo.com?
           \_ not dreamhost. Was going to look at yahoo, but i think they
              want their own domain
2006/9/9-12 [Transportation/Airplane, Computer/SW/Security] UID:44330 Activity:nil
9/9     http://www.latimes.com/news/local/la-me-baggage9sep09,0,1502706.story
        This is insanely stupid.  All the bad guys need to do is throw
        kgs of TATP in the false hardsides of their luggage on several very
        busy buses and have them all explode at the same time on buses across
        the city.  Let's hope L.A. people are so inherently anti-public
        transportation that those buses never fill.
        \_ uh, from a security standpoint how is this any different than
           checking bags at the counter?  Or bringing a bomb onto any
           bus?  -tom
           \_ there's no difference from a security standpoint as you've
              implied.  however, from the standpoint of the terror impact of
              burning bus shells on TV, the synchronized bombings of full
              LAX transit buses is much more effective and obvious than
              (synchronized) exploding ticket counters or bus lines intended
              for low-income workers / students.
              \_ uh, whatever.  -tom
                 \_ uh, yeah
2006/9/8-12 [Computer/SW/Security, Computer/SW/WWW/Server, Computer/SW/Unix] UID:44325 Activity:nil
9/9     Is there a gzip-like unix command that will encrypt a file?
        I'm looking for something that's widely available. Thanks
        crypt (not very secure - DES).  Or failing that, openssl or gnupg
        \_ openssl or gnupg... what are you looking for?  Those will work fine..
           \_ Thanks for the recommendations. I'm basically experimenting
              with a way of using my friend's computer to backup my
              personal files and using my computer to backup theirs.
              Of course, this means storing files in a way where we can't
              see each other's personal files.
              \_ I'd recommend checking out http://dar.linux.free.fr
                 It makes the whole "backing up a bunch of files, encrypting
                 it, and chunking it into bite-sized pieces" thing much easier
                 than dump/tar + gzip + openssl.  --dbushong
                 \_ Oh, that is so cool. Thanks. My way was going to
                    be much more convoluted involving ssh and a bunch
                    of script writing. This should save some time.
              \_ One nice thing about using gpg (dump/tar | gpg) is you
                 can do public key crypto and not ever have passwords stored
                 in the script.  I believe gpg also can chunk it into X
                 byte chunks, optionally ascii armored, for emailing as
                 well. (well, I suppose you could mime-attach it)
        \_ openssl bf-cbc -in file.txt -out file.txt.bfcbc    # encrypt
           openssl bf-cbc -d -in file.txt.bfcbc -out file.txt # decrypt
           --dbushong
        \_ /usr/bin/{zip,unzip} on soda can take passwords.  Don't know if
           they're widely available on other *nix's.
2006/8/22-23 [Computer/SW/Security] UID:44096 Activity:high
8/22    In Windoze XP, how can I make my service start automatically when it
        boots up in Safe Mode?  I searched MSDN site and didn't see anything.
        Thanks.
        \_ I don't know how to do that in Windoze XP but it isn't that hard in
           Windows XP.
           \_ And that would be how?  Thx.
              \_ Start here and you should get the right idea:
           HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal
                 \_ Thanks!
        \_ Out of curiousity, why do you need to do that?
           \_ I am working on a module that is a service, and I need it to be
              loaded even in Safe Mode so that people won't be able to bypass
              it by rebooting the machine in Safe Mode.
              \_ I sure hope there isn't a way to do what you want.  If the
                 users want to bypass your module, let them!
                 \_ It's part of a security product, and we don't want the end
                    user bypass it.
                    \_ And what stops them from booting off a USB key, CD,
                       other hard drive, etc?
                       \_ BIOS password.
                          \_ Yank HD, take to another computer, etc.
                             \_ Always true for any product that can't
                                physically defend itself.  I don't think most
                                customers want their firewall to shoot at
                                people.
                                \_
                        http://blubbie.com/usb-nailgunner-pc-gadget.html -tom
                             \_ There's also FS encryption.
                             \_ Some of the firmare-level drive crypto stuff
                                out there is pretty buff.  Not failsafe, but
                                in most cases more trouble than it's really
                                worth.  -John
                    \_ What gives you the arrogance to think you can take over
                       the end user's system in such a way?
                       \_ I think he's building a security appliance not a
                          home user software thing.
                          \_ A security appliance running Windows?
                 \_ RESPECT MY AUTHORITAW!
              \_ And suppose there is such a way.  What's to stop
                 someone from writing a malicious service that does the
                 same thing?
2006/8/21-24 [Computer/SW/Security] UID:44088 Activity:nil
8/21    Apparently, you need to pay $1.00 to Direct Marketing Association to
        have your name taken off of the junk mailing list. When did they
        start charging for this?  http://www.the-dma.org/cgi/offmailinglist
2006/8/17-19 [Computer/SW/Security, Recreation/Humor] UID:44052 Activity:nil Cat_by:auto 80%like:44043
8/17    This is pretty funny:
        http://tinyurl.com/ku2mp (schneier.com/blog) -John
        \_ Another funny link on the same page:
           http://geekz.co.uk/schneierfacts
2006/8/17 [Computer/SW/Security, Recreation/Humor] UID:44043 Activity:nil Cat_by:auto 80%like:44052
8/17    This is pretty funny:
        http://tinyurl.com/ku2mp  -John
2006/8/12-14 [Computer/SW/Security] UID:43984 Activity:nil
8/12    Anybody know of a good backup solution for PGP encrypted disks?
        The way I've been backing up is to make copies of the .pgd file
        with dates in the filename.  This method is not very scalable as my
        .pgd files are becoming gigabytes in size.  Anybody know
        of an integrated solution to backups and encrypted folders/disks?
        OS X Leopard "time machine" backup feature looks interesting.  But
        I don't think it works if all my files are in PGP disks/directories.
        Any other solutions that integrate encryption and backups? -thanks.
        \_ This is Windows, right?  (Dunno if PGPDisk exists on another OS.)
           Wouldn't anything that checks to see if a drive letter is attached
           do the trick?  Also, is this for personal backups, enterprise-
           level, what?  -John
2006/8/9 [Computer/SW/Security, Computer/Theory] UID:43952 Activity:nil
8/9     Can someone update soda's ssh host keys on
        http://www.csua.berkeley.edu/computing/hardware
        I think the new keys are:
        RSA - 9c:a4:3a:66:23:22:b0:2f:ba:87:2a:ca:03:c5:24:b6
        DSA - 93:1d:30:88:65:a5:fa:38:6f:06:a3:86:12:0d:85:8b
        \_ That's what you'd like us to believe.
2006/8/7-11 [Computer/SW/Security, Computer/SW/Unix] UID:43929 Activity:nil
8/7     hey ax watch this when you get home from work
        http://www.youtube.com/watch?v=f83L9iWIx54
        \_ Is there a CSUA login?
           \_ Use http://www.bugmenot.com to find a login.
                \_ That was work safe in my book, but thanks for thinking
                   of me.  Has anyone one noticed any patterns concerning
                   women who wear Bebe shirts?  -ax
                   \_ I wanna work where you work.  I think there's
                      a pattern for chicks who wear Hollister shirts.
                      \_ one more for you
                         link:tinyurl.com/gmaxd
                         \_ Jesus Christ.
                            http://i43.photobucket.com/albums/e381/oklahomaok/DSCN0419.jpg
                            \_ That's not Jesus Christ. --Mel Gibson
2006/8/4-6 [Computer/SW/Security] UID:43908 Activity:nil
8/4     Has anyone used Working Assets cell phone service?
        is it good?
        \_ they are a sprint reseller.  co-worker has it, likes the
           customer service, and web payment options, and of course
           there is the donation thing to progressive cause of your
           choice.  Paper correspondence comes on all 100% recycled
           paper.  Just under $50 for 450 minute plan after all the
           taxes/etc.  One downside, she gets a lot of mail (snail,
           I think) from other progressive causes, but I think that
           one can opt out of that.
        \_ No.  Yes.  -proud American
           \_ how much for mass amounts of text messages?
2006/8/2-6 [Computer/SW/Security] UID:43882 Activity:nil
8/2     Does anybody have a sample of a reliable and robust /tmp cleaner
        which can be run out of cron? I am not sure what is a good way to
        make sure things that need to be persistent like ssh-agent "files"
        dont get deleted ... obviously I can specifically tailor it for
        "known knowns", but I want something conservative but also reasonable.
        \_ reboot?
        \- i'm thinking if the idea is to save space, rather than remove
           clutter, can add a switch to remove say +1mb files. But not sure
           of a good idea for the clutter problem ... maybe not descend to
           subdirs for some rules.
                \_ Yes.  -proud American
2006/8/2-6 [Computer/SW/Security, Recreation/Media] UID:43863 Activity:nil
8/2     What do you guys think about http://www.wtcmovie.com ?
        \_ I don't think much either way, but it's clear we're still in what
           I'd call "The Rambo Years" -- a very glorified version of historical
           events. I don't think it's outright propaganda, I think it's actually
           a fairly collective view the US has on 9/11. Make this movie in 10 or
           20 years and it will be entirely different. I can't wait for the FMJ
           kind of take on it. --michener
           I'd call "The Rambo Years" -- a very glorified version of
           historical events. I don't think it's outright propaganda, I think
           it's actually a fairly collective view the US has on 9/11. Make
           this movie in 10 or 20 years and it will be entirely different. I
           can't wait for the FMJ kind of take on it. --michener
           [formatd was here]
           \_ who/what is FMJ ?
              \_ Full Metal Jacket?
        \_ I prefer http://www.tawnyroberts.com  -proud American
2006/7/30-8/2 [Computer/SW/Security, Computer/SW/Languages/Web] UID:43838 Activity:low
7/28    Anyone have more info on the breakins on a bunch of Cal sites?
        http://www.csua.org/u/gkg   -John
        \_ Yes.
           http://ls.berkeley.edu/lscr/news/2006-07-25-security-incident
           (The defacements were mostly one multi-homed server).  -tom
           \_ Most kernel problems require local access to exploit.
              so, if not a user account then some other insecure service
              that can be used as a starting point.  Is this the case here?
              Do you know/mind_telling_us the details? -crebbs
              Do you mind telling us the details? -crebbs
              \_ The machine is a web hosting server for L&S departments,
                 where departments can install their own PHP code.  There
                 was a security hole in user-installed PHP code that got
                 the hackers shell access, and they used a 0-day RedHat
                 kernel priv escalation bug (SYS_PRCTL) to get root.
                 It is worth noting that the bad PHP code was hand-written,
                 not some package like phpBB with security holes which you can
                 search the net for; the initial compromise seemed to have
                 a higher degree of sophistication than is usually found
                 in script kiddies.  -tom
                 \_ I doubt the hackers found the PHP hole the same day the
                    Redhat bug came out.  I'd bet a buck they had non-root
                    shell access on the machine for a long time.  I also
                    suspect they had root for a while too.  Or there was more
                    than 1 set of hackers.  Why would sophisticated hackers
                    waste a quality attack on a web page defacement?  I'd bet
                    another buck they still have access to that and several
                    other machines.
                    \_ I can pretty closely track their root access; they
                       did have it for over a week before it was discovered.
                       I am pretty certain that they no longer have root
                       access.  I agree that there are likely remaining
                       apache-level holes on the machine; it's an
                       occupational hazard of an open PHP hosting environment.
                       When is PHP going to implement taint mode, anyway?
                         -tom
                       \_ The only way to be absolutely sure is to rebuild the
                          box.  You could do a bit by bit comparison from a CD
                          on all the binaries but yech.
                          \_ Yes, I've read "Reflections on Trusting Trust."
                          \_ Yes, I've read "eflections on the Revolution in
                             France"
                              -tom
                          \_ Yes, I've read "Reflections on the Revolution in
                             France" -tom
2006/7/13 [Computer/SW/Apps, Computer/SW/Security, Computer/SW/Graphics] UID:43656 Activity:kinda low
7/13    I have about 80 .pdf graphics files, that are a mix of vector graphics
        and bitmaps, and I want to convert them all to bitmap of a specified
        resolution, while preserving the physical size of the original image.
        Does anyone have any suggestions for how to do this fast and
        efficiently?  I have access to the full Adobe suite if that makes any
        difference.  thanks.
        \_ Are they all one page?
           \_ Each file is much less than a page in size, and they're all
              seperate files.
        \_ Should be able to use ghostscript.
           Post a file if you want an example.
           \_ Ok, thanks.  I've been messing with Ghostscript, but I can't
              figure out how to get it to both be 600 dpi and to preserve
              the physical size.  If I were smarter, I probably would have
              specified all the sizes in the Latex code so that I wouldn't
              care, but that would be a lot of work at this point (180 page
              document).  Here is an example file:
              /csua/tmp/lafe/5point5huge.pdf
              Any pointers very much appreciated.
2006/7/12-18 [Computer/SW/Security] UID:43645 Activity:nil 50%like:43591
7/12    Kchang -- thanks for turning the search feature back on!
        \_ you're welcome. I spent some time making sure that even if the
           mysql passwords are stolen, it would only have read only access.
           It would have been easier with suexec, but I guess the current
           admins insist that CGIs run as "nobody", which is a security risk
           that I guess they just don't care about anymore.     -kchang
        \_ Intellidiff is back too! Thanks!   -Intellidiff #1 fan
           \_ It is broken. I use scp to edit but it blames someone else.
              Yet another useless program written by someone useless.
2006/7/11-17 [Computer/SW/Security] UID:43637 Activity:nil
7/11    I'm working for a new company that is coming out with a web based
        product soon and we need to find good co-location facilites to
        host it. Can anyone recommend a good co-location facility in
        the south bay that can provide load balancing, backups, possibly
        SAN access, bandwidth on demand and has good peering?
        \_ you want the co-lo to provide the load balancing and storage?
           -shac
           \_ Possibly yes. This will be a one man show for a while so
              having some of the services managed would be nice and to
              lower the initial capital expense hit. Who does IGN use?
              \_ IGN is mostly at various Savvis colo's around the world
                 but we have all our own gear and storage. the only thing
                 we outsource is a fraction of our dba work. most of the
                 big companies dont outsource load balancing and storage
                 -shac
        \_ we use quest at work...
        \_ Not a recommendation, but check http://www.webhostingtalk.com
           You will get better response there and also do some search
           on a company's reputation.
        \_ might want to ask http://he.net
2006/6/30-7/5 [Computer/SW/Mail, Computer/SW/Security] UID:43544 Activity:nil
6/30    I'm trying to set up SSH port forwarding of VNC between my laptop and
        my home server.  Once I had it working but I lost be client-side
        config.  I can use PuTTY to set up port forwarding and can successfully
        load webpages off the remote server by using <DEAD>localhost<DEAD>
        My problem is that I can't seem to forward port 5900 (VNC) to my
        remote machine.  When I try telnetting to localhost port 5900 I get
        a connection but don't get the standard VNC handshake: "RFB 003.003"
        I know VNC is up on that machine because I can connect to it just fine
        when I am on the same subnet.  Any ideas?
        \_ You're not running VNC on your local box on port 5900, are you?
           \_ Ooh, good idea.. but no.
        \_ OK, so in PuTTY, your Forwarded ports: lines for your server Session
           look like:
           L80 localhost:80
           L5900 localhost:5900
           Is that right?  What OS is the server?
           \_ I had this:
              L80 http://myhost.com:80
              L5900 http://myhost.com:5900
              I changed the second one to
              L5900 locahlost:5900 and now it works.  Thanks!
              But why did the HTTP forwarding work then?
              \_ Maybe your firewall/VNC server/whatever would allow loopback
                 connections, but not connections on the "real" IP
2006/6/28-29 [Computer/SW/Security, Computer/SW/Virus] UID:43517 Activity:nil
6/28    I'm looking for a company that can do testing of antivirus and
        anti-malicious code products--I have a client who wants some sort
        of "external verification", even if it's just a formality.  I
        imagine this will involve running a battery of not-too-complex
        malicious code & exploit tests.  Any recommendations?  -John
        |_ http://www.counterpane.com/consulting.html or
           http://securityevaluators.com ? Both have well known security ppl
           \_ Securityevaluators looks good, thanks.  -John
2006/6/25-28 [Computer/SW/Security, Computer/SW/Unix] UID:43493 Activity:nil 53%like:43401
6/25    Hey root, could you please reenable finger motd@csua? Can't be a
        security issue since fingerd is enabled ...
        \_ Done. For some reason linking it refused to work, so I added it
           as a cronjob that happens just as the motd concatenation happens
           (every 2 minutes). --michener
2006/6/23-28 [Computer/SW/Security, Computer/SW/Unix] UID:43487 Activity:nil 80%like:43482 80%like:43483
6/23    Soda rooted by sendmail bug.  Will be going down at 8pm.
        \_ Resetting accounts again?
        \_ Good thing I stopped using my @csua.berkeley.edu address as my main
           non-work e-mail address!
        \_ Let's try FreeBSD again!
        \_ Let's try Windows!
        \_ Er, why is this in motd.public?
           \_ soda is run by liburals, always aiding and comforting Terrorists
           \_ Maybe 'cause it's a lie?
        \_ So, why is it still up?
           \_ It used to say 5pm.
           \_ The crackers have changed the root passwd!  Root is powerless!
              \_ I can assure you this has not happened. --michener
                 \_ They probably exploited something to put in a trojan su.
                    Did you test this by suing?  Now they probably have the
                    old root password!
              \_ Someone should go to the server room and destroy soda with
                 an sledgehammer before the crackers unleash the skynet on us.
        \_ I know of no such issue and have not heard from the rest of root
           about it. If this is not a lie, will whoever wrote this email root?
           --michener
           \_ Did the cracker post this to freak everybody out?
           \_ The only non-anonymous evidence I see is on wall log, where
              Paolo posted a snippet showing brg and sly speculating on
              whether soda had been hacked
              \_ which had nothing to do with sendmail at all.
        \_ Lying about a rooting is l4m3.
           \_ My account has been hacked!  Last login from China!
2006/6/23 [Computer/SW/Mail, Computer/SW/Security, Computer/SW/Unix] UID:43483 Activity:kinda low 80%like:43482 80%like:43487
6/23    Soda rooted by sendmail bug.  Will be going down at 3pm.
        \_ Resetting accounts again?
        \_ Good thing I stopped using my @csua.berkeley.edu address as my main
           non-work e-mail address!
        \_ Let's try FreeBSD again!
        \_ Let's try Windows!
        \_ Er, why is this in motd.public?
           \_ soda is run by liburals, always aiding and comforting Terrorists
           \_ Maybe 'cause it's a lie?
        \_ So, why is it still up?
           \_ It used to say 5pm.
           \_ The crackers have changed the root passwd!  Root is powerless!
              \_ I can assure you this has not happened. --michener
        \_ I know of no such issue and have not heard from the rest of root
           about it. If this is not a lie, will whoever wrote this email root?
           --michener
2006/6/23-28 [Computer/SW/Security, Computer/SW/Languages/Web] UID:43481 Activity:nil
6/23    apache back on and PHP seems to be working once more (so the main page
        works too). Security modules have been added, so if they interfere with
        things, mail root. Hopefully they won't though. Thanks for your patience
        and understanding --michener
2006/6/23-24 [Computer/SW/Security] UID:43475 Activity:nil
6/22    Whats up with all the defunct sshd processes on soda?
        Have we been hacked again?
        \_ I don't think so, but let me check your account.  What was your
           username again?
           \_ ok so then whats with the 1655 syslogds running?
2006/6/22-28 [Computer/SW/Security] UID:43470 Activity:nil
6/22    http://media.putfile.com/AOL-Cancellation
        Guy attempts to cancel AOL account with AOL customer service rep (who
        sounds like a full-blown American, not outsourced labor).  It gets
        started slowly, but it really builds up half-way in.
        http://insignificantthoughts.com/page/2
        http://www.msnbc.msn.com/id/13447232
        \_ It's amusing that he recorded it and posted it online but his
           experience is dirt common for AOL.  I hope no one was actually
           shocked by this encounter in any way.  It took me 5+ minutes to
           cancel an account a few years ago although the CSR took a different
           direction she still wouldn't cancel it until I'd told her at least
           three dozen times I wanted it cancelled.
2006/6/20-24 [Computer/SW/Mail, Computer/SW/Security] UID:43439 Activity:nil
6/19    I'm leaving the country for a year.  I am thinking of
        getting a Skype number in the United States, and I guess
        if people in the US call it, my Skype client running
        on my computer in the foreign country will receive the call?
        What is wrong with my plan to do this?
nnn     \_ 1. yes.  The only thing wrong with your plan is that as nerdy as
           you are, you may *NOT* be at front of computer all the time.
           After a while, when people couldn't reach you via the Skype
           number, they will STOP calling you.  I recommend you also purchase
           couple SkypeOut credit; and also set up a call-forwarding on your
           SkypeIn number to your local cell phone.  THis way, when you are not
           at the front of computer or your computer is off, calls will
           be forwarded to your cell phone.             kngharv
           \_ No.  You get voicemail with your skypein number.  I'm using
              it (my Swiss cell phone is forwarded to my CH skypein
              number while I'm in Chile.)  When you start your Skype
              client, it tells you you have voicemails.  Works a charm,
              worth the money.  -John
              \_ duh, voicemail come with the SkypeIn number.  My experience
                 is that after a while, people just sick of calling because
                 he/she gets voicemail all the time.  Skype forwarding
                 service would keep people interested in calling this number.
                                                kngharv
                 \_ That wasn't his question.  -John
        \_ 1. yes.  The only thing wrong with your plan is that as nerdy as
           you are, you may *NOT* be at front of computer all the time.
           After a while, when people couldn't reach you via the Skype
           number, they will STOP calling you.  I recommend you also purchase
           couple SkypeOut credit; and also set up a call-forwarding on your
           SkypeIn number to your local cell phone.  THis way, when you are not
           at the front of computer or your computer is off, calls will
           be forwarded to your cell phone.             kngharv
           \_ No.  You get voicemail with your skypein number.  I'm using
              it (my Swiss cell phone is forwarded to my CH skypein
              number while I'm in Chile.)  When you start your Skype
              client, it tells you you have voicemails.  Works a charm,
              worth the money.  -John
              \_ duh, voicemail come with the SkypeIn number.  My experience
                 is that after a while, people just sick of calling because
                 he/she gets voicemail all the time.  Skype forwarding
                 service would keep people interested in calling this number.
                                                kngharv
                 \_ That wasn't his question.  -John
        \_ There are other similar VOIP service.  For example,
           http://voicestick.com offers FREE virtual # anywhere in USA.  It
           can then forward anyone calling that # to anywhere in the
           world.  Of course you pay for the forwarded calls.
2006/6/13-15 [Computer/SW/Security] UID:43377 Activity:nil
6/13    ok, memorizing all these passwords is driving me insane. I
        know this has been asked before but I cant find it: whats the
        best way to keep a password-protected file of very sensitive
        information? in this case, all my other passwords. thanks
        \_ I use http://www.bugmenot.com
        \_ Whatever happened to this single login thing called the
           MS Passport or something?
        \_ I just use a yellow sticky note on my monitor.  Works like a charm.
        \_ I use a Palm Pilot that is password protected. I then have a
           Crypto program on it (also requires a password).
           \_ the second part is very important, cause even if you password
              protect the file using Palm's native password protection, the
              document is downloaded in unencrypted format when you sync to
              your computer.  I use Keyring for encryption:
              http://gnukeyring.sourceforge.net
        \_ I pgp encrypt this password excel file. You should have
           some password level as well:
           - password to this excel file
           - password for financial sites
           - password for secure e-commerce sites
           - password for other non secure sites
           A secure password can be the initial of your favorite
           phrase. I consider sites that emails back your password in
           plaintext as non-secure site. Good sites should reset your
           password to a random one in the worst case.
        \_ For passwords I don't get to choose, I use this:
           http://www.schneier.com/passsafe.html on PocketPC
           For passwords tied to domains, I use a command line version of this:
           http://bushong.net/dave/webpasswd
           (generates a reproducible hex hash)  --dbushong
        \_ http://keepass.sourceforge.net
           Also, in the same vein as generating passwords from hashes,
           here's a Firefox extension to make it more convenient:
           http://www.xs4all.nl/~jlpoutre/BoT/Javascript/PasswordComposer
           \_ Ooh.  Great minds think alike.  This one looks more secure than
              mine (uses a Base64 variant encoding rather than Hex).  Alas,
              I can't switch now or I'd have to check 2 of them :-) --dbushong
        \_ this program is really old but it's simple and works (for windows
           users): http://www.passkeeper.com
2006/6/12-13 [Computer/SW/Security, Health/Women] UID:43355 Activity:nil
6/12    http://news.yahoo.com/s/nm/20060612/od_nm/newzealand_streaker_dc
        Are all New Zeland women as attractive as this one? Are they
        more fit than say, American women in general? Damn I gotta
        move there!
        \_ Most of the women I've met from New Zeland looks more like
           this:
http://www.manuphotos.com/images/NEw%20Zealand/NZ%20Maori%20Woman%2001.jpg
2006/6/7-9 [Computer/SW/Security] UID:43302 Activity:nil
6/7     Rails question:  I've got data in a number of tables, all of it owned by
        one site "user" or another.  Is there a nice clean standard way
        (probably at the model level) to validate whether the current user has
        access to the requested bit(s) of data?  (Hopefully that's not too
        inefficient)  I tried some obvious things, but Model classes don't have
        access to your session data, so they can't trivially see what user id
        is making the request.  Or does this sort of thing not belong in the
        models.  Thoughts?
        \_ Try handlers.  Install a handler that will do the ID check, then
           throw an exception if it's fails.  The model has access to the
           session data, otherwise you can't do anything custom wrt to
           the session, so I don't know what you're talking about.  -marked
2006/6/7-9 [Computer/SW/Security] UID:43295 Activity:nil
6/6     Where can I find the RSA host key to put in a .ssh/known_hosts (or
        whatever exactly it's called) so I can ssh to csua?

here use mine
|1|42db5+KDy9Hano4lbj/SgFMPKDs=|taKwtpIOjvjZb9S9EIZ+pMbK7pQ= ssh-rsa AAAAB3NzaC1\
yc2EAAAABIwAAAQEA4F3Vgzyef4WlQqLst2xqi+yiRTdg1f4enDPkeT1zSFqhOFNXGoFlKJOGHRmpfwm\
Fxpa0eS6PVtleoI4b5kTbx0C9mA1OFXFVbZNlwjH6Hmife/NZazI4Nhe6Gl7JTNHBliu6VD6KLct66iA\
tZVUhOmM3gmbMfhgIqfbTvtPTLcYGeGHMz+X7dzWPMxMOqoD4iCXIthuLImijbL1HPqX1G65R048MWL1\
eHctxOi+XeFKzvAJ37iez2+prakglPkyAU6jg9luRiPtVQmjD3Q9gp+kenZGKKIK0FiuCuX+avuid5+5\
2psfIl6UWGbXl4VciV5QWZ6AdUmiEsEovZ9DbBQ==
2006/6/6-9 [Computer/SW/Apps/Media, Computer/SW/Security] UID:43284 Activity:nil
6/6/06  http://www.eff.org/deeplinks/archives/004721.php
2006/5/29 [Computer/SW/Security, Politics/Foreign/MiddleEast/Iraq, Politics/Foreign/Europe] UID:43215 Activity:nil
5/29    Castro's Cuba
        http://www.therealcuba.com/index.htm
2006/5/20-22 [Computer/SW/Languages/C_Cplusplus, Computer/SW/WWW/Browsers, Computer/SW/Security] UID:43123 Activity:nil 61%like:43119
5/19    I need a simple plug-in 128-bit (or so) C encryption library.
        Semmetric key is easiest, but public key is ok if that's the only
        thing I can get.  Any ideas?
        \_ symmetric
        thing I can get.  Any ideas?
        \_ http://mcrypt.sourceforge.net --dbushong
           \_ Thanks, I'm checking it out.
2006/5/17-22 [Computer/SW/Security] UID:43078 Activity:nil
5/16    Blue Security gives up:
        http://csua.org/u/fvo
2006/5/10-12 [Computer/SW/Security, Academia/Berkeley/CSUA/Motd] UID:43004 Activity:nil
5/10    Can we get kais motd intellidiff back now that cgi is re-enabled?
        \_ No. "suexec" is not enabled so it is run as "nobody", which means
           I need to make EVERYTHING world readable, including the index.cgi
           in which I embed mysql password. I am not enabling anything
           back till suexec is added. Until then, soda is insecure, and
           I'm not going to risk security for convenience.    -kchang
           \_ root: Can we get suexec set up? -intellidiff #1 fan
           \_ Mysql has fairly granular permissions.  Why not set up an
              account that has read-only access to the appropriate tables?
              \_ Because it also needs to write to certain directories/files.
                 In the end it's a lot of trouble and I don't have
                 time to code a workaround now. Look. Enabling suexec
                 takes 30 seconds, so it is a solution that has a much
                 higher work/time ratio. I'm no no hurry. I can wait. -kchang
                 higher work/time ratio. I'm in no hurry. I can wait. -kchang
              \_ How can we access mysql from soda?
                 \_ I compiled my private copy on a separate port and
                    not sharing it                              -kchang
2006/5/8-9 [Computer/SW/Unix, Computer/SW/Security] UID:42979 Activity:nil
5/8     A friend of mine still hasn't gotten his account reactivated even
        though he sent photo id. Is this still being worked on?
        \_ soda root == students
           may 12 == start of finals.
           I'd say a little patience is in order.
           \_ Granted, but 3 weeks is a long time. Could you update the
              website so they have a clue. 4/17 was in a galaxy far, far away.
2006/5/8 [Computer/SW/Security] UID:42976 Activity:moderate
5/8     why you are getting all that blue frog spam
        http://q.queso.com/archives/001917 - danh
        \_ While I'm not ready to call it outright bullshit, I'm skeptical:
           * Most DNS operators with a clue set TTL values to cache records
             for 24 hours to one week.  The DNS notify mechanism leaves much
             to be desired.  Thus, changing a DNS pointer is unlikely to
             divert a DoS attack.
           * Many DoS attacks hard code the ip of the target both to avoid the
             added complexity of DNS lookups and because, if the code is
             written by a script kiddie moron, he may botch it and do the DNS
             lookup before sending each packet which slows things down
             spectacularly.
           -dans
           \_ and I call bullshit here, because the TTL values of a domain are
              under control of the domain's owner (or at least the nameserver
              the domain is master'd from), and any DoS attack hardcoded to
              an IP is trivial to defeat by changing the IP of your web/service.
              And TTL only comes into play when an address is cached, which
              isn't likely to be the case with all the clients participating
              in a DDOS.
              -ERic
              \_ Correct, ttl values of a domain are controlled by the
                 domain's owner, but if ttl values are set to sane values,
                 e.g. 24 hours to 1 week, then it will be 24 hours to 1 week
                 before reducing them will have any effect on cache behavior.
                 If DDoS clients actually perform DNS lookups, then the vast
                 majority of lookups will go through caches, which won't
                 refresh their content until ttl expiry.  It would be
                 enlightening to see what http://bluesecurity.com's DNS records
                 looked like the week prior to the attack.  Also, changing the
                 IP of your service doesn't help if you just hop to a new IP
                 address on the same network, since modern DDoS attacks
                 overwhelm your upstream network pipe(s), and not just an
                 individual host running a sppecific service. -dans
        \_ This guy doesn't really have any idea what he is talking about:
           he can't explain correctly how Blue Security really works and
           instead of bothering to learn, he just argued with the people
           trying to teach him. Finally, he just turned off comments rather
           than accept that he was wrong. He sounds a bit like Bill O' Reilly.
           I wouldn't really take his explaination for what happened at
           face value, given his record. -ausman
2006/5/4-7 [Computer/SW/Security, Computer/SW/Unix] UID:42931 Activity:nil
5/4     Ok I need to make a hosting choice soon because my current co-op
        colo is falling apart like http://autobahn.org in the old days. I can
        go with http://dreamhost.com, http://textdrive.com, or http://johncompanies.com [from
        which dans heard good things about]. I really like johncompanies'
        virtual machines because you get root, but it is a whopping
        $47/month!!! http://dreamhost.com is dirt cheap, but you share
        resources and it's probably just as secure as soda (which is
        not very). I haven't heard anything about http://textdrive.com.
        What do you guys use and recommend? Thanks.
        \_ i have a bunch of stuff hosted with dreamhost and have been
           very happy with them. i was referred by another sodan. alot
           of guys at gamespy use dreamhost as well and love it. -shac
           \_ How much quota, IP/hosts, do you get, and how much do you pay?
              \_ i pay annually. so i paid $120 for 1 year starting at 20GB
                 disk, 1TB monthly transfer. each month they increase both
                 of these numbers for you so im probably at like 22GB and
                 whatever monthly transfer. the longer you are a customer
                 the larger your quotas are. see their pricing comparison.
                 http://www.dreamhost.com/shared/comparison.html
                 -shac
        \_ which coop is dieing?  how much do you use now?
        \_ i've heard good things about simpli.biz
        \_ JohnCompanies kicks ass.  You send mail and.. John mails you back
           in like 2 minutes.  None of the trouble-ticket-queue bullshit.  On
           the flipside, yeah, they're (relatively) pricey and you have to do
           all the admin themselves, and if John dies in a carcrash, I'm not
                                            \- that is the scenario i call
                                               BUS TERMINATED. --psb
           sure how much human failover they have.  --dbushong
           \_ HA that's pretty funny. But how do you know johncompany is
              run by 1 man, and if other companies aren't in the same
              situation?
              \_ I don't, but if you go with <insert random huge company>
                 it's unlikely.
        \_ Oh, if you are doing anything art or community oriented, consider
           Laughing Squid. -dans
2006/5/3-5 [Computer/SW/Security, Computer/SW/Mail] UID:42921 Activity:nil
5/3     Can anyone recommend an e-mail service that provides POP3/IMAP and
        SMTP with encrypted authentication, From: address to whatever you want
        it, isn't zombie-land, has minimal service interruptions, and won't
        go away?  Doesn't need to be free.  Really imporant to have minimal
        service interruptions.
        \_ Gmail!
           \_ From: address always defaults to @gmail.com.
              \_ I believe you can change this in Settings->Accounts.
                 There is no IMAP though.
                 \_ Cool, I just tested it.  Works through SMTP auth port 465
                    too.  Thanks. -op
              \_ Not if you're using SMTP, afaik.
2006/5/3-5 [Computer/SW/Mail, Computer/SW/Security] UID:42918 Activity:nil
5/3     In the light of what happened recently, should I stop using soda
        for any important communications and get a gmail account instead?
        \_ FYI, I am making my ISP account (Comcast) my main e-mail point.
           My problem with gmail is that the From: address is automagically
           replaced with your @gmail.com address, whereas I can make it
           whatever I want with Comcast as long as I authenticate.
           I do realize Comcast is the source of most zombie spam.
           This is after having used soda as my main mail account since '92.
           Props to all the undergrads who have kept soda up, anyway.
           \_ Comcast is a bad idea. Comcast is a spam target and also means
              you are tied to that ISP. Better to convert to gmail.
              \_ because, you know, gmail isn't a spam target.  -tom
                 \_ No, but it does have good spam filtering built-in.
                    Still, what is a good reason for using comcast over
                    gmail? I'd rather use soda. Or <DEAD>cal.berkeley.edu<DEAD>.
                    \_ I don't use comcast, but web interfaces to email
                       suck, and gmail still doesn't offer IMAP, right?  -tom
                       \_ Well, gmail is faster than any other webmail I've
                          used, and the searching/labeling/filtering system
                          is pretty good. Gmail is the only webmail I've used
                          that I could put up with daily... although I still
                          only use it for certain things. Maybe eventually
                          they will have IMAP. I saw some kind of beta 3rd
                          party attempts at providing IMAP gmail access.
                          Shrug.
                       \_ "web interfaces to email suck" ?? what are you
                          talking about? gmail is easy to use, has key-
                          board shortcuts and is accessible from anywhere
                          without worrying about ssh'ing or crap like that
                          \_ One drawback of web mail is that if you don't
                             access it within X time, your account can
                             go byebye. Although gmail's 9 months is I think
                             much longer than any other free webmail.
                          \_ Let me be more explicit; non-web GUI mail clients
                             have better interfaces than web-based mail
                             clients.  It can be useful to have access to
                             a web-based client, but the web interface is
                             signficantly less effective for day-to-day
                             activity.  -tom
                                \_ gmail supports POP/SMTP, so you can use
                                   other email clients like outlook and
                                   mac mail client.
                                   \_ but not with multiple mailboxes, so
                                      what's the point?  -tom
        \_ Most people stopped using soda for important communications a
           long time ago.
        \_ Yes, it's pretty obvious that gmail will be more reliable for
           things like that. I use both.
        \_ I echo the op's concerns and am switching to my primary e-mail to my
           ISP as well (SBC). If you lived in a neighborhood for 10 years,
           loved it, then all of a sudden couldn't get access to your house for
           2 weeks because their was a break-in, while the local police was
           processing your paperwork, I would move.  Again, not enough praise
           can be given to those volunteering their time and effort to maintaining
           this environment.  It's a testament that it's has as much uptime as it
           does.  But as your primary account, it would be awful to go
           through that again.  I think free e-mail services are risky because
           they can start charging at anytime or start going downhill
           (ie. Hotmail).  If you are happy with your ISP and plan to use them for
           awhile, why not go with them, at least you have greater control of the
           risks.
        \_ I'm still using soda for most things just because, it's really
           nice to be able to hand someone an email address you can be
           fairly sure will still be there in 5 years.
           \_ Why not just register your own domain ($2 to $30/year), and
              point it at a cheap virtualhosting/email provider ($10 to
              $50/month)? -dans
              \_ because there are free, or already-paid-for alternatives.
2006/5/2-5 [Computer/SW/Security] UID:42892 Activity:nil
5/2     Okay, I think I get it now.  If I want password-less login to
        soda, then I need to do the whole generating the public and private
        keys which requires a pass phrase, if I can put up with entering
        my unix password every time in SSH or PUTTY, then I don't need
        to do the whole ssh-keygen stuff.  Is it correct?
        \_ Yes.  But if you go password-less, then if soda is compromised
           again, you won't need to change your unix password.
           \_ why is that?  if soda is compromised then they have access
              to the unix password too.
              \_ Not if you didn't type it in while soda was compromised. -tom
                 \_ Unless it was cracked, which basically depends only on
                    how motivated the attacker is. -gm
                    \_ This is why a couple of soda users choose not to have
                       passwords at all -- they have "*" for their password
                       in /etc/shadow, so ssh keys are the only way they can
                       log in.  For those users, an attacker who gets soda's
                       password file won't have anything to crack.  --mconst
                        \_ how do you put * in /etc/shadow?  I can't even
                           view it?  so if I don't want to use unix password,
                           I need to ssh-keygen on my client server, then copy
                           the generated public key to soda under .ssh/ folder?
                           I should not copy my private key on soda though, right?
                           \_ Unfortunately, it's not possible for you to do
                              this yourself.  If you really want to have no
                              password, mail root and we can remove it for
                              you -- but before you do that, you might want
                              to try just setting your password to something
                              random and not using it for a while.  This will
                              give you a chance to get used to ssh keys and
                              see how you like them, and if anything goes
                              wrong with your ssh keys, you'll be able to log
                              in with your password and fix them.  And yes,
                              your ssh-keygen stuff is exactly right.  You
                              didn't mention this, but when you put the public
                              key on soda, you need to put it in a file named
                              .ssh/authorized_keys.  --mconst
                                \_ thank you bery much! this helped alot in clearing
                                   out my confusions.
        \_ I was told because of the comprise, my ssh private key may be
           stolen as well, but how is that possible?  I thought the ssh
           private key is on the client host, not on the server host (i.e.
           http://csua.berkeley.edu)?
           \_ Some people put their private keys on soda (with a passphrase,
              I would hope). If you did, then both your private key and your
              passphrase may have been stolen. If you didn't store your private
              key on soda, you should be fine. -gm
              \_ they put their private keys on soda, is it because they want
                 to use soda as a client to a different server?
                 \_ Exactly.
              \_ the private key would be under .ssh/ right?
2006/5/1-4 [Computer/SW/Security] UID:42878 Activity:nil
5/1     Where can I find step by step instructions to change my ssh pass?
        How do I change my login password?  Sorry I haven't been on unix
        for too long.
        \_ What do you mean?  You mean your login password?  Run passwd.
           You mean the password used to decrypt your private key?  If you
           stored a private key on soda, shouldn't you assume that's been
           compromised too and generate a new private/public key pair?
           \_ yes the compromised passphrase fo rdecrypt the key.  Please
              how do you remember the steps to regenerate a new priveate/pub
              key?  All I remember there were some very tricky steps to generate
              the key.  Like I either 1) have to use the keyboard that is on
              the server; or 2) use the java interface to generate the key
              Now I can't find the procedures on csua website....
              \_ You seem to be confusing ssh keys with the ridiculously
                 paranoid (and not altogether useful) "advice" on securing
                 your pgp/gpg key.  Try "man ssh-keygen"
        \_ Passphrase you mean?
        \_ Would this help? http://www.csua.berkeley.edu/ssh-howto.html
        \_ http://www.csua.berkeley.edu/~ranga/notes/ssh_nopass.html
2006/5/1-4 [Computer/SW/Security, Uncategorized/Profanity, Computer/SW/Unix] UID:42873 Activity:nil
5/1     Fuck it.
        RSS wall feed isn't down, so much as only serving out my little diatribe on
        the life and death of the hack.
        I got shit to do. Later.
        --michener
        \_ Bring it back.  This is *your* organization.  It should run *your*
           code.  If bitchy alums, myself included, have problem with it, fuck
           em!  If bitchy alums have a problem with google seeing it, tell
           them to get off their asses and write robots.txt file to fix the
           problem. -dans
           \_ root staff seems much more inclined to ignore than do anything.
              It's rather discouraging for alums to even bother trying to
              help when work making old desired software run is ignored, and
              for requests that people "mail root if you want to do this," are
              met with much silence.
           \_ yes, you can "fuck em" but if the existence of a feed
              makes people revolt, and not use wall logging, and therefore
              make the feed pretty much useless as well, what's the fucking
              point?
              \_ Lowers the alumni noise floor of wall thereby making it a
                 useful channel for undergraduate signal?  Sounds like a win
                 to me. -dans
                 \_ that way all 6 undergrads can talk.  If the alumni noise
                    is a concern for them, I'm sure they can figure out
                    how to make a second wallall channel
                    \_ If, as you indicate, there are only 6 active undergrads
                       in the organization, then perhaps the CSUA has run its
                       course and should be shut down.  Of course, you're
                       wrong, so the point is moot. -dans
                       \_ Do you actually work on getting stupider every
                          day?  -tom
                          \_ For you tom?  Anything. :-*
                             It's cute how you define stupid as "Any view
                             that doesn't support what you believe."  Here in
                             reality, i.e. that place outside of the bubble
                             you live in, we call that closeminded and
                             juvenile.  meh.  Bored now. -dans
                             \_ Coming from you, this is hilarious.
                                \- but is it ironic?
        \_ Let me add some useful info to this debate.  For the record, I
           think it's a cool idea, and don't care of Google indexes wall, in
           which case you could just reenable it as is.  But, the bitchy
           alumni can read these:
           http://csua.org/u/fok - How do I request that Google not crawl
           parts or all of my site?
           http://csua.org/u/foj - How can I remove content from Google's
           index?
        \_ Interesting and useful. But, really. I seriously have code to
           write for classes and such and shit to do. So I'll revisit at
           a later date. Until then, bad alums, no cookie! ;) --michener
2006/4/21-24 [Recreation/Activities, Computer/SW/Security, Computer/SW/Unix] UID:42798 Activity:low
4/22    ok, so maybe a dumb question, but a coworker just asked me and I'm
        not sure the answer: so is it possible to view the standard
        output of a process running on your system? I do have root. thx
        \_ truss/strace, with the option to print the entire syscalls
           \_ ok, let me rephrase: there is a process running on my system.
              I did not start it. I am root. I have just the process id
              (from ps) ... is there some way I can see std out/err? thx
              \_ you can't see what has -already- gone out to stdout/stderr
                 if you look at the write() calls for stdout/stderr (by fd)
                 you can see what it is putting out -now-.  truss -p pid
        \_ try /proc/<pid>/fd   \
                 \_______________\_  this was all helpful. thanks.
2006/4/19-23 [Computer/SW/Security] UID:42785 Activity:low
4/19    Hey, IMAP and IMAP/SSL aren't accepting my password.  Is this
        happening to anyone else?  I can login fine using ssh.  It had been
        working up until someone turned off POP.
        \_ Is it possible that SASL is configured to use a different
           authentication backend, e.g. PAM, than logins, which I believe use
           LDAP? -dans
           \_ Wrong.
              \_ I asked if it's possible.  I've seen this error on other
                 systems before.  Do you have any constructive suggestions?
                 -dans
        \_ SMTP auth... please
        \_ oh goodie, they both work now as of 1:30pm today (the 20th, and it
           wasn't working an hour ago). -op
2006/4/18-23 [Computer/SW/Security, Computer/SW/WWW/Server] UID:42779 Activity:nil
4/18    Thanks mrauser for the call just now.
        root:  I think one of the next priorities can be enabling POP3/SSL
        and IMAP/SSL.  I'm going to download e-mail with the unencrypted
        connection, but I'll probably change my password once every couple
        weeks until the above gets online.
        Most if not all of the official UC e-mail systems now require SSL
        for downloading and sending e-mail, right?
        \_ Actually, all password transactions must be encrypted according
           to the Minimum Standards for Networked Devices policy.  -tom
        \_ IMAP/SSL is now up, POP3 is down entirely. That should suffice
           for the moment. -michener
2006/4/18-20 [Computer/SW/Security, Computer/SW/Unix] UID:42775 Activity:moderate
4/18    Some thoughts about securing a machine.  Feel free to add your
        expert opinions. --ricky
        * Securing a machine that allows interactive logins by users
          is _very_ hard.
        * Reduce suid binary to absolute bare minimum.
        * Perform automatic _remote_ checksums from a machine that is
          separate and is not accessible by regular users.  Usually,
          NFS is recommended for this.  Basically, have a remote
          machine regularly check critical files on the machine and
          alert root if anything changed.
          \_ This existed a while ago, called Tripwire. Started as a
             a research project and grew to a startup. Many people tried
             it but gave it. The concept is easy, but in practice, it takes
             damn too much time. All of the above suggestions are good,
             but in the end, if the cost of manageability is high, no
             one will care. Lastly root and politburo aren't paid to do any
             of the above stuff and most people have better use of their
             time so... why cares. Would YOU like to volunteer
                \_ Why are suggestions being taken as a demand that they
                   do it.  If alumni (or "members") do all this stuff, aren't
                   they just "fucking the undergrads" ?
                   \_ No.  If they storm into the machine room or the office
                      and insist that it be done there way and be done right
                      this minute, then they are fucking the undergrads.
                      Historically, asking nicely and accepting a polite `No.'
                      is not one of the strong suits of the alumni.  Though
                      anecdotal, it's also worth noting that the amount a
                      given alumnus bitches appears to be inversely
                      proportional to the amount of meaningful contributions
                      (time, money, hardware, etc.) he makes to the
                      organization. -dans
                      \_ so you contribute absolutely nothing, eh?  -tom
                         \_ Ah let me clarify that.  The amount a given
                            alumnus bitches at the current undergrads appears
                            to be inversely proportional to the amount of
                            meaningful contributions he makes to the
                            organization.  If the alumni bitch at each other,
                            it has no bearing on the CSUA or its future.
                            -dans
             doing these things ricky? You should attend politburo.
             \_ Agreed, I tried to set up a modern version of tripwire on
                hosts I administered in my last job, and it's nigh unusable.
                It smacks of overengineering, and has too many features
                apparently added by marketing folks trying to sell to the
                enterprise software market.  Furthermore, if you want to be
                really secure, running _remote_ checksums isn't good enough
                since the credentials for soda are likely the same as the
                credentials for other CSUA hosts.  Thus, checksumming soda's
                binaries from screwdriver takes a non-trivial amount of work
                for a trivial gain.  Also, what happens when people trojan
                libraries not binaries?  Should we checksum those to?  Which
                libs? -dans
                \_ ideally you checksum everything, and flag what is 'volatile'
                   and likely to change from day to day.
                   \_ ideally, yes, but that's a really time consuming,
                      tedious, manual process.  Unless you have some '1337 tool
                      to do that for us.  If so, please post a url. -dans
             \_ I have used aide, a tripwire-like tool that checksums files
                in two ways. It works pretty well, and isn't that difficult to
                use.  I found it annoying if I didn't check/update signatures
                before doing package upgrades, which meant I couldn't tell
                whether the changes were intentional from the update or if
                someone had done something to the binaries the same day.
                While there are certain more-secure "ideal" ways to set things
                up (binary on immutable media, running on a separate system,
                database on immutable media, etc.) A simple "on this system"
                "aide running out of /usr/sbin" "database stored locally" while
                not great from a security standpoint, as long as one doesn't
                rely on the lack of warnings and messages to mean you are
                secure, is still a useful tool.
        * Educate users about ssh.  For example, unless the user is
          extremely certain that their private keys are safe (resides
          in encrypted partition, etc.) having empty passphrase is a
          bad idea.  Assuming above is met, using passphrase protected
          key pair and setting up authorized_keys is safer than using
          passwords.
          \_ Education works the best, when people are willing to
             be educated. Do you think people like to be educated?
        \_ It's also vital to keep up with patches to OS and utilities.
           \- ssh wont solve the problem. the problem is a combination of
              clueless users and users who dont care about security [and
              are willing to login from machines with kbd sniffers]
              combined with the close to inevitability of local account ->
              local exploit -> root. i think sloda should adopt the
              position: 1. soda will be broken into and should not be
              trusted ... meaning it should not be used as an outbound
              stepping stone ... no rsh, rlogin, ssh, telnet. i suppose
              you can leave ftp on and i guess scp. 2. do what you can
              about prevention [applying patches etc but also invest some
              in rapid detection. tripwire is a piece of crap but there are
              other tools to do this with ... i maintain checksums on about
              50 things [in some cases OSes, in other cases various data
              trees] and while i dont look at all the data everyday, with
              disk being cheap i can store enough snapshots i can at least
              go back and tell a story if there is a problem found at some
              point. even a half asses checksumming system will get you
              pretty far ... and would certainly pickup a trojaned daemon
              or client. we have some not-very-portable hacks to address the
              case of trojaned libs [these check low level information in
              inodes and compare them to higher level queries and look
              for inconsistencies ... like say in the link count] but these
              are probably not worth the effort ... they were crafted for
              very specific rootkits.
2006/4/18-22 [Computer/SW/Security] UID:42773 Activity:nil
4/18    I'm interested in doing some traffic analysis to see if
        the sshd trojan can be detected by looking at traffic patterns.
        I seem to remember people's inbound sshd connections
        being dropped now fairly frequently [but soda stayed up].
        Can anybody authoritatively speak to whether just some
        sshds were dropped or when one was dropped all were dropped.
        Also I assume outbound sshes were not dropped. I'm curious
        whether the sshd bug was in maybe the checkpointing routine
        when it was writing out to the sniffer log, or it was
        something more random/complex. Unless I get a good lead
        I probably wont pursue this because I'm sort of busy
        now and it's a lot of data to trawl though potentially or
        lot of work to reconstruct. Basically looking for a large
        clustering of sshd drops in time and space without evidence
        of a reboot [other protocols dropped] and not a normal shutdown
        might be smoke -> fire signal.
        \_ Even if this particular ssh trojan was causing the daemon to drop
           connections, why would you assume that this would be true of other
           ssh trojans? -dans
           \- why do you assume i assume it is true of other trojans.
              obviously my concern is we dont know where the soda hacker
              came from and what he did with the sniffed info. assuming
              this same person installed the same buggy trojan elsewhere
              is hardly a stretch. a better question might be: is the
              trojan buggy on just freebsd. and the issueis sshd not
              ssh. ssh trojan and sshd trojan have different implications.
2017/10/18 [General] UID:1000 Activity:popular
10/18   
Results 901 - 1050 of 1108   < 1 2 3 4 5 6 7 8 >
Berkeley CSUA MOTD:Computer:SW:Security:
.