Questions I was Googled for today

In my first installment of "you came to my website because you Googled for something", I take your questions and answer them:

"gdbm invalid argument" -- you were probably trying to install gdbm on osx, where the bin group doesn't exist.  Go here.

"leopard graphics update" -- you were probably wondering what the hell it is.  I don't know.  But here's the post about it.

"the punisher" -- You were probably looking for the movie.  But you came to my site because of a friend of mine whose site is called "The Punisher".

"when was nuclear fusion discovered" -- I have no idea how you wound up at my site.  Here's Wikipedia.  But it appears the answer is "1932".

"make looped ringtones" -- I talked about this on my Garageband post.

"how to airport extreme powerbook"  -- You were probably looking for how to install an airport extreme card into a powerbook.  Uhhh, unless you have a really really old powerbook that comes with a regular airport card (instead of an airport extreme),  you can't put an airport extreme in an older one.   And if you have a newer powerbook, it has an airport extreme built in.

"joel esler" -- Uh, you found me.  Here I am.

"how do i save my iTunes library for reinstating on another machine" -- Okay, here's a good question.  Open up iTunes, then open Preferences.  Then Click on the "Advanced" button.

See the folder location there?  Open up your Finder, browse to your home directory (which it should go to by default), click on music, you will see a folder there called "iTunes".  Copy that folder on to whatever media you have, thumbdrive, through the network directly to the other computer, dvd/cd, whatever...

Now, on your new computer, navigate to the same path, you should have an "iTunes" folder there, with nothing in it.  Delete the folder on the new computer, and replace it with the iTunes folder that you copied from the old computer.  Start iTunes.  iTunes should pick up the folder with all your music in it.  At most, when you play your music, if you have any music that you have bought from the iTunes music store, you will have to authenticate with the iTunes store in order to play your music (big whoop!).

"esler blog"  -- AH!! you found me.

"differences between two operating systems" -- You were probably looking for this post.

That's all for today.  Come back later for more questions answered.

 Subscribe in a reader

Science fiction author Arthur C. Clarke dies aged 90

As if you haven't read it in 90 other publications already,  Arthur C. Clarke died today at the age of 90.  The man who wrote "The Sentinel"  (No, not the movie with Michael Douglas and Keifer Sutherland in it), the book on which "2001:  A Space Odyssey" was based.

R.I.P.

 Subscribe in a reader

Microsoft Polishes a Turd with SP1

Microsoft released their big SP1 update for Vista today.  Check out the Vista team's blog here.  Good luck with SP1.  I've heard it doesn't improve much, including most of the things that caused it to be largely rejected by the Windows community overall.

 Subscribe in a reader

Answering Googled questions

Since my blog is indexed by Google, Yahoo, MSN, and whatever else search engines have found me, I get alot of hits from people searching for simple answers to questions.  When I look at them, I realize that there probably isn't a good way to answer the questions that are asked.  Obscure questions like "What does it mean to close port 80?".

So, I had a thought, maybe I'll take these every once in awhile and make a post to answer these questions.   So, what I'll do is grab some of these, write a blog entry and put it up.  So basically, if you have questions, feel free to ask em..  If I don't know the answer, I know someone who does.

 Subscribe in a reader

Mail and it's conversion

I recently had to move a ton of email (several hundreds of thousands) from one server to another.  (Damn you Gmail IMAP).  On one server all my email was in Maildir and in order to move all that email to the server I wanted it on, I had to import it into Mail.app.  Mail.app imports from a number of formats, the one I was interested in was mbox.  So, I scp'ed all my email down from server #1, of course, in Maildir.  So I needed some conversion from Maildir to mbox.  I found this script online with a quick Google search:

#!/bin/bash
echo search mdir-files in $1 and send them to mbox: $2
for file in `find $1 -type f`
do
echo parsing: $file
cat $file | formail >> $2
done

It took a long time to do, but now all my email is comfortably resting on server #2.  

 Subscribe in a reader

Microsoft Polishes a Turd with SP1

Microsoft released their big SP1 update for Vista today.  Check out the Vista team's blog here.  Good luck with SP1.  I've heard it doesn't improve much, including most of the things that caused it to be largely rejected by the Windows community overall.

 Subscribe in a reader

Answering Googled questions

Since my blog is indexed by Google, Yahoo, MSN, and whatever else search engines have found me, I get alot of hits from people searching for simple answers to questions.  When I look at them, I realize that there probably isn't a good way to answer the questions that are asked.  Obscure questions like "What does it mean to close port 80?".

So, I had a thought, maybe I'll take these every once in awhile and make a post to answer these questions.   So, what I'll do is grab some of these, write a blog entry and put it up.  So basically, if you have questions, feel free to ask em..  If I don't know the answer, I know someone who does.

 Subscribe in a reader

Mail and it's conversion

I recently had to move a ton of email (several hundreds of thousands) from one server to another.  (Damn you Gmail IMAP).  On one server all my email was in Maildir and in order to move all that email to the server I wanted it on, I had to import it into Mail.app.  Mail.app imports from a number of formats, the one I was interested in was mbox.  So, I scp'ed all my email down from server #1, of course, in Maildir.  So I needed some conversion from Maildir to mbox.  I found this script online with a quick Google search:

#!/bin/bash
echo search mdir-files in $1 and send them to mbox: $2
for file in `find $1 -type f`
do
echo parsing: $file
cat $file | formail >> $2
done

It took a long time to do, but now all my email is comfortably resting on server #2.  

 Subscribe in a reader

PaulDotCom Community Blog

So, over on the PaulDotCom mailing list several of us were discussing the idea for a wiki strictly for the security community.  Sections for malware, IDS's, Anti-virus and such.  I thought this was a good idea.  Then we said, "Hey, since the new mainstream media for people in our line of work is quickly becoming blogs and online journalism, why don't we start a blog.  But instead of just one person being able to blog, open the blog to lots of people.  People we know of course, but more than just a couple people.  How diverse would that be?

Well, Paul (of PaulDotCom) started the blog over at http://pauldotcommunity.blogspot.com and is going to be adding bloggers soon.  I think this might be a very interesting experiment.  

I've also linked it over on the blog roll on the right ----->

 Subscribe in a reader

Internet Zoning Initiative, and why it's stupid

Usually I'm not very vocal about 'policy' ideas.  Things that may become law in other words..  But I read this article as a recommendation from Marc Sachs.  We were sitting in the ISC chat room last night, he asked us if we had read it, and I said no.  So I grabbed the pdf and here I am blogging about it.

So essentially what the Internet Zoning Initiative is, is the ability (trying to become a requirement) for lawmakers to tell web providers to essentially make different "channels" out of the web.

For instance, if you had a website that had normal content and adult content, it would require you to run a "Child-free" website on port 80, then, using virtual hosting, run your adult website on port 69.  (Or whatever.)  Here's an example they give in their pdf:

Now, this, to me, is like asking a kid to click on, "Are you above the age of 18?  Yes, or No".  If a teenager (or adult for that matter) wants to go and look at whatever they want to look at, what are they going to click? 

Yeah, I can just imagine a kid now, sitting behind his desk at home, "Oh wait, I'm not 18, let me click No."  Come on people.

All you are doing is saying that basically the kid has to either click on the link on your port 80 website to go to your port 69 website.  OOhh!!  What protection!  Even that, hey, I can just add http://urlgoeshere:69 to my browser address bar, and thusly, I am there man!

I think this whole idea is founded well.  Okay, so you want to protect kids on the internet, fine.  I have no problem with that idea.  But the idea that you have here is a bit off base.  I've heard that OS X's parental controls are quite good.  However, never having tested them, I can't endorse them either yet.  But the idea of putting porn on a totally different port isn't going to solve a THING.

The only idea that I have ever seen that was at least descent was the invention of the ".xxx" domain for 'adult' content.  That's at least blockable and instantly distinguishable.  

Besides, let's look at the corporate implications for this.  Inline proxies would have to start listening on, essentially all ports.  IDS/IPS's would have to normalize http over any port, there would be all kinds of holes poked in the firewalls..  It's just not feasible.  Sorry, try again.

 Subscribe in a reader

SANSFIRE 2008

Found out yesterday that i'll be giving a talk at SANSFIRE 2008.  I have a topic (I don't want to publicly share it yet, as the title might change a bit) and it'll probably be one of the evening talks.

I don't know yet where or when the talk/speech will be (of course at SANSFIRE, but I mean, room and time)  so we'll see.  I'll keep the blog updated with more info as I find out.

 Subscribe in a reader

SANSFIRE 2008

Found out yesterday that i'll be giving a talk at SANSFIRE 2008.  I have a topic (I don't want to publicly share it yet, as the title might change a bit) and it'll probably be one of the evening talks.

I don't know yet where or when the talk/speech will be (of course at SANSFIRE, but I mean, room and time)  so we'll see.  I'll keep the blog updated with more info as I find out.

 Subscribe in a reader

Port 7100/udp part deux

I wrote about port 7100/udp before.  We had a bunch of packets submitted at the ISC, all rather random.  

Buddy of mine wrote this about it:

"The overrall packet size is very strongly 104 bytes. So a set hash length. and packets all doing about the same function.  A handful have been observed (like maybe 400 out of 2 million) with a length of 1144 bytes."

Nothing ever came of it.  You can see the graph here.  We still don't know what to make of it, so if you know what the deal was, or have any more intel, feel free to write in and let us know.  

 Subscribe in a reader

Apple TV, my personal review

By now, you have probably heard of the Apple TV, a device that is essentially a fancy-pants iPod for your TV.  Allowing you to take your media that is in your iTunes and have it play on or through your TV.

iWanted one when it first came out, but I couldn't bring myself to buy it.  Couldn't justify it.  Hard drive was too small, price point too high.

Then Apple came out with a second version, with way more harddrive space, (160 G's) but the price point was too high for the features that you get.  (You still had to buy movies on your iTunes on your computer, then transfer them over to the AppleTV when it got done downloading.)

Then Steve Jobs came out with the "AppleTV: Take two".  They lowered the price point, and made the ability to rent movies directly from my couch possible.  Excellent.  This is exactly what I was waiting for.  So, being such that it was my birthday, I went down to the local Apple Store and bought one.  The bigger one that was 329.00.  

Brought it home, plugged it in, of course, mine was on the old software revision, so it had to update first, which, after joining it to my Wireless Network, it downloaded the update and updated itself.  (802.11n, so the download was fast.)

Next, my computer that holds all my movies and music (I started ripping my movies from DVD onto my computer using Handbrake a long time ago :) auto-detected the AppleTV, asked me if I wanted to set it up (of course I did!), and it transferred all the media over.  Now, I have about 140 Gigs of media, so I set it to transfer and went to bed.  It was late at night anyway.

When I woke up, everything was synced, and I was good to go with my photos, music, and movies.  (Even though I could have streamed them directly from my machine(s)).  I've rented and watched a few movies.  It's been great.

Overall, I like it.  If you have taken the time to convert all your media (CD's, Movies, etc) into digital format and into iTunes, (or would) I highly recommend the AppleTV.  There is nothing like having your entire movie library, music library, and all of your photos at your fingertips able to be watched and loaded at the touch of a button.  Of course, along with the ability to rent movies, this is priceless.

Stamp?  Recommended.

 Subscribe in a reader

Port 7100/udp part deux

I wrote about port 7100/udp before.  We had a bunch of packets submitted at the ISC, all rather random.  

Buddy of mine wrote this about it:

"The overrall packet size is very strongly 104 bytes. So a set hash length. and packets all doing about the same function.  A handful have been observed (like maybe 400 out of 2 million) with a length of 1144 bytes."

Nothing ever came of it.  You can see the graph here.  We still don't know what to make of it, so if you know what the deal was, or have any more intel, feel free to write in and let us know.  

 Subscribe in a reader

Apple TV, my personal review

By now, you have probably heard of the Apple TV, a device that is essentially a fancy-pants iPod for your TV.  Allowing you to take your media that is in your iTunes and have it play on or through your TV.

iWanted one when it first came out, but I couldn't bring myself to buy it.  Couldn't justify it.  Hard drive was too small, price point too high.

Then Apple came out with a second version, with way more harddrive space, (160 G's) but the price point was too high for the features that you get.  (You still had to buy movies on your iTunes on your computer, then transfer them over to the AppleTV when it got done downloading.)

Then Steve Jobs came out with the "AppleTV: Take two".  They lowered the price point, and made the ability to rent movies directly from my couch possible.  Excellent.  This is exactly what I was waiting for.  So, being such that it was my birthday, I went down to the local Apple Store and bought one.  The bigger one that was 329.00.  

Brought it home, plugged it in, of course, mine was on the old software revision, so it had to update first, which, after joining it to my Wireless Network, it downloaded the update and updated itself.  (802.11n, so the download was fast.)

Next, my computer that holds all my movies and music (I started ripping my movies from DVD onto my computer using Handbrake a long time ago :) auto-detected the AppleTV, asked me if I wanted to set it up (of course I did!), and it transferred all the media over.  Now, I have about 140 Gigs of media, so I set it to transfer and went to bed.  It was late at night anyway.

When I woke up, everything was synced, and I was good to go with my photos, music, and movies.  (Even though I could have streamed them directly from my machine(s)).  I've rented and watched a few movies.  It's been great.

Overall, I like it.  If you have taken the time to convert all your media (CD's, Movies, etc) into digital format and into iTunes, (or would) I highly recommend the AppleTV.  There is nothing like having your entire movie library, music library, and all of your photos at your fingertips able to be watched and loaded at the touch of a button.  Of course, along with the ability to rent movies, this is priceless.

Stamp?  Recommended.

 Subscribe in a reader

Subscribers Part 2

In my previous post I said that I lost about 100 subscribers.  Looks like one of the url's that I had through Google Reader didn't transfer over, and one of the url's that bloglines grabs didn't transfer over.

See the problem is this:  

Some people subscribed to esler.is-a-geek.net

Some subscribed to www.joelesler.net

Under those two domain names, some people subscribed to the rss.xml, and others subscribed to the atom.xml.  (Little did you know, it was the same exact file.. heh)

That's a potential of 4 different subscription points.  Then, as I have been trying to do, I had everyone (using mod_redirect) reading the feeds from feedburner.  At this url: http://feeds.feedburner.com/RandomThoughtsFromJoelsWorld.  This is the url that is now managing all the feeds.

So what it looks like happened is, I lost all the people that were subscribed through Google Reader and Bloglines at the esler.is-a-geek.net url.   I can correct some of that, by using webhops and redirects, but I think I'll wind up losing about 50 or so still.

So, here is the correct URL to repoint your rss readers at.  I apologize for all the moving and confusion around here.  Switching my blog from blogger to mac.com hosted, and back, then moving from Georgia to Delaware, in the meantime switching ISP's 3x.  It caused some havok.

So, I apologize, now, my blog is hosted through the custom domain feature at Google, I should have no problems, and I won't move it anymore.  Thanks for your patience.

 Subscribe in a reader

Subscribers

Seems when I moved my blog I lost about 100 readers, and a bunch of people have been Googling me and successfully finding me again..  So, hopefully they don't get too lost..  My rss feed is below.  I serve my rss and atom feeds through Feedburner.  Lets me keep all the readers in one place.  More predictable that way.

When I was on my previous cable provider I had unfiltered inbound port 80.  Now I am on Verizon FIoS, and I don't have that luxury without paying for a business account.  So I moved the blog to Google's servers.  Not only is it faster for me to update the blog (instantly, there used to be a 5 minute delay), but I don't have any of the maintenance anymore. Cool

 Subscribe in a reader

Live from the Apple SDK event

No, I'm not actually there.  But Engadget is.  Hit the link.

So far --

-- ActiveSync, Native iPhone with Exchange.  Including calendar, contacts, GAL, etc..

-- Remote wipe

-- SDK

Check out the link above.

 Subscribe in a reader

Subscribers

Seems when I moved my blog I lost about 100 readers, and a bunch of people have been Googling me and successfully finding me again..  So, hopefully they don't get too lost..  My rss feed is below.  I serve my rss and atom feeds through Feedburner.  Lets me keep all the readers in one place.  More predictable that way.

When I was on my previous cable provider I had unfiltered inbound port 80.  Now I am on Verizon FIoS, and I don't have that luxury without paying for a business account.  So I moved the blog to Google's servers.  Not only is it faster for me to update the blog (instantly, there used to be a 5 minute delay), but I don't have any of the maintenance anymore. Cool

 Subscribe in a reader

Live from the Apple SDK event

No, I'm not actually there.  But Engadget is.  Hit the link.

So far --

-- ActiveSync, Native iPhone with Exchange.  Including calendar, contacts, GAL, etc..

-- Remote wipe

-- SDK

Check out the link above.

 Subscribe in a reader

Port 7100/udp

I've seen some news circulating this morning on port 7100/udp.  We've even put out a call for packets at the ISC.  We have received some pcaps of the traffic (we could use a bit more), and are researching what it could be.

One possibility that exists is the Solaris XFS font server bug that was published last year in October.  I'll update the blog as I/we conduct more research.

 Subscribe in a reader

I'm over it. (The flu that is)

Last week, I was in bed all week not eating, throwing up, drinking Gatorade, and running back and forth to the bathroom.  (So was my wife and daughter..  it was a sick household.)

But, everyone was asking how I am, so I just wanted to let you know that I am fine now (we all are, except for daughter, who has molars coming in now).  Thank you for your concern!

 Subscribe in a reader

I'm over it. (The flu that is)

Last week, I was in bed all week not eating, throwing up, drinking Gatorade, and running back and forth to the bathroom.  (So was my wife and daughter..  it was a sick household.)

But, everyone was asking how I am, so I just wanted to let you know that I am fine now (we all are, except for daughter, who has molars coming in now).  Thank you for your concern!

 Subscribe in a reader

FiOS is in

Okay, now that my FiOS is in, life is good.  I have lots of bandwidth now:

Last Result:
Download Speed: 14218 kbps (1777.3 KB/sec transfer rate)
Upload Speed: 13303 kbps (1662.9 KB/sec transfer rate)

As measured from http://www.speakeasy.net/speedtest.  Everything is working fine, save for me having to move my blog, and the pictures didn't get moved over, so i'll have to fix that slowly but surely.  

But everything seems to be working great.  I was even able to get get rid of one of my servers!  No need anymore!

 Subscribe in a reader

Blog is back up, kind of

Well, the blog is back-up.  You may notice that you are being redirected to blog.joelesler.net.

This is normal.  Do not panic.  I had to point my www cname at blog.joelesler.net so Google would let me transfer the domain to their servers.  We'll see how well that goes.

Verizon blocks inbound port 80 requests, so I thought I was going to be able to redirect around that, but it's proving more difficult then it seems.  I am currently blaming GoDaddy.  Stay tuned.

 Subscribe in a reader

FiOS is in

Okay, now that my FiOS is in, life is good.  I have lots of bandwidth now:

Last Result:
Download Speed: 14218 kbps (1777.3 KB/sec transfer rate)
Upload Speed: 13303 kbps (1662.9 KB/sec transfer rate)

As measured from http://www.speakeasy.net/speedtest.  Everything is working fine, save for me having to move my blog, and the pictures didn't get moved over, so i'll have to fix that slowly but surely.  

But everything seems to be working great.  I was even able to get get rid of one of my servers!  No need anymore!

 Subscribe in a reader

Blog is back up, kind of

Well, the blog is back-up.  You may notice that you are being redirected to blog.joelesler.net.

This is normal.  Do not panic.  I had to point my www cname at blog.joelesler.net so Google would let me transfer the domain to their servers.  We'll see how well that goes.

Verizon blocks inbound port 80 requests, so I thought I was going to be able to redirect around that, but it's proving more difficult then it seems.  I am currently blaming GoDaddy.  Stay tuned.

 Subscribe in a reader

Blog will be down take 2

Okay, last time I said the blog might be down, it wasn't.  The Verizon guy never came.  Welp, it'll be down today, because he is here.  So we'll see what time the blog returns.  

I have three blog entries I need to write, one on the AppleTV, one on the new bluetooth headset I have, and #3 on my Verizon install (when he gets that done).  Party.

 Subscribe in a reader

Blog will be down take 2

Okay, last time I said the blog might be down, it wasn't.  The Verizon guy never came.  Welp, it'll be down today, because he is here.  So we'll see what time the blog returns.  

I have three blog entries I need to write, one on the AppleTV, one on the new bluetooth headset I have, and #3 on my Verizon install (when he gets that done).  Party.

 Subscribe in a reader

The Secret Diary of Steve Jobs: Confession: I love to f*ck with car salesmen

The Secret Diary of Steve Jobs: Confession: I love to f*ck with car salesmen

Funny ass story over at FakeSteve about messing with car salesmen. I know, it's not the nicest story, but it's worth a read for a good chuckle.

Subscribe in a reader

The Secret Diary of Steve Jobs: Confession: I love to f*ck with car salesmen

The Secret Diary of Steve Jobs: Confession: I love to f*ck with car salesmen

Funny ass story over at FakeSteve about messing with car salesmen. I know, it's not the nicest story, but it's worth a read for a good chuckle.

Subscribe in a reader

Microsoft chops Vista retail prices

Okay, wait.

HAHAHAHAHAA.

Okay, I'm over it. Apparently Microsoft can't sell Vista fast enough so they decided to cut prices. News flash MSFT, I don't think it's the price (although that doesn't help), is the damn 6 different versions and horrible codebase to begin with that keep people from going to Vista. The suggested price for Vista Ultimate dropped from $299 from $219, while Home Premium fell from $159, to $129.

It didn't work with XP Home, XP media edition, and XP pro! What makes you think that 6 versions would be better than 3?

Just buy a Mac people. Come on, seriously, do you really need more of an excuse?

 Subscribe in a reader

Microsoft chops Vista retail prices

Okay, wait.

HAHAHAHAHAA.

Okay, I'm over it. Apparently Microsoft can't sell Vista fast enough so they decided to cut prices. News flash MSFT, I don't think it's the price (although that doesn't help), is the damn 6 different versions and horrible codebase to begin with that keep people from going to Vista. The suggested price for Vista Ultimate dropped from $299 from $219, while Home Premium fell from $159, to $129.

It didn't work with XP Home, XP media edition, and XP pro! What makes you think that 6 versions would be better than 3?

Just buy a Mac people. Come on, seriously, do you really need more of an excuse?

 Subscribe in a reader

iPhone SDK

Next week on March 6th, Apple, will have an event at the Cupertino Apple Campus to announce, what looks like an SDK.  From the image, I don't think they are going to actually ANNOUNCE an SDK.  They are going to announce their roadmap.  I could be wrong on this one, but that's the way I read the news blast.  "iPhone Software Roadmap".  Roadmaps are usually just an idea of how things are going to go, not really a product announcement.  

The picture has three interesting pictures on it.  One says "SDK", one says "Software Update", and another says "Enterprise".  This leads me to believe that Apple is going to have a Software Update first, then we're going to get the SDK.

But the enterprise logo is interesting.  Does that signal iPhone's exchange capability that I know Apple is working on?  (BTW -- The only reason I know this is because of the job postings on Apple's website wanting developers to integrate the iPhone and Exchange).

But I don't know, we'll see I guess.

 Subscribe in a reader

iPhone SDK

Next week on March 6th, Apple, will have an event at the Cupertino Apple Campus to announce, what looks like an SDK.  From the image, I don't think they are going to actually ANNOUNCE an SDK.  They are going to announce their roadmap.  I could be wrong on this one, but that's the way I read the news blast.  "iPhone Software Roadmap".  Roadmaps are usually just an idea of how things are going to go, not really a product announcement.  

The picture has three interesting pictures on it.  One says "SDK", one says "Software Update", and another says "Enterprise".  This leads me to believe that Apple is going to have a Software Update first, then we're going to get the SDK.

But the enterprise logo is interesting.  Does that signal iPhone's exchange capability that I know Apple is working on?  (BTW -- The only reason I know this is because of the job postings on Apple's website wanting developers to integrate the iPhone and Exchange).

But I don't know, we'll see I guess.

 Subscribe in a reader

Apple MACOS X xnu <= 1228.3.13 ipv6-ipcomp remote kernel DoS POC

Posted today, "Apple MACOS X xnu <= 1228.3.13 ipv6-ipcomp remote kernel DoS POC" is a remote Denial of Service against OSX 10.5.1, 10.5.2, Freebsd 5.5, 4.9.0, and NetBSD 3.1.

It appears that the only reason for this DoS to exist is basically, a typo.

See? Copy and Paste from Exploit:
" * ipcomp6_input does not verify the success of the first call
* to m_pulldown (m -> md typo?).
*
* md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
* if (!m) {
* ->
* md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
* if (!md) {"

New MacBooks and MacBook Pros

In what is basically a simple refresh of the product line, Apple put out new Macbooks and Macbook Pro's this morning, with each one getting new processors.

The MacBook Pros got a multitouch trackpad inherited from the MacBook Air, and instead of having two models of 15" laptop, and one of the 17"...  there is just now one model of the 15, and two of the 17.  So clearly Apple is going towards "bigger is better".  The second 17 offering simply more screen resolution.

Each laptop possess 802.11n capability for the fastest wireless, and of course an ethernet jack as well.

 Subscribe in a reader

Random IDS musings

I've seen alot of traffic lately on the snort-users list about how to clean out a database periodically and it got me thinking..

Basically the basis of the story is that people want to clean out the events from their DB on a periodic basis, 1 month, 2 months, whatever. Basically I look at it like this then, why are there events in your database that are that old?

If you have events in your IDS DB, you should look at them. That's the reason you have an IDS/IPS. To review the events (and in the case of IPS, prevent the attacks) and make sure the evil hax0rs are not getting you. If you have events in your current DB that are a month old, that tells me either one of two things:
A) You don't care about your alerts
B) You have too many alerts, and you don't have a system.

So let me help you get a system.

Make an archive DB (for the people using BASE, then this is pretty simple), now, you have two db's. One current, and one archive.

1) Events come in from Snort via barnyard into your current DB.
2) You review these events. Any events that you skip over, take note of them. Do you need this alert? Is applicable to your network? Do you KNOW if it's applicable to your network?
3) Any events that you take a look at, did it actually affect your network or was it someone banging on the door (script kiddie)? If it was a skript kiddie, what are you going to do about it? Block them at your firewall? Send their ISP a cease and desist letter? If you are going to do nothing then DELETE THE ALERT. Why keep it? You aren't going to do anything about it, so who cares?
4) Now, say when you are reviewing alerts, you come across something you need to investigate. Good. Take note of it and come back later. Leave it in your current db, get through the rest of your alerts.
5) Through your alerts? Good. Come back to the ones you still have in your current db. Do you need to take further action on these guys? Yes? Investigation time? Okay, well then you need to save the alert, so move it to your archive db. When you are done with your investigation in your archive db, then delete the alert.

Basically my point here is, don't keep alerts for no reason. Now, let's go back to #2.
For instance, if you are running web-php rules, but aren't running any webservers that run PHP on them, do you need the rules? Don't subscribe to the philosophy of "if the IDS isn't alerting, then how do I know it's working?". If you want to make sure your IDS is working, then write some kind of script to email you the statistics or something from the Snort process to make sure it's analyzing traffic. If you ALWAYS skip over a particular event, then WHY are you making your IDS run the rule? Shut it off!

Let's take a look at a network. Small one. One bsd box, 2 osx boxes, 2 windows boxes, and 1 linux box. Now, in your network these may be thousands of machines on tons of subnets. The network size doesn't matter, you can take the same philosophy.

Your frag3 and your stream5 preprocessors need to be tuned to the OSes. Done? k.

Now, take your network and look at it. What services are you running, what versions of those services? What OSes? What vulnerabilities are present on your network? Now, figure those things out and turn off the rules in Snort you don't need.

Now, this is where you say to me that this is a pain in the butt, and Snort has tens of thousands of rules, with more coming out each month, blah blah, etc. etc.

Well, that's where Sourcefire comes in. We have things like RNA, we have things like Adaptive IPS/IDS that will do all that FOR YOU, leaving you with the relevant alerts, things you HAVE to look at! But rather than this turning into a sales pitch, I am simply trying to get you to think about how to work with your data. Do you need to keep all that data? or can you fine tune it?

Apple MACOS X xnu <= 1228.3.13 ipv6-ipcomp remote kernel DoS POC

Posted today, "Apple MACOS X xnu <= 1228.3.13 ipv6-ipcomp remote kernel DoS POC" is a remote Denial of Service against OSX 10.5.1, 10.5.2, Freebsd 5.5, 4.9.0, and NetBSD 3.1.

It appears that the only reason for this DoS to exist is basically, a typo.

See? Copy and Paste from Exploit:
* ipcomp6_input does not verify the success of the first call
* to m_pulldown (m -> md typo?).
*
* md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
* if (!m) {
*
* md = m_pulldown(m, off, sizeof(*ipcomp), NULL);
* if (!md) {"

New MacBooks and MacBook Pros

In what is basically a simple refresh of the product line, Apple put out new Macbooks and Macbook Pro's this morning, with each one getting new processors.

The MacBook Pros got a multitouch trackpad inherited from the MacBook Air, and instead of having two models of 15" laptop, and one of the 17"...  there is just now one model of the 15, and two of the 17.  So clearly Apple is going towards "bigger is better".  The second 17 offering simply more screen resolution.

Each laptop possess 802.11n capability for the fastest wireless, and of course an ethernet jack as well.

 Subscribe in a reader

Posted from Engadget.  Take a look at the "In Stock Date" and the "Out Stock Date".  I guess it's easy to see when the new computers are coming and when they are leaving.

Yep, new Macbook part numbers are in Best Buy's database

Filed under: Laptops

Our tip jar, it brings us so much joy -- and it brings you, dear reader, this printout of what's purported to be the Best Buy database listing for one of those heretofore-unknown MacBook model numbers. You'll note that whatever MB402LL/A turns out to be, it's said to be in stock on March 2nd, which is just a few days away -- but also note that current MacBook Pros have MA-series model numbers, while the regular MacBook has traditionally carried the MB designation. That's interesting, but we doubt a $1,999 MacBook is about to surface -- besides, the current MacBook box is 15 inches square, smaller than the 19 inches listed here. (Yes, we measured.) As always, we'll see when we see -- come on Tuesday, you're almost here.

Posted from Engadget.  Take a look at the "In Stock Date" and the "Out Stock Date".  I guess it's easy to see when the new computers are coming and when they are leaving.

Yep, new Macbook part numbers are in Best Buy's database

Filed under: Laptops

Our tip jar, it brings us so much joy -- and it brings you, dear reader, this printout of what's purported to be the Best Buy database listing for one of those heretofore-unknown MacBook model numbers. You'll note that whatever MB402LL/A turns out to be, it's said to be in stock on March 2nd, which is just a few days away -- but also note that current MacBook Pros have MA-series model numbers, while the regular MacBook has traditionally carried the MB designation. That's interesting, but we doubt a $1,999 MacBook is about to surface -- besides, the current MacBook box is 15 inches square, smaller than the 19 inches listed here. (Yes, we measured.) As always, we'll see when we see -- come on Tuesday, you're almost here.

Microsoft to employees: We're still buying Yahoo!

In an internal email to MSFT employees Kevin Johnson, President of the Services and Platform division, says that they are still pursuing the Yahoo buy-out,  and that until MSFT's deal to purchase Yahoo is finalized, Yahoo should still be seen as rivals.

So it's looks like the battle isn't over yet.  Hostel takeover from MSFT time? 

 Subscribe in a reader

Microsoft to employees: We're still buying Yahoo!

In an internal email to MSFT employees Kevin Johnson, President of the Services and Platform division, says that they are still pursuing the Yahoo buy-out,  and that until MSFT's deal to purchase Yahoo is finalized, Yahoo should still be seen as rivals.

So it's looks like the battle isn't over yet.  Hostel takeover from MSFT time? 

 Subscribe in a reader

Microsoft throws open the door

If you haven't heard about it already, Microsoft has published a ton of their protocols on their MSDN page.  Everything from Windows Update to Remote Desktop.  What is (MSFT) trying to do here?  Are they going for the "open up the OS, we're moving to the online services" market?  I guess we'll see.

What will this lead to?  Well, people will try and make things interoperable, find the bugs, publish the bugs, exploits will reign down, cats and dogs, living together, MASS HYSTERIA.

But this may be nice for security researchers as well.  No more having to brute-force reverse engineer MSFT's protocols.  They are out in the open now.  

 Subscribe in a reader

Microsoft throws open the door

If you haven't heard about it already, Microsoft has published a ton of their protocols on their MSDN page.  Everything from Windows Update to Remote Desktop.  What is (MSFT) trying to do here?  Are they going for the "open up the OS, we're moving to the online services" market?  I guess we'll see.

What will this lead to?  Well, people will try and make things interoperable, find the bugs, publish the bugs, exploits will reign down, cats and dogs, living together, MASS HYSTERIA.

But this may be nice for security researchers as well.  No more having to brute-force reverse engineer MSFT's protocols.  They are out in the open now.  

 Subscribe in a reader

Okay, so the blog lives to be down another day

Verizon made a liar out of me.  They apparently had problems with the transferring of my phone number from my old provider to Verizon.  So let me gripe for a second, because it took me about 2 hours to get this answer.

1) I hate voice operated prompts: "Please say Support, Billing, Order Status, or help menu"  I say "Order Status", the computer says back to me "What Support question can I help you with?"  AHHHHHH!!!

2) Oh, and if you order FIoS, they tell you to check your order status online.  But when you do, and it says "for further information, please click here.  Then you click there, under "To find out the status of your FIoS order, please see the online order status screen here."  Essentially taking you back a screen.  AHHHHHHH!!!

3) Verizon says they can't install the tv and internet until the phone order comes through (seems broke).

4) Hold Sucks.

5) I want my damn FIoS.

 Subscribe in a reader

Okay, so the blog lives to be down another day

Verizon made a liar out of me.  They apparently had problems with the transferring of my phone number from my old provider to Verizon.  So let me gripe for a second, because it took me about 2 hours to get this answer.

1) I hate voice operated prompts: "Please say Support, Billing, Order Status, or help menu"  I say "Order Status", the computer says back to me "What Support question can I help you with?"  AHHHHHH!!!

2) Oh, and if you order FIoS, they tell you to check your order status online.  But when you do, and it says "for further information, please click here.  Then you click there, under "To find out the status of your FIoS order, please see the online order status screen here."  Essentially taking you back a screen.  AHHHHHHH!!!

3) Verizon says they can't install the tv and internet until the phone order comes through (seems broke).

4) Hold Sucks.

5) I want my damn FIoS.

 Subscribe in a reader

Blog may be down

The blog may be down for a bit today, I am switching ISP's to Verizon FIOS.  Well, I hope I am, the guy isn't here yet, and it snowed last night... so I hope I am switching today.

But anyway, just want to let you know the blog may be down for a bit or something while I get the DNS and ports and everything figured out.   Thanks!

 Subscribe in a reader

Blog may be down

The blog may be down for a bit today, I am switching ISP's to Verizon FIOS.  Well, I hope I am, the guy isn't here yet, and it snowed last night... so I hope I am switching today.

But anyway, just want to let you know the blog may be down for a bit or something while I get the DNS and ports and everything figured out.   Thanks!

 Subscribe in a reader

Thanks

I just wanted to thank all of you guys that sent me a Happy Birthday. I guess most people found out through Plaxo and everyone else found out from there. But I literally (actually?) received about 50 emails today wishing me Happy Birthday. Thank you all very much.

Thanks

I just wanted to thank all of you guys that sent me a Happy Birthday. I guess most people found out through Plaxo and everyone else found out from there. But I literally (actually?) received about 50 emails today wishing me Happy Birthday. Thank you all very much.

Recent Template Changes

As you probably have noticed, (or been annoyed by), I've changed the template again. Obviously I am experimenting with different code and layouts and looks.

I like the darker colors with the lighter fonts, but people write into me and tell me that it's hard to read. So I change it a bit. It's a never ending cycle. Basically, you can't make everyone happy. But I can at least try. ;)

So, I'm going to experiment with this blog layout for a bit. See how it goes.

Recent Template Changes

As you probably have noticed, (or been annoyed by), I've changed the template again. Obviously I am experimenting with different code and layouts and looks.

I like the darker colors with the lighter fonts, but people write into me and tell me that it's hard to read. So I change it a bit. It's a never ending cycle. Basically, you can't make everyone happy. But I can at least try. ;)

So, I'm going to experiment with this blog layout for a bit. See how it goes.

Snort Drinking Game by Erek Adams

Today I went looking for the "Snort Drinking Game". A joke made by Erek Adams, who, unfortunately for all those involved with Snort and his family + friends, passed away last October. So, in honor of Erek, I repost HIS drinking game here. I did NOT make it, this is EREK's. However, the game is getting a bit hard to find (only via the WayBack machine was I able to find it), now that Erek's servers are gone.

So, in honor of him:

Welcome to the Snort-Users Drinking Game!
version 1.00
By Erek Adams
The most current version of this can be found at
http://www.theadamsfamily.net/~erek/snort/drinking_game.txt . Please send
suggestions/updates to erek@theadamsfamily.net.

-----
WARNING: Excessive use of alcohol can be dangerous to your health. Please
play this game sensibly. If you start to feel ill or sick, stop playing!
Alcohol poisioning is not fun, and you can kill yourself!

Please be sensible! This is for _fun_ only!!

And if you don't like alcohol, please use your beverage of choice!
-----

Instructions: Don't read your snort-users email for a month. Or failing
that, you could use the archives. Start with the first email message for the
month. Read it. If an item from the following lists is in the email, take
the penalty drink. If not, go onto the next message. Repeat until you can't
read anymore, or have a empty bottle. ;-)

Please note: These are culmative! Be careful, as you could have SIX+ drinks
from one email!

Lets Begin!!

Take one drink if.....

The question is answered in the documentation.
The question is answered in the FAQ.
The writer doesn't know how use Google.
The reply is "RTFM"
The reply is "It's in the FAQ"
Writer is using Red Hat's broken pcap.
"Why aren't portscans showing up in ACID?"
"Why is snort not reporting dropped packets the right way on Linux?"
Marty complains about Red Hat's brokeness.
Writer is using "Linux 8" or "Linux 9".
Writer has a .sig over 4 lines.
Writer posts a packet capture with the IP's XXX'ed out, but still leaves
them in the hex decode below.
The drinking game starts it's own thread.

Take two drinks if.....

Writer obviously has _never_ read any docs.
Writer obviously doesn't know how to compile.
"How can I auto update the rules?"
Writer asks "Where is signature XX?" and that's already in the rules.
Writer says "It's broken." and includes _nothing useful_ about the
setup.
Someone reply's to a digest mode email, and includes the whole digest.
A virus scanner kicks email back to the list.
Writers .sig contains a "The contents of this email.." style discalimer.
Post contains a "Stupid Management Tricks" story.
Message says "Please unsubscribe me from this list."
Message is _entirely_ blank.
Confirmation/signup email gets sent to the entire list.
Someone posts a non RFC-1918 IP and remarks that "it's not being used
by anyone."
Someone replys to a message and has more 'header cruft' in thier message
than content--Thank you Lotus Notes....
You post a message to the list and get a "I am out of the office
message...."
If you realize that _YOU_ were the reason another penalty drink was
added to the Drinking Game.
You hit "Reply to All" instead of "Reply" and you start you response
with the words "Hey Sexy!"
Writer says "I've searched Google and can't find the answer." and the
answer is in the first 10 results.

Take three drinks if.....

The message has "Whitehats.com is down" or "Where's another
Whitehats?"
Someone wants the file vision18.conf.gz.
"Can snort email me alerts?"
"Can snort page me with alerts?"
Writer is using an old version (non-current release) of snort.
Writer becomes offended at "Kickass P0rn."
Writer becomes offended at comments in source code.
Writer isn't even sure what snort does.
Writer starts an OS Holy War.
Someone posts in HTML-ized email.
Posters .sig or disclaimer is longer than the reply.
Writer has no clue that http://www.snort.org/ exists.
Someone has to correct your drink totals for a penalty.
Someone posts thier IP asking for a portscan.
Writer obviously thinks that Red Hat == Linux.
Writer places the question and or email in the subject and leaves the
body of the email blank.
You move your mailserver from coast to coast w/o a temp box setup and
your bounces get you unsubscribed from the snort-users list. *sigh*
You post more than one message to the list and get back a "I am out of
the office..." message for _each_ post you made.
You have a broken vacation message that responds to the each post made
to a mailing list.
You realize that you just posted a "Hey Sexy!" response to a worldwide
mailing list.... From your _work_ email address.

And the Big Penalty Drink:

If you realize you are drinking to your own post, DOUBLE the penalty.
IOW, if you posted a HMTL-ized email, take six (yes, 6) drinks.

Snort Drinking Game by Erek Adams

Today I went looking for the "Snort Drinking Game". A joke made by Erek Adams, who, unfortunately for all those involved with Snort and his family + friends, passed away last October. So, in honor of Erek, I repost HIS drinking game here. I did NOT make it, this is EREK's. However, the game is getting a bit hard to find (only via the WayBack machine was I able to find it), now that Erek's servers are gone.

So, in honor of him I've found it and placed it here, plus we've updated it:

http://blog.joelesler.net/the-snort-drinking-game

Snort Hints

I recently received a question via the blog email. Email read:

"I'm a new Snort user in a IDS class and I'm getting the following error message about my bad traffic rule. however, if I comment out this rule it still appears in every successive rule. I have also open the bad traffic rule file and I see no "!any" syntax. Can you give some more advice?

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
ERROR: c:\snort\rules/bad-traffic.rules(27) => !any is not allowed
Fatal Error, Quitting..
C:\Snort\bin>

Additionally, I get this error message if I'm trying to run a custom rule named testing.rule:

ERROR: Unable to open rules file:
c:\snort\rules/TESTING.rules or C:\snort\etc\c:\snort\rules/TESTING.rules
Fatal Error, Quittting...
Any advice here also?"

Now, this looks like two separate problems. Let's look at the first one.

The (27) in Bold above tells you exactly what line you have the error on. You can find this in vi by starting vi like this: "vi +27 bad-traffic.rules". This will open the file bad-traffic.rules at exactly line 27. Well, I asked the guy, "What is line 27?"

"alert tcp $EXTERNAL_NET any <> $HOME_NET 0 (msg:"BAD-TRAFFIC tcp port 0 traffic"; flow:stateless; classtype:misc-activity; sid:524; rev:8;)"

Okay, so the error is "!any is not allowed". The only "any" I see here is the any after EXTERNAL_NET. So that tells me that something is screwed in the Snort.conf. So, how do you have your variables configured I asked.

"var HOME_NET 192.168.0.0/24
var HOME_NET any
var EXTERNAL_NET !$HOME_NET"

Was the answer I got. Well what happens here is Snort reads the variables in the snort.conf file from top to bottom, so the last HOME_NET that was configured is "any". Then EXTERNAL_NET is read "!any". Which you can't do. What happens is the header of the rule winds up being:

"alert tcp !any any <> any 0" See how that doesn't work?

Now, for the second question..

Looks like a simple misconfiguration of the RULE_PATH variable. The RULE_PATH variable is by default "../rules" so it just looks like testing.rules isn't in that area. So, you either have to reset that to the correct path, or put your rules in the RULE_PATH directory.

I posted these hints and this email with permission from the guy who wrote the question in to me, with the promise that I remove his name. No problem. Thanks.

If you have questions, feel free to write me. However, as I will tell you in #snort on IRC, and as I will tell you in forums. We are not here to help you do your homework. Every year at the same time we start getting a ton of really basic questions from users in IRC and on the Snort-Users list. There has to be a class at a University out there somewhere that is giving assignments.

Last year we got a classic one on the snort-users list. It was a direct copy and paste of the assignment asking us to answer his questions for him.

I'm definitely not saying that this guy that wrote me is in a class like that, since this kind of question happens all the time, it just happens to be that time of year.

New Template

I switched templates from the green one that I used to have this newer template made over here by TemplatesForBlogger. I think it looks rather nice, except I see that it has at least one error in it. I've noticed that if I put two paces after a period, like you are supposed to, you get this funky character.  See?  Right there.

Any CSS and Html people know what the issue is?  I suck at HTML and CSS.

Go, Walk no.. Run to CostCo

If you are lucky enough to have a CostCo in your area, go ahead and go. Went there today, and they had a nice deal on Thumbdrives. You can get 3 2Gb Sandisk Retractable USB Cruizer Drives for 48 bucks. (16 dollars a piece). So it's slighty cheaper (or about the same as) Newegg.com's prices here. Except, you get 3.

I think it's a good deal, at least comparable. Hell, I remember spending 89 dollars for my 512 Mb thumbdrive back in the day, and that was a steal. Now 2 Gb ones are McDonalds money. (Reference:  McDonalds money means "roughly the same as it would cost my family to eat at McDonalds"

Toshiba to give up on HD DVD

According to a Source that Reuters has, HD-DVD is done.  

Money Quote: "TOKYO (Reuters) - Toshiba Corp is planning to give up on its HD DVD format for high definition DVDs, conceding defeat to the competing Blu-Ray technology backed by Sony Corp, a company source said on Saturday."

Glad I went the Blu-Ray route.

New Template

I switched templates from the green one that I used to have this newer template made over here by TemplatesForBlogger. I think it looks rather nice, except I see that it has at least one error in it. I've noticed that if I put two paces after a period, like you are supposed to, you get this funky character.  See?  Right there.

Any CSS and Html people know what the issue is?  I suck at HTML and CSS.

Go, Walk no.. Run to CostCo

If you are lucky enough to have a CostCo in your area, go ahead and go. Went there today, and they had a nice deal on Thumbdrives. You can get 3 2Gb Sandisk Retractable USB Cruizer Drives for 48 bucks. (16 dollars a piece). So it's slighty cheaper (or about the same as) Newegg.com's prices here. Except, you get 3.

I think it's a good deal, at least comparable. Hell, I remember spending 89 dollars for my 512 Mb thumbdrive back in the day, and that was a steal. Now 2 Gb ones are McDonalds money. (Reference:  McDonalds money means "roughly the same as it would cost my family to eat at McDonalds"