@thisjosh Right now I am just using the static rules of spamassassin and it works reasonably well (95% of spam is filtered). I still keep the last 3 weeks worth of spam, in case I get word of an unduly filtered legitimate email.
I've been experimenting with the flagging system for the last couple of days, and have learnt a few strategies. But I feel that I'm making little difference to the mountain of accumulated rubbish.
Having within a few minutes easily run out of my 48 flags tonight, so now helpless for another 19 h...
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entires on one of my web servers with phpmyadmin in the connection criterion, but as I dont have phpmyadmin installed, it 404s. They originate from several former-Soviet-bloc countries, w...
@thisjosh Time wasting is the point. I want my filters to be such that I do not ever need to have a look at the spambox. This implies that the filters must not be too restrictive, and I find the Bayesian thing a bit worrying because its behaviour changes over time.
@TheEvilPhoenix I think your tags are good enough. There is one more I might add, but I'll have to let it stew a bit before I decide if it really actually fits, or just kind of looks like it might.
I was thinking maybe network-scanners, however looking at the questions in that tag it's not quite right. Another option could be vulnerability-scanners though I don't much care for it either.
@ScottPack can you do me a favor? Windows is fubarish with my user page, but can you tell me what badges i have? the system says I have seven, and last i looked before turning off my other system, i had 3.
Well first and foremost, it appears that they would be from Soviet bloc countries. Second it could be an exploit scanner, but if you don't have the software what does it matter? You would want to whitelist MAC + IP addresses (where static) that are involved with your network operations. How fa...
It looks like someone is trying to hack my site. The following comes from my IIS log files:
#Software: Microsoft Internet Information Services 7.5
#Version: 1.0
#Date: 2011-07-03 00:02:39
#Fields: date time s-sitename cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) sc-s...
@ScottPack given the different architectures, as well as the given natures of each question, i don't see the relevancy of the "exact duplicate" flag
assuming i understand the nature of that flag
it should only be used when the exact same procedure or general situation is involved
in this case, the architectures vary greatly
as such, different procedures must be done
thus, the "exact duplicate" flag or "possible duplicate" comment are irrelevant
because the exact same information is not covered in both posts
two different architectures. two different circumstances. two different response procedures
and two fundamentally different questions, even. where the IIS one references the general question of "What should I do", mine is "What can I do to specifically prevent this in the future?". Preventative procedures/tips questions are != the more general "What should I do" questions.
and given that i've argued for and against certain flags that I may or may not have issued on questions from AskUbuntu... my arguments tend to be extremely energetic and direct ;)
but now i understand why the debate team wanted me to join them when i was in high school :P
@ScottPack in your answer, you propose using the iptables module state to monitor the connections to limit
can i use the conntrack module which is existent in my system rather than the state module?
regarding SSH on any given system. Is it safe to allow both password and ssh-key authentication, or would I be better off with just ssh-key authentication?
assuming there are filtering rules to only allow certain sources of the connection in the firewall rules, and assuming i'm using one of those allowed hosts
I am in the process of putting my ~/.ssh/config in my dotfiles/ssh/config.
This makes me wonder should I also move my ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub to dotfiles/ssh/... as well?
PS: offcourse it's a private repository.
For home users, the physical access thing isn't a big deal - you're generally more worried about securing your neighbors from piggybacking than anything else, and they won't usually have unsupervised physical access to the inside of your house.
Businesses on the other hand, have a totally different profile.
@TheEvilPhoenix Sorry, just checked in again. A lot of recommendations now-a-days are to disallow password auth and only use keys. I would say it depends on your use-case and environment.
I'm sounding more and more like a lawyer. "It Depends"
@ScottPack no problem. Assume its my development system. This system sits at one location behind a NAT'd router. This system has access to all my servers via SSH keys with a bitstrength of 4096. These keys are subsequently secured with very secure passcodes, and thsoe keys do not share passcodes.
should i allow password auth so i dont need to carry a USB stick with my keys on it?
@ThomasPornin The soldering iron is a great method, don't get me wrong. I just find making changes a little more tricksome. Use of sponges and all that.
@RoryAlsop Well SE rewards people for referrals to questions (via the userid embedded in the link that you send). I don't know if there is a way to send people to chat the same way....
I hate it how when I make a comment in chat on a message from a while ago, it scrolls me to the bottom with no easy way to get back, and the message I responded to isn't even visible any more so I have to start loading older messages....
@ThomasPornin My answer on that site: I think if it is about theory, math, algorithm design, etc it is good [at crypto.se]. But if it is about practice, implementation, coding, risk management, usability, etc. it should be on Security.SE.
Presumably I can't get smacked for quoting creative-commons-by-sa text from there, especially since it's my own :)
@ThomasPornin, can you see @Ninefingers' draft? I wonder e.g. about the line "cryptography is really all about data in motion, as opposed to data at rest"
@Ninefingers I think this is an important post about a topic of endless confusion, and we have a great set of reviewers/collaborators to think it thru.
@nealmcb ok maybe it's not, I agree. The point I am trying to make is that it is about protecting data over untrusted channels. It can't help you when you put the key and the ciphertext together on the same system.
@rory or @avid, can you give @thomas reviewer status on the blog?
@ThomasPornin Yeah - in context I think it works better than by itself, but I'm really curious myself about the whole thing. I've gotta run now, and haven't finished reading the revised draft, but it definitely is headed in the right direction. Thanks, @Ninefingers!
@nealmcb Perhaps, but that's not what I'm using NaRQ for in this case. Definition of NaRQ per the "flag" menu: "It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form."
@thisjosh to refer to your question, I'm using a watermarking that tries to be less destructive as possible. As it's a semi-fragile one, that not a real problem.
The asker in that case is obviously not giving us all the details, and thus far seems to be putting the question in some sort of fantasy- (or, perhaps more appropriately, nightmare-) land context that for all we know only exists in his head. Without further clarification, which does not appear to be soon forthcoming, we have no way of providing an answer that can objectively be deemed as accurate and acceptable.
@nealmcb @ThomasPornin I believe data at rest is industry-speak for a turned off encrypted hard disk? I read it in an article somewhere, I cannot remember where, but really encrypting your hard disk is about protecting it in transit, i.e. transit from points of use. When you stop (the message arrives) and turn the computer on (decrypt and read the message) cryptography stops being able to protect the hard disk (message).
In any case, I'm happy for any improvements, suggestions, comments or whatever else. Anything that makes it a better article is fine by me.
Yep, in this abbreviated snippet: "encryption and decryption are all about sending data over untrusted networks such that only the intended recipient can read that information. ... so cryptography is really all about data in motion, as opposed to data at rest. Cryptography ceases to be able to protect you when you decide to put the key and ..."
@Ninefingers I think I understand the message you're trying to get across, but I'm not sure quite how to re-work it. Ideas, @RoryAlsop or @ThomasPornin?
if i'm setting up openssh-server on a system that is not a server (i.e. a workstation or actual system that I need to remote into that has access to other servers), should I change the auth methods so that only ssh keys are accepted, or should I leave it so both keys and passcodes are accepted?
Only here briefly, but I think in terms of industry usage, we all agree that crypto is used to protect data at rest (whether stored on powered down or powered up hard drives, CD's, USB keys etc) by encrypting the data, or in motion by encrypting the channel. It is further used as part of the authentication path
@Ninefingers I have read your draft -- great post ! For the level 4 of your black box setup, you might want to include a link to HDCP, because that's what they do (video is supposed to be encrypted all along, until it reaches the screen).
@ThomasPornin I thought someone might have tried it, somewhere, but I wasn't sure how to dig up anything on it. I'll do some searching and add it in, thanks!
@Ninefingers For the "data at rest": since I do not find it in your text, I believe you have already changed it. The paragraph where you somehow define encryption and decryption is like the rest of your text: it looks fine to me.
You might want to add a piece of explanation that I am quite fond of: "Encryption does not create confidentiality, it just concentrates confidentiality into the key. Presumably, it is easier to keep confidential a small key of fixed size, and the key uniform structure allows for the key confidentiality to be measured. Yet you have to start confidentiality at something. Once the key is known, confidentiality has left."
@ThomasPornin Yep, I'd removed it. I couldn't make an alternative work and I think that was partly where it was in the text. Ok, I might well incorporate that too - a few edits for tomorrow night I think!
I'm having a little trouble with it though, something is happening when you apply the key to the plaintext, but the key may exist before the plain text...
How can encryption concentrate confidentiality into the key if the key exists first and at the conclusion of the process the key is unaltered?
Also, there is no reason for confidentiality to alter data, in the same way that disclosure is not supposed to alter what is disclosed (otherwise Wikileaks is a huge joke)
This seems to be a fairly easy question to figure out, but I wanted to make sure. I've got about a thousand entires on one of my web servers with phpmyadmin in the connection criterion, but as I dont have phpmyadmin installed, it 404s. They originate from several former-Soviet-bloc countries, w...
Well first and foremost, it appears that they would be from Soviet bloc countries. Second it could be an exploit scanner, but if you don't have the software what does it matter? You would want to whitelist MAC + IP addresses (where static) that are involved with your network operations. How fa...
I am in the process of putting my ~/.ssh/config in my dotfiles/ssh/config.
This makes me wonder should I also move my ~/.ssh/id_dsa and ~/.ssh/id_dsa.pub to dotfiles/ssh/... as well?
PS: offcourse it's a private repository.
