Re: Hacked server

2007-04-08 Thread Ilya Konstantinov

On 4/8/07, Orr Dunkelman [EMAIL PROTECTED] wrote:


You will also need to install everything from scratch (and I suggest you
init. your bios as well).



Flashing your BIOS for no real need (and the attack you're talking about is
purely theoretical) is calling for trouble. While it's fun to play the how
can you totally 0wn a server? mental game, let's stick to what's really
done in real life attacks.


Try running them (including the web server itself) in chroot.


Alternatively, at least consider limiting Apache a bit:
1) Run it with an SELinux policy (FC3 and upwards supports SELinux; not sure
about FC2)
2) Limit, with iptables uid-owner/gid-owner rules, the network sites which
Apache can initiate a connection to. While this will add a maintenance
overhead for web apps which pull data from remote servers, it'll also break
many common attacks, e.g.:
- some pre-made attack scripts rely on making, say, your broken PHP webapp,
download the full-fledged backdoor program from a remote server owned by the
attacker
- one reason to attack might be to set up a spam zombie; By refusing
outgoing traffic, it couldn't contact port 25 on other machines.

Depending on your web apps, those limitations might be an unacceptable
overhead. Or you might flex them a bit, e.g. chose to always allow port 80
but not other ports. Also, they don't aim to give hermetic security, just to
cripple your environment just enough to frustrate an attacker or make your
machine useless for his needs.


Re: Nokia E61 Linux syncing

2007-04-08 Thread Ilya Konstantinov


On 07/04/07, Gil Freund [EMAIL PROTECTED] wrote:

 Hi,

 I am considering buying a Nokia e61 phone, and would appreciate any
 note on syncing the thing with Linux (more specifically Kontact,
 FireFox or Evolution). Any experience?



At the worst case, you're likely to be able to sync any modern phone's phone
book by pulling off its phonebook in VCF format (from the magic
pb/telecom.vcf file, ObexFTP service) and then using it in your favorite
PIM software. I know KDE's address book groks Nokia's VCFs rather well.

The OpenSync project is more along the lines of what you need (read: SyncML
support) but back when I tried it, it was still half baked.


Perl book

2007-04-08 Thread Moshe Gorohovsky
Hi,

Can you recommend a perl cookbook please ?
Please share your opinion on perl books or other manuals that you have
used.

I need a perl book for a system administrator with Java/C++/C
background, with lots of examples.

--
 Moshe Gorohovsky

 A6 CC A7 E1 C2 BD 8C 1B  30 8E A4 C3 4C 09 88 47   Tk Open Systems Ltd.
 ---
 - tel: +972.2.679.5364,http://www.tkos.co.il -

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Perl book

2007-04-08 Thread Noam Meltzer

Learning Perl  Programming Perl, both by O'reilly.
The first is a gr8 dive into water for everyone, programmer or no
programmer. The latter is a great reference for those who know.

On 4/8/07, Moshe Gorohovsky [EMAIL PROTECTED] wrote:


Hi,

Can you recommend a perl cookbook please ?
Please share your opinion on perl books or other manuals that you have
used.

I need a perl book for a system administrator with Java/C++/C
background, with lots of examples.

--
Moshe Gorohovsky

A6 CC A7 E1 C2 BD 8C 1B  30 8E A4 C3 4C 09 88 47   Tk Open Systems Ltd.
---
 - tel: +972.2.679.5364,http://www.tkos.co.il -

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]




Re: Perl book

2007-04-08 Thread Shlomi Fish
On Sunday 08 April 2007, Moshe Gorohovsky wrote:
 Hi,

 Can you recommend a perl cookbook please ?
 Please share your opinion on perl books or other manuals that you have
 used.

 I need a perl book for a system administrator with Java/C++/C
 background, with lots of examples.


Hi Moshe!

Please consult my site for that at:

http://perl-begin.berlios.de/

Regards,

Shlomi Fish

-
Shlomi Fish  [EMAIL PROTECTED]
Homepage:http://www.shlomifish.org/

If it's not in my E-mail it doesn't happen. And if my E-mail is saying
one thing, and everything else says something else - E-mail will conquer.
-- An Israeli Linuxer

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Perl book

2007-04-08 Thread Moshe Gorohovsky
Noam Meltzer wrote:
 Learning Perl  Programming Perl, both by O'reilly.
 The first is a gr8 dive into water for everyone, programmer or no
 programmer. The latter is a great reference for those who know.
 
Thank you for the recommendation, I will look at Learning Perl.

I had looked at Programming Perl by Larry Wall, etc.

and Perl Cookbook by Tom Christiansen, etc.

and online perl manuals and man-pages.



I was lost in Programming Perl and

perl man-pages because of their too detailed descriptions,

without good examples. I was need to run many examples

on my own, to understand first sections of the Programming Perl.

 - Moshe.

 On 4/8/07, Moshe Gorohovsky wrote:

 Hi,

 Can you recommend a perl cookbook please ?
 Please share your opinion on perl books or other manuals that you have
 used.

 I need a perl book for a system administrator with Java/C++/C
 background, with lots of examples.

 -- 
 Moshe Gorohovsky

 A6 CC A7 E1 C2 BD 8C 1B  30 8E A4 C3 4C 09 88 47   Tk Open Systems Ltd.
 ---
  - tel: +972.2.679.5364,http://www.tkos.co.il -

 =
 To unsubscribe, send mail to [EMAIL PROTECTED] with
 the word unsubscribe in the message body, e.g., run the command
 echo unsubscribe | mail [EMAIL PROTECTED]


 


=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Perl book

2007-04-08 Thread Moshe Gorohovsky
Hi Shlomi,

The perl course slides at cs.technion.ac.il that are linked from your
site is just what I need.

Is there an exercises [ and solutions :) ] page for that course
that we can access ?

Thank you.

- Moshe.

Shlomi Fish wrote:
 On Sunday 08 April 2007, Moshe Gorohovsky wrote:
 Hi,

 Can you recommend a perl cookbook please ?
 Please share your opinion on perl books or other manuals that you have
 used.

 I need a perl book for a system administrator with Java/C++/C
 background, with lots of examples.

 
 Hi Moshe!
 
 Please consult my site for that at:
 
 http://perl-begin.berlios.de/
 
 Regards,
 
   Shlomi Fish
 
 -
 Shlomi Fish  [EMAIL PROTECTED]
 Homepage:http://www.shlomifish.org/
 
 If it's not in my E-mail it doesn't happen. And if my E-mail is saying
 one thing, and everything else says something else - E-mail will conquer.
 -- An Israeli Linuxer
--

 Moshe Gorohovsky



A6 CC A7 E1 C2 BD 8C 1B  30 8E A4 C3 4C 09 88 47   Tk Open Systems Ltd.

---

 - tel: +972.2.679.5364,http://www.tkos.co.il -


=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Hacked server

2007-04-08 Thread Maxim Veksler

On 4/8/07, Hetz Ben Hamo [EMAIL PROTECTED] wrote:

You could do few things:

2. Have some logs emailed to you from the server on a daily basis
(crontab). By default, Redhat/CentOS/Fedora does this automatically,
but you can enhance it to send pack few log files and email them to
you as .tar.bz2 for example. That way you could check whats going on
to see who entered when etc.. (logs like ssh, httpd, sendmail).
Ususally when you compress text files, they become small, so the email
wouldn't be really big.


That is impractical advise. No one has time the go by daily basis over
the logs of every service, the only way your logs will prove to be
useful that way is *after* the break in.
You should be looking at logwatch.


3. Make sure your iptables/firewall settings will only let specific
needs and nothing else comes in. nmap is your friend to check, along
with stuff like SAINT etc. If you don't know firewall settings well,
just ask here. I'm sure someone would happily assist you with it.


Also, for user friendly firewall manipulation - http://www.fwbuilder.org/


4. have a cron script that will backup your web server stuff nightly.
If you don't have a tape backup or spare space for backup, then pack
the essential parts and use the script to email it to you (GMail
account can hold almost 3 gigs, so you can save the backup there)


dirvish.org is a gift from guru(s).


Hetz



Maxim.

--
Cheers,
Maxim Veksler

Free as in Freedom - Do u GNU ?

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Perl book

2007-04-08 Thread Amos Shapira

On 08/04/07, Moshe Gorohovsky [EMAIL PROTECTED] wrote:


I need a perl book for a system administrator with Java/C++/C
background, with lots of examples.



If examples are what you are after then maybe the perl FAQ could suffice.
http://perldoc.perl.org/ is a very conveient way to browse the documents,
the FAQ and even start a search of CPAN.

--Amos


Re: FOSS accounting software

2007-04-08 Thread Oron Peled
On Sunday, 8 בApril 2007 00:00, Geoffrey S. Mendelson wrote:
 First of all, the probablility in the real world of someone
 being able to verify the source code is clean is not very large.
 Few people can actually read source code to the point that a hidden
 exploit is not present. Even those that can, rarely do so.

Maybe, but the probability is still higher than in a closed source.

 Have you looked at the source code for any of the open source
 applications you run?
 Not little bits here and there, but the entire program?

Usually only the little bits that interest me personally,
maybe other people look at other bits (or maybe not).

However, our mythical attacker does not know which bits
and pieces would be read by someone. So basically we really
play a probability game here.

How many people have read the source of a typical proprietary
application? If you lived in the corporate world, you already
know the answer...

 There was for example a trojan placed in one of the more common TCP/IP
 utilities (I forget which it was, either traceroute or tcpdump) and it
 even made it to a few distributions of various operating systems.

Good example. Let's examine some of the facts:
  http://www.cert.org/advisories/CA-2002-30.html

  ...These modified distributions began to appear in downloads from
   the HTTP server www.tcpdump.org on or around Nov 11 2002 10:14:00 GMT.
   The tcpdump development team disabled download of the distributions
   containing the Trojan horse on Nov 13 2002 15:05:19 GMT.

Hmmm... roughly *two days* to discovery and damage control. Do you think
a proprietary application would have scored better?

I'll feed you with a better example:
  http://www.cert.org/advisories/CA-2001-01.html
  Interbase Server Contains Compiled-in Back Door Account

This backdoor took *6 months* to be discovered since the open-sourcing
of this database (now called Firebird). This is a very long time...

However, it was discovered that the backdoor was inserted to the
codebase in 1994.

Yes that's *six years* in which the database was proprietary and was
sold by a respectable company (Borland) to respectable customers (e.g:
Motorola, Nokia, Boeing and the Boston Stock Exchange).

 With closed source programs where the source code and the distribution
 of compiled programs is tightly controlled, the skill level required of a
 person modifiying it for nefareous purposes is much higher.

Eastern Eggs -- do you know any big proprietary application without ones?
Care to explain how these filter into the code in a tightly controlled
environment? Don't make us laugh.


Geoff, maybe development process was tightly controlled in 60's but it
surely ain't even close to this now.

In the crazy race for time-to-market almost no one care about real
bugs (as long as they are not show stoppers). For most managers security
related bugs look even more vague and hypothetical problem that only
paranoids are worried about unless it is already on CNN.


Cheers,

-- 
Oron Peled Voice/Fax: +972-4-8228492
[EMAIL PROTECTED]  http://www.actcom.co.il/~oron
ICQ UIN: 16527398

.. Complex problems have simple, easy to understand wrong answers.

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: FOSS accounting software

2007-04-08 Thread Amos Shapira

On 08/04/07, Oron Peled [EMAIL PROTECTED] wrote:


Eastern Eggs -- do you know any big proprietary application without ones?
Care to explain how these filter into the code in a tightly controlled
environment? Don't make us laugh.


Geoff, maybe development process was tightly controlled in 60's but it
surely ain't even close to this now.

In the crazy race for time-to-market almost no one care about real
bugs (as long as they are not show stoppers). For most managers security
related bugs look even more vague and hypothetical problem that only
paranoids are worried about unless it is already on CNN.



I must share with you another story - just last week I talked to a guy who
programmed the real-time code in SHDSL cards many years ago. They had very
tight CPU and memory constraints but they HAD to put in some easter egg. One
of the requirements or limitations in the corporate he worked for (a very
large and well known corporate) was that it won't download porn so they
embedded ascii porn on the card (since it's embedded it's not downloaded).
If you get into the debug interface and type 69 in some command there
you'll get screen fulls of ascii porn. The card is sold and installed by the
thousands every day today but nobody found about this egg so far (and the
guy who wrote it says that there is no chance of it being found since it can
only be accessed through the debug interface and the ascii images are
encrypted  so a simple memory hex dump won't reveal anything obvious about
them).

BTW - this guy got around to talk to a support engineer who supports this
card after a few years and the engineer told him there are still zero bugs
filed against this product (as a developer, I consider this to be the
ultimate measure that a programmer knows what he's doing).

Talk about proprietary software

--Amos


Re: FOSS accounting software

2007-04-08 Thread Geoffrey S. Mendelson
On Sun, Apr 08, 2007 at 07:46:12PM +1000, Amos Shapira wrote:
 I must share with you another story - just last week I talked to a guy who
 programmed the real-time code in SHDSL cards many years ago. They had very
 tight CPU and memory constraints but they HAD to put in some easter egg. One
 of the requirements or limitations in the corporate he worked for (a very
 large and well known corporate) was that it won't download porn so they
 embedded ascii porn on the card (since it's embedded it's not downloaded).

Marc, do you remember the PC BIOS upgrade you downloaded almost 10 years
ago the included in plain text SHEMA YISRAEL A.? I'm sure anyone
a few kilometers to the east of us would have loved seeing that. :-)


Geoff.
-- 
Geoffrey S. Mendelson, Jerusalem, Israel [EMAIL PROTECTED]  N3OWJ/4X1GM
IL Voice: (07)-7424-1667  Fax ONLY: 972-2-648-1443 U.S. Voice: 1-215-821-1838 
Visit my 'blog at http://geoffstechno.livejournal.com/

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Web app to upload files?

2007-04-08 Thread Amos Shapira

Hello,

I'd like to let a friend of mine to upload a file to my home server. It's a
one-off need.

Does anyone know of a simple web application I can install to let him do
that through HTTP without too much hassle?

I'm using Debian Etch.

Thanks,

--Amos


Re: Web app to upload files?

2007-04-08 Thread ik

Hello,

Well, there are few problems with such application:
1. HTTP is limited to the amount of files that PUT or fileupload
field allows.
2. It's easier to write your own program, rather then to tweak an
existed program (it will take you the same amount of time imho, or
even more).
3. It's not that safe (many security vulnerabilities exists with such approach)
4. There are better protocols for such action (FTP and SFTP as two examples).


Ido

On 4/8/07, Amos Shapira [EMAIL PROTECTED] wrote:

Hello,

I'd like to let a friend of mine to upload a file to my home server. It's a
one-off need.

Does anyone know of a simple web application I can install to let him do
that through HTTP without too much hassle?

I'm using Debian Etch.

Thanks,

--Amos





--
http://ik.homelinux.org/

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Hacked server

2007-04-08 Thread Baruch Shpirer
1. run it behind a decent firewall ( even pf,iptables logs should give you
some idea about who's accessing your computer and using which service )

2. dont run anything with root

3. run chrooted env's if possible

4. reinstall using something more updated system and dont install anything
you dont need, skin it down

5. configure firewall and services ACL to allow remote access (SSH) or
service level (BIND) access from known ips/networks

6. honeypots and monitoring scripts

7. rootkits

8. IDS can come in handy to alert you on hazardus actions on the server
(snort?)

9. hide all information about application names and versions, same goes
for OS, search for OS hardening guides


On Sun, April 8, 2007 00:33, Ori Idan wrote:
 A server I managed was hacked by a libian hacker.
 The only thing he did was changing the index.html of some web sites.


 The server is based on fedora core 2
 running:
 httpd sendmail bind proftp (through xinetd) ssh

 Any ideas how he could have done it?
 What should I do to prevent such hackes in the future?


 --
 Ori Idan



 !DSPAM:4618103d188168008797548!




Best regards

Baruch Shpirer
http://www.shpirer.com

Paranoids are people too, they have their own problems. It's easy to
criticize, but if everybody hated you, you'd be paranoid too.
D. J. Hicks

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Web app to upload files?

2007-04-08 Thread shimi

On Sunday 08 April 2007 13:12, Amos Shapira wrote:
 Hello,

 I'd like to let a friend of mine to upload a file to my home server. It's a
 one-off need.

 Does anyone know of a simple web application I can install to let him do
 that through HTTP without too much hassle?

 I'm using Debian Etch.

If you don't mind a bit coding and you have an HTTP server with PHP 
enabled...

Gathering a few piece of code from here will take no more than 1-2 minutes...

http://php.net/features.file-upload

-- Shimi

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Hacked server

2007-04-08 Thread Oron Peled
On Sunday, 8 בApril 2007 01:16, Amos Shapira wrote:
 Sticking to supported versions is rule number one in production networks
 (and plan ahead to switch to a later version well before the current one you
 use get's EOL'ed).

Correct. Ori used FC2, while FC4 is already EOL many months.

 As far as I'm aware FC is just a beta for RedHat and I'm not even
 sure they promise to issue security patches for it.

That's FUD. RedHat sponsors Fedora, but the project issues its own
releases and patches. 

 By supported I mean that the distro vendor promises to track the
 relevant security vulnerabilities in the included software and issue
 patched packages in a timely manner.

Fedora do this promptly like any other free software distro
(yes, I am a Fedora user as you can feel ;-)

 (Again - I'm not quite familiar with FC or RH but Debian makes all these
 suggestions uber easy).

I run 'yum update' daily (you can do it via cron of course, but I
prefer to do it manually).

For production server you should reconsider your distribution of choice:
Fedora is a fast paced distro like Debian testing, you get most
bleeding edge software (that's why I stick with it) but you pay
in almost daily updates and a short life cycle -- new release
every 6 months and good maintenance of only 1.5 releases (~1 year).

If you aim at free distribution with long term updates than you
may either switch to Centos (a RedHat clone, so your learning
curve should be easier), or switch to Debian stable (h...
there's no point installing Sarge now, and Etch is due RSN(tm).

-- 
Oron Peled Voice/Fax: +972-4-8228492
[EMAIL PROTECTED]  http://www.actcom.co.il/~oron
ICQ UIN: 16527398

Software is like Entropy: it's hard to grasp, weighs nothing and obeys
the Second Law of Thermodynamics, i.e. it always increases 
-- Norman Augustine 

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Web app to upload files?

2007-04-08 Thread Baruch Shpirer
a few good scripts for you:

phpXplorer (my favorite)
http://phpxplorer.org/phpXplorer/www/

blueshoes (windows folders like using JS)
http://www.blueshoes.org/en/applications/filemanager/

or some others

http://phpfm.sourceforge.net/

http://pfn.sourceforge.net/

On Sun, April 8, 2007 13:12, Amos Shapira wrote:
 Hello,


 I'd like to let a friend of mine to upload a file to my home server. It's
 a one-off need.

 Does anyone know of a simple web application I can install to let him do
 that through HTTP without too much hassle?

 I'm using Debian Etch.


 Thanks,


 --Amos



 !DSPAM:4618c238295701709215669!




Best regards

Baruch Shpirer
http://www.shpirer.com

Paranoids are people too, they have their own problems. It's easy to
criticize, but if everybody hated you, you'd be paranoid too.
D. J. Hicks

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: FOSS accounting software

2007-04-08 Thread Dan Armak
On Sunday 08 April 2007, Geoffrey S. Mendelson wrote:
 On Fri, Apr 06, 2007 at 11:53:45PM +0300, Dan Armak wrote:
  On Friday 06 April 2007, Geoffrey S. Mendelson wrote:
   I have a philosophical question. With open source software how do you
   make sure that the copy you are running was not modified to send
   your accounting data to some data collection site?
 
  You seem to be implying that there's a way to do this with proprietary
  software that doesn't work for free software. Is there?

 No, but there is a much greater risk of it happening with open source
 software. First of all, the probablility in the real world of someone
 being able to verify the source code is clean is not very large. Few
 people can actually read source code to the point that a hidden exploit
 is not present. Even those that can, rarely do so. Have you looked at
 the source code for any of the open source applications you run?

 Not little bits here and there, but the entire program?

The probability of any one person verifying an entire codebase is very low - 
I've certainly never done so. But that of some people doing it collectively 
or even just as 'patchwork' can be high. In any project with more than one or 
two committers, there will be people watching the commit log, there will be 
people looking through the code to learn how to extend it. Really important 
projects will come under the scrutiny of dedicated audit teams.

Anyway, the probability of someone verifying that non-open-source code is 
clean is a lot smaller yet. Both the ease of performing a complete-code 
audit, and the likelihood of one occuring for widely used programs, are 
higher for open source than for proprietary code.


 With open source software it becomes much easier for an unscrupulous
 person to modify the downloadable source code or ceate a mirror of the
 compiled program with a bug. There was for example a trojan placed in
 one of the more common TCP/IP utilities (I forget which it was, either
 traceroute or tcpdump) and it even made it to a few distributions of
 various operating systems.

Of course it's easier to make a mirror with a trojan for an open source app, 
because proprietary software disallows mirrors.But that doesn't automatically 
get the trojan to the end users.

I looked up the tcpdump case. The CERT advisory[1] says an intruder to 
tcpdump.org inserted the trojan into the release tarball, and it was then 
copied to various mirrors. tcpdump installations began to fail for 
from-source Gentoo users, and some of them[2] spent the couple of minutes 
needed to diff the good and bad tarballs. This revealed a small change to the 
code which even on first inspection is suspicious, so they investigated 
further, and/or alerted upstream. 

[1] http://www.cert.org/advisories/CA-2002-30.html
[2] http://www.hlug.org/trojan/

The whole issue was widely known and fixed in a few days. Apparently no major 
distributions' packages were affected. That's an example of a good immune 
response: the correct security system (release tarball hashes) both stopped 
the trojan and alerted people to it. 

Of course the system isn't perfect. tcpdump is a big project. When I install 
some small one-off utility I'd never heard of before, can I really trust that 
the distro's packager verified a GPG signature on the tarball he was testing, 
and got the signing GPG key out of band? For that matter, can I trust the 
upstream committers to keep that key and their development workstations 
separate from, and at least as secure as, the site where they publish 
releases? Can I even trust the good intentions of the main committers of this 
small project - not just that they won't trojan the code themselves, but that 
their code is security-conscious and of high quality and that they won't try 
to hide bugs and vulnerabilities instead of fixing them?

The answer is no - at least not for small-to-medium projects. But that's not 
the issue here. Proprietary software isn't better off. For the most part it's 
a lot worse off because the average Windows user, and the average Windows 
infrastructure, isn't as secure and security-minded as good open source 
software.

Imagine if a similar trojan were inserted into wireshark - not into the source 
tarballs, but only into the Windows .exe release. I'm sure they publish 
hashes and signatures for the EXEs as well. How many Windows users check 
those after downloading, do you think? Not users like you (if you ever use 
Windows), but average tech-savvy users? 


 With closed source programs where the source code and the distribution
 of compiled programs is tightly controlled, the skill level required of a
 person modifiying it for nefareous purposes is much higher.

Not that much higher.

First, trojaning a random binary is easy: that's what all viruses do, and by 
now there must be a huge  of virus-making tools and sample code out there.

Second, it's true that it's a lot harder to penetrate the distribution of 
official 

Re: Hacked server

2007-04-08 Thread Shachar Shemesh
Oron Peled wrote:
 Fedora is a fast paced distro like Debian testing
I'm assuming you meant Debian Unstable

Shachar

-- 
Shachar Shemesh
Lingnu Open Source Consulting ltd.
Have you backed up today's work? http://www.lingnu.com/backup.html


=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Hacked server

2007-04-08 Thread Oren Held




I disagree, Debian Unstable (Sid) is an ever-updating, bleeding-edge
distro: *tends to bring the latest version of each software*, while
Fedora doesn't.

For example, FC6 has Firefox 1.5, and 2.0 will never be there, only in
FC7.

Debian Testing is the next Debian Stable, like FC is the next RHEL.

 - Oren

Shachar Shemesh wrote:

  Oron Peled wrote:
  
  
Fedora is a fast paced distro like Debian testing

  
  I'm assuming you meant "Debian Unstable"

Shachar

  





=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: Hacked server

2007-04-08 Thread Oron Peled
On Sunday, 8 בApril 2007 13:59, Shachar Shemesh wrote:
 Oron Peled wrote:
  Fedora is a fast paced distro like Debian testing
 I'm assuming you meant Debian Unstable

No, unless I missunderstood the Debian process.

In Fedora untested packages first goes to the Rawhide
repositories (which I think are the equivalent of Debian Unstable).
Only later they filter into the official Fedora repositories.

Fedora does not have an equivalent to Debian Stable (because that's
what RedHat suppose to be when you pay them... ;-)

BTW, as the Fedora project matures it naturally encounters the
same challenges as any big community based distro. In that sense
I see a lot of learning and copying from Debian (which is a good
thing).

Regretfully, it's not common enough and there are plenty of cases
when the wrong wheels are poorly reinvented -- my (un)favorite is yum
instead of using apt4rpm. Well, at least the official repositories are
both yum/apt capable since FC5.

Bye,

-- 
Oron Peled Voice/Fax: +972-4-8228492
[EMAIL PROTECTED]  http://www.actcom.co.il/~oron
ICQ UIN: 16527398

Those who do not understand Unix are condemned to reinvent it, poorly.
 (H. Spencer)

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: FOSS accounting software

2007-04-08 Thread Marc A. Volovic
Quoth Geoffrey S. Mendelson:

 Marc, do you remember the PC BIOS upgrade you downloaded almost 10 years
 ago the included in plain text SHEMA YISRAEL A.? I'm sure anyone
 a few kilometers to the east of us would have loved seeing that. :-)

Yep. If I am not mistaken, it was in the BIOS fonts area...


-- 
---MAV
Marc A. Volovic [EMAIL PROTECTED]
Swiftouch, LTD +972-544-676764

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: VMWare and native Windows XP

2007-04-08 Thread Valery Reznic
  to the initrd can solve the problem.
 
  Is it a way to achive same on Windows, i.e boot
  windows, which was installed native under VMWare
 ?
 
  Valery
 
 
 See this page for SCSI Disk Drivers

http://www.vmware.com/download/server/drivers_tools.html
Thank you for the pointer.
I downloaded this file, create floppy from the image,
boot into the Windows... And stupid question - what
now ?
I see nothing on this floppy that can be run,
and control panel is not too cooperative.

Valery.


 
 I vaguely remember solving a similar problem by
 booting into windows,
 installing the drivers and then booting back into
 Linux, loading
 vmware and booting into windows - should work.
 


  Don't pick lemons.
  See all the new 2007 cars at Yahoo! Autos.
  http://autos.yahoo.com/new_cars.html
 
 

=
  To unsubscribe, send mail to
 [EMAIL PROTECTED] with
  the word unsubscribe in the message body, e.g.,
 run the command
  echo unsubscribe | mail
 [EMAIL PROTECTED]
 
 
 
 
 -- 
 Cheers,
 Maxim Veksler
 
 Free as in Freedom - Do u GNU ?
 

=
 To unsubscribe, send mail to
 [EMAIL PROTECTED] with
 the word unsubscribe in the message body, e.g.,
 run the command
 echo unsubscribe | mail
 [EMAIL PROTECTED]
 
 




 

Need Mail bonding?
Go to the Yahoo! Mail QA for great tips from Yahoo! Answers users.
http://answers.yahoo.com/dir/?link=listsid=396546091

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Re: [Israel.pm] israel.pm meeting on 12/4/2007

2007-04-08 Thread Shlomi Fish
Hi Shmuel!

On Sunday 08 April 2007, Shmuel Fomberg wrote:
 Hi Shlomi.

  Would you or any other F5er would like to update the site directly?

 I'm

  getting tired of doing it, and want to delegate some responsibilities

 to

  people with less community involvement.
  A similar issue is publicising in time in Perl-IL, Linux-IL, Whatsup,
  Linmagazine, which I'd also like to delegate. The previous meeting had
 
  very little attendance due to an incredibly low publicity. Everyone
  dependended on
  me, and I thought it was unnecessary. (my mistake, I know, but at

 least

  we've learned from this experience)

 Why haven't you written a script by now, that post a message on all
 these boards?
 You are so under-productive. You are a programmer - program!


Thanks for labelling me as under-productive. :-)

As you may well know laziness is one of the three great virtues of a 
programmer. And besides it's not that simple - I need it in English for the 
mailing lists, and in Hebrew for the web sites, and I need to customise the 
content etc. And it's not very time-consuming.

However, I feel that with my level of contribution to the FOSS world, I have 
much better things to contribute to my time than to publicise it, which any 
HTML-knowing kid can do. And some people practically don't do anything to 
Perl or FOSS, while I may be over-doing things a bit.

What have you done for your country lately?

If you don't want publicity for the meetings - fine - I'm not going to do it. 
If you do want, then someone will have to volunteer. In fact, I'm CCing this 
message to Linux-IL where some people may volunteer.

Regards,

Shlomi Fish

-
Shlomi Fish  [EMAIL PROTECTED]
Homepage:http://www.shlomifish.org/

If it's not in my E-mail it doesn't happen. And if my E-mail is saying
one thing, and everything else says something else - E-mail will conquer.
-- An Israeli Linuxer

=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word unsubscribe in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]



Online Help

2007-04-08 Thread Online MensHealth




=
To unsubscribe, send mail to [EMAIL PROTECTED] with
the word "unsubscribe" in the message body, e.g., run the command
echo unsubscribe | mail [EMAIL PROTECTED]