540 reputation
213
bio website
location
age
visits member for 2 years, 2 months
seen Feb 27 at 23:42

May
31
comment Physical machines not detected from a Backtrack VM
Can your 2 VMs communicate directly? Isn't there a firewall or anything between them? Do you use nmap to detect the OS? Does it work if it's not in a virtualized environment? I'd like to know then answer as well. Bridging should leave IP traffic untouched. BTW, I strongly discourage the use of BT in a VM, use a usb stick instead: BT has a lot of drivers for all kind of hardware, emulated interfaces may not implement what you want/need, it's limiting.
May
31
comment Configure Linux to allow network activity based on binary?
BTW, I'd guess that windows implement this as a antivirus, by placing hooks on network library functions. Which with some level of reverse engineering, can be bypassed. There are many ways to bypass it, it's not a cutting edge security feature at all, it's here to cut down malware infection which is very important on windows. Maybe it'll change in your favorite distribution over time, but for now, it's not a good idea.
May
31
comment Configure Linux to allow network activity based on binary?
@curiousguy: A firewall is just a packet filter, it only pays attention to network traffic, and not to application running. Moreover, firewalls are not usually workstations, but dedicated machines who filter traffic, you don't run any program you don't know/trust on it like you'd do on a workstation. Userland is separated from the kernel, "The Linux kernel is developed and maintained separately from userland." en.wikibooks.org/wiki/Guide_to_Unix/Linux#Kernel This is true for all UNIX-like systems.
May
31
comment Configure Linux to allow network activity based on binary?
@Jez: Because you don't want to calculate the checksum manually for each binary (especially if you upgrade them often as you usually do on linux). Without this, cp malware /tmp/firefox will bypass your security.
May
30
awarded  Revival
May
30
comment Configure Linux to allow network activity based on binary?
Moreover, the 'firewall' on windows, is more an antivirus/malware/etc than a firewall (packet filter).
May
30
comment Configure Linux to allow network activity based on binary?
they only have one Desktop Environment, which makes it easy to integrate notification from the kernel. By design in Unix systems userland is strictly separated from the kernel. System calls can be used to ask the kernel specific tasks (access to IO, etc). One could imagine this kind of improvement on some distribution of Linux, but I doubt this would get accepted upstream. It's not just iptable to upgrade and maintain. A firewall doesn't run application, so no need to deny/accept anything interactively, a firewall should be a headless (CLI) and at the network border.
May
30
comment What do I need to configure, to make sure my software uses /dev/urandom?
Blocking is a bad choice, it could reveal keystrokes (used to generate entropy among other things) for instance.
May
30
answered Firefox Flash plugin malware?
May
30
comment X.509 certificate policies question
Will -> SHOULD. It's correct but as you MAY know, RFC are often poorly implemented, especially to fit one's business needs. Many factors can influence this, in both good and wrong way.
May
30
comment Configure Linux to allow network activity based on binary?
Very hard to implement, it should rely on a checksum + name to identify connections. Then the network stack has to be modified to intercept any call (or use k/ptrace) to send(). Then the system must interact with the user (many different DE/WM, no clean interface guarantied) and then change (permanently?) the ruleset of the packet filter to authorize accepted connections. It's more complex than that actually but this should let you understand why there is no such thing on UNIX yet (as I know). BTW, the program can still call another legitimate program to reach out, and users make mistakes...
May
30
comment Can people use AES VPN tunnels to hide their activities from authorities?
Among other things yes. There's always a risk to being a defector, playing with a technology that one doesn't fully understand is a good way to fail. Although I doubt governments will use such drastic measures, it's not a big enough problem (yet?).
May
30
revised Can people use AES VPN tunnels to hide their activities from authorities?
added 1 characters in body
May
30
comment Spam fighting idea
@AviD: It's free but it doesn't mean it's worth their time, they won't do it if they don't get any profit at all. But I agree with you otherwise.
May
30
comment Spam fighting idea
It's fun, not necessarily an effective way to do it though. No corporation will waste money to make pranks nor support some experimental technology on such a critical infrastructure as email. But I agree that no profit -> no spam, or better less profit -> less spam. And we should continue the arms race against spammers.
May
30
comment Spam fighting idea
Bruce also writes in his book - "Liars and Outliers" that there will always be defectors, but we should try to limit their numbers by making being a defector a less favorable option. Cutting down the impact of spam on end user will make being a spammer a bad solution. So it's not vain to fight spam, it's what we should do. You should at least give some ideas on how to fight spam right?
May
30
comment Spam fighting idea
Done. It's not exhaustive and not very helpful if you're not running OpenBSD. But it may still give a hint on different spam fighting strategies.
May
30
revised Spam fighting idea
added 1297 characters in body
May
28
answered Spam fighting idea
May
28
answered Can people use AES VPN tunnels to hide their activities from authorities?