nion's blog - Comments

nion: Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl embedded webserver)

nospam@example.com (nion) — Thu, 04 Aug 2011 18:11:45 +0200

thx, fixed!

wlet: Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl embedded webserver)

nospam@example.com (wlet) — Thu, 04 Aug 2011 08:23:12 +0200

nice write-up. Your link to the py-file is relative but should be absolute

nion: Debian 6.0 squeeze

nospam@example.com (nion) — Tue, 08 Feb 2011 12:35:46 +0100

hmm?

Anonymous: Debian 6.0 squeeze

nospam@example.com (Anonymous) — Sun, 06 Feb 2011 05:33:21 +0100

"corporate"?

patrick: acrobat reader stealing my passwords

nospam@example.com (patrick) — Tue, 18 Jan 2011 13:41:20 +0100

thx for sharing.

while xpdf is not bad, the best experience i had is with `Evince`,
a recommendation of http://pdfreaders.org/

gicxjo: Using the ii irc client

nospam@example.com (gicxjo) — Wed, 12 Jan 2011 19:00:31 +0100

tmux now supports split, break and rejoin windows, so you can drop splitvt and screen and use it!

Jay Zhang: copy & paste in text mode applications

nospam@example.com (Jay Zhang) — Thu, 30 Dec 2010 12:53:10 +0100

It's cool tips. This bother me for a long time.

Lasse: Using the ii irc client

nospam@example.com (Lasse) — Tue, 28 Sep 2010 16:47:45 +0200

How about using tmux instead of screen?

Sebastien K: fail2ban + dns = fail

nospam@example.com (Sebastien K) — Thu, 23 Sep 2010 09:51:30 +0200

What do you think about syslog lines like theses (counted by logwatch in a single day):

client 62.141.52.x query (cache) 'isc.org/ANY/IN' denied: 3438 Time(s)

client 62.141.60.x query (cache) 'isc.org/ANY/IN' denied: 5414 Time(s)

client 63.223.80.x query (cache) 'isc.org/ANY/IN' denied: 3847 Time(s)

client 76.73.68.x query (cache) 'isc.org/ANY/IN' denied: 3541 Time(s)

client 82.165.131.x query (cache) 'isc.org/ANY/IN' denied: 1006 Time(s)

client 84.19.180.x query (cache) 'isc.org/ANY/IN' denied: 1342 Time(s)

client 84.19.190.x query (cache) 'isc.org/ANY/IN' denied: 1639 Time(s)

client 87.106.177.x query (cache) 'isc.org/ANY/IN' denied: 2366 Time(s)

Doesn't someone is trying to use my DNS to DDOS someone?

wb: Dear Lazyweb...

nospam@example.com (wb) — Tue, 15 Jun 2010 00:29:08 +0200

FTR: mairix does support gzipped mbox folders since version 0.17 and bzip2'd mbox folders since version 0.18. Latest version at SourceForge is 0.22 (as of June 2010).

nion: fail2ban + dns = fail

nospam@example.com (nion) — Thu, 27 May 2010 14:53:29 +0200

yes i agree on that though in the case of dns providing a filter for udp really doesn't make sense not saying fail2ban sucks, i'm using it as well for some special purposes

Yaroslav Halchenko: fail2ban + dns = fail

nospam@example.com (Yaroslav Halchenko) — Thu, 27 May 2010 13:44:02 +0200

"for unexperienced users" I bet noone really would run a serious targetted DoS attack, but some automated script junkies looking looking for easy targets and doing dictionary attacks. And that is where (and thus for whom) fail2ban shines. DNS issue though is a bit closer to the reality of admins, and they better be experienced, and if they are not, such DoS would be the gentle lesson... may be I should advocate it as an educational tool then

but point is taken -- I might add some warning (thought about it myself as well)

nion: fail2ban + dns = fail

nospam@example.com (nion) — Thu, 27 May 2010 13:07:20 +0200

excuse my lazyness, I was too lazy to report this as a bug. Imho the whole fail2ban package should ship with a big fat warning for unexperienced users. anyway, I filed one now.

@zsh, I do agree Even though I once rmed my /etc when trying to show the zsh asking for the deletion and I missed that it only does on /etc/*

Yaroslav Halchenko: fail2ban + dns = fail

nospam@example.com (Yaroslav Halchenko) — Thu, 27 May 2010 06:27:22 +0200

I guess I should take all the blame for this:

commit 042e160eeb3d7a09b0bb8dcda92f284bc3889f1d
Author: lostcontrol
Date: Wed Aug 8 22:21:15 2007 +0000

- Added filter file for named (bind9). Thanks to Yaroslav Halchenko

But I wonder why for "bad ... idea why this filter is shipped in a default fail2ban installation" I see no new bug report among

http://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;src=fail2ban;submitter=nion%40debian.org

This one indeed should be highly unadvised (and removed from jails.conf shipped with Debian) unless ignoreip can cover the range of valuable not-to-DoS for sure IPs ... or may be there is another precaution (matching incoming IPs based on interfaces on gateways etc) you have in mind?

anyways, awaiting for a bug report

P.S. I still consider 'rm' to be the most dangerous command of all times... god bless zsh and its protective powers

Jonathan Nieder: gcc and printf/puts optimizations

nospam@example.com (Jonathan Nieder) — Thu, 27 May 2010 02:24:14 +0200

Maybe the best fix would be to teach puts to handle NULL, too (string written as array below to avoid comment escaping bug).

diff --git a/libio/ioputs.c b/libio/ioputs.c
index 7fa5db5..c6478e4 100644
--- a/libio/ioputs.c
+++ b/libio/ioputs.c
@@ -31,9 +31,17 @@
+static const char null[] = { '(', 'n', 'u', 'l', 'l', ')', 0 };
+
int
_IO_puts (str)
const char *str;
{
int result = EOF;
- _IO_size_t len = strlen (str);
+ _IO_size_t len;
+
+ if (str == NULL)
+ str = null;
+ len = strlen (str);
+
_IO_acquire_lock (_IO_stdout);
if ((_IO_vtable_offset (_IO_stdout) != 0

nion's blog - Comments

nion: Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl embedded webserver)

wlet: Exploiting the Ubiquisys/SFR femtocell webserver (wsal/shttpd/mongoose/yassl embedded webserver)

nion: Debian 6.0 squeeze

Anonymous: Debian 6.0 squeeze

patrick: acrobat reader stealing my passwords

gicxjo: Using the ii irc client

Jay Zhang: copy & paste in text mode applications

Lasse: Using the ii irc client

Sebastien K: fail2ban + dns = fail

wb: Dear Lazyweb...

nion: fail2ban + dns = fail

Yaroslav Halchenko: fail2ban + dns = fail

nion: fail2ban + dns = fail

Yaroslav Halchenko: fail2ban + dns = fail

Jonathan Nieder: gcc and printf/puts optimizations

nion: Debian 6.0 squeeze

Anonymous: Debian 6.0 squeeze