How security sensitive is information about your network architecture?
One of the breathless things that I've seen said recently about therecent Sony Pictures intrusion is that having their network layout andinfrastructure setup disclosed publicly is really terrible and willforce Sony Pictures to change it. This doesn't entirely make sense tome; I'm hard pressed to see how network layout information and so onis terribly security sensitive in a sensibly run environment. Switchand router and database passwords, certainly; but just the networkarchitecture?
(This information is clearly business sensitive, but that
Log retention versus log analysis, or really logs versus log analysis
In a comment on my entry on keeping your logs longer , oz wrote:
yea but. keeping logs longer is not particularly interesting if youhave no heavy duty tools to chew through them. [...]
Unsurprisingly, I disagree with this.
Certainly in an ideal world we would have good log analysis toolsthat we use to process raw logs into monitoring, metrics data, andother ongoing uses of the raw pieces we're gathering and retaining.However ongoing processing of logs is far from the only reason
Security capabilities and reading process memory
Today, reading Google's Project Zero explanation of an interestingIE sandbox escape taught me something that I probably should have known already buthadn't thought about and realized. So let's start at the beginning,with capability-based security . You canread about it in more detail in that entry, but the very shortversion is that capabilities are tokens that give you access rightsand generally are subject to no further security checks. If you'vegot the token, you have access to whatever it
The unreasonable effectiveness of web crawlers
I have a few test copies of Wandering Thoughts and allof CSpace sitting around here and there; I use them for things liketrying out new CSS and other layout stuff, playing with code changes,testing the full weight of CSpace in different web environments,and so on. As it happens, one of those copies sometimes exists on my personal domain . I don't link to thesecopies from anywhere, of course, as they're test things and I accessthem from direct URLs. So you can
TLS versions in connections to my spam-catching sinkhole SMTP server
I've written before about TLS usage on our real inbound mail gateway and the general TLS breakdown on my sinkholeSMTP server . My sinkhole server didn't initially logthe TLS version used, but after Heartbleed hit I changed that because itwas now interesting information, and here's a preliminary report. Notethat, unlike our main mail gateway, this is all spam sending attempts.
The basic version breakdown is that out of 588 connections thatnegotiated TLS since I added this logging, 102
You should keep your system logs for longer than you probably are
One simple thing you can do to improve your life is to make yourmachines keep their logs for longer than they currently do. Mostsystems ship with relatively short log retention defaults thatbasically date from the days when systems had what are now verysmall disks and sysadmins got really grumpy about logs eating uplots of scarce disk space. Those days are over now for most systems;for example our new servers come with 500 GB HDs as the default.A 500 GB disk will hold really quite a
Sometimes you need to turn things into small, readily solvable problems
If you've read my entry on making IKE work you may have noticed that the ultimateconfiguration I wound up with doesn't sound all that complicatedor as if it took all that much work to create. Yet I've previouslybeen strongly uninterested in trying to create more or less the IKE configuration that I woundup with, and I expected it to take a daunting amount of work ( cf ). Whathappened between those two points is not quite as simple as me beingwrong about how much work
How I made IPSec IKE work for a point to point GRE tunnel on Fedora 20
The basic overview of my IPSec needs is thatI want to make my home machine (with an outside address) appear asan inside IP address on the same subnet as my work machine is on.Because of Linux proxy ARP limitations, the core mechanics of thisinvolve a GRE tunnel, which must be encrypted and authenticated byIPSec. Previously I was doing this with a static IPSec configurationcreated by direct use of setkey , which had the drawback that it didn'tautomatically change encryption keys or notice if something went
Using iptables to block traffic that's not protected by IPSec
When I talk about my IPSec setup , I often saythat I use GRE over IPSec (or 'an IPSec based GRE tunnel'). However,this is not really what is going on; a more accurate but more opaquedescription is that I have a GRE tunnel that is encrypted and protectedby IPSec. The problem, and the reason that the difference matters, isthat there is nothing that intrinsically ties the two pieces together,unlike something where you are genuinely running X over Y such as'forwarding X
Using go get alone is a bad way to keep track of interesting packages
When I was just starting with Go, I kept running into interesting Gopackages that I wanted to keep track of and maybe use someday. 'Noproblem', I thought, 'I'll just go get them so I have them sittingaround and maybe I'll look at them too'.
Please allow yourself to learn from my painful experience here and don'tdo this. Specifically, don't rely on ' go get ' as your only way to keeptrack of packages you want to