There's a reasonably popular view that having your firewall dropundesired packets instead of sending ICMP rejections is 'moresecure'. It is not; instead it is 'more annoying'.

(Technically this is not quite true; in a very limited set ofcircumstances, dropping all packets for a host can hide someinformation from attackers. The flipside is that dropping some but notall packets usually leaks information about what you're screening.)

Dropping packets is more annoying because attempted connections haveto time out before

I'll lead with Hotmail's spam numbers:

• four emails accepted, and I know for sure that two of them werespam.
• 239 messages rejected because they came from non-Hotmail emailaddresses.
• 24 messages refused because their sender addresses had already hitour spamtraps.
• 10 messages refused due to their origin IP address (5 in the SBL, 4in the CBL, and one from Nigeria).

The case for banning Hotmail entirely becomes more and morecompelling. It's probably time

TCP keepalives are do-nothing packets the TCP layer can send to see ifa connection is still alive or if the remote end has gone unreachable(due to a machine crash, a network problem, or whatever). Keepalivesare not default TCP behavior (at least not in any TCP stack thatconforms to the RFCs), so you have to specifically turn them on.(There are various reasons why this is sensible.)

In Python you can do this with the .setsockopt() socket method,using

Chris Lewis of Nortel recently posted a breakdown of CBL listings byISP in news.admin.net-abuse.email. Here's the top ten of his listing:

375649 chinanet.cn.net130245 cnc-noc.net102931 telekom.gov.tr80936 kornet.net67721 tpnet.pl51671 dtag.de47246 rain.fr3

I recently discovered that not all of the iptables extension modules are documented in the iptables manualpage, at least the versions installed on Debian Sarge or Fedora Core4; they're only documented in the netfilter.org extensions HOWTO here ,or sometimes not even there.

I care about this because this means there's interesting things I coulddo with iptables that I can't find out by reading the manpage. So for myfuture reference and anyone else's use, here's a quick summary of

I recently stumbled over this blog entry on a nice, easy way to stop brute force ssh scans, so it's time tospread this knowledge around.

If you've got an ssh daemon exposed to the Internet, you know aboutthe brute force ssh scans and password guessing attacks. The realproblem with them is the sheer volume, which creates log clutter (andsystem load) as they spew login failures and unknown users all overyour logs.

(If brute force ssh attacks give you security ulcers,

I spent part of today writing a very simple network server inPerl. While most of my problems were due to my ignorance, theexperience did give me a new appreciation for introspection andinteractive interpreters.

The problem is that without introspection, things are opaque whensomething goes wrong. What do you have? Certainly not what youexpected, but it's hard to tell much more than that. Withintrospection, you can find out type information, maybe a printablerepresentation of the thing (this gives you some idea

I have a script called ' nsaddrs ', which lists the IP addresses ofthe nameservers for a given domain. It is basically:

addr `dig +short ns $1`

addr is one of my utility programs; it does IP address lookups forhostnames. Normally you give it hostnames on the command line, but forbulk lookups you can give it no arguments and it will read hostnamesfrom standard input, one per line.

Then one day I used nsaddr on a domain that didn't exist and it

Most people doing threading in Python know about Python's GlobalInterpreter Lock (GIL), which causes only one thread to be running inthe CPython interpreter at any one time. This means that threadedcode already has a certain amount of implicit locking going on,making certain operations thread-atomic without you writing explicitlocks.

The important thing about the GIL for this is that it protectsbytecodes, not Python statements . If something happens in a singlebytecode, it's protected; otherwise, you need explicit locking