OT - "Intel Management Engine" security issues

2017-09-08 Thread Dave Anderson
work for a laptop, for desktop systems it might be sufficient to use an add-in NIC rather than the built-in one -- but the limited info I've found suggests that the IME may be able to snoop on all devices and so defeat this tactic. Does anyone here know? Thanks for any information, Dave -- Dave Anderson

Re: What is you motivational to use OpenBSD

2019-08-28 Thread Dave Anderson
security and correctness. -- Dave Anderson

pf questions

2021-05-30 Thread Dave Anderson
will pass through an interface. And I haven’t found any way of filtering on untagged connections (something like ‘! tagged any’ would be nice). I’m sure that my setup isn’t unique, so there must be a good way of dealing with this, but I’ve no idea what it might be. Suggestions, please! -- Dave

Re: pf questions

2021-06-03 Thread Dave Anderson
> On Jun 1, 2021, at 16:50, Stuart Henderson wrote: > > On 2021-05-30, Dave Anderson wrote: >> I’m setting up on 6.9-release a (for now) IPv4-only firewall with multiple >> public addresses and multiple subnets behind it, and have a couple of >> quest

man.openbsd.org failure?

2023-12-21 Thread Dave Anderson
Safari isn’t providing much useful information, but starting today I’m consistently getting a “server stopped responding” error when trying to access the online man pages at man.openbsd.org. www.openbsd.org is working fine. Dave Anderson d...@daveanderson.com

Re: man.openbsd.org failure?

2023-12-21 Thread Dave Anderson
Oops! I did see that message but forgot that it mentioned man.openbsd.org. Apologies for the noise. (But that Safari error message sucks!) Dave Anderson d...@daveanderson.com > On Dec 21, 2023, at 21:55, Daniel Jakots wrote: > > On Thu, 21 Dec 2023 21:22:49 -0500, Dave Anders

Re: man.openbsd.org failure?

2023-12-23 Thread Dave Anderson
“Server stopped responding” implies that it did provide some response before stopping. “Server did not respond” would be more accurate and less confusing. Dave Anderson d...@daveanderson.com > On Dec 23, 2023, at 07:27, hahahahacker2...@airmail.cc wrote: > > On 2023-12-22 10:39, Dave

Re: Why on earth would online voting be insecure?

2016-11-14 Thread Dave Anderson
se 2 pieces of information plus your name and town together that makes it secure. Just guessing. Did I overlook anything? -- Dave Anderson

Advice requested -- how best to copy a disk

2014-11-11 Thread Dave Anderson
oot, editing the duids in /etc/fstab, and fixing up /etc/hostname.*, but I'm hoping that there's a better way. Thanks in advance for any suggestions (or confirmations that there is no better way). Dave -- Dave Anderson

Re: Fund raising

2015-03-27 Thread Dave Anderson
at adapting their >ordering system to the people ordering from all over the world, but >we'll get there step by step I hope. I hit a couple of those bumps on my first order from them, and they were _very_ good about analyzing and fixing them. Dave -- Dave Anderson

FYI - 5.2 CDs just arrived near Boston, Mass.

2012-10-13 Thread Dave Anderson
-- Dave Anderson

Problem building -current userland

2012-12-04 Thread Dave Anderson
conf && config GENERIC.MP && cd ../compile/GENERIC.MP make clean && make make install reboot cd /usr/obj && touch junk && mkdir -p .old && mv * .old && rm -rf .old & cd /usr/src && make obj && cd /usr/src/etc && env DESTDIR=/ make distrib-dirs cd /usr/src && make build Thanks for any help, Dave -- Dave Anderson

Re: Problem building -current userland

2012-12-04 Thread Dave Anderson
atest version without any release >tags, since you mention following -current) Thanks for the suggestion; I'll give it a try -- and double-check that the cvs update worked properly. Dave -- Dave Anderson

Re: Problem building -current userland

2012-12-07 Thread Dave Anderson
On Tue, 4 Dec 2012, Dave Anderson wrote: Problem solved; PEBCAK. I didn't fully understand what 'cvs update' was doing, and managed to create a source tree containing a mixture of old and current files. Apologies for the noise. Dave >I recently upgraded to the 2 D

Re: OpenBSD 5.7 release -- CD2 issues

2015-05-15 Thread Dave Anderson
update. As usual, you're doing the right thing -- and we appreciate it. I hate to think of the likely mess if this sort of error had happened with some commercial software package. Dave -- Dave Anderson

Re: e-commerce framework suggestion? medoc?

2016-02-24 Thread Dave Anderson
ve overheard quite a bit of discussion on the subject.) I'd strongly recommend that, before doing anything about this, you carefully investigate what your responsibilities and liabilities would be. Dave -- Dave Anderson

Re: e-commerce framework suggestion? medoc?

2016-02-25 Thread Dave Anderson
nightmares yet running it internally with limited outside connectivity and reliable (static) web front end site is an option for control of this critical aspect. At that point you're as good as a personal self sustained service. -- Dave Anderson

Re: OT: True hardware UNIX terminal

2016-04-03 Thread Dave Anderson
Canadian X.25 service) PAD -> remote PAD -> remote dial-out service -> another modem -> another multiplexer -> serial line into, IIRC, ttyA on a Sun system I was helping someone repurpose. The entire install completed successfully off a network boot in about an hour at 2400bps (*and* simultaneously 2400baud, all you pedants out there...). Wow. -- Dave Anderson

Help requested tracking down a problem running 5.5-release.

2014-08-18 Thread Dave Anderson
at uhub2 port 2 configuration 1 interface 0 "SuYin HP TrueVision HD" rev 2.00/1.10 addr 4 video0 at uvideo0 uhub3 at uhub1 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2 vscsi0 at root scsibus1 at vscsi0: 256 targets softraid0 at root scsibus2 at softraid0: 256 targets root on sd0a (c3ffcff67dc13a92.a) swap on sd0b dump on sd0b -- Dave Anderson

Help, please, understanding AHCI error on amd64

2014-08-25 Thread Dave Anderson
00/0.00 addr 2 ugen0 at uhub2 port 1 "Validity Sensors product 0x0018" rev 1.10/0.78 addr 3 uvideo0 at uhub2 port 2 configuration 1 interface 0 "SuYin HP TrueVision HD" rev 2.00/1.10 addr 4 video0 at uvideo0 uhub3 at uhub1 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2 vscsi0 at root scsibus1 at vscsi0: 256 targets softraid0 at root scsibus2 at softraid0: 256 targets root on sd0a (c3ffcff67dc13a92.a) swap on sd0b dump on sd0b -- Dave Anderson

Re: Help, please, understanding AHCI error on amd64

2014-08-25 Thread Dave Anderson
On Mon, 25 Aug 2014, Adam Thompson wrote: >On 14-08-25 03:49 PM, Dave Anderson wrote: >> My amd64 notebook (full dmesg below) has started reporting an error >> which I don't adequately understand. Any explanations or ideas as to >> how to figure out exactly what

5.5 CDs arriving

2014-04-30 Thread Dave Anderson
Just got mine, near Boston, Mass. My thanks to everyone involved. Dave -- Dave Anderson

Re: 5.5 CDs arriving

2014-04-30 Thread Dave Anderson
On Wed, 30 Apr 2014, JJ Jumpercables wrote: >On Wed, Apr 30, 2014 at 12:56 PM, Dave Anderson wrote: >> Just got mine, near Boston, Mass. >> > >Jut curious... how long ago did you order? As soon as I saw the announcement that orders were open -- I don't remember exactly

Re: I can't download OpenBSD 4.5, "550 /pub/OpenBSD/4.5: Permission denied."

2009-04-16 Thread Dave Anderson
t! Wait for May 1st. Dave -- Dave Anderson

Re: autowhitelister for spamd needs testing

2009-04-22 Thread Dave Anderson
gt; it's a pisser. What might make sense is to alter the script to generate a list of canditates for whitelisting, but only apply any of them after they are manually approved. Dave -- Dave Anderson

iPad2 and iPhone4S USB messages

2011-12-22 Thread Dave Anderson
0/0.01 addr 3 Remove iPhone4S: ugen1 detached Dave -- Dave Anderson

Re: iPad2 and iPhone4S USB messages

2011-12-23 Thread Dave Anderson
ere I know of (other than by looking in the source). >-Bryan. Dave -- Dave Anderson

Re: iPad2 and iPhone4S USB messages

2011-12-23 Thread Dave Anderson
On Fri, 23 Dec 2011, Brynet wrote: >On Fri, Dec 23, 2011 at 09:30:44PM -0500, Dave Anderson wrote: >> For the iPhone, yes, but evidently not for the iPad2. > >Yes, it will be a manual effort for as long as Apple releases new devices. > >> >If you want to use libusb por

Re: I want buy labtop ,work OpenBSD, wireless network must work

2011-12-30 Thread Dave Anderson
eventually found a model where everything I cared about worked. Dave -- Dave Anderson

'pkg_add -u' question

2012-01-14 Thread Dave Anderson
s a good reason for leaving this alone. I haven't looked into the pkg_add source myself because it's large, complicated and (especially) under active development. -- Dave Anderson

Re: 'pkg_add -u' question

2012-01-14 Thread Dave Anderson
On Sat, 14 Jan 2012, Ingo Schwarze wrote: >Hi Dave, > >Dave Anderson wrote on Sat, Jan 14, 2012 at 12:14:57PM -0500: > >> and then ran 'pkg_add -ui' it was unable to update those files: >> "Couldn't find updates for uvideo-firmware-1.2p0, iwn-firmware-

Long delay updating xenocara source tree?

2012-01-27 Thread Dave Anderson
by this. Any clues would be greatly appreciated. Dave -- Dave Anderson

Re: Long delay updating xenocara source tree?

2012-01-28 Thread Dave Anderson
On Fri, 27 Jan 2012, Philip Guenther wrote: >On Fri, Jan 27, 2012 at 12:10 PM, Dave Anderson >wrote: >> I've run into this problem perhaps a dozen times over the past several >> months while running amd64-current, most recently at 15:53 2012/1/26 EST >> while runni

Re: 5.0 kernel won't compile on 4.9 i386 system

2012-01-28 Thread Dave Anderson
#x27;) >ioconf.c:224: warning: excess elements in struct initializer >ioconf.c:224: warning: (near initialization for 'cfdata[3]') >ioconf.c:226: warning: excess elements in struct initializer >ioconf.c:226: warning: (near initialization for 'cfdata[4]') >ioconf.c:228: warning: excess elements in struct initializer >ioconf.c:228: warning: (near initialization for 'cfdata[5]') >ioconf.c:230: warning: excess elements in struct initializer >ioconf.c:230: warning: (near initialization for 'cfdata[6]') > >The last ones continue for many more lines for 68 members of the array >before the make process exits. > >Now this has happened twice, on brand new systems, also I've found other >list posts describing the same errors but no solutions applying to my >situation. So what do I do to get 5.0 compiled? > >-- >Hdlsningar / Greetings > >Stefan Midjich >[De omnibus dubitandum] > -- Dave Anderson

Re: iPad2 and iPhone4S USB messages

2012-01-30 Thread Dave Anderson
On Sat, 24 Dec 2011, Dave Anderson wrote: >On Fri, 23 Dec 2011, Brynet wrote: > >>On Fri, Dec 23, 2011 at 09:30:44PM -0500, Dave Anderson wrote: >>> For the iPhone, yes, but evidently not for the iPad2. >> >>Yes, it will be a manual effort for as long as Apple rel

Re: Long delay updating xenocara source tree?

2012-01-30 Thread Dave Anderson
On Sat, 28 Jan 2012, Nick Holland wrote: >On 01/28/12 09:12, Dave Anderson wrote: >> Thanks for the info. I've been using -Pd because >> <http://www.openbsd.org/anoncvs.html> says to use them; I haven't yet >> had a chance to look into how cvs works bey

Re: Long delay updating xenocara source tree?

2012-02-03 Thread Dave Anderson
entry for tht dir wil be different than the other's. > >The exact cause of the slowdown is not known to me. But when you are >switch repositories once in a while it's easy to get this case. > >I repair this by find . -name Root | xargs rm and using a explicit cvs >root. > > -Otto Hmmm. That doesn't seem to [fully] explain the slowdowns I've seen, since I always use an explicit cvs root (following the FAQ) though I certainly have switched repositories from time to time. Dave -- Dave Anderson

/etc/daily bug? altroot vs DUIDs

2012-02-07 Thread Dave Anderson
y checking for /dev/whatever in the /altroot fstab entry -- but I've been using DUIDs (as set up by the installer). Shouldn't the daily script be updated to handle DUIDs as well as explicit devices in /etc/fstab? Dave -- Dave Anderson

Re: /etc/daily bug? altroot vs DUIDs

2012-02-08 Thread Dave Anderson
On Tue, 7 Feb 2012, Kenneth R Westerback wrote: >On Tue, Feb 07, 2012 at 09:42:07AM -0500, Dave Anderson wrote: >> I've got a system running amd64/mp -current (latest source update on >> February 1st) and have noticed (for quite a while, actually) that the >> night

Re: /etc/daily bug? altroot vs DUIDs

2012-02-09 Thread Dave Anderson
On Wed, 8 Feb 2012, Dave Anderson wrote: >On Tue, 7 Feb 2012, Kenneth R Westerback wrote: > >>On Tue, Feb 07, 2012 at 09:42:07AM -0500, Dave Anderson wrote: >>> I've got a system running amd64/mp -current (latest source update on >>> February 1st) and have n

AHCI0 errors with 5.1-current

2012-02-27 Thread Dave Anderson
1 "vendor 0x138a product 0x0018" rev 1.10/0.78 addr 3 uvideo0 at uhub2 port 2 configuration 1 interface 0 "SuYin HP TrueVision HD" rev 2.00/1.10 addr 4 video0 at uvideo0 uhub3 at uhub1 port 1 "Intel Rate Matching Hub" rev 2.00/0.00 addr 2 vscsi0 at root scsibus1 at vscsi0: 256 targets softraid0 at root scsibus2 at softraid0: 256 targets root on sd0a (c3ffcff67dc13a92.a) swap on sd0b dump on sd0b -- Dave Anderson

Re: AHCI0 errors with 5.1-current

2012-03-05 Thread Dave Anderson
On Mon, 27 Feb 2012, Dave Anderson wrote: >I recently upgraded an HP dv7-6b63us notebook (dmesg below) to amd64/mp >5.1-current as of about 11:30 EST 25 February 2012 (rebuilt from source >several times since installing a 7 February snapshot) and have started >seeing > > ah

Re: My OpenBSD 5.0 installation experience (long rant)

2012-03-07 Thread Dave Anderson
of the original message) he has identified what may be the only place in the install process where a single wrong keystroke can do major damage. Everyplace else I can think of there's at least an opportunity to abort the installation after making a mistake but before the damage is done. I've no great love for 'are you sure' questions, but they may be appropriate where they prevent a single easy-to-make mistake from causing serious damage. Dave -- Dave Anderson

Re: About Xen: maybe a reiterative question but ..

2007-10-24 Thread Dave Anderson
ss to information which is not generally available. And if any of the answers is 'no', the security of anything run under that virtualization may be fatally compromised -- no matter how secure that software may be when run standalone. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: [Fwd: Open-Hardware]

2008-01-06 Thread Dave Anderson
l they had already become established practice (and so, almost impossible to undo). Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Real men don't attack straw men

2008-01-06 Thread Dave Anderson
tion of "recommend", I expect that most of this discussion would end. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: avoiding a mac address filter

2008-01-07 Thread Dave Anderson
gt;> > IP address via dhclient >> > >> > I have a naive question: Is there any way to avoid that? I mean: is >> > there a way to surpass the mac filter and get an ip? >> >> Do I understand this correctly? You are asking how to *defeat* someone >> else's >> SOHO NAT router, using its MAC filter as their only security? >> >> If so, I'm appalled by your lack of ethics. -- Dave Anderson <[EMAIL PROTECTED]>

Re: [Fwd: Open-Hardware]

2008-01-07 Thread Dave Anderson
(e.g., EEPROM) or permanent (e.g., ROM) -- it's just easier to provide a malicious firmware file for loading than it is to convince someone to replace a ROM chip. Even for a pure-hardware device, with no firmware at all, you still have to trust the manufacturer to avoid bugs which can harm the system as a whole. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Real men don't attack straw men

2008-01-07 Thread Dave Anderson
orsement. I don't recall seeing any of them claiming that. Many of them _have_ (quite reasonably) objected to your spreading misinformation about OpenBSD. And making statements which are true only if common words are given non-standard meanings certainly amounts to spreading misinformation.

Re: Real men don't attack straw men

2008-01-07 Thread Dave Anderson
programs that could be installed, implicitly >that recommends installing FOO as an option for people to consider. > >Perhaps "implicitly recommend" would be a clearer description of this >particular case. It would be closer to reality, but would still massively overstate the case. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Real men don't attack straw men

2008-01-08 Thread Dave Anderson
tems. But that's quite different from demanding an endorsement. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Real men don't attack straw men

2008-01-08 Thread Dave Anderson
e is, at best, weasel-wording. >One reason I do not want to call this a "barrier" is that it suggests >other things. Many people thought I objected to the general capability >of the ports system to install any program. That misunderstanding >seems to come words like "barrier". Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: : Zombie Network Spam Attack

2008-02-08 Thread Dave Anderson
r really >is suspicious or disallowed. Read the RFCs rather than guessing. 'Mail From: <>' is not merely allowed but is _required_ when a delivery-failure message is sent. You're throwing away most legitimate notifications of errors delivering messages which originated on your serv

Re: : Zombie Network Spam Attack

2008-02-08 Thread Dave Anderson
g' caused by forged 'from' header addresses in spam. While it's not possible to do this in _all_ cases, bad addresses can be handled at the SMTP 'rcpt to' command with (usually) very little effort and greylisting (and associated tools) can reject a large fraction of spam messages at this stage. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: : Zombie Network Spam Attack

2008-02-08 Thread Dave Anderson
On Fri, 8 Feb 2008, Stuart Henderson wrote: >On 2008/02/08 11:35, Dave Anderson wrote: >> On Fri, 8 Feb 2008, Peter N. M. Hansteen wrote: >> >> >Raimo Niskanen <[EMAIL PROTECTED]> writes: >> > >> >> If a backscatter gets through to sendmail, and

Re: pf tag goes missing post sshd tcp decapsulization

2008-03-07 Thread Dave Anderson
ich set the tag "VPN1" and will get >"APP_VPN1" ?? This is not a good behavior, IMHO. Why not just require that any application-generated tag must start with some fixed string ("APP_" or "@" or whatever)? Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: pf tag goes missing post sshd tcp decapsulization

2008-03-07 Thread Dave Anderson
On Fri, 7 Mar 2008, Henning Brauer wrote: >* Dave Anderson <[EMAIL PROTECTED]> [2008-03-07 17:34]: >> On Fri, 7 Mar 2008, Konrad wrote: >> >> >>> Nice, you probably want to keep the application/kernel tag name spaces >> >>> distinct though. Ot

FYI: Discrepancy between pf FAQ and man pf.conf(5)

2008-03-17 Thread Dave Anderson
I've been working on the pf configuration for my home firewall, and have reviewed a lot of documentation in the process. I've noticed that, when discussing queueing, the pf FAQ mentions only CBQ and PRIQ while man pf.conf(5) also defines HFSC. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Flexibility of pf rules created by ftp-proxy?

2008-03-17 Thread Dave Anderson
more options to tweak the generated rules and to avoid the delay involved in modifying the program whenever someone comes up with a new need. Thanks in advance for any info, Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: FYI: Discrepancy between pf FAQ and man pf.conf(5)

2008-03-17 Thread Dave Anderson
On Mon, 17 Mar 2008, Peter N. M. Hansteen wrote: >"Dave Anderson" <[EMAIL PROTECTED]> writes: > >> that, when discussing queueing, the pf FAQ mentions only CBQ and PRIQ >> while man pf.conf(5) also defines HFSC. > >It's probably a matter of coming up

A few questions for which I haven't found answers...

2008-03-17 Thread Dave Anderson
a 'solution' which might change when I upgrade (or even just reboot) is not acceptable. Thanks in advance for either direct answers or pointers to relevant bits of documentation that I've missed. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Flexibility of pf rules created by ftp-proxy?

2008-03-19 Thread Dave Anderson
On Mon, 17 Mar 2008, Stuart Henderson wrote: >On 2008-03-17, Dave Anderson <[EMAIL PROTECTED]> wrote: >> I've been working on the pf configuration for my home firewall, >> including setting up ftp-proxy. I've noticed that the command is >> getting cluttere

Re: Flexibility of pf rules created by ftp-proxy?

2008-03-19 Thread Dave Anderson
On Tue, 18 Mar 2008, Camiel Dobbelaar wrote: >Dave Anderson wrote: >> I've been working on the pf configuration for my home firewall, >> including setting up ftp-proxy. I've noticed that the command is >> getting cluttered with options to adjust the rules it creat

Re: Disable IPv6 on OpenBSD 4.0

2006-12-17 Thread Dave Anderson
ty of IPv6 traffic, you could easily configure PF to block all IPv6. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Disable IPv6 on OpenBSD 4.0

2006-12-17 Thread Dave Anderson
l of your interfaces). The question is, can you convince the powers-that-be that doing this is sufficient? It clearly should be, since it prevents any possibility of communicating via IPv6. Good luck, Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: sendmail w/ virtual mailboxes

2007-01-01 Thread Dave Anderson
>account? This depends on your 'local' mail-delivery program definition in sendmail.cf. IIRC the standard program will only deliver to real users. I'm using maildrop (from packages) to allow delivery to virtual users (who access their mail via POP); there are undoubtedly other such programs available. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: weird PF behavior

2007-03-16 Thread Dave Anderson
case) is the same as if the {} construct were evaluated as an OR within a single rule, but that's not how it's implemented. Dave PS: I'm definitely *not* a pf/pfctl expert, but I believe that I do understand how this bit of it works. If I'm wrong, I'm sure that I'll be corrected quickly. -- Dave Anderson <[EMAIL PROTECTED]>

Re: No Blob without Puffy

2007-03-19 Thread Dave Anderson
of not releasing adequate documentation -- so accepting blobs (even when "there's no other choice") actively harms the anti-blob campaign. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: NOOP and Spamd

2007-03-19 Thread Dave Anderson
;s purposes? It seems to me that in those cases the cost to implement and maintain is so low as to be worthwhile even if it only avoids relatively unlikely problems. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: OT Strange Punishment

2007-08-28 Thread Dave Anderson
about being required to run monitoring software, just about being required to run Windows rather than his accustomed OS (presumably because Windows is the only OS that the government's preferred monitoring software will run on). Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: OT Strange Punishment

2007-08-28 Thread Dave Anderson
On Tue, 28 Aug 2007, Gilles Chehade wrote: >On Tue, Aug 28, 2007 at 11:19:40AM -0400, Dave Anderson wrote: >> On Tue, 28 Aug 2007, Lars Hansson wrote: >> >> >On 8/28/07, Die Gestalt <[EMAIL PROTECTED]> wrote: >> >> Why doesn't he run the monitoring

Re: OT Strange Punishment

2007-08-28 Thread Dave Anderson
On Tue, 28 Aug 2007, Emilio Perea wrote: >On Tue, Aug 28, 2007 at 12:49:56PM -0400, Dave Anderson wrote: >> But, as I understand the issue, this is _not_ part of his specified >> punishment -- it's just a side-effect of the manner in which the >> government wants

Re: Scaling DNS with CARP + pf (+ hoststated ?)

2007-08-28 Thread Dave Anderson
ows boxes can't handle more than 2 resolver addresses? If so, and if they're getting their DNS-server information via DHCP, it might be much easier and almost as effective to hack the DHCP server to have a large pool of DNS-server addresses and randomly(?) select two of them to provide in each response it sends. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: OT Strange Punishment

2007-08-29 Thread Dave Anderson
d lose >> rights under the law beyond those which the law specifies as being taken >> away. Is this a correct inference? > >I don't think think running Linux is a basic human right. This looks remarkably like a "yes" answer to my question. We've gotten pretty fa

Re: That whole "Linux stealing our code" thing

2007-09-02 Thread Dave Anderson
IIRC this is true for any country which has adopted the Berne Convention, which is currently almost every country which has any copyright law in place. It includes the U.S. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: That whole "Linux stealing our code" thing

2007-09-02 Thread Dave Anderson
clearly and authoritatively stated to exclude that interpretation -- so anyone who is aware of this yet still changes the license text in this case is, at the very least, behaving unethically. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: SMTP flood + spamdb

2007-09-26 Thread Dave Anderson
e greylisting time... Or take advantage of the (by default) 25 minute window to use other means to detect that this address is sending spam. Perhaps spamd should be extended to look for excessive attempts to send messages from an address during that period? (How often do spammers' lists contain only one or two addresses from a domain?) Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Difficult routing problem

2007-10-06 Thread Dave Anderson
will sure be appreciated. Maybe I'm missing something, but (given that everything else is working and assuming that the systems on LAN B have a default route directed to GW B) wouldn't a static route on GW B for 207.12.0.0/18 pointing to 10.74.10.245 do the job? Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: [side thread] security implcations of multiple kernel threads?

2007-10-09 Thread Dave Anderson
hreaded (both because that's much easier than multi-threaded and because multi-cpy systems were rare back then) and has not [yet] been changed because changing to a multi-threaded kernel requires a lot of very finicky work (with innumerable opportunities to introduce very subtle bugs). Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: named on udp ports only

2006-06-20 Thread Dave Anderson
words, it's not possible to do what you want. (It can *appear* to work, but you'll have obscure problems where some requests quietly fail for no obvious reason.) Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: dns query

2006-08-07 Thread Dave Anderson
n.example IN A192.168.13.57 So if you want this to work when your internet connection is down you need to either set up your own DNS server (it's not all that hard, but is certainly not trivial) or find a mailer (if one exists) that does some special hackery to avoid DNS queries for locally-addressed messages. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Is it possible that source spoof IP bypass the three step handshake of the TCP connection to apache in an attack?

2006-08-23 Thread Dave Anderson
whatever malware is involved is using the software installed on the hijacked computer. More likely, it is opening a connection to your web server itself and sending whatever request and supplementary information it wants (which is the same in all cases, since it's the same malware). Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Missing section in FAQ - 6 Networking ?

2006-09-04 Thread Dave Anderson
er...as apparently you do, as well. Have you considered having a vestigal section (something like '6.8: [removed]') to make it obvious that there's no error with very little extra work on your part? Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: DNS confusion about www.oorexx.org

2008-10-02 Thread Dave Anderson
.org.IN ANY ;; ANSWER SECTION: www.oorexx.org. 86400 IN A 208.34.240.200 ;; Query time: 289 msec ;; SERVER: 202.131.95.2#53(ns1.planetdomain.com) ;; WHEN: Thu Oct 2 13:42:44 2008 ;; MSG SIZE rcvd: 48 Where did that CNAME come from, why does it have what looks like an IPv4 address as its value (rather than an FQDN, as is IIRC required), and why doesn't it show up when we request all information? Dave -- Dave Anderson <[EMAIL PROTECTED]>

4.4 arriving in the U.S.

2008-10-14 Thread Dave Anderson
Today's mail delivered the 4.4 CDs near Boston, Mass. Many thanks to the developers, Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Packet Filter: how to keep device names on hardware failure?

2008-11-07 Thread Dave Anderson
ame.only if there's only one NIC found, the sysadmin could assign interfaces to groups and use those group names everywhere, and so not need to use the actual interface names at all. This appears to be a fairly simple change. Does it sound reasonable to people with more knowledge of OpenBSD networking? Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Packet Filter: how to keep device names on hardware failure?

2008-11-07 Thread Dave Anderson
On Fri, 7 Nov 2008, Ted Unangst wrote: >On Fri, Nov 7, 2008 at 12:44 PM, Dave Anderson <[EMAIL PROTECTED]> wrote: >> Network configuration has bugged me a bit ever since I started using >> OpenBSD, not just the real security issue that Harald Dunkel points out &

Re: Packet Filter: how to keep device names on hardware failure?

2008-11-07 Thread Dave Anderson
be worth doing something about. Or if it suggests a change which is worthwhile in itself and also solves the problem. >> This appears to be a fairly simple change. Does it sound reasonable to >> people with more knowledge of OpenBSD networking? > >No, it is not reasonble. You are inventing problems at a very high >level just because some very low level pci-related bug is making some >of your devices not reliably show themselves. No, I'm thinking about a general way for those people who care about it to tie pf rules, etc, to specific physical interfaces, regardless of what other devices are installed or configured in a system. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Packet Filter: how to keep device names on hardware failure?

2008-11-07 Thread Dave Anderson
On Fri, 7 Nov 2008, Chris Kuethe wrote: >On Fri, Nov 7, 2008 at 3:55 PM, Dave Anderson <[EMAIL PROTECTED]> wrote: >> Maybe I'm just confused, but my recollection is that one needs to set up >> the appropriate hostname. to enable the interface before >> th

Re: Packet Filter: how to keep device names on hardware failure?

2008-11-08 Thread Dave Anderson
On Fri, 7 Nov 2008, johan beisser wrote: >On Nov 7, 2008, at 9:44 AM, Dave Anderson wrote: >> >> Perhaps most of these issues could be dealt with by changing the >> network >> configuration procedure to have a hierarchy of interface-configuration >> files rather

Re: /dev/random as (chrooted) named's entropy source [current]

2008-04-03 Thread Dave Anderson
root entropy source /dev/arandom > >So why is /var/named/dev/arandom "not configured". Is there something >that needs to be done beside MAKEDEV? Is /var marked 'nodev' in /etc/fstab? Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Got 'em

2008-04-14 Thread Dave Anderson
The 4.3 CD set arrived today near Boston, Mass. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Kernel trap with custom ramdisk

2008-04-29 Thread Dave Anderson
homework and are trying to get other people to do it for you. Dave -- Dave Anderson <[EMAIL PROTECTED]>

Re: Kernel trap with custom ramdisk

2008-04-29 Thread Dave Anderson
mething goes wrong. Again, developers will usually ignore bug reports dealing with custom kernels, unless the problem can be reproduced in a GENERIC kernel as well. You have been warned. Dave >29.04.08, 19:13, "Dave Anderson" <[EMAIL PROTECTED]>: > >> OpenBSD com

Re: Decipering "Understanding IP addressing"

2008-05-21 Thread Dave Anderson
rk administrator will >need to round up to 24 (or 16)." > >23 or 8 what? Bits? What are 23 and 8 alternatives of? 24 or 16 looks >like alternative prefix lengths for class A or B networks, but I don't >get 23 or 8. Somewhere along the line the exponentiation operator (^) has

Re: Zeroconf / Howl Problems.

2008-06-09 Thread Dave Anderson
969 >[howl] error sending packet to 224.0.0.251 (23126) >[assert] error: 64 (Host is down) >[assert] where: "socket.c", "sw_socket_udp_really_sendto", line: 969 >... > >Thanks. > >-- Jeremy > -- Dave Anderson <[EMAIL PROTECTED]>

Re: UPDATE: mozilla-firefox-3.0

2008-07-17 Thread Dave Anderson
ter version of the Java runtime. The only exceptions I'm aware of involve one of the rare and well publicized API changes in the class libraries or Microsoft's pseudo-Java, which was deliberately incompatible (in violation of the Java licence) as a marketing move. Dave -- Dave Anderson <[EMAIL PROTECTED]>

No DMA? What's going on here?

2005-07-09 Thread Dave Anderson
A Card /S , AXE2201, PNP80D6, " port 0x240/32 irq 5 ne3: NE2000 Ethernet ne3: address 00:40:05:c0:ad:75 biomask e945 netmask ef65 ttymask ffe7 pctr: 586-class performance counters and user-level cycle counter enabled dkcsum: wd0 matched BIOS disk 80 root on wd0a rootdev=0x0 rrootdev=0x300 rawdev=0x302 -- Dave Anderson <[EMAIL PROTECTED]>

Re: No DMA? What's going on here?

2005-07-09 Thread Dave Anderson
** Reply to message from "Todd C. Miller" <[EMAIL PROTECTED]> on Sat, 09 Jul 2005 18:55:03 -0600 >In message <[EMAIL PROTECTED]> > so spake "Dave Anderson" (dave): > >> If I'm reading it correctly, this bit of the dmesg says that my hard

Re: No DMA? What's going on here?

2005-07-09 Thread Dave Anderson
that first 504M, >the system will boot without problem or delay, as it won't try to detect >the disk parameters at all, and OpenBSD will properly detect the entire >disk. Thanks for the detailed info, and especially for this hint -- which I will certainly try. Dave -- Dave Anderson <[EMAIL PROTECTED]>

  1   2   >