Re: [gpsd-dev] HOWTO: Security

2016-05-25 Thread Gary E. Miller
Yo Eric! On Wed, 25 May 2016 04:00:58 -0400 "Eric S. Raymond" wrote: > Hal Murray : > > OCXOs are big, power hungry, and expensive. Why do you want one? > > To minimize drift during loss of sat lock, of course. If you put the OXCO between the GPS and ntpd you can use it as another filter la

Re: HOWTO: Security

2016-05-25 Thread Hal Murray
e...@thyrsus.com said: >> OCXOs are big, power hungry, and expensive. Why do you want one? > To minimize drift during loss of sat lock, of course. Do you have any idea how big a can of worms you are opening? Low end OCXOs will double the cost of Pi type setup. Good ones cost a lot more. How

Re: HOWTO: Security

2016-05-25 Thread Eric S. Raymond
Hal Murray : > OCXOs are big, power hungry, and expensive. Why do you want one? To minimize drift during loss of sat lock, of course. -- http://www.catb.org/~esr/";>Eric S. Raymond ___ devel mailing list devel@ntpsec.org http://lists.nt

Re: HOWTO: Security

2016-05-24 Thread Hal Murray
e...@thyrsus.com said: > The deal we've struck with them is: They supply the hardware, we'll do the > software integration. I think they're our best bet for a real single-board > solution. I don't think we want a single board solution. It won't track new versions with newer CPU chips, or if i

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Clark B. Wierda : > I can commit to writing the diffs for both of these boards using Eric's > HOWTO as the baseline. Does that help define scope and advance the > critical path? It certainly does. -- http://www.catb.org/~esr/";>Eric S. Raymond

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Hal Murray : > > Not immediately; there's still the Odroid C2 and BeagleBone to do. > > Forget them. They aren't worth your time. I already have the Odroid, and Mark asked me to support it at Penguicon. You can ask him why he thinks it's important; I remember that he gave me some reasons, but le

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Clark B. Wierda
On Tue, May 24, 2016 at 8:47 PM, Gary E. Miller wrote: > Yo Hal! > > On Tue, 24 May 2016 17:30:04 -0700 > Hal Murray wrote: > > > > Not immediately; there's still the Odroid C2 and BeagleBone to do. > > > > Forget them. They aren't worth your time. > > +1. > > The Odroid hardware is nice, but t

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Hal! On Tue, 24 May 2016 17:30:04 -0700 Hal Murray wrote: > > Not immediately; there's still the Odroid C2 and BeagleBone to do. > > Forget them. They aren't worth your time. +1. The Odroid hardware is nice, but they have not been maintaining their code base. Their versions of things l

Re: HOWTO: Security

2016-05-24 Thread Hal Murray
> Not immediately; there's still the Odroid C2 and BeagleBone to do. Forget them. They aren't worth your time. There aren't any HAT equivalents for BeagleBone and the Odroid web site is broken enough that I couldn't even order one. --- There is actually a Cape with GPS but it also has GPR

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Hal Murray : > I like it. The disadvantage is that you may need some adapters. Has the > world switched to HDMI yet? (I'm still using VGA and PS2, but I have USB > keyboards.) There's a lot of both HDMI and DVI out there. New monitors tend to have both jacks. I believe VGA is in sharp decline

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Hal Murray : > e...@thyrsus.com said: > > Now that I'm thinking about it - probably the NTPsec site should have a > > HOWTOs category, and both this thing and both time-service HOWTOs should > > move there. Later to be joined by others. > > I like that suggestion. > > It seems like the fastest wa

Re: HOWTO: Security

2016-05-24 Thread Hal Murray
e...@thyrsus.com said: > Now that I'm thinking about it - probably the NTPsec site should have a > HOWTOs category, and both this thing and both time-service HOWTOs should > move there. Later to be joined by others. > But I'm not wedded to that plan. Do you have a better or different idea? I li

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Gary E. Miller : > > Interestingly enough, my wife Cathy came up with this one as I was > > explaining the problem to her over dinner. Score one for sharp > > Philadelphia lawyers. > > Lawyers know logic. Buy her a steak. By coincidence, we have a custom of going out for a (relatively inexpensi

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Hal Murray : > > e...@thyrsus.com said: > > Would it suffice to say "Never put a Pi on an un-NATted address until you > > have removed the default account?" > > I don't think that's quite good enough. It's OK, I think I have a better solution now. > What are your longer term plans for this docu

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Eric! On Tue, 24 May 2016 18:49:29 -0400 "Eric S. Raymond" wrote: > > I do not want the best to be the enemy of the better. I'll settle > > for the next small improvement. > > There's a simpler way. First step becomes changing the default-user > password using a local display and keyboar

Re: HOWTO: Security

2016-05-24 Thread Hal Murray
e...@thyrsus.com said: > There's a simpler way. First step becomes changing the default-user > password using a local display and keyboard, *before* the Ethernet is > plugged in. I like it. The disadvantage is that you may need some adapters. Has the world switched to HDMI yet? (I'm still us

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Gary E. Miller : > Yo Eric! > > On Tue, 24 May 2016 18:03:51 -0400 > "Eric S. Raymond" wrote: > > > > Or even disable password logins altogether and use ssh keys only. > > > But that's not for the HOWTO's target audience, unfortunately. > > > > Actually ./clockbuilder --secure does exactly th

Re: HOWTO: Security

2016-05-24 Thread Hal Murray
e...@thyrsus.com said: > Would it suffice to say "Never put a Pi on an un-NATted address until you > have removed the default account?" I don't think that's quite good enough. What are your longer term plans for this document? Is it going to live on www.catb.org forever, or migrate to someplac

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Eric! On Tue, 24 May 2016 18:03:51 -0400 "Eric S. Raymond" wrote: > > Or even disable password logins altogether and use ssh keys only. > > But that's not for the HOWTO's target audience, unfortunately. > > Actually ./clockbuilder --secure does exactly that. Gary's argument > is that the

Re: HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Kurt! On Tue, 24 May 2016 23:45:39 +0200 Kurt Roeckx wrote: > > > Would it suffice to say "Never put a Pi on an un-NATted address > > > until you have removed the default account?" > > > > Most people's NATs leak a lot. Or they have IPv6 end around. > > > > Just change the password, to a

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Kurt Roeckx : > Can I just suggest that you don't allow password based logins over > the network? ./clockmaker --secure makes that change. -- http://www.catb.org/~esr/";>Eric S. Raymond ___ devel mailing list devel@ntpsec.org http://list

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Paul Fertser : > On Tue, May 24, 2016 at 02:38:23PM -0700, Gary E. Miller wrote: > > The primary defense is simple, change passwords FIRST. > > Or even disable password logins altogether and use ssh keys only. But > that's not for the HOWTO's target audience, unfortunately. Actually ./clockbuilde

Re: HOWTO: Security

2016-05-24 Thread Kurt Roeckx
On Tue, May 24, 2016 at 02:38:23PM -0700, Gary E. Miller wrote: > Yo Eric! > > On Tue, 24 May 2016 17:33:06 -0400 > "Eric S. Raymond" wrote: > > > Hal Murray : > > > > > > e...@thyrsus.com said: > > > > See my reply to Gary and your text about NATs and firewalls. > > > > Nobody has convinced

Re: HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Eric! On Tue, 24 May 2016 17:33:06 -0400 "Eric S. Raymond" wrote: > Hal Murray : > > > > e...@thyrsus.com said: > > > See my reply to Gary and your text about NATs and firewalls. > > > Nobody has convinced me that this procedure *isn't* taking > > > security seriously, nor will they until

Re: HOWTO: Security

2016-05-24 Thread Eric S. Raymond
Hal Murray : > > e...@thyrsus.com said: > > See my reply to Gary and your text about NATs and firewalls. Nobody has > > convinced me that this procedure *isn't* taking security seriously, nor will > > they until I understand how any machine other than the one I port-forward to > > is visible to o

Re: [gpsd-dev] HOWTO: Security

2016-05-24 Thread Gary E. Miller
Yo Hal! On Tue, 24 May 2016 13:47:48 -0700 Hal Murray wrote: > e...@thyrsus.com said: > > See my reply to Gary and your text about NATs and firewalls. > > Nobody has convinced me that this procedure *isn't* taking security > > seriously, nor will they until I understand how any machine other > >

HOWTO: Security

2016-05-24 Thread Hal Murray
e...@thyrsus.com said: > See my reply to Gary and your text about NATs and firewalls. Nobody has > convinced me that this procedure *isn't* taking security seriously, nor will > they until I understand how any machine other than the one I port-forward to > is visible to outsiders. Your mention