From mikel.king Sat Oct 1 00:10:08 2005 From: mikel.king (Mikel King) Date: Sat, 01 Oct 2005 00:10:08 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <20051001030806.GR12532@ns.metm.org> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301150s6dd52e61laac9d9d650656cf2@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> Message-ID: <915F437B-626B-465F-907C-30191F2BD1A2@ocsny.com> On Sep 30, 2005, at 11:08 PM, Marco Scoffier wrote: > On Fri, Sep 30, 2005 at 07:21:08PM -0400, Marc Spitzer wrote: > > >> On 9/30/05, Marco Scoffier wrote: >> >> >>> >>> >>> On Fri, Sep 30, 2005 at 05:02:55PM -0400, Mikel King wrote: >>> >>> >>>> On a side note, I'm wondering what sort of security holes this will >>>> open? >>>> >>>> >>>> >>> Don't you mean close? >>> >>> >> >> nope open, the easyest way to exploit code is to read the code for >> bugs and not tell the people who are running their bussiness on it. >> >> >> > Oh the businesses always find out when there is an exploit, > > I'm a bit suprised by what seems to be an arguement for a false sense > of security. > > -- Marco > > False or not, if you have to rely on someone else writing it for you then you probably lake the ability to discover the flaws yourself. Anyone who's been in this business for a while can surely agree that security stands fairly low on the priorities of most CFOs. This is not really a debate about security, it's about a stupid idea, that adds no value to the current gpl, and more importantly it is the kind of stupidity that give's open source a bad name. From lists Sat Oct 1 00:28:46 2005 From: lists (Francisco Reyes) Date: Sat, 1 Oct 2005 00:28:46 -0400 (EDT) Subject: [nycbug-talk] More that one SSL cert per IP/Port? Message-ID: <20051001002713.T82489@zoraida.natserv.net> According to what I can find in the net it seems that it is not easy (possible?) to have more than one SSL certificate per IP/port in Apache 1.3.X Anyone knows of a way to do it? Is it possible? From alex Sat Oct 1 00:40:32 2005 From: alex (alex at pilosoft.com) Date: Sat, 1 Oct 2005 00:40:32 -0400 (EDT) Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: <20051001002713.T82489@zoraida.natserv.net> Message-ID: On Sat, 1 Oct 2005, Francisco Reyes wrote: > According to what I can find in the net it seems that it is not easy > (possible?) to have more than one SSL certificate per IP/port in Apache > 1.3.X > > Anyone knows of a way to do it? Is it possible? It is not possible. SSL negotiation takes place prior to HTTP headers being sent - thus remote host has no idea which web server you want to talk to. -alex From mspitzer Sat Oct 1 01:20:04 2005 From: mspitzer (Marc Spitzer) Date: Sat, 1 Oct 2005 01:20:04 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <20051001030806.GR12532@ns.metm.org> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301150s6dd52e61laac9d9d650656cf2@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> Message-ID: <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> On 9/30/05, Marco Scoffier wrote: > On Fri, Sep 30, 2005 at 07:21:08PM -0400, Marc Spitzer wrote: > >nope open, the easyest way to exploit code is to read the code for > >bugs and not tell the people who are running their bussiness on it. > > > Oh the businesses always find out when there is an exploit, not always, it depends why the cracker is there, how good he is, what kind of controls you have on your network and servers etc. Most places may never figure out how there compitition got there customer list. > > I'm a bit suprised by what seems to be an arguement for a false sense > of security. think of it as the difference between a locked door and a locked door with the key taped to it. marc -- "We trained very hard, but it seemed that every time we were beginning to form into teams we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing, and a wonderful method it can be for creating the illusion of progress, while producing confusion, inefficiency and demoralization." -Gaius Petronius, 1st Century AD From lists Sat Oct 1 09:58:24 2005 From: lists (Hans Zaunere) Date: Sat, 1 Oct 2005 09:58:24 -0400 Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: <20051001002713.T82489@zoraida.natserv.net> Message-ID: <0MKp2t-1ELhsm3jDc-0003nN@mrelay.perfora.net> Francisco Reyes wrote on Saturday, October 01, 2005 12:29 AM: > According to what I can find in the net it seems that it is not easy > (possible?) to have more than one SSL certificate per IP/port in Apache > 1.3.X > > Anyone knows of a way to do it? Is it possible? Not possible - chicken and the egg problem. http://www.modssl.org/docs/2.8/ssl_faq.html#ToC47 http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#parallel There are somethings in the works, but they appear to be a ways off. --- Hans Zaunere / President / New York PHP www.nyphp.org / www.nyphp.com From lists Sat Oct 1 10:18:13 2005 From: lists (michael) Date: Sat, 1 Oct 2005 10:18:13 -0400 Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: <20051001002713.T82489@zoraida.natserv.net> References: <20051001002713.T82489@zoraida.natserv.net> Message-ID: <20051001101813.050e7e96@genoverly.com> On Sat, 1 Oct 2005 00:28:46 -0400 (EDT) Francisco Reyes wrote: > According to what I can find in the net it seems that it is not easy > (possible?) to have more than one SSL certificate per IP/port in > Apache 1.3.X > > Anyone knows of a way to do it? Is it possible? > As everyone has already pointed out.. 1 apache = 1 cert. In my experinece, the default virtual domain appears when you https://www.domain.com from a browser. The solution I use is another instance of apache in a chroot or jail. Michael From chsnyder Sat Oct 1 11:58:17 2005 From: chsnyder (csnyder) Date: Sat, 1 Oct 2005 11:58:17 -0400 Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: <20051001101813.050e7e96@genoverly.com> References: <20051001002713.T82489@zoraida.natserv.net> <20051001101813.050e7e96@genoverly.com> Message-ID: On 10/1/05, michael wrote: > On Sat, 1 Oct 2005 00:28:46 -0400 (EDT) > Francisco Reyes wrote: > > > According to what I can find in the net it seems that it is not easy > > (possible?) to have more than one SSL certificate per IP/port in > > Apache 1.3.X > > > > Anyone knows of a way to do it? Is it possible? > > > > As everyone has already pointed out.. 1 apache = 1 cert. In my > experinece, the default virtual domain appears when you > https://www.domain.com from a browser. > > The solution I use is another instance of apache in a chroot or jail. > Really a one-to-one relationship? I'm pretty sure (darn it) that you can use IP-based virtual hosting to provide more than one secure site in a single Apache process, provided the server is reachable on more than one IP address. The restriction should apply to name-based virtual hosting only. -- Chris Snyder http://chxo.com/ From lists Sat Oct 1 12:43:36 2005 From: lists (michael) Date: Sat, 1 Oct 2005 12:43:36 -0400 Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: References: <20051001002713.T82489@zoraida.natserv.net> <20051001101813.050e7e96@genoverly.com> Message-ID: <20051001124336.6dc2f5f5@genoverly.com> On Sat, 1 Oct 2005 11:58:17 -0400 csnyder wrote: > Really a one-to-one relationship? > > I'm pretty sure (darn it) that you can use IP-based virtual hosting to > provide more than one secure site in a single Apache process, provided > the server is reachable on more than one IP address. > > The restriction should apply to name-based virtual hosting only. > > -- > Chris Snyder > http://chxo.com/ I was referring to name-based virtual hosts. http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html Good catch, Mr. Snyder. Michael From marco Sat Oct 1 13:10:45 2005 From: marco (Marco Scoffier) Date: Sat, 1 Oct 2005 13:10:45 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301150s6dd52e61laac9d9d650656cf2@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> Message-ID: <20051001171045.GA23290@ns.metm.org> On Sat, Oct 01, 2005 at 01:20:04AM -0400, Marc Spitzer wrote: >think of it as the difference between a locked door and a locked door >with the key taped to it. > Wrong. It is equivalent to making the plans for how the lock was made publicly available. The key is not made public. You are are full of confusing and downright faulty analogies. -- Marco From mspitzer Sat Oct 1 13:42:18 2005 From: mspitzer (Marc Spitzer) Date: Sat, 1 Oct 2005 13:42:18 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <20051001171045.GA23290@ns.metm.org> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301150s6dd52e61laac9d9d650656cf2@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> <20051001171045.GA23290@ns.metm.org> Message-ID: <8c50a3c30510011042xf839257p60ff893ddd6f44c@mail.gmail.com> On 10/1/05, Marco Scoffier wrote: > On Sat, Oct 01, 2005 at 01:20:04AM -0400, Marc Spitzer wrote: > >think of it as the difference between a locked door and a locked door > >with the key taped to it. > > > > Wrong. > > It is equivalent to making the plans for how the lock was made publicly > available. The key is not made public. > > You are are full of confusing and downright faulty analogies. The funny thing about analogies is that they are *all* wrong by definition, one of my favorite's is 22/7. Now would you have preferred a paper sack full of keys, exploits, to a number of doors, that may or may not lead to different places, db access or shell account or nothing useful, more pedantic stuff follows? And yes the first guy to figure it out will need to have some skill to do it, but the first guy he tells, or gives a canned exploit to, does not. marc > > -- > Marco > _______________________________________________ > % NYC*BUG talk mailing list > http://lists.nycbug.org/mailman/listinfo/talk > %Be sure to check out our Jobs and NYCBUG-announce lists > %We meet the first Wednesday of the month > -- "We trained very hard, but it seemed that every time we were beginning to form into teams we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing, and a wonderful method it can be for creating the illusion of progress, while producing confusion, inefficiency and demoralization." -Gaius Petronius, 1st Century AD From lists Sat Oct 1 23:11:45 2005 From: lists (Francisco Reyes) Date: Sat, 1 Oct 2005 23:11:45 -0400 (EDT) Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: <0MKp2t-1ELhsm3jDc-0003nN@mrelay.perfora.net> References: <0MKp2t-1ELhsm3jDc-0003nN@mrelay.perfora.net> Message-ID: <20051001231031.M15236@zoraida.natserv.net> On Sat, 1 Oct 2005, Hans Zaunere wrote: > Not possible - chicken and the egg problem. Thanks for the links. I was able to confirm that using different IPs work. So basically one can have one SSL per IP/port. > There are somethings in the works, but they appear to be a ways off. For now will just use different IP, but it's good to know that there are plans to work on this. From lists Sat Oct 1 23:34:44 2005 From: lists (Francisco Reyes) Date: Sat, 1 Oct 2005 23:34:44 -0400 (EDT) Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: <433894B1.80704@sddi.net> References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> Message-ID: <20051001233348.I15236@zoraida.natserv.net> On Mon, 26 Sep 2005, George R. wrote: > It's not really a question of jails v non-jails to me. . . Given that samba can be configured to listen only in certain subnets what would be the advantage of jailing the external apps? To protect in case someone breaks into apache/ftp? From lists Sat Oct 1 23:37:44 2005 From: lists (Francisco Reyes) Date: Sat, 1 Oct 2005 23:37:44 -0400 (EDT) Subject: [nycbug-talk] More that one SSL cert per IP/Port? In-Reply-To: References: <20051001002713.T82489@zoraida.natserv.net> <20051001101813.050e7e96@genoverly.com> Message-ID: <20051001233721.V15236@zoraida.natserv.net> On Sat, 1 Oct 2005, csnyder wrote: > The restriction should apply to name-based virtual hosting only. Correct. It's 1 certificate per IP/Port. From lists Sat Oct 1 23:39:52 2005 From: lists (Francisco Reyes) Date: Sat, 1 Oct 2005 23:39:52 -0400 (EDT) Subject: [nycbug-talk] DSL Providers In-Reply-To: <200509261945.j8QJjcOY032342@lucifier.net> References: <200509261945.j8QJjcOY032342@lucifier.net> Message-ID: <20051001233835.D15236@zoraida.natserv.net> On Mon, 26 Sep 2005, Michael Shalayeff wrote: > cloud9 and acedsl seem to be the most liberal don't know about liberal, but I am very happy with my Acedsl. Have had them for several years. I only remember I have them when I get the bill. :-) Except for my wife or one of the nephews tripping on one of the cables I extremely rarely ever have had my internet down. From mspitzer Sun Oct 2 00:58:46 2005 From: mspitzer (Marc Spitzer) Date: Sun, 2 Oct 2005 00:58:46 -0400 Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: <20051001233348.I15236@zoraida.natserv.net> References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> <20051001233348.I15236@zoraida.natserv.net> Message-ID: <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> On 10/1/05, Francisco Reyes wrote: > On Mon, 26 Sep 2005, George R. wrote: > > > It's not really a question of jails v non-jails to me. . . > > Given that samba can be configured to listen only in certain subnets what > would be the advantage of jailing the external apps? > > To protect in case someone breaks into apache/ftp? yes. With a script you can rebuild a jail, including saving all the data(web site etc), and recover from an incident automatically. login to the root box and kick off the script and all is better. Even if you are running apps that give you root you only get root in the jail and your tripwire( or mtree if you want to be bsdish(and who does not)) should be running out of the main box that has not been compromised. marc > _______________________________________________ > % NYC*BUG talk mailing list > http://lists.nycbug.org/mailman/listinfo/talk > %Be sure to check out our Jobs and NYCBUG-announce lists > %We meet the first Wednesday of the month > -- "We trained very hard, but it seemed that every time we were beginning to form into teams we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing, and a wonderful method it can be for creating the illusion of progress, while producing confusion, inefficiency and demoralization." -Gaius Petronius, 1st Century AD From lists Sun Oct 2 10:11:08 2005 From: lists (Francisco Reyes) Date: Sun, 2 Oct 2005 10:11:08 -0400 (EDT) Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> <20051001233348.I15236@zoraida.natserv.net> <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> Message-ID: <20051002100309.Y88154@zoraida.natserv.net> On Sun, 2 Oct 2005, Marc Spitzer wrote: >> To protect in case someone breaks into apache/ftp? > > yes. With a script you can rebuild a jail, including saving all the > data(web site etc), and recover from an incident automatically. Sounds like a good idea. > you are running apps that give you root you only get root in the jail I have actually used jails, just have never set one up. Now will have a machine where I think it may make sense. > and your tripwire( or mtree if you want to be bsdish(and who does > not)) should be running out of the main box that has not been > compromised. I like that idea. Specially for files one does not expect to change. I already have a little script to use mtree to compare directories. How about CPU overhead? I like the concept of a jail, but in the past I always wondered if the extra complexity and CPU overhead were necessary for my needs. I think a current box I am setting up is the first time I think it make sense. I will have both confidential services/data AND at the same time need to serve an app through http to the public. In an ideal world I would like two machines, but given how little load I expect to have on the machine it's hard to justify. From ike Sun Oct 2 18:15:27 2005 From: ike (Isaac Levy) Date: Sun, 2 Oct 2005 18:15:27 -0400 Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: <20051002100309.Y88154@zoraida.natserv.net> References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> <20051001233348.I15236@zoraida.natserv.net> <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> <20051002100309.Y88154@zoraida.natserv.net> Message-ID: Hi Francisco, All, On Oct 2, 2005, at 10:11 AM, Francisco Reyes wrote: > On Sun, 2 Oct 2005, Marc Spitzer wrote: >>> To protect in case someone breaks into apache/ftp? >>> >> >> yes. With a script you can rebuild a jail, including saving all the >> data(web site etc), and recover from an incident automatically. >> > > Sounds like a good idea. >> and your tripwire( or mtree if you want to be bsdish(and who does >> not)) should be running out of the main box that has not been >> compromised. That's OK, *but*, let me throw in the caveat that any process/daemon which runs from a master jailing box, and so much as touches files in a jail, is at risk of being compromised. Not that I'm saying I know of any vuln. for tripwire in this case, but it's worth saying here. > I like that idea. Specially for files one does not expect to change. > I already have a little script to use mtree to compare directories. > > How about CPU overhead? > I like the concept of a jail, but in the past I always wondered if > the extra complexity and CPU overhead were necessary for my needs. > I think a current box I am setting up is the first time I think it > make sense. Re. CPU overhead, it's VERY minimal for jailed systems- by design. Jail is not a full-fledged virtual machine, so the resources soaked, are simply whatever you end up running in the jail itself- jailing is different than Xen or VMware in this respect, as the virtualization of memory and etc.. hardware interfaces, are comparatively much more taxing- though in the context of the applications used, it's all pretty moot... (3k vs. 300k is nothing on a machine with a gig of ram ;) > I will have both confidential services/data AND at the same time > need to serve an app through http to the public. In an ideal world > I would like two machines, but given how little load I expect to > have on the machine it's hard to justify. As an aside, jail(8) was used for CTF competition at DefCon this summer instead of many many boxen, as I understand the competition revolved around application-level exploits this year. (Read: Jails are Secureable) Rocket- .ike From bob Mon Oct 3 03:23:48 2005 From: bob (Bob Ippolito) Date: Mon, 3 Oct 2005 03:23:48 -0400 Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> <20051001233348.I15236@zoraida.natserv.net> <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> <20051002100309.Y88154@zoraida.natserv.net> Message-ID: <6A48E3C8-6DD9-49F6-A166-2B5576D009F0@redivi.com> On Oct 2, 2005, at 6:15 PM, Isaac Levy wrote: > On Oct 2, 2005, at 10:11 AM, Francisco Reyes wrote: > >> I like that idea. Specially for files one does not expect to change. >> I already have a little script to use mtree to compare directories. >> >> How about CPU overhead? >> I like the concept of a jail, but in the past I always wondered if >> the extra complexity and CPU overhead were necessary for my needs. >> I think a current box I am setting up is the first time I think it >> make sense. >> > > Re. CPU overhead, it's VERY minimal for jailed systems- by design. > Jail is not a full-fledged virtual machine, so the resources > soaked, are simply whatever you end up running in the jail itself- > jailing is different than Xen or VMware in this respect, as the > virtualization of memory and etc.. hardware interfaces, are > comparatively much more taxing- though in the context of the > applications used, it's all pretty moot... (3k vs. 300k is nothing > on a machine with a gig of ram ;) In either case, when was the last time you did anything CPU bound? Almost every service you're going to run is IO bound by disk or network (or even RAM). The CPU almost always has plenty of cycles to spare. The memory usage or increased memory usage might matter, but it's likely to be quite negligible. Jails are by design basically the lightest weight method to solve the virtualization problem (since there is only one kernel for all jails)... Anything that does machine emulation like Xen or VMWare is going to have to just allocate a big chunk of memory for each virtual system, so will require a lot more RAM and memory bandwidth than a jails solution. -bob From cclymer Mon Oct 3 04:05:54 2005 From: cclymer (Chris Clymer) Date: Mon, 03 Oct 2005 04:05:54 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <8c50a3c30510011042xf839257p60ff893ddd6f44c@mail.gmail.com> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301150s6dd52e61laac9d9d650656cf2@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> <20051001171045.GA23290@ns.metm.org> <8c50a3c30510011042xf839257p60ff893ddd6f44c@mail.gmail.com> Message-ID: <4340E662.3070908@chrisclymer.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Are you actually arguing that software is more secure if its closed-source? I thought that history had done a pretty good job of disproving this. That said, this stuff about the GPL3 is defintly interesting. What if i have a db.inc file in my web app full of sensitive information? Can i put just that file under a different license? Its still PHP code thats part of the same app... Marc Spitzer wrote: > On 10/1/05, Marco Scoffier wrote: > >>On Sat, Oct 01, 2005 at 01:20:04AM -0400, Marc Spitzer wrote: >> >>>think of it as the difference between a locked door and a locked door >>>with the key taped to it. >>> >> >>Wrong. >> >>It is equivalent to making the plans for how the lock was made publicly >>available. The key is not made public. >> >>You are are full of confusing and downright faulty analogies. > > > The funny thing about analogies is that they are *all* wrong by > definition, one of my favorite's is 22/7. > > Now would you have preferred a paper sack full of keys, exploits, to a > number of doors, that may or may not lead to different places, db > access or shell account or nothing useful, more pedantic stuff > follows? > > And yes the first guy to figure it out will need to have some skill to > do it, but the first guy he tells, or gives a canned exploit to, does > not. > > marc > > >>-- >>Marco >>_______________________________________________ >>% NYC*BUG talk mailing list >>http://lists.nycbug.org/mailman/listinfo/talk >>%Be sure to check out our Jobs and NYCBUG-announce lists >>%We meet the first Wednesday of the month >> > > > > -- > "We trained very hard, but it seemed that every time we were beginning to > form into teams we would be reorganized. I was to learn later in life that > we tend to meet any new situation by reorganizing, and a wonderful method it > can be for creating the illusion of progress, while producing confusion, > inefficiency and demoralization." > -Gaius Petronius, 1st Century AD > _______________________________________________ > % NYC*BUG talk mailing list > http://lists.nycbug.org/mailman/listinfo/talk > %Be sure to check out our Jobs and NYCBUG-announce lists > %We meet the first Wednesday of the month > - -- Chris Clymer - Chris at ChrisClymer.com PGP: E546 19B6 D1EC 47A7 CAA0 8623 C807 398C CD27 15B8 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.7 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDQOZiyAc5jM0nFbgRAgP+AJ9nlJXoVtszpMdmARx9ICeqAcolowCgkk3/ uHJv5x0NuFnB55J13PtuD5Q= =25H0 -----END PGP SIGNATURE----- -------------- next part -------------- A non-text attachment was scrubbed... Name: chris.vcf Type: text/x-vcard Size: 293 bytes Desc: not available Url : http://lists.nycbug.org/pipermail/talk/attachments/20051003/16a050e0/attachment.vcf From mspitzer Mon Oct 3 04:48:55 2005 From: mspitzer (Marc Spitzer) Date: Mon, 3 Oct 2005 04:48:55 -0400 Subject: [nycbug-talk] gpl on /. In-Reply-To: <4340E662.3070908@chrisclymer.com> References: <8c50a3c30509300840t7d30bc2et49e9b141a79bf581@mail.gmail.com> <8c50a3c30509301331j13c643e3y1501e2a92707531c@mail.gmail.com> <20050930210318.GO12532@ns.metm.org> <8c50a3c30509301621j2e1f29e6t2b2a3fb403039d36@mail.gmail.com> <20051001030806.GR12532@ns.metm.org> <8c50a3c30509302220x2fa70887je3bc9f715432139@mail.gmail.com> <20051001171045.GA23290@ns.metm.org> <8c50a3c30510011042xf839257p60ff893ddd6f44c@mail.gmail.com> <4340E662.3070908@chrisclymer.com> Message-ID: <8c50a3c30510030148w41e1886exbebc8d11eebdef@mail.gmail.com> On 10/3/05, Chris Clymer wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Are you actually arguing that software is more secure if its > closed-source? I thought that history had done a pretty good job of > disproving this. No. There are different trade offs in this: open source: Everyone can read the code, this includes bad people who can use the code of the application to craft exploits, and submit patches closed source: no one, in general, can read the source, this includes bad people who can *not* read the code to craft exploits, so they can not submit patches it cuts both ways especially when dam near all end users are not capable of submitting a patch or even reading code. I think it is 6 of 1 and 1/2 dozen of another. Now the difference on how specific projects/companies handle the issue is different. Now some companies suck at this as do some projects. What I think makes the difference is if you engage in good engineering practices, for example: bad: We will write code that will not have any bugs good: we will try to write code with no bugs in it, but we are not always that good so we will design the application in such a way that a compromise is not going to cause much of a problem bad: big honken monolithic process that is full of very complex logic and runs as root good: lots of separate unprivileged processes that each do one thing and unless absolutely necessary they do not run as root I could go on with lots of others but I think you get my idea. Now one of the big problems is that people buy shit, so companies are in the business of selling it to them. Now if you look at one area where people generally do not buy/use shit, enterprise DB's, you will not see the problem as much, word gets around when the db ate my business. > > That said, this stuff about the GPL3 is defintly interesting. What if i > have a db.inc file in my web app full of sensitive information? Can i > put just that file under a different license? Its still PHP code thats > part of the same app... from what I understood no, it is linked to the gpl3 parts so must be downloaded. And it makes no difference what licence you put it under it is hit by the viral clause, its not your choice once you use gpled code. Also please do not top post, it makes things hard to follow. marc -- "We trained very hard, but it seemed that every time we were beginning to form into teams we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing, and a wonderful method it can be for creating the illusion of progress, while producing confusion, inefficiency and demoralization." -Gaius Petronius, 1st Century AD From steve.rieger Mon Oct 3 11:01:21 2005 From: steve.rieger (Steve Rieger) Date: Mon, 3 Oct 2005 11:01:21 -0400 Subject: [nycbug-talk] ssh config question Message-ID: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> hi all amoung the many options is there a way i can tell sshd_config to only allow connections from a certain ip address. Steve Rieger steve.rieger at tbwachiat.com Cell 646-335-8915 Office 212 804 1131 Fax 212 804 1200 AIM chozrim Yahoo riegersteve if ((light eq dark) && (dark eq light) && ($blaze_of_night{moon} == black_hole) && ($ravens_wing{bright} == $tin{bright})){ my $love = $you = $sin{darkness} + 1; }; From mikel.king Mon Oct 3 11:09:48 2005 From: mikel.king (Mikel King) Date: Mon, 3 Oct 2005 11:09:48 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: On Oct 3, 2005, at 11:01 AM, Steve Rieger wrote: > hi all > > amoung the many options is there a way i can tell sshd_config to > only allow connections from a certain ip address. > > > > Steve Rieger > steve.rieger at tbwachiat.com > Cell 646-335-8915 > Office 212 804 1131 > Fax 212 804 1200 > AIM chozrim > Yahoo riegersteve > > if ((light eq dark) && (dark eq light) > && ($blaze_of_night{moon} == black_hole) > && ($ravens_wing{bright} == $tin{bright})){ > my $love = $you = $sin{darkness} + 1; > }; > IPFW... or some other firewally type method is probably the best way... Cheers, Mikel King Optimized Computer Solutions, INC Tech Alliance, INC 39 West Fourteenth Street Second Floor New York, NY 10011 http://www.ocsny.com http://www.techally.com t: 212.727.2100x132 +------------------------------------------+ How do you spell cooperation? Pessimists use each other, but optimists help each other. Collaboration feeds your spirit, while competition only stokes your ego. You'll find the best way to get along. +------------------------------------------+ From steve.rieger Mon Oct 3 11:15:33 2005 From: steve.rieger (Steve Rieger) Date: Mon, 3 Oct 2005 11:15:33 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: On Oct 3, 2005, at 11:09 AM, Mikel King wrote: > > On Oct 3, 2005, at 11:01 AM, Steve Rieger wrote: > > >> hi all >> >> among the many options is there a way i can tell sshd_config to >> only allow connections from a certain ip address. >> >> > > IPFW... or some other firewally type method is probably the best > way... i do not want to start up a firewall if there is any other way. is there no accept from like there is in postfix for relay ? From sequethin Mon Oct 3 11:21:53 2005 From: sequethin (Mike Hernandez) Date: Mon, 3 Oct 2005 11:21:53 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: <3060c2390510030821l700afda1t3349818c8c16d3f0@mail.gmail.com> On 10/3/05, Steve Rieger wrote: > i do not want to start up a firewall if there is any other way. > > is there no accept from like there is in postfix for relay ? google for sshd hosts.allow Mike From mikel.king Mon Oct 3 11:34:13 2005 From: mikel.king (Mikel King) Date: Mon, 3 Oct 2005 11:34:13 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: On Oct 3, 2005, at 11:15 AM, Steve Rieger wrote: > > On Oct 3, 2005, at 11:09 AM, Mikel King wrote: > > >> >> On Oct 3, 2005, at 11:01 AM, Steve Rieger wrote: >> >> >> >>> hi all >>> >>> among the many options is there a way i can tell sshd_config to >>> only allow connections from a certain ip address. >>> >>> >>> >> >> IPFW... or some other firewally type method is probably the best >> way... >> > > i do not want to start up a firewall if there is any other way. > > is there no accept from like there is in postfix for relay ? > There is this form the man page... HostbasedAuthentication Specifies whether rhosts or /etc/hosts.equiv authentication together with successful public key client host authentication is allowed (hostbased authentication). This option is similar to RhostsRSAAuthentication and applies to protocol version 2 only. The default is ``no''. HostKey Specifies a file containing a private host key used by SSH. The default is /etc/ssh_host_key for protocol version 1, and /etc/ssh_host_rsa_key and /etc/ssh_host_dsa_key for protocol ver- sion 2. Note that sshd will refuse to use a file if it is group/world-accessible. It is possible to have multiple host key files. ``rsa1'' keys are used for version 1 and ``dsa'' or ``rsa'' are used for version 2 of the SSH protocol. Cheers, Mikel King Optimized Computer Solutions, INC Tech Alliance, INC 39 West Fourteenth Street Second Floor New York, NY 10011 http://www.ocsny.com http://www.techally.com t: 212.727.2100x132 +------------------------------------------+ How do you spell cooperation? Pessimists use each other, but optimists help each other. Collaboration feeds your spirit, while competition only stokes your ego. You'll find the best way to get along. +------------------------------------------+ From ike Mon Oct 3 13:19:13 2005 From: ike (Isaac Levy) Date: Mon, 3 Oct 2005 13:19:13 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: <870867BD-A8DE-4C5F-A062-8CB1506C064A@lesmuug.org> Hi Steve, On Oct 3, 2005, at 11:01 AM, Steve Rieger wrote: > amoung the many options is there a way i can tell sshd_config to > only allow connections from a certain ip address. > > > No, by design, that should happen at the link-layer (IP), not the Applicaton layer. Weather or not this would be handy, is another discussion alltogher... but I'd think this feature would tend to be sorely abused. You should check /etc/hosts.allow for certain, man pages on the syntax are hosts_options on FreeBSD- as you may get what you need out of that. -- Sidenote regarding HostbasedAuthentication and HostKey, these are SSH configurtion directives for using ssh keys, which is a whole other bag... (I Love ssh keys!) Some Googles: http://www.arches.uga.edu/~pkeck/ssh/ http://www.sshkeychain.org/mirrors/SSH-with-Keys-HOWTO/SSH-with-Keys- HOWTO.html Rocket- .ike From hubert Mon Oct 3 13:23:25 2005 From: hubert (Hubert Feyrer) Date: Mon, 3 Oct 2005 19:23:25 +0200 (CEST) Subject: [nycbug-talk] ssh config question In-Reply-To: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: On Mon, 3 Oct 2005, Steve Rieger wrote: > amoung the many options is there a way i can tell sshd_config to only allow > connections from a certain ip address. I guess that hosts.allow is your best bet here. A weaker alternative is to turn off password-based authentication ("PasswordAuthentication no"), and the use "from=" in the authorized_keys file, ssee the "AUTHORIZED_KEYS FILE FORMAT" section in sshd(8) manpage. - Hubert From steve.rieger Mon Oct 3 13:28:49 2005 From: steve.rieger (Steve Rieger) Date: Mon, 3 Oct 2005 13:28:49 -0400 Subject: [nycbug-talk] ssh config question In-Reply-To: References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: On Oct 3, 2005, at 1:23 PM, Hubert Feyrer wrote: > On Mon, 3 Oct 2005, Steve Rieger wrote: > >> amoung the many options is there a way i can tell sshd_config to >> only allow connections from a certain ip address. >> > > I guess that hosts.allow is your best bet here. > > A weaker alternative is to turn off password-based authentication > ("PasswordAuthentication no"), and the use "from=" in the > authorized_keys file, ssee the "AUTHORIZED_KEYS FILE FORMAT" > section in sshd(8) manpage. got it do do what i needed with /etc/hosts.allow thanx all From lmurillo Mon Oct 3 13:40:27 2005 From: lmurillo (Luis Murillo) Date: Mon, 03 Oct 2005 11:40:27 -0600 Subject: [nycbug-talk] ssh config question In-Reply-To: References: <45DEC7FC-DCE1-4559-9AC0-8D3D0639FB79@tbwachiat.com> Message-ID: <43416D0B.3090109@gmx.net> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Why is it a "weaker alternative" to use authorized_keys? Isn't this a bit more secure than using passwords? Hubert Feyrer wrote: > On Mon, 3 Oct 2005, Steve Rieger wrote: > >> amoung the many options is there a way i can tell sshd_config to only >> allow connections from a certain ip address. > > > I guess that hosts.allow is your best bet here. > > A weaker alternative is to turn off password-based authentication > ("PasswordAuthentication no"), and the use "from=" in the > authorized_keys file, ssee the "AUTHORIZED_KEYS FILE FORMAT" section in > sshd(8) manpage. > > > - Hubert > _______________________________________________ > % NYC*BUG talk mailing list > http://lists.nycbug.org/mailman/listinfo/talk > %Be sure to check out our Jobs and NYCBUG-announce lists > %We meet the first Wednesday of the month > > - -- Luis Murillo lmurillo at gmx.net GPG KeyID: D66B35FD gpg --keyserver pgp.mit.edu --recv-keys D66B35FD -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDQW0Lv7xQYtZrNf0RAqzdAJ479OQI06S7dB9ZeMulrpbyNfV0wACfXN0I St4lGetasoK2ggO5WHW5XWY= =0QJC -----END PGP SIGNATURE----- From trish Tue Oct 4 13:40:33 2005 From: trish (Trish Lynch) Date: Tue, 4 Oct 2005 13:40:33 -0400 (EDT) Subject: [nycbug-talk] Apache, ftp, samba, etc.... In-Reply-To: <6A48E3C8-6DD9-49F6-A166-2B5576D009F0@redivi.com> References: <20050926203406.kqdee76q88kk48k8@free.loftmail.com> <433894B1.80704@sddi.net> <20051001233348.I15236@zoraida.natserv.net> <8c50a3c30510012158u75915d84pfe164eb6727f8c6c@mail.gmail.com> <20051002100309.Y88154@zoraida.natserv.net> <6A48E3C8-6DD9-49F6-A166-2B5576D009F0@redivi.com> Message-ID: <20051004133926.X59405@ultra.bsdunix.net> On Mon, 3 Oct 2005, Bob Ippolito wrote: > > In either case, when was the last time you did anything CPU bound? Almost > every service you're going to run is IO bound by disk or network (or even > RAM). The CPU almost always has plenty of cycles to spare. let me see, I'm currently doing this right now, we do realtime audio and video processing using FreeBSD hosts to multiplex it, it takes increasing the rtprio of processes to get them working well, and they are majorly cpu bound :) -Trish -- Trish Lynch trish at bsdunix.net Ecartis Core Team trish at listmistress.org EFNet IRC Operator/SysAdmin @ irc.dkom.at AilleCat at EFNet Key fingerprint = 781D 2B47 AA4B FC88 B919 0CD6 26B2 1D62 6FC1 FF16 From joshmccormack Wed Oct 5 12:42:41 2005 From: joshmccormack (Josh McCormack) Date: Wed, 05 Oct 2005 12:42:41 -0400 Subject: [nycbug-talk] wireless card supported in OpenBSD? Message-ID: <43440281.80902@travelersdiary.com> I looked at the OpenBSD site, but just want to make sure I"m not overlooking something. I have a 802.11b pcmcia card that I think is not supported. Could someone confirm or deny? GigaFast Wireless 802.11B PCMCIA Adapter WF721-AEX Thanks, Josh From mickey Wed Oct 5 12:55:45 2005 From: mickey (Michael Shalayeff) Date: Wed, 5 Oct 2005 12:55:45 -0400 (EDT) Subject: [nycbug-talk] wireless card supported in OpenBSD? In-Reply-To: <43440281.80902@travelersdiary.com> from Josh McCormack at "Oct 5, 2005 12:42:41 pm" Message-ID: <200510051655.j95Gtj2M030715@lucifier.net> Making, drinking tea and reading an opus magnum from Josh McCormack: > I looked at the OpenBSD site, but just want to make sure I"m not > overlooking something. I have a 802.11b pcmcia card that I think is not > supported. Could someone confirm or deny? > > GigaFast Wireless 802.11B PCMCIA Adapter > WF721-AEX if you already have a card would not it be much faster to just try it? cu -- paranoic mickey (my employers have changed but, the name has remained) From okan Wed Oct 5 13:12:32 2005 From: okan (Okan Demirmen) Date: Wed, 5 Oct 2005 13:12:32 -0400 Subject: [nycbug-talk] wireless card supported in OpenBSD? In-Reply-To: <43440281.80902@travelersdiary.com> References: <43440281.80902@travelersdiary.com> Message-ID: <20051005171254.GB2313@nitrogen.khaoz.org> On Wed 2005.10.05 at 12:42 -0400, Josh McCormack wrote: > I looked at the OpenBSD site, but just want to make sure I"m not > overlooking something. I have a 802.11b pcmcia card that I think is not > supported. Could someone confirm or deny? > > GigaFast Wireless 802.11B PCMCIA Adapter > WF721-AEX stick it in your laptop and send a dmesg From george Wed Oct 5 22:50:14 2005 From: george (George R.) Date: Wed, 05 Oct 2005 22:50:14 -0400 Subject: [nycbug-talk] SFS: Self-certifying File System Message-ID: <434490E6.7010209@sddi.net> A number of us were talking about remote mapping of file systems securely after the NYCBUG meeting. . . It's SFS Self-certifying File System (it's in the fbsd ports in security/) Marco S told me about it. . . one of or *the* developer is David Mazieres, who I guess taught at NYU last semester, but is apparently at Stanford: http://www.scs.stanford.edu/~dm/ And SFS is here: http://www.fs.net/sfswww/ Anyone have practical experience with it? g From lists Thu Oct 6 08:21:15 2005 From: lists (michael) Date: Thu, 6 Oct 2005 08:21:15 -0400 Subject: [nycbug-talk] Fw: Newsletter from O'Reilly Message-ID: <20051006082115.5ed57c4c@genoverly.com> ----------------------------------------------------------- Begin forwarded message: Date: Wed, 05 Oct 2005 12:29:04 -0700 Subject: Newsletter from O'Reilly UG Program, October 5 ================================================================ O'Reilly News for User Group Members October 5, 2005 ================================================================ ---------------------------------------------------------------- Book News ---------------------------------------------------------------- -Ambient Findability -Halo 2 Hacks -Cult of iPod -Windows Server 2003 Network Administration -Prefactoring -Degunking Windows, Second Edition -eBay: The Missing Manual -iPod Shuffle Fan Book -Behind Closed Doors -Security and Usability -iLife: The Missing Manual -Digital Photography Pocket Guide, 3rd Edition -Oracle PL/SQL Programming, 4th Edition -TCP/IP Guide -Cisco IOS in a Nutshell, 2nd Edition ---------------------------------------------------------------- Upcoming Events ---------------------------------------------------------------- -Stephen Teilhet ("C# Cookbook" and "Subclassing and Hooking with Visual Basic") at Compuware OJ.X, Detroit, MI--October 6 -"The Art of Project Management" Tour, Boston, NYC, and Pittsburgh--October 11-19 -O'Reilly Authors at Macromedia Max, Anaheim, CA--October 16-19 -Steven Feuerstein's Oracle PL/SQL Programming Conference, Chicago, IL--November 2-3 ---------------------------------------------------------------- Conference News ---------------------------------------------------------------- -ETel Registration Now Open -Registration is Open for EuroOSCON ---------------------------------------------------------------- News ---------------------------------------------------------------- -Tim O'Reilly in the News -What Is Web 2.0? -Beta Broadcast 002: Data for Web 2.0 -What Is Asterisk? -Marking up your Designs with HTMLstamps Opera Goes Free Without Ads -User Group Members receive a special 50% discount Learning Lab Courses -Perlcast Interviews Jesse Vincent, author of "RT Essentials" -What Is Free Software? -Installing Debian -Backward Compatibility? We've Heard of It -Using FreeBSD's ACLs -How to Set Up Backup 3 and Save Your Data -Installing Fink on Mac OS X -What Is ASP.NET? -Using Windows Explorer with Alternate Credentials -What Is C#? -What Is Quartz? -What Is Hibernate? -Jack Herrington ("Podcasting Hacks") on the User Group Report -Nate Howard: Midwestern Photographer in Iraq -Julian Kwasneski: Inside Game Audio -Make your own "PowerSquid" ================================================ Book News ================================================ Did you know you can request a free book to review for your group? Ask your group leader for more information. For book review writing tips and suggestions, go to: http://ug.oreilly.com/bookreviews.html Don't forget, you can receive 30% off any O'Reilly, No Starch, Paraglyph, PC Publishing, Pragmatic Bookshelf, SitePoint, or Syngress book you purchase directly from O'Reilly. Just use code DSUG when ordering online or by phone 800-998-9938. http://www.oreilly.com/ ***Free ground shipping is available for online orders of at least $29.95 that go to a single U.S. address. This offer applies to U.S. delivery addresses in the 50 states and Puerto Rico. For more details, go to: http://www.oreilly.com/news/freeshipping_0703.html ---------------------------------------------------------------- New Releases ---------------------------------------------------------------- ***Ambient Findability ISBN: 0596007655 Written by best-selling author Peter Morville, this thought-provoking book describes the future of information and connectivity, examining how the melding of innovations like GIS and the internet will impact the global marketplace and society at large. Focused on information literacy, information architecture, and usability as critical components, this book doesn't preach or pretend to know all the answers, rather, Morville presents research, stories, and examples for support. http://www.oreilly.com/catalog/ambient/ Chapter 1, "Lost and Found," is available online: http://www.oreilly.com/catalog/ambient/chapter/index.html Book Blog: http://findability.org/ ***Halo 2 Hacks Publisher: O'Reilly ISBN: 0596100590 Even if you've finished Halo 2 in Legendary Mode, you're not done with this game. This incredible book gives you a horde of great hacks for weapons, levels, vehicles, game play, and mods. With all the clever tips and tricks we have in store, you'll turn Halo 2 into a whole new experience, whether you're at level 25 or a complete n00b. http://www.oreilly.com/catalog/halo2hks/index.html Sample Hack 46, "Drop Your Weapons," is available online: http://www.oreilly.com/catalog/halo2hks/chapter/index.html ***Cult of iPod Publisher: No Starch Press ISBN: 1593270666 "The Cult of iPod" is a comprehensive look at how the iPod is changing music, culture, and listening behavior. This 4-color book includes the exclusive back story of the iPod's development, looks at the many ways iPod's users pay homage to their devices, and investigates the quirkier aspects of iPod culture. From Wired News reporter Leander Kahney. http://www.oreilly.com/catalog/1593270666/index.html ***Windows Server 2003 Network Administration Publisher: O'Reilly ISBN: 0596008007 Ideal for system administrators and network managers, this essential guide is divided into three distinct sections: fundamental concepts, tutorial, and reference. The first three chapters are a basic discussion of the network protocols and services. The remaining chapters provide a how-to tutorial for planning, installing, and configuring various important network services. The book concludes with three appendixes that are technical references for various configuration options. http://www.oreilly.com/catalog/windowsvrnet/ Chapter 14, "Troubleshooting TCP/IP," is available online: http://www.oreilly.com/catalog/windowsvrnet/chapter/index.html ***Prefactoring Publisher: O'Reilly ISBN: 0596008740 If you understand object-oriented design, and you want to save time and money by considering more efficient designs before you begin your project, Prefactoring will show you the way. This practical, thought-provoking guide details prefactoring guidelines in design, code, and testing, derived from lessons learned by many developers over the years. With these guidelines, you'll create more readable code before you reach the second-guessing stage. http://www.oreilly.com/catalog/prefactoring/ Chapter 2, "The System in So Many Words," is available online: http://www.oreilly.com/catalog/prefactoring/chapter/index.html ***Degunking Windows, Second Edition Publisher: Paraglyph Press ISBN: 1933097078 This fully updated and expanded edition provides numerous new Degunking techniques to help Windows users get the most out of the latest version of Windows XP-Service Pack 2. The book features new software, an expanded 12-step Degunking plan, expanded hardware coverage, techniques for getting the "kinks" out of SP 2, and new chapters on Windows Media Player and security updates to keep PCs running safely and efficiently. http://www.oreilly.com/catalog/1933097078/index.html ***eBay: The Missing Manual Publisher: O'Reilly ISBN: 0596006446 This book has gems of wisdom for everyone from total novices to more experienced traders. It covers both buying and selling, and it's chock full of step-by-step instructions. Buyers will find the most effective ways to find what they want and pay great prices. Sellers will get surefire tips from eBay veterans who have discovered ways to ramp up their own auctions and sell at the highest possible prices. http://www.oreilly.com/catalog/ebaytmm/ Chapter 3, "Finding and Getting Bargains," is available online: http://www.oreilly.com/catalog/ebaytmm/chapter/index.html ***iPod Shuffle Fan Book Publisher: O'Reilly ISBN: 0596100701 This is the ultimate written companion for iPod Shuffle owners. This user-friendly guide will teach you how to get your Shuffle up and running, load it with up to 240 songs, and even use it as a flash drive to transport files. Then, learn how to create custom playlists, share and publish with iMix, burn playlists on CDs, and more. Beautifully designed in a colorful, compact format, this handy reference book is a must have for "shufflers" everywhere. http://www.oreilly.com/catalog/ipodshufflefb/ ***Behind Closed Doors Publisher: Pragmatic Bookshelf ISBN: 0976694026 If you're a seasoned manager who wants to be more effective, or if you're considering moving into management, this book will show you what to do and how to do it effectively. http://www.oreilly.com/catalog/0976694026/index.html ***Security and Usability Publisher: O'Reilly ISBN: 0596008279 Destined to be the classic reference in this emerging field, Security & Usability collects groundbreaking essays from leading security and human-computer interaction (HCI) researchers on authentication, privacy and anonymity, secure systems, commercialization, and much more. This book is expected to start an avalanche of discussion, new ideas, and further advances in this important field. http://www.oreilly.com/catalog/securityusability/ Chapter 23, "Privacy Analysis for the Casual User with Bugnosis," is available online: http://www.oreilly.com/catalog/securityusability/chapter/index.html ***iLife: The Missing Manual Publisher: O'Reilly ISBN: 0596100361 Objective and in-the-know, David Pogue highlights the newest features, changes, and improvements of iLife '05, covers the capabilities and limitations of each program within the suite, and delivers countless undocumented tips, tricks, and secrets for getting the best performance out of every iLife application. Pogue examines all five programs in iLife '05 in depth: iTunes 4.7, iPhoto 5, iMovie HD, iDVD 5, and GarageBand 2. http://www.oreilly.com/catalog/ilife5tmm/ ***Digital Photography Pocket Guide, 3rd Edition Publisher: O'Reilly ISBN: 0596100159 Portable and affordable, this is the perfect on-the-go guide for taking top-notch digital photos. In full color, this third edition of the bestseller covers everything from shooting sports action, close ups, and night shots, to dealing with image resolution, archiving, memory cards, and more. There's also a comprehensive table of contents and index, so you'll waste no time flipping to the specific information you need. http://www.oreilly.com/catalog/digphotopg3/ A sample excerpt, "Who's in Charge?", is available online: http://www.oreilly.com/catalog/digphotopg3/chapter/index.html ***Oracle PL/SQL Programming, 4th Edition Publisher: O'Reilly ISBN: 0596009771 This fourth edition of the 10-year bestseller is a comprehensive update with significant new content extending to Oracle Database 10g Release 2. New chapters added cover security, I/O (file, email, and web), and internationalization. New features described include the PL/SQL optimizing compiler, conditional compilation, compile-time warnings, regular expressions, and much more. This classic reference provides language syntax, best practices, and extensive code. http://www.oreilly.com/catalog/oraclep4/ Chapter 20, "Managing PL/SQL Code," is available online: http://www.oreilly.com/catalog/oraclep4/chapter/index.html ***TCP/IP Guide Publisher: No Starch Press ISBN: 159327047X The "TCP/IP Guide" is both an encyclopedic and comprehensible guide to the TCP/IP protocol suite. Its personal, easy-going writing style lets anyone understand the dozens of protocols and technologies that run the Internet, with full coverage of PPP, ARP, IP, IPv6, IP NAT, IPSec, Mobile IP, ICMP, RIP, BGP, TCP, UDP, DNS, DHCP, SNMP, FTP, SMTP, NNTP, HTTP, Telnet, and much more. http://www.oreilly.com/catalog/159327047X/index.html ***Cisco IOS in a Nutshell, 2nd Edition Publisher: O'Reilly ISBN: 0596008694 Fully revised, this second edition takes the mystery out of IOS 12.3 and consolidates the most important commands and features of IOS into a single, well-organized volume that you'll find refreshingly user-friendly. This book covers IOS configuration for the TCP/IP protocol family, and includes information on the user interface, configuring lines and interfaces, dial-on-demand routing and security, access lists, and much more. http://www.oreilly.com/catalog/cisconut2/ Chapter 14, "Switches and VLANs," is available online: http://www.oreilly.com/catalog/cisconut2/chapter/index.html ***MAKE Magazine Subscriptions Available The annual subscription price for four issues is $34.95. When you subscribe with this link, you'll get a free issue--the first one plus four more for $34.95. So subscribe for yourself or friends with this great offer for charter subscribers: five volumes for the cost of four. Subscribe at: https://www.pubservice.com/MK/Subnew.aspx?PC=MK&PK=M5ZUGLA ================================================ Upcoming Events ================================================ ***For more events, please see: http://events.oreilly.com/ ***Stephen Teilhet ("C# Cookbook" and "Subclassing and Hooking with Visual Basic") at Compuware OJ.X, Detroit, MI--October 6 Author Stephen will sign copies of his books at this event. http://www.compuwareojx.com/ ***"The Art of Project Management" Tour, Boston, NYC, and Pittsburgh-- October 11-19 Scott Berkun, author of the bestselling book "The Art of Project Management," is hitting the road in October. Inspiring, funny, honest, and compelling, this essential book is fueled by over a decade of work in the industry and will save you and your team countless hours of trial and error. Further details on the tour can be found on Scott's blog. http://www.scottberkun.com/blog/?p=128 ***O'Reilly Authors at Macromedia Max, Anaheim, CA--October 16-19 Colin Moock ("Essential ActionScript 2.0" and "ActionScript for Flash MX: The Definitive Guide") and Joey Lott ("Actionscript Cookbook") are both presenting at this year's event. http://www.macromedia.com/macromedia/events/max/ ***Steven Feuerstein's Oracle PL/SQL Programming Conference, Chicago, IL--November 2-3 Join Steven Feuerstein, author of "Oracle PL/SQL Programming, 4th Edition," for this one-of-a-kind event on everything PL/SQL. It's a unique opportunity to learn from some of the most respected and experienced PL/SQL experts in the world. Whether you've been using PL/SQL for years or have recently started working with this language, OPP 2005 is a must-attend event. http://www.oracleplsqlprogramming.com/opp2005.php ================================================ Conference News ================================================ ***ETel Registration Now Open Emerging telephony networks enable a new generation of powerful communication applications, which threaten established business models--but more importantly, open up new opportunities and new markets. O'Reilly's Emerging Telephony Conference, January 24-26 in San Francisco, aims to articulate this revolution, provide a framework, and spark creative discussions among enterprise managers, developers, hackers, and sponsors interested in telephony. Join us as we explore this exciting new territory and investigate its implications. http://conferences.oreilly.com/etel/ Use code "etel06dsug" when you register, and receive 15% off the registration price. To register for the conference, go to: http://conferences.oreillynet.com/cs/etel2006/create/ord_etel06 ***Registration is Open for EuroOSCON Join developers, systems and network administrators, and IT managers at the very first O'Reilly European Open Source Convention in Amsterdam on October 17-20. EuroOSCON will explore the best and newest open source technologies, particularly for companies, governments, and nonprofits. EuroOSCON showcases the diversity in open source while maintaining a practical edge. http://conferences.oreilly.com/eurooscon/ Use code "euos05usrg" when you register, and receive 25% off the registration price. To register for the conference, go to: http://conferences.oreillynet.com/cs/eurooscon/create/ord_euos05 ================================================ News From O'Reilly & Beyond ================================================ --------------------- General News --------------------- ***Tim O'Reilly in the News "The New York Times," September 28, "Search and Rescue" http://radar.oreilly.com/archives/2005/09/ny_times_op_ed_on_authors_guil.html "Wired," October 2005, "The Trend Spotter": http://www.wired.com/wired/archive/13.10/oreilly.html ***What Is Web 2.0 Defining just what Web 2.0 means still engenders much disagreement. Some decry it as a meaningless marketing buzzword, while others have accepted it as the new conventional wisdom. Tim O'Reilly attempts to clarify just what we mean by Web 2.0, digging into the implications of viewing the web as a platform, which applications fall squarely under its purview, and which do not. http://www.oreillynet.com/pub/a/oreilly/tim/news/2005/09/30/what-is-web-20.html ***Beta Broadcast 002: Data for Web 2.0 This week, O'Reilly's audio magazine program "Distributing the Future" takes a look at the Data for Web 2.0. Tim O'Reilly explains "What is Web 2.0," Marc Hedlund ponders the browsers of the future that might mash up the private data on your hard drive with data that lives on the Web, NAVTEQ's Robert Denaro discusses why NAVTEQ drives so many miles each day to gather the geographic information you use in your favorite online mapping applications, Phil Torrone is already hacking the iPod nano, and our "FOO Cast" is more of Richard Giles' Gadget show interview with John Batelle. (24 minutes, 52 seconds) http://www.oreillynet.com/pub/a/network/2005/09/23/distributing-the-future.html ***What Is Asterisk? Asterisk is an open source PBX (private branch exchange) that provides all the functionality of high-end business telephone systems, and much more. Brian McConnell explains how Asterisk works, where to get it, and provides an overview of its feature set and platform capabilities. http://www.oreillynet.com/pub/a/network/2005/09/30/what-is-asterisk.html ***Marking up your Designs with HTMLstamps Alex shows you how to bridge the gap between Website designs done in Photoshop (or any other graphics editor) and the HTML code required to make them real. http://www.sitepoint.com/blogs/2005/09/22/marking-up-your-designs-with-htmlstamps/ ***Opera goes free without ads It's finally happened. Opera, the 3rd player in the browser market (after Microsoft and Mozilla's Firefox), has finally made its popular browser available for free--without embedded ads. Kevin Yank takes a closer look at the move and what it means. http://www.sitepoint.com/blogs/2005/09/20/opera-goes-free-without-ads/ ***User Group Members receive a special 50% discount Learning Lab Courses As an O'Reilly User Group member, you save on all the courses in the following University of Illinois Certificate Series: -Linux/Unix System Administration -Web Programming -Open Source Programming -.NET Programming -Client-Side This offer ends December 31st, 2005. To redeem, use Promotion Code "ORALL1" to save 50%. Each course comes with a free O'Reilly book and a 7-day money-back guarantee. Register online: http://learninglab.oreilly.com/ --------------------- Open Source --------------------- ***Perlcast Interviews Jesse Vincent, author of "RT Essentials" http://perlcast.com/2005/09/29/interview-with-jesse-vincent/ ***What Is Free Software? Today, free software is a large body of high-quality code on which much of the internet depends for critical functions. But free software is much more than a collection of programs. Karl Fogel examines free software under three different lights: as a political movement, as a programming methodology, and as a business model. Karl is the author of "Producing Open Source Software." http://www.onlamp.com/pub/a/onlamp/2005/09/29/what-is-free-software.html ****Installing Debian Debian GNU/Linux is a powerful and popular community-developed Linux distribution--and the basis for several other useful and usable distributions. With the recent release of Debian Sarge, it's better than ever. Edd Dumbill, Debian developer and GNU/Linux advocate, walks through a typical installation. http://www.linuxdevcenter.com/pub/a/linux/2005/09/29/installing_debian.html ***Backward Compatibility? We've Heard of It PHP 5's release has sparked a PR disaster for the popular open source programming language because of some significant backwards compatibility issues. http://www.sitepoint.com/blogs/2005/09/15/backward-compatibility-weve-heard-of-it/ ***Using FreeBSD's ACLs The standard Unix permissions scheme works fine if you have simple needs, but juggling groups and users can grow unwieldy very quickly. FreeBSD's Access Control Lists give you more control over who can access files and directories. Dru Lavigne explains how to enable, understand, and use them appropriately. http://www.onlamp.com/pub/a/bsd/2005/09/22/FreeBSD_Basics.html --------------------- Mac --------------------- ***How to Set Up Backup 3 and Save Your Data Combined with a hefty 1GB of online storage, Backup 3 provides .Mac subscribers with a robust, easy-to-use workflow for protecting their most valuable data. In this tutorial, Derrick Story shows you how to get the most out of version 3, using both your iDisk and DVDs for preserving your work. http://www.macdevcenter.com/pub/a/mac/2005/09/23/backup3.html ***Installing Fink on Mac OS X The Fink project aims to port Unix software to Mac OS X and make it easy to install. In this article, Koen Vervloesem shows you the ins and outs of Fink, with some info about how it compares to DarwinPorts, another package management system for Mac OS X. http://www.macdevcenter.com/pub/a/mac/2005/09/30/fink.html --------------------- Windows/.NET --------------------- ***What Is ASP.NET? Part of the .NET Framework, ASP.NET allows developers to build dynamic web apps and web services using compiled languages like VB.NET and C#. Wei-Meng Lee provides a look under the ASP.NET hood, describing how it works, its improved support in areas like state management and tracing and debugging, and important new features in version 2.0. Wei-Meng is the author of "ASP.NET: A Developer's Notebook." http://www.ondotnet.com/pub/a/dotnet/2005/09/19/what-is-asp-net.html ***Using Windows Explorer with Alternate Credentials Running Windows using administrator credentials can be hazardous to the health of your machine. Mitch Tulloch, author of "Windows Server Hacks," shows you how you can help solve the problem by using Windows Explorer while running alternate credentials. http://www.windowsdevcenter.com/pub/a/windows/2005/09/20/using-windows-explorer-with-alternate-credentials.html ***What Is C#? Jesse Liberty reveals this little-understood secret: C# is really one of two "coatings" of MSIL, the Microsoft Intermediate Language (the second is Visual Basic 2005). Both C# and VB 2005 produce MSIL, and it is MSIL that runs on the .NET platform. Jesse provides an overview of the C# language and how it works within the .NET platform, and concludes with resources for coding in C#. Jesse is the author of "Programming C#, 4th Edition." http://www.ondotnet.com/pub/a/dotnet/2005/10/03/what-is-csharp.html --------------------- Java --------------------- ***What Is Quartz? Java programmers: if you've ever needed an application to perform a task at a specific time, automatically, Chuck Cavaness suggests you check out the Quartz Scheduler. Cavaness looks at this open source job-scheduling framework, explains where to get it, how it works, and reviews its feature set. http://www.onjava.com/pub/a/onjava/2005/09/28/what-is-quartz.html ***What Is Hibernate? Hibernate is a free open source Java package that makes it easy to work with relational databases. James Elliott describes the "enlightened laziness" that resulted in the development of Hibernate, how it works, and when it makes good sense to use it in your projects. James is the author of "Hibernate: A Developer's Notebook." http://www.onjava.com/pub/a/onjava/2005/09/21/what-is-hibernate.html --------------------- Digital Media --------------------- ***Jack Herrington ("Podcasting Hacks") interviewed on the User Group Report on The MUG Center. http://www.mugcenter.com/usergroupreport/2005/534.html (You can also subscribe to this Podcast through iTunes.) ***Nate Howard: Midwestern Photographer in Iraq A photojournalist from Rochester, Minnesota is assigned to cover a local transportation unit on duty in Iraq. The images that Nate Howard returned with document the Iraqi people and American soldiers from a compassionate point of view. http://digitalmedia.oreilly.com/2005/09/28/featured.html ***Julian Kwasneski: Inside Game Audio If you've played Star Wars, The Lord of the Rings, Indiana Jones, James Bond, or any number of NBA, NFL, PGA, or NCCA console games, you've likely heard the music and sound effects of Bay Area Sound. Cofounder Julian Kwasneski takes us inside the process of optimizing audio for games, then shares five MP3s. http://digitalmedia.oreilly.com/2005/09/21/bas-kwasneski-game-audio.html --------------------- MAKE --------------------- ***Make your own "PowerSquid" Have you seen the "PowerSquid" on ThinkGeek? It's a very cool, five-outlet power strip that allows you to plug in those bulky square adapters. The Make team was going to order one, but they were out of stock and so they made their own--with a total of eight outlets--for almost half the price. Here's the simple cheap version. http://www.makezine.com/blog/archive/2005/09/how_to_make_your_own_powersqui.html Try a Sample Project from MAKE: http://makezine.com/samples/ MAKE Show Archive: http://www.makezine.com/blog/archive/make_podcast/ ***For more information on MAKE, go to: http://www.makezine.com/ ================================================ >From Your Peers ================================================ ***Don't forget to check out the O'Reilly UG wiki to see what user groups around the globe are up to: http://wiki.oreillynet.com/usergroups/index.cgi Until next time-- Marsee Henon ================================================================ O'Reilly 1005 Gravenstein Highway North Sebastopol, CA 95472 http://ug.oreilly.com/ http://www.oreilly.com ================================================================ Michael From lists Thu Oct 6 09:07:08 2005 From: lists (michael) Date: Thu, 6 Oct 2005 09:07:08 -0400 Subject: [nycbug-talk] freebsd web Message-ID: <20051006090708.22f0ac86@genoverly.com> FreeBSD has launched a new look for its website; It looks clean and seems effective, nice job. Check it out: http://www.freebsd.org/ Is that the 'new logo' at the top? Michael From nomadlogic Thu Oct 6 11:10:12 2005 From: nomadlogic (pete wright) Date: Thu, 6 Oct 2005 08:10:12 -0700 Subject: [nycbug-talk] freebsd web In-Reply-To: <20051006090708.22f0ac86@genoverly.com> References: <20051006090708.22f0ac86@genoverly.com> Message-ID: <57d710000510060810y635eb0bel328da6bbd592ed20@mail.gmail.com> On 10/6/05, michael wrote: > > FreeBSD has launched a new look for its website; > It looks clean and seems effective, nice job. > Check it out: http://www.freebsd.org/ > > Is that the 'new logo' at the top? yea looks pretty similar to our site...i think we should send these guy's a letter ;p (actually it looks nothing like our site except for the navigation bar i know) i was following a thread on questions@ and it seems the new logo will be getting rolled out in a little while, i guess they are finishing up voting on it today. -p -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.nycbug.org/pipermail/talk/attachments/20051006/c0c48504/attachment.html From nomadlogic Thu Oct 6 11:11:58 2005 From: nomadlogic (pete wright) Date: Thu, 6 Oct 2005 08:11:58 -0700 Subject: [nycbug-talk] SFS: Self-certifying File System In-Reply-To: <434490E6.7010209@sddi.net> References: <434490E6.7010209@sddi.net> Message-ID: <57d710000510060811j107cd910k2f0f0ecac5aaabbc@mail.gmail.com> On 10/5/05, George R. wrote: > > A number of us were talking about remote mapping of file systems > securely after the NYCBUG meeting. . . > > It's SFS Self-certifying File System (it's in the fbsd ports in security/) > > Marco S told me about it. . . one of or *the* developer is David > Mazieres, who I guess taught at NYU last semester, but is apparently at > Stanford: > > http://www.scs.stanford.edu/~dm/ > > And SFS is here: > > http://www.fs.net/sfswww/ > > Anyone have practical experience with it? I obviously missed the discussion last night, but quickly checking our the sfs site it sounds comparable to AFS. was there any discussion on how this may be different than AFS? -pete g > _______________________________________________ > % NYC*BUG talk mailing list > http://lists.nycbug.org/mailman/listinfo/talk > %Be sure to check out our Jobs and NYCBUG-announce lists > %We meet the first Wednesday of the month > -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.nycbug.org/pipermail/talk/attachments/20051006/ee0d1198/attachment.html From marco Thu Oct 6 11:44:33 2005 From: marco (Marco Scoffier) Date: Thu, 6 Oct 2005 11:44:33 -0400 Subject: [nycbug-talk] SFS: Self-certifying File System In-Reply-To: <57d710000510060811j107cd910k2f0f0ecac5aaabbc@mail.gmail.com> References: <434490E6.7010209@sddi.net> <57d710000510060811j107cd910k2f0f0ecac5aaabbc@mail.gmail.com> Message-ID: <20051006154433.GI11680@ns.metm.org> On Thu, Oct 06, 2005 at 08:11:58AM -0700, pete wright wrote: > >I obviously missed the discussion last night, but quickly checking our the >sfs site it sounds comparable to AFS. was there any discussion on how this >may be different than AFS? > Totally different security model. SFS was designed to work over an insecure network. I believe the SFS codebase is much smaller, AFS has legacy creaks and groans in the code. Have been meaning to set this up for a while. I know the security group that David Mazieres heads uses this constantly. Sorry I'm too busy to be around right now... -- Marco From mspitzer Thu Oct 6 12:17:36 2005 From: mspitzer (Marc Spitzer) Date: Thu, 6 Oct 2005 12:17:36 -0400 Subject: [nycbug-talk] checkpoint bought sourcefire Message-ID: <8c50a3c30510060917o4724d076v4d15fa4ef0cb61b7@mail.gmail.com> http://www.snort.org/about_snort/msg_from_marty/mr_100605.html -- "We trained very hard, but it seemed that every time we were beginning to form into teams we would be reorganized. I was to learn later in life that we tend to meet any new situation by reorganizing, and a wonderful method it can be for creating the illusion of progress, while producing confusion, inefficiency and demoralization." -Gaius Petronius, 1st Century AD From nomadlogic Thu Oct 6 13:07:42 2005 From: nomadlogic (pete wright) Date: Thu, 6 Oct 2005 10:07:42 -0700 Subject: [nycbug-talk] SFS: Self-certifying File System In-Reply-To: <20051006154433.GI11680@ns.metm.org> References: <434490E6.7010209@sddi.net> <57d710000510060811j107cd910k2f0f0ecac5aaabbc@mail.gmail.com> <20051006154433.GI11680@ns.metm.org> Message-ID: <57d710000510061007o71b946ahb074ad7f1ec60ce9@mail.gmail.com> On 10/6/05, Marco Scoffier wrote: > > On Thu, Oct 06, 2005 at 08:11:58AM -0700, pete wright wrote: > > > >I obviously missed the discussion last night, but quickly checking our > the > >sfs site it sounds comparable to AFS. was there any discussion on how > this > >may be different than AFS? > > > > Totally different security model. SFS was designed to work over an > insecure > network. I believe the SFS codebase is much smaller, AFS has legacy creaks > and groans in the code. > > Have been meaning to set this up for a while. I know the security group > that David Mazieres heads uses this constantly. > > Sorry I'm too busy to be around right now... execellent, I did a bit of reading up on this after my initial post and it does seem very interesting indeed. it seems to me that distributed file systems like this can solve alot of problems with mobile users...so i'll have to start checking this guy out. -p -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.nycbug.org/pipermail/talk/attachments/20051006/fd41a837/attachment.html From nikolai.fetissov Thu Oct 6 14:33:45 2005 From: nikolai.fetissov (Nikolai N. Fetissov) Date: Thu, 6 Oct 2005 14:33:45 -0400 (EDT) Subject: [nycbug-talk] October meeting audio Message-ID: <2532.63.66.6.134.1128623625.squirrel@www.geekisp.com> Hi, folks, mp3 of yesterday talk by Jan Schaumann is available at http://www.peachisland.com/nycbug/ Sorry for the delay. -- nikolai From lists Thu Oct 6 18:35:47 2005 From: lists (Francisco Reyes) Date: Thu, 6 Oct 2005 18:35:47 -0400 (EDT) Subject: [nycbug-talk] freebsd web In-Reply-To: <57d710000510060810y635eb0bel328da6bbd592ed20@mail.gmail.com> References: <20051006090708.22f0ac86@genoverly.com> <57d710000510060810y635eb0bel328da6bbd592ed20@mail.gmail.com> Message-ID: <20051006183512.U11156@zoraida.natserv.net> On Thu, 6 Oct 2005, pete wright wrote: > yea looks pretty similar to our site...i think we should send these guy's a > letter ;p It looks clean.. although I kind of had gotten used to the previous look and feel. From spork Fri Oct 7 19:51:34 2005 From: spork (Charles Sprickman) Date: Fri, 7 Oct 2005 19:51:34 -0400 (EDT) Subject: [nycbug-talk] java/batik problems Message-ID: Hi, Anyone here know enough about java to know what the batik build failure is telling me? Building as root, there should not be any resource problems, but the port fails with messages suggesting that some resource has been exhausted. I've been in java hell all day. All I wanted was to get this installed: http://callflow.sourceforge.net/ No jre for 1.3 for 5.x, then the jdk build ate up all my free space, and now this with "batik". Tried the package as well, but it does not like the revisions of some of the dependancies. Any ideas? Thanks, Charles root at blarg[/usr/ports/graphics/batik]# make ===> Building for batik-1.5.1_1 Buildfile: build.xml init-args: init: compile: [echo] debug off, optimize on, deprecation on [javac] Compiling 1364 source files to /usr/local/ports/graphics/batik/work/xml-batik/classes [javac] The system is out of resources. [javac] Consult the following stack trace for details. [javac] java.lang.OutOfMemoryError [javac] at java.lang.Object.clone(Native Method) [javac] at com.sun.tools.javac.v8.code.Scope.dupUnshared(Scope.java:107) [javac] at com.sun.tools.javac.v8.comp.Enter.methodEnv(Enter.java:289) [javac] at com.sun.tools.javac.v8.comp.Enter$MemberEnter._case(Enter.java:716) [javac] at com.sun.tools.javac.v8.tree.Tree$MethodDef.visit(Tree.java:441) [javac] at com.sun.tools.javac.v8.comp.Enter$MemberEnter.memberEnter(Enter.java:642) [javac] at com.sun.tools.javac.v8.comp.Enter$MemberEnter.memberEnter(Enter.java:658) [javac] at com.sun.tools.javac.v8.comp.Enter$CompleteEnter.finish(Enter.java:879) [javac] at com.sun.tools.javac.v8.comp.Enter$CompleteEnter.complete(Enter.java:865) [javac] at com.sun.tools.javac.v8.code.Symbol.complete(Symbol.java:366) [javac] at com.sun.tools.javac.v8.comp.Enter.main(Enter.java:544) [javac] at com.sun.tools.javac.v8.JavaCompiler.compile(JavaCompiler.java:357) [javac] at com.sun.tools.javac.v8.Main.compile(Main.java:247) [javac] at com.sun.tools.javac.Main.compile(Main.java:26) [javac] at java.lang.reflect.Method.invoke(Native Method) [javac] at org.apache.tools.ant.taskdefs.compilers.Javac13.execute(Javac13.java:55) [javac] at org.apache.tools.ant.taskdefs.Javac.compile(Javac.java:931) [javac] at org.apache.tools.ant.taskdefs.Javac.execute(Javac.java:757) [javac] at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275) [javac] at org.apache.tools.ant.Task.perform(Task.java:364) [javac] at org.apache.tools.ant.Target.execute(Target.java:341) [javac] at org.apache.tools.ant.Target.performTasks(Target.java:369) [javac] at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1216) [javac] at org.apache.tools.ant.Project.executeTarget(Project.java:1185) [javac] at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:40) [javac] at org.apache.tools.ant.Project.executeTargets(Project.java:1068) [javac] at org.apache.tools.ant.Main.runBuild(Main.java:668) [javac] at org.apache.tools.ant.Main.startAnt(Main.java:187) [javac] at org.apache.tools.ant.launch.Launcher.run(Launcher.java:246) [javac] at org.apache.tools.ant.launch.Launcher.main(Launcher.java:67) BUILD FAILED /usr/local/ports/graphics/batik/work/xml-batik/build.xml:368: Compile failed; see the compiler error output for details. Total time: 2 minutes 40 seconds *** Error code 1 Stop in /usr/local/ports/graphics/batik. From nomadlogic Fri Oct 7 20:14:30 2005 From: nomadlogic (pete wright) Date: Fri, 7 Oct 2005 17:14:30 -0700 Subject: [nycbug-talk] java/batik problems In-Reply-To: References: Message-ID: <57d710000510071714x2a93413crb2dbc28f64aefad7@mail.gmail.com> On 10/7/05, Charles Sprickman wrote: > > Hi, > > Anyone here know enough about java to know what the batik build failure is > telling me? Building as root, there should not be any resource problems, > but the port fails with messages suggesting that some resource has been > exhausted. I've been in java hell all day. All I wanted was to get this > installed: > > http://callflow.sourceforge.net/ > > No jre for 1.3 for 5.x, then the jdk build ate up all my free space, and > now this with "batik". Tried the package as well, but it does not like > the revisions of some of the dependancies. Any ideas? Looks like an Out Of Memory error...which may be due to some wierness with the JRE. How much RAM is on this guy? Would it be possible to build it on another host with more RAM as a portable package? -pete -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.nycbug.org/pipermail/talk/attachments/20051007/556d5183/attachment.html From spork Fri Oct 7 20:45:36 2005 From: spork (Charles Sprickman) Date: Fri, 7 Oct 2005 20:45:36 -0400 (EDT) Subject: [nycbug-talk] java/batik problems In-Reply-To: <57d710000510071714x2a93413crb2dbc28f64aefad7@mail.gmail.com> References: <57d710000510071714x2a93413crb2dbc28f64aefad7@mail.gmail.com> Message-ID: On Fri, 7 Oct 2005, pete wright wrote: > On 10/7/05, Charles Sprickman wrote: >> >> http://callflow.sourceforge.net/ >> >> No jre for 1.3 for 5.x, then the jdk build ate up all my free space, and >> now this with "batik". Tried the package as well, but it does not like >> the revisions of some of the dependancies. >> >> Any ideas? > > Looks like an Out Of Memory error...which may be due to some wierness with > the JRE. How much RAM is on this guy? Would it be possible to build it on > another host with more RAM as a portable package? It's got 256MB, and it's normally a tertiary desktop. But X is not running at the moment, so most of the memory is unused. I may be able to dig up another 5.x, but I'm leery about letting the jdk install all the crap it needs to build (need linux compat, linux_base, OpenMotif, and a whole laundry list of other stuff). If I could avoid that, I'd be happy. Thanks, Charles > -pete > > > > > > -- > ~~o0OO0o~~ > Pete Wright > www.nycbug.org > NYC's *BSD User Group > From nomadlogic Fri Oct 7 21:05:28 2005 From: nomadlogic (pete wright) Date: Fri, 7 Oct 2005 18:05:28 -0700 Subject: [nycbug-talk] java/batik problems In-Reply-To: References: <57d710000510071714x2a93413crb2dbc28f64aefad7@mail.gmail.com> Message-ID: <57d710000510071805u32bc60dbs35e12f5ac444d6df@mail.gmail.com> On 10/7/05, Charles Sprickman wrote: > > On Fri, 7 Oct 2005, pete wright wrote: > > > On 10/7/05, Charles Sprickman wrote: > >> > >> http://callflow.sourceforge.net/ > >> > >> No jre for 1.3 for 5.x, then the jdk build ate up all my free space, > and > >> now this with "batik". Tried the package as well, but it does not like > >> the revisions of some of the dependancies. > >> > >> Any ideas? > > > > Looks like an Out Of Memory error...which may be due to some wierness > with > > the JRE. How much RAM is on this guy? Would it be possible to build it > on > > another host with more RAM as a portable package? > > It's got 256MB, and it's normally a tertiary desktop. But X is not > running at the moment, so most of the memory is unused. > > I may be able to dig up another 5.x, but I'm leery about letting the jdk > install all the crap it needs to build (need linux compat, linux_base, > OpenMotif, and a whole laundry list of other stuff). If I could avoid > that, I'd be happy. yea that sounds sketchy. Although, I'm not suprised that it's complaining about olny having 256megs. While it may be enough to get the jre up and running, it may become an issue while compiling code and extracting jar's etc...sounds like a fun problem to work around ;) -p -- ~~o0OO0o~~ Pete Wright www.nycbug.org NYC's *BSD User Group -------------- next part -------------- An HTML attachment was scrubbed... URL: http://lists.nycbug.org/pipermail/talk/attachments/20051007/24a6c073/attachment.html From nikolai.fetissov Fri Oct 7 21:24:02 2005 From: nikolai.fetissov (Nikolai N. Fetissov) Date: Fri, 07 Oct 2005 21:24:02 -0400 Subject: [nycbug-talk] java/batik problems In-Reply-To: References: <57d710000510071714x2a93413crb2dbc28f64aefad7@mail.gmail.com> Message-ID: <43471FB2.4000500@peachisland.com> Charles Sprickman wrote: > On Fri, 7 Oct 2005, pete wright wrote: > >> On 10/7/05, Charles Sprickman wrote: >> >>> >>> http://callflow.sourceforge.net/ >>> >>> No jre for 1.3 for 5.x, then the jdk build ate up all my free space, and >>> now this with "batik". Tried the package as well, but it does not like >>> the revisions of some of the dependancies. >>> >>> Any ideas? >> >> >> Looks like an Out Of Memory error...which may be due to some wierness >> with >> the JRE. How much RAM is on this guy? Would it be possible to build it on >> another host with more RAM as a portable package? > > > It's got 256MB, and it's normally a tertiary desktop. But X is not > running at the moment, so most of the memory is unused. > > I may be able to dig up another 5.x, but I'm leery about letting the jdk > install all the crap it needs to build (need linux compat, linux_base, > OpenMotif, and a whole laundry list of other stuff). If I could avoid > that, I'd be happy. > > Thanks, > > Charles > >> -pete >> It's not the physical ram, it's the jvm heap size limit. Dig around ant config to see if you can increase that. I don't have java on a bsd box, this is under gentoo: nickf at paris ~ $ /home/SUNWappserver/jdk/bin/java -X -Xmixed mixed mode execution (default) -Xint interpreted mode execution only -Xbootclasspath: set search path for bootstrap classes and resources -Xbootclasspath/a: append to end of bootstrap class path -Xbootclasspath/p: prepend in front of bootstrap class path -Xnoclassgc disable class garbage collection -Xincgc enable incremental garbage collection -Xloggc: log GC status to a file with time stamps -Xbatch disable background compilation -Xms set initial Java heap size -Xmx set maximum Java heap size -Xss set java thread stack size -Xprof output cpu profiling data -Xrunhprof[:help]|[: