Posts by Trevor_Pott

@AJ Stiles

"Providing Source Code would help by forcing the people who wrote it to write it properly in the first place, lest other people point and laugh."

Have you ever used any open source anything? Better yet, have you ever actually looked at the source of open source anything?

The /vast/ majority of it is as badly coded as anything proprietary, and a truly unfortunate amount of it is utter crap. It is largely coded to solve a specific problem, stupendously inefficient and with zero consideration for extensibility, dealing with errors or unexpected input.

So essentially identical quality to proprietary code then.

The only difference is other coders can tear it up /if they choose/.

They very rarely choose to do so, because frankly it would be less bother to code it from scratch anyways. I think you have some overly idealistic views of open source, sir…

@AC

Systems Administration is a blue collar gig. The brass never listen to blue collar folks, they just tell 'em to "get it fixed." They don't care about the details of how it gets fixed, or why it happened in the first place; that's why they are hiring you. When was the last time anyone actually paid any attention to what the plumber or the electrician or Janitor said? Only if something bites them in the ass multiple (expensive) times do they begin to ask “why did this happen” as opposed to just barking out the orders “make it better.”

Sysadmins are digital janitors, and if they agitate too much about things like crappily designed software they risk being replaced; after all, thanks to things like outsourced, offshoring and cloud computing…there’s a massive oversupply of them.

So every sysadmin has to walk to terrifying line between making enough noise to cover their ass when things go boom, and not speaking out so loudly that when cutbacks roll around theirs is the first face on people’s minds to get rid of.

@Stephen Roberts 2

Check my replies later in this thread...I do explain it all more in detail...

@Chris in NZ

Actually, Vista/7 have mostly done away with DLL hell. I abhor the solution, but their "WinSXS folder" does seem to solve that particular issue.

Windows 7 can take many more kinds of patches in stride without reboots than XP, but it admittedly falls *far* behind it’s competition in this regard; this is largely due to the outdated fundamental security model of the OS…something that Windows 8 is supposed to address.

Windows 7's approach to UAC and privilege separation is as good IMHO as anything Linux or Mac have to offer, and if you wonder when Windows will catch up with Linux and Mac on the rest of the security model, please go read everything Mary Jo Foely has to say on the topic of Midori. If the rumours are right, and they are using Midori as the basis for Windows 8, then things are going to get VERY interesting in a couple of years.

Midori is considered to be Microsoft’s first “post-Windows” operating system, and will likely form the basis of the next generation of the Windows brand. The model for the operating system is so radically different from what exists now that I frankly haven’t found myself this excited for a new OS since OSX was about to be launched.

In any case, I can’t do this topic justice, get the hence to Mary Jo Foely’s blog, and read what she has to say.

http://www.zdnet.com/blog/microsoft/on-the-road-to-midori-redhawk-minsafe-and-sapphire/1477 is a good place to start, but there is plenty more…

@gerdesj

I never once claimed that "because my router does NAT my LAN is secure."

I point out that it is common practice, ESPESSIALLY inside a home or very small business. For these people it may not be "secure" in the truest sense of the word, but it is GOOD ENOUGH. Aunt Tilly the Home User or Ma & Pa's 2 PC Bakery don't have the resources, training or time to deal with the kind of network security and management that IPV6 is going to bring to their doors.

They don’t care about SIP, or any of the crap that the end-to-end model makes easier. They want to get to a couple of web pages, get their e-mail, and upload their taxes once a year.

IPV6 in its current format will be a nightmare for these folks, and the entire internet establishment doesn’t seem to care. All you get is “well, the way they are doing it is just plain WRONG, so they should learn better.”

The way they are doing it has worked for FIFTEEN YEARS; these people are going to get their hackles up when told to change, and for no good reason they can understand.

I am sorry, but it drips of arrogance and lack of end-user usage scenarios to me.

@M Gale

Not a vinyl router...but close. Different kind of media production, same basic idea.

@Jay Daley

Read it. Still don't agree with their approach. IMHO it’s not even close to enough. I want address space that simply isn’t routable on the public internet, space that I can assign either manually or DHCP so I control rigidly what lives on my network, and I want these systems to be able to get at Internet resources without those resources seeing anything about my network. What I want is NAT. Not some touchy feely “if people code their routers and applications to respect the rules, then you will have your privacy and security,” but actual “the only information you are getting about my packets is that they come from my edge device.”

I don’t happen to *like* the end-to-end model, and see no value in preserving it. There is simply a fundamental philosophical difference at work here. I don’t want the internet ever able to address anything behind my edge systems, I don’t want the internet to be able to uniquely identify systems behind my edge, and I want to be able to run around behind my firewall with as few shields as possible. Unless my understanding of IPV6

ULAs aren’t a help at all because ULAs are still supposed to be globally unique. I don’t want globally unique addresses. I want a block of private addresses that *everyone* uses and that for all intents and purposes can’t be routed across the internet. Even if you put your own router into place that would disobey the rules, other routers along the way would simply refuse to forward those packets because they are private address space.

“Untraceable IPV6 Addresses” is smoke and mirrors. There’s no actual anonymity. There’s simply “well, there are just SO MANY addresses that you can randomly assign them!” I don’t want to randomly assign them. I want them assigned sequentially in a way that makes sense TO ME, THE HUMAN WHO HAS TO RUN THE DAMNED NETWORK. But I don’t in any way want you seeing the structure of my network, or the local addresses of my systems. You should see *nothing* except the address of my edge system.

For that matter, stateless auto-config can die in a fire too. I don’t want devices on my network auto-configuring. If you aren’t handed an address, then you languish in .169 and don’t get to communicate with anyone. Network control is eleventeen squillion times more important than being friendly or neighbourly. My network; noone else’s.

I learn to work with IPV6 as it is because I am forced to; I have no vote or say in how it is deployed. Is wrong, absolutely nothing prevents someone from coding a router or network stack that takes what should be “private” or “privacy assured” IPV6 addresses and harvesting the unique information out of them. I don’t trust my ISP, do you? Why should I trust any router past the one on the edge of my network?

But the complete disregard for the concerns of folks like me makes me a Sad Panda. I have nothing but disdain and zero respect for the attitude of the folks who oversee IPV6 I never thought I’d say this, but I really hope Cisco wins. The internet establishment needs to be taken down a peg on this. Have you READ these documents? “The perceived benefits of NAT.” Who the heck are these folks to determine if someone else finds benefit in a technology or not? They can run their networks their way, let us run our networks our way. With any luck, NATPT6 will be widely available regardless of the desires of the IPV6 committees.

AND I WILL CACKLE WITH GLEE.

Until then, I will shield everything system I have, and direct as much negative mental energy as I can in the direction of the Ivory Tower folks who decided they knew better than the rest of us.

If that sounds bitter and angry, then so be it.

@Terry Walker

SCCM = $. :(

@Robin 1

I don't care if NAT breaks things. I want them broken. I don't care about IPTel or other people's applications. Broken by default is good. I don't care about anyone's network but my own. If the lives of other people trying to peer into my network or run applications that affect systems beyond my edge are made miserable...I'm strangely okay with that.

My network doesn’t belong to the internet. It belongs to me.

@garetht t

At the time, both NOD32 and Microsoft Security Essentials

@Ben Jackson

Worth looking at. Thanks!

@Mike Bird 1

The author likes to get paid. Jumping up and down on the egos of those who sign the cheques is not an efficient way to do so. You can get away with it once and a while...

...but you pick those battles carefully.

@Nick Ryan

Thanks! WIll look into it...

@Robert Carnagie

No desktops. VDI. That measn you can just disconnect from your session. THAT MAKES IT FUNNER.

*sob*

@FIllipo

The e-mail checking did not occur on the brittle Win2K box. It occurred on the user's virtual machine. (The one he is assigned to use.) That VM happens to be on a subnet capable of reaching the brittle equipment, and then all things went *poof*.

The real hell of it is that I can’t take “Local admin” away from the guy because he’s a manger. So if you have local admin on your VM, decide to open an attachment that you shouldn’t….there’s really **** all I can do about it. That system will get pwned in about 0.2 seconds flat. And it ain’t just windows this happens on. (Seriously, I am getting SO BLOODY SICK of cleaning up after Macs that keep getting pwned by these damned “download this file and execute it” Safari exploits.

So yeah, PHB opens mail, pwns his local system…that reaches out to our network and pwns anything not fully patched. As my article points out: “mea culpa.” That box should have been on it’s own subnet, one that regular desktops or personal VMs can’t route to.

@AJ Stiles

Your solution, while very passionate and open-sourceily noble would leave us without any of the equipment that actually makes our company money. When there isn't an open source version available, you buy what you can.

IT exists to server the business, the business does not exist to server IT's ideology. This equipment is what it is, and it is what pays for the wages of everyone I work with. It is my job to make sure it runs, regardless of ideology.

I am pretty certain this is true everywhere else in the entire world, with the possible exception of certain areas of California.

@jlocke

I couldn't agree more! In larger enterprises this is an honestly top-notch approach. Sadly, in smaller companies every staff member is "an exception." Everyone is wearing two or three hats. Just setting up the windows security permissions is a nightmare; it's probably as complex (or more) for an SME of 150 people than it is for a corporation of 1000.

When your staff wear so many hats that most of them can't even be reasonably given an actual job title...network security via compartmentalisation becomes a pipe dream.

I can isolate some of the back-end equipment, but isolating desktops, file servers and similar equipment just ain't gonna happen.

Still, wherever you can compartmentalise...do so!

@AC

Wait for the next article on the IDS stuff...

As to "bridge mode firewall between the office LAN and the equipment," I would like to be enlightened as to why you feel this will provide more security than a separate subnet + VLAN on the switch. (Especially if the equipment will be getting its own firewall.)

What real protection does your approach provide that mine doesn’t?

@AC 12:52

Yar. In this case something on the order of 15-20 years...

@Obvious to me...

Never heard of it, but based on your recommendation I will take the time to check it out. :D

Honest and true; when you filter the noise out of the signal, the real value of El Reg is in it's readers. <3 commenttards.

@AC

Nope; they never turn thier machines off. We live in a VDI environment, and they *all* have external RDP access. Look for my upcoming articles on VDI; one of the major pains in the neck is that your users can simply "disconnect" instead of rebooting. (Though this can be solved with GPOs...)

Anyways, I don't want to give too much away, because then I'll be out of material for the VDI article set!

@AC 11:22

"You can do quite a lot to isolate things beyond subnetting. Modern switch hardware has all sorts of separation and even packet blocking features."

Yes it does. In fact, even my old-ass semi-managed switches offer VLANing. There are many features that high-end switches (such as Cisco or Procurve) offer that could solve this problem. It's just COMPLETE OVERKILL for this situation.

Subnetting will put my system “out of reach” for any system under my control, because the OS will honour the subnet and refuse to allow randoms to connect. It will also prevent anyone plugging into my network from simply getting a DHCP address and finding the system. Virus and attackers can configure the network card to NOT respect subnets, and so the subnet really should be combined with a VLAN.

Being sensible, I will subnet the system *and* VLAN it. Anything beyond that is both totally unnecessary...and not possible with my current switching gear. While I could easily toss together a bit-flinging box to be a router and do more than vlans, I just don’t see what it gets me that simple subnetting and a VLAN don’t.

My switching gear is okay for an SME; but cisco it is not. Replacing my network infrastructure with Cisco would eat my IT budget for the next two solid years, and I frankly fail to see any benefit. Cisco, (or their trained minions) have yet to show me a single thing that would actually care about doing on my network that their gear can do better than a well configured Linux or BSD box. And for the cost of one of their routers, I could build a multi-system RAIS* 5 (with hot spare) Linux or BSD routing cluster. Since I only have to route gigabit, a bloody Atom can fling all the bits I need.

*RAIS: Redundant array of inexpensive systems. Fancy clusters on steroids.

@yehasher

This system exists to receive files from a master command and control system. It then takes those files and Does Stuff (tm). Without the ability to use the files it is getting over the network it is a quarter million dollar paperweight.

@AC 12:14

That's certainly a new approach. The only thing I can say about that is...

...neat!

@cornz 1

Yes, it is one of a number of excellent tools that can help mitigate these sorts of problems. Like all such tools, it isn't comprehensive enough to solve the problem entirely, but it does most certainly do nothing but good.

There are several similar applications offered by various vendors; some I have had opportunity to use, others I haven’t. I would love the opportunity to test all the big ones side by side, but sadly, this isn’t on my project list for at least the next six months.

I personally think these programs have come a long way since the last time I really looked at them in depth, (2007.) Not getting the chance to dive back into things like this more than once every five years makes me a sad panda.

@AC

Did I say I had autorun enabled on my network? There is a difference between articles like the one previous to this; a confession based entirely on my own network config, and trying to pass along some best practice information. It is "obvious" to any practiced systems administrator, but it bears repeating for the newbies. Remember; some of El Reg's readers are a little wet behind the ears, and it is largely them I am trying to target. The more experienced folks read white papers and practice guides and have decades of strong opinions anyways.

As to users "needing" administrative privs...the debate has been had.

http://forums.theregister.co.uk/forum/1/2010/05/28/malware_user_training/