Advertisement
Help Keep Boards Alive. Support us by going ad free today. See here: https://subscriptions.boards.ie/.
https://www.boards.ie/group/1878-subscribers-forum

Private Group for paid up members of Boards.ie. Join the club.
Hi all, please see this major site announcement: https://www.boards.ie/discussion/2058427594/boards-ie-2026

www.eolas.ie, www.droghedacu.ie, www.portlaoisecu.ie DEFACED script kiddies !

2»

Comments

  • Registered Users, Registered Users 2 Posts: 10,501 ✭✭✭✭ecksor


    I'd rather you created a new thread if you're going to veer off like that.

    Whether you think that bedlam's mirror site is a "reward" or not, saying it makes him as bad as a script kiddie is just taking the ****.


  • Registered Users, Registered Users 2 Posts: 21,264 ✭✭✭✭Hobbes


    I notice boards.ie was down last night due to a contaiminated DNS. I guess we must of upset a script kiddie somewhere. smile.gif


  • Registered Users, Registered Users 2 Posts: 10,501 ✭✭✭✭ecksor


    Apache is still beta, as you say, which would discourage lots of people from putting it in a production environment. Still, if ASP support was up the IISs level then it could take a lot of the market share perhaps. (I don't see that happening any time soon).


  • Registered Users, Registered Users 2 Posts: 21,264 ✭✭✭✭Hobbes


    They use Apache in WebSphere. I'd say that's production environment software. smile.gif



  • Closed Accounts Posts: 1,141 ✭✭✭fisty


    well in my opinion it gives the sad defacers something to work towards "i got on bedlams site"
    if nobody gave a $hite about the defacements and didnt mirror them maybe there wouldnt be so many.
    And I also have the feeling that the law is going to cop this trend of defacements quite quickly (especially with lotto.ie done in)
    even a fool could put together where to find the culprits with the amount of names / connections floating around. I'm kinda happy I couldn't hack my way out of a paper bag.


  • Advertisement
  • Registered Users, Registered Users 2 Posts: 10,501 ✭✭✭✭ecksor


    This debate about apache/beta on Win32 has been done recently ...

    http://www.securityfocus.com/templates/archive.p ike?threads=0&mid=175894&end=2001-04-12&fromthread=0&list=82&start=2001-04-06&

    [This message has been edited by X_OR (edited 23-05-2001).]


  • Banned (with Prison Access) Posts: 16,659 ✭✭✭✭dahamsta


    I agree with you that that's how a lot of business think, but I honestly don't think they're right. I've built a reasonably successful business around Red Hat and other open source products. I've only ever had to pay for one single piece of software running on my servers - vBulletin, ironically - and I've always been able to solve my problems on web forums or using Google. The savings in licencing outlay far outweigh the cost of training myself.

    I can see why some companies choose to use Microsoft software, if not on the server then certainly on the client. Linux is immature on the desktop, and the GUI is often messy and harder to work with, particularly after running in Windows for a while. But it's maturing rapidly, and with the release of Red Hat 7.1 and Mandrake 8.0, I think it's well on the road to becoming a serious competitor. I also think that Microsoft's greedy reorganisation of licencing is going to have a detrimental affect, since it's invariably the bean counters that make the decisions about software, and intelligent bean counters may just see though Microsoft's little ploy.

    On a related note, again ironically, this morning I was forced to solve a problem with visitors to a client's site not being able to POST a form via SSL. The problem lay with flawed handling of keepalives in the SSL protocol in a certain browser, and I found the solution in five minutes with a little work on Google.

    The irony lies in the browser responsible for the problem. Can you guess which one it was?

    adam


  • Closed Accounts Posts: 557 ✭✭✭Snaggle


    <font face="Verdana, Arial" size="2">Originally posted by dahamsta:
    Do _that_ with IIS! The Apache Foundation produces the most popular and most secure webserver available today, and if you don't believe that, you can do something about it, instead of waiting for Microsoft to do it for you.
    </font>

    I don't believe that Apache is the most secure webserver today, simply because it's not. There are more webservers than just IIS and Apache


  • Closed Accounts Posts: 557 ✭✭✭Snaggle


    <font face="Verdana, Arial" size="2">Originally posted by tom-thebox:
    www.eolas.ie, www.droghedacu.ie, www.portlaoisecu.ie

    A lot more Irish domains are under attack some lamer is posting me the address and shouting out to me with them I dont know ho my guess is its jerry.
    </font>

    I suspect it's you sending yourself shouts


  • Banned (with Prison Access) Posts: 16,659 ✭✭✭✭dahamsta


    Well, from the business point of view, we have to take it up one rung on the ladder, to WINNT. Using WINNT on a server is simply a waste of money and time. Linux is free, much more stable, and supported far better in the community than WINNT is by the developers. And since we're on the security boards, it's far less likely to be cracked, even with Ramen, Lion and the like.


  • Advertisement
  • Registered Users, Registered Users 2 Posts: 10,501 ✭✭✭✭ecksor


    This is not how I have seen a lot of businesses think.

    Microsoft offer a more attractive development platform for the typical sort of site that ASP/IIS/SQL Server are used for.

    [This message has been edited by X_OR (edited 24-05-2001).]


  • Registered Users, Registered Users 2 Posts: 332 ✭✭spod


    <font face="Verdana, Arial" size="2">Originally posted by Evil Phil:
    Somebody apparently has 'issues' with Irish Credit Unions. Perhaps they couldn't get a loan without their parents permission?</font>

    Probably more to do with a recent post on something like BUGTRAQ pointing out that a certain prominent provider of online Credit Union Sites had to ship a specifically customised version of NT which couldn't have certain Service Packs available to it..

    That or just more iis stuff.

    The annoying thing is, given two or three days to set up a iis box i'd probably make it tighter then the average "hardened" redhat box which had /etc/inetd.conf stripped.

    http://www.oreilly.com/catalog/securwinserv/

    Securing Windows NT/2000 Servers for the Internet
    A Checklist for System Administrators

    is a *must* read.



  • Registered Users, Registered Users 2 Posts: 332 ✭✭spod


    <font face="Verdana, Arial" size="2">Originally posted by dahamsta:
    I agree with you that that's how a lot of business think, but I honestly don't think they're right. I've built a reasonably successful business around Red Hat and other open source products. I've only ever had to pay for one single piece of software running on my servers - vBulletin, ironically - and I've always been able to solve my problems on web forums or using Google. The savings in licencing outlay far outweigh the cost of training myself.
    </font>

    Unfortunately non hobbyist admins/developers who work a 40hr week and aren't too passionate about the work are hard to find. It's the kind of dilbert evil hr thing.

    Companies can get Server Insurance for IIS servers. Companies can get MCSEs with Internet+ streams. Companies can *easily* get vb programmers and send them on a course to re-train as "Internet" developers with ASP/IIS/Interdev.

    The *cost* isn't an issue to most big companies.

    What's more important is the ability to *easily* get adequately trained people who will do the job adequately and go home, not hard to manage awkward techies.

    That's why solaris is still a popular unix solution, and given improvements with solaris 8 and coupled with quality hardware it's going to stay a big player.

    <font face="Verdana, Arial" size="2">
    I can see why some companies choose to use Microsoft software, if not on the server then certainly on the client. Linux is immature on the desktop, and the GUI is often messy and harder to work with, particularly after running in Windows for a while. But it's maturing rapidly, and with the release of Red Hat 7.1 and Mandrake 8.0, I think it's well on the road to becoming a serious competitor. I also think that Microsoft's greedy reorganisation of licencing is going to have a detrimental affect, since it's invariably the bean counters that make the decisions about software, and intelligent bean counters may just see though Microsoft's little ploy.
    </font>

    Why use an immature free product with awkward employees who insist on working flexible hours when they can get insurance and trained employees for the MS solution?

    As a former webdeveloper, given a choice, I'd go for a well set up asp environment anyday. PHP is far too messy. JSP is a bit too complex unless your talking N-Tier stuff and you can set up a decent ejb server.

    If you can hire a decent security firm to put in place good secure coding guidelines, to set up, build, and maintain your iis servers, and to put a sparc/solaris firewall/ids solution together for a couple of hundred grand a year, coupled with 24/7 monitoring, quarterly audits and if you want, occasional penetration tests by responsible tiger teams why try and save some money by using linux?

    <font face="Verdana, Arial" size="2">
    On a related note, again ironically, this morning I was forced to solve a problem with visitors to a client's site not being able to POST a form via SSL. The problem lay with flawed handling of keepalives in the SSL protocol in a certain browser, and I found the solution in five minutes with a little work on Google.
    </font>

    What if you don't want your employees wasting time on the net?
    What if the msdn cds and monthly updates are a much better solution for you?
    <font face="Verdana, Arial" size="2">
    The irony lies in the browser responsible for the problem. Can you guess which one it was?
    </font>

    Probably mozilla :P


    Ok, seriously, I'm trying to play devils advocate here.

    Cost doesn't matter as much as mangeability and accountibility and insurance and audits and stuff to any company with more then a handful of employees.

    They can't *afford* to let the company be too dependant on some sort of in house system cobbled together by an awkward tech who decides to leave the company after 5 years to set up a surf shop in clare wink.gif

    That's why documentation, another great *evil* bane of techies lifes is so important.

    It really is like dilbert out there.

    Free as in beer isn't important. Free as in we can snarf this, and slip it into our product with just a little credit saying portions of our code are dependant on work of the jpeg group or bsd is important.

    Free as in GPL is a pain in the ass wink.gif

    spod

    [This message has been edited by spod (edited 28-05-2001).]


  • Registered Users, Registered Users 2 Posts: 10,501 ✭✭✭✭ecksor


    <font face="Verdana, Arial" size="2">Originally posted by spod:
    The *cost* isn't an issue to most big companies.</font>

    The cost of the software you mean. Choosing a free OS may end up costing more to a company in terms of how much they pay for the skills, or difficulty with using it.
    <font face="Verdana, Arial" size="2">That's why solaris is still a popular unix solution, and given improvements with solaris 8 and coupled with quality hardware it's going to stay a big player.</font>

    Plus the fact that it's rock solid, and a lot better at a lot of things than the free alternatives. It certainly kicks Linux's ass into next week.

    Anyway, this thread is closed.


This discussion has been closed.
Advertisement
Advertisement