7,697 reputation
12253
bio website tltech.com
location United States
age 36
visits member for 5 years, 6 months
seen 7 hours ago

{{Hacker}}

I own a small, successful security consulting business. But by day I work for a really big company, doing really big things.

Nothing I write here represents the views of my employer, nor does it reflect any proprietary or confidental knowledge. In fact, practically all of it was written before I even started working there, so don't get too excited.


Jun
3
comment What to use instead of FTP
@MichaelHampton It violates the principle of least privilege and dramatically increases your attack surface and risk of escalation. Allowing flash videos to be embedded in PDF documents is theoretically safe, but it's crazy-dangerous in the real world.
Jun
3
comment What to use instead of FTP
@Stephane By "set up" I'm referring to server-side set up, not client-side. I'm intimately familiar with the protocols, having myself written implementations for many of them including WebDAV and FTP. The core of the question isn't "what should I use on my server", it's "what should I encourage beginner admins to use on their servers." SFTP very critically relies on shell access; the only way around it is to create a modified restricted shell (e.g. rssh) which pretends to be a shell but only allows you to run SFTP-related commands. This is non-trivial to set up on Windows.
Jun
3
comment What to use instead of FTP
@Stephane SFTP is perfectly reasonable if it can be done without granting shell access (which typically isn't the case). DAV is perfectly reasonable if it can be simple for a novice to set up and secure (which typically isn't the case).
May
23
comment How to forbid non-UTF-8 filenames?
@lvella OK, you do that.
May
14
comment Extending a PaGP EtherChannel run beyond the maximum ethernet length
Maximum run length for ethernet is not a matter of signal strength, it's packet transit time. If you exceed your maximum length, then a small packet can be 100% "in flight" on the wire, and the CSMA/CD algorithm in Ethernet is built on the assumption that this will never happen. Packet-collision chaos ensues.
Mar
1
comment What conditions trigger a table level lock
That's in interesting possibility. I don't have the captured events to tell for certain, but I see how that could be possible.
Feb
14
comment How to speed up file transfer from server to server over the Internet?
SCP works with any user account, not just root.
Jan
7
comment MySQL replication re-sync
It's a little absurd that people are voting this question as off-topic. For heaven's sake, we're talking about configuring MySQL replication; could anything be more on-topic than that?
Jan
7
comment MySQL replication re-sync
@syneticon-dj typically the the periodic snapshots happen anyway for backup purposes; the replication would be for to try to fill the gap between snapshots
Jan
6
comment MySQL replication re-sync
@MichaelHampton - No idea. Typically this type of client insists on doing the monitoring himself for cost reasons, but may not have the expertise to know what to do about it. It's crappy, but there you go. We do what we can for this type of person and give them all the appropriate warnings about "properly maintained by a qualified professional" and all that. But welcome of the world of shoestring budgets and unlimited optimism.
Jan
5
comment MySQL replication re-sync
See, that's why I said "zero-maintenance, hands-off". I have no idea why replication might break, nor will I be in a position to know. Troubleshooting the replication failures is not an option in this type of case, largely because usage of the server is out of my hands. In fact, the replication may never fail. I won't know because I won't be monitoring the slave except perhaps on a once-every-few-months checkup. This has to be a set-it-and-forget-it solution with zero interactivity.
Nov
15
comment How to prevent file owner from changing/deleting their own file? Linux CentOS
The way that it's possible is to have whatever mechanism you used to upload the files ALSO run chattr. That's different from automatic
Nov
15
comment How to prevent file owner from changing/deleting their own file? Linux CentOS
but so far they don't seem to address how to have this work automatically for newly-created files -- Can't happen. Sorry to disappoint.
Nov
15
comment Linux software RAID - partition first?
@syneticon-dj if you have an answer, why not put it as a stand-alone answer instead of as a comment to someone else's answer?
Nov
13
comment trap “” HUP v.s Nohup ? How can I run a portion of shell script in nohub mode?
I don't see the value of trap '' EXIT, since EXIT isn't a real signal; it's just synthesized by bash at script end. So you're just telling bash to do nothing additional when the script ends. That doesn't sound useful.
Nov
10
comment All servers flooded by salt water, is it possible to recover data from multi-platter drives?
FWIW, the amount of water infiltrated into the drive should be minimal if any. Drives are entirely sealed except for a single small airhole, which means that it's unlikely that more then a few cc would have entered if any at all. But the controller almost certainly needs to be repaired/replaced, and the internals of the drive should be cleaned before you attempt to spin it up.
Oct
29
comment Configure .htaccess to block bot indexing but allow browser directory listing/viewing
Why are you not using robots.txt?
Oct
21
comment Seeing traffic destined for other people's servers in wireshark
@TomTom Oh? really? You're just dead certain of that are you? From Cisco: "If the switch receives a packet with a destination MAC address that does not exist in the bridge table, the switch sends that packet over all its interfaces that belong to the same VLAN assigned to the interface where the packet came in from." But what does Cisco really know about switches, anyway. Right?
Oct
20
comment Seeing traffic destined for other people's servers in wireshark
@TomTom Switches don't learn IPs, they learn MACs. This is why you can use a switch with non-IP network protocols. Layer 3 switches can do IP inspection, but they're really by definition routers instead of switches specifically for that reason. Switches can use ARP returns to learn MACs, but really any traffic will do, ARP included. This is why a switch plugged into an active network will immediately become functional without requiring all the hosts to re-discover their neighbors. Here's a text on the subject if you want to fact-check my work.
Oct
8
comment String search and replace across an entire database
@MDMarra np -- i figured it was a given. I don't think anyone would head down this type of path if they had any other choice.