Security

It seems that there is some keywords in the central cleaning house and I can’t update the blacklist… Maybe we should create a new one!

I have finally got skeljail implemented through the RCng way. After some test I will post the patch for review.

A skel jail is a jail that share essential binaries/libraries with the base system (optionally, other base template if you want) through mount_nullfs.

I’d say I really dislike this feature, it always prevent me from being able to receive attachments and does not actually block virii since I have some carefully designed security mechanisms installed on my computer.

Of course someone may say “Outlook sucks, don’t use it!” but I won’t say that. Outlook is a great product that is very safe if you have configured it *CORRECTLY*. The feature of the attachment blocking, while may be useful for not experienced users, will harm users that is experienced and is highly security-aware when communicating with non-experienced folks.

于是他们又来了。

如果你正在用Linux kernel 2.2.x，2.4.x(从开始到2.4.29-pre3)，2.6.x(从开始到2.6.10)，那么你就有事干了。通过合理地注入代码，任何人都可以拿到root，因为kmem_cache_alloc()的执行过程被打断，则VMA的红黑树可能会在不希望的地方插入一个节点，并进而通过LDT调用门获取CPL0特权。

昨天下午接到通知说这台机器不能往外主动建连接了，本来想说道两句，但后来觉得其实有几个能连出去的端口就足够了，终于等到这一天啦，更何况我觉得那个服务没给我带来任何好处，没有也就没有了，还什么XML RPC，搞笑，traceback是什么呀？申请了没有？

其实不能连出去挺好的，再也不用担心像从前公司的服务器突然被告知「连接了某某网站，根据某某部门的要求，现停闭你公司服务器，特此通知」的事情了。

This should be considered as a “security release” somewhat. I’m building package for it at company’s buildbox, and it would be deployed internally.

And seems that they have re-implemented it… Why netcat… I can’t understand it…

实在是不得已而为之，spammer越来越过分了。comment插件一口气删掉了将近300条垃圾comment。

Kill spam!!

感觉现在反垃圾技术发展到了一个坎上，短期内恐怕不会什么大的技术突破。基本的技术就是黑白名单、内容分析、特征分析。垃圾邮件发送的技术最近也没什么大的进展，目前我能够做到的漏判大约是万分之七，误判万分之五左右，前一阵考虑的技术还没有时间去做……

It seems that the official FreeBSD qmail port’s disable-qmail (as well as the Live with Qmail documentation) will need write access to /usr/bin and /usr/libexec, and hence the “fast jail” script I have written has been rendered useless :-(

I will investigate the issue this weekend and hopefully I will be able to work around the issue.