Submission + - Sourceforge Hijacks the Nmap Sourceforge Account (seclists.org) 2
According to him the old Nmap project page (located at http://sourceforge.net/projects/nmap/, screenshot) was changed to a blank page and its contents were moved to a new page (http://sourceforge.net/projects/nmap.mirror/, screenshot) which controlled by sf-editor1 and sf-editor3, in pattern mirroring the much discussed the takeover of GIMP-Win page discussed last week on Ars Technica, IT World and eventually this week Slashdot.
That happens after Sourceforge promises to stop "presenting third party offers for unmaintained SourceForge projects. At this time, we present third party offers only with a few projects where it is explicitly approved by the project developer, or if the project is already bundling third party offers."
To their credit Fyodor states that "So far they seem to be providing just the official Nmap files (as long as you don't click on the fake download buttons) and we haven't caught them trojaning Nmap the way they did with GIMP" but reiterates "that you should only download Nmap from our official SSL Nmap site: https://nmap.org/download.html"
Comment If you want to know which side Google is on ... (Score 1) 335
Did the Spamhaus DDoS Really Slow Down Global Internet Access? 70
Google Releases Street View Images From Fukushima Ghost Town 63
Ship Anchor, Not Sabotaging Divers, Possibly Responsible For Outage 43
Comment Tried it last night ... (Score 1) 149
Comment Re:Roll your own. (Score 1) 141
He's got a point that many implementations make it hard to navigate the tree,
I don't even grant him that point. Hard compared to what? A flat list of posts that one should try to reconstruct the (naturally tree-shaped) discussion structure from? That's like saying we should be using square wheels because some round wheels make it hard to steer the car.
Comment Re:Roll your own. (Score 2) 141
Is it because the developers are too lazy to add a minimal amount of recursion in their engine or . . . what?!
In this particular case it is because Jeff Atwood hates threading. I think it's a huge mistake and he never manages to argue this choice in a compelling way, but I guess it's an emotional thing after all.
Comment To get a better impression of the people behind it (Score 1) 279
Comment Re:wrong on all accounts (Score 2) 279
Monitoring their blacklist for your IPs is not "hard"
Neither is distinguishing between "having open relays", "sending perfectly legitimte e-mail to addresses that have a new (domain) owner" and "sending spam", but they don't do it - you will always be slandered (called "spammer") and your business will be disrupted by their blacklisting, even if no spam e-mail was ever sent by your hosts. Last time I checked, they will even blacklist you for having a vacation responder at the address they send their probes to and on one occurrence they kept blacklisting us with the following reason (i.e. their probes that prolonged the blacklisting were these lines):
postfix/smtp[....]: XXXX: to=, relay=XXXX:25, delay=[...] status=bounced (host XXX said: 571 Your IP is BLACKLISTED at UCEPROTECT-LEVEL 1 - See: http://www.uceprotect.net/rblcheck.php?ipr=XXX (in reply to RCPT TO command))
So basically they extended the blacklisting because we were blacklisted, at least that was the reason in the logs (which we were supposed to use to find a problem on our side).
In fact the problem was that we had a registered user many years ago with a domain that had changed owner in the mean time and was used as a spam honeypot now - how do we "debug" that, let alone prevent it? And why do we need to "punished" with a blacklisting when we obviously did nothing wrong (or should we demand of our users to tell us when their e-mail provider sells a domain or goes belly-up?).
What is usually ignored by people in this thread is the simple fact that no spam e-mail is required to get you blacklisted, they don't seem to classify e-mail at all, that needs to be understood.
Comment wrong on all accounts (Score 2) 279
* you do not have to have spam originating from your system, it can be perfectly normal e-mail to an address used by someone you knew in the past, that is now used by someone else as a spam honeypot.
UCEprotect sucks. It's no wonder the people behind it are hiding their identities.
Comment Re:Stop sending spam then. (Score 5, Informative) 279
If you don't want to be blacklisted, then stop sending spam. Simple.
You're an ignorant fool. Unfortunately, too many sysadmins are just as ignorant, so they trust these badly-run, possibly with malicious intent, services. We've never sent 1 spam e-mail in 12 years doing business online and have been blacklisted several times by UCEprotect due to them recycling old domains (which were used by users to register on our site) for use as spam honeypots. They wasted countless hours of our time for nothing.
Comment We've had this too ... (Score 1) 279
Comment Re:comment (Score 1) 259
A commercial (or open source) forum suite has had way more eyes looking at it than your home-brewed solution.
That's both good (theoretically better code) and bad (large-scale attacks when some exploit is out in the wild). In practice, a decent programmer can write a safe, simple forum for themselves easily, while they will get hit regularly by exploits in phpBB etc. if they just trust such solutions instead.