On 2013-09-26 17:49, Paul_Koning at Dell.com wrote:
On Sep 26, 2013, at 9:46 AM, Johnny Billquist <bqt at softjar.se> wrote:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
In what way? Just like most of the Internet, it sends cleartext. Of course in HECnet we can easily use IPSec (well, for some suitable definition of "easily" because crypto usually requires some effort to configure). But apart from that, the security assumptions in DECnet are basically the same as those in TCP/IP. If anything, they might be slightly stronger: there is a semi-standard way of handling access control in the Session layer rather than having it done differently (if at all) by each application. There is event logging that can be used to capture some security-relevant events.
Already commented some further on this. And you are right.
Johnny
On Sep 26, 2013, at 9:46 AM, Johnny Billquist <bqt at softjar.se> wrote:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
In what way? Just like most of the Internet, it sends cleartext. Of course in HECnet we can easily use IPSec (well, for some suitable definition of "easily" because crypto usually requires some effort to configure). But apart from that, the security assumptions in DECnet are basically the same as those in TCP/IP. If anything, they might be slightly stronger: there is a semi-standard way of handling access control in the Session layer rather than having it done differently (if at all) by each application. There is event logging that can be used to capture some security-relevant events.
paul
On 09/26/2013 09:46 AM, Johnny Billquist wrote:
Like I said before. I certainly don't mind if EISNER were to be
connected to HECnet, but I really can't say that it would actually
benefit HECnet (or EISNER) much in the general sense. Most people on
EISNER would probably not care at all about the fact that there was
DECnet connectivity to a bunch of other machines which they know nothing
about, and would do even less with.
And most of the time, the people on HECnet wouldn't really be all over
EISNER either.
I would think that, as a bunch of DECheads, many in the EISNER crowd
would very much enjoy exposure to some other DEC OSs that they likely
haven't seen in decades.
-Dave
--
Dave McGuire, AK4HZ
New Kensington, PA
On 2013-09-26 16:44, Julian Wolfe wrote:
Hey, does anyone have a copy of the NOTES client for RSTS/E? I have seen this mentioned in some articles on usenet, possibly in the DEC micro notes as well. I would like to get it going on my machine if at all possible. I am of unsure if this came with an early copy of VMS or something, but there is no reference to a server, so I assume so.
I have never even heard of a RSTS/E NOTES client. If one exists, that would be cool.
Johnny
On 2013-09-26 16:24, Brian Schenkenberger, VAXman- wrote:
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 16:14, Brian Schenkenberger, VAXman- wrote:
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be
connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
It's not any worse than TCP/IP.
You might right about that. The issue is possibly more about the
applications that runs on top of it. It's at the same level as telnet
and ftp, which are pretty much frowned upon nowadays. (I like those
protocols, but I can see the issues with passwords in clear text, for
example.)
But I wonder about a bunch of things like the equivalent of SYN attacks
in DECnet for example... But actually, that is not so much about the
protocols as the implementations.
Well, if you really want to secure your computers, you need to remove the
cabling that networks them with the electric power company! :)
Right. Somewhere, I think that was my point. :-)
Johnny
Hey, does anyone have a copy of the NOTES client for RSTS/E? I have seen this mentioned in some articles on usenet, possibly in the DEC micro notes as well. I would like to get it going on my machine if at all possible. I am of unsure if this came with an early copy of VMS or something, but there is no reference to a server, so I assume so.
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 16:14, Brian Schenkenberger, VAXman- wrote:
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be
connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
It's not any worse than TCP/IP.
You might right about that. The issue is possibly more about the
applications that runs on top of it. It's at the same level as telnet
and ftp, which are pretty much frowned upon nowadays. (I like those
protocols, but I can see the issues with passwords in clear text, for
example.)
But I wonder about a bunch of things like the equivalent of SYN attacks
in DECnet for example... But actually, that is not so much about the
protocols as the implementations.
Well, if you really want to secure your computers, you need to remove the
cabling that networks them with the electric power company! :)
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
On Thu, Sep 26, 2013 at 03:48:45PM +0200, Sampsa Laine wrote:
The problem is that if you want to be paranoid, then you should not be connected to HECnet at all.
I'm not THAT paranoid, I actually do give out accounts on CHIMPY (after vetting) and HILANT, but the Deathrow Cluster guys included some pretty dubious "security researchers" that I'd rather keep off my LAN.
Think of the Deathrow guys as the NSA. If they want access to your LAN,
they already have it. :)
I don't really care about the DECNET side of it, more the fact that they'd be inside my IP firewall - and putting my DECNET stuff in a separate VLAN is just way too much hassle.
I have things on a separate VLAN but currently it's not firewalled. I
should probably set that up.
Of course if I had actual machines running it would be worth doing. :)
-brian
On 2013-09-26 16:14, Brian Schenkenberger, VAXman- wrote:
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be
connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
It's not any worse than TCP/IP.
You might right about that. The issue is possibly more about the applications that runs on top of it. It's at the same level as telnet and ftp, which are pretty much frowned upon nowadays. (I like those protocols, but I can see the issues with passwords in clear text, for example.)
But I wonder about a bunch of things like the equivalent of SYN attacks in DECnet for example... But actually, that is not so much about the protocols as the implementations.
Johnny
Johnny Billquist <bqt at softjar.se> writes:
On 2013-09-26 14:16, Sampsa Laine wrote:
While I did have an account on Deathrow, I was not all that familiar with
the users thereof.
The encourage security research, it attracts a certain type of person that I don't want on my LAN (trust me, I used to be a penetration tester :) )
The problem is that if you want to be paranoid, then you should not be
connected to HECnet at all.
DECnet is a very bad protocol when it comes to network security.
It's not any worse than TCP/IP.
--
VAXman- A Bored Certified VMS Kernel Mode Hacker VAXman(at)TMESIS(dot)ORG
Well I speak to machines with the voice of humanity.
