Because the servers have not committed any network address assignments on
the basis of a DHCPOFFER, servers are free to reuse offered
network addresses in response to subsequent requests. As an
implementation detail, servers SHOULD NOT reuse offered addresses
and may use an implementation-specific timeout mechanism to decide
when to reuse an offered address.
I'm curious if common DHCP servers like dnsmasq actually do reuse IPs from pending OFFERs, and what timeout they have, if any, before reuse. I poked around dnsmasq config but I did see any specific tuning for that.
Way back in the 90's my CRT monitor went out. Money was tight so I had to wait a couple of weeks before I could replace it. I went to a local computer repair shop (as in, actual repair, like replacing blown capacitors on mainboards and such) to see what I could get for cheap, as a stopgap. The guy had an old monochrome CRT he had repaired--the kind with green pixels--probably 6-7 years old at the time. He sold it to me for like 8 bucks. I figured I could at least use bitchx and links on it until I could get a new monitor. After a few hours in front of it, I started feeling really itchy, and the screen had enough static charge to raise the hairs on my forearm if I moved near it. Pretty sure it was shooting cancer directly into my face. Good times!
You put together a really awesome project! Kudos on that and for sharing it first and foremost!! I speak regex pretty fluently, and I may very well have reached for sed/perl -ne there as well, depending on mood. I guess it just struck me as odd to use a parser for XML but not JSON. Anyhow, off on a tangent, I recently learned about a program called xgrep that lets you pull elements out of XML using xpath or pcre (althought pcre support was kind of spotty for me)--it's neat for one-offs like this and pipeline building while playing with rest apis and such!
I get the impression that most violent terrorist groups are rather low-tech and are not using _any_ server hardware. If you're aware of terrorists routinely operating DCs or co-locating servers, feel free to correct my understanding.
INAL (but I play on one daytime TV): Their whole claim aginst TOR amounts to:
pp. 2-3
"According to its website, TOR "was originally designed, implemented, and deployed as a third-generation onion routing project of the U.S. Naval Research Laboratory. It was originally developed with the U.S. Navy in mind, for the primary purpose of protecting government communications." The TOR website further states that their products and services are used by individuals "to keep websites from tracking them and their family members, or to connect to news sites, instant messaging services, or the like when these are blocked by their local Internet providers." TOR also provides services that permit users, such as Pinkmeth, to "publish web sites and other services without needing to reveal the location of the site." [...] It is clear from the TOR website that TOR is knowingly assisting websites such as Pinhneth in committing torts against Texas resident..."
p. 5
"However, unscrupulous Internet service companies such as TOR offer "private" or "anonymous" domain name hosting services that allow criminals such as Pinkmeth and its users to escape accountability for their actions. TOR even advertises that with their service "nobody would be able to determine who was offering the site, and nobody who offered the site would know who was posting to it." [...] many unscrupulous companies offer services that allow illegal websites such as Pinkmeth to remain anonymous and difficult for authorities to shut down. Indeed Pinkmeth's Twitter feed advertises its website as being a website "where your state laws don't apply.""
pp. 8-9
"The specific object to be accomplished by the conspiracy was the publication pornographic images of Plaintiff (and other women) on the Pinkmeth website in such a mannner so as to prevent its operators and users from being held civilly and criminally accountable for this unlawful behavior."
This seems to be conflating a few things. The fact that "revenge porn" sites exist outside of anonymous content distribution networks like TOR shows that anonymity wasn't a required component in the tort allegedely commited by Pinkmeth. There are many cases involving sites like that being taken down from public hosting providers. The fact that TOR could allegedly allow defendant to escape prosecution does not equate to a real conspiracy to assist defendant in escaping prosecution. A person hosting a costume party isn't automatically responsible for a murderer taking advantage of the anonymity to commit a crime, without some evidence of collusion.
Brute force is infeasible if you get random heap data along with key fragments. Based on the way the exploit works[0], my amateur guess would be they sent small payloads and actually did get SSLv3 records, because they found the right heap allocation strategy for a specific build on a specific platform.
What if it was a donation to Americans United or Planned Parenthood? There are people who earnestly believe that AU hates religions and-or religious people, or that PP hates traditional family structure. What if he donated to a group that was against the Affordable Heathcare Act? What if he donated to a group that was for it? There are many reasons why people may support different causes or groups, and a contribution in and of itself doesn't do anything to show that it is motivated by hate or fear. You need to look at the person's other actions in order to better determine that.
> an opinion people shouldn't be held to account for...
I believe people should be held publicly accountable for their actions, not their thoughts/opinions, no matter how strongly I may disagree with their ideas. I wouldn't be too worried about a CEO of Mozilla who had at some point contributed $1000 to a group trying to stop interracial- (or gay-, or plural-, or cats-and-dogs-) marriage by itself, if it were the person's own money. There are benign reasons a person may support such views, however misguided they may be, without being motivated by hate. So nothing in that contribution alone to makes me suspect the person would behave unfairly in the workplace towards the group of people supporting such marriage or trying to be married. To bring it back from the thought experiment to the current situation, I'm pretty sure a lot of people worked with Brendan at Mozilla, and I haven't heard of anyone coming forward with complaints of homophobia against him after working with/for him... so yeah.
Should you judged by the views and actions of others who self-identify as "hackers"? If the label includes people with a wide range of fundamentally incompatible views, it's not very useful to use as a yard stick. It looks a lot like guilt by association.
Agreed. I wasn't defending DO's professionalism there, just saying that from my experience creating base images for a (different) cloud provider, it looks like an artifact of image creation rather than a real cause for alarm (I would certainly be alarmed if random people were logging in to my instance and running random scripts from the web!).
To be honest, this looks like an artifact of the base image creation process.
"This file is used to clean up traces from DigitalOcean images before being published."
I don't think someone actually logged in and ran those commands on your instance. I could be wrong, but I'd bet this is just from sloppy creation of the base image leaving weird stuff in history after the image was published.
> Or, that our policy on not doing a secure delete by default isn't something you agree with?
This one. Choosing insecure defaults for a virtualization API is a Bad Idea. As a rule of thumb (to put it bluntly), people are dumb. If you give them a loaded gun, they will shoot themselves with it. And they will blame you for it. At least put the safety on and make them take a conscious step before blowing their face off. Don't mean to tell you your business, but seriously, insecure defaults are a Bad Idea for a virt API.
Looking at their pricing page, it looks like an instance with 512MB RAM comes with a 20GB disk. Depending on host load, IO and process niceness etc, I can see a `dd if=/dev/zero of=...` taking ~10 minutes easily.
https://tools.ietf.org/html/rfc2131#page-31
I'm curious if common DHCP servers like dnsmasq actually do reuse IPs from pending OFFERs, and what timeout they have, if any, before reuse. I poked around dnsmasq config but I did see any specific tuning for that.