February 2005 VOLUME 30 NUMBER 1

February 2005 VOLUME 30 NUMBER 1 THE USENIX MAGAZINE OPINION MOTD ROB KOLSTAD Who Needs an Enemy When You Can Divide and Conquer Yourself? MARCUS J. RANUM SAGE-News Article on SCO Defacement ROB KOLSTAD TECHNOLOGY Voice over IP with Asterisk HEISON CHAK SECURITY Why Teenagers Hack: A Personal Memoir STEVEN ALEXANDER Musings RIK FARROW Firewalls and Fairy Tales TI NA DARMOHRAY The Importance of Securing Workstations STEVEN ALEXANDER Tempting Fate ABE SINGER S Y S ADMIN ISPadmin ROBERT HASKINS Getting What You Want:The Fine Art of Proposal Writing THOMAS SLUYTER The Profession of System Administration MARK BURGESS PROGRAMMING Practical Perl: Error Handling Patterns in Perl ADAM TUROFF Creating Stand-Alone Executables with Tcl/Tk CLIF FLYNT Working with C# Serialization GLEN MCCLUSKEY CONFERENCES 18th Large Installation System Administration Conference BOOK REVIEWS The Bookworm (LISA ’04) PETER H. SALUS EuroBSDCon 2004 Book Reviews RIK FARROW AND CHUCK HARDIN USENIX NOTES 20 Years Ago . and More PETER H. SALUS Summary of USENIX Board of Directors Actions The Advanced Computing Systems Association Upcoming Events 2005 USENIX ANNUAL TECHNICAL STEPS TO REDUCING UNWANTED TRAFFIC ON CONFERENCE THE INTERNET WORKSHOP (SRUTI ’05) APRIL 10–15, 2005, ANAHEIM, CA, USA JULY 7–8, 2005, CAMBRIDGE, MA, USA http://www.usenix.org/usenix05 http://www.usenix.org/sruti05 Paper submissions due: March 30, 2005 2ND SYMPOSIUM ON NETWORKED SYSTEMS LINUX KERNEL SUMMIT '05 DESIGN AND IMPLEMENTATION (NSDI ’05) JULY 17–19, 2005, OTTAWA, ONTARIO, CANADA Sponsored by USENIX, in cooperation with ACM SIGCOMM and ACM SIGOPS MAY 2–4, 2005, BOSTON, MA, USA 14TH USENIX SECURITY SYMPOSIUM http://www.usenix.org/nsdi05 (SECURITY ’05) AUGUST 1–5, BALTIMORE, MD, USA 3RD INTERNATIONAL CONFERENCE ON MOBILE http://www.usenix.org/sec05 SYSTEMS, APPLICATIONS, AND SERVICES Paper submissions due: February 4, 2005 (MOBISYS ’05) Jointly sponsored by USENIX and ACM SIGMOBILE, INTERNET MEASUREMENT CONFERENCE 2005 in cooperation with ACM SIGOPS (IMC ’05) JUNE 6–8, 2005, SEATTLE, WA, USA Sponsored by ACM SIGCOMM in cooperation with USENIX http://www.usenix.org/mobisys05 OCTOBER 19–21, 2005, NEW ORLEANS, LA, USA FIRST ACM/USENIX INTERNATIONAL CONFERENCE 19TH LARGE INSTALLATION SYSTEM ON VIRTUAL EXECUTION ENVIRONMENTS (VEE ’05) ADMINISTRATION CONFERENCE (LISA ’05) Sponsored by ACM SIGPLAN and USENIX, Sponsored by USENIX and SAGE in cooperation with ACM SIGOPS DECEMBER 4–9, 2005, SAN DIEGO, CA, USA JUNE 11–12, 2005, CHICAGO, IL, USA http://www.usenix.org/lisa05 http://www.veeconference.org Draft papers and extended abstracts due: May 10, 2005 Paper submissions due: February 18, 2005 4TH USENIX CONFERENCE ON FILE AND 10TH WORKSHOP ON HOT TOPICS IN STORAGE TECHNOLOGIES (FAST ’05) OPERATING SYSTEMS (HOTOS X) DECEMBER 14–16, 2005, SAN FRANCISCO, CA, USA JUNE 12–15, 2005, SANTA FE, NM, USA http://www.usenix.org/fast05 http://www.usenix.org/hotos05 For a complete list of all USENIX & USENIX co-sponsored events, see http://www.usenix.org/events OPINION 2 MOTD ROB KOLSTAD 4 Letters to the Editor 5 Who Needs an Enemy When You Can Divide and Conquer Yourself? MARCUS J. RANUM 8 SAGE-News Article on SCO Defacement ROB KOLSTAD contents TECHNOLOGY 10 Voice over IP with Asterisk H EISON CHAK SECURITY 14 Why Teenagers Hack: A Personal Memoir STEVEN ALEXANDER 17 Musings RIK FARROW 20 Firewalls and Fairy Tales TINA DARMOHRAY 23 The Importance of Securing Workstations STEVEN ALEXANDER 27 Tempting Fate ABE SINGER SYSADMIN 31 ISPadmin ROBERT HASKINS V OL. 30, #1, FEBRUARY 2005 39 Getting What You Want:The Fine Art of Proposal Writing THOMAS SLUYTER 46 The Profession of System Administration EDITOR ;login: is the official magazine of MARK BURGESS Rob Kolstad the USENIX Association. PROGRAMMING [email protected] ;login: (ISSN 1044-6397) is CONTRIBUTING EDITOR published bi-monthly by 47 Practical Perl: Error Handling Patterns in Perl Tina Darmohray the USENIX Association, ADAM TUROFF [email protected] 2560 Ninth Street, Suite 215, Berkeley, CA 94710. 53 The Tclsh Spot:Creating Stand-Alone MANAGING EDITOR Executables with Tcl/Tk Jane-Ellen Long $85 of each member’s annual CLIF FLYNT [email protected] dues is for an annual subscrip- tion to ;login:. Subscriptions for 59 Working with C# Serialization COPY EDITOR nonmembers are $115 per year. Steve Gilmartin GLEN MCCLUSKEY [email protected] Periodicals postage paid at Berkeley, CA, and additional BOOK REVIEWS PROOFREADER offices. proofshop 64 The Bookworm [email protected] POSTMASTER: Send address PETER H. SALUS changes to ;login:, TYPESETTER USENIX Association, 65 Book Reviews Star Type 2560 Ninth Street, RIK FARROW AND CHUCK HARDIN [email protected] Suite 215, Berkeley, CA 94710. USENIX NEWS USENIX ASSOCIATION ©2005 USENIX Association. 2560 Ninth Street, 67 20 Years Ago . and More Suite 215, Berkeley, USENIX is a registered trade- PETER H. SALUS mark of the USENIX Associa- California 94710 tion. Many of the designations 68 Summary of USENIX Phone: (510) 528-8649 used by manufacturers and sell- Board of Directors Actions FAX: (510) 548-5738 ers to distinguish their products TARA MULLIGAN are claimed as trademarks. [email protected] USENIX acknowledges all CONFERENCE REPORTS [email protected] trademarks herein. Where those designations appear in this pub- 69 18th Large Installation System [email protected] lication and USENIX is aware of Administration Conference (LISA ’04), http://www.usenix.org a trademark claim, the designations have been printed in caps November 14–19, 2004 http://www.sage.org or initial caps. 90 EuroBSDCon 2004, October 29–31, 2004 Let’s review some of the latest news about spam. ROB KOLSTAD I Message security firm MX Logic reported that November compliance with the USA’s CAN-SPAM act hit 6%, doubling October’s 3% compliance rate. They add that 69% of spam is sent through “zom- bies,” usually home computers controlled by spammers to send email on behalf of bulk mailers. In motd related news, a Maryland judge ruled that Mary- land’s anti-spam law is unconstitutional, since it “seeks to regulate commerce outside the state’s bor- THE ONLY GOOD SPAM COMES ders.” FROM HORMEL I Iowa ISP Robert Kramer sued 300 spammers in an effort to stem the 10,000,000 daily spam emails he Dr. Rob Kolstad has long served as editor of ;login:. He saw (in 2000). A U.S. District Court judge ruled is SAGE’s Executive Director, and also head coach of the USENIX-sponsored USA Computing Olympiad. that one spammer must pay him US$720M, and another must pay US$360M. Widespread opinion is [email protected] less than optimistic about actually collecting these damages. I Anti-spam firm Postini reports that 88% of email is now spam; 1.5% of those messages contain viruses. MessageLabs says as high as 6%, depending on the report. Every related news story I checked predicted that 2005 will see the true rise of phishing. (My own mailbox has seen no relief at all from spam. The graph below shows the rolling average of the number of my personal spam emails for the past 15 months.) I The loss of productivity due to spam is gauged at anywhere from hundreds of dollars per year per employee on up. Administrators sometimes find themselves buried in spam or in requests to make it stop. Phishing is a US$137M–500M industry, depending on whose numbers you believe. Now let’s think back to the Golden Age of Email. You remember: each electronic message evoked thoughts of Christmas, like a package of joy waiting to be unwrapped. The bell rung by biff to signal a new message set off a Pavlovian salivation of anticipation at a new missive—perhaps it was a product order, a busi- ness prospect, or greetings from a long-lost friend. Those were the days! 2 ;LO GIN: V OL. 30, NO. 1 Alas, those halcyon days of communication of a certain emails, credit card accounts, and true identities are purity are gone. The tears have been shed; we’ve moved not discernible by mortals. on. Stopping any of a spammer’s three enablers will thwart What happened? In a nutshell, some lawyers in the them: Southwest tested the waters of Internet advertising and I Remove access to cheap and easy sending of bulk found them bountiful. Subsequently, every budding emails. entrepreneur with a scam, fraud, herbal pharmaceuti- I Remove anonymity: make spammers stand up per- cal, erotic Web site, or home-mortgage connection has sonally for their products and services. decided that “almost-free” advertising can make big I Remove their ability to collect money easily and profits. It’s almost as though someone is creating bill- secretly. boards that read, “If you can#t splel VaigrA, you cn I initially thought removing anonymity would solve the mkae big $M$O$N$E$Y$ wtih b.ul.k adtervising on teh problem. Creating a positive identification token for I*N*T*R*E*N*E*T.” tens of millions of Internet users is a very pricy proposi- Some institutions are trying to stem the tide. We have tion, and one not likely to serve the purpose. It appears black lists, white lists, and grey lists. We have black that many people would gladly sell spammers their hole (non-)routing, sender protection frameworks, and, token for relatively small amounts of money. best of all, 150 vendors raking in two-thirds of a billion Removing the other two enablers might yield better US dollars in 2004 just to slow the scourge. Venture results. ISPs can either completely block outward port capitalists pumped US$23M into anti-spam firms in 25 traffic or restrict it to a set of well-known email August 2004 alone. servers. One would think it would be in the ISPs’ best Current solutions seem to fall roughly into these cate- interests to shut down spammers.

Load more