skysight-inc/HackerNews huggingface dataset:
I agree. Changing the port or hiding with port knocking is useful especially for keeping logs clean.

Generally, I think it's best to avoid publicly accessible SSH but if needed, changing the port is a good idea.

I always remove password auth and direct root login however even though my machine is now secure, the logs are filled with failed login attempts.

Clean and tidy logs help spot anomalies indicative of real attacks and not someone looking for open port 22 and hoping the combo root/root somehow works.

I don't think it's wise to change the port and consider things safe. All other security advice still applies however changing the default port in addition to locking down access seems like a wise decision to me.
It's clear Vinod Khosla really cares about the environment.
Developer Auction is now hired.com, has a new look, and supports designers
Calgary is just silly large and special. My commute to the university is 30 minutes in good traffic by car. Mass transit implies about one and a quarter hours on the ctrain and twenty minutes on a bus. Plus waiting time.

In all honesty Calgary is a hopeless city.
Consider Tokyo: https://maps.google.ca/?ll=35.637209,139.744034&spn=0.502803...

Now compare it to Calgary: https://maps.google.ca/maps?ll=50.988692,-113.841705&spn=0.3...

Keep in mind Tokyo is only the center of that metro area. Tokyo itself is 13M people. The full metro area is 35M! Meanwhile calgary is a mere 1M!

Calgary is just not scaling. If we tried to fit 35M people in Calgary the city limits would start hitting the Rockies! Just as CPUs are hitting limits on the speed of light Calgary is hitting limits on safe highway speeds. Mass transit could be improved but it cannot shrink the city.
Perhaps I need to find a farmer's market and a meat shop.
Port scanning is generally automated (edit: and scans all ports, not just the handful you listed), so it doesn't actually matter which port you pick as long as it's not 22. Port scanners like nmap are widely available, so the time to actually figure out which port is running SSH is quite short in practice.

Basically, there are two classes of people:

1. Those who use port scanners.

2. Those who do not.

If you are being attacked by someone in class 1, then moving your port gives you absolutely no protection. Thus moving your port is only worth anything at all if the percentage of class 2 people is significant.

However, if you also consider the probability a person in each class has of actually compromising your machine, then the security looks less convincing. Yes, it might be true that 95% of people don't bother to use a port scanner, but the most competent hackers are almost certainly going to be in the 5% that do use one.
I'm with you on that one. Setting up OpenVPN is a day worth of work at most and gives you the freedom not to have to worry about this stuff in the future.
> So now $EVIL_USER puts "@reboot /home/$EVIL_USER/bind_port_2222" in his crontab, or some such other method of getting to port 2222 before the ssh daemon.

I hadn't thought of this. Setting up the malicious executable to somehow bind to the SSH port before the SSH daemon is able to and then rebooting the computer - assuming the user has reboot privileges - seems to be the only way to do this correct?

(Once the SSH daemon has bound to its assigned port, then I don't think the port matters - if the user is able to kill a root-owned SSH daemon, he's likely able to start his service on whatever port he wants).
Actually, one thing I've found useful is keeping an sshd listening on port 443. I know, I know, sacrilege reusing the HTTPS port, right?

The benefit of this is that it can allow you to tunnel through an HTTP proxy (e.g., like in a corporate environment). Many HTTP proxies only allow traffic through to port 80 and port 443. The benefit of ssh on port 443 is that if the proxy is handed a CONNECT verb, it will transparently just transmit data between your client and the remote server, irrespective of what that content is. In fact, this behaviour is what makes HTTPS remain secure when going through an HTTP proxy.

You can use this to tunnel ssh through an HTTP proxy. Putty supports this out of the box, but if you're using openssh, you'll need corkscrew also.

You can always try to tunnel to an ssh server on port 22, but most proxies will hand you HTTP403 on any CONNECT request to a non-port 443.

More info at http://daniel.haxx.se/docs/sshproxy.html.
GNOME can integrated with SkyDrive since June 2012.
First, I think Wikipedia is great. And I don't want to imply that the Talk pages are bad. But, I really find the Talk pages to be the most "inside baseball," almost inane, and just impenetrable thing on the Web. Might just be me.
Thank you! This all looks like great advice! Especially the feature creep, my client is already showing signs of that. I
Perhaps I have a more expansive definition of "accounting" than you ;-) I do agree that Excel is not and never should be a primary tool for bookkeeping.
I never really got the huge advantage of self-driving cars until I read something similar a few years ago talking about one parent in a family taking the car to work, then the car driving itself home, so that the other parent could drive the kids to school, etc.

Before then I had never thought about the biggest game changer of the self-driving car: The car driving around with NO ONE in it!!

That is huge and once the technology is good enough to be safer than our current state of affairs with human drivers, it is a complete and utter game changer. You would no longer need drivers for 18-wheelers and would not have issues with tired drivers pushing their limits to drive 12, 14, 16 hours...instead a truck could drive all day and all night at 55mph or whatever speeds were safe, only stopping for refueling or maintenance issues.

You could also have driverless taxis, school buses (maybe repurpose the drivers into chaperones who actually pay attention to what is going on in the bus?!), Greyhound-type bus lines, etc, etc.

Plus, as you pointed out, lots and lots of families would only need one car. Or several people could share a car together. Or services such as Zipcar could really take off because you don't have to go to where the car is — you could just find the nearest one and request that it come to you!

On top of all that, a huge benefit is that you can do other things while getting to your destination. Let the car drive while you read a book, catch up on email, text your friends, watch a movie — whatever.

I don't think the biggest impediments will be technological—they will be governmental and legal. Who is at fault in an accident of two driver-less cars? Do you still need a "license" to operate? What happens if they get hacked? Etc.

Totally agree with you that it is interesting and amazing to think about!
I run SSH on a non-standard port because it makes it easier to see when someone is genuinely targetting me for attack. If I run SSH on 22 then I won't know when someone is targetting me for attack since I'll be under constant script kiddie attacks from everywhere all at once. If I have nothing on 22 then all those attacks just get silently blackholed. Which is ideal.
We've had to use asana for a particular customer project recently and it's really not that great. For me trello is a far better implementation of task management.
The tracking bits aren't the big problem, the "car that drives you instead of you driving it" is the potential problem.
I'm not a "wikipedian" -- but I do think the focus on sibling-projects, allowing wikipedia to be an encyclopaedia, is good. Contribute to wikibooks if you want to write text books (on math or some other subject) -- I don't think it makes sense for wikipedia to host all content everyone ever wants to create. That's what the Internet is for. It shouldn't be the goal of wikipedia to be the wiki to end all wikis. More wikis with different focus would be more manageable, I think. Both wrt quality control and translation.

Text in a wikipedia is much like source code for a program -- it will be read many times more than it is written -- and after a certain point, it should largely stop changing, unless bugs are found. "Bugs" in the case of text are the obvious: grammar/spelling, somewhat subtle: use of language, wording (contrast eg: articles written in "simple English" wikipedia vs "normal" English) -- and external change: Hiroshima has lots of beautiful wooden houses > Hiroshima is one of two cities to have ever been bombed with a nuclear weapon (For a rather grotesque example).
I never understood that comic. You would think preventing traffic reaching a website would be harder than tearing down a poster.

edit: Wrong direction.
Yep. I noticed the domain going flaky in August (http://aspensmonster.com/2013/08/23/nsa-gov-is-down-friday-a...). That time, it looked like the Akamai Edge network ended up serving it for a while.
I would contest that samstave is doing The Lord's work, in this here situation. To that, I say Amen.
Everyone's work on prediction markets at Google was a 20% project, so Patri would have had his main job doing something else.
Yes, but he's noting that a younger engineer may have never encountered a system with multiple users, so wouldn't think that being able to open a privileged port is more terrifying than being able to spin up netcat on 10032.
> I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.

You don't get that from it being on 22; you get it from verifying host keys.
Insurance companies are not liable, the owner of the car would be liable, just as he is if he lets someone borrow his car and that person crashes it. He carries insurance against that risk, but the liability is his.
Your society is so insufferable that they've died out.
When you're riding in the kind of humidity they get in Houston, a 100 degree breeze will heat you up instead of cooling you down.
I don't think this has much to do with politics.

How does it even make sense for you to be asking about getting a beer with me? Your friend considers a job you don't approve of and is dead to you. What am I? Presumably something worse than that, right?

My point is, reconsider coercing your friends into taking only the jobs you approve of.
Standard or not standard port, you still should use port knocking in a way or another (or only enable it for the specific IPs that can access it ever). Internet don't even should be able to know that you have there a service that is only for you or for a very small amount of people.

If a remote vulnerability is discovered in the server (happened in the past, don't rule it out for the future), you will be attacked, and it won't be a brute force attack to be blocked by fail2ban or similar. You can be scanned in any time, put in a database as "having ssh version x running in y port" and get ready for future use.

And if well simple port knocking could be defeated inspecting your traffic, there are variants like fwknop that are resistant to that kind of interception or replaying.
I think you have missed the point - you should tell why using non-standard port is less secure, not provide me an alternative, because I would also argue VPN is better fail2ban.

You cannot neglect the fact that there are vast amount of bots scanning only port 22 in the Internet. We know this because we have found the evidence in our OWN logs, not from those security experts always saying security through obscurity is bad and therefore we should do nothing.
It sure is. It's been down for hours.

http://www.isitdownrightnow.com/nsa.gov.html

Funny thing is, outages for GitHub and its ilk hit HN in minutes. Either way, the transparency in the post-mortem is more valuable and telling than the outage. Organizations need to prove themselves with transparency to build and earn trust.

Yet, one of these things is not like the other.
Most of them don't have passwords, they are static pages created in Ms Word XP or FrontPage 97 (to this day). They are now getting "modern" with heavy PHP+Typo3, notice the '"'. Seriously, the requirement of some Qc government organization to make page editing compatible with Microsoft Word (forbid CSS, favor tables) mandatory is the dumbest IT rule I ever saw. PHP will, on the long run, create an even bigger mess than Ms Word. I hate to say that, but they should have gone with Java. The quality of most of their programmers leave to be desired, you can't expect forward thinking practices. Not saying entry level programmers are useless, but relying on them for code with 20+ years lifecycle is not an economical decision.

*I never and will never work for them, but I came across some of their monstrosities as a consultant or over some (geek) beer talks (better than weather, at least funnier).
Doesn't founder liquidity typically range swap out some equity for single digit million dollars?
The point is that the "poster" (or website) is an irrelevance and "tearing it down" amounts to minor vandalism.
Hacking the NSA website is not hacking the NSA. Hacking a website is relatively easy and not that interesting to people who deal with servers day-to-day.
Activist Tweets Former NSA Chief's 'Off Record' Phone Call On Train
http://en.m.wikipedia.org/wiki/Feynman_point
Are there any conceivable practical ways to implement reversible computing? I think it makes sense not to mention ideas that are super hard to fulfill.
But that bolsters the EFF's argument, does it not?

I mean, on a technical level, you may be right, but the 4th Amendment is not something that protects only as long as the government does not exploit these technical details. See Kyllo v. United States.
The article interchangeably uses "self-driving car" and "autonomous car", but it doesn't clarify whether the benefit calculations include completely unmanned usage.

A car that drives by itself with passengers in it, is one thing. But an unmanned vehicle takes the concept to a whole new level.

It will have an incredibly deflationary effect on the economy. Trucking is a $600 billion business. It employs 3 million people. Over a million of them are long-haul truckers. And that's not counting non-driving support staff. With self-driving trucks, 30% reduction in headcount isn't unrealistic.

That's just one example.

It's a scary prospect for many people.
Turning off passwords and only using keys also mitigates the standard brute force attacks that happen. Frankly I'd much rather do that then have my server on a non-standard port.
Get a pair of Bose noise canceling headphones. They do what you describe above for your ears only. Very portable and much less destructive.
Tasteful Sarcasm site is now live Class up your sass.
Most of the comments here are talking about the perhaps? controversial analysis about processing capability. IMO, That's not really the most important point in this article, for the HN crowd.

It's a long article, so I will sum up what I think is the most important point: we are going to have to think of ways of creating value that no longer leverage exponential deterministic data processing capability. The next venues of profit and growth will be in figuring out how to deal with non-deterministic or open-ended questions where an exact answer is not necessary, or better yet, may not be optimal.
Google Suddenly Stop Sending Visitors To Your Blog? Try This Steps
So you're operating with a compromised user account capable of killing your sshd on port 1234 but there's no other local escalation exploits?

Seems like something a little script or patch could fix up really easily - make sure your daemon is running on port 1234. If it's not, take whatever defensive measures you think would be effective.
Yes, you are right. I live in Houston and I bike for 12 miles round trip almost through out the year except when it is cold and windy. And if you are commuting for work, you are not going to face the peak heat in the middle of the day during summer. But the roads are not completely bike friendly in here and there is problem of stray dogs.
Folks, this is a HUGE problem that will affect our entire industry. There is no replacing an exponential growth function. Sure, we can have a few "one-offs" here and there, but the loss of the exponential growth of computer performance cannot be replaced.

What happens when computers no longer get any faster? People have been so used to the 40 year exponential trend that they can't even comprehend that it will end. We're talking about the next 4-5 years.
Dark silicon isn't a problem, it's a partial solution to the real problem, power density.
jeez, i don't know who is worse: apologists for japan, or apologists for china.

the hilarious thing is the aforementioned two groups are vehemently anti-each-other.

GUESS WHAT. east asian interests don't align with your western ones.
No no, the hidden input fields would not be filled in by a human (because they're positioned off screen by CSS, for example), whereas a bot would fill them in because the bot is just scraping the HTML for all input fields and filling them in with something.

It seems like you had that backwards -- hope that clears it up.
To say that it's safe on average is not the same thing as saying it's safe in Los Angeles. Biking is not safe in most of Los Angeles.
Younger Than The iPad 2
it's a decoy.

or it might be a decoy decoy... =)
Rustle League takes credit for downing NSA web site
... why was this downvoted?
http://www.unicode.org/faq/casemap_charprop.html

Still provincial
I can't help but laugh. I always joke with my irc buds that we are chatting in a NSA honeypot. Maybe it's actually true? lol I think I'm actually disillusioned now. Just another example of why you should never put information you wouldn't want someone to know on the internet.
Because they had a presumably safer alternative available. It might be construed as negligence. I'm not making a judgement one way or the other about it. I just think it's likely to happen.
Obligatory video:

http://www.youtube.com/watch?v=SQobzdCNDgQ

Before anyone freaks out, note that (as ChuckMcM said) all these trees are almost exactly the same size/age. This isn't an old-growth forest -- it's a lot closer to harvesting a field of corn.
Every language has grammar by definition. We're just trying to discover it.

It's like the laws of physics: We have laws which seem to work, but we know they're not the whole story, so we observe more of what happens and try to bring our laws into harmony with the actual underlying laws.
Is there a precedent you're referring to? Because I believe all of the above social networks started as... social networks.
Why would I use a VPN when I have SSH? IE, why do you think that a VPN is somehow more secure than an SSH connection?
No doubt, but I would be very surprised if one could set up an R simulation quicker than one could set up a comparable spreadsheet. I don't see R and spreadsheets as interchangeable. They are very complimentary technologies.

This looks promising: http://wiki.openoffice.org/wiki/R_and_Calc
> You don't get that from it being on 22; you get it from verifying host keys.

You know how you just wrote a blog post talking about how more layers of security are better even if all you're gaining is obscurity? This isn't an exception. And it is a valid point that by moving from a privileged port to a non-privileged port, you just traded away a layer (arguably a more useful one than you gain by moving away from 22) for absolutely no reason. (You could move to a different privileged port and still get everything else.)

tl;dr: You advocate giving up an actual layer of protection for a layer of obscurity. This is especially puzzling when you could get both.

Further, the reality of the situation is that as a practical matter most sysadmins are terrible about key management and when they see those warnings the very next thing they almost always do is immediately delete the key and hastily attempt to login to the machine via ssh. (The better ones to see what's going on and try and fix it, and the worse ones just assume that the key changed because sysadmins change keys all too often without notifying users and don't investigate at all.)

It turns out that humans are annoyingly predictable.
Controller latency. Hierarchy of all memory and cache has a complexity/memory-size correlation in the controller that directly affects performance. Also, power density in hot-spots is the issue, and fundamentally you want all the fastest switching parts close to each other, which fights any effort to move them apart. There will always be fast-switching, constantly used transistors next to others. Also, at the small scale, the heat has to move linearly to the chip package before it can spread three-dimensionally at all, and it's basically linear at the center of the hot-spot. The heat is going through a straw instead of a block.

Multicore in essence is breaking up the hot spot and spreading it out. Our choices are limited simpler CPU's and more of them to flex this technique. GPU design is more geared toward this, and unified address space on newer AMD chips as well as potentially Nvidia's Tegra design evolution (project Denver?) both point to smaller, simpler CPU's or something like sub-CPU's (instructions are already translated to micro-opcodes and scheduled differently than they appear in the program text) that only do parts of the work instead of operating on whole threads. CPU's are binary code runtimes implemented in hardware, so this kind of abstraction is like changing the runtime without changing the bytecode fed to it. We might end up at a situation where CPU's work on 100 threads with a blurry definition of what a core even is anymore. It will happen slowly, as microprocessors retain major similarities over the years. Convergent evolution and too much engineering and experience to start anything from scratch. Can you find the FPU's in each generation? http://chip-architect.com/news/AMD_family_pic.jpg I always marveled at how much silicon is necessary for SIMD FP.

I somewhat doubt this is relevant at the chip scale, but we're at 10cm per clock cycle at speed-of-light to put the frequency into perspective.
What are some examples? Like hiding a wallet in a shoe at the beach? Even that is actually successful in some cases.

Most thieves aren't career criminals in search of wallets. Perhaps a respectable working man sees a wallet of a young rich kid currently in the water. The man could use some extra cash and sees large bills protruding from the wallet and decides to take it. Why not? The man has a family and that kid probably has a trust fund.

The wallet stuffed in a shoe or buried under a towel prevents temptation. It's not actually more secure but it keeps honest people honest.

Nothing is really secure. Adding security is all about making something harder. Harder to live with, harder to access, harder to do un-detected, etc. If hiding something from plain sight makes it even slightly more troublesome of a heist, it's actually security IMO.

It shouldn't be your only form of security but to write it off completely seems silly.
Agreed. Contrary to the naysayers, port knocking is an unalloyed good.

Whatever your setup is, it's better if it doesn't show up in a scan at all.

The "knock is a weak password" argument is silly - nobody suggests using only the knock, but rather to use the knock in addition to your existing auth scheme.
I find it significant they still recommend using Tor even after a seeming exposé a couple weeks back. [1] Is it the fact that some measure of security is better than none or it makes surveillance incrementally harder?

[1] http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa...
Facebook, Twitter, and the sort hold on to content in perpetuity and content is monetizable. In this case, other than a network of friends who would be embarrassed with you, what is left of Snapchat after the first "My stuff wasn't really deleted" scandal? An "I have all of your dirty photos service"? Could their users just jump onto another "delete everything" app?
On my personal boxes I use a combination of non-standard ports, disabling password auth (seriously, this will do more for your security than anything else), and fail2ban. Even with key authentication fail2ban still blocks several IPs a day.