*Nathan E Norman wrote: > Mr. Lapeyre, > > You do realise that pavlov.midco.net is part of the DNS rotation > http.us.debian.org? No, I didn't. I was using the mirror. I am in error. Obviously the connections to several ports on my machine were a legitmate part of the transfer of data to my machine. I made the accusations out of ignorance. > I see no evidence in the logs that you are being port scanned - I feel > it's more likely that your use of the mirror here is at issue. You may > of course disagree. No, I agree. The connection attempts in my log were made to transfer data that I requested. > > Nevertheless, I will shut down the mirror here and rebuild this machine > from scratch, implementing draconian and paranoid security measures. Please don't do this. I don't see any need to do this. > > If I receive further complaints of "abuse" from Debian project > participants, I will be forced to remove the mirror entirely. > Complaints to "security@midco.net" are viewed by members of the > management team as well as members of the technical staff, and I regret > to inform you that one of the members of the management team has reacted > to your complaint in an abusive and non-productive manner that will > certainly impact our ability to help Debian in the future. I feel sorry for this person. > > I regret the "shoot the messenger" tone of this email; understandably > security is important and potential abuses should be dealt with swiftly > and forcefully, given the state of the Internet today. Nevertheless, > common sense can and should be exercised whenever possible. I made a mistake, and made a false accusation. I am very sorry to have wasted the time of your security team. Maybe you can avoid further waste of time, by accepting my retraction of accusations and realizing that now there is no evidence and no accusation of a security problem, and therefore, no reason to take action on a suspected security problem I apologize to the project for throwing a wrench in the mirroring system. -- John Lapeyre <lapeyre@physics.arizona.edu>, lapeyre@debian.org Tucson,AZ http://www.physics.arizona.edu/~lapeyre
Attachment:
pgpAqDCHl5rdy.pgp
Description: PGP signature