[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: scanning my ports



*Nathan E Norman wrote:

> Mr. Lapeyre,
> 
> You do realise that pavlov.midco.net is part of the DNS rotation
> http.us.debian.org?
  No, I didn't.  I was using the mirror. I am in  error.  Obviously
the connections to several ports on my machine were a legitmate part
of the transfer of data to my machine.  I made the accusations out
of ignorance.

> I see no evidence in the logs that you are being port scanned - I feel
> it's more likely that your use of the mirror here is at issue.  You may
> of course disagree.
  No, I agree.  The connection attempts in my log were made to transfer
data that I requested.
> 
> Nevertheless, I will shut down the mirror here and rebuild this machine
> from scratch, implementing draconian and paranoid security measures.
   Please don't do this.  I don't see any need to do this.
> 
> If I receive further complaints of "abuse" from Debian project
> participants, I will be forced to remove the mirror entirely.
> Complaints to "security@midco.net" are viewed by members of the
> management team as well as members of the technical staff, and I regret
> to inform you that one of the members of the management team has reacted
> to your complaint in an abusive and non-productive manner that will
> certainly impact our ability to help Debian in the future.

  I feel  sorry for this person. 

> 
> I regret the "shoot the messenger" tone of this email; understandably
> security is important and potential abuses should be dealt with swiftly
> and forcefully, given the state of the Internet today.  Nevertheless,
> common sense can and should be exercised whenever possible.
  I made a mistake, and made a false accusation.  I am very sorry to
have wasted the time of your security team.   Maybe you can avoid further
waste of time, by accepting my retraction of accusations and realizing that
now there is no evidence and no accusation of a security problem, and
therefore, no reason to take action on a suspected security problem

   I apologize to the project for throwing a wrench in the mirroring
system.

-- 
John Lapeyre <lapeyre@physics.arizona.edu>,  lapeyre@debian.org
Tucson,AZ     http://www.physics.arizona.edu/~lapeyre

Attachment: pgpMYEwAVbM7I.pgp
Description: PGP signature


Reply to: