<?xml version="1.0" encoding="UTF-8"?>
<!-- generator="wordpress/2.1.3" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>

<channel>
	<title>LART's Blog</title>
	<link>http://www.engert.us/lart</link>
	<description>killing hackers 1 botnet at a time</description>
	<pubDate>Tue, 29 Jan 2008 21:35:43 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.1.3</generator>
	<language>en</language>
			<item>
		<title>qtax first looks</title>
		<link>http://www.engert.us/lart/archives/22</link>
		<comments>http://www.engert.us/lart/archives/22#comments</comments>
		<pubDate>Tue, 29 Jan 2008 21:35:43 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://www.engert.us/lart/archives/22</guid>
		<description><![CDATA[when I saw that qutax was going to be released soon and planed to offer leagal downloads of allmost any song it sounded really cool.  however as the water clears it&#8217;s not as good as it sounds.  right now they have jack.  They have rebraned the gpled media player songbird.  I [...]]]></description>
			<content:encoded><![CDATA[<p>when I saw that qutax was going to be released soon and planed to offer leagal downloads of allmost any song it sounded really cool.  however as the water clears it&#8217;s not as good as it sounds.  right now they have jack.  They have rebraned the gpled media player songbird.  I have looked at the install and it looks like the only major change was they added some plugins removed the vlc stuff and a lot of Thumbs.db files :-/.  the part that I like most is \extensions\QTrax_Extension@songbirdnest.com\chrome\content\rightbanner.htm and topbanner.htm.if you edit rightbanner.uml and overlayMainPlayer.xul you can set how big the banners are are the ui.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/22/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Postgresql and me</title>
		<link>http://www.engert.us/lart/archives/21</link>
		<comments>http://www.engert.us/lart/archives/21#comments</comments>
		<pubDate>Thu, 26 Apr 2007 00:12:12 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://www.engert.us/lart/archives/21</guid>
		<description><![CDATA[I know what the 3 of you who have my blog&#8217;s rss are thinking 2 posts in 1 day wtf?  well I finally come up with something to talk about.  This is related to my first post but it&#8217;s different enough that I&#8217;m making it a second post.
A number of people have requested that we [...]]]></description>
			<content:encoded><![CDATA[<p>I know what the 3 of you who have my blog&#8217;s rss are thinking 2 posts in 1 day wtf?  well I finally come up with something to talk about.  This is related to my first post but it&#8217;s different enough that I&#8217;m making it a second post.</p>
<p>A number of people have requested that we use Postgresql instead of mysql.  At first I thought it was going to be a walk in the park after all the are both SQL&#8230; well I had never setup a dbms other then mysql and well postgresql has a LOT of options and is really diffrent from mysql.  The confusing file is pg_hba.conf mostly because there&#8217;s 9 different ways to  authenticate to the db server and you can set that differently for different hosts.  Then there&#8217;s the little differences.  If you want to  quit you type \q if you want to list the tables you type \d if you want to see the structure of a table you type \d table_name.  Now I get to try and get php to work nicely with postgresql</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/21/feed/</wfw:commentRss>
		</item>
		<item>
		<title>IP (and more) Archive</title>
		<link>http://www.engert.us/lart/archives/20</link>
		<comments>http://www.engert.us/lart/archives/20#comments</comments>
		<pubDate>Wed, 25 Apr 2007 23:57:13 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://www.engert.us/lart/archives/20</guid>
		<description><![CDATA[I&#8217;ve been working for a little bit now on a new project that we started calling the IP archive project.  The idea is we keep a track of what ip&#8217;s are up to bad things and put dates next to this.  There&#8217;s a few diffrent ways we plan on getting data all in all I [...]]]></description>
			<content:encoded><![CDATA[<p>I&#8217;ve been working for a little bit now on a new project that we started calling the IP archive project.  The idea is we keep a track of what ip&#8217;s are up to bad things and put dates next to this.  There&#8217;s a few diffrent ways we plan on getting data all in all I think it&#8217;s going to be a HUGE project.  However one idea that was brought up was keeping track of domains.  say that a spammer has a domain that they use for 5 days and then git rid of and have 10 more domains that they do the same thing with but all point to the same ip.  With this we will be able to search for stuff like.  One thing you could do with that is go hay this domain resoloves to an ip that spammers have used in the past let&#8217;s not trust it as much.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/20/feed/</wfw:commentRss>
		</item>
		<item>
		<title>AIM Bot</title>
		<link>http://www.engert.us/lart/archives/18</link>
		<comments>http://www.engert.us/lart/archives/18#comments</comments>
		<pubDate>Sat, 17 Jun 2006 17:30:23 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://www.engert.us/lart/archives/18</guid>
		<description><![CDATA[I know what Kevin and Zach are thinking right now.  ZOMFG he updated his blog.  There&#8217;s a reason why I have not updated my blog in ooo 6 months or so.  I got World of Warcraft.  needless to say this has eaten up a LOT of my time trying to hit [...]]]></description>
			<content:encoded><![CDATA[<p>I know what Kevin and Zach are thinking right now.  ZOMFG he updated his blog.  There&#8217;s a reason why I have not updated my blog in ooo 6 months or so.  I got World of Warcraft.  needless to say this has eaten up a LOT of my time trying to hit 60 and then get into a good guild.  I have started to cut back some and since school is over I have a LOT more time to do coding.  Yesterday I got talking to Zach about how rt is not working for defrag because of some weird memory error.  I tried and think succeeded to convince him that we should switch to a php based tracker because we(fpz, kevin and me) all know php like the inside of our computers unlike perl.   Then he started to talk about how the aimbot he was going to use for a project for defrag is written in perl.  Needless to say I started looking for java libraries :-).  last night I wrote a small simple bot that checks the status of the wow realm that I&#8217;m on.  if it&#8217;s down it will hit the xml feed every 5 min untill it comes back up.  right now it&#8217;s up and down but if you see lart2150bot on message it with &#8220;wow&#8221;.  that will check if the realm is running.  there is another command that will start the thread that checks every 5 min :-).  come next Tuesday I plan on being one of the first on the realm assuming worldofwarcraft.com does not go down as it frequently does on Tuesdays.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/18/feed/</wfw:commentRss>
		</item>
		<item>
		<title>Moved Domain</title>
		<link>http://www.engert.us/lart/archives/16</link>
		<comments>http://www.engert.us/lart/archives/16#comments</comments>
		<pubDate>Wed, 28 Dec 2005 01:39:38 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://www.engert.us/lart/archives/16</guid>
		<description><![CDATA[I have finished moveing my domain over to godaddy.com and so far all I have to say is omg are they cheap.  While I was seriously thinking about what Kevin asked me with going in with him and what not this costs a LOT less and still gives me a lot.  The two [...]]]></description>
			<content:encoded><![CDATA[<p>I have finished moveing my domain over to <a href="http://www.godaddy.com">godaddy.com</a> and so far all I have to say is omg are they cheap.  While I was seriously thinking about what Kevin asked me with going in with him and what not this costs a LOT less and still gives me a lot.  The two down sides that I have found so far is that the e-mail accounts that they provide you are a max of 10MB each :-/.  also the mysql db&#8217;s can only be connected to from their hosts but I kindof expected that part.  It would be nice if the two control panales were combined into one but it&#8217;s not to bad.  I can&#8217;t complane I got my first year for $32 and that gives me 5GB of space and 250GB of bandwidth.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/16/feed/</wfw:commentRss>
		</item>
		<item>
		<title>blocking nasty robots</title>
		<link>http://www.engert.us/lart/archives/14</link>
		<comments>http://www.engert.us/lart/archives/14#comments</comments>
		<pubDate>Wed, 14 Dec 2005 22:45:19 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://engert.us/lart/?p=14</guid>
		<description><![CDATA[I was looking over the logs on one of my honey pots and I saw something strange but not suppriseing.  a robot that was using the msie 6 useragent.  so then I looked at my logs to see if they downloaded robots.txt and there was nothing.  now i&#8217;m getting a little pissed. [...]]]></description>
			<content:encoded><![CDATA[<p>I was looking over the logs on one of my honey pots and I saw something strange but not suppriseing.  a robot that was using the msie 6 useragent.  so then I looked at my logs to see if they downloaded robots.txt and there was nothing.  now i&#8217;m getting a little pissed.  doing some more digging shows that the bot works for Cyveillance after reading the second resault from google I wanted to put on my <a href="http://cyveillance.linuxgod.net/">tin foil hat</a>.  This bot deserves to die but it got me thinking what&#8217;s the best and ezest way to block bots like this.</p>
<p>I fairly quickly came across <a href="http://www.neilgunton.com/spambot_trap/">&#8220;Stopping Spambots: A Spambot Trap&#8221;</a>.   On that page Neil talks about how he made a simple spambot trap that should trap any abusive robot that does not pay attion to robots.txt.  so I thought of 2 things to do first keep track of who simple ignores the robots.txt but does download it (kindof hard w/o looking at logs or editing htaccess/httpd.conf) or make a folder that&#8217;s in robots.txt as deny for all then frist have a page that warns users that if they click the link on this page they will be banned from this server.  log who hits that second link and log their ip agent etc in a db.</p>
<p>For now I think i&#8217;m going to simply make the later of the 2.  then make a small php script that I can include on all php pages with a simple sql query and if it finds the ip die();.  once I get that I also want to add a second part to the php script that get&#8217;s included on all pages.  I want to look in using dns blacklists for blocking open proxys as they are nothing but truble.  The only down side is that it can take some time and I don&#8217;t know of any way to mutithread php.  So my idea is use a ouside program mostlikely java as it&#8217;s my language of choice to do this step and use a simple system call in php.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/14/feed/</wfw:commentRss>
		</item>
		<item>
		<title>all wemon must read</title>
		<link>http://www.engert.us/lart/archives/13</link>
		<comments>http://www.engert.us/lart/archives/13#comments</comments>
		<pubDate>Sun, 11 Dec 2005 18:27:03 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://engert.us/lart/?p=13</guid>
		<description><![CDATA[I woke up this morning and like most other mornings I chekced out digg.com and one of the articals was titled &#8220;Dating an Apple Developer&#8221;.  The title got me thinking what do us nerds put wemon through who we love.  while this artical is slanted to a apple web developer the basic concepts [...]]]></description>
			<content:encoded><![CDATA[<p>I woke up this morning and like most other mornings I chekced out <a href="http://digg.com">digg.com</a> and one of the articals was titled &#8220;Dating an Apple Developer&#8221;.  The title got me thinking what do us nerds put wemon through who we love.  while this artical is slanted to a apple web developer the basic concepts apply to most devs.</p>
<p><a href="http://www.emilyhambidge.com/blog/emily/66/">Dating an Apple Developer</a></p>
<blockquote><p>7. Rubies and Pearls are not what you think.</p>
<p>I once overheard Justin having a conversation with a friend of ours. He made mention of a ruby and a pearl. Seeing as how it was almost my birthday I immediately thought I was in for a great gift. Little did I know they were talking about Ruby on Rails and Perl. Later that week we went out for a Sunday afternoon drive. There is a jewelry store just across the street from the local Barnes and Noble. I, of course, thought we were pulling in to buy some bling. 30 minutes and two O’Reilly books later I figured out that my “birthday gift” was actually how-to manuals for programming languages. </p></blockquote>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/13/feed/</wfw:commentRss>
		</item>
		<item>
		<title>worst install ever</title>
		<link>http://www.engert.us/lart/archives/12</link>
		<comments>http://www.engert.us/lart/archives/12#comments</comments>
		<pubDate>Fri, 09 Dec 2005 03:28:23 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://engert.us/lart/?p=12</guid>
		<description><![CDATA[so I wanted to reinstall linux on files.defrag.depaul.edu so we can get cpanel on it for gameing groups.  I wanted to get it done today so tomorrow I can upgrade smartlanuch and then go to the party&#8230; well things didn&#8217;t quite work how I wanted them to.  It started with me not bringing [...]]]></description>
			<content:encoded><![CDATA[<p>so I wanted to reinstall linux on files.defrag.depaul.edu so we can get cpanel on it for gameing groups.  I wanted to get it done today so tomorrow I can upgrade smartlanuch and then go to the party&#8230; well things didn&#8217;t quite work how I wanted them to.  It started with me not bringing my wallet with me when I went to the bus and then when I was going to get the next bus I forgot that it&#8217;s one of 2 buses that dont leave on the hour and 1/2 hour so I end up waiting 40 min for my bus :-/.  I only wish that was the worst part of the day :-(.</p>
<p>The only thing is my 2 favorate distro&#8217;s are not really supported.  gentoo is not even listed on their site as something they are working one.  debian 3.0 is beta but 3.1 came out a while ago and 3.0 is SOOO out of date.  my choices are all rpm based something I left behind in the 90&#8217;s because they are nothing compaired to dpkg and portage.  However I really want to use cpanel soo I deside to bite the bullet and start to install suse 10 when the install failed (because of something don&#8217;t know why) kevin told me that suse 10 is not supported.  I got a little pissed but went fine and desided that getting mad would not help me get any where fast so I take one from the team and bendover while I start to download the 4 cd&#8217;s for fredora core 4 :-/ when the install failed I started to louse my cool but went fine test the cd for errors it said the md5 didn&#8217;t match so I checked the sha-1 of the iso it was fine burned another copy same thing bad md5 <img src='http://www.engert.us/lart/wp-includes/images/smilies/icon_sad.gif' alt=':-(' class='wp-smiley' /> at this point my rage was getting high and my stack of cd-r&#8217;s was shrinking.  At this point I tested the last thing centos.  It&#8217;s red hat enterprise but free it also has the same installer as fedora.  but you know what I get the same error :-(.  at that poing all I wanted to do was go home and so I did but that&#8217;s when I rembered that it&#8217;s a blizzard out there :-(.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/12/feed/</wfw:commentRss>
		</item>
		<item>
		<title>gmail av</title>
		<link>http://www.engert.us/lart/archives/11</link>
		<comments>http://www.engert.us/lart/archives/11#comments</comments>
		<pubDate>Sun, 04 Dec 2005 23:58:17 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://engert.us/lart/?p=11</guid>
		<description><![CDATA[magoo sent me a im this morning pointing to his newest post on his blog &#8220;Gmail AntiVirus = Sophos&#8221;.  He asked me if I could conferm this so at first I used the files that I have from my nepenthes honeypot.  That didn&#8217;t work so well after about 19 files I only ruled [...]]]></description>
			<content:encoded><![CDATA[<p>magoo sent me a im this morning pointing to his newest post on his blog &#8220;Gmail AntiVirus = Sophos&#8221;.  He asked me if I could conferm this so at first I used the files that I have from my nepenthes honeypot.  That didn&#8217;t work so well after about 19 files I only ruled out 9 of 20 ish venders.  So then I rembered that I had a vmware image with a lot of spyware and trojens on it from a backdoor I installed on it.  I found a number of files that should not be on a default install of win 2k so I tested thoes files.  the resaults from all of this makes it look like out of the 20 venders that I tested Sophos was the only one that had consistent resaults with what I was getting from <a href="http://VirusTotal.com">VirusTotal</a>.  magoo posted my resaults at <a href="http://www.thebillygoatcurse.com/gmailresults2.html">thebillygoatcurse.com/gmailresults2.html</a></p>
<p>After doing this 2 questions have come to mind.  The frist one being what&#8217;s stoping google from telling the world about who they use for gmail?  I don&#8217;t get why Sophos would have them keep quiet about this as it would be great advertiseing.  the second thing is does antivirus give users a false sence of security?  a number of the files that I tested later on were not deteded by quite a number of venders.  It seems to me that noobs think that if their antivirus is up to date and says it&#8217;s working just fine that they are invincible, but this is never the case.  As long as we rely on virus definations we are allways vulnerable.</p>
<p>update: I put some closer to raw resaults at <a href="http://students.depaul.edu/~bengert/gmail.xls">gmail.xls</a> and for the open office users out there <a href="http://students.depaul.edu/~bengert/gmail.ods">gmail.ods</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/11/feed/</wfw:commentRss>
		</item>
		<item>
		<title>your preapproved</title>
		<link>http://www.engert.us/lart/archives/10</link>
		<comments>http://www.engert.us/lart/archives/10#comments</comments>
		<pubDate>Thu, 01 Dec 2005 17:29:34 +0000</pubDate>
		<dc:creator>LART</dc:creator>
		
		<category><![CDATA[Main]]></category>

		<guid isPermaLink="false">http://engert.us/lart/?p=10</guid>
		<description><![CDATA[some of you might not get a lot of preapproved credit cards but I seem to get between 1-5 a week and it&#8217;s starting to piss me off.  Since this is winter break and I don&#8217;t have a job this time around i&#8217;m starting to stick it to the man.  step one send [...]]]></description>
			<content:encoded><![CDATA[<p>some of you might not get a lot of preapproved credit cards but I seem to get between 1-5 a week and it&#8217;s starting to piss me off.  Since this is winter break and I don&#8217;t have a job this time around i&#8217;m starting to stick it to the man.  step one send out the 15 business reply envelopes that&#8217; I&#8217;ve colected over the past few weeks with a nice letter inside asking them to remove me from their list and recording the date and who they are being set to :-D.  step two opt-out at optoutprescreen.com.  At frist it looked like a scam to me because it asks for your ss# but after looking around they are legit.   according to a lot of the places that wrote about this site it makes it so banks and other lenders can&#8217;t simply check your credit unless you ask them to or have an account with them.  so long story short they can&#8217;t check your credit to preaprove you :-D.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.engert.us/lart/archives/10/feed/</wfw:commentRss>
		</item>
	</channel>
</rss>
