openpacket-mods — Private discussion forum for OpenPacket moderators

[Openpacket-mods] OP.ORG updates

[JJ C. <cum...@gm...>]

I would like to begin by thanking Richard for his time and dedication  
in getting this project off of the ground.

There have been a number of changes in recent months, including the  
migration of the site onto new hardware to increase stability. There  
are a number of significant changes that are rapidly approaching that  
include some partnerships and significant site enhancements. This  
being said, please stay tuned for these upcoming developments and let  
us know how we are doing by participating in the forums and capture  
uploads.

I would also like to welcome our latest moderator: Joel Esler.

Cheers,
JJC 

Re: [Openpacket-mods] OpenPacket.org future

[JJ C. <cum...@gm...>]

RoR is fine... if I can get Sherri's ok I'll release the existing 
code... but heh...

Aaron Turner wrote:
> On Mon, Jul 14, 2008 at 9:29 PM, Lee Hinman <mat...@gm...> wrote:
>   
>> I'll help with development, but I don't have enough time to devote to
>> developing the entire thing from the ground-up.
>>     
>
> I suspect that's a common situation.   What languages/frameworks are
> you familiar with?  I've done PHP, Perl/Mason in the past but frankly
> would prefer to never touch either of them again now that I've started
> using Ruby on Rails (what the current site is written in).
>
> JJ- can you tell us anything about your minions, err friends?
>
>   
>> Also, do we want to use Trac as the main bug/feature request tool? If
>> so, I'll add all the requests/bugreports from the sourceforge tracker
>> into Trac.
>>     
>
> I'd vote for dumping SF's bug tracking system.
>
>   

Re: [Openpacket-mods] OpenPacket.org future

[Lee H. <mat...@gm...>]

>> I'll help with development, but I don't have enough time to devote to
>> developing the entire thing from the ground-up.
>
> I suspect that's a common situation.   What languages/frameworks are
> you familiar with?  I've done PHP, Perl/Mason in the past but frankly
> would prefer to never touch either of them again now that I've started
> using Ruby on Rails (what the current site is written in).

I've done PHP, Ruby on Rails and Catalyst. I'd prefer to do something
with Rails also

> I'd vote for dumping SF's bug tracking system.

Agreed, I'll move the tickets.

- Lee

Re: [Openpacket-mods] OpenPacket.org future

[Aaron T. <syn...@gm...>]

On Mon, Jul 14, 2008 at 9:29 PM, Lee Hinman <mat...@gm...> wrote:
> I'll help with development, but I don't have enough time to devote to
> developing the entire thing from the ground-up.

I suspect that's a common situation.   What languages/frameworks are
you familiar with?  I've done PHP, Perl/Mason in the past but frankly
would prefer to never touch either of them again now that I've started
using Ruby on Rails (what the current site is written in).

JJ- can you tell us anything about your minions, err friends?

> Also, do we want to use Trac as the main bug/feature request tool? If
> so, I'll add all the requests/bugreports from the sourceforge tracker
> into Trac.

I'd vote for dumping SF's bug tracking system.

-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin

Re: [Openpacket-mods] OpenPacket.org future

[Lee H. <mat...@gm...>]

I'll help with development, but I don't have enough time to devote to
developing the entire thing from the ground-up.

Also, do we want to use Trac as the main bug/feature request tool? If
so, I'll add all the requests/bugreports from the sourceforge tracker
into Trac.

- Lee


On Mon, Jul 14, 2008 at 4:18 PM, Aaron Turner <syn...@gm...> wrote:
> Done.
>
> http://openpacket.synfin.net/trac/
>
> You can create your own user accounts by clicking 'register'.  I'll
> grant TRAC_ADMIN perms to anyone who'd like, just let me know.
>
> As for SVN, please send me the result from:
>
> htpasswd -ns <your_user_name>
>
> And I'll give you r/w or r/o perms as you request.  SVN url:
>
> https://www.synfin.net/svn/openpacket/
>
> If Sharri allows us to have access to the code, I'll turn off the Trac
> code browser feature for non-developers.
> --
> Aaron Turner
> http://synfin.net/
> http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
> They that can give up essential liberty to obtain a little temporary
> safety deserve neither liberty nor safety. -- Benjamin Franklin
>
> -------------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> Openpacket-mods mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/openpacket-mods
>

Re: [Openpacket-mods] OpenPacket.org future

[Aaron T. <syn...@gm...>]

Done.

http://openpacket.synfin.net/trac/

You can create your own user accounts by clicking 'register'.  I'll
grant TRAC_ADMIN perms to anyone who'd like, just let me know.

As for SVN, please send me the result from:

htpasswd -ns <your_user_name>

And I'll give you r/w or r/o perms as you request.  SVN url:

https://www.synfin.net/svn/openpacket/

If Sharri allows us to have access to the code, I'll turn off the Trac
code browser feature for non-developers.
-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -- Benjamin Franklin

Re: [Openpacket-mods] OpenPacket.org future

[JJ C. <cum...@gm...>]

I would suggest that we setup an svn repo frontended by something like Trac.

I have a few people that are willing to work on this project, this would 
provide a collaborative frontend as well as an issue tracking system so 
that users can create bug reports and suggest their own contributions.

Thoughts?

JJC

Aaron Turner wrote:
> Well I guess I was hoping for a reaction from my exit, but I didn't
> quite expect this...  and just to clarify, I never considered myself a
> "moderator".  I never moderated anything.  I consider myself an
> interested 3rd party hoping to see OpenPacket succeed and perhaps a
> role as a future contributor.
>
> I think Richard hit the nail on the head about the separation of the
> developer & leadership of the project being a major problem.  You need
> your core developers to find the site useful so they actually use it
> and have a vested interest in it's success rather then just being a
> way to show off their web-dev skills to prospective clients or doing a
> favor for a friend.
>
> Guillaume Fortaine <gui...@or...> expressed some interest
> earlier on the openpacket-devel list about working on the code- I'd
> hit him up.
>
> Unfortunately, I'm actively working on my own webapp- Cabernet (as
> well as a working at a startup, looking to buy a house, start
> motorcycle club racing and tcpreplay- whew!) so I really don't have
> time to commit to re-start the project from scratch.  I probably could
> be convinced to help maintain the existing code base and make
> improvements overtime, but I don't have a ton of free time and frankly
> my UI design skills are below average at best (proof:
> http://cabernetdemo.synfin.net) - an important skill when starting
> from scratch.
>
> It really sucks that Sharri won't open the code and apparently won't
> actively maintain it either, but I can understand her position.
> Richard, do you think you could get her to allow a select few to edit
> and not open the code to the world?  Basically, is she willing to
> allow others to help out?  If not, what does she suggest we do in
> light of her lack of participation?
>
> I'd be more then happy to host another SVN repository/trac instance or
> help set one up on another host for that matter... SF.net won't host
> non-open source projects.
>
> Lastly, I don't think it's a good idea to publicly announce Richard's
> departure and ask for someone to step forward as the new "project
> leader/developer".   It sends a message that the project is in
> complete disarray and will likely cause people to become less
> interested in the project which may reduce contributions.  Also, it
> would be better to gracefully hand off to someone(s) already involved
> and proven to have the interest in the project rather then someone who
> quickly gets bored.
>
> Anyways, I'm on #openpacket and I'll hang around at least until you
> guys have a solution in place or you decide I cause more trouble then
> I'm worth and ask me to leave. :)
>
>   

Re: [Openpacket-mods] OpenPacket.org future

[JJ C. <cum...@gm...>]

I will check around with some of my Dev type buddies and see what they  
think

Sent from the iRoad

On Jul 13, 2008, at 4:10 PM, "Richard Bejtlich"  
<tao...@gm...> wrote:

> Hello mods,
>
> Some of you may have noticed Aaron Turner's comments in IRC regarding
> his departure as a moderator.  He's raised good points and it makes me
> question the future of OpenPacket.org.  I've cc'd him on this email
> since I want him to know I take his points seriously.
>
> I think the separation of site leadership and site development is a
> mistake.  If I had not followed that path there would be no
> OpenPacket.org at all, but it's clear now that the current process is
> broken.
>
> My role in this project is also debatable.  My day job is keeping me
> busier than ever, and my night job (family) occupies my remaining
> time.  I am open to handing project leadership to someone with the
> time to lead and the development skills to recreate and maintain the
> site.
>
> If anyone here is interested in taking over, please let me know.
> Otherwise, I will post to the openpacket-devel and -users lists, then
> finally to my blog.  I'm looking for someone to completely
> re-implement the site, since I do not think Sharri will release the
> code to us.
>
> Sincerely,
>
> Richard
>
> --- 
> ----------------------------------------------------------------------
> Sponsored by: SourceForge.net Community Choice Awards: VOTE NOW!
> Studies have shown that voting for your favorite open source project,
> along with a healthy diet, reduces your potential for chronic lameness
> and boredom. Vote Now at http://www.sourceforge.net/community/cca08
> _______________________________________________
> Openpacket-mods mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/openpacket-mods

[Openpacket-mods] OpenPacket.org future

[Richard B. <tao...@gm...>]

Hello mods,

Some of you may have noticed Aaron Turner's comments in IRC regarding
his departure as a moderator.  He's raised good points and it makes me
question the future of OpenPacket.org.  I've cc'd him on this email
since I want him to know I take his points seriously.

I think the separation of site leadership and site development is a
mistake.  If I had not followed that path there would be no
OpenPacket.org at all, but it's clear now that the current process is
broken.

My role in this project is also debatable.  My day job is keeping me
busier than ever, and my night job (family) occupies my remaining
time.  I am open to handing project leadership to someone with the
time to lead and the development skills to recreate and maintain the
site.

If anyone here is interested in taking over, please let me know.
Otherwise, I will post to the openpacket-devel and -users lists, then
finally to my blog.  I'm looking for someone to completely
re-implement the site, since I do not think Sharri will release the
code to us.

Sincerely,

Richard

Re: [Openpacket-mods] Question on trace license

[JJ C. <cum...@gm...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Could be an agreement that the user agrees to prior to being a user.... 
like a user agreement and in there it's included.

I like BSD licensing of course.

Richard Bejtlich wrote:
| Hello OpenPacket.org mods,
|
| Dakrone suggested we attach a license to our traces.  I am interested
| in your thoughts:
|
| 1. What license?  I lean towards BSD.
| 2, How to state it?  Is publication on the Web site sufficient?  I
| don't see a way to "tag" traces and I don't think it is needed anyway.
|
| Thank you,
|
| Richard
|
| -------------------------------------------------------------------------
| This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
| Don't miss this year's exciting event. There's still time to save $100.
| Use priority code J8TL2D2.
| 
http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
| _______________________________________________
| Openpacket-mods mailing list
| Ope...@li...
| https://lists.sourceforge.net/lists/listinfo/openpacket-mods
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)

iEYEARECAAYFAkgi/OMACgkQZ17WnJjeIzkO+QCfWE1irMaDsW7oro/iGP52Nuzr
/fsAnRA7uLtzagVWtBYXvH/6XvWiqO21
=LzaB
-----END PGP SIGNATURE-----

Re: [Openpacket-mods] Question on trace license

[CS L. <ge...@gm...>]

Hi guys,

BSD license, so that it is free to modify or do whatever they want with the
pcap. Just publication on the web site should be sufficient i think, and
provide the universal bsd license copy if anyone want to download them.

just my 2 cents.

Cheers ;]

On Thu, May 8, 2008 at 6:56 PM, Richard Bejtlich <tao...@gm...>
wrote:

> Hello OpenPacket.org mods,
>
> Dakrone suggested we attach a license to our traces.  I am interested
> in your thoughts:
>
> 1. What license?  I lean towards BSD.
> 2, How to state it?  Is publication on the Web site sufficient?  I
> don't see a way to "tag" traces and I don't think it is needed anyway.
>
> Thank you,
>
> Richard
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> Don't miss this year's exciting event. There's still time to save $100.
> Use priority code J8TL2D2.
>
> http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> _______________________________________________
> Openpacket-mods mailing list
> Ope...@li...
> https://lists.sourceforge.net/lists/listinfo/openpacket-mods
>



-- 
Best Regards,

CS Lee<geek00L[at]gmail.com>

http://geek00l.blogspot.com

[Openpacket-mods] Question on trace license

[Richard B. <tao...@gm...>]

Hello OpenPacket.org mods,

Dakrone suggested we attach a license to our traces.  I am interested
in your thoughts:

1. What license?  I lean towards BSD.
2, How to state it?  Is publication on the Web site sufficient?  I
don't see a way to "tag" traces and I don't think it is needed anyway.

Thank you,

Richard

Re: [Openpacket-mods] EmergingThreats VS OpenPacket

[Richard B. <tao...@gm...>]

On Thu, Apr 24, 2008 at 8:36 AM, CS Lee <ge...@gm...> wrote:
> Hi Richard,
>
> I have initiated the conversation with jonkman and you can find them in the
> attachment.
>
> We have had the conclusion of the collaboration work yet, but what Jonkman
> want is to contribute the pcap from his sandnet and the payload needs to be
> sanitized to avoid the revelation of his sandnet, He will permit me to login
> to his sand net and see how we can do the job better. Maybe pcap tagging is
> good but at the end the sanitizing needs to be done manually though.
>
> Cheers all!!!!!
>
> --
> Best Regards,
>
> CS Lee<geek00L[at]gmail.com>
>

Thanks CS.  Let me know what you find.  This is directly applicable:

http://www.ics.forth.gr/~antonat/nda08.html

The 1st ACM Workshop on Network Data Anonymization (NDA 2008)

Sincerely,

Richard

[Openpacket-mods] EmergingThreats VS OpenPacket

[CS L. <ge...@gm...>]

<jonkman> morning
<geek00l> per richard request, i will be coordinating between emergingthreats and openpacket
<jonkman> cool!
<geek00l> which means working together with you
<geek00l> so what do  you have in mind?
<jonkman> sorry for you :)
<geek00l> haha
<jonkman> I'd like a way to share our pcaps from the sandnet
<jonkman> but have to figure a way to:
<jonkman> 1 document what's in each
<jonkman> 2. sanitize them so my zombies/methods aren't shown
<geek00l> yes, most probably
<jonkman> have about 20k pcaps, some small, some hundreds of megs....
<geek00l> ah
<geek00l> need semi auto way to do it
<geek00l> first of all, the sanitizing is on header only or payloads too?
<jonkman> ya...
<jonkman> payloads primarily
<jonkman> they're in private IP space
<geek00l> dang
<jonkman> but there are IP lookups that reveal real IPs, etc
<geek00l> okay, the header doesn't matter now
<jonkman> netbios names,
<geek00l> yes
<geek00l> and something like ftp also reveals thing
<jonkman> we could just have an auto way to submit interesting ones...
<jonkman> ya
<geek00l> but you come to the point which it really hurts
<geek00l> sanitizing payload is more challenging
<jonkman> ya
<geek00l> while not losing the point 
<jonkman> maybe we don't make it known where they're from...
<jonkman> then it's not necessarily revealing...
<geek00l> i think i have this discussion with chris lee before
<geek00l> similar
<geek00l> he want to share his pcap from his honeynet
<jonkman> ya..
<geek00l> dns must be killed 
<geek00l> all host lookup shit must be killed
<geek00l> 20K pcaps
<geek00l> ouch
<jonkman> Ya, I use dummy domains for the sandnet, don't want to reveal those
<jonkman> best bet may be for me to jsut make a way for the analyst to hit a button to mark a pcap as interesting
<geek00l> okay
<jonkman> and needing to be considered for submitting
<jonkman> then we can hand sanitize maybe...
<geek00l> yes
<geek00l> tagging would be good
<geek00l> tag to be sanitized
<jonkman> ya
<geek00l> okay dude
<jonkman> you'll see what I mean and what we have, maybe you'll have an idea
<jonkman> will be back online this evening probably
<geek00l> need to look at that
<geek00l> thanks a lot
<jonkman> ya, it's schweet :)
<jonkman> later
<geek00l> have fun
<geek00l> !!!!!

[Openpacket-mods] OpenPacket.org guidelines

[Richard B. <tao...@gm...>]

Everyone,

Nate volunteered to write some guidelines for using OpenPacket.org,
and I think he did a great job.  I've attached them here and added a
few items, notably a line about responsible disclosure.

If no one objects by this Thursday I'll ask Sharri or JJ to post the
guidelines on the Web site.

Thank you,

Richard

PS:  JJ -- please join the
https://lists.sourceforge.net/lists/listinfo/openpacket-mods mailing
list when you get a chance.

Also, all -- please let me know your Sourceforge username so I can add
you to the Sourceforge site.

[Openpacket-mods] Welcome to the list

[Richard B. <tao...@gm...>]

This is a first post to test archive creation.

Richard