RE: [Full-Disclosure] MS should point windowsupdate.com to 127.0.0.1

["Schmehl, Paul L" <pauls@utdallas.edu>]

> -----Original Message-----
> From: Jeremiah Cornelius [mailto:jeremiah@nur.net] 
> Sent: Friday, August 15, 2003 12:34 PM
> To: Schmehl, Paul L
> Cc: full-disclosure@lists.netsys.com
> Subject: Re: [Full-Disclosure] MS should point 
> windowsupdate.com to 127.0.0.1
> 
> Paul,
> Yours was EXACTLY the scenario for which HOGWASH - a 
> filtering proxy based on snort - was written.  The hogwash 
> project was eventually due to be folded back into the 
> mainline snort code base.  I don't know if this has happened yet.
> 
http://hogwash.sourceforge.net/docs/overview.html

I'm aware of that.  I use snort here.  I didn't provide *all* the
details of this scenario, because the point wasn't to solicit a
solution, but to present a dilemma to the know-it-alls and see whether
they had even considered any alternatives.

At any rate, love snort, love open source, gentoo rules, microsoft
sucks, hoo rah and all that good stuff.

Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html