![](/i/fill.gif) |
![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
And lo on Fri, 04 Jul 2008 12:01:07 +0100, Jim Henderson
<nos### [at] nospam com> did spake, saying:
> On Fri, 04 Jul 2008 11:27:26 +0100, Invisible wrote:
>
>>>> No problem. There's no charge for this service. Please contact Phil
>>>> Cook in my absence. ;-)
But I charge by the word.
>>> And another laugh. I might actually get some sleep yet tonight. :-)
>>
>> Yeah - dude, what the hell?? WHY ARE YOU AWAKE?! x_x
>
> Right now because I'm talking to you. 5 AM now.
>
> Today's the 4th of July here, so I don't have to work today.
Too many giant spaceships hovering over the cities causing congestion?
Pfft uppity colonials, you don't see us celebrating Consitutional Monarchy
Day.
--
Phil Cook
--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
>>>>> No problem. There's no charge for this service. Please contact Phil
>>>>> Cook in my absence. ;-)
>
> But I charge by the word.
He does, you know...
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Invisible wrote:
> As does the fact that SSL and TLS both run over TCP, yet OpenVPN seems
> to be using UPD. That looks like a big enough deviation from the
> standard that I'm left wondering how many design decisions have been
> made with potential security implications.
Yes, exactly. That, and all the other things you might want to do (like
be behind a NAT) that OpenVPN doesn't handle.
Note that SSL and TLS are both technologically the same thing. The
difference is in provisioning. That is, it's SSL if you start the
protocol dance as soon as you open the port (because you're talking on
port 443 instead of port 80, for example). It's TLS if you open the
connection, do some negotiation, *then* start encrypting, such as with
BEEP or Secure SMTP or anything else that has a "STARTTLS" command.
--
Darren New / San Diego, CA, USA (PST)
Helpful housekeeping hints:
Check your feather pillows for holes
before putting them in the washing machine.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
>> As does the fact that SSL and TLS both run over TCP, yet OpenVPN seems
>> to be using UPD. That looks like a big enough deviation from the
>> standard that I'm left wondering how many design decisions have been
>> made with potential security implications.
>
> Yes, exactly. That, and all the other things you might want to do (like
> be behind a NAT) that OpenVPN doesn't handle.
I thought I saw somewhere that OpenVPN *does* work with NAT, but IPSec
doesn't. (Because NAT involves packet modification, which IPSec is
obviously designed to prevent.)
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Orchid XP v8 wrote:
> I thought I saw somewhere that OpenVPN *does* work with NAT, but IPSec
> doesn't. (Because NAT involves packet modification, which IPSec is
> obviously designed to prevent.)
No, what they said was that if you want IPSec to work with NAT, you had
to exclude the IP addresses from the hash calculation with a
configuration. Since OpenVPN never even offers the opportunity to
include the IP addresses, it's "simpler" and therefore more secure.
Huh?
--
Darren New / San Diego, CA, USA (PST)
Helpful housekeeping hints:
Check your feather pillows for holes
before putting them in the washing machine.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 15:17:37 +0100, "Phil Cook"
<phi### [at] nospamrocain freeserve co uk> wrote:
>
>Pfft uppity colonials, you don't see us celebrating Consitutional Monarchy
>Day.
A bit late but I always celebrate "Good Riddance Day" ;)
--
Regards
Stephen
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 18:40:54 +0100, Orchid XP v8 wrote:
> I thought I saw somewhere that OpenVPN *does* work with NAT, but IPSec
> doesn't. (Because NAT involves packet modification, which IPSec is
> obviously designed to prevent.)
IPSec can work over NATted connections, you just need a router that will
handle it. The last couple Linksys routers I've had (and the Belkin I
currently own, IIRC) have supported IPSec over NAT.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 13:33:49 +0100, Invisible wrote:
> Jim Henderson wrote:
>
>> Ah, I see. There are so many Jamies' in the world.
>
> And I kinda promised that if I ever have children... well, there'll be
> *another* Jamie in the world. ;-)
:-)
>> But hey, it sounds
>> like you've got at least *one* friend. Actually, though, I know you
>> have more than that. ;-)
>
> Meh. There are people I sometimes speak to on teh interwebs. But human
> beings that I can actually go hang out with? Now that's a tiny list. :-(
Hey, the same goes here. Offhand, I can think of about 2 people outside
of work that I will just hang out with - and they're my immediate
family. I'll occasionally have lunch with one of my instructors or
coworkers at lunch. Very occasionally, I'll get together with the
neighbors across the alley from us, or the ones next door to us.
>>> Seriously, Zazzle boasts that you can have your order within 24 hours,
>>> but that's only actually true if you line in North America. For the
>>> rest of the world... it takes rather a long time. :-( I wish they
>>> would set up a facility somewhere in mainland Europe...
>>
>> Seems a lot of companies operate that way. We have a similar
>> experience when ordering DVDs from amazon.co.uk as well.
>
> Really? I usually find Amazon to be quite good...
You're not in the US ordering from a.co.uk, though. When I order from
Amazon US, delivery time is just fine - but from the UK, it takes a while
longer.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Fri, 04 Jul 2008 15:17:37 +0100, Phil Cook wrote:
> And lo on Fri, 04 Jul 2008 12:01:07 +0100, Jim Henderson
> <nos### [at] nospam com> did spake, saying:
>
>> On Fri, 04 Jul 2008 11:27:26 +0100, Invisible wrote:
>>
>>>>> No problem. There's no charge for this service. Please contact Phil
>>>>> Cook in my absence. ;-)
>
> But I charge by the word.
>
>>>> And another laugh. I might actually get some sleep yet tonight. :-)
>>>
>>> Yeah - dude, what the hell?? WHY ARE YOU AWAKE?! x_x
>>
>> Right now because I'm talking to you. 5 AM now.
>>
>> Today's the 4th of July here, so I don't have to work today.
>
> Too many giant spaceships hovering over the cities causing congestion?
Yeah, something like that.
> Pfft uppity colonials, you don't see us celebrating Consitutional
> Monarchy Day.
Heh, well, I know a number of Brits who celebrate having rid themselves
of us, so that's fair. ;-) As for us, we celebrated by calming cats
during the fireworks - but the fireworks themselves have been very muted
this year out here.
Oh, and I cooked us some *excellent* steaks. I managed - for the first
time - to cook medium-rare steaks instead of cooking them until they were
charcoal. You'd be able to see more about it in my LJ.
It's kinda ironic - I'm perfectly happy having some reheated pizza or
canned soup, but I somehow do seem to pull together some pretty good home
cooked food every once in a while - and I enjoy it, which just really
surprises me.
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
On Sat, 05 Jul 2008 17:34:55 +0100, Stephen wrote:
> On Fri, 04 Jul 2008 15:17:37 +0100, "Phil Cook"
> <phi### [at] nospamrocain freeserve co uk> wrote:
>
>
>>Pfft uppity colonials, you don't see us celebrating Consitutional
>>Monarchy Day.
>
> A bit late but I always celebrate "Good Riddance Day" ;)
See, Phil? This is what I was just saying. ;-)
Jim
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |