full-disclosure - Blocking Music Sharing.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1063765998.3176.80.camel@tantor.nuclearelephant.com>
From: jonathan at nuclearelephant.com (Jonathan A. Zdziarski)
Subject: Blocking Music Sharing.

> >
> > I heartily disagree -- if an offense is considered serious enough to
> > warrant being prohibited in an org's Acceptable Use Policy then there
> > should be real punishment involved.  If an offense isn't a big deal,
> > then the AUP should be rewritten.
> >

My belief is that proactive prevention should always be tried before
even getting to this level; there should be differing levels of severity
in punishment for those who violate the AUP, but I see no reason not to
block the common ports as a first attempt.  Nearly every company has a
corporate firewall (or at least should).  Many P2P sharing tools are on
obscure ports that could easily be blocked.  Even a half-baked firewall
policy ought to be able to prevent sharing.

> > A Wall of Shame just sets a bad precedent -- a user could argue that the
> > rules were ambiguous.  "What?  You can't fire me for running that root
> > exploit!  None of the other rules were ever seriously enforced, our
> > policy is a joke!"

Exposing employees instead of dealing with situations privately is
always bad politics, and can be an easy way to kill morale (not to
mention bring on a lawsuit by an embarrassed employee).  Enforce the AUP
in a private, civil manner.  

Bottom line is if management won't back the admin's attempts to stop
things like this from the office, and the admin can't (for whatever
reason) prevent it from a technical level, then the admin has no place
in taking upon themself to embarrass or discipline employees.  There's
no place for BOFH in today's corporate environment (IMHO at least) and
things like this are unfortunately what gives seed to many admin types
I've either fired or wanted to choke to death in the past.

Let management enforce the AUP in a professional manner, taking the
issue seriously or not at all.