Host-based IDS

Host-based systems are installed on the server or desktop and  can monitor not only network traffic but also key files, events and logs. They have lower level of false positives then NIDS.  For more informatrion see Architectural Issues of Intrusion Detection Infrastructure in Large Enterprises

 We can distinguish:

• Kernel based subsystems like SELinux and, especially, AppArmor
• Solaris Zones and similar light-weight virtualization solutions that isolate one application from others.
• RBAC (see Solaris RBAC) and similar role based mechanisms
• Firewall-based HIDS  combine intrusion detection and packet filtering. It can be TCP/IP only like Xinetd and TCP Wrappers or packet firewall like Linux iptables.  In any case firewalls has higher returns on investment the NIDS. See firewalls
   
• Integrity checkers Tripwire is good example of  traditional integrity checker. It has its strong point and weakness that are discussed on a separate page.  Generally Tripwire is too primitive and is not a good choice for HIDS.
   
• Log analyzers -- this type of HIDS have the highest level of useful signal to noise ration and deserve more attention and investment that other types. See special page (Log analyzers ) devoted to this kind of IDS (although they are mostly used not for IDS but for regular troubleshooting.
   
• Honeypots - this over-hyped concept is essentially an instance of OS (usually virtual partition) with a combination of IDS installed or a regular network sensor with an additional services on vulnerable ports configured as honeypot ports (honeyport :-). Honeypots specifically designed to detect attacks and suspicious traffic and they usually do not perform any other useful function (or such a function is faked).  One extremely positive thing about honeypot is that it can be very cheap (a desktop computer with Linux and some IDS software suffice) and have lower noise to useful signal ration then traditional network IDS. Most non-broadcast type of network traffic directed toward them is anomalous from the point of view of normal network functioning as this is a passive device that just listening to the traffic and normally nobody should try to connect to it or scan it.  Actually some types of intrusion detection are simpler and more reliably performed on honeypots  (port scanning attempts, etc). Here is the definition from http://www.honeypots.net/

  Honeypots are closely monitored network decoys serving several purposes: they can distract adversaries from more valuable machines on a network, they can provide early warning about new attack and exploitation trends and they allow in-depth examination of adversaries during and after exploitation of a honeypot.

Robust intrusion detection requires multi-level approach and the return on investment is much higher on the host level than, say, on network level.

Tools such as Solaris Zones, RBAC, AppArmor can provide tremendous return on investment and cost nothing (they come free with Solaris and suse Linux respectively).

Each server has the ability to provide useful information about intrusions attempts via log. So syslog integration is one of the most important things in host based intrusion detection and probably the first thing to do.

Firewall logs are especially useful as connection to rogue ports are instant sign that something is wrong or that the box is scanned.   

There are a couple of important scripts that can be installed on each box:

• Analyzer of the last log (any successful connection from IP outside "approved set of IPs) should generally create an alarm. This is very simple but at the same time extremely effective tool
• Analyzer of  integrity of critical configuration files or the whole /etc/directory. Changes that are performed on the box configuration file should be immediately reported.

NEWS CONTENTS

• 20110404 : how-to-set-up-kippo-ssh-honeypot-on-centos-5 ( how-to-set-up-kippo-ssh-honeypot-on-centos-5, Apr 04, 2011 )

Old News ;-)

[Apr 04, 2011] how-to-set-up-kippo-ssh-honeypot-on-centos-5

How To Set Up Kippo SSH Honeypot On CentOS 5.5

Kippo is a medium interaction SSH honeypot designed to log brute force attacks and, most importantly, the entire shell interaction performed by the attacker. Kippo is inspired, but not based on Kojoney. If you need more information about Kippo please visit its official site on http://code.google.com/p/kippo/. This tutorial shows how you can compile and install Kippo on a CentOS 5.5 server.

I do not issue any guarantee that this will work for you!

Python 2.6 Installation As you already know, CentOS only comes with Python 2.4, so you need to install Python 2.6 by using the tutorial from the following link:

http://www.geekymedia.com/tech-articles/rhel5-centos5-rpms-for-python-2-5-and-2-6/.

Important Notes!:

1) Just install the RPMs for the version that you want. You will need at least the base python version package and the libs package.

2) To start Python 2.6, type python26 at your command line rather than python. (Your original Python 2.4 is still installed.)

3) If you are installing packages with setuptools, make sure to use the correct python version. (i.e. python26 setup.py install)

Twisted, Zope Interface And Pycrypto Installation

Twisted is an event-driven networking engine written in Python and licensed under the MIT license. Twisted projects variously support TCP, UDP, SSL/TLS, multicast, Unix sockets, a large number of protocols (including HTTP, NNTP, IMAP, SSH, IRC, FTP, and others), and much more.

cd /tmp wget http://twistedmatrix.com/Releases/Twisted/10.2/Twisted-10.2.0.tar.bz2 tar -xvf Twisted-10.2.0.tar.bz2 cd Twisted-10.2.0 python26 setup.py build python26 setup.py install

Zope is an open source web application server primarily written in the Python programming language.

cd /tmp wget http://www.zope.org/Products/ZopeInterface/3.3.0/zope.interface-3.3.0.tar.gz tar -xvf zope.interface-3.3.0.tar.gz cd zope.interface-3.3.0 python26 setup.py build python26 setup.py install

Pycrypto is a collection of cryptographic algorithms and protocols, implemented for use from Python.

cd /tmp wget wget http://www.amk.ca/files/python/crypto/pycrypto-2.0.1.tar.gz tar -xvf pycrypto-2.0.1.tar.gz cd pycrypto-2.0.1 python26 setup.py build python26 setup.py install

ASN.1 types and codecs (BER, CER, DER) implementation in Python programming language.

cd /tmp wget http://sourceforge.net/projects/pyasn1/files/pyasn1-devel/0.0.12a/pyasn1-0.0.12a.tar.gz/download tar -xvf pyasn1-0.0.12a.tar.gz cd pyasn1-0.0.12a python26 setup.py build python26 setup.py install

Create Regular User Kippo doesnt run under root user! So we must create a regular user.

useradd kippouser

Download Kippo Source Package You need to download latest version of Kippo source package from http://kippo.googlecode.com.

su - kippouser wget http://kippo.googlecode.com/files/kippo-0.5.tar.gz tar -xvf kippo-0.5.tar.gz cd kippo-0.5

Configure Kippo vi kippo.cfg

	vi kippo.cfg 

#
# Kippo configuration file (kippo.cfg)
#
[honeypot]
# IP addresses to listen for incoming SSH connections.
#
# (default: 0.0.0.0) = any address
#ssh_addr = 0.0.0.0
# Port to listen for incoming SSH connections.
#
# (default: 2222)
ssh_port = 2222
# Hostname for the honeypot. Displayed by the shell prompt of the virtual
# environment.
#
# (default: sales)
hostname = sales
# Directory where to save log files in.
#
# (default: log)
log_path = log
# Directory where to save downloaded (malware) files in.
#
# (default: dl)
download_path = dl
# Directory where virtual file contents are kept in.
#
# This is only used by commands like 'cat' to display the contents of files.
# Adding files here is not enough for them to appear in the honeypot - the
# actual virtual filesystem is kept in filesystem_file (see below)
#
# (default: honeyfs)
contents_path = honeyfs
# File in the python pickle format containing the virtual filesystem. 
#
# This includes the filenames, paths, permissions for the whole filesystem,
# but not the file contents. This is created by the createfs.py utility from
# a real template linux installation.
#
# (default: fs.pickle)
filesystem_file = fs.pickle
# Directory for miscellaneous data files, such as the password database.
#
# (default: data_path)
data_path = data
# Directory for creating simple commands that only output text.
#
# The command must be placed under this directory with the proper path, such
# as:
#   txtcmds/usr/bin/vi
# The contents of the file will be the output of the command when run inside
# the honeypot.
#
# In addition to this, the file must exist in the virtual
# filesystem {filesystem_file}
#
# (default: txtcmds)
txtcmds_path = txtcmds
# Public and private SSH key files. If these don't exist, they are created
# automatically.
#
# (defaults: public.key and private.key)
public_key = public.key
private_key = private.key
# Initial root password. Future passwords will be stored in
# {data_path}/pass.db
#
# (default: 123456)
password = 123456
# IP address to bind to when opening outgoing connections. Used exclusively by
# the wget command.
#
# (default: not specified)
#out_addr = 0.0.0.0
# Sensor name use to identify this honeypot instance. Used by the database
# logging modules such as mysql.
#
# If not specified, the logging modules will instead use the IP address of the
# connection as the sensor name.
#
# (default: not specified)
#sensor_name=myhostname
# Fake address displayed as the address of the incoming connection.
# This doesn't affect logging, and is only used by honeypot commands such as
# 'w' and 'last'
#
# If not specified, the actual IP address is displayed instead (default
# behaviour).
#
# (default: not specified)
#fake_addr = 192.168.66.254
# MySQL logging module
#
# Database structure for this module is supplied in doc/sql/mysql.sql
#
# To enable this module, remove the comments below, including the
# [database_mysql] line.
#[database_mysql]
#host = localhost
#database = kippo
#username = kippo
#password = secret
 

Start Kippo ./start.sh

Log File By default kippo output will be redirected to the file log/kippo.log. To see the Kippo logging data use the following command:

tail -f log/kippo.log

Note: How To Make Kippo Accessible To The World! By default,Kippo is running on port 2222. If its running on Windows, port 22 is usually free and it's ok to run kippo on that port. On linux, port 22 is restricted for root only, except if you do this (quote from #twisted):

iptables -t nat -A PREROUTING -i IN_IFACE -p tcp --dport 22 -j REDIRECT --to-port 2222

Replace IN_IFACE with your real interface name such as eth0!

Testing Connect to the Kippo server on port 2222 by using root as username and 123456 as password.

ssh 127.0.0.1 -p 2222 -l root

You must see the following banner after successful login:

sales:~#

www.daemon.de - NabouConfig

www.daemon.de - Nabou

Nabou is a system integrity monitor. That means, it runs every night and watches for changes on files. If a file has changed in any way, it will inform you by email(if you prefer that). Beside of this it can also look for changed or added user accounts, cronjobs, weird processes and suid files. And you can define your own checks using inline scriptlets.

It stores the properties for each file in a dbm database and will warn you if something has been changed on a file. The most important thing to check for, is the MD5-checksum. This checksum will never be the same if the file content has changed even if only one letter has changed. But you can also look for some other properties, like ownership or filemode. See the section configuration for more details on that!

nabou requires perl and some Perl Modules.

If you are interested, here is a sample report generated by a nabou check run.

Securing Debian Manual - After Installation

Are you sure /bin/login on your hard drive is still the binary you installed there some months ago? What if it is a hacked version, which stores the entered password in a hidden file or mails it in cleartext version all over the internet?

The only method to have some kind of protection is to check your files every hour/day/month (I prefer daily) by comparing the actual and the old md5sum of this file. Two files cannot have the same md5sum (the MD5 digest is 128 bits, so the chance that two different files will have the same md5sum is roughly one in 3.4e3803), so you're on the safe site here, unless someone has also hacked the algorithm that creates md5sums on that machine. This is, well, extremely difficult and very unlikely. You really should consider this auditing of your binaries as very important, since it is an easy way to recognize changes at your binaries. Common tools used for this are sXid, AIDE (Advanced Intrusion Detection Environment), TripWire (non-free; the new version will be GPL), integrit and samhain.

Installing debsums will help to check the filesystem integrity, by comparing the md5sums of every file against the md5sums used in the Debian package archive. But beware, those files can easily be changed.

Furthermore you can replace locate with slocate. slocate is a security enhanced version of GNU locate. When using slocate, the user only sees the files he really has access to and you can exclude any files or directories on the system.

Setting up setuid check

Debian provides a cron job that runs daily in /etc/cron.daily/standard. This cron job will run the /usr/sbin/checksecurity script that will store information of this changes.

In order for this check to be made you must set CHECKSECURITY_DISABLE="FALSE" in /etc/checksecurity.conf. Note, this is the default, so unless you have changed something, this option will already be set to "FALSE".

The default behavior does not send this information to the superuser but, instead keeps daily copies of the changes in /var/log/setuid.changes. You should set the CHECKSECURITY_EMAIL (in /etc/checksecurity.conf) to 'root' to have this information mailed to him. . See checksecurity(8) for more configuration info.

Recommended Links

Softpanorama Recommended

Top articles

Sites

Honeypots, Intrusion Detection, Incident Response

Neohapsis Archives

Random Findings

Intrusion Detection Solutions Dragon Squire - Host Intrusion Detection

Why host based IDS?
Enterasys developed the Dragon Squire product line as a host based IDS for several reasons. First, simply put, NIDS have a real difficult time with encrypted traffic. Dragon Sensor has signatures which look for SSH activity, but no NIDS including Dragon Sensor can see inside that SSH session and look for login failures. Another large protocol which NIDS cannot decode are secure web transactions protected with SSL. Second, even though we think Dragon Sensor is one of the most advanced NIDS in existence, we believe that a determined hacker will bypass the NIDS and achieve compromise on a sensitive system host. This also accounts for a strong insider threat. Once an attacker has achieved system access, they may do something which will generate network activity and be detected by Dragon Sensor, but it is more likely that the attacker will do something directly to the targeted computer which will be detected by Dragon Squire. Any finally, our third reason to produce a HIDS was to be able to leverage it as a secure log aggregator to process router logs, firewall logs and many other sources of security information.

System Log Analysis
Dragon Squire is placed directly on key servers. Once loaded, it can be directed to monitor (or tail) key system log files and monitor them for suspicious activity. In the case of Windows NT and 2000, Dragon Squire can monitor the NT event log for activity as well.

Syslog Analysis
For routers and firewalls which do not have a local operating system to run Dragon Squire, libraries to analyze the Syslog messages from those devices can be placed on a dedicated log server which runs Dragon Squire. For example, a router farm could use Syslog to send events to a dedicated Linux server running the Dragon Squire software and the libraries for the logs from the routers. In this case, Dragon Squire does not receive or process the Syslog message directly, and instead relies on the underlying system to process the Syslog messages. This allows Dragon Squire to work with many forms of Syslog such as Secure Syslog and K-Syslog.

SNMP Trap Analysis
Dragon Squire can receive and process SNMP v1 traps. Dragon Squire receives the SNMP trap and produces a field of SNMP OIDs and their values. Signatures are available to process the SNMP trap for specific OID and value combinations.

MD5 File Analysis
Dragon Squire performs MD5 checksum analysis on key files. It stores these MD5 checksums in a local file and on the Dragon Policy Manager. If the contents of a monitored file changes, the MD5 value will changes and an alert can be generated. This detects backdoors and other potentially harmful files modifications.

Low System Impact
Dragon Squire has been designed to minimize system impact. All system performance varies greatly from operating system to operating system as well as server load and network activity. Dragon Squire has a very small footprint that takes up little memory and hard drive space for logs.

Cisco IDS (Formerly NetRanger) � Intrusion Detection System
... Software Technical Specifications for IDS Host Sensor (Standard Agents). ... Technical
Specifications for Host IDS Sensor (Web Server Edition). ...
www.cisco.com/univercd/cc/td/doc/pcat/nerg.htm - 11k - Cached - Similar pages

Installing and Configuring the Cisco IDS Host Sensor on ...
... Installing and Configuring the Cisco IDS Host Sensor on CallManager 3.0 and 3.1.
Contents. ... Caveats. Using Cisco Host IDS Sensor Agent and McAfee NetShield. ...
www.cisco.com/warp/public/788/ AVVID/ids_host_sensor_cm.html - 21k - Cached - Similar pages
[ More results from www.cisco.com ]

Neohapsis Archives - IDS List - IDS Re RE Host IDS - From [email protected]

SF Focus-IDS Mailing List FAQ

Table Of Contents

1. What is Intrusion Detection?
   
2. What is the difference between Host based (HIDS) and Network based IDS(NIDS)?
   
3. Who is Stephen Entwisle and why does he send a newsletter every week?
   
4. Who are the 31173 on this list?
   
5. I see snippets of output like:
   
6. I always see Snort being mentioned. Is it the most popular NIDS?
   
7. What tools can be used for building packets?
   
8. What are some personal IDS/firewalls?
   
9. Where can I find a list of Inrusion Detection Systems?
   
10. How can I test my IDS?
    
11. What is a false positive?
    
12. What is a false negative?
    
13. Why do discussions on Intrusion Detection seem to have a bias towards Linux / UNIX ?
    

---

Questions Specific to Intrusion Detection and this list

1:   What is Intrusion Detection?

Intrusion Detection is the active process to document and catch
attackers and malicious code on a network. It is described in
two types of software: Host based software and Network based software.

2:   What is the difference between Host based (HIDS) and Network based IDS(NIDS)?

HIDS is software which reveals if a machine is being or 
has been compromised. It does this by checking the files
on the machine for possable problems.  Software described
as host based IDS could include File Integrity checkers (TripWire),
Anti-virus software (Norton AV), Server Logs (Event viewer or syslog),
and in some ways even backup software can be a HIDS.

NIDS is software which monitors network packets and examines them
against a set of signatures and rules. When the rules are violated
the action is logged and the Admin could be alerted. 
Examples of NIDS software are SNORT, ISS Real Secure, and Network Flight Recorder.

3:   Who is Stephen Entwisle and why does he send a newsletter every week?

Stephen works for Security Focus. He worked as a moderator and editor of
different announcements. The weekly newsletter is a summary of vulnerabilities
and security papers announced that week. It is convenient to have the 
newsletter to keep up with the latest security issues without having
to check every day.

4:   Who are the 31173 on this list?

Dug Song: Security expert who wrote the tool fragrouter and runs monkey.org.
Robert Graham:CTO of the networkICE (Bought by ISS) Wrote great FAQs.
Martin Roesch: Author of SNORT
Max Vision: Runs www.whitehats.com. Keeps a database of attack signature information known as arachNIDS.
Marcus Ranum: CTO of Network Flight Recorder (one of the bets known NIDS). See his offical bio here
Ron Gula: A large contributor to SNORT and CTO of Dragon NIDS. He also has an offical bio here

5:   I see snippets of output like: 

Jan 26 12:43:01 207.236.111.23:49658 -> MY.SUB.NET.1:56023 UDP
Jan 26 12:43:01 207.236.111.23:49658 -> MY.SUB.NET.1:56034 UDP
Jan 26 12:43:01 207.236.111.23:49658 -> MY.SUB.NET.1:56035 UDP

What is this output from?

As a whole, this is the type of output you will examine with a 
Network Intrustion Detection System. The above lines could have been
taken from a network sniffer like TCPDUMP or from a NIDS like SNORT.
Once you understand the basics about reading network sniffer ouptut, 
you can communicate with others about odd network traffic and understand
the output above. 

6:   I always see Snort being mentioned. Is it the most popular NIDS?

It is very popular for a few reasons:
1) The author of the program reads and replies to this list (See who are the 31173 question)
2) It is constantly improving from it's user feedback and the author's persistence.
3) It has both UNIX/Linux and Windows versions.
4) It's FREE!

Is it the top of the line NIDS? No. It is however a very good tool
to get started with NIDS. It has a serious place in any production network.

7:   What tools can be used for building packets?

hping
isic
Trinux a floppy distro of Linux, 
contains the above tools plus more.

8:   What are some personal IDS/firewalls?

While they don't fit into the enterprise class of IDS, there are several programs that
can provide firewall and IDS services for a single user/pc.  Here are a few:

Black Ice Defender
Symantec Personal Firewall
McAfee Firewall V2.1 
ZoneAlarm

9:   Where can I find a list of Inrusion Detection Systems?

http://www.networkintrusion.co.uk

10:  How can I test my IDS?
We suggest the following steps:
1) Place the NIDS on a test network with a hub and a separate server.
2) Run the tool Nessus against the separate server.
3) When Nessus is done, what attacks did it detect ? If it did not detect all the attacks
does the NIDS have the latest signatures ? Can you write your own rules for the NIDS to 
catch the attack ?
4) After the tests with Nessus, then run the packet building tools. Make various illegal packets
and aim them at the separate server. Does it detect the packets ? Also use frgroutr
against it to see how it handels fragmented packets.
5) Repeat steps 2 - 4 against the NIDS machine.
6) Harden the NIDS to help prevent it from being compromised.
7) Place it on the production network and see how many false positives it gets.
8) Tune it down from the false positives.
9) As new vunerabilities occur, update the Nessus signatures and test to see 
if the NIDS catches them.

Here are a few tools.
NIDSbench
IDSwakeup


11:  What is a false positive?

Most IDS use signatures to compare against attacks.  Sometimes normal activity triggers the IDS.  
The IDS detects an attack signature during normal activity.  Part of maintaining the IDS is knowing 
when what you are dealing with is a false positive and tuning the IDS to avoid them.

12:  What is a false negative?

Most IDS use signatures to compare against attacks.  Sometimes attack activity doesn't trigger the IDS.

13:  Why do discussions on Intrusion Detection seem to have a bias towards Linux / UNIX ?

It is mainly due to the tools available. Many great tools are free for Linux / UNIX. 
(See the question on the top 50 tools) Some of those tools have ports for Windows, 
but the Windows versions usually are an after thought.

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: March, 12, 2019