Try with the "username" param in your favorite sofia profile. François. On Wed, 2013-06-19 at 14:44 +0100, Antonio Teixeira wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

...

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> wrote:

...

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

hi all , Thanks all of you, to providing or sharing me your experience with Free-Switch. using username param i change Free-switch Word form SDP SIP Header. On Wed, Jun 19, 2013 at 7:59 PM, Ken Rice-2 [via freeswitch-users] < ml-node+s2379917n7591945h35@n2.nabble.com> wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <[hidden email]<http://user/SendEmail.jtp?type=node&node=7591945&i=0>> wrote:

...

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

...

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <[hidden email]<http://user/SendEmail.jtp?type=node&node=7591945&i=1>> wrote:

...

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

---

...

...

Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=2> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=3> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________

...

Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=4> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=5> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=6> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list [hidden email] <http://user/SendEmail.jtp?type=node&node=7591945&i=7> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

------------------------------ If you reply to this email, your message will be added to the discussion below:

http://freeswitch-users.2379917.n2.nabble.com/remove-in-local-SDP-word-FREES... To unsubscribe from remove in local SDP word FREESWITCH, click here<http://freeswitch-users.2379917.n2.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=7591936&code=YWJkdWxsYWhAc21vbnRlLmNvbXw3NTkxOTM2fC0yOTQ5MjEyODg=> . NAML<http://freeswitch-users.2379917.n2.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>

-- View this message in context: http://freeswitch-users.2379917.n2.nabble.com/remove-in-local-SDP-word-FREES... Sent from the freeswitch-users mailing list archive at Nabble.com.

Are you going to be attending ClueCon 2013? /b On Jun 19, 2013, at 12:30 PM, Abdullah <abdullah@smonte.com> wrote:

hi all ,

Thanks all of you, to providing or sharing me your experience with Free-Switch. using username param i change Free-switch Word form SDP SIP Header.

As Anthony has said in the past, removing this string can in some cases cause more damage than good (as FS will apply certain rules when it detects this string in another request/response). Even if this were not the case, I cannot think of any valid reason why this would be required (and no, security/branding/compliance is not a valid reason). So say it loud and say it proud, I AM USING FREESWITCH. Cal On Fri, Jun 21, 2013 at 3:12 AM, Jeff Leung <jleung@v10networks.ca> wrote:

Should we undocument this parameter from the wiki and keep it hush-hush between ourselves?

...

-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch- users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: Thursday, June 20, 2013 7:00 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

Are you going to be attending ClueCon 2013?

/b

On Jun 19, 2013, at 12:30 PM, Abdullah <abdullah@smonte.com> wrote:

...

hi all ,

Thanks all of you, to providing or sharing me your experience with Free- Switch. using username param i change Free-switch Word form SDP SIP Header.

__________________________________________________________ _______________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

You¹ve heard me possibly talk about changing the UserAgent string due to stupidity of a carrier... But not the owner line of the SDP which is what this particular thread started about... On 6/20/13 10:52 PM, "Jeff Leung" <jleung@v10networks.ca> wrote:

Well it is understandable why somebody would want to change the username because say for example they created a fork of FreeSWITCH, but would like to redistribute it; they¹d basically have to remove all references of FreeSWITCH and not to leave the branding set at FreeSWITCH.

Correct me if I¹m wrong above, but I did hear from somebody (not to throw them under the bus) from the FreeSWITCH dev team talk about this on one of the conference calls we had some time ago.

From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch-users-bounces@lists.freeswitch.org] On Behalf Of Cal Leeming [Simplicity Media Ltd] Sent: Thursday, June 20, 2013 8:13 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

As Anthony has said in the past, removing this string can in some cases cause more damage than good (as FS will apply certain rules when it detects this string in another request/response). Even if this were not the case, I cannot think of any valid reason why this would be required (and no, security/branding/compliance is not a valid reason).

So say it loud and say it proud, I AM USING FREESWITCH.

Cal

On Fri, Jun 21, 2013 at 3:12 AM, Jeff Leung <jleung@v10networks.ca> wrote: Should we undocument this parameter from the wiki and keep it hush-hush between ourselves?

...

...

-----Original Message----- From: freeswitch-users-bounces@lists.freeswitch.org [mailto:freeswitch- users-bounces@lists.freeswitch.org] On Behalf Of Brian West Sent: Thursday, June 20, 2013 7:00 PM To: FreeSWITCH Users Help Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

Are you going to be attending ClueCon 2013?

/b

On Jun 19, 2013, at 12:30 PM, Abdullah <abdullah@smonte.com> wrote:

...

...

hi all ,

Thanks all of you, to providing or sharing me your experience with Free- Switch. using username param i change Free-switch Word form SDP SIP Header.

__________________________________________________________ _______________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org irc.freenode.net #freeswitch

@Ken I think we need to drop into the real world... 1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ... 2) _Security trough obscurity != security_ its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...." I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!). 3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results. 4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand". ---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything. This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project. And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D. P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX".... And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :) Antonio Teixeira On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira"<eagle.antonio@gmail.com> wrote:

...

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

...

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah<abdullah@smonte.com> wrote:

...

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

---

Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Hello Anthony. Yes i fully understand that and to be sincere my answer was more toward other comments not yours. But i can imagine ( sincerely) freeswitch consulting providing more turn-key solutions for some clients ( I'm cross reading the SBC thread now) So my post was also pointing into a direction that allows freeswitch to be a sustainable company ( i know your great relation with sangoma and their SBC products :D) P.S Im still waiting for the CPA software or should i go with the dialogic thing :( On 6/21/13 8:27 AM, Anthony Minessale wrote:

e is you can selectively choose to not care at all about someone's mind-melting business requirements that aim to unravel everything.

@Anthony I remembered something on the mailing list that freeswitch consulting /was/ developing a "payware" CPA for freeswitch. /I'm getting old so it could be a bad sector on my brain ../. * Company Bought By Dialogic http://wiki.projectdiastar.org/index.php/FreeSWITCH_Woomera_Client_Install This is a really interesting feature specially for us that have to build faily large dialers where every second counts and you have to feed large

500 persons callcenters.

P.S You can contact me off list if you prefer , eagle.antonio@gmail.com A/t On 6/21/13 8:54 AM, Anthony Minessale wrote:

Is that something from Sangoma? Like their answer to Dialogic API? It seems familiar but I really have no idea.

On Fri, Jun 21, 2013 at 2:42 AM, Antonio Teixeira <eagle.antonio@gmail.com <mailto:eagle.antonio@gmail.com>> wrote:

Hello Anthony.

Yes i fully understand that and to be sincere my answer was more toward other comments not yours. But i can imagine ( sincerely) freeswitch consulting providing more turn-key solutions for some clients ( I'm cross reading the SBC thread now)

So my post was also pointing into a direction that allows freeswitch to be a sustainable company ( i know your great relation with sangoma and their SBC products :D)

P.S Im still waiting for the CPA software or should i go with the dialogic thing :(

On 6/21/13 8:27 AM, Anthony Minessale wrote: > e is you can selectively choose to not care at all about someone's > mind-melting business requirements that aim to unravel everything.

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Anthony Minessale II

FreeSWITCH http://www.freeswitch.org/ ClueCon http://www.cluecon.com/ Twitter: http://twitter.com/FreeSWITCH_wire

AIM: anthm MSN:anthony_minessale@hotmail.com <mailto:MSN%3Aanthony_minessale@hotmail.com> GTALK/JABBER/PAYPAL:anthony.minessale@gmail.com <mailto:PAYPAL%3Aanthony.minessale@gmail.com> IRC: irc.freenode.net <http://irc.freenode.net> #freeswitch

FreeSWITCH Developer Conference sip:888@conference.freeswitch.org <mailto:sip%3A888@conference.freeswitch.org> googletalk:conf+888@conference.freeswitch.org <mailto:googletalk%3Aconf%2B888@conference.freeswitch.org> pstn:+19193869900

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Metasploit :) I fully realize this but obscurity works by "reducing" the attack surface of course. The less data or "assurance" the attacker has the better your are , so now im going to replace freeswitch with *cough asterisk *cough on the SDP :D On 6/21/13 8:56 AM, Steven Ayre wrote:

2) _Security trough obscurity != security_ its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com <mailto:eagle.antonio@gmail.com>> wrote:

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) _Security trough obscurity != security_ its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

...

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira"<eagle.antonio@gmail.com> <mailto:eagle.antonio@gmail.com> wrote:

...

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

...

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah<abdullah@smonte.com> <mailto:abdullah@smonte.com> wrote:

...

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <mailto:consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org <mailto:FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

The more work should be done by hacker, the more secure system is. So, "security by obscurity" is working, not so good, but thousands of years. 2013/6/21 Steven Ayre <steveayre@gmail.com>

2) *Security trough obscurity != security* its always better than

...

nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com> wrote:

...

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com> <eagle.antonio@gmail.com> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> <abdullah@smonte.com> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

This bruteforce approach required even more resources than intelligent one. I mean resources required for creating attacking network. First of all someone should write this bot, debug(!) it, then apply it to controlled botnet, that should be created before attack. That isn't so simple IMO. And even scanning of IP for non-standard port numbers can be detected by target system with appropriate action. Dmitry. 2013/6/23 Steven Ayre <steveayre@gmail.com>

Except the approach of a bot trying known exploits is automated. It doesn't take any effort of the hacker's time. It's not on his machine so doesn't even use his resources (time/CPU/bandwidth). It doesn't even need to check what software is running, simply trying everything in the book is sufficient. And that could be done in a couple of minutes.

-Steve

On 23 June 2013 15:45, Dmitry Lysenko <dvl36.ripe.nick@gmail.com> wrote:

...

The more work should be done by hacker, the more secure system is. So, "security by obscurity" is working, not so good, but thousands of years.

2013/6/21 Steven Ayre <steveayre@gmail.com>

...

2) *Security trough obscurity != security* its always better than

...

nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com> wrote:

...

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com> <eagle.antonio@gmail.com> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> <abdullah@smonte.com> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE: http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I mean overall botnet resources, not the hacker's PC. ) Hackers that have really large botnet may hack everything with login/password security. The more resources controllable botnet has, the faster the result will be achieved. But knowing exactly which software running on target system may reduce complexity of attack, and accordingly resources required, by times. Dmitry. 2013/6/24 Ken Rice <krice@freeswitch.org>

The bruteforce approach doesn’t really require that much bandwidth at all on the part of the original attacker, IDK how many hosts per day I see scanning my networks on my honey pots and I would guess that most of them are rooted machines... Add this type of functionality to a botnet (we’ve already seen sipvicious being deployed as part of a botnet toolkit) and the attackers bandwidth is little more then an IRC channel for C&C and PMs reporting the exploitable/exploited machines...

This type of thing is nothing new... Distributed Scanning was pioneered in the late 90s... And more advanced techniques were seen in the wild for doing just this sort of thing well over a decade ago... Sure maybe it’ll stop the script kiddies, but its not going to stop the people that you really need to look out for...

On 6/23/13 10:58 PM, "Dmitry Lysenko" <dvl36.ripe.nick@gmail.com> wrote:

This bruteforce approach required even more resources than intelligent one. I mean resources required for creating attacking network. First of all someone should write this bot, debug(!) it, then apply it to controlled botnet, that should be created before attack. That isn't so simple IMO. And even scanning of IP for non-standard port numbers can be detected by target system with appropriate action.

Dmitry.

2013/6/23 Steven Ayre <steveayre@gmail.com>

Except the approach of a bot trying known exploits is automated. It doesn't take any effort of the hacker's time. It's not on his machine so doesn't even use his resources (time/CPU/bandwidth). It doesn't even need to check what software is running, simply trying everything in the book is sufficient. And that could be done in a couple of minutes.

-Steve

On 23 June 2013 15:45, Dmitry Lysenko <dvl36.ripe.nick@gmail.com> wrote:

The more work should be done by hacker, the more secure system is. So, "security by obscurity" is working, not so good, but thousands of years.

2013/6/21 Steven Ayre <steveayre@gmail.com>

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com> wrote:

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com> < mailto:eagle.antonio@gmail.com <eagle.antonio@gmail.com>> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> < mailto:abdullah@smonte.com <abdullah@smonte.com>> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

...

so if they are connected to us via a psuedo account to monitor our features they still think we're using Asterisk...

You're mean! :-P Regards HASSAN On Mon, Jun 24, 2013 at 12:19 PM, John M <j_mj@aol.com> wrote:

I don't think anyone expects that security by obscurity is all you need .. but in terms of tools that you use to secure your network it's a valid addition.

Kinda like putting your hand over the keypad while entering your PIN at the ATM, it's not all you need to do but it's an extra step to help keep your account secure.

If I present my server as an asterisk server and the attacker has a special set of scripts to attack Asterisk .. he'll probably/might use them and when it fails .. move on.

In regard to the ability to be able to disguise the switch name .. i think this is a valid reason.

Another one that comes to mind is competition .. we work in a tight local market and have some competitors that follow us liek sheep .. whatever price we set they follow.. etc..

They run similar platforms hosted on Asterisk servers .. we are switching to FS and this is going to give us an edge .. I don't want these competitors to know that we are using a superior platform .. so I modify the name so if they are connected to us via a psuedo account to monitor our features they still think we're using Asterisk...

-----Original Message----- From: Steven Ayre <steveayre@gmail.com> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Sent: Fri, Jun 21, 2013 6:05 pm Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

2) *Security trough obscurity != security* its always better than

...

nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com> wrote:

...

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com> <eagle.antonio@gmail.com> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> <abdullah@smonte.com> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services:consulting@freeswitch.orghttp://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Serverhttp://www.cudatel.com

Official FreeSWITCH Siteshttp://www.freeswitch.orghttp://wiki.freeswitch.orghttp://www.cluecon.com

FreeSWITCH-users mailing listFreeSWITCH-users@lists.freeswitch.orghttp://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-usershttp://www.frees...

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

Freeswitch is open source and that's great. So checking the sources will resolve this problem. 2013/6/24 Ken Rice <krice@freeswitch.org>

Which breaks actually breaks things... For example... We actually put FS into a special mode when we detect sonus... Why would we do this? Because sonus has broken RTP and we have to do this for compatibility reasons... Theres other things that may happen along these lines also...

On 6/24/13 1:19 AM, "John M" <j_mj@aol.com> wrote:

I don't think anyone expects that security by obscurity is all you need .. but in terms of tools that you use to secure your network it's a valid addition.

Kinda like putting your hand over the keypad while entering your PIN at the ATM, it's not all you need to do but it's an extra step to help keep your account secure.

If I present my server as an asterisk server and the attacker has a special set of scripts to attack Asterisk .. he'll probably/might use them and when it fails .. move on.

In regard to the ability to be able to disguise the switch name .. i think this is a valid reason.

Another one that comes to mind is competition .. we work in a tight local market and have some competitors that follow us liek sheep .. whatever price we set they follow.. etc..

They run similar platforms hosted on Asterisk servers .. we are switching to FS and this is going to give us an edge .. I don't want these competitors to know that we are using a superior platform .. so I modify the name so if they are connected to us via a psuedo account to monitor our features they still think we're using Asterisk...

-----Original Message----- From: Steven Ayre <steveayre@gmail.com> To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org> Sent: Fri, Jun 21, 2013 6:05 pm Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com> wrote:

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com> < mailto:eagle.antonio@gmail.com <eagle.antonio@gmail.com>> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com> < mailto:abdullah@smonte.com <abdullah@smonte.com>> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

I know, my English is bad, very bad. Sorry. I mean that before changing 'username' parameter in sip profile we can check freeswitch's sources for compatibility and choose appropriate name, and of course not 'SONUS', or other buggy software. Dmitry. 2013/6/24 Ken Rice <krice@freeswitch.org>

Where did I say that FS was broken? I said sonus (which is very widely used) is broken and we use proper endpoint tagging (in the SDP and other places) to identify broken endpoints so we can properly compensate for it

On 6/24/13 2:07 AM, "Dmitry Lysenko" <dvl36.ripe.nick@gmail.com> wrote:

Freeswitch is open source and that's great. So checking the sources will resolve this problem.

2013/6/24 Ken Rice <krice@freeswitch.org>

Which breaks actually breaks things... For example... We actually put FS into a special mode when we detect sonus... Why would we do this? Because sonus has broken RTP and we have to do this for compatibility reasons... Theres other things that may happen along these lines also...

On 6/24/13 1:19 AM, "John M" <j_mj@aol.com <http://j_mj@aol.com> > wrote:

I don't think anyone expects that security by obscurity is all you need .. but in terms of tools that you use to secure your network it's a valid addition.

Kinda like putting your hand over the keypad while entering your PIN at the ATM, it's not all you need to do but it's an extra step to help keep your account secure.

If I present my server as an asterisk server and the attacker has a special set of scripts to attack Asterisk .. he'll probably/might use them and when it fails .. move on.

In regard to the ability to be able to disguise the switch name .. i think this is a valid reason.

Another one that comes to mind is competition .. we work in a tight local market and have some competitors that follow us liek sheep .. whatever price we set they follow.. etc..

They run similar platforms hosted on Asterisk servers .. we are switching to FS and this is going to give us an edge .. I don't want these competitors to know that we are using a superior platform .. so I modify the name so if they are connected to us via a psuedo account to monitor our features they still think we're using Asterisk...

-----Original Message----- From: Steven Ayre <steveayre@gmail.com <http://steveayre@gmail.com> > To: FreeSWITCH Users Help <freeswitch-users@lists.freeswitch.org < http://freeswitch-users@lists.freeswitch.org> > Sent: Fri, Jun 21, 2013 6:05 pm Subject: Re: [Freeswitch-users] remove in local SDP word FREESWITCH

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

Actually I'd argue the opposite. Security through obscurity often makes people assume they're secure and therefore neglect securing their systems in the places that actually matter.

The only argument I can really see of hiding that you're running $version of $product is that an bug in that $version means an exploit exists.

If that's the case then you need to upgrade to a patched copy of $product - you can NOT rely on the fact that people will not realise that they can use the exploit because you're hiding what you're running.

The flaw still exists and attackers might either a) guess you're using $product and try the exploit anyway or b) have their bot just randomly try every exploit in the book against you until one works in which case they don't even need to know you're using $product.

The things that matte are actually verifying your authentication is working correctly, you're running the latest software, you're following software updates / security announcements, etc.

Besides even when $product/$version are hidden they can often be found through fingerprinting by looking at differing behaviour between different products and within a product between versions.

-Steve

On 21 June 2013 07:59, Antonio Teixeira <eagle.antonio@gmail.com < http://eagle.antonio@gmail.com> > wrote:

@Ken I think we need to drop into the real world...

1) Ok .,... Don't forget to say thanks to Debian , CentOs , Fedora , PHP , Python , Microsoft , all the authors of the OpenSource Libs , the creator of Make , the creator of the IDE that the Dev team uses , etc etc when you deliver the next project to your client ...

2) *Security trough obscurity != security* its always better than nothing. " hey you don't need to guess the the software I'm using , I'm giving the info for free just find an entry point and you got it ...."

I could also imagine you agree with showing the version of the software in the HTPP headers (stuff that happens on some webservers/libs ( from my ming i can recall Django?!).

3) The clients pays it doesn't really care about what software you use ( unless he fears some patent infringement) he wants results.

4) No , Compliance could be internal or external the end-client could simply say "i don't want the freeswitch brand".

---- ///// ---- @all I don't know you guys but my daily work is developing software for some fairly large financial institutions and sincerely i think you are all over reacting to this thing. Yes if you open-source something you will get part of your software stolen , changed or use in a way you were not expecting and not given credit for , that's life .If you don't want it , close the source , resell it , ask for NDA's , etc. In my daily work me and my collegues use alot of open source ( contrary to the popular belief) , closed source and everything in between and you don't expect a public statement thanking anyone for anything.

This is the way life works and with open-source this is our current world ( i think the FS Team could even offer a fully custom branded solution) so it could help monetize the project.

And before you start thinking yes i bought G729 licenses , the FS Book even before it was out and no to many miles between me and Gluecon , yes i know airplanes exist :D.

P.S - I Also assume that you all as sysadmins once found a problem that a blogger may have solved and on your final report to the administration you didn't wrote " problem solved by Blogger XXXXXX"....

And never forget he is just the mailman sometimes the boss wants something ( even if not morally correct ) and you have to do it. But the point raised by Anthony regarding the SDP "freeswitch flag" is important and you be featured on the wiki :)

Antonio Teixeira

On 6/19/13 3:49 PM, Ken Rice wrote:

Ok... Lets look at these...

Branding... I don't want to show people that I'm using F/OSS software for running my for profit business so I can tell them I'm using either ${some_comercial_platform} or ${we_developed_this_ourselves}

Security/Security Requirements - Security throught obscurity != security...

Client Requirements - That's a new one one... Unless client is <see branding>

Compliance - isnt this the same thing as see security

On 6/19/13 8:44 AM, "Antonio Teixeira" <eagle.antonio@gmail.com < http://eagle.antonio@gmail.com> > <mailto:eagle.antonio@gmail.com<eagle.antonio@gmail.com>> wrote:

I could think off

Branding Security Client Requirements Security Requirements Compliance

On 6/19/13 2:37 PM, Michael Jerris wrote:

Why would you want to do that?

On Jun 19, 2013, at 9:28 AM, Abdullah <abdullah@smonte.com < http://abdullah@smonte.com> > <mailto:abdullah@smonte.com<abdullah@smonte.com>> wrote:

HI ALL ,

please help me ,how to change or remove o=*"FreeSWITCH"* in free switch Cli Log .

any idea ??

o=FreeSWITCH 1369449071 1369449072 IN IP4 10.10.50.1 s=FreeSWITCH c=IN IP4 10.10.50.1

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

------------------------------ _________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org <http://consulting@freeswitch.org> http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org < http://FreeSWITCH-users@lists.freeswitch.org> http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org

-- Ken *http://www.FreeSWITCH.org http://www.ClueCon.com http://www.OSTAG.org *irc.freenode.net #freeswitch

_________________________________________________________________________ Professional FreeSWITCH Consulting Services: consulting@freeswitch.org http://www.freeswitchsolutions.com

FreeSWITCH-powered IP PBX: The CudaTel Communication Server http://www.cudatel.com

Official FreeSWITCH Sites http://www.freeswitch.org http://wiki.freeswitch.org http://www.cluecon.com

FreeSWITCH-users mailing list FreeSWITCH-users@lists.freeswitch.org http://lists.freeswitch.org/mailman/listinfo/freeswitch-users UNSUBSCRIBE:http://lists.freeswitch.org/mailman/options/freeswitch-users http://www.freeswitch.org