Re: The grass is green? No! The sky is blue!

["Dave O'Shea" <doshea () telentente com>]

As an official representative* of the U.S. Department of Bad Analogies,
I am here to help.

When I'm on a freeway, I expect to see a lot of cars, and I expect a
small number of them to be driven by idiots. I wear my seat belt and try
to be aware of the idiots to make sure I keep my distance. But I don't
let them distract me from my primary task. I also see, very rarely,
someone truly dangerous, perhaps a drunk, or a truck that is unknowingly
losing cargo on the road. Those very few are worth making note of and
pointing out to The Proper Authorities.

At home, living at the end of a cul-de-sac, I expect to see very few
cars, and I expect to be familiar with the drivers of most of them. When
I see one that doesn't look familiar, I will probably notice it. If I
see the same car more than once, I would probably say hello to the
driver, and determine why he's there. The few times I've done this, I've
usually found that they're a contractor, or someone visiting a relative.
Once I've done so, I'll go back to something productive like watching
The Simpsons. Yes, I could make a stink about them parking on the
street, but it would make my neighbors think I'm far more grumpy and
weird than they already think, and they'll be less inclined to lend me a
hand next time I need to move something heavy.

Moral of the story: Things that are alarming in one context are harmless
in another, and vice versa. The value is in that SJDLR ("something just
don't look right") instinct that cops and similar professions, that
allows them to spot trouble. 


*I'm lying, of course. I don't even claim to represent my own opinion,
never mind anyone else's.


> -----Original Message-----
> From: Matt Levine [mailto:matt () deliver3 com]
> Sent: Friday, October 26, 2001 2:43 PM
> To: Simon Lockhart; Dan Hollis
> Cc: Christopher Wawak; Alex Rubenstein; nanog () nanog org
> Subject: RE: EXAMPLE: ### xxx Canada detected a penetration 
> attempt from
> 209.123.x.229. Incident# xxxx
>
>
>
>  
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Wouldn't it be more appropriate to use "businesses" instead of
> houses?  Trying the front door to a business to see if they're open
> (while no excuse for checking the windows, obviously) is a little
> more appropriate IMO..
>
>
> Matt
>
> - --
> Matt Levine
> @Home: matt () deliver3 com
> @Work: matt () eldosales com
> ICQ  : 17080004
> PGP  : http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x6C0D04CF 
> "The Trouble with doing anything right the first time is that nobody
> appreciates how difficult it was." 
>
> - -----Original Message-----
> From: owner-nanog () merit edu [mailto:owner-nanog () merit edu]On Behalf
> Of
> Simon Lockhart
> Sent: Friday, October 26, 2001 3:19 PM
> To: Dan Hollis
> Cc: Christopher Wawak; Alex Rubenstein; nanog () nanog org
> Subject: Re: EXAMPLE: ### xxx Canada detected a penetration attempt
> from
> 209.123.x.229. Incident# xxxx
>
>
>
> > On Fri, 26 Oct 2001, Christopher Wawak wrote:
> > > Well, not exactly.  Looking into the windows or checking the
> > > doorknobs is more akin to looking at your directory structre on
> > > your computer or file ... Scanning is more like going through the
> > > phone book or looking at the names on mailboxes in a
> > > neighborhood....
> >
> > So you dont mind if people portscan your network?
>
> Stupid analogy # 54325235:
>
> pinging all hosts on a net: Walking down a street finding out which
> houses 
> exist
>
> Portscan: Trying the doors, windows, etc on a house
>
> I know which one I don't mind...
>
> Simon
> - -- 
> Simon Lockhart                       |   Tel: +44 (0)1737 839676 
> Internet Engineering Manager         |   Fax: +44 (0)1737 839516 
> BBC Internet Services                | Email:
> Simon.Lockhart () bbc co uk 
> Kingswood Warren,Tadworth,Surrey,UK  |   URL:
> http://support.bbc.co.uk/
>
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com>
>
> iQA/AwUBO9m8rsp0j1NsDQTPEQKtSwCfdo8BpdgJoUZ5kJlvptNB14UwTLgAn0yy
> G6u7HTmDnKp9fAmJontSwdsd
> =LpNH
> -----END PGP SIGNATURE-----