As an IT person. Reddit has a great (funny) sub called TalesFromTechSupport. If you're old and geeky like me it's like the old SysOpsFromHell chat logs.

So WTF? So this newest development is like the opposite of all those. Every sysop from old and every network admin from now wants to see this guy strung up. He should be banned from working in IT forevermore.

Everyday to see the latest installment of the Clinton fail. Have to wonder if they will make it to the election. I wonder when the people who vote in this country will have had enough? And, I wonder what it will be that finally take them down. And, final wonder, who will it be that breaks that story?

I remember listening to the watergate hearings in 1973 on the radio, everyday, the drip drip drip, finally breaking the story out. History repeating....

Treason. He ain't no Clinton. He can be sent before a FISA court and have his testicles removed through is mouth.

If it is in fact the private keys for the servers SSL certificate,.. The level of incompetence is legendary, SSL/TLS is the easiest part of an email server to setup.

Email is a rather special case to an extent, its a badly thought out protocol, that can not guaranty ownership of the exchanged messages, Nobody was thinking about abuse when it was first invented, and so designed nothing into it to deal with abuse. It was designed to work across different network's and network protocols, and I am not referring to different internet protocols, I am referencing the ability to move messages from an ip network, to a ipx/spx(pre internet protocol used by novell) network, to something else entirely and back again.

Email, or SMTP, is a very easily abused protocol that has a mountainous pile of crap tacked on, to deal with abuse without actually solving the flawed nature of the protocol in the first place, SMTP is an absolute pain in the ass to setup and properly maintain. And SMTP is an on going arms race with those that would abuse it, and not just hackers, their is also spammers, and in both cases multiple vectors that an attack might be after the server for.

If you put up an email server, the first thing that you will notice is hundreds of automatic bots scanning it every day, after a few bots have found your machine, you will start seeing login attempts, at first it will be common stuff short dictionaries(user root/admin, pass god/sex/password, etc), if your domain or whois info for your domain contain any words that match or are similar to leaked user databases from other sites, then more targeted user/password combo's will be tried, and this is also automated.

The internet for this sort of thing is a freaking battlefield, We absolutely can not allow the incompetence argument, If a person isn't ready to handle SSL keys properly, a very very simple thing todo, then they sure as hell shouldn't be running an email service.

Hillary's use of gmail is actually probably the least offensive thing that happened from a security perspective, google knows how to secure their stuff properly, and webmail over SSL is not something that is likely to have been broken even when communicating on hostile networks so long as the device doing the communicating hasn't had its certificate authority certificates compromised. of course using pop3 or imap when the private key is public and you might as well just directly forward all of your email to every other government directly and save them the trouble. especially if a password is sent across that connection(and it will be to log in).

Where the hell did they find this admin, they have him set this thing up after having him read redhat linux for dummies?

They should have never offered him immunity, they should have thrown his ass the in the clink, and after 6months or so offered to reduce his sentence for singing.

And I have read his wife was a Berner, he may have been, too. And he has a cat and a dog. Very public exposure. Something for the rest of us to keep in mind. Not that we are doing anything questionable under the law, right?

everyday at my parent's house. Dad and I would watch while I did laundry and mom helped me with the baby. What drama! Now, I'm reading Servergate unfold via the excellent researchers here. You all are amazing!

FBI was not aware of this. How are they going to weasel out of indictment now? Is this finally going to bring Clinton down?

And now E Warren is on his case and all of DoJ about the financial meltdown and the list of bankers who defrauded us and got bailed out with a token warning.

But aren't Her Majesty's written responses re: the JW investigation due soon, as well?

much less one holding top secret govt data. In yesterday's reddit revelation, he was asking on reddit for advice on how to set email retention dates on the email server. Anyone asking something that basic is clearly a rookie at email server management.

And so today we see he admitted on a public reddit thread that the SSL was not working and gave out the IP address. Hahaha.

Hellery loves saying there is no evidence the server was hacked. But knowing the above tells me it is almost a certainty that it was hacked.

HERE

Please! Let's be accurate: The IP address of a device on the public Internet is not a key or password or anything of the sort -- it's the device's network identifier -- it's how routers identify that device in order to send network packets to it.

If it's a static IP address (not an address that's temporarily assigned via DHCP), and has a domain name, then it is entirely public -- you can look up the translation of domain name to IP address with nslookup or dig or whois other local DNS tool, or you can use a whois service on the web (e.g. http://whois.domaintools.com/). Please go ahead and try this on some domain that you think is private. Try it on some domain you own.

If the device is on a local network (and that's most of 'em), and is going through a gateway to the public IP network, then it will have a temporary IP address assigned by the gateway. You can see your own machine's IP address by going to:
https://www.whatismyip.com/
Some exploits aren't even possible on a device that's not directly connected to the public Internet -- the gateway just doesn't pass everything along.

What can you do with an IP address posted online? Nothing other than if you'd looked up the IP address by other means, or just started constructing arbitrary IP addresses. (We've effectively run out of IPv4 addresses, so you'll find something is using just about every IPv4 address.) So, given an IP address, you can attempt any number of standard exploits. (This is why you run a firewall and don't choose just a word in the dictionary as your root password.) Again, the IP address does not give you any special access. All it does is point to a specific device (if it's a static IP) or to some gateway's table mapping shared public IP to local addresses (if it's a DHCP address).

Now, it is still wrong to *invite* attempts to penetrate security...especially if the sysadmin suspects there is a security lapse. This is where one hires a reputable security company to do an audit, not ask your buds out on some subreddit. Ur still an idjit for saying, hey, come try to hack my device, I dare you! But it is *not* the same as posting access info that allows people in without hacking.