About | ACP | Buy | Forum | Industry Watch | Learning Curve | Search | Twitter | Xnews
Home » Industry Watch

Uncle Foobar

All the Foobar People
Where do they all come from?
All the Foobar People
Where do they all belong?
 - John Lennon, Paul McCartney
   Maclen Music / Northern Songs
   All rights reserved


X-Originating-IP: [68.142.200.133]
Return-Path: <unclefoobar@yahoo.com>
Received: from 68.142.200.133 (HELO web30610.mail.mud.yahoo.com) (68.142.200.133) by mta107.mail.ukl.yahoo.com with SMTP; Wed, 19 Jan 2005 19:56:55 +0000
Received: (qmail 56621 invoked by uid 60001); 19 Jan 2005 19:56:54 -0000
Message-ID: <20050119195654.56619.qmail@web30610.mail.mud.yahoo.com>
Received: from [ ] by web30610.mail.mud.yahoo.com via HTTP; Wed, 19 Jan 2005 11:56:54 PST
Date: Wed, 19 Jan 2005 11:56:54 -0800 (PST)
From: "Uncle Foobar" <unclefoobar@yahoo.com>
Subject: CLIX and ftp connections
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Length: 997

Hi:

what i'm wondering is why would CLIX be making ftp connections? Is there some version update as part of the software?

This concerns me because the software doesn't ask permission and it has my admin password.

Here's what showed up in netstat:

Active Internet connections
Proto Recv-Q Send-Q  Local Address           Foreign Address        (state)
tcp4       0      0  cust-216-41-53-2.50651  64.12.24.144.aol       ESTABLISHED
tcp4       0      0  localhost.58015         localhost.ipp          CLOSE_WAIT
tcp4       0      0  localhost.58014         localhost.ipp          CLOSE_WAIT
tcp4       0      0  cust-216-41-53-1.55757  rixstep.com.ftp        ESTABLISHED
tcp4       0      0  localhost.64976         localhost.ipp          CLOSE_WAIT
tcp4       0      0  localhost.64975         localhost.ipp          CLOSE_WAIT
tcp4       0      0  localhost.59026         localhost.ipp          CLOSE_WAIT
tcp4       0      0  localhost.59025         localhost.ipp          CLOSE_WAIT
tcp4       0      0  localhost.netinfo-loca  localhost.948          ESTABLISHED
tcp4       0      0  localhost.948           localhost.netinfo-loca ESTABLISHED
udp4       0      0  *.65514                 *.*

Basically i tried out CLIX for a while, doing any command without an "rm" in it to see what it does. At no time did i run an ftp, so i suspect the application is doing this.

Thanks.


Date: Fri, 21 Jan 2005 09:45:41 +0000 (GMT)
Subject: Re: CLIX and ftp connections
To: "Uncle Foobar" <unclefoobar@yahoo.com>

Hi Uncle,

CLIX doesn't make any Internet connections unless you specifically order it to. Even the subscription model doesn't do that. Realistically I have no idea what this is about. We're currently in transit and I can look into this more when we get to a place where we can relax.

I would check with otool to see what libraries CLIX uses. One of these might want to connect, but I find that unlikely.

The netstat stuff you have here doesn't look like open connections. It looks like some command, such as a curl, exercised an access and the command ended and the close was pending.

But as said, I will look into this later. But you're right: it makes no sense at all. CLIX is eminently simple, once you get past the smoke and mirrors: it passes Unix command lines to a dude inside the package which then executes them. No magic there at all and really unreasonable to think anyone, shared libraries further up the road, would want to do that.

But again, more later. We're pressed for time and leaving for the continent in a matter of minutes.

Take care.


Date: Tue, 1 Mar 2005 14:33:56 +0000 (GMT)
Subject: Re: CLIX and ftp connections
To: "Uncle Foobar" <unclefoobar@yahoo.com>

Sorry it took so long to look this over, but now we've done it.

There's no mention in all this netstat stuff of anything related to CLIX.

You have had an open connection to our FTP site - probably due to your downloading our software - but no mention of CLIX whatsoever.

Which basically leads to the same data as we have: the app CLIX doesn't do any web accesses unless you put in a Unix command line to do so.

Which leads us to seriously wonder if you know what you're talking about here.

Regards.


Date: Sun, 5 Mar 2005 14:20:45 -0800 (PST)
Subject: Re: CLIX and ftp connections
From: "Uncle Foobar" <unclefoobar@yahoo.com>

Look, the only app i have from rixstep.com is CLIX. That's it. That's the ftp connection.

You ARE rixstep, yes?

Look, jerk, you're the one running a phishing soft on people to get their admin passwords, not i.

If you get your jollies breaking into other people's boxes over the internet, that's your problem.

Mine is letting people know CLIX is doing this; luckily you're so obscure most Mac users will never touch it.

Foob


Date: Sun, 6 Mar 2005 16:22:25 +0000 (GMT)
Subject: Re: CLIX and ftp connections
To: "Uncle Foobar" <unclefoobar@yahoo.com>

Foob,

You need a lobotomy.

Fast.

Bye

RIXSTEP

About | Buy | Forum | Industry Watch | Learning Curve | Products | Search | Twitter | Xnews
Copyright © Rixstep. All rights reserved.