Stomp Out Annoying Allergies

Annoying Allergies

If the drip, sniff, sneeze, and itch of allergies have you thinking of buying stock in the company that makes Kleenex, dry your eyes and prepare to take action.

You're going to wage battle inside your house and even inside your body to reduce the number of allergy attacks you suffer and minimize those so-annoying symptoms. Allergies may not be life-threatening, but they're nothing to sneeze at either. Here are 20 of the best ways to protect yourself.

1. Choose chicken instead of beef. A two-year study of 334 adults with hay fever and 1,336 without found those who had the most trans oleic acid in their diets, a form of monounsaturated fat found primarily in meat and dairy products, were nearly three times as likely to have hay fever as those who ate the least. Don't worry, olive oil is okay; although it's got a lot of oleic acid, it's not the "trans" form.

2. Pop a fish-oil supplement every morning after you brush your teeth. A study of people with allergic asthma (asthma caused by allergies) found those who took daily fish-oil supplements for a month had lower levels of leukotrienes, chemicals that contribute to the allergic reaction.

3. Turn on the AC. Air conditioners remove mold-friendly moisture and filter allergens entering the house. Just make sure to clean or change the filters often or you'll just make things worse.

4. Eat one kiwifruit every morning. They're rich in vitamin C, which acts as a natural antihistamine. Some studies link low levels of C with allergies. When your allergies are flaring up, consider taking a vitamin C supplement.

5. Steam vacuum your furniture and carpets and include a solution of disodium octaborate tetrahydrate (DOT), a boron-based product, in the water. A 2004 study published in the journal Allergy found DOT cut dust mite populations and their associated allergen levels to undetectable levels for up to six months.

6. Take 250 milligrams of quercetin three times a day. This natural supplement is a potent anti-inflammatory flavonoid, and it is widely used in natural medicine practices to fight allergies.

7. Clean out your gutters and make sure they're not clogged. Clogged gutters can result in water seeping into the house, leading to mold growth, which can exacerbate allergies. Next time it rains, check your gutters. If you see water leaking out of end caps, flowing on the outside, or dripping behind them, it's time to get out the ladder.

8. Always run the exhaust fan and/or leave the window and door open when taking a shower or bath. Another option is to run a small portable fan (away from water sources) during and after showers. Again, you're trying to keep surfaces dry and prevent the growth of mold. Also, check to see that the vent on the outside of your house where the exhaust exits isn't blocked by leaves.

9. Wash the shower curtain in hot water and bleach every month. Or use a shower liner that you can replace every couple of months for just a few bucks.

10. Keep your thermostat set above 65°F in the winter. If you set it too low, you're encouraging the growth of mold in damp air. The heat dries out the air, preventing mold growth. Of course, too-dry air can also irritate your lungs and sinuses. The perfect humidity in a home is around 50 percent.

11. Wash all your bedding in very hot water every week. It's the best way to kill those pesky microscopic dust mites that love your bed even more than you do.

12. Follow your dryer vent and make sure it's vented to the outside. For every load of laundry you dry, 20 pounds of moisture has to go somewhere! If your dryer is vented to the garage or basement, you're just asking for mold buildup.

13. Clean the tray under the fridge with a bleach solution and sprinkle with salt. The tray is a veritable mold magnet. Adding salt reduces the growth of mold and bacteria. Also, clean under the refrigerator occasionally; food can become trapped there, become moldy, and the mold spores are blown into the kitchen every time the compressor kicks in.

14. Water your plants sparingly and put pebbles on top of the dirt to discourage mold spores from getting into the air. Overwatering houseplants can contribute to the growth of mold. Also, water might leak through the plant onto the carpet.

15. Spend this weekend decluttering. Throw out or give away coats and other clothing you haven't used in the past year. Put sports equipment in the garage or basement where it belongs. Slip shoes into hanging shoe bags. When you finish, you should be able to see all your closets' floors and back walls. Now give everything a good vacuum and you'll have significantly reduced the amount of dust in your house.

16. Keep your bedroom door shut so your dog and/or cat can't get in. Let him bark or meow. You spend more time in your bedroom than any other room of the house, and this keeps down cat and dog dander, to which many people are allergic.

17. Choose a doormat made of synthetic material. Doormats made of natural material (wicker, etc.) can break down and become excellent feeding grounds for mites, mold, and fungus, and then get tracked into the house. Wash all mats weekly.

18. Clean all dead insects from your porch lights. As they decompose, they can become an allergen source.

19. Put a shelf by the front door for shoes and encourage your family and guests to remove their shoes before entering to reduce the amount of dust, mold, and other allergens tracked in. Keep some soft slippers in a basket by the front door for people who don't want to walk around in their stocking feet.

20. Read labels and avoid foods that contain the additive monosodium benzoate. An Italian study found that monosodium benzoate triggered allergy-like symptoms, including runny, stuffy nose, sneezing, and nasal itching, in adults without allergies. The preservative is often found in juices, pie fillings, pickles, olives, and salad dressings.

Magic Eye Trick

Disable USB on Windows

How to disable USB sticks and limit access to USB storage devices on Windows systems

USB storage - a possible security risk?

Decent IT administrators secure their networks behind firewalls. They install mail filters on their SMTP servers and deploy anti-virus software on all client workstations. But securing the network is not sufficient -- what happens if the users bring their own USB memory sticks and connect them to the computers at their office? A 1 Gb USB stick can sometimes hold an entire company's vital data. Within minutes or even seconds an employee has all the files they need in order to start up their own business and take all the customers with them. Alternatively, what happens if a careless user accidentally compromises the network with an infected USB stick?

What does Microsoft have to say about it?

If you, the administrator, want to establish a minimum level of security, it is absolutely necessary to control which users can connect USB memory sticks to a computer. Unfortunately, a default Windows XP or Windows 2000 installation comes with no limitations on who is able to install and use USB storage media. Microsoft knowledge base article 823732 contains instructions on how to disable USB storage access for a certain group of users; however, the article only distinguishes between whether or not a USB storage device has been installed on a particular computer. Furthermore, the instructions are limited to a stand-alone computer. According to the general rule of thumb "If it's tedious, there is a better way", I try to avoid techniques that force me to repeat certain tasks for each computer that I manage. That's what group policy objects (GPO) are for.

Suggestions?

Mark Heitbrink describes how to disable USB storage devices entirely on all or some computers in the network. He employs an ADM template in a group policy object that disables the USB storage driver (USBSTOR). The ADM template simply sets the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor\Start to 4 (Disable). But his technique has a serious drawback. It only works if the USB storage driver is already installed. If it has not yet been installed, Windows' plug & play subsystem automatically resets the Start value to 3 (Manual) when it installs USBSTOR after a USB storage device is plugged in for the first time. In that case, USBSTOR remains enabled until the GPO is re-applied, usually at the next reboot. If the storage device is plugged in during that reboot, it will still be available because the USBSTOR driver is started before any GPOs are processed.

The Howto!

If we combine Mark Heitbrink's approach with the one outlined in knowledge base article 823732, we get a more reliable solution. Firstly, we need to prevent USBSTOR from being installed unless the currently logged on user is allowed to use USB storage. We do that by restricting access to USBSTOR.INF and USBSTORE.PNF in a GPO such that PNP can't automatically install the driver. This is possible because when PNP installs a driver, the installation is performed using the priviledges of the currently logged on user. Secondly, we need to make sure that USBSTOR is not started when a USB storage device is plugged in. For that we use Mark's ADM template. The only minor drawback of my solution is that users with access to USB storage need to manually start USBSTOR before connecting USB storage devices.

1. In Active Directory Users and Computers, open an existing GPO or create a new one and open it. Use the security settings of that GPO to specify which computers it affects.
2. In that GPO, go to Computer Configuration – Windows Settings – Security Settings – File System and create a new entry (right-click File System and select Add File). Specify the location of USBSTOR.INF (usually SystemRoot%\Inf\USBSTOR.INF)
3. Change the security settings of the new entry. The security settings that you specify here will be enforced on the USBSTOR.INF of every computer to which the GPO is applied. This process is not additive, which means that the previous security settings of USBSTOR.INF will be overwritten by the ones given in the GPO. It is therefore recommended to grant full control to SYSTEM and local administrators. But unlike in the default security settings of USBSTOR.INF, you should not grant any priviledges to Everybody. You do not need to explicitly deny access – just omit an entry for Everybody. Optionally, you can grant read access to a certain group. Members of this group will be able to use USB storage.
4. Repeat the above two steps for USBSTOR.PNF.
5. Download USBSTOR.ADM.
6. Back in the GPO, right-click Administrative Templates under Computer Configuration and select Add/Remove Templates. Click Add and browse to the location of USBSTOR.ADM. Close the dialog.
7. You should now have an additional entry called Services and Drivers in Administrative Templates. Click on it. If it is empty, select View from the menu and uncheck Show Policies Only. Click back on Services and Drivers in Administrative Templates. It should now show the USB Storage policy. Double click it, select Enabled and pick Disabled from the Startup Type drop down. Again, the policy must be enabled wheras Startup Type must be Disabled.
8. Close the dialog as well as the GPO and boot/reboot one of your workstations. Make sure no USB strorage device is connected to that computer. Log on with administrative privileges and check the permissions of USBSTOR.INF and USBSTOR.PNF. Check the value of the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor\Start. It should be 4. It is also ok if the UsbStor key doesn't exist at all.
9. On the same workstation, log off and back on as a user that should not have access to USB storage. Connect a USB memory stick or a similar device. Nothing should happen. Remove the memory stick.
10. Log on as a user that should have access to USB storage and execute net start usbstor in a command shell or at Start – Run before connecting the memory stick. The memory stick should initialized and mapped to a drive letter. If USBSTOR fails to start, it's probably because this is the first time a memory stick is plugged into the workstation in which case USBSTOR is not yet installed. Nevertheless, the memory stick should be initialized and mapped correctly but you need to reboot in order to reapply the administrative template such that USBSTOR is disabled again. Alternatively, you can disable it manually by downloading and double clicking USBSTOR.REG as well as executing net stop usbstor.
11. Instruct the users with access to USB storage that they need to execute net start usbstor before they can connect a USB storage device.

Attachment	Size
usbstore.adm	530 bytes
usbstore.reg	258 bytes

Build an Intrusion Detection System

There is a large number of Intrusion Detection Software / Systems (IDS) out there for various operating platforms, all ranging in price and complexity. I have spent countless hours looking at hardware and software solutions for a Windows platform and found one product that stands out from the rest, SNORT.

SNORT is an open source Intrusion Detection Software / IDS that is now available for the Windows operating system. Listed in the table below is the information you'll need to get your Intrusion Detection Software up and running for next to nothing.

IDS Software

Windows XP
SNORT IDS (under binaries)
WinPcap (for packet capturing)
LiTe Sniffer (network traffic monitor
IDScenter (Snort front end)

Intrusion Detection

Let's get started! You're going to turn this PC into what is known as a bastion host, a computer (gateway) between an inside network and an outside network that has unnecessary services turned off.

01) Install your version of Windows (XP, etc). Do not install Internet Information Server (IIS) or Indexing - you can remove them later if you forget.

02) Apply all the service packs.

03) Disable NetBios over TCP

• Right click on My Computer > Properties > Hardware > Device Manager.
• Click on View > Show Hidden Devices.
• Click on View > Devices by Connection.
• Right click on NetBios over TCP/IP > Properties
• Driver Tab > Type > Disabled.
• Click OK.

04) Disable as many of the following services as possible:

• Alerter
• Computer Browser
• DHCP Client
• Distributed File System
• Distributed Link Tracking Client
• Distributed Link Tracking Server
• Distributed Transaction Coordinator
• DNS Client
• Fax Service
• File Replication
• Indexing Service
• Internet Connection Sharing
• Intersite Messaging
• Kerberos Key Distribution Center
• License Logging Service
• Messenger
• Netmeeting Remote Desktop
• Network DDE
• Network DDE DSDM
• Print Spooler
• QoS RSVP
• Remote Access Auto Connection Manager
• Remote Access Connection Manager
• Remote Registry Service
• Removable Storage
• Run as a Service
• Server
• Simple Mail Transport Protocol (SMTP)
• Smart Card
• Smart Card Helper
• Task Scheduler
• TCP/IP NetBios Helper Service
• Telephony
• Telnet
• Uninterruptible Power Supply
• Windows Time
• Workstation

05) Install winPcap

06) Install Snort

07) Install LiTe Sniffer - start this program and watch for traffic. If you do not see traffic and you're on the switch, you'll need to tell your switch that the port you're connected to on this switch is a monitor port. A switch reduces traffic by keeping track of where information goes; if computer A sends information to Computer B and you are computer C, then you'll never see the information. The IDS system needs to see all the information (traffic) to correctly determine if a instruction attempt is being performed.

08) NOTE: You are at your own risk if you follow these instructions. Editing your registry is DANGEROUS and should be done with extreme caution. Follow these steps at your OWN risk.

• 1. Get your device's hex value. ('snort -W' works for this)
• 2. open Regedt32
• 3. Navigate out to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  \Interfaces\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
• 4. Select the network card you wish to setup as the monitoring interface (this will be the {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} value).
• 4a. Set IPAddress:REG_MULTI_SZ: to null (Double click on the string, delete data in the Multi-String Editor, then click OK)
• 4b. Set SubnetMask:REG_MULTI_SZ: to null (Double click on the string, delete data in the Multi-String Editor, then click OK)
• 4c. Set DefaultGateway:REG_MULTI_SZ: to null (Double click on the string, delete data in the Multi-String Editor, then click OK)
• 5. Close the Registry Editor and reboot.
• 6. In a command prompt, run 'ipconfig' to verify the interface does not have an IP bound to it.
  

If you do not receive an IP address listing from the interface you modified, you are good to go.

09) Install IDScenter

10) Configure your rules - This is the hard part (or should I say the time consuming part!). Out of the box, SNORT will record an incredible amount of information, much of which is unnecessary. You'll want to reconfigure your rules until the only information that is recorded is information you should be aware of. Visit the SNORT site and read up on rules for more information. It's not rocket science, just a little time consuming!

Man Vs. Mountain - Avalanche Prevention

man vs mountain: avalanche control structures

by deputydog ⋅ 02 / 03 / 2008 ⋅ post a comment

one of the places i'd refuse to set up home would have to be at the bottom of a mountain with a history of avalanche activity. unfortunately for some that choice doesn't seem to exist and after reading a post over at the highly recommended blog pruned yesterday the frightening world of avalanche survival systems nearly became an obsession, for a couple of reasons.

firstly, the fact that they exist at all was news to me. i naively assumed that avalanches of any substance were pretty much uncontrollable on our part (unless explosives are used), especially when the relatively miniscule and fragile community you're attempting to defend sits at the base of the mountain in question. so the thought of humans battling angry mountains the world over using fences and angled walls was always going to be a winner for me. secondly, they look great. i'm a sucker for enormous man-made structures anyway and these beasts are fairly huge, the dams especially as they sometimes span the width of entire villages.

so, here a 3 different types of structure actively being used in various regions in the defense against rapid walls of snow. i'm not even going to pretend to be knowledgeable about the subject so if you want any more depth i suggest you follow the links after these photos.

the deflecting dam

deflecting dams exist with one objective in mind: to divert the flow of an oncoming avalanche away from the populated area beneath the shifting snow. this is done using angled walls and one of the most successful examples can be found at flateyri in iceland (see above) where a triangular deflecting dam can be clearly seen above the village. the dam was built following a fatal avalanche in 1995 and since its construction the dam has successfully diverted at least 2 more large avalanches.

the catching dam

in areas where a diversion isn't possible you will often find a catching dam, a structure built purely to stop an avalanche in its tracks, hopefully preventing any major movement beyond that point. the main part of a catching dam is the long, curved wall immediately above the community. further up you'll sometimes find a series of huge earth mounds, strategically placed in order to suck some energy from the flow before it hits the main wall and renders it useless. the photos above show the catching dam protecting drangagil, also in iceland.

below is video of a simulation of the taconnaz catching dam in action, the yellow areas being the part of the flow with highest energy…

supporting structures

steel supporting structures are the most common type of avalanche control system and can be found at the top of avalanche-prone mountains. huge horizontal lines of (usually) steel angled supports are built into the side of avalanche starting zones for a number of reasons: 1. to give support to the snow, therefore reducing the likelihood of an avalanche in the first place, 2. to remove the momentum of any small avalanches, 3. to prevent 'slab formation' by divding the snow into sections.

for more info, check out the source links below. you can also go here to read parts of the extremely interesting and useful (if you live or holiday amongst unstable mountains) 'avalanche handbook' - not all of it is readable through google books but it can be bought through amazon here.

Port Knocking

An Easy Tutorial on IP Tables and Port Knocking
Basic Preparation

Matt Waldo
Monday, February 4, 2008 10:53:27 AM

Do you wish you had access to your home file server without leaving your firewall wide open to attacks? Well today's your lucky day! While you can implement this on any OS its easiest to do this on Linux. This article will show you how to lock down your firewall and implement a port knocker to let you in.

We are going to achieve this using a Linux firewall and server, SLED 10.1 to be exact. Yes, you will be playing around with config files, but I'll give you a template you can work with so you can just copy/paste and change the things you need to change.

Before we get started you need to install some things along with the OS. Mainly:

• C/C++ Compiler and Tools Pattern
• Common Code Base (for certification) Pattern
• kernel-source Package
• kernel-syms Package

You can install these tools through YaST2, just make sure you have the install cd/dvd with you and remember to resolve dependencies.

The first thing you have to do is configure both network cards. That's right, I said "both." You need to have two network cards in this box to let it run as a firewall. You need to configure one as "internal" and one as "external." Again, you can do this through YaST2.

While your there, make sure the "External" card has no ports open and your internal one has all the ports open. The external card is the one that's going to be interfacing with the Internet and as such is the one running the firewall. If you can't figure out which card is which open a terminal, do an su - to change to root and type in ifconfig. Note the MAC addresses for each card (probably eth0 and eth1) and then compare them to the MACs you see in the YaST2 configuration screen. If your ISP gave you a static IP address, configure that in the external card as well, or else set up that card to optain its IP address with DHCP. The set up should eventually look like this: modem->SLED Server (a.k.a. firewall)->router->other computers.

I'm going to skip the rest of the card configuration steps; it's not that hard just play around with it. You need to set up your internal card to either give out IP addresses, or just put the IP address of your second card into the default gateway of your router. Go crazy and experiment, the worst that will happen is you need to reinstall or reset your router.

Configuration 101

Matt Waldo
Monday, February 4, 2008 10:53:27 AM

Now to secure your firewall. The YaST2 firewall is very nice except for one part. There are two types of packets that aren't treated the the same way. For every other packet, if the port is closed when it's sent to you, the firewall just eats them. To an attacker it just looks like the packets sent didn't hit anything and therefore there is no computer there.

For ICMP type 8 and IDENT packets, however, the firewall will send a response saying the port is closed and would you kindly please start attacking me because you now know someone is here. In order for the firewall to treat those packets like any other, you need to add an entry to the IP tables. open a console, su - into root, cd into /etc/sysconfig/scripts, start a text editor to open SuSEfirewall2-custom. Now, just copy and paste the following into the fw_custom_after_antispoofing() section of the document.

###################################################
#
# Start
# Rules to make the host invisible on the Internet
#
###################################################

# Setup new chain
iptables -N INVISIBLE

# Drop incoming ICMP packets
#(Note: uses $FW_DEV_EXT variable setup in main SuSEfirewall2 script)

iptables -A INVISIBLE -p icmp -i $FW_DEV_EXT -m state --state NEW -m icmp --icmp-type 8 -j DROP

# Drop identd packets from unknown hosts
iptables -A INVISIBLE -p tcp --dport 113 -m state --state NEW -j DROP

# Send the packets I want to examine further to my INVISIBLE chain
iptables -A INPUT -p icmp -i $FW_DEV_EXT -m state --state NEW -j INVISIBLE
iptables -A INPUT -p tcp --dport 113 -j INVISIBLE
###################################################
#
# End
# Rules to make the host invisible on the Internet
#
###################################################

While your at it, copy this as well and put it right under the previous code:

###################################################
#
# Start Port Knocking Configuration
#
###################################################

#Enter the 4 ports used as the port knocking combination
TOKEN1="10"
TOKEN2="20"
TOKEN3="30"
TOKEN4="40"

#Enter the port to open after successful know
OPENPORT="22"

#Enter the number of seconds the port will remain open waiting for you to connect
OPENTIMER="10"

iptables -N TOKEN1CHAIN
iptables -A TOKEN1CHAIN -m recent --name TOKEN1A --remove
iptables -A TOKEN1CHAIN -m recent --name TOKEN2A --remove
iptables -A TOKEN1CHAIN -m recent --name TOKEN3A --remove
iptables -A TOKEN1CHAIN -m recent --name TOKEN4A --remove
iptables -A TOKEN1CHAIN -m recent --name TOKEN1A --set
iptables -A TOKEN1CHAIN -m recent --name TOKEN1B --set
iptables -A TOKEN1CHAIN -j LOG --log-prefix "TOKEN1 Received: "
iptables -N PRE-TOKEN2CHAIN
iptables -A PRE-TOKEN2CHAIN -p tcp --dport $TOKEN2 -m recent --rcheck --name TOKEN1A -j RETURN
iptables -A PRE-TOKEN2CHAIN -p tcp --dport $TOKEN1 -m recent --name TOKEN1B --remove -j RETURN
iptables -A PRE-TOKEN2CHAIN -m recent --name TOKEN1A --remove
iptables -A PRE-TOKEN2CHAIN -j LOG --log-prefix "VIOLATION AFTER TOKEN1: "
iptables -N TOKEN2CHAIN
iptables -A TOKEN2CHAIN -m recent --name TOKEN1A --remove
iptables -A TOKEN2CHAIN -m recent --name TOKEN2A --set
iptables -A TOKEN2CHAIN -m recent --name TOKEN2B --set
iptables -A TOKEN2CHAIN -j LOG --log-prefix "TOKEN2 Received: "
iptables -N PRE-TOKEN3CHAIN
iptables -A PRE-TOKEN3CHAIN -p tcp --dport $TOKEN3 -m recent --rcheck --name TOKEN2A -j RETURN
iptables -A PRE-TOKEN3CHAIN -p tcp --dport $TOKEN2 -m recent --name TOKEN2B --remove -j RETURN
iptables -A PRE-TOKEN3CHAIN -m recent --name TOKEN2A --remove
iptables -A PRE-TOKEN3CHAIN -j LOG --log-prefix "VIOLATION ATFER TOKEN2: "
iptables -N TOKEN3CHAIN
iptables -A TOKEN3CHAIN -m recent --name TOKEN2A --remove
iptables -A TOKEN3CHAIN -m recent --name TOKEN3A --set
iptables -A TOKEN3CHAIN -m recent --name TOKEN3B --set
iptables -A TOKEN3CHAIN -j LOG --log-prefix "TOKEN3 Received: "
iptables -N PRE-TOKEN4CHAIN
iptables -A PRE-TOKEN4CHAIN -p tcp --dport $TOKEN4 -m recent --rcheck --name TOKEN3A -j RETURN
iptables -A PRE-TOKEN4CHAIN -p tcp --dport $TOKEN3 -m recent --name TOKEN3B --remove -j RETURN
iptables -A PRE-TOKEN4CHAIN -m recent --name TOKEN3A --remove
iptables -A PRE-TOKEN4CHAIN -j LOG --log-prefix "VIOLATION AFTER TOKEN3: "
iptables -N TOKEN4CHAIN
iptables -A TOKEN4CHAIN -m recent --name TOKEN3A --remove
iptables -A TOKEN4CHAIN -m recent --name TOKEN4A --set
iptables -A TOKEN4CHAIN -m recent --name TOKEN4B --set
iptables -A TOKEN4CHAIN -m recent --name TOKEN4C --set
iptables -A TOKEN4CHAIN -j LOG --log-prefix "TOKEN4 Received: "
iptables -N PRE-OPENPORT
iptables -A PRE-OPENPORT -p tcp --dport $OPENPORT -m recent --rcheck --name TOKEN4C -j LOG --log-prefix "TOKEN OK: "
iptables -A PRE-OPENPORT -p tcp --dport $OPENPORT -m recent --name TOKEN4C --remove
iptables -A PRE-OPENPORT -p tcp --dport $OPENPORT -m recent --rcheck --name TOKEN4A -j RETURN
iptables -A PRE-OPENPORT -p tcp --dport $TOKEN4 -m recent --name TOKEN4B --remove -j RETURN
iptables -A PRE-OPENPORT -m recent --name TOKEN4A --remove
iptables -A PRE-OPENPORT -j LOG --log-prefix "VIOLATION AFTER TOKEN4: "
iptables -A INPUT -p tcp --dport $TOKEN1 -m recent --set --name TOKEN1A -j TOKEN1CHAIN
iptables -A INPUT -m recent --rcheck --name TOKEN1A -j PRE-TOKEN2CHAIN
iptables -A INPUT -p tcp --dport $TOKEN2 -m recent --rcheck --name TOKEN1A -j TOKEN2CHAIN
iptables -A INPUT -m recent --rcheck --name TOKEN2A -j PRE-TOKEN3CHAIN
iptables -A INPUT -p tcp --dport $TOKEN3 -m recent --rcheck --name TOKEN2A -j TOKEN3CHAIN
iptables -A INPUT -m recent --rcheck --name TOKEN3A -j PRE-TOKEN4CHAIN
iptables -A INPUT -p tcp --dport $TOKEN4 -m recent --rcheck --name TOKEN3A -j TOKEN4CHAIN
iptables -A INPUT -m recent --rcheck --name TOKEN4A -j PRE-OPENPORT
iptables -A INPUT -p tcp --dport $OPENPORT -m recent --rcheck --seconds $OPENTIMER --name TOKEN4A -j ACCEPT

###################################################
#
# End Port Knocking Configuration
#
###################################################

Change the Token number from 10, 20, 30, 40 to any other numbers you want up to 1024. Think of this combination of numbers as your access code, because it is. This is the combination of numbers you will feed to your firewall to let you in, so remember them.

The other things you need to change before you restart your firewall are here:

1. Edit /etc/sysconfig/SuSEfirewall2 and change FW_CUSTOMRULES="" to FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom", and FW_DEV_EXT="any eth-id-xx:xx:xx:xx:xx:xx" to FW_DEV_EXT="eth0" or FW_DEV_EXT="eth1" (Use the correct name for your external interface, remembering the setting from YaST2.)
2. Restart the firewall service by issuing the following commands from a terminal as root:

   SuSEfirewall2 stop
   SuSEfirewall2 start
   

Bam: totally secure firewall that will let you through. How do you use it? Well, use differs depending on if you're trying to connect from a Linux box or from a Windows box, but the concept is the same. We can demonstrate the use from the aspect of a Windows machine, since that is the slightly more complicated setup.

Connecting to Windows

Matt Waldo
Monday, February 4, 2008 10:53:27 AM

To establish an SSH tunnel you need to download cygwin. You can get this Linux emulator from http://www.cygwin.com. Run the setup, choose to install from the internet, save it in c:\ and choose a mirror site to download from. At this point you'll see a long list of stuff you can download and install. Expand Net, and choose to install "curl" and "openssh".

Curl will allow you to throw a packet to a designated port on your firewall exactly once. So what you will do is set up a batch file to throw four packets at your firewall in order, to the four port numbers you specified earlier as your tokens. This will open the ssh port on your firewall for 10 seconds. at the end of your batch file it will call an ssh configuration file to establish the encrypted ssh tunnel so you can access your network. Its just that easy. just make sure that all the batch files, configuration files, and cygwin directory are in your c:\ directory.

Here is an example of the batch file and the configuration file.

cygwin\bin\curl -s -m 1 http://"IPADDRESS":"TOKEN1"
cygwin\bin\curl -s -m 1 http://"IPADDRESS":"TOKEN2"
cygwin\bin\curl -s -m 1 http://"IPADDRESS":"TOKEN3"
cygwin\bin\curl -s -m 1 http://"IPADDRESS":"TOKEN4"
cygwin\bin\ssh "username"@"IP ADDRESS" -F \"config file name"

The config file would look like this:

# Create a tunnel to access my private web server (192.168.0.10)
LocalForward 127.168.0.10:80 192.168.0.10:80

# Create a tunnel to access ssh on my web server (192.168.0.10)
LocalForward 127.168.0.10:22 192.168.0.10:22

# Create a tunnel to access the remote desktop on a Windows XP system (192.168.0.20)
LocalForward 127.168.0.20:3389 192.168.0.20:3389

To save as a batch file open Notepad, copy the code and when you save it give it a .bat extension. The "username" has to be an account no the computer you are trying to access, and the IP address is just that, the IP address of the computer you are connecting to.

If you are just trying to connect to a file server and don't care about the firewall portion of this you will probably have to port forward port 22 in your router. The IPADDRESS in the batch file refers to the IP of the server as well; however, the 192.168.*.* address is your homes INTERNAL address. So after making the SSH connection to your server, you can either access things on your server or you can go through the tunnel and touch other computers on your network. Suddenly, an encrypted tunnel for a remote desktop session with your computer at home without leaving your network wide open is a real possibility!

If you would like to be able to do this from any computer you sit down at then save your batch file, your configuration file, and cygwin to the root of a USB thumb drive. Just pop in the drive and run it from there to get an automatic connection.

IT meets the new kid on the block

Social Networking Meets the Business World

00:17:13 09.03.2008 added by usb

The business world seems to be on a constant collision course with new technologies, some of which are beneficial to the organization and some of which are not. Recently, the workplace has been colliding with that burgeoning technology-based phenomenon known as social networking.

The mass adoption of social networking tools, including instant messaging, is causing a lot of CIOs to grapple with the question: do tools used for social purposes have any place in the office?

Many organizations have taken the firm stance that they do not. They ban instant messaging applications and restrict visits to popular social networking sites, causing resentment amongst the "Generation Ys" entering the workforce. Other companies have welcomed the collision of the social world and the work world by adopting networking tools that enhance productivity and engage employees in a positive and enterprising way.

This article presents perspectives from three organizations that have chosen the latter course.

Nintendo 8 Bit Games

http://nintendo8.com/

Don Marco Crayola Artitst

Don Marco Crayola Artitst

Don Marco was born in Northern Minnesota in the late 1920's. His interest in art was evident even before starting school. As a young adult in the Army Air Corp, he began his life's career in Air Traffic Control, which continued until his retirement from Honolulu International Airport in 1973. Much of his spare time was spent as a professional artist. Before retirement, Don started developing a technique to create fine art using Crayola Crayons. Shortly after retiring he published his first print. Living in Southern California, his work was in demand including commissions from Burt Reynolds and a one-man show at his Dinner Theater in Florida.

The Monkey and The Lizard

The Monkey and The Lizard

One day there was a monkey hanging out in a tree smoking some real good weed. A lizard near by could smell the delicious aroma and decided to find out where it was coming from. After a few minutes of searcing he found the monkey. The monkey looked down at him and asked the lizard if he wanted to hit some of this good marijuana. The lizard obliged and climbed up the tree. After a few passes of the joint the lizard had some terrible cotton mouth and decided to walk down to the river and get something to drink. He told the monkey he would be right back for some more weed. While the lizard was gone getting a drink an alligator near by could smell the aroma and decided to find the source. He found where it was coming from and when he looked up he saw the monkey. The monkey looked at him in amazement and said "Damn Lizard how much water did you drink?"

Women Explained by Engineers

Women Explained by Engineers

Coffee Habit? Nah!!!

How to Defend Your Coffee Habit

I don't think I've read a productivity blog yet that didn't suggest kicking the coffee habit. I've kicked many bad habits in the last few years, something that seemed impossibly hard at first—such as dumping dairy—but coffee is one thing that I never succeeded with. That's probably because I never really wanted to.

While it truly is best that you cut caffeine out of your diet or curtail your consumption, for many of us it's the one thing we'll hold onto even when making other drastic changes in our lives. Never fear—there are still many benefits to drinking coffee, and I'll show you how to defend your manic addiction to the world when confronted by an overzealous stampede of crusading lifehackistas!

A Reduced Risk of Disease

Have you seen all those tea advertisements that claim it's the best source of antioxidants? Apparently, coffee is the number one source of antioxidants in the American diet. Tea comes second. Of course, that's a statistic measured on the level of consumption rather than the quality of the source.

Antioxidants prevent and slow disease and oxidative damage. When the body uses oxygen, the process creates harmful by-products that antioxidants destroy. This reduces the risk of disease and promotes optimal health.

This is one of the few benefits of coffee not derived from its caffeine content, so if you want to avoid high blood pressure or a heart attack, you can drink decaf without losing any health points—if you have a stomach strong enough to keep it down.

Counter-defense: fruits and vegetables are an even denser source of antioxidants.

Increased Mental Performance

This is why we start drinking coffee in the first place, right? I started binge drinking coffee in order to stay up all night working on various projects, though it didn't take long for coffee consumption to become a hobby in its own right.

Drinking coffee improves your concentration, alertness and staves off a tired mind. For me, work comes to a halt when I'm missing any of the above, especially concentration or alertness. Ten or twenty minutes after a cup of coffee, I can be back to work for a few more hours.

Apparently coffee improves your short term memory, which indicates that I'm not drinking nearly enough of it. Did I mention that coffee improves your short term memory?

Counter-defense: eating a diet low in meat and dairy and high in vegetables and fruit will provide increased mental performance and higher energy on a more consistent basis.

Make Shift Work Slightly More Tolerable

Shift work forces the body into strange sleeping patterns, or more accurately, a lack of a sleeping pattern. Your body relies on patterns to tune and operate the whole circadian process which tells you when you're in need of sleep or when it's time to be awake. Lacking a solid pattern means you'll be pumping melatonin or adrenaline through your body at very strange times.

I know someone who took their car through a street sign (and escaped without getting caught) because of the way shift work destroys your sleeping patterns, so for these workers caffeine is not as much of a luxury - it becomes a necessary part of safely performing the work and getting there and back. Drink 200mg (two espressos) to keep yourself attentive on the job for a period of five or six hours. If you've got a killer twelve hour shift, throw back a few more halfway through.

Drinking 400mg of caffeine in one night isn't the healthiest thing you could be doing, but neither is shift work.

Counter-defense: become a freelancer!

Improve Endurance and Stamina in Physical Activities

It is well known that coffee improves endurance and stamina in physical activities, especially sports. The last time I played any team sport, I could count my age on two hands. Nevertheless, a cup of coffee before the morning run makes it go that much faster and easier.

If you're starting an exercise routine (or returning to one) and having trouble with the adaption, drinking a cup of coffee before starting may make it easy enough to get over the hump and make it a habit. If all you need is an adaptation tool you can stop drinking it once you can get through each session on your own.

Counter-defense: with stamina and endurance training, you don't need a cup of coffee to enable your body - you can apply these traits at any time.

Improve Your Ability to Socialize

A few cups of coffee can really help the introvert or cynic to come out of the shell and enjoy social situations. Coffee houses first formed in the Middle East hundreds of years ago and became popular as social locations, a tradition that has continued to this day. It's got to do with not only the great atmosphere, aroma and architecture of most coffee houses, but of course, the effects of caffeine kicking your mind into gear and boosting your mood.

There is evidence to show that coffee doesn't boost your mood so much as reduce stress by eliminating the hormone cortisol. Cortisol is responsible for the frazzled, distressed feeling brought on by day-to-day stress.

This one works well for me—especially for making visits to the wife's family much more bearable!

Counter-defense: get a life, make some friends!

Truly, there is no substitute for replacing a caffeine dependency with the optimal diet for your body and lifestyle. Drinking too much coffee can wreak havoc on your system, especially your sleep patterns and blood pressure.

The latest research shows that drinking 200mg of caffeine or more a day can double the risk of miscarriage in pregnant women. If you're pregnant, watch your intake, or better yet, just stop consuming caffeine altogether.

That aside, coffee drinking has a far worse reputation than it deserves; the benefits are real, and in moderation, it's actually a good idea to get some coffee in your system. Go ahead. Have a cup—you know you want to!

AV Options 2008

Best antivirus software for 2008

Wed Feb 27, 2008 12:43AM EST

You're crazy to use a computer on the web without antivirus software, but getting solid antivirus protection doesn't have to mean spending a fortune. In fact, some of the most capable antivirus products don't cost a thing.

Here are some of my personal thoughts on the best antivirus products on the market, both free and commercial.

Free

Alwil Avast! 4.6 Home Edition - Venerable Avast! is still free for personal use, and it's a relatively unobtrusive and capable virus stomper that will work well for just about anyone. A new feature adds a web proxy to the mix (which filters all traffic running through it for security risks), and it works will all major web browsers. It also recognizes non-virus threats like spyware and adware. The Pro edition ($40) adds a few power-user features that the average user probably won't miss. Give the free version a try!

Aviva AntiVir PersonalEdition Classic 7 - This has long been a capable and effective antivirus product, especially noteworthy for its fast operation.

UPDATE: Many readers have asked me about Grisoft's AVG product. I've used it and don't really prefer it to Avast/Aviva, namely because it does not seem to scan all files effectively. Independent security ratings place it relatively low in overall capability as well. Your mileage may vary, of course.

Paid

Trend Micro Internet Security Pro - Trend Micro has long been an also-ran in the antivirus world, but after spending some time with a recent version of the software I've been impressed with how well it works, its paucity of crashes, and how generally effective it is. Trend offers three vaguely similar versions of its security application; this one ($70) is the most inclusive, and cheaper than the rest. You can also get plain antivirus for just $40.

Kaspersky Internet Security 7.0 - If you want absolute and utter control over every 1 and 0 that enters and exits your computer, Kaspersky is the app for you. I honestly don't think you can get any more secure than with Kaspersky locking down your system, but it was overkill even for me, and I had trouble convincing it not to remove some applications I knew were OK and actually wanted on my PC. Kaspersky is a hungry shredder with no reverse button (and it's on the slow side, too). $80. (Anti-virus only is $60.)

Symantec Norton 360 - I've been a Norton user in various forms for close to a decade; the latest version doesn't do much different than the last few years' worth, but it's still rock-solid security that I don't hesitate to rely on. My only complaint is that Norton can slow down your computer quite a bit (like Kaspersky) and almost invariably hangs when I'm trying to shut down my computer. If you've ever wondered where all those error messages about programs like "ccApp" not responding come from, well, you've found it. It

Yep, It's a Recession

The Latest Data: Yes, It’s a Recession

By Justin Wolfers

There has been a lot of hand-wringing about whether or not the U.S. economy is currently in a recession. This morning’s data will, I think, lead to a near-unanimous view that the U.S. economy is in a recession. Not only was employment growth in February negative, but the B.L.S. also tells us that the previous two months were worse than originally thought. Over the past three months, non-farm payrolls fell at an annualized rate of about 0.1 percent.

As the chart below shows, in virtually every instance in which payrolls fell over a 3-month period, the NBER business cycle dating committee declared the U.S. economy to be in recession. Indeed, the only exceptions to this rule occurred over 50 years ago.

A few more thoughts:

1) The only thing to save us now: these are preliminary data, and a big upward revision could give a different view. But given the run of other recent economic data, it seems pretty darn clear that the macroeconomy is currently pretty grim.

2) What the politicos will say: given where we are in the political cycle, expect some commentators to point instead to the survey-based measure of the labor market. These data are based on a survey of workers rather than firms, and tend to yield noisier estimates. And when numbers can jump around a lot, it gives plenty of scope for political operatives to choose the specific numbers that support the particular story they are trying to tell. Even so, there’s not a lot of good news in the survey data.

3) What many macroeconomists will be pondering: does this second recent recession challenge the view that we are in the midst of a “great moderation,” in which the business cycle has been tamed?

4) The chances of a recession, according to Intrade.com, have risen to somewhere around 60 percent. But these traders are predicting the chances of two consecutive quarters of negative GDP growth, rather than the decisions of the NBER business cycle dating committee. The latter seems much more likely than the former (although both are likely).

Learning From Leadville

Learning from Leadville

By Jim Starr

Article Last Updated: 02/29/2008 10:45:05 AM MST

The toxic drainage that threatens Leadville is a story that could easily be repeated in other towns across the West. While Leadville's toxic threat comes from a facility built 60 years ago, the law that governs mining in the West today is more than twice as old.

Failure by Congress to change this historic law could lead to environmental problems of historic proportions.

The law signed by President Ulysses S. Grant encouraged prospectors to develop the West, offering them the chance to take gold and other precious metals from public lands in unlimited amounts. Mining was done with picks and pans, and towns were few and far between, so mining was given priority on most public lands over almost everything else.

But today, a law that gives global companies basically free reign to mine on millions of acres of Western public lands with few restrictions no longer makes sense. Places like Gunnison County, which is more than 80 percent federal land, are particularly vulnerable to the law's effects. Our main source of income, recreational tourism, is dependent upon clean water, clean air and pristine landscapes.

Yet we still live with a law that allows hardrock (metal) mining, one of the nation's most toxic industries, to proceed without effective water quality or other conservation safeguards. What's more, local governments and civic-minded groups have little say about the location of mines that could impact their environmental and economic future.

When mines are poorly designed, a chemical chain reaction can occur that creates water pollution that will never end. But under the 1872 law, there is little to stop the mine operators from creating and then abandoning such problems. In Crested Butte's backyard, a water treatment plant with an annual operation cost of $1 million treats mine-polluted waters. Ongoing treatment is essential, but we have no clear assurance of the plant's continued operation.

When it comes to protecting our residents from the impacts of mining, the county and town's hands are tied. U.S. Energy and Kobex Resources Ltd., a Canadian company, are now moving forward with a mine less than 3 miles outside of Crested Butte.

Unfortunately, a federal court has ruled that under the 1872 law that local communities like ours have no voice in critical decisions about deeding public land over to private mining interests.

But help could be on the way. Last fall, the U.S. House passed bipartisan legislation that would allow communities to petition for special lands to be withdrawn from mining and to ensure that mines are well bonded and meet water quality standards.

The issue is now under consideration by the Senate Energy and Natural Resources Committee, where Colorado's Sen. Ken Salazar is expected to play a key role.

Time is short. According to a recent analysis of government data by the nonpartisan Environmental Working Group, claims on Colorado federal lands jumped 239 percent from their 2003 levels.

Let's learn from Leadville. It's a story we don't want to repeat.

Jim Starr has been a Gunnison County commissioner since 1999. He lives in Crested Butte.

Learning From Leadville 2

> "Let's learn from Leadville. It's a story we don't
> want to repeat." 1
>
> That's what Jim Starr, a Gunnison County
> commissioner, had to say in response to the toxic
> mining mess that's threatening the people of
> Leadville.
>
> We couldn't agree more.
>
> Unfortunately, the mining law that led to Leadville
> is still around today -- in fact, it's been the law
> of the land since 1872.
>
> The 1872 Mining Act gives mining companies free
> reign to extract resources, get rich and get out,
> leaving cash-strapped towns and counties to clean up
> their mess or deal with the toxic consequences.
>
> The good news is that there's movement in the Senate
> to reform the law and prevent another Leadville and
> Colorado Senators Ken Salazar and Wayne Allard could
> play a key role.
>
> We're calling on Senators Salazar and Allard to sign
> on in support of a bill that would protect our wild
> lands and communities from the leftovers of toxic
> mining. Click the link below to take action now.
>
> http://www.environmentcolorado.org/action/preservation/learn-from-leadville?id4=ES
>
> Colorado is facing down another mining boom: In just
> four years, mining claims across the state have
> jumped over 230 percent.
>
> Environment Colorado has been working in the
> Statehouse to pass legislation that would protect
> against radioactive pollution from uranium mining --
> an urgent threat to some of Colorado's most
> beautiful landscapes, such as the Dolores River
> Canyon northwest of Telluride.
>
> But we also need Colorado's senators to stand up for
> constituents in communities across the Rocky
> Mountain State by supporting critical mining reforms
> in Washington, D.C.
>
> Let's learn from Leadville, and take the next steps
> to make sure something like this never happens
> again. Take action now:
>
> http://www.environmentcolorado.org/action/preservation/learn-from-leadville?id4=ES
>
> Sincerely,
>
> Matt Garrington
> Environment Colorado Field Director
> MattG@environmentcolorado.org
> http://www.environmentcolorado.org
>
> P.S. Thanks for your continued support. Please feel
> free to share this e-mail with your family and
> friends.

Immunization Shots

www.theonion.com

Friday, March 7, 2008

Adults Eschew Simple Immunizations

A Centers for Disease Control survey revealed that statistically few adults get immunization shots for common ailments, such as tetanus and influenza. What do you think?

Tabitha Flynn,
Machinist
"If I'm getting immunized, I'm going for the good stuff, like the monkeypox and Japanese encephalitis, not your everyday garbage diseases."

Sam Fox,
Bus Driver
"Without the smiley-face Band-Aid and Dum Dum lollipop, I hardly see the point."

Arnold Lithman,
Gem Cutter
"I don't mind having the flu every now and then, so I can give it to people I hate at work."

Signs You Drink Too Much Coffee

- You answer the door before people knock.
- Juan Valdez named his donkey after you.
- You ski uphill.
- You grind your coffee beans in your mouth.
- You haven't blinked since the last lunar eclipse.
- You lick your coffeepot clean.
- You're the employee of the month at the local coffeehouse and you don't even work there.
- Your eyes stay open when you sneeze.
- You chew on other people's fingernails.
- Your T-shirt says, "Decaffeinated coffee is the devil's blend."
- You can type sixty words per minute ... with your feet.
- You can jump-start your car without cables.
- Cocaine is a downer.
- You don't need a hammer to pound nails.
- Your only source of nutrition comes from "Sweet & Low."
- You don't sweat, you percolate.
- You buy 1/2 & 1/2 by the barrel.
- You've worn out the handle on your favorite mug.
- You go to AA meetings just for the free coffee.
- You walk twenty miles on your treadmill before you realize it's not plugged in.
- You forget to unwrap candy bars before eating them.
- Charles Manson thinks you need to calm down.
- You've built a miniature city out of little plastic stirrers.
- People get dizzy just watching you.
- You've worn the finish off your coffee table.
- The Taster's Choice couple wants to adopt you.
- Starbucks owns the mortgage on your house.
- Your taste buds are so numb you could drink your lava lamp.
- Instant coffee takes too long.
- When someone says. "How are you?", you say, "Good to the last drop."
- You want to be cremated just so you can spend the rest of eternity in a coffee can.
- Your birthday is a national holiday in Brazil.
- You're offended when people use the word "brew" to mean beer.
- You have a picture of your coffee mug on your coffee mug.
- You can thread a sewing machine, while it's running.
- You can outlast the Energizer bunny.
- You short out motion detectors.
- You don't even wait for the water to boil anymore.
- Your nervous twitch registers on the Richter scale.
- You think being called a "drip" is a compliment.
- You don't tan, you roast.
- You can't even remember your second cup.
- You help your dog chase its tail.

Jokes

______________________________

The cucumber says "I hate my life, when I get big fat and juicy they cut me up and put me in salad."

The olive says "That's nothing, when I get big fat and juicy they cut me up and put me on pizza."

The penis says "You think you have it bad, when I get big fat and juicy they put me in a bag, throw me in a cave, shut the door and leave me there till I throw up"
______________________________

This is a story about a couple who had been happily married for
years. The only friction in their marriage was the husband's habit of farting loudly every morning when he awoke.

The noise would wake his wife and the smell would make her eyes water and make her gasp for air.

Every morning she would plead with him to stop ripping them off because it was making her sick. He told her he couldn't stop
and that it was perfectly natural. She told him to see a
doctor. She was concerned that one day he would blow his guts out.

The years went by and he continued to rip them out! Then one Thanksgiving morning as she was preparing the turkey for dinner and he was upstairs sound asleep, she looked at the bowl where she had put the turkey innards and neck, gizzard, liver and all the spare parts and a malicious thought came to her.

She took the bowl and went upstairs where her husband was sound asleep and, gently pulling back the bed covers, she pulled
back the elastic waistband of his underpants and emptied the bowl of turkey guts into his shorts.

Some time later she heard her husband waken with his usual trumpeting which was followed by a blood curdling scream and
the sound of frantic footsteps as he ran into the bathroom.

The wife could hardly control herself as she rolled on the floor
laughing, tears in her eyes! After years of torture she reckoned she had got him back pretty good.

About twenty minutes later, her husband came downstairs in his
bloodstained underpants with a look of horror on his face.

She bit her lip as she asked him what was the matter. He said, "Honey, you were right. All these years you have warned me
and I didn't listen to you.

"What do you mean?" asked his wife.

"Well, you always told me that one day I would end up farting my guts out, and today it finally happened. But by the grace of God, some Vaseline, and these two fingers, I think I got most of them back in.
______________________________

Subaru STI - Diesel

Subaru STI: Is Diesel the Intersection of Power and Fuel Economy?

We all know that fast cars are fun and fuel-sipping cars are environmentally responsible, but is there a middle ground?

Short of expensive electric sports cars like the Tesla Roadster, there may be a solution to be found in diesel. Not only can diesel cars be fueled with waste vegetable oil, biodiesel, or some mixture of these fuels, but diesel engines produce a lot of torque and get better fuel economy than their gasoline-powered brethren.

Autoexpress reports that the Impreza lineup will soon feature a 2.0L diesel engine sporting 148 bhp - but that engine could easily be tuned up to 180bhp for use in a sportier WRX model. This model could go 0-60 in under 7 seconds and wouldn't top out until a respectable 140 mph.

Certainly impressive, but what we really care about is the fact that this engine could achieve up to 45mpg and reduce CO2 emissions 40% compared to the gasoline-powered STI.