Re: decoy traffic and legal admissibility of logs in court

[Andreas Bogk <andreas () andreas org>]

Sebastian <scut () nb in-berlin de> writes:

> With logs, it's just the same, they are weak, can be spoofed, changed,
> compromised, deleted, anything can be done with them. In case they are not
> modifyable (like line printer logs) you can still add data to them, or
> modify data that goes to them.

There has been some work on unmodifiable log files, basically using a
published hash as a checkpoint. See for instance:

http://www.iks-jena.de/mitarb/lutz/logfile/

Andreas

-- 
Reality is two's complement. See:
ftp://ftp.netcom.com/pub/hb/hbaker/hakmem/hacks.html#item154