The DMZ - 2011-06-20

« first day (186 days earlier) ← previous day next day → last day (4715 days later) »

1:08 AM

Is it possible to migrate a question that has a bounty?

7

Q: Hiding user account names from unauthenticated RDP sessions.

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The system does not display my username on the Welcome screen at boot-up, or when the session is loc...

authentication windows data-leakage remote-desktop rdp

@AviD I don't even know where to go with that one. It's just screaming trollbait.

@Iszi Can we migrate to serverfault? I don't see it in the list of available options. Were you thinking of migrating it to superuser?

@Ori I don't think we get any site, other than our own meta, as an option during beta.

I was thinking of SU, but SF would probably be just as well.

@AviD @RoryAlsop @GrahamLee - What happened with @LanceBaynes? He's got a lot of up-voted questions but only 1 rep? Did he get mod-smacked?

1:28 AM

@Iszi He threw 350 rep at a bounty and has a bunch of downvotes since.

6 hours later…

7:10 AM

Stack Overflow Blog: Creative Commons Data Dump Jun ’11

Posted by Jeff Atwood on June 19th, 2011

The latest version of the Stack Exchange Creative Commons Data Dump is now available. This reflects all public data in …

… up to Jun 2011.

This month’s Stack Exchange data dump, as always, is hosted at ClearBits! You can subscribe via RSS to be notified every time a new dump is available.

Please read, this is not the usual yadda yadda! Three things:

If you’d prefer not to download the torrent and would rather play with the most recent public data in your web browser right now, check out our open source Stack Exchange Data Explorer. …

4 hours later…

10:43 AM

@Iszi @Ori so I was actually starting to worry about that user account a couple of days back. Historically he's given some useful contributions, but recently has been going wildly off-topic and posting low quality content.

11:33 AM

@GrahamLee And let's not forget getting incredibly pissed when someone offers advice

that doesn't help.

I would much rather have a user with questionable content that's willing to accept criticism, than this.

12:01 PM

@GrahamLee Was figuring it would have had something to do with that. In the past, I've been able to see where a user account has been locked, and I didn't notice that this time.

@Ori Oh yeah, that would do it too.

12:29 PM

Hey @Iszi

@ScottPack Hiyo

Hrm. It would seem I'm the only one in this room (at the moment) without a custom Gravatar.

12:53 PM

@Iszi There's a badge for a "full bio", and I am not sure whether a custom picture is needed for that -- but it sure prompted me to include one.

@ThomasPornin it's amazing how readily security experts will hand over extra information in return for a bronze badge :D

3

@GrahamLee Just like the Passwords for Chocolate movement. How accurate is the data?

Filtering ICMP is bad.

2

I cannot directly connect to my mail server this morning.

But I have a shell account elsewhere from where I can connect to the server.

yeah, I don't really understand the 'OMFG but people can enumerate your hosts' deal.

Because they can do that any one of a number of other ways.

traceroute is not informative about the location of the problem, because ICMP are dropped.

1:07 PM

I don't find traceroute to be a very good example, simply because of the fact that different systems implement it differently.

Path MTU discovery is probably the best general purpose reason for not blocking ICMP (at least at the network layer)

Active Directory also really enjoys having ping functional.

1:26 PM

as in: stops synchronising properly if it isn't?

1:36 PM

The first gateway in my ISP network is G. My mail server is M and is "far away". I have a shell account on an extra machine E (which is also "far away"). From my home (H), I can ping G. I can also ping G from M and from E. From E I can ping H, too (my own machine). But I cannot ping M from H or H from M.

In short words, it seems that the problem is with my ISP, but I have no idea how I could explain that to them.

Yes, I did reboot my modem.

@GrahamLee Yeah, weird things like that. It seems a bit inconsisitent, though I'm sure a proper Windows guy understands better. I know that it uses ping to determine your "closest" DC, so everything should work without ping. However, I've seen cases where servers will only pull down GPOs and the like iff ping succeeds.

@GrahamLee a great talk all about that was: the robin sage talk last year. science.dodlive.mil/2010/07/21/…

@Ori there was a speaker at B-Sides London who said he asked candidates for info sec posts "what is your password?" at interviews, and 30% told him :-/

@GrahamLee So these were IS type guys, or just normals?

IS types

*unemployable IS types

1:49 PM

Ah, full Internet is back. Problem solved itself.

@GrahamLee good god, might as well ask for their social.

@ThomasPornin They must have gotten the magic smoke back in.

@ScottPack only time I got a laugh for the "magic smoke" joke was a time when it escaped.

2:33 PM

What do we think: too angry?

0

A: Is PCI DSS applicable to other solutions than those dealing with payment cards?

Some of the PCI DSS requirements may apply to situation (in fact, it's highly likely that some of them will). However, your application will have requirements that are specific to its problem domain, and that PCI does not address: similarly, PCI will make some requirements that are irrelevant (or...

I think I need to read his question again after some time. It feels...wonky.

1 hour later…

3:37 PM

@Iszi This $4 tester is probably the best money I've spent on electrical anything: bit.ly/l5F2yo

Splurge for the $8 variety and it will come with a ground fault test mode as well.

@ScottPack Cool. Thanks. Based on some of the other comments to that article, I don't think that's a project I'll be jumping on too soon.

Hey guys, had a quick question wondering if this is the right place to post or not. We are looking at using something like urlscan to help increase the security stance of our IIS servers. The two that I have found are urlscan and webknights. I'd basically be wondering what peoples thoughts were on the two solutions and why they would recommend either... etc etc

@CtrlDot Might not be a good question for the site, but definitely welcome in chat.

thanks Iszi. Do you have any thoughts then?

@Iszi When we moved in I needed to get some power to the other side of the room, but couldn't run new in wall wiring because of how the basement was finished. So a spool of romex, 1 grounded end, run of raceway, and one external mount outlet box later I pretty much did the same thing.

3:47 PM

@CtrlDot Not on those particularly, but you might want to check out Acunetix also.

@CtrlDot Asking a direct comparison of those two on the main site would be bad form, S&M and all that. But, I think you could probably divide it up into two questions asking about each tool in particular.

have you used this one before @Iszi? What did you like about it?

Then do your own comparison.

okay thanks @ScottPack

@CtrlDot Our organization just started with Acunetix. I haven't had hands-on with it myself, but thought I'd throw it in there.

3:49 PM

yeah I guess my question is more general about what do people do to protect IIS

i know I can read a book, but there seems to be a lot of options when it comes to WAF

Are you intending to protect IIS or your underlying(overlaying?) web applications?

These tools don't actually protect IIS, or any web server for that matter. They just help show you where the weak spots are, so that you can do patching and hardening.

Both to a certain degree. I guess this is more for the the web application itself

I could use something like IIS lockdown to protect IIS, or so I read

You definitely need to do both, but how you go about doing it will be different for each

fair

I think a WAF is a good way to go for the application itself

why have your web app deal with xss when it can be blocked before it reaches it?

(it should still deal with it tho)

« first day (186 days earlier) ← previous day next day → last day (4715 days later) »

Transcript for

Jun '1120

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile