I just love classical music. #2 on this list of (i'm told) free classical downloads is "Air on the G String" by Johann Sebastian Bach. I didn't know such things existed in those times! gardnermuseum.org/music/listen/music_library?filter=composer
ah - but it isn't like pdf exploits where the problem is that the pdf is allowed to contain macros. a music file (wav, mp3 etc) should not be allowed to have macros
without an expectation of executable instructions, your vulnerability is restricted to things like buffer overflows etc
but admittedly, out of the wider pool who are eligible to vote only about 15% have even visited the page which means under 6% of possibles have actually voted
Heyo diamonds! @RoryAlsop @AviD @GrahamLee: Could one of you take a look at this guy? Seems like he's spreading at the very least a bad attitude, and at worst some erroneous information.
@JeffFerland Was about to pretty much say just that. It seems he's posting primarily in contention with existing highly-voted and accepted answers that have been posted by well-respected members of the community who have in some cases more than proven their knowledge in the fields in question.
Use SHA256 instead of SHA1 ( they say it is SHA1 is not considered too strong now a days)
Then "they" are wrong.
Anyway:
I have no idea what you (= the OP) are trying to do. Why not use SSL for all requests, not just for the initial HTTPS request? If it is only an optimisation, it ...
Great example of that... ad-hominem to the poster, contradiction of SHA1 vs. SHA256...
this helps to somewhat disenchant them of their sense of anonymity on your network
They may not feel anonymous, but they are anonymous (inside the set of people that asked you the passphrase - if the set consists of 1 person, the anonymity is limited).
Additionally, if you decided to imp...
I made the mistake of composing and posting a full response to that one, before I really checked into this guy.
@Iszi I think it would. It's one thing to redirect the new guy on current questions; it's more disruptive when he's dragging up stuff that's 10 months old.
The main point of public/private key authentication is not to let your secret out, even to the party you're authenticating to. For this reason, using keys is better, as you never send your secret outside your machine.
Is challenge password authentication not supported by SSH?
And this may be because reputation on deleted posts & votes is not shown in the lists, but it does appear to be reflected in the graph.
There should be a "reformed" badge that's extra-special for users who achieve x negative rep and/or flags over y time, and then afterwards gain z positive rep.
Note: This is for my personal use. I'm not going to hack someone else's website.
I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good resources for learning how to hack my websites?
I already know about Hack This Site.
Could someo...
What is the effect of the Spam flag?
The spam flag is designed to eliminate posts with no relevant content and to penalize the authors:
3 flags (spam or offensive): post is banished from the front page.
6 flags (spam or offensive): post is locked, deleted, and the first revision owner loses 10...
> 6 flags (spam or offensive): post is locked, deleted, and the first revision owner loses 100 reputation.
What are the books you advise describing methods or steps required to make a successful penetration test?
I have a base knowledge of common security checks, but it would be great if someone more experienced describes the full test.
I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.
@JeffFerland True. SO has a few too, but they're mostly "for historical reasons". I don't think they're necessarily bad, but they are discouraged, which means if we can get the OP to ask what they actually want out of those resources, that's better.
I'm trying to amass a list of programming books that are freely available on the Internet. The books can be about a particular programming language or about computers in general.
What are some freely available programming books on the Internet?
A lot of the current close reason discussion came from the fact that... well, look at the top voted questions on SO: stackoverflow.com/questions?sort=votes
This question exists because it has
historical significance, but it is not
considered a good, on-topic question
for this site, so please do not use it
as evidence that you can ask similar
questions here.
More info: http://stackoverflow.com/faq
Nobody likes waiting but unfort...
I'd like to ask a question about "how do I know a course or qualification is any good?"; but I'd like it to be a good fit for SE.
The specific courses I have in mind are the Backtrack Wifu course, and the MyHardDriveDied course. But I wouldn't ask about those two specifically.
So, Security.SE,...
So, here I am. I'd like to know if the course is any good. And then if I list the certificate on my resume will any employer recognise it? See, for example, the course at MyHarddriveDied, which is mostly stuff I've already done, but then with advanced stuff like "platter replacement" (tools and equipment included in price).
@JeffFerland - yes, at first it'd be just local data recovery stuff (and really, I don't need it for that) but then to use on a resume / CV for some kind of full time work.
@DanBeale I think you may have to illustrate what you took... I don't recognize them as a known name, but it coudl be useful for jobs that focus on forensics.
I thought the platter replacement thing was mostly myth (or just theory, or very expensive). So, a course on $RECOVERY_SOFTWARE is no use to me; I can do that.
Although many SSL certificates have been boasting extravagant guarantees -- typically around $10k minimum to $250k per breach -- to ensure their certificates are valid, to this date, I've heard that there has never been a single payout due to the fact the certificates limit the warranty to just d...
@Iszi It's a legal question that couldn't be answered without a technical professional. Needs an example, though. Without reading one I can't begin to guess.
Technology changes over time. Any business tied to technology will necessarily change along with it. Therefore even though we try to have answers that will be relevent in the future some of them will time out.
@thisjosh I'm not even talking about temporal localization. The question is localized further based on your agreements (or lack thereof) with the organizations, and local laws. Neither of these are things that our community is expected to provide expertise on.
@ScottPack I see the custom gravatar in the room list, too. So, it's as if whenever he has the gravatar at a certain size it uses the custom one, but below that it uses the default.
@thisjosh SSL guarantees are limited to the organizations which are involved in signing such agreements. The enforcement of said agreements in court then varies by jurisdiction.
So, I believe it's like going into another SE and saying "My computer got damaged by lightning while plugged in via XYZ UPS/Surge Protector. Do they have to pay me for the damage?"
@thisjosh I imagine they probably do. However, their guarantee probably varies by jurisdiction and may also vary depending on what sort of service level you've subscribed to with them. Further, the enforceability of those agreements in court will also vary by jurisdiction.
@JeffFerland Still not making sense. The large would have been the first loaded, as it is the same (or is it?) used to represent you in the room listing.
"Copy Image Location" returns the same for both large images.
It matters: if you choose a CA so incompetent/dishonest that it gets kicked out of root cert store, then you better get in touch with another CA quickly.
It does NOT matter: any cert accepted by browsers will work equally well.
It DOES matter: informed "paranoid" users DO worry about CA that ha...
@Iszi @RoryAlsop - You might want to keep an eye out for that, by the way. I'd rather let you have first crack at it if/when it comes.
@RoryAlsop @AviD @GrahamLee - Could one of you guys please handle the situation with @corrector? Apparently, I forgot that it also takes 5 rep to post in meta!
So, I guess people without enough rep to access the best resources available to help themselves avoid causing trouble still have enough rep to cause trouble?
@Gilles Are you sure? Besides, I'm pretty certain any up-vote I'd give him would only be negating down-votes and essentially get nulled out.
@Gilles Not sure why you say he seems to be familiar. Down-votes are pretty easy to notice, and he's obviously learning the chat/meta rep requirements the hard way.
@Iszi up. There's even a known exploit that if you downvote someone at 1 rep and cancel your downvote, they get to 3 rep. You can't go beyond 3 that way, so it's not a big deal.
@Iszi I looked through his answers. I don't understand all the issues, but none seemed worthy of an upvote, though I didn't downvote any either. So I can't give him extra rep. He could make a worthwhile edit, if he's determined to get to +5, but I suspect he won't care.
@Gilles He'd still need at least two up-votes (or one canceled down-vote, and an up-vote) on any current post to bring one of them into the positive. He could also post a new answer worth up-voting to an unanswered question. But that also seems unlikely, so I really hesitate to encourage him to answer anything else.
@Gilles I'd ask if you're able to invite him, since you've kinda got that blue diamond in all the chat rooms. But, I don't have time to deal with it right now. I've got to move on to other things.
I don't think I can do it (I think I could only invite him to a chatroom that's associated with Science Fiction and Fantasy), and anyway it's up to the [sec.se] mods to decide what to do with the guy.
His main issue now seems to be that he can't participate in chat or meta, so we can't really have a live discussion with him about improvement of his posts.
@RoryAlsop I think @@ would create a chat account if there isn't one yet, so you could @@ him here then invite him here (or maybe @@ would in fact suffice)
The lolcat came from a problem with the Stack Overflow API; this should be fixed now.
Users with less then 20 reputation cannot talk in chat unless a moderator gives them access (I've done that [temporarily] in this case). We're still looking at ways to allow high-rep users to create temporary p...
Note: This is for my personal use. I'm not going to hack someone else's website.
I have several websites, and I'd like to learn how to hack them so that I can secure them. Where can I find some good resources for learning how to hack my websites?
I already know about Hack This Site.
Could someo...
What is the effect of the Spam flag?
The spam flag is designed to eliminate posts with no relevant content and to penalize the authors:
3 flags (spam or offensive): post is banished from the front page.
6 flags (spam or offensive): post is locked, deleted, and the first revision owner loses 10...
I'm looking to sit for my exam in a few weeks, and I want to have a good set of practice tests to bounce against and make sure that I'm up to par with the types of questions that will be asked.
I'm trying to amass a list of programming books that are freely available on the Internet. The books can be about a particular programming language or about computers in general.
What are some freely available programming books on the Internet?
This question exists because it has
historical significance, but it is not
considered a good, on-topic question
for this site, so please do not use it
as evidence that you can ask similar
questions here.
More info: http://stackoverflow.com/faq
Nobody likes waiting but unfort...
I'd like to ask a question about "how do I know a course or qualification is any good?"; but I'd like it to be a good fit for SE.
The specific courses I have in mind are the Backtrack Wifu course, and the MyHardDriveDied course. But I wouldn't ask about those two specifically.
So, Security.SE,...
