I live in Lebanon, not USA I've recently asked this question.
somehow I managed to know the cellphone number of the thief:) so i wounder if i can get a location? I know that civilians are probably not allowed to do so, that's why i came to here for help, you know everything about these things.
...
Based on some of the comments here I went and looked at the FAQ again. We've always, as far as I can remember, closed policy subversion questions as Off Topic.
The question that brought this up is this one and it apparently got people interested in it because it's about trying to gain access to...
I've been trying to figure out/remember some of the major classes of web-app security faults. SQL-injection, cross-site scripting, and simple 'input validation' are the ones I remember. What are the others?
Also, could a mod clean up the comments here? Looks like a lot of them are SF-specific and do not necessarily reflect the views of our community. By the way, is that close vote from here, or did it get carried over?
Unfortunately our government filters the SSH protocol so now we can't connect to our Linux server from Iran.
They do the filtering by checking the header of each packet in the network layer (and not by just closing port). They also do with with VPN protocols.
Is there any alternative way to con...
@nealmcb I mean, how can we, in good conscious, develop policies/procedures/recommendations on how to institute such systems if we also explain to circumvent the ones we don't agree with?
@ScottPack On the other side, some are pointing out that there are engineers in the US that are apparently actively collaborating with the countries that are torturing citizens who try to share information about human rights violations in their country. Pretty hard to define "security" so that trying to give people info on securing their own privacy and thus people's lives is off topic.
by the way, thanks for the responses - I agree that this is a tough one, and finding the brightest line we can will help as this sort of thing continues to escalate
Either way, (going back to the question in question) it's about performing an unauthorized subversion of otherwise legitimate policies. Whether we agree with them is the real question.
@Iszi Right, and pentesting is an * authorized* attempt to bypass. Or, at least, you'll find plenty of examples on the site where the person writing the answer says, "You had better do this, or else it's illegal and your own damn fault if something bad happens."
@ScottPack But from the other perspective, humans are authorized by the UN to seek to preserve various human rights, and those are being violated, and we're trying to help someone preserve access and privacy, both of which are technical security issues
We don't get to pick who gets to set policy. but we can help people achieve security goals
@nealmcb That assumes that the UN has authority in the matter. Think back to the US Civil War.
The US government passed a law freeing all slaves, specifically targeting the Confederacy. In their opinion secession was illegal, and therefore they were still bound by US federal law.
The Confederacy, however, felt as though they were a free country and ignored the law since the USA did not have authority to do such a thing.
Does the UN have authority to make such proclamations regarding Iranian policies? From a legal perspective, I don't know, though if I could venture a guess it would likely comes down pretty strongly to an opinion.
@sysadmin1138 The Top 10 is nice, gets updated frequently enough. Though it feels like more and more of the items are just specific examples of input validation.
Sometimes policy goals of different entities are in conflict. For example a question can sometimes be viewed as an attempt to learn how to defeat a security control, or be viewed as a way to achieve other security goals like confidentiality and availability.
For example consider a country that ...
3000 Vote to close, reopen, or migrate any questions 5000 Vote to approve or reject suggested tag wiki edits 10000 Vote to delete closed questions, access to moderation tools 15000 Protect questions so only registered users with 10 rep on this site can answer 20000 Vote to delete negatively voted answers and stronger question deletion votes
US-CERT recently released Vulnerability Note VU#723755.
http://www.kb.cert.org/vuls/id/723755
In short, this describes how modern wireless routers can have their PSKs discovered within just a matter of hours - even if they're using WPA2 with a strong PSK.
The exploit is done by abusing a desig...
@RoryAlsop @ScottPack asked if we get pop-ups on question migrations. @sysadmin1138 said we do for questions, not for answers. This implies answers can be migrated.
@sysadmin1138 Oh. Not sure why the distinction in your statement, then. I figured answers coming along with questions was presumed, and therefore a pop-up for the answers would be redundant.
I am a PHP newbie and am working on a basic form validation script. I understand that input filtering and output escaping are both vital for security reasons. My question is whether or not the code I have written below is adequately secure? A few clarifying notes first.
I understand there is a ...
What's sad is that the password in question is my domain password. You'd think I wouldn't have to think about it, but for some reason I did at that moment.
@Iszi YES. At oldjob the datacenter door had a keypad. I was in and out of that thing daily. Then one day, after months of walking through that door without thinking, my fingers forgot the code.
You should use /dev/urandom, not /dev/random. The two differences between /dev/random and /dev/urandom are (I am talking about Linux here):
/dev/random might be theoretically better in the context of an information-theoretically secure algorithm. This is the kind of algorithm which is secure ag...
Y'know, I kind of wonder why Kevin Mitnick's business cards always have the address obscured in pictures. It's public record, per his Amateur Radio license.
Based on some of the comments here I went and looked at the FAQ again. We've always, as far as I can remember, closed policy subversion questions as Off Topic.
The question that brought this up is this one and it apparently got people interested in it because it's about trying to gain access to...
Sometimes policy goals of different entities are in conflict. For example a question can sometimes be viewed as an attempt to learn how to defeat a security control, or be viewed as a way to achieve other security goals like confidentiality and availability.
For example consider a country that ...
US-CERT recently released Vulnerability Note VU#723755.
http://www.kb.cert.org/vuls/id/723755
In short, this describes how modern wireless routers can have their PSKs discovered within just a matter of hours - even if they're using WPA2 with a strong PSK.
The exploit is done by abusing a desig...
I am a PHP newbie and am working on a basic form validation script. I understand that input filtering and output escaping are both vital for security reasons. My question is whether or not the code I have written below is adequately secure? A few clarifying notes first.
I understand there is a ...
You should use /dev/urandom, not /dev/random. The two differences between /dev/random and /dev/urandom are (I am talking about Linux here):
/dev/random might be theoretically better in the context of an information-theoretically secure algorithm. This is the kind of algorithm which is secure ag...
