Ah yes. Actually for me it doesn't matter, because I find both essential ... seeds for any mushroom stews and the leaves for milder dishes, like some fish or even spreads
"Finally, we will have the WhiskeyCon. Anyone attending SyScan’14 can go on stage and present anything related to security (NO PRODUCT PIMPING!). The amount of time you have will be based on the number of shots of whiskey that you drink before the talk. Every 2 shots of whiskey get you 5 minutes."
@deed02392 Well, I'll ping you about the trip on Facebook around the time of my arrival. You know, just so it doesn't come in an inconvenient time for you.
@deed02392 Ahh - if I get down that way to meet up with my best man I'll need to give you a shout. He's down that way at least for the next few months, till he gets posted to Naples at the end of the year anyway
@deed02392 depends a bit on who you're interviewing for - assuming it's a reputable place, it can be viewed as "mainstream" right now. And not the good kind of mainstream.
I'm assuming that you're not the only interviewee and I'm thinking many others will have Heartboop on their mind as well, so you'd have to really excel in the presentation.
I was thinking I could talk about how it was discovered, how the attack works, the impact, talk about PKI in general and the importance of auditing FOSS when your security depends on it as well as supporting organisations like OpenSSL. Then for laughs I was going to include some of the funnier SE question titles on it.
@deed02392 To be honest, I'd be very impressed with such a presentation. This goes well beyond the mainstream heartbleed understanding/reporting/story.
@deed02392 It's clear that you're showing deep understanding of the issue, going beyond the direct impact, possible future solutions. I don't know, but to me it seems pretty good.
@Adnan Hey, guess what? The manufacturer of that frisbee is a well-known disc company. They don't make shitty discs. Yours was a really good driver disc.
Yeah and also it's suggested it should be based on my degree or something I did at work recently. But I don't have a degree and nothing I do at work in terms of cyber sec has been particularly interesting
@TerryChia Yeah I appreciate a lot of people are sick of it, but I thought I could use that as the basis of adding a bit of a comedic element and/or maybe lowering expectations from the start in order to seem even more impressive! OK I'm joking on that latter point.
@deed02392 so I'd say that heartbleed isn't a bad choice (Although Mr Alsop is a more experienced interviewer than I), it shows you're relatively up to date and as long as you go past the superficial stuff it should show you're not getting all your security info. from reddit :) Picking out some unusual angles (like large co. reliance on open source) could work well but watch for potential political concerns (some open source people really dislike implications that money is required to produce..
@TerryChia well in general if you look at people posting anti-MS diatribes they conflate commercial software with bad software because sometimes commercial companies write bad software
@RоryMcCune I know :( the e-mail was supposed to have been sent last week but it never showed up to my private e-mail address, I had to call it in and it just turned up 2 hours ago. Interview is Thursday.
Seriously, just look at the Linux kernel, CPython etc. They all have people working on them full time hired by companies using the tech. There are some completely voluntary ones like Debian though, I agree.
@Adnan I did not edit my answer because of flags from people who lack a brain, a sense of humour, or both. I edited it because @Rory has asked for it, and I respect the Rory.
> So there you have it: ineffective countermeasures to a fantasized attack stemming from an overhyped bug (serious, but still overhyped), which comforts poor sysadmins in their bad practices. Mr Sheep, please meet Mrs Cliff. I am sure you will get along well.
Would it be straightforward to apply a binary patch for something like that? Though I suppose you'd need to either regenerate the hash manually or patch that too.
@deed02392 In theory, you can make any modifications post-build by applying patches to the binaries. In practice, however, things are much more complicated.
It's extremely easy to break stuff by messing with the binaries.
Best case scenario here is a new minor version that include those fixes.
Oh, and a backward compatibility mechanism. You need to take the current correct inputted password and send it to the stronger KDF again.
I haven't looked/understood all of the other points, but some of them might be related to some essential aspects of the container files themselves. In that case, it's a lot more trickier to provide backward compatibility
In my simple mind I was imagining patching a hex value that stored number of iterations and then just manually generating a compatible hash with a short C program
@ThomasPornin many thanks, both for the expansion and for your reasons.
@deed02392 - sorry, I have been outside all day. The sun appeared (I know, right?) and I'm on holiday, so I built stuff, mowed the lawn, threw stuff out, fixed bicycles, encouraged my kids to hurl themselves about the garden etc etc etc
God, I just had to deal with someone telling me I'm wrong about the security of MikroTik routers and having Remote Admin enabled. I'm so tired of this so-called expertise in this country ... for uninitiated, there's even videos in multiple languages explaining how to get in in under 5 minutes, even if you don't exactly know what you're doing.
I am tired of hearing about the heartbleed vulnerability; however, I heard somebody say that a VPN connection with RSA security is not affected. The the RSA key was made with openssl, isn't it affected?
Just trying to broaden my understanding ... VPN connections with RSA certs are just checking the certs to be valid or are they encrypting the traffic in the process?
@RoryAlsop I'm not sure he'll be able to follow it ... I need an analogy, something in the lines of "it's like storing the combination to your safe that's in your house along with the keys to it under the flower pot in front of your house"
Well, I was curious to see if the heartbleed affected VPN services when a new tunnel was initiated (e.g. attacker targets a VPN, sends heartbeat signal, retrives RSA key, initiates new tunnel with key, has access.)
I know there is an influx right now of wannabe hackers exposing the heartbleed. Just wanted to make sure VPN was safe.
@AWippler If the software you use includes OpenSSL, make sure that the copy is up-to-date with security patches from the software vendor. Actually do that even if the software you use does not include OpenSSL. This should go without saying.
@ThomasPornin Thanks. So then if OpenSwan and/or OpenVPN use the OpenSSL libraries to initiate/check the certs, they are considered vulnerable to heartbleed?
Had a vendor's tech guru tell me that OpenSwan and OpenVPN were not affected by heartbleed.
@AWippler "Heartbleed" is a bug in the way some versions of OpenSSL handle a SSL connection. If you do not have a SSL connection in your setup, then, quite logically, you do not have the bug either.
In any case, if the vendor himself swears that there is no problem, then there is no problem (and you will sue him if a problem arises anyway).
It seems that I found a way to exceed the rep cap.
Yesterday, some insufferable yahoo dared to downvote me.
His pathetic -2 got drowned in the rep cap, though: I still got my +200 from upvotes.
Today, the poor sod got his account deleted. The system gave me +2 back -- although I had not actually lost it. And that +2 appears not to count towards the rep cap, too.
It's that bleeping "you have new rep!" lime green icon that doesn't go with the rest of the site's color scheme, so you gotta click on it to make it disappear. If there's also mod messages or 10k flags, suggested edits, and comments you didn't read, it looks like a Christmas tree. I don't calm down until I clear all those as soon as I wake up :)
@TildalWave alternate strategy #1: never open it. It's annoying at the beginning because it keeps updating, but after a while the width and most of the digits remain fairly stable
alternate strategy #2: CSS stylesheet that whisks it away
@Gilles I can't ignore others disagreeing with me, early in the morning and before I had my first coffee I simply have to know who to send my evil thoughts to :D
also, rep tracking via a mobile device is a pain in the behind, but there is a menu option in your profile, if you look close enough or enter profile page submenu on smaller screens
