@TerryChia if it's anything like Ruby packaging I know what you mean. I read a whole book on ruby gem management and still not sure I get all the nuances
for me its Friday which generally is report day :o(
@TerryChia yeah that's become a thing in ruby gem land you can put a git repo into the Gemfile and it'll go get stuff from there. Nice from a functionality perspective, really makes me shudder from a security perspective
the number of projects that are one github account compromise away from security problems is likely very high....
@TerryChia well I should take this up at some point as it might be interesting, unfortunately I'm still too low up the foodchain to step into Ken Allan's office with this :p
Partners won't go for it locally as it's not their pot of gold that will be affected positively if they do internships here and get a contract in SG
@AviD my fav was when I went to defcon, the airline had cancelled the route, so they moved me to other flights but the long leg was first class, it was ..... nice.
@AviD yeah my connection was delayed and I was worried I'd miss it. 'cause I was first class they had a personal rep meet me on arrival and walk me through the airport with a variety of tickets to make sure I had one that would work. brief view of how the other half live :)
@AviD one of our customers that we do sub-contract work for decided that they want them on all reports. I'm trying to explain why there's no CVSS for "hasn't implemented HTTP Security headers" and why making SSLv2 a medium finding makes no sense
@AviD no but it's not a serious issue, when in the history of the Internet has someone exploited SSLv2 when if you're MITM to the connection there's way better stuff to do
the only time I rate SSLv2 as serious is when there's a compliance req. or it's something like Financial services
I had looked at FAIR in the past, and I liked it in principle, but its usually too much of an overkill. DREAD is a nice compromise, but I still feel it's lacking.... something.
@TerryChia hokay I'll bite, how would an attacker exploit SSLv2 on a web site in a situation where a customer is accessing it using a standard web browser?
@AviD oh absolutely it screams "we don't patch properly and don't update our systems" but in and of itself, I'm not aware of any time its actually been exploited...
@AviD Definitely not a critical problem, but medium is a fair rating imo. Although I'm not really into the whole "ratings" thing. Just fix that shit goddamit!
@TerryChia my point being no-one would be likely to actually do that if they had the pre-reqs for an attack, because there would be better options available...
@AviD in conjunction with something else like directory traversal that could be really bad, but on it's own in seems a bit steep (bearing in mind that would be a fail on PCI)
I've come along a few hipster programmers when doing code review, strangely enough they were all a LOT better and more secure coded than what I normally see
@jnk BTW at least one of my fellow DMZ denizens may be commenting post some drinks and may therefore not always be making the most sensible suggestions... see if you can work out which one :)
@JNK you may want to ask when a couple more of our american types are about they may well know of more US focused venues. look out for @ScottPack , @tylerl or @aj-henderson, they're on here reasonably often...
ok, sanity double check, the world hasn't completely changed on me since I last looked right? Have a significant number of viruses started coming out that can passively become active?
@AviD ok, I didn't think I was going crazy, but I've been catching a lot of flack on my answer about the (relative) safety of having a virus as a data file on your system
granted, that isn't too surprising as I'm covering a lot of territory in a fairly short post for the amount I'm covering
and people tend to forget that while there are edge cases examples of exploits that can do code execution from a passive state, there are also (roughly as many?) cases of demonstrated vulnerabilities that may allow escaping a VM
which was the main "solution" offered
which yes, is a good step, but also isn't surefire
so yeah, wanted to make sure I wasn't losing it
I haven't played extensively with viruses in a few years
@TerryChia yeah I saw @homakov 's tweet this morning, will be interesting to see some more details as he just linked to one line of rails source saying something like "timing attack"
A place to find information security folks. For retweets, @ or DM me or tag posts with #infosecjobs for infosec jobs, #infosecq for questions, and #infoseccfp.
I'm not sure but a web-site I visited over the computer browser gives me an invalid certificate warning when viewed over a PDA browser. Am I being spoofed?
But PDA browsers might do MITM interception for caching etc. I think I remember hearing about that with blackberry. Nobody really uses them anymore though.i
cloudflare uses the DNSName cert attribute to assign the same cert to multiple domains. That feature might not be supported if it's a really old version of android
tester.testcloud.io goes through cloudflare. But cloudflare is DNS-driven, so they give different DNS records based on whether they think you're a threat
so your desktop is going straight to the server, while your phone goes to cloudflare's servers
Well writing it down is an entirely different issue to what we were debating in the first place but I just find it ridiculous to be opposed to passwords like "dog" or "password" on the grounds that their more complex counterparts are "easier to crack."
@DavidFreitag Oh yes absolutely, like I said in the thread I want to keep that conversation to a minimum since it's outside the scope of the question. But I see that similar to a question with code that allows for SQL injections - just as an informative measure for the OP and future viewers that something about it is insecure.
Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
@TerryChia Book Depository ships to a lot of countries including Singapore, for the same price everywhere and independently of the number of books. They're often roughly the same price as Amazon for paperbacks, but more expensive for technical books.
@ThomasPornin Or imposed passwords. Which get written down, where most attackers (who are halfway across the world) can't see it.
@AJHenderson it heavily depends on the type of account: for a web service they're rarely internal (or if they are you have other things to worry about), for an enterprise service I don't know
Does storing temporarily a non-encrypted file containing some PANs violate pci requirements? (for example because it is being processed by an application, or to open it on a file editor)
