Stack Exchange
log in

The DMZ

The DMZ

A serious place where infosec is discussed PS we don't do hardware/software support (srs face -.-) https://security.stackexchange.com/
4d ago – Journeyman Geek
Journeyman Geek: 4d ago, 17671 posts (1%)CaffeineAddiction: 14d ago, 1510 posts (0%)Rory Alsop: 26d ago, 62302 posts (6%)
1031k
1030
info

export all events for this room

Starred posts

1 … 329 330 331 332 333
Graham Lee
May 26, 2011 14:52
@Iszi @ThomasPornin one thing I've noticed is that you can't refer to beta sites in your careers profile :(
Rory Alsop
May 26, 2011 12:54
drobo.com/promos/100drobos/100drobos_home.php
nealmcb
May 23, 2011 20:36
I think a site that broadly covers the security "mindset" is a good thing, and what we've pretty much got now
Iszi
May 23, 2011 14:34
Proof you're addicted to SE. You initially think any Tweet with a "?" at the end is something on SE.
nealmcb
May 23, 2011 14:09
Sounds like Mike the "cryptography researcher" there should study the algorithm a bit more and reconsider his "utmost certainty" :/
Thomas Pornin
May 23, 2011 14:05
@nealmcb We do not know how to make robust hash functions. The SHA-3 competition is showing that we do know how to make hash functions that the colleagues cannot break.
nealmcb
May 20, 2011 05:02
The most creative ones may just up and leave if "clueless folks in IT" are snooping over their shoulders.
Scott Pack
May 17, 2011 17:15
@Iszi What did the Yogi say? In theory there is no difference between theory and practice, but in practice there is?
AviD
May 12, 2011 21:41
6
Q: What is the day to day role of a Security Analyst/Engineer?

Sheehan AlamI have heard a lot of buzz around security and CISSP in IT organizations, but I am not sure what this entails. What are the day to day roles of a Security Analyst/Engineer and what steps do you need to take to become one?

security career-development non-technical
Iszi
May 12, 2011 13:34
bash.org/?244321
C. Ross
May 12, 2011 10:52
user image
AviD
May 11, 2011 18:37
Also for the record, I recanted my position shortly after. Yup, I was wrong, and I admit to it.
Graham Lee
May 11, 2011 13:47
My role is high-visibility brand protection: my responsibility is to say "blah blah crypto" every so often.
Scott Pack
May 11, 2011 11:35
Mac's don't get viruses, everybody knows that!
Scott Pack
May 10, 2011 12:39
userscripts.org/scripts/show/77298
Graham Lee
May 10, 2011 09:20
The best bit was that the password-comparison function was, to put it politely, strcmp(), so it took linear time in first incorrect character position.
Iszi
May 9, 2011 17:49
user image
AviD
May 9, 2011 13:58
@RoryAlsop half those things are probably poison!!
Scott Pack
May 7, 2011 18:10
Quick! Ship it before the code stops working!
Scott Pack
May 7, 2011 12:15
It would be like feeding your child a diet of nothing but packing peanuts dissolved in water.
Ormis
May 6, 2011 15:36
use a produce like FOCAfree to do a search for web data dealing with your company and see if you can get any usernames (or any helpful info) from that data
Scott Pack
May 5, 2011 21:00
I was attempt to make a joke about the dangers of client side validation. Unfortunately, it fell rather flat.
Scott Pack
May 5, 2011 13:52
home2.paulschou.net/tools/xlate
nealmcb
May 4, 2011 22:33
@RoryAlsop I agree with @Iszi on @AviD's comment - please help us avoid sophomoric and demeaning "humor" which is likely to make our official chat room unappealing to a lot of people.
Thomas Pornin
May 3, 2011 20:42
@Iszi You have been downvoted because of the accuracy of your diagnosis.
Scott Pack
May 2, 2011 13:41
The rest of humanity perceives Central Florida in August as inhospitable to carbon based life forms.
Thomas Pornin
Apr 26, 2011 15:21
@GrahamLee Isn't knowing that you are right its own recompense ?
Rory Alsop
Apr 26, 2011 13:47
so twisty, you have places named like this: maps.google.co.uk/…
Ninefingers
Apr 26, 2011 08:51
For the record, I'm not interested in removing any mods, banning or anything like that. My suggestion if I can make it is the next time a mod is involved in a contentious question (bound to happen at some point as the site is young and the mods are some core contributors as well as moderators) that they flag it for other mods if they feel a user is being sarcastic and let them judge.
AviD
Apr 26, 2011 08:18
@RoryAlsop well, yeah, that was kinda my problem...
AviD
Apr 26, 2011 07:50
It's not fair to be offended that I was offended. That is purely a wife's prerogative.
Iszi
Apr 24, 2011 20:25
@nealmcb You can't delete your own account, but you can request the mods (and I think this goes even above diamond-mods) do it for you. Essentially, it's just saying "waaah, I'm taking my ball and going home".
Graham Lee
Apr 24, 2011 17:07
@AviD Do you know about CERT guideline STR08-C "Use managed strings for development of new string manipulation code"?
Thomas Pornin
Apr 24, 2011 16:24
@RoryAlsop I think it is a fine question -- it demonstrates that such an inflammatory concept can be debated with minimal heat on security.stackexchange.com
Thomas Pornin
Apr 24, 2011 16:23
It was a lot more fun, and I daresay more secure, than rewriting X.509 validation in C.
Thomas Pornin
Apr 24, 2011 16:22
So I ended up with writing my own Java virtual machine.
Rory Alsop
Apr 24, 2011 09:19
@Ninefingers answer was aimed at quite a low level, yes, but from an external perspective I didn't take it as being sarcastic or patronising. I thought he was trying to put info in that would be relevant to a large number of folks.
AviD
Apr 24, 2011 09:19
bottom line, @GrahamLee is the only one that actually gave me an actionable answer. though Im not sure how practical, given that it requires rewriting a sizable chunk of code
Iszi
Apr 23, 2011 20:12
Urgh... This really doesn't look on-topic. More like "Google this article for me please?"
Rory Alsop
Apr 23, 2011 11:51
@ScottPack You can never have too much nerf!
Thomas Pornin
Apr 22, 2011 16:23
even more when talking about French cryptographic research
Iszi
Apr 21, 2011 23:36
One surefire way to tell your vulnerability scanner isn't working, is if it doesn't pick up anything on a fully-patched Windows system.
Scott Pack
Apr 21, 2011 23:11
room topic changed to The DMZ: General discussion for security.stackexchange.com
AviD
Apr 21, 2011 22:36
@ThomasPornin all 12 of them?
Marcin
Apr 21, 2011 15:14
there's a very interesting presentation by Matt Weir talking about how all the password policy (at least one special, two numbers, etc) is actually lowering the password entropy
Thomas Pornin
Apr 20, 2011 16:20
@nealmcb my C code is quite inefficient in its implementation; it makes an exhaustive search on the 6 lower bits, and the recursive invocation is likely to be a performance killer. On my PC, for a 14-byte half password, it does about 35000 reversals per second (and per core). My PC has four cores, leading to about 4 hours of computation to get the 2 billions.
Rory Alsop
Apr 19, 2011 14:02
@GrahamLee O Rlyeh?
Rory Alsop
Apr 19, 2011 13:55
And if people can remember that many passwords over that timescale, then you should fire them for using a system that is too simple :-)
Rory Alsop
Apr 19, 2011 13:03
13
Q: Popularity Contest

Farseeker Yes, I know it's too late to get in for the prizes ('sif this would win anything anyway) but hey, for the betterment of the community :) Screenshot / Code Snippet About I've (and others) been bugging about getting some stats so we can track our Stack Exchange sites against the others, so I...

app website statistics
Rory Alsop
Apr 19, 2011 12:42
I hope most people read them the way I do, and check timestamps when there are dupes, then you can vote up the original.
1 … 329 330 331 332 333