I know we've been trying to get rid of unnecessary tags, but last night I was thinking about all those questions that come down to hardening various and sundry apps/OSes.
Would anyone be offended if I created a [hardening] tag and added it to all those?
@Iszi Offhand I think tags are more useful if they express one thing. folks can search for windows hardening or web-application hardening if they want more specificity
so just "hardening" makes sense
but it doesn't look like any of those are there now
If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like?
If one exists could someone explain it or link to an explaination?
Hello, on my windows 2003 server, all incoming connections are dropped.
I can see them getting in using Wireshark, but even a single ping from another computer fails.
All locally initiated connection work fine (i'm asking from the server).
This server is the DC/DHCP/DNS/File server, so computer c...
Well, I flagged the question as a migration candidate. Reading those comments, then the corresponding meta.sf thread, there were definitely some strong feelings about the whole thing :)
Is there a set of guidelines about where questions get migrated to and when and why? I recently noticed a question that got moved (228792) to a stackexchange site. My thoughts were:
Seriously? - we need to move questions about windows firewalls/virus activity to a security stackexchange?
wh...
@Iszi I think it depends a lot on the context, but those kinds of things do definitely fall into our (armed?) camp.
To use my work as an example. We (the information security office) does not manage the firewalls, that sits in the networks department. We do, however, have extreme oversight in their design and implementation. Moreover, we have to approve all config changes.
The virus thing works similarly. We have a few incident response procedures (depending on what kind of incident) but the base assumption is that, "All incidents are security incidents until the security office decides that they are not."
Now, granted, 90% of the time that's a 10-30 second decision, but in the event of a suspected virus infection of a core infrastructure system, well, it may be in our court for a few days or a week before it moves on to standard 'Loss of Service Incident'
Yeah - I got dragged into an incident response which led to me and the client doing 90 hour weeks all December, then followup work for the next 9 months
No mention of your name in there, though. Too bad.
Because of the scope of my work we tend towards things such as child porn and various forms of fraud. The latter can be interesting, but nothing really grand in scope.
LOL - sadly no, I can't even use it as a reference now I've left the organisation :-(
The day I get back from the B-Sides I'm hosting an event that the Lothian and Borders Serious Fraud Squad are talking at - they have some great stories
Is there a set of guidelines about where questions get migrated to and when and why? I recently noticed a question that got moved (228792) to a stackexchange site. My thoughts were:
Seriously? - we need to move questions about windows firewalls/virus activity to a security stackexchange?
wh...
On my Windows Server 2003 server, all incoming connections are dropped. I can see them getting in using Wireshark, but even a single ping from another computer fails.
All locally initiated connection work fine (I'm asking from the server). This server is the DC/DHCP/DNS/File server, so computer ...
@packs I really like the way we can link one chat line to others that it refers to. Nice dynamic highlighting etc. So I'll link this one to that original one. But I guess I can only link to one message at a time.... So here I'll just refer up a few messages in the history to the messages @packs referenced.....
WTF? I can't even tell on SF who moved it or why – Jim B yesterday edit Yeah - don't see this as likely to be a security issue. Much more likely to be network driver or config issue. Can't imagine a virus/worm wanting to destroy its network connection :-) – Rory Alsop♦ yesterday edit @jim At SF it says it was moved by serverfault.com/users/45/splattne Who can move it back, and what is the protocol for doing so? – nealmcb 23 hours ago edit Can i get my question back to serverfault please ? – Benoît 3 hours ago edit
@nealmcb - yes, it is archived and searchable - don't know about the hows and wherefore's. I have often gone back to much older chats referenced by mentions of @roryalsop so the archive definitely exists
hi. i just tested grsecurity. i installed debian and a vulnerable version of proftpd. i launched an exploit. worked. patched the latest kernel with grsec. and now the exploit doesnt work anymore. BUT . wouldnt just a the new kernel alone cause the exploit to fail? the exploit was only for debian ...
@packs Aye - prioritisation! That is one of the best things about my new job - I am now involved in teh school run, dinner time and I even got to see the kids nativity plays this year
Funk that. Work is work, being a good child is better. They already get more than their 40 hours, so if I leave something unfinished on an afternoon, I'm not too worried.
If there a generally agreed upon naming convention for types of malware/virus? For example, are there agreed upon terms for virus, trojan, worm and the like?
If one exists could someone explain it or link to an explaination?
