« first day (48 days earlier)      last day (3795 days later) » 

12:07 AM
@packs Hah... funny.
12:53 AM
I aim to pleasure
1:18 AM
@nealmcb done
Anyone else see this one as "subjective and argumentative"?
Q: To firewall or not to firewall?

Jakob BorgThere's recently been some discussion (to be generous) about the pros and cons of having a firewall deployed in front of servers. The con mainly being that it's a point of failure in case of a DDoS. Microsoft has been talking about doing away with the standalone firewall and instead basing securi...

@Iszi hahaha - VX!
and, evening all
@RoryAlsop Yeah, if I'd written the equation properly the first time, the Roman algebra joke would have been a little funnier because x=X.
LOL - wish I'd read it, but I was running around getting stuff ready and didn't have time
it is funny now though - so still worthwhile :-)
As to the firewall one, possibly subjective but I think the answers coming out are interesting. Maybe it should be a community wiki
Preparing an answer now, as the majority of the setups I work with are different to all the ones illustrated there :-)
@RoryAlsop Thanks!
1:52 AM
@Iszi - regarding the default passwords one - think we should give him a wee bit more time. Looks like he hasn't been back so won't have seen the comments.
I do agree with you though :-)
@RoryAlsop I agree with the default passwords one, I'm holding judgement until he clarifies a bit.
@RoryAlsop Don't disagree. Just wanted to put my $0.02 in, in case there were already close votes active. It's becoming mildly frustrating that I can't see close votes until I actually have the close-vote permission.
what rep do you need @Iszi?
@RoryAlsop I think... 1k for beta? (Checking)
Oh, it's 500
you're nearly there then :-)
1:57 AM
@RoryAlsop Aye :-)
get a couple of answers in and you'll be closing before the weekend
@RoryAlsop Yeah, problem is that compared to most on here I'm still pretty newbish at ITSec.
Definitely worth asking about anything that you need to know about then
that will also get your rep up quickly
anyway - got to go, it's 2am and I still need to submit all my set lists for the last 19 gigs so I can collect some royalties payments. Ah, the rock and roll lifestyle :-)
"How do you afford your rock and roll lifestyle..."
it pays for itself
the gigs cover petrol, new kit etc
2:02 AM
@RoryAlsop ('Twas a song quote, in case you aren't familiar.)
Hahaha - totally missed it, sorry :-)
In my defence, it is 2am...and I have spent the last 4 hours practicing so the brain is almost as numb as the fingers
@RoryAlsop Yeah, sounds like tome for bed for you.
Took your advice by the way...
Q: Automated tools for Cisco IOS config auditing?

IsziAre there any automated tools for auditing config files exported from Cisco IOS devices? Free/Open Source is always nice, but anything that does the job would be of interest.

2:20 AM
@RoryAlsop s/defence/defense/ There, I fixed that for you.
I do rather find the random placement of privs on the beta sites to be rather....odd.
I think they're in a different fricken order
@packs I've checked before - they are. And non-proportional in progression either.
@Iszi Is this auditing it against set policies? I.e., All Routers Shall Use NTP Against This Server
@packs I'd be happy if it made the configuration more human-readable. But yeah, validating a given policy is a bonus.
I think I've seen something like that before, I'll try to remember to look for it.
For a while, I was hot and heavy into the config stuff for Cisco. I.e., I had to write a config parser and automated management tools for the PIXes since nothing that existed supported multi-context mode.
I definitely came across some cool stuff, but that's been a while
Now time for tele with the wife.
Of course, tomorrow I also have to get some photoshop time in.
We're doing Shackled City as a round-robin GM and my chapter starts tomorrow night.
Trying to get reveal layers for, at least, the first map done
Don't speak Photoshop myself, or I'd be happy to help.
8 hours later…
10:33 AM
Posted by Jeff Atwood on February 2nd, 2011

First, a quick update on the Stack Exchange moderator election schedule.

Ending today, so get those votes in!

Ending soon:

Just started:

Coming soon, in this order, at 3 per week:

As you can see, we have a lot of community moderators! That’s why we’ve been working so hard lately on improving our moderator tooling, to make sure our new class of incoming moderators have as pleasant, polished, and smooth an experience as possible.

One thing we haven’t helped much with, historically, is when a moderator needs to contact a user directly to resolve serious issues. We always encourage direct one-on-one communication to resolve user behavior issues before they become a problem. Unfortunately, the only way for a community moderator to contact a user was to email the user from his or her personal email account. Ew, right? Far from an ideal solution, but it was the only one we had… until today! …

3 hours later…
1:30 PM
@AviD So if I am reading all this stuff right, every question gets tweeted out?
Also. Good Morning Gentlemen, and Ladies should that be applicable.
1 hour later…
2:46 PM
@packs - good afternoon :-)
3:11 PM
@RoryAlsop At 10:11am? Unpossible!
3:31 PM
@packs - LOL at you and your 5 hour offset
God Rory! We've been over this. UTC-5 is canonical!
I thought we'd agreed UTC + or - anything was nonsensical :-)
Only in New Zealand or Tuvalu
I leave the rest as an exercise to the reader.
3:49 PM
I'll just have to keep calling it Greenwich Mean Time then, to hark back to the days of Empire
I may have to watch that later
Elbow deep in setting up the provisioning of 5 more snort sensors
4:08 PM
Took me longer than I care to admit to get the infrastructure tested and built, but I'm to the point of managing a few dozen with relatively little effort. That makes me happy :)
2 hours later…
6:03 PM
@packs Oooh, I may have to pick your brain on that sometime. Snort is something on our to-do list.
6:14 PM
@Iszi Sure, np.
You work in the private sector, yes?
1 hour later…
7:26 PM
Ah - I'm delighted - my band has been nominated for best Metal Act in the 2011 Scottish Alternative Music Awards!
Anyone likes 80's rock guitar and 90's techno rhythms held together with exceedingly funky bass, feel free to head on over (and vote for us from Monday!)
</selfpromotion class="shameless">
Your makeup is cute :)
Doktor! YUS! I know exactly what I will be calling you henceforth.
@packs Hahahaha - yep it's shameless, and I weighed up the risks of presenting my alter ego over here....
It's true, risk assessment is a big part of our industry.
This has you guys listed in Edinburgh. I thought you were a bit to the west
8:03 PM
I live about 12 miles west, or thereabouts
but this is just a suburb of Edinburgh
Ah, I thought you were in Glasgow, hence my confusion
I get what you mean about the suburb thing. We honeymooned out of Currie
Ahh - now Currie is very close, about halfway between here and Edinburgh city centre
I just checked on the map and saw that it was about 6 miles out. I actually thought it was closer in.
8:42 PM
I was just wondering.
The spirit of higher ed is in your favor if you're there.
But, your removal of that statement does make my spidey-senses tingle
@packs I just prefer to keep disclosure of my RL to a minimum audience, on the Internet.
evening, folks
@AviD Howdy.
@Iszi I was big on that as a kid. After a couple of years working in the industry, and especially at a university, I grew to realize two things.
1) Professionally - I am public record, although some small parts of me may be redactable.
2) Online reputation is good
I mean, look at that one mod that we have here. His linkedin page is killer
Oh, Hi AviD
Yeah, LinkedIn... I should update that.
8:55 PM
@packs in what way do you mean?
or was it just general sarcasm? ;)
Well, according to that place, you do have a good looking CV. But yeah, the general air of sarcasm also applies
well, thank you - and, gee thanks ;)
I do have some RL-associable accounts, but I try to keep those fairly separated from my online alias. If someone tried, they could put the two together but I'm still just paranoid enough that I don't want to make it too easy.
actually, my linkedin profile does get me a lot of work - potentially, anyway
there was a time that I was getting a job offer every few weeks through it
now, less so - but instead I'm getting projects/clients
it does actually work, at least for me....
8:59 PM
@AviD et al - my online profiles get me a lot of work, both in security and music
(nevermind that I'm so picky that very little was actually relevant, but still...)
In fact I just posted a piece on LinkedIn specifically about social networking :-)
@RoryAlsop absolutely
I like talking at conferences so I can't really separate much online from RL
@RoryAlsop That's my thing too. I'm trying to work myself up to that kind of thing.
That was one reason I decided to get involved in these sites, actually.
I need to add some more info to my linked in account, and update my cv in general.
I've spoken at a few local conferences, but nothing is really documented
9:04 PM
Isn't cisco-ios a little redundant of cisco? I mean, in the sense that the two don't really need to be together?
@AviD The SE model is proving pretty good from a sharing experience with the community perspective, and in terms of getting your name in front of a wider audience it is already showing value - which will increase as it grows
@Iszi - I think we had the discussion a while back that ios was now pretty much regarded as the apple OS, so the cisco prefix was to distinguish it
Is it worth making a synonym to cisco?
I realize they are technically different, but...
@RoryAlsop Right, but what I'm saying is does the cisco tag really need to be on the same post as a cisco-ios tag?
Also, I did propose an alternative, here:
A: Will there be a problem with the [ios] tag?

IsziJust wanted to throw another suggestion in here. For Apple/Cisco iOS/IOS questions, use both applicable tags. My question about Cisco IOS config file auditing has both the cisco and ios tags.

@Iszi - gotcha. I reckon you would only need cisco-ios, not both cisco and cisco-ios
@Iszi did you mean if you already have cisco, why bother with cisco-ios?
9:06 PM
@AviD The other way around, actually.
@RoryAlsop I agree - I actually had a few leads via my stackoverflow profile, too... and my rep there really isnt even very high
@Iszi ah, okay
is there not other cisco gear, besides ios?
From a technical perspective, IOS only runs on the routers. Other cisco devices had different enough operating systems that it would be like saying that 'We already have [aix] so why do we need [linux]?'
@packs I'm not saying do away with the cisco tag entirely. Only on questions already tagged with cisco-ios.
And, I thought IOS also ran on switches, APs, etc?
@Iszi totally agree in this sort of case. You already have cisco-ios, and it can stand alone, but is a sub tag of cisco, so adding cisco adds no value
"sub tags" are not unheard of...
9:10 PM
@Iszi That's a negative. The command structures may be similar, but it is a different OS
I can into this problem with trying to manage PIXes back when we still did that
@Iszi Just routers
@AviD The first that come to my mind are the SOHO products via Linksys.
@packs - you're too fast for me
Yeah, I effectively had to write my own version of rancid
I made the mistake of making a pot of coffee after lunch, and am apparently the only guy drinking it.
@packs Hm. I took a CCNA class not long ago, and there didn't seem to be much distinction made. Of course, there's plenty else I can say about that particular class...
9:13 PM
@Iszi By and large, the command structures are very, VERY similar, but there are differences.
Most likely, you would find out about that in an actual PIX, or now I suppose an ASA specific class.
It's the little things that trip you up between PIXs and routers
trying to remember one of the things that always annoyed me
@packs I know there's differences between devices, but they're all (not including PIX/ASA) still IOS are they not?
@Iszi Nope, the PIX/ASA have their own OS
@packs I said excluding PIX/ASA.
Oh, sorry.
I misread that.
Outside those, I dunno. I've only ever worked with 7200s and pixes
9:17 PM
Just talking about general routers, switches, APs....
well, there you go - [cisco] is definitely larger than (and inclusive of) [cisco-ios].
is there value in having the more specific tag? wont someone who is expert in [cisco] also have equal expertise in ios?
I would be really surprised if the APs ran IOS, but I really don't know.
@AviD Perhaps, but someone looking for Cisco IOS questions isn't necessarily interested in PIX/ASA or SOHO devices.
so it is a distinct and independant subset?
I see.
Quite, in fact I know guys who are Cisco switching gods, but have never touched a router in their professional lives.
9:21 PM
@packs I'm not quite sure we'll need to break it down that far though.
what would a cisco switching god look like?
all robes and sandals and everything, greek/roman style?
or more with horns and helmets, ala vikings?
i know, strange heads, like the egyptian gods
@AviD I would say Roman, except that their skin cannot be touched because they radiate too much heat.
And when they open their mouths gale force winds are produced.
on the other hand, I think it does make sense to tag q's with both
as i said, its kinda a sub-tag
@AviD On the same token, would you tag windows and windows-xp on the same question?
someone looking at the cisco tag would expect to see also ios stuff, no?
9:25 PM
You see, it's funny because a single rack of Cisco equipment can be used to heat a small former Soviet Bloc country.
@packs lol
@AviD That's why I was wondering if [cisco-ios] should be a synonym
@Iszi I really dont think we should have a windows-xp tag
SP3 is still supported
@AviD Thought that was the purpose of a sub-tag though? To establish a connection between the two?
9:26 PM
@packs synonyms are automatically translated into the master tag. its not kept...
not really a sub-tag....
@packs And further, some organizations could argue there's need for a windows-98 tag.
Sad, but true.
@AviD I don't know that I've actually seen a sub-tag, so I'm not sure how they work.
@packs hehe, thats not why... I meant, same as we shouldnt have windows-2008 and windows-7 and windows-vista
Luckily the oldest windows boxes any of my clients have is NT
@Iszi No! Bad!
@RoryAlsop That's still downright scary
9:27 PM
unluckily they are large corporates - and they can't patch this 'essential' kit
very scary
Have they called the vendor to ask?
same way I dont think we should have .net-4, .net-3.5 and .net-2.0
@AviD And why not? There's plenty of solutions that are very much isolated to certain editions.
@packs you aint seen em cuz they dont exist
how many .net-x questions do we have?
9:28 PM
when i said "sub-tag", i meant virtually
@RoryAlsop I hear crap like that all the time, and the real reason is that the techs are too lazy to actually find out if a newer version can work.
@packs - god , yes. or that the vendors will not do an update
@packs hear hear
@packs There's also the "the guy who put this together is not around anymore, and we don't think we can touch it without it turning to dust" excuse.
@AviD Heh, I honestly wouldn't be surprised if they did exist. I don't follow the SO blog because of the SNR, so I miss all kinds of things like that.
9:29 PM
@Iszi but does it matter? is a simple [windows] tag not good enough?
the ones I see still working away are usually because the original vendor no longer exists
as Iszi said
will that scare off all those that are only experts in a specific edition?
@RoryAlsop I've seen something like that with SCADA style systems
However, at least they're current, supported OSes, just a year-ish out of patches.
yay for SCADA - was safe-ish until it got connected to the Interpipes
@AviD When it means lumping XP together with 7, absolutely not.
9:30 PM
@RoryAlsop Smells like network-segmentation!
@Iszi gimme an example where a simple [windows] tag wouldnt work.
dont forget, we're on itsec - not SF or SU
@RoryAlsop 7 .net questions
@AviD Windows Firewall, and group policies.
so why would [windows] tag not work?
Big differences between XP/7.
@Iszi oh, i agree 100%.
I'm just saying that tagging a question [windows] is correct, and [windows-xp] or [windows-7] is extraneous at best, harmful and cofusing at worst
9:33 PM
Each edition's tag can easily exist on its own, and still garner a lot of posts.
but you need to specify versions in the question, and thats not what the tags are for
@Iszi yes, but what is the benefit there?
will a windows security expert only know windows vista, but not 7?
@AviD Specificity? Searchability?
kids all asleep. need some beers with SWMBO - might be back later on
@AviD Actually, it's probably more likely the other way around. Vista being what Vista was, and all.
tags are not for specificity, and for searchability (i assume you mean ala seo?) it can be in the title, or the body, etc...
9:35 PM
@RoryAlsop Enjoy! I'll drink a few tonight while I try to kill my friends with fiendish critters :)
@Iszi heh, fair enough, bad example - but you know what I mean
In any case, I gotta get rolling. Can continue later tonight.
gnite @Iszi @RoryAlsop
nite @AviD
Oh, @AviD, with respect to the 'different requirements levels' I referred to in that Secure Programming standard question.
We would only have 3, and they map directly to the Data Classification policy. So no more than 3, but probably 2.
9:45 PM
not so bad then - but still a bit tricky to manage
unless, the levels are already clearly and unambiguously defined and agreed upon, and everyone understands them, and always knows which is the relevant level....
We went down this road with servers a few years ago, so I'm trying to keep them as similar as I can for consistency.
makes sense, though really, how many of your audience would see/use both?
though it would definitely help for the security guys...
That is what is more important to me. If we can be as consistent as possible across the board, then we can speak better.
Plus, it would help classify the overall stack
I'm bouncing ideas around, so we'll see how it pans out :)
@packs good luck!
Yeah, tell me about it. My experience is that sysadmins are way easier to change that programmers :)
9:55 PM
yeah? admittedly programmers are notoriously difficult to change, but sysadmins also usually seemed much more locked in their ways
conservative, if you will
I highly suspect that I have had good luck.
Go time.
Night all.
@packs gnite

« first day (48 days earlier)      last day (3795 days later) »