The DMZ

Scott Pack

11:31 AM

Martin's last line in today's QC is beautiful. "My love life is like a Rush song - complicated and wanky."

Iszi

1:28 PM

Aside from being homework help, isn't this one a little S&A?

6

Q: Penetration testing by ethical Hackers/Crackers should be trusted?

My question today come from my homework question from class ethics in IT. Our question states roughly that I'm IT guy in in big company and I am asked to hire few hackers to to find vulnerabilities in the system. Hackers would take a role in finding out what's wrong with security and alarm compa...

Rory Alsop

@ScottPack I liked that one:-)

@Iszi Yeah - a bit. I felt motivated enough to write a screed for it, as the core message I want to get out is important, but will understand if it gets voted into oblivion.

and 'afternoon all'

Scott Pack

Morning gents

I was sorely tempted to write something up last night, but I was too tired at the time. Rory gave an incredibly good answer.

That's one of those classic questions where, in my mind, the ends justify the means.

Yes, it is S&M, however, I would rather allow it on the site to get the answers out there, than let it drift off into oblivion.

Minor evils :)

Also. Anyone know the name 'Al Lindsay'?

Rory Alsop

1:45 PM

I know of this one: Network Solutions Architect at Terrestrial Technology

through ISACA

He's based in Seattle

@ScottPack why you ask?

Scott Pack

He started following me on twatter

Same g uy

Adam Lynch

2:15 PM

hey

Rory Alsop

@AdamLynch afternoon

Adam Lynch

hypothetically, could someone see an attachment sent in an email using something like wireshark?

Rory Alsop

yes

what's the context?

Adam Lynch

ah just going to say someone that I could see something they just sent

as a joke

specifically a word doc attachment

Rory Alsop

oh, hang on - just re-read your original message. You definitely can do this

and it isn't that complicated

Adam Lynch

2:19 PM

ok cool:) thanks

Rory Alsop

I thought you had said "edit" an attachment

it is a small amount of work to pull the attachment out of the data stream, but nothing complicated

Adam Lynch

according to a guy in my class (just got a text back from him), he says "yes but only the name... if its a picture u might be able to catch the meta data... it would be jumbled up as random ASCII chars... You'd want to be very fast to catch it on wireshark though"

Rory Alsop

you don't need to be fast - wireshark can grab it all and you can analyse the pcap dump file at your leisure

and you can get at the entire doc, picture etc

as long as it isn't encrypted

Adam Lynch

ok cool

Scott Pack

2:33 PM

If you got the pcap, you can do all kinds of fun and neat things.

Hell, I have a couple dozen gig pcap file that I replay to use for load testing snort boxes.

In addition to doing things like extracting and reconstructing files, check out this tool tcpreplay.synfin.net

Rory Alsop

4:00 PM

well, that's step one in my get fit plan sorted: join gym

now I just need to visit it, and exercise:-)

Scott Pack

Thems the hard part.

That and continuing go to after the first month.

Rory Alsop

I was always very good at going to the gym 3 mornings a week, I just got very bad at it after a knee injury and then working too many hours

this one opens at 6.30 in the morning, and is adjacent to my new office, which makes it very easy to go

and it has a pool, which I do like after a workout

Scott Pack

4:42 PM

I keep telling myself I should take up bicycling or jogging.

this.josh

5:26 PM

@ScottPack What is QC?

@Iszi I think ethics almost by nature is subjective and often argumentative.

@ScottPack Don't you get enough exercise banging your head against the wall and ripping up RFCs?

I do believe I shocked someone today when I told then I don't necessarily check my personal e-mail every day.

Scott Pack

6:02 PM

@thisjosh Questionable Content, a web comic -- questionablecontent.net

@thisjosh Somewhat, but it's very limited and not very cardio. Although, I have had much better results since switching to NIST's 800 series.

this.josh

Better stretch before reading...

Iszi

@ScottPack Oh, hey! Welcome to the party!

Scott Pack

6:16 PM

Hey thanks! We're getting read to start using -53 as our framework.

In fact, we're using it as our theme for this year's conference.

Iszi

@ScottPack Just in time to have to update everything to Rev 4 in a few months, I'm sure.

@RoryAlsop The reason I flagged this one...

-3

A: when is it safe to click through an SSL warning message?

When is it safe? Always (as safe as any other site). The only thing that it really means is that when you come to a site that has an expired cert, is that the company decided that it didn't want to pay to keep their certs up to date, and either let them expire, or created their own. It is all jus...

...is pretty much for his cited sources. The first one is just one blog's rant against what he believes to be the racket of the current CAs. The second is the same blog claiming, without any apparent outside evidence supporting, that a major CA actually allowed the previous blog posting to sway their business dealings.

And, the answerer in this case also has a comment on that blog specifically saying "I'm not a security guy".

Jeff Ferland

6:38 PM

@Iszi Ooh, that's a winner. I'd leave it there unless the poster deletes it, though. Kind of like gibbeting... a warning to all who see anything that awful.

I like the comment you added too.

Iszi

@JeffFerland Yeah, I can't stand down-voting without giving reason (or at least up-voting an existing stated reason), so I just pretty much echoed what I said in here.

M'vy

7:15 PM

@Iszi never?

Iszi

I wouldn't say never, but definitely not always.

M'vy

Well I would :P. If you can't get a a CA root cert you trust, that means it is not safe.

well I guess it's valid if you include trust in "safety"

Stack Exchange

Stack Overflow Blog: Welcome [Valued Associates That Make Up] CHAOS!

Posted by Alex Miller on September 15th, 2011

For the past couple months, we’ve had a new team starting up out of our NY office, CHAOS (or if you’re not into that whole brevity thing: Cheerful Helpful Advocates of Stack Exchange). You’ve probably seen them around some of the sites or run into them in one of the chat rooms – but here’s your official introduction:

CHAOS works directly with Joel and me to come up with, and execute on, new ways to promote all of the new SE sites and bring in new users. Looking at the original job posting we put up, you can get a bit of a feel for what they’ll be doing: …

Iszi

@Mvy What about expired certs?

M'vy

If their is expiration date, that's for a reason :P

this.josh

7:32 PM

Trust noone, no wait, trust me!

Scott Pack

You already said that!

Aw snap!

this.josh

I did?

Scott Pack

You said, "Trust noone" and then "trust me". Sounds like you were repeating yourself.

I was attempting to be funny, but it fell rather flat.

M'vy

lol

this.josh

Jul 20 at 20:03, by Scott Pack

I appreciate how you separate your cat from trusted individuals.

Scott Pack

7:36 PM

See, that's the kind of comic gold I normally go for.

this.josh

Jul 6 at 17:55, by Iszi

I'd love to fit "In God we trust, all others we audit." somewhere. But, I don't know how any atheists/agnostics would feel about it.

Scott Pack

Searching the archives for the word trust?

this.josh

Generateing more chat with used material, recycling

There are no new jokes, only new audiences.

2

Scott Pack

How do you feel about blue humor? All kinds of it over in The Comms Room

this.josh

Blue humor, not familiar with it

Though feeling a color if not physically imposible may be unethical.

Scott Pack

7:44 PM

Ah, it appears to be an Americanism. Off-colou?r

this.josh

Doesn't bother me.

Iszi

@ScottPack Please, don't flood the sidebar with ASCII boobs again.

Scott Pack

@Iszi No worries. There's plenty of that over there.

They haven't been planning any raids that I know of.

this.josh

Redundant Array of Inexpensive Disks?

Jeff Ferland

8:14 PM

0

Q: Is there a valid reason to limit the password length on a website's registration form?

If they store passwords securely then regardless of the size the hash + salt is always a fixed length. I encountered a website that limits the password length to 16 characters and I can't see any reason why they are doing so besides the fact that they might store my password in plain text. Is t...

passwords

Duuuuuuupe

Scott Pack

damn son

Scott Pack

8:44 PM

You make things hard sometimes, @Iszi.

Iszi

@ScottPack Tried to retweet, didn'tcha?

(Wow. That word is surprisingly hard to apostrophesize.)

For the non-tweeters:

File this under AWESOME! http://twitpic.com/6lb8sv Aurora Australis and Orion, as seen from the ISS. Taken by @Astro_Ron

Tweeted by packscott on September 15, 2011 at 8:43 PM

Scott Pack

I didn't even bother trying to retweet. I went straight to the copy/paste.

Iszi

@ScottPack Ah, so you've learned then.

Scott Pack

That is a pretty incredible picture.

I never make the same mistake more than a few dozen times!

Iszi

What (if anything) does it say that 5 of the top 6 starred posts currently in the sidebar (or, at least the only 6 that I can see) are either by or in reference to me?

Scott Pack

9:03 PM

That you are a lovely and all-together interesting person.

And now this public servant gets to go home.

Iszi

@ScottPack Awww... Does that mean you'd be interested in a second date?

AviD

10:09 PM

'allo 'allo, good evening all, and greetings from my post-conf buzz.

then again, its more likely that the buzz is a result of all the redbulls and beer I've had all day....

sorry, what was it @Iszi calls it? gummy berry juice?

AviD

10:37 PM

@Iszi @RoryAlsop re the troll on the ssl warning q... it really is a valueless post, and nothing but a troll's rant - and of course wrong and clueless - but i'm not sure it's quite hammer-worthy. His answer isn't really doing anything wrong, other than being clueless.... and annoying.

Don't feed the trolls....

btw, I got the feeling that he is the author of the blog he linked to - even though he commented to the blogger, it felt very much a sockpuppet... and, I should know... ;-)

Don't feed the sockpuppets

Scott Pack

11:16 PM

@Avi!

Iszi

11:44 PM

@AviD I use that particularly for 5-Hour Energy, really.

@AviD Clueless, annoying, almost completely incorrect, and (presuming he is a sock puppet) self-promoting. I'd rather not see it stay around.

Transcript for