"Is [x] secure?" or "Is [x] more secure than [y]? is always a tricky question to answer. In the end, you have to boil each option down to the strengths and weaknesses of its components and then make the decision based on your own needs to balance security and usability.
Here, your method of prot...
Oh, and no TL;DR for you guys this time. I'm too lazy right now.
Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my Windows/Linux boxes. It would be nice if this OS had a toolset of different common attacks. I am sure th...
@RoryMcCune My personal opinion has always been this: If it's a substantial update and you were unsure, comment and rack a few upvotes on the comment, then update the answer.
If you were sure, then go ahead and update the answer directly.
I find that writing a new answer is sort of redundant and confusing to new visitors.
Also, updating the top-rated/accepted answer gives the new information the most visibility.
Morning! I think we should bring this to meat, because this is gonna be an increasingly frequent problem and it would be good if we have some policy on that to point people to in case of disputes
@RoryMcCune But I'm for it, if that helps. It's a natural update that doesn't substantially change the answer, merely updates it to be current
*meat = meta damnit (sorry, on first sips of my coffee LOL)
I have two friends (yes, belive or not they are my friends) that are redirecting all the email spam they receive to my email address. This makes my Hotmail account receive 30 spams per hour (that are not filtered), so I need to keep erasing them and blocking the sender.
I already blocked their e...
@LucasKauffman are you still editing that Wordpress XSS answer? Looks like you wanted to add something in parentheses? ...without properly sanitizing the output (if you ).
I'm really wondering about the shit in Syria, I've been reading stuff from both sides, Assad isn't really a nice guy, but some stuff the rebels do isn't much better and sometimes even worse it seems.
The world can be one seriously F*** place sometimes
@LucasKauffman problem is, the 'rebels' aren't a cohesive group. There are some with the right mindset of political opposition to a repressive regime, while there are plenty of others that are simply terrorists along for the ride.
which is the #1 reason we shouldn't be sending weapons to anybody
@lynks true, I know, the question is just which one will get into power after they remove Assad. To be honnest Asad is a dictator, but dictatorship does sometimes seem to be better than Sharia law
@LucasKauffman indeed. Assad's regime already pointed out that they have warplanes with bombs which are way more devastating than chemical weapons, so why would they use them...
@TerryChia I haven't actually checked the performance, but I really like to use it since you can off load a lot of the logic and manual query building to it
it has got its limits though, so if you have something which is really database intensive you could only partially use its functions and write for instance prepared statements instead
@RoryMcCune plus there were reports that it wasn't Assad who was using the chemical weapons but some of the rebels who managed to get their hands on them after taking over a military base
@TerryChia that's what I did, I have something really DB instensive (some calculations and selects on millions of rows) so I created a materialized view instead
@RoryMcCune in the end for some people they just made it worse, especially if you look at Afghanistan, they are basically retreating while these guys aren't ready for it
and even local villagers say that it was better on Taliban rule because #1 the had money from growing opium and #2 there was justice because nobody dared to steal or murder as it would make you end up standing in front of a Taliban court
@LucasKauffman well look at afganistan in the past the russians (who I'd imagine were willing to be way more brutal) couldn't hold it, the british empire couldn't hold it, TBH when they pull out it'll be back to same old setup I reckon inside a year
@ScottPack That video really made me pitty the American soldiers working in Afghanistan, they are there risking their life and realizing that it's basically for nothing.
While there are certainly exceptions, in general most people in the service are really there because they feel a need to give back (though the reasons for that need vary wildly). So knowing that it's really hard to not feel sympathy for the shit position most of them get put into.
Often with, at best, classroom training on how to handle life or death situations.
Sure, the majority of people know how to protect themselves and/or kill people, but knowing how to defuse a situation without arms or talk to a mass of people and not come away looking like a jerk? Rough.
And, now that I'll admit I have no idea what context you guys are talking about I'll end my rant too. :)
It's not only about the life or death situations, but also the corruption they face. If you build a base and then come back to see the "Afghan Armed Forces" you left in charge there sold half of the base as scrap metal or that they sold all the fuel they were supposed to use for patrols.
That's really depressing because you realize there is no way these guys will be able to face Taliban fighters
@RoryMcCune We have an in house application that scans systems, uploads the results to our secure file distribution center, and emails out the report access information.
This one is an automated process that's just used for the entire network, but what I would love is to be able to have customized scans and reports for specific people.
We have a few people out there that still run their own IT stuff. Things like the academic departments that teach IT. They would love to get regular pound me in the ass level scans. Security Center would do it all, but that's hella expensive.
@LucasKauffman I wanted to edit it for clarity, but later realized I have no idea how to do that, and still keep its intended meaning (whatever that is). So I voted with NaRQ (I've noticed someone else did the same at about the same time too).
@ScottPack nice. yeah I've been looking at a VA setup to take Nessus scans, map the output of plugins to internally worded findings, suppress findings that aren't needed (e.g. nessus scan information) and then create a nice Excel report.
@RoryMcCune It looks like it ended up getting abandoned. It wasn't bad, but so much of the script was just messy copy/paste porting from a similar nmap tool. Once I finish my thesis I was going to set my next personal project to rebuilding that into something nicer.
@ScottPack yeah to an extent that' my problem I start a project, make decisions, later realise they weren't optimal then tend to abandon it rather than go back and fix things... :)
@LucasKauffman Well I think what has already been said sounds reasonable enough. If I wanted to add something, I'd say that one must realize that the situation isn't black and white. It's definitely not Assad || Sharia law.
@Lucas Syria doesn't have the base for such radical change. Unlike other places, the majority of the people are well-educated and the mixture of tens of religions and sects made people more tolerant over time. I come from an area where you wouldn't believe it's part of Syria (compared to what you see in the videos, of course)
@Adnan Well, it's sorta public anyway: Vote for self on quiet sites, use assoc bonus to go elsewhere (and wreak hvoc), delete posts and then account on quiet site
mine for Sec.SE was Exchange. It may or may not be read or altered if TLS is then discarded. Thus, the private key to your contacts using it. Don't use it for anything you need to and a VPN wouldn't help there at all. The real question raised by the PRISM disclosure isn't significantly different from knowing someone was found.
If you were using the information about the cert is changed. Really advanced setups can actually monitor traffic between your systems, potentially gleaning significant information. Any systems with vulnerabilities due to lack of patching would probably be to take down your router normally gives is gone and out of them and link it for anything you need long term privacy on, but it should be hosted by entry in the profile.
It probably depends on how you need to communicate across mail servers as well, then you have no choice but to encrypt/decrypt on the?
@ScottPack nessusy stuff, yeah if I get some time it would be good. the basic parser piece I have up on github already, but would be interesting to look at the bigger system :)
at the moment have the delights of looking at moving house which is mega-hassle
@RoryMcCune That last week will be stressful, just from having to coordinate closings and actually moving our stuff, but the packing up shouldn't have been so bad.
Katie's a bit of a Type-A personality, and things like packing are definitely her bag. However, from now until moving time she's going to be out of town for 3 weeks. :)
@LucasKauffman used to have one actually, but gave it to a friend, I wasn't really taking the time to keep it properly maintained. I don't think he's decapitated anyone with it so far..
The company I work at goes through computers fairly regularly. When we get a new computer, someone has to manually go through and remove all the bloatware that comes with the computer. Right now, I am compiling a database of known bloatware and their silent uninstall commands, but many programs e...
This question is inspired by an experience I had today with online banking, as follows.
One year ago I opened an online deposit account. (Without naming the bank, I will say the company is currently a constituent of the Dow -- in other words, not a fly-by-night institution.) Earlier this month, t...
At a glance it largely seems that way to me, or topics I just don't care about. If I actually care about something, and don't know the answer, I'll go figure it out in order to post.
It just takes time, and whenever I have the time to dedicate to that task I'm just not all that interested in doing so.
@TildalWave the weirdest thing is both my desktop and the application run in native res. so no res change has occured anyway. but this has happened on two different machines.
Does anyone know of any lightweight OSs that are great for Pen-testing? I would love to have a very lightweight live OS that I can boot off a USB and try some pen-testing against some of my Windows/Linux boxes. It would be nice if this OS had a toolset of different common attacks. I am sure th...
