The DMZ

Scott Pack

02:40

I went ahead and flagged this one for migration. Are there any dissenters?

0

Q: Did someone really plug an iphone in, or are these symptoms of an exploit attempt?

My syslog indicates that someone plugged an iPhone USB device into my desktop at 4am today, for about 10 minutes. I'm checking physical security logs to see if there was someone in the room, but in the meantime I'm trying to investigate whether these symptoms could indicate some other kind of in...

Iszi

@ScottPack Well, it's definitely off-topic for ServerFault. Might be more on-topic for Ubuntu, but here sounds like a good place too.

Scott Pack

I don't see it being any more on-topic for Ubuntu than U&L.

Granted. I don't see any purpose in having Ubuntu separate from U&L except to further fragment the SE userbase.

That question does read like the kind of thing that would come to my office first, and we would decide if someone else needs to handle it.

Though, I'm not answering it. I'm going to bed.

Iszi

03:30

@ScottPack Well... yeah, but I think that's always been a fairly fuzzy distinction.

Iszi

05:39

This one's really S&A and likely to end up creating more discussion than it does globally-useful answers. If it's kept alive, I strongly suggest moving it to Meta.

3

Q: Appropriate password requirements for a login (OpenID) service/provider/delegate/thing

This is with regards* to Stack Exchange's upcoming OpenID provider (and in particular, discussion about password requirements). Currently, password requirements are: Must contain 3 of: lower case character, upper case character, number, special character**. Cannot contain any public account fi...

authentication passwords openid

Scott Pack

11:33

It was asked by one of the devs, presumably based on this statement from Gilles

14 hours ago, by Gilles

And there's a mini-debate going on about password requirements

Iszi

12:30

@ScottPack I'm aware, which is why I am suggesting we keep it alive in Meta.

I get the feeling that if it were asked by anyone else, it would have been much more widely accepted as close material for S&A or too localized.

Scott Pack

Well, it seems like only you, myself, and Neal actually vote to close things. I haven't really looked at it yet

Iszi

@ScottPack Hrm... How do I poll the site for # of users with 500+ rep?

Scott Pack

There's no good way outside of a data query, which isn't made available for beta sites.

security.stackexchange.com/…

That's about the best we can do right now.

Rory Alsop

Morning All! I'm back :-)

Scott Pack

@RoryAlsop!

Hey, check out the area 51 page!

Rory Alsop

12:45

@Scott!

Scott Pack

187

IT Security – security.stackexchange.com

Beta Q&A site for security professionals to discuss vulnerabilities like XSS, buffer overflows, SQL injection, CSRF, clickjacking, as well as system and network security. Discussions related to OWASP projects, tools, papers, and other materials are encouraged.

Currently in public beta.

Rory Alsop

I got the 150th voted up this morn:-)

Scott Pack

damn!

I just put one over the top as well

Rory Alsop

LOL

so, just questions and visits to go. Our analytics page looks grand :-)

Scott Pack

I've been noticing that number ticking up

How was Vegas?

Rory Alsop

12:49

Vegas - well, I don't gamble (not for moral reasons, I'm just crap at it) so I'm not a huge fan, however Paris Las Vegas is a very nice hotel, dinner at the top of the Stratosphere with free rides thrown in was awesome, and the conference was astonishingly good

It might sound sad, but COBIT 5 actually seems to be getting there (from the perspective of real security) - my wife says I'm not normal, getting excited about a set of control activities, but it looks like a step change in terms of security deliverables from ISACA - who have always done audit deliverables well but have been light in the security field

Scott Pack

Which conference was it?

Rory Alsop

ISACA Global Leadership Conference

Scott Pack

The wife and I have come to terms with our respective points of excitement. :)

Rory Alsop

@ScottPack hahahaha - almost too much information

Scott Pack

She has a business background and likes organizational products, I'm a geek. So, you know.

Rory Alsop

12:52

yep - I'm a geek and my wife is a nurse. Think she's jealous I get to take my work home with me...

Scott Pack

Well, she can too...but it's probably soaked into the fibers and needs washing.

Rory Alsop

ewwww

Scott Pack

Pretty much.

Now she works in real estate, which is pretty nice. Lots of juicy gossip comes home.

Iszi

So, looks like we've got just a bit over 40 users who actually have 500+ rep.

Scott Pack

13:10

Then 13 over 1000

Rory Alsop

@Iszi did you just count them? :-)

(off to check if mod analytics give us that info)

Scott Pack

How many people per page, how many full pages, etc

Iszi

@ScottPack Exactly.

Rory Alsop

nah - we get numbers of questions, answers, visits, votes (up and down), new visits, new users but no links between them unfortunately

also get good info on referrers, search terms

all the good stuff comes once we leave beta

nealmcb

13:42

@RoryAlsop Yay! I've been working on it also with you and @ScottPack

Rory Alsop

@nealmcb excellent

Scott Pack

Morning, @nealmcb

Rory Alsop

I had been spotting ones I had already voted on pinging up further - think @AviD was also being tactical and deliberately hunting down good posts from specific individuals:-)

So 3 out of 5 at excellent... that's getting close to exiting Beta material

Scott Pack

@RoryAlsop That only works if said individuals had multiple posts

Rory Alsop

@ScottPack yep - but if they didn't, then that's their fault:-)

Scott Pack

13:44

Booring!

Rory Alsop

oh - I see what you mean

no I meant that I had voted up individuals, then watched as other people voted them up

spotting them tipping over the 200 mark

Scott Pack

Ah, that.

I did notice that many of the folks who were close to the mark had such small numbers of posts that it would be difficult to tip them.

Rory Alsop

yeah - my search category was actually to go first for those with many badges and a rep of 160 to 199

as that implied they were more active in a range of areas, rather than one lucky good answer

Scott Pack

True enough

nealmcb

I was just watching out for anyone under 200, thinking that that is the stage where they are most excited about getting voted up - retain them for the long term

Scott Pack

13:50

@nealmcb Same here.

Rory Alsop

@nealmcb oh definitely - it was just harder with the folks who had 1 or maybe 2 questions, which I had already voted on... not much I could do with them

Scott Pack

@RoryAlsop Or, even worse, only had questions.

nealmcb

@RoryAlsop Does ISACA ever deal with election integrity, e.g. election audits? C.v. one of my foci: Principles and Best Practices for Post-Election Audits | ElectionAudits.org

We need good folks to advise on evaluating audit files of voting machines, and recommending improvements and standards

(2 different kinds of audit there - tabulation audits and event log audits)

Rory Alsop

@nealmcb - sort of. Not specifically, but integrity controls are well in ISACA scope. Part of this leadership conf was identifying the right people to lead each subset, so I can easily ping a request out to ISACA central in Chicago to see who heads that up now)

Is your need for audits, or more for guidance/good practices around the topic?

nealmcb

Re: isaca.org/about-isaca/Pages/default.aspx I hate it when the "about" page for an organization doesn't have a place to copy/paste their full name :/

Rory Alsop

14:01

@nealmcb copy and paste what?

nealmcb

@RoryAlsop copy and paste whatever it is that IACSA stands for...

Iszi

14:23

@nealmcb Per Wiki: Information Systems Audit and Control Association

Information Systems Audit and Control Association

ISACA is an international professional association that deals with IT Governance. It is an affiliate member of IFAC. Previously known as the Information Systems Audit and Control Association, ISACA now goes by its acronym only, to reflect the broad range of IT governance professionals it serves. History The ISACA was founded in the USA in 1967, when a group of individuals with jobs auditing controls in the computer systems, which were becoming increasingly critical to the operations of their organizations, recognized the need for a centralized source of information and guidance in the f...

nealmcb

@Iszi Thanks. I had found it before, and forgot it, and went to their "about" page to get it again, but it wasn't there. So I was pointing that out - surprisingly common. Often an organization only has their full name in a graphic that can't be copy/pasted, but I don't see ICASA's name anywhere on their about page

Iszi

@nealmcb Yeah, I hate that too.

nealmcb

Ahh - I see it is intentional. Though listing the historical name would have saved me some confusion and frustration

Iszi

@nealmcb Kinda like Kentucky Fried Chicken is now just KSC, I guess.

makerofthings7

14:40

Curious if anyone here is in NYC or went to the Cloud Security Alliance meeting last night csanymetro.org

drachenstern

15:06

'allo all. Curious who, if at all, is familiar with the dropbox host_id "problem" of a few months back.

Scott Pack

@Iszi KSC?

drachenstern

15:21

Ok, so I'll just prattle on then since I'm off the phone.

I know there was a lot of griping about how the host_id value was stored in plaintext in a file and so while plaintext for a securityID is a bad idea, I'm curious how to uniquely authorize a given machine so replay attack vectors are reduced.

Should I be asking programmers on SO specifically, or is this a good venue to pursue this line of thought?

Or is there a super good resource I should be looking at that I have no idea about.

nealmcb

@drachenstern This is the right place to ask if replay attacks etc are an issue.

drachenstern

The idea is how would one go about making it secure, but letting an app run as a service?

So I don't want to ask the user for a password on a regular basis, but I want to auth as them securely.

Jeff Ferland

18:11

http://security.stackexchange.com/questions/3919/how-to-defend-vs-image-remote-file-inclusion-e-g-rfi-using-a-gif-file-apache

I have never seen anything on here that has made me twitch as much as that. Anybody able to one-up it? That's seriously thedailywtf.com stuff.

Testing to see if a link only posts the actual question:

2

Q: How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?

To defend versus Remote File Inclusion where attackers try to abuse image files, I usually recommend to never use include to include image files into PHP code. Sometimes though, the avoidance of image includes may be not possible at all (for whatever reasons, doesn't matter). In such case I usu...

appsec web-application php

drachenstern

18:26

@JeffFerland that would be called oneboxing the link. It works on a great many number of links. Also see, the Sandbox:

Sandbox

Where you can play with chat features (except flagging) and ch...

2

notice that links to other rooms get oneboxed ~~and other formatting is fun to play with too~~

nealmcb

19:28

@AviD - I edited this for link rot (and to give it a bump), but a real description would also help

2

Q: What key metrics should a CIO rely on to gauge the extent of IT risk exposure?

Note - This was originally asked in another Area51 proposal, which has since been deleted.

business-risk risk-management metrics

nealmcb

19:55

I love the IETF: reducing ambiguity!! Guidelines for the use of the OAM acronym in the IETF (Draft)

Complete with "Security Considerations" :)

Feeds

21:19

Stack Overflow Blog: SE Podcast #05

Posted by Alex Miller on May 18th, 2011

The podcast is on the road again this week, with Jeff and Joel coming to you live from Jeff’s living room in El Cerrito, CA. They’re also joined by Josh Heyer (aka Shog9) who calls in from Colorado. This is actually the second time we’ve done a podcast from Jeff’s house, the first time being Episode #51.

There’s no podcast next week, but we’ll be back the week after, so make sure to join us then!

Stack Exchange Podcast – Episode #05 w/ Josh Heyer by Stack Exchange …

Rory Alsop

23:07

@nealmcb Well - part of the reason is that ISACA is now just ISACA. They don't bother with the full name any more.

Iszi

@ScottPack Bah. Getting my TLAs crossed, it seems.

Rory Alsop

@Iszi heh WTF LOL

Sandbox

Transcript for