The DMZ

« first day (168 days earlier) ← previous day next day → last day (5010 days later) »

nealmcb

03:08

Wow - I realized this afternoon that I couldn't remember a pgp passphrase I haven't used in a while. don't think I ever wrote it down. Then it came to me. Phew! Managing keys securely is fraught with peril.....

Iszi

03:49

Sounds like my last re-build. I thought I'd copied off all my data, but somehow it apparently didn't happen. Lost everything including my local copy of my PGP keys. Fortunately, they were 1.) Non-essential, as they've not been used much yet, and 2.) Backed up to an encrypted volume on a flash drive.

1 hour later…

nealmcb

05:00

YAY! I just remembered another OLD OLD password I hadn't used or thought of in years :)

1 hour later…

Iszi

06:18

@nealmcb Wish I could do that. There's a couple IM accounts I'd like to reclaim...

Iszi

06:32

Wow. Umm... Where to begin on this one?

Q: Windows network specific attacks

I have limited experience with Windows networks and certainly no experience with AD forests or anything related. I have experience and understanding how to secure and maintain a unix style network. I am wondering if the extra stuff like AD and whatever other windows specific technologies there ...

wicky

07:23

@Iszi Is it just my imagination or has the quality of some of the questions dropped through the floor recently on here? There's a small group of people who are turning this into a "how do i hack <insert technology here>?" forum. :-(

Rory Alsop

@AviD Just did the delete bit as per the instructions. He was happy to have the answers kept, just not with his name. Maybe I need to go through and check all deleted ones...

@wicky Yeah - those we just point to the faq, close etc

wicky

@RoryAlsop Morning, I guess. Bit of an overhead compared to what you were used to as mods I imagine

Rory Alsop

@wicky it's getting more, but not really that bad

how's tricks?

wicky

Yeh good. Busy, busy.

How's things working out on your lonesome?

Rory Alsop

amusingly I have had more job offers in the last week than I can shake a stick at. Have whittled it down to 2 perm roles or stay contracting (and it looks like I have a pretty definite 14 months contracting if I want it) - good problem to have!

wicky

07:29

wow, yeh

nice position to be in

i think i'd contract if i had 14 months of work lined up

Rory Alsop

really tempted by these two perm ones - good salary, really good roles...but yeah 14 months at decent day rate...

wicky

it's tricky. having never contracted it's difficult to say. i guess it depends on your circumstances.

Rory Alsop

yeah - with family, the benefits of a perm role are a good thing, but the take home from contracting is obviously much higher

wicky

Still, at least your beer is cheap up there

bbc.co.uk/news/uk-scotland-13621315

oh, thought it would do that preview thing

obviously not for external sites

now that /would/ be interesting

Rory Alsop

Hahahahaha - no Tesco near me

nearest is about 10 miles away

wicky

07:36

same here.

but Ocado deliver :-)

Rory Alsop

@AviD Have asked Jeff if there is a way to rectify. Looks like a mistook on my part when trying to delete him from chat.

@wicky well within 1 mile I have Morrisons, Sainsburys, M&S, Asda, Lidl, Aldi and a coop - so I just send the kids out for essentials.

they deliver

wicky

:-)

right, i've read the news, checked SE, checked Twitter, checked IRC, now it's time to do some work!

got a fun day ahead writing secure development training

which basically means hacking webgoat and others

Rory Alsop

LOL - enjoy

1 hour later…

Graham Lee

08:51

@wicky what dev platform?

I have to do some secure dev training for iOS soon, wondered if I could save some time by cribbing/buying your materials :)

Graham Lee

09:10

great, now I need undo for a mod action.

2 hours later…

Rory Alsop

10:50

@AviD - just had confirmation back, @Ams questions and answers should all still remain, as I did just to a delete account. The two destroys were spam accounts.

@GrahamLee what happened?

Graham Lee

11:15

@RoryAlsop accidentally moved an answer to be a comment on a different answer instead of on the question.

Rory Alsop

ah - think obvious solution is to move it again. Other than that I would just ask over on Teachers

Graham Lee

Q: Starting with sandbox development.

Hi everyone, I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a beginner. I was searching for such project in GSoC and found a opensource sandbox p...

windows tools threats

can I do that?

can I move a comment?

Rory Alsop

where did you move it to?

I see it is deleted, but not obvious where it went

Scott Pack

@RoryAlsop That's a funny statement to hear. Except for the last 3 years I have never, in my life, lived less than 10 miles from a grocery store.

Rory Alsop

11:32

@ScottPack - well, my entire country fits into some of your smaller states :-)

Scott Pack

@RoryAlsop Yes, there's that as well.

Rory Alsop

@GrahamLee Right - I think delete the one you moved incorrectly. Undelete the correct one, then do a new move to comment

Scott Pack

@RoryAlsop According to The Source of All Knowledge, Scotland would be the 43rd state by area (of 50).

Rory Alsop

Yay - we're bigger than, what, Hawaii?

Scott Pack

A bit, yeah.

List of U.S. states and territories by area

This is a complete list of the states of the United States and its major territories ordered by total area, land area, and water area. The water area figures include inland, coastal, Great Lakes, and territorial waters. Glaciers and intermittent water features are counted as land area. {| class="wikitable sortable" ! # !! State !! total (sq mi) !! (km²) !! land (sq mi) !! (km²) !! water (sq mi) !! (km²) !! % water !! comparable country (total area) |- valign="top" halign="left" |align="center"| | Alaska | | | |align="center"| 13.77 | Libya |- valign="top" halign="left" |align="center"| ...

They list you guys at 30,414 sq.mi.

Now, the grocery stores we go to are about 1 mile away, too bad it would be a rather miserable walk along fast moving traffic

/me sighs

Off to work.

Rory Alsop

11:57

@GrahamLee Fixed it for you

Iszi

12:31

@ScottPack Funny. I don't think I've ever lived more than 10 miles from one. For that matter, probably not even more than 5 miles.

@wicky I don't think I've seen so much of the "how do I hack x" questions, but I know what you mean about quality dropping. Mostly though, I'm seeing it from newer users.

Graham Lee

12:56

@RoryAlsop thanks :D

2 hours later…

Iszi

15:19

I just had an idea that we should try to get an IT Security StackExchange meet-up/key signing party put together. But, that was immediately shot down in my head by the realization of how globally dispersed we are.

Rory Alsop

15:30

@Iszi Heh - well, I've met 4 of the guys in the UK...don't know when I'll be in Florida:-)

Iszi

I'm debating whether I want to put my public key on a key server. Kind of trying to weigh the risk/benefit between the possibility of getting mass loads of spam, and how often I'll actually need the functionality provided by the Web Of Trust.

Rory Alsop

I never got any spam from popping my main pgp key up online

ymmv :-)

Iszi

I like the fact that, until very recently, I've never gotten any spam period.

And even the recent stuff is low volume - only one or two e-mails a day.

Rory Alsop

yeah - postini helps me get the same sort of thing, maybe 1 or 2 a week at high volumes

sometimes I go for weeks without any

Iszi

Postini?

I don't use any particular spam filtering services, and still don't get spam to my Inbox or my e-mail providers' junk folders.

Rory Alsop

15:47

wow

Postini - offered along with google apps. Does some good things with mail security

Iszi

Just about anything that does go to the junk folders is a false-positive. BTW: I should probably clarify that I interpret "spam" to be unsolicited junk e-mail.

Rory Alsop

as opposed to solicited junk?

:-)

Iszi

I do get plenty of junk mail, but it's stuff I signed up for at one point or another and just haven't bothered to un-sub.

What I don't get normally is the Nigerian Prince scams or other crap.

nealmcb

16:41

@wicky Yeah - there's one new user in particular that seems to be honing skills on how to fish here for juicy "how do I crack" tips

Scott Pack

@Iszi I've had my key up on the public servers for the better part of a decade. Never felt like I could attribute to it.

nealmcb

16:58

@Iszi amazing - sounds like you've avoided having it visible on the web, or via rude web sites. I'd be surprised if spammers didn't mine the info on the keyservers. Note that if you get signatures on your key, it would be common for the signer to upload the signature and your key/userid to a keyserver, so be very clear if you don't want that

Scott Pack

Jeez, @RoryAlsop. You should hop down off that high horse and actually read his question. You're clearly stupid and ugly. :)

nealmcb

17:21

@ScottPack I must say that I disagree with all the comments on @rory's post. Silly escalations. I don't want to comment there and lead Sonny on, but there certainly are ways to attack software that doesn't listen on any ports, and on machines that don't listen to any ports. E.g. via email to get to machines that run fetchmail.

Scott Pack

@nealmcb That is not a useful conversation, indeed.

There's also the question about whether or not you're attempting a targeted attack. Your techniques would be a little different in both cases.

Iszi

18:16

@nealmcb I like your answer to my public key server question. Is there anything you can add in regards to mitigating the potential risks, aside from the standard patching & AV stuff?

1 hour later…

nealmcb

19:42

Some gmail accounts hacked: - Google traced the origin of the attacks to Jinan, China, US says no official email hacked; FBI on case :: WRAL.com

Iszi

20:13

Maybe we should get one or two good IT Security related news feeds in here?

C. Ross

@Iszi what would you consider good IT Security feeds?

Slashdot Security?</sarcasm>

Iszi

Dunno. US CERT?

1 hour later…

nealmcb

21:15

@Iszi To find folks to get you in the PGP web of trust, check out biglumber.com

see also help.ubuntu.com/community/GnuPrivacyGuardHowto

2 hours later…

Rory Alsop

22:52

@nealmcb I liked, and upvoted your answer as it does go into some decent detail on the non-listening options. Was tricky to try and articulate some responses when he seemed keen on being condescending...so I eventually just left it. <sigh>

nealmcb

23:35

@RoryAlsop Yeah - especially unfun as a mod to have to deal with rude folks - my sympathy.

« first day (168 days earlier) ← previous day next day → last day (5010 days later) »

all rooms