The DMZ

« first day (186 days earlier) ← previous day next day → last day (4992 days later) »

Iszi

01:08

Is it possible to migrate a question that has a bounty?

Q: Hiding user account names from unauthenticated RDP sessions.

This is for a Windows 7 Ultimate system, which is not a member of a domain. When I log into the system locally, I am required to either manually enter my user ID or authenticate with biometrics. The system does not display my username on the Welcome screen at boot-up, or when the session is loc...

Ori

@AviD I don't even know where to go with that one. It's just screaming trollbait.

@Iszi Can we migrate to serverfault? I don't see it in the list of available options. Were you thinking of migrating it to superuser?

Iszi

@Ori I don't think we get any site, other than our own meta, as an option during beta.

I was thinking of SU, but SF would probably be just as well.

@AviD @RoryAlsop @GrahamLee - What happened with @LanceBaynes? He's got a lot of up-voted questions but only 1 rep? Did he get mod-smacked?

Ori

01:28

@Iszi He threw 350 rep at a bounty and has a bunch of downvotes since.

6 hours later…

Feeds

07:10

Stack Overflow Blog: Creative Commons Data Dump Jun ’11

Posted by Jeff Atwood on June 19th, 2011

The latest version of the Stack Exchange Creative Commons Data Dump is now available. This reflects all public data in …

… up to Jun 2011.

This month’s Stack Exchange data dump, as always, is hosted at ClearBits! You can subscribe via RSS to be notified every time a new dump is available.

Please read, this is not the usual yadda yadda! Three things:

If you’d prefer not to download the torrent and would rather play with the most recent public data in your web browser right now, check out our open source Stack Exchange Data Explorer. …

4 hours later…

Graham Lee

10:43

@Iszi @Ori so I was actually starting to worry about that user account a couple of days back. Historically he's given some useful contributions, but recently has been going wildly off-topic and posting low quality content.

Scott Pack

11:33

@GrahamLee And let's not forget getting incredibly pissed when someone offers advice

Graham Lee

that doesn't help.

Scott Pack

I would much rather have a user with questionable content that's willing to accept criticism, than this.

Iszi

12:01

@GrahamLee Was figuring it would have had something to do with that. In the past, I've been able to see where a user account has been locked, and I didn't notice that this time.

@Ori Oh yeah, that would do it too.

Scott Pack

12:29

Hey @Iszi

Iszi

@ScottPack Hiyo

Hrm. It would seem I'm the only one in this room (at the moment) without a custom Gravatar.

Thomas Pornin

12:53

@Iszi There's a badge for a "full bio", and I am not sure whether a custom picture is needed for that -- but it sure prompted me to include one.

Graham Lee

@ThomasPornin it's amazing how readily security experts will hand over extra information in return for a bronze badge :D

Scott Pack

@GrahamLee Just like the Passwords for Chocolate movement. How accurate is the data?

Thomas Pornin

Filtering ICMP is bad.

I cannot directly connect to my mail server this morning.

But I have a shell account elsewhere from where I can connect to the server.

Graham Lee

yeah, I don't really understand the 'OMFG but people can enumerate your hosts' deal.

Because they can do that any one of a number of other ways.

Thomas Pornin

traceroute is not informative about the location of the problem, because ICMP are dropped.

Scott Pack

13:07

I don't find traceroute to be a very good example, simply because of the fact that different systems implement it differently.

Path MTU discovery is probably the best general purpose reason for not blocking ICMP (at least at the network layer)

Active Directory also really enjoys having ping functional.

Graham Lee

13:26

as in: stops synchronising properly if it isn't?

Thomas Pornin

13:36

The first gateway in my ISP network is G. My mail server is M and is "far away". I have a shell account on an extra machine E (which is also "far away"). From my home (H), I can ping G. I can also ping G from M and from E. From E I can ping H, too (my own machine). But I cannot ping M from H or H from M.

In short words, it seems that the problem is with my ISP, but I have no idea how I could explain that to them.

Yes, I did reboot my modem.

Scott Pack

@GrahamLee Yeah, weird things like that. It seems a bit inconsisitent, though I'm sure a proper Windows guy understands better. I know that it uses ping to determine your "closest" DC, so everything should work without ping. However, I've seen cases where servers will only pull down GPOs and the like iff ping succeeds.

Ori

@GrahamLee a great talk all about that was: the robin sage talk last year. science.dodlive.mil/2010/07/21/…

Graham Lee

@Ori there was a speaker at B-Sides London who said he asked candidates for info sec posts "what is your password?" at interviews, and 30% told him :-/

Scott Pack

@GrahamLee So these were IS type guys, or just normals?

Graham Lee

IS types

*unemployable IS types

Thomas Pornin

13:49

Ah, full Internet is back. Problem solved itself.

Ori

@GrahamLee good god, might as well ask for their social.

Scott Pack

@ThomasPornin They must have gotten the magic smoke back in.

Graham Lee

@ScottPack only time I got a laugh for the "magic smoke" joke was a time when it escaped.

Graham Lee

14:33

What do we think: too angry?

A: Is PCI DSS applicable to other solutions than those dealing with payment cards?

Some of the PCI DSS requirements may apply to situation (in fact, it's highly likely that some of them will). However, your application will have requirements that are specific to its problem domain, and that PCI does not address: similarly, PCI will make some requirements that are irrelevant (or...

Scott Pack

I think I need to read his question again after some time. It feels...wonky.

1 hour later…

Scott Pack

15:37

@Iszi This $4 tester is probably the best money I've spent on electrical anything: bit.ly/l5F2yo

Splurge for the $8 variety and it will come with a ground fault test mode as well.

Iszi

@ScottPack Cool. Thanks. Based on some of the other comments to that article, I don't think that's a project I'll be jumping on too soon.

CtrlDot

Hey guys, had a quick question wondering if this is the right place to post or not. We are looking at using something like urlscan to help increase the security stance of our IIS servers. The two that I have found are urlscan and webknights. I'd basically be wondering what peoples thoughts were on the two solutions and why they would recommend either... etc etc

Iszi

@CtrlDot Might not be a good question for the site, but definitely welcome in chat.

CtrlDot

thanks Iszi. Do you have any thoughts then?

Scott Pack

@Iszi When we moved in I needed to get some power to the other side of the room, but couldn't run new in wall wiring because of how the basement was finished. So a spool of romex, 1 grounded end, run of raceway, and one external mount outlet box later I pretty much did the same thing.

Iszi

15:47

@CtrlDot Not on those particularly, but you might want to check out Acunetix also.

Scott Pack

@CtrlDot Asking a direct comparison of those two on the main site would be bad form, S&M and all that. But, I think you could probably divide it up into two questions asking about each tool in particular.

CtrlDot

have you used this one before @Iszi? What did you like about it?

Scott Pack

Then do your own comparison.

CtrlDot

okay thanks @ScottPack

Iszi

@CtrlDot Our organization just started with Acunetix. I haven't had hands-on with it myself, but thought I'd throw it in there.

CtrlDot

15:49

yeah I guess my question is more general about what do people do to protect IIS

i know I can read a book, but there seems to be a lot of options when it comes to WAF

Scott Pack

Are you intending to protect IIS or your underlying(overlaying?) web applications?

Iszi

These tools don't actually protect IIS, or any web server for that matter. They just help show you where the weak spots are, so that you can do patching and hardening.

CtrlDot

Both to a certain degree. I guess this is more for the the web application itself

I could use something like IIS lockdown to protect IIS, or so I read

Scott Pack

You definitely need to do both, but how you go about doing it will be different for each

CtrlDot

fair

I think a WAF is a good way to go for the application itself

why have your web app deal with xss when it can be blocked before it reaches it?

(it should still deal with it tho)

« first day (186 days earlier) ← previous day next day → last day (4992 days later) »

all rooms