@DavidFreitag It's your apache config. You need to set up either perl CGI, perl fastcgi, or mod_perl to interpret the pl files instead of just displaying them.
@tylerl yeah I've seen it in a lot of dev products, just a little surprised/disappointed that a security product wouldn't at least provide an MD5/SHA-1 sum that could be checked...
@tylerl sure I've always thought that was a bit useless, I'd say announce via a separate channel/site. but as you say really it should be signed all the way for that kind of thing...
@RoryMcCune If the MD5/SHA-1 is on the main HTTPS-powered Web site, then the download itself can use plain HTTP, FTP, Torrent... whatever is efficient for bulk data.
Of course, if the MD5 or SHA-1 is obtained over plain HTTP, then that's kinda weak. However, it still demonstrates some level of care.
@RoryAlsop Honestly, that didn't sound very Finnish to me. I mean, I can definitely recognize some words. It could be the loud music masking the lyrics.
@kalina Heh. I could say the same of a few other SEs, but I don't really spend that much time on them either. I think I've got 101 rep (or not much more) on probably a dozen or so SEs.
@kalina Oh, see you're missing the point of this room then. security is way down the priority list here. You want too really learn security? Check out the main site.
@Adnan on which note, you should stop pushing buttons during this phase before you inadvertently upset me, resulting in me finding where you live and burning down every property within a square mile of your location
@Iszi no, I'm quitting in preparation for moving into a place I can't do them
I realize this isn't strictly a programming question, but I have a file with the extension .bak, and the file starts with "TAPE". What program produced this?
hi, hoping to get my question reopened as I don't think it's a dupe (and I've fixed the answer-with-questions issue). Need one more vote. Can anyone help out / suggest anything remaining that needs to be improved?
What steps need to be taken to protect a computer from quick attacks that involve physical access?
(Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; also I'm only interested in very time limited attacks in this question)
The scenario is protecting...
The fundamental problem with that question isn't so much being duplicate, as it is being limited in scope and usability. The ~30 second vulnerability window is absurd. Hardly a single system in the world, let alone any personal system, is so well-protected by nature that 30 seconds is the largest window any attacker will ever have for physical access to it.
@Iszi SpiderLabs does a weekly podcast. Though it's mostly just Space Rogue ranting about responsible disclosure.
@Michael I agree with Iszi. The scope is a bit silly. It's like saying "I want to build a cage for a tiger, but let's just assume that he's not going to use teeth for anything"
In any case, the recommendations are going to be more or less the same as several already-answered questions on this site: Physically secure your computer when not in use via whatever locking mechanisms are available or feasible. Protect the OS with a strong password and lock the session whenever you're away. Lock down the BIOS and boot order. Use whole-disk encryption.
In fact, I'm pretty sure I've given that exact answer - though in a much more verbose form - on no less than four questions across Sec.SE & SU.
hm, maybe I've not expressed myself then. It's also to do with capabilities of attacker - I'm not worried about people who have invested a lot of preparation in targetting me in particular, it's opportunistic attacks
the two example I give in the question show that it is not absurd - these are real use cases that it is worth considering how to protect against
@Michael True, but the implied assumption is that these are the only physical attack scenarios worth protecting the system against.
@Michael Again, the usefulness of the answers would be ridiculously restricted. There's not a whole lot of computer owners out there who are really worried, let alone only worried, about protecting their systems against the technically inept.
@Michael The advice for how to protect a computer in a more adverse scenario than yours still work for yours. I recognize that your situation is unique, as is everyone's. But if you want someone to analyze your specific requirements, then hire a consultant.
Maybe they are. If I carry my phone in my pocket and sleep beside it, but then leave it in a different room / semi-public place for a short while, actually that is the only physical attack you need to worry about
@Michael So, you never go swimming at hotels or water parks? What do you do with it when you go on a roller coaster? You get in a car accident and are air-lifted, unconscious, to the nearest hospital - who's looking after your phone then?
@tylerl I managed to be able to run the *.cgi scripts by symlinking a file from /etc/apache2/mods-available to /etc/apache2/mods-enabled but now i'm getting a 500 error when it tries to load css files
client called, needed malware removed from his website. Quoted him some number that was more than he wanted to pay. "I'll give it to one of my internal admins" he says.
client calls again 3 days later "server won't boot" he says....
internal admin found the malware and deleted it: "rm -rf /some/dir/*"
"not sure what happened" says admin. it was deleting the files just fine, and then I started getting errors about missing libraries. So I rebooted the server.
@DavidFreitag Oh, I've gotten that one almost a dozen times. Except it's in the form of "I was getting an error in my PHP script, and I was following a solution on a blog..."
@DavidFreitag mostly recoverable. Takes several days. Usually just move the valuable data to a new server.
@DavidFreitag yes, well you replace the user:group with your own. But the blog says "replace /somedirectory/" with your document root, and the client thinks "my site is example.com/" so the path is "/"
@tylerl That just makes no sense. It's like "This is what our entire business is built on, it's the one weakness. Should we spend the extra money to do regular backups? Nah."
@DavidFreitag Often they're advertising or branding companies. They offer web hosting as a side-business or courtesy. They don't see it as their core business. But they're still responsible for it if the fuk it up.
@tylerl I have a system in place for my musical projects, nightly a full copy is moved to each of my other pcs, and then a copy is uploaded to google drive
why businesses don't do that with stuff that could put them out of business is beyond me
I realize this isn't strictly a programming question, but I have a file with the extension .bak, and the file starts with "TAPE". What program produced this?
What steps need to be taken to protect a computer from quick attacks that involve physical access?
(Note unlike this question, I'm primarily interested in stopping the attacks, not detecting them; also I'm only interested in very time limited attacks in this question)
The scenario is protecting...
