@FalconMomot Sooo...Your position is that free/inexpensive software is bad? Because if you want to hold software to the same engineering standards as airplanes, software is going to need to cost as much as airplanes.
Anonymous
@FalconMomot you are suggesting to remove the big ass warnings in most licenses about NO WARRANTIES - USE AT YOUR OWN RISK? no thanks
@TildalWave I'm beginning to think it might have been one. I figured it wasn't because they posted it on April 2nd in Australia but the moderator comments suggest it was an April fools joke.
I think it was an ill considered joke, since they have just finished the 7-part post on how they really got hacked earlier and the server in question hasn't seen an update in four years.
@Ladadadada That's why I hate April Fools, most people's sense of humour is simply crap and they should stick to quoting Wikipedia which they seem to be good at :)
tis like what I was saying about Google's "pranks" - just because you write something stupid / crazy / impossible / untrue-but-possible, does not make it funny.
Pro-tip: if you want your April Fool's prank to be funny, start with step #1: "Be Funny".
@AviD It failed for three reasons: Suckie answers (namely, @Tildal's and @Iszi's), for being closed so early, and for needing a bit more creativity in the question itself. It already reached the SuperCollider a few minutes before it was closed.
The only people who actually played were @Lucas and @Gilles
@PatoSáinz I think if you pay for it or commission it (and most of these guys do get paid like liable engineers around here), it should at least be free of gross negligence.
@LucasKauffman for the benefit of those not familiar (and to prevent me from putting my fist through the monitor displaying the awful code I'm reviewing....)
@FalconMomot Oh ... dunno, I would agree with what you're saying but only partially. That's what certification is supposed to be there for, but I wouldn't want ALL the paid for software to get ridiculously expensive or simply unavailable just because someone wants its engineers to be liable for it. Certification, individual contracts, even end user licence agreements should be sufficient. Then it's up to you which one you wanna use or not. But I'd agree that some are greatly lacking in this.
All the pen testers I have ever managed have despised SQLi. Mostly because they see it as monkey work, which is difficult to use to justify decent hourly rates, but also, as you said @AviD, it takes up time they could be using looking for interesting vulnerabilities
One of the upsides of managing over 100 testers who had to pass a customer 'assault course' to qualify for a large engagement is that I got to know some really good security guys and see how they ranked on a real world test. The top 10% are an impressive bunch of technically brilliant guys
and, if you dont deliver a thick report with hundreds of trivial monkey issues that their monkey devs shouldnt have put out in the first place, instead providing a short, targeted report focusing on the high value, interesting, business flaws - then they assume you did not do a good job and do not justify your own higher rates, and will prefer a cheap monkey tester next time.
@LucasKauffman I actually plan to put together some text on "good SSL configuration" per web server, if I get a chance. Then I can put that in to provide some value (hey better to have good SSL configuration than bad) and put in the VA style results as part of that
I worked with the client on the test, but despite being slightly geeky, and able to understand testing reports and implications, my input to the technical setup was more around discussing what we could put in as vulnerabilities
@RоryMcCune Yea I've been thinking of adding that stuff as well, problem is that sometimes the shit you find in an application makes me think: "let's first make them stand up and walk before starting to run"
@LucasKauffman well yeah, it's perhaps more relevant where the customer has sorted the really egregious problems, but with some template text it becomes relatively easy to tailor and add to the report...
@LucasKauffman heh, I'll need to tidy it up a little (the headers bit) but sure, I can send it over. Am tied to a desk this week anyway (my knee has smegged up on me, so mobility is pretty limtied)
@LucasKauffman that's the thing, not sure. 3 days ago started to hurt to twist it at all (tender on the outside), then yesterday starts to hurt to bend it much, some probs. walking on it. off to see the doc. this morning ...
I think it could be down to doing a lot of walking recently
something wore out and I didn't pay attention till it got worse...
actually, depending on what the doc says, if there is a need for taping, I'll see whether we can take a tour up your way over the easter break, as Claire does physio taping and is going through training to do it professionally as part of her day job
@kiBytes - I have a copy, however I cannot passit on to you due to licencing restrictions. As all copies are watermarked with the owner, this is relatively easy to monitor. The upside is, your boss will be able to get a very cheap copy, or a free one as part of organising cobit training, perhaps.
I always think it's odd that standards in a lot of cases are non-free docs. It took me ages to get a copy of ISO27001 back in the day...
which was bizarre 'cause the (large) company I worked for said all their security policies were to be based on it, and I was tasked with writing some of said policies...
We are planning to develop a EHR/Billing Software and we are aware about HIPAA rules and regulations. Our current application architecture using a shared database with all client's(Provider/Practice) data. I would like to know if HIPAA recommends in isolating database per client(Provider/Practice...
@RoryAlsop @RоryMcCune re Bell Lapadula etc... while it is true that very VERY few actually use these in the real world, I think it is actually super important to learn them. They are very important building blocks to understand the internals of how it should be done.
kinda like how any programmer should learn assembly, but (almost) never use it.
besides, just because >80% of the real world does access control a certain way, doesnt mean that it's the right way, or a good way.
we could definitely do with more people understanding access control better.
@AviD possibly but with so few real-world implementations, a developer wanting to do things that way would need to start from scratch which is something they're unlikely to get right
For example, the Biba model is now hanging out in current versions of Windows. Things downloaded from the Internet are tagged as such. Internet (low) stuff can't alter user (medium) stuff which isn't allowed to write to system (high) objects. Inevitably, this kind of fades away as the end user ju...
so like I said - it's not something a "technician" needs to know, but security professionals DO need to understand it, so they can design better access models (and understand the existing ones).
well potentially that's the tack ISC2 are taking these days, but my memory of the CISSP syllabus was that they taught it in a list with RBAC and DACLs without saying "hey only these ones are actually practical in most circumstances..."
@RоryMcCune well, the direct alternative is not much better... "Hey this is the same stupid thing that everybody does.... if you want to make the same mistakes as them, here ya go!"
@AviD I guess if you could create a demand for MAC products by educating people on the benefits, but I'm not sure that teaching things which are (in a lot of cases) unimplementable as though they were helps with InfoSecs integration with the rest of IT (i.e. as a profession we do have a bit of a rep for lack of realism...)
The problem is that these are essentially platform implementations. PBKDF2 is imply a bad design. Hard to implement correctly and even when implemented correctly it has weird properties like those trivial collisions.
It also does some weird XORing, which removes the feed-forward from certain hashes. Doesn't cause any vulnerabilities, but seriously WTF.
@TildalWave It is a pointless feature which is not expensive for implementations but means that it is much harder to know (for cryptographers) whether the result is secure or not.
Basically it projects the feeling that the designer of PBKDF2 was not completely aware of what his job entailed.
Which is kind of embarrassing since PBKDF2 is from RSA Labs, signed by Kaliski, who usually knows his trade.
Argh. I hate when people conflate "two-factor" and "two-step" authentication - especially when those people should know better.
> Two-factor authentication includes a regular password system augmented by a second step, such as providing a code sent to the vendor’s mobile phone or answering extra security questions
Just had one of these happen today... Me: A recent scan shows that you're missing patch X on your systems. SA: I've tried applying that several times but it still shows up. Me: Did you follow all the steps in the patch instructions? SA: Yep. Me: [Insert recommendation from aforementioned instructions.] [SA follows recommendation.] [I rescan, system shows patched.] Me: ***HEADDESK***
@Iszi That may be an inevitable consequence of experience. As you get more experience you skim over things you have seen before. The more experience you have, the more things you have seen before, the more things you skim over.
It's still frustrating. Needing to tell someone from the unwashed masses of the Internet to RTFM or JFGI/LMGTFY is one thing. Having to do it at work, for someone who certainly shouldn't need to be told, is another.
For me (and I recognize I may be unique in this) it ranks up around the same level of frustration as having to implement a change you disagree with.
Anyone watching the Windows Phone news at BUILD? Can't wait to get Cortana on mine!
It is a classic. Dialog template: Me: did you do X ? SA: yes I did. It still does not work. Me: are you sure you did X ? SA: yes I am sure. Do you think I am dumb ? [... three hours of enabling various debug mechanisms ...] SA: oh, I found it ! In fact, I needed to do X ! Now it is done, it works.
The basic idea is that if the guy was not a psychopath, he would not do that job. So you are bound to deal with that kind of people.
Most of such "debug sessions" (usually over phone) turn into ways to make the guy produce some debug information which demonstrates that he previously lied, but he must not be aware of it too early, otherwise he will cease to comply.
@Iszi Personally I don't really care about either. I prefer counting how many points an attacker needs to compromise. Often enough that's only one (trojan on PC) even if it's two factor auth.
having the tech support guy from company ABC (which generally starts with D) on the line and having them walk through stupidly basic stuff you have already tried and timing out the proper amount of time before saying "ok, what now" so that they don't catch on you are ignoring them until they give you the RMA you already know you need
My last headbanging experience was with a non-techie that finds MS Word fascinating trying to find a technical excuse for being lazy about writing user docu for her website, saying she first needs to register a domain, that there's no point in having any content before that.
@tylerl I didn't, because her last question was that they changed the server and where is now her website so she can write that user docu. I should mention that she's been "writing" those 4 pages for the last two years. It's all just lame excuses not to do anything anyway.
Reminds me of the old saying at Apple when you start a new project: Step 1: Come up with a cool name Step 2: Design the icon and "About" dialog box Step 3: Print the T-shirts ....
well this one isn't really my "client" it's more a favor that I'm doing for her as a sister of my good friend ... but it's painful to listen to all the excuses really, and the last few were simply putting me in danger of self-harm
She has a complete e-commerce package, design (actually two), the whole shebang ... I even entered a few (read: all she has) of her products she'll be selling into the database, and had lessons with her how to use the CMS and all ... all she'd have to do is write 4 bleeping pages for "about us" and shit like that. I even wrote her ToS and all the more-or-less generic things. So I kinda gave up, I'll only reply on request from my friend from now on.
It seems that every single banking & financial website that I have used logs me out after a certain period of time.
Are there a legal requirements or technical reasons for financial sites to do this? Or is this just their form of "security" to prevent others from accessing your account should y...
A gram is equal to 0.035274 ounces. Assume that the variable mass_in_ounces has a value representing a mass in ounces. Which arithmetic expressions below using the variable mass_in_ounces represent the equivalent mass in grams?
@Adnan If people had not stupidly prevented Napoleon from ridding the World of Brits, that sort of question would not need to be asked. Metric system, dammit !
frankly, I don't really remember, I think I did ... that was the one when you had to find something bright to watch them against otherwise you didn't see shit?
It seems that every single banking & financial website that I have used logs me out after a certain period of time.
Are there a legal requirements or technical reasons for financial sites to do this? Or is this just their form of "security" to prevent others from accessing your account should y...
