The DMZ

this.josh

00:02

I was speaking of the scale of private (closed) versus public (open). At one extreme everything is open (no practical anonymity) and on the other everything is closed (no practical accountability). I don't pretend to know where any population's mean lies on that scale, but I would say I register more towards the private (closed) side than at least two frequent contributers.

And for reference, this is (in my faulty wetware) connected to the discussion of warning new users about the international and difficult to redact nature of contributions to IT Security.

Hmm I wonder how to make 'difficult to redact' an obvious adjective modifier to nature...

Scott Pack

00:26

@thisjosh Ah, my ideology definitely trends more towards open in that regard. Of course, I also work for a public university, so there may be a correlation there.

Although, in practice, I feel like I trend towards closed when it comes to specifics. Largely in response to the public records laws. Walking the fine line between what's redactable and what's not under such laws is always exciting. :/

this.josh

That is true.

I think the balance for a long time has been towards the private (closed) side of things in most countries, and that there is a lot to be gained by moving towards public (open).

I do worry about the mean moving too far though. I think individuals should be entitled to some privacy.

Scott Pack

@thisjosh Unquestioned. In fact, I said as much in my elevator pitch suggestion :)

this.josh

I don't ride elevators, safety and health risk, stairs have much better uptime, especially when running.

I need a symbol to indicate humor content in a sentence... (as in the above)

\May contain humor/ too long

Scott Pack

ಠ_ಠ

Iszi

00:44

@thisjosh Could just do </humor> like I do </sarcasm>

this.josh

aparently ಠ_ಠ is the look of disaproval.

Scott Pack

@thisjosh Disapproval...humor...tomato...potato...

In related news. I need to fix my fonts so that the characters actually show up. I'm not keen on hex filled boxes.

this.josh

< humor> Poor analogy, potato is a vegtable and tomato is a fruit < / humor>

< humor> Did a witch doctor get to your boxes? </humor>

Iszi

01:01

@thisjosh Erm... we don't usually use the opening tags. Just the closer. Kinda like saying, "in case you didn't realize... yeah, that's what this was".

this.josh

No, actually I didn't realize. I noticed that if you don't put a space between the left angle bracket that the tag got removed. I fugured that people were forgetting to add in a space and it got eaten.

Iszi

01:40

@thisjosh You didn't use a space in the closing tag on your last post.

this.josh

Err, I was being serious. I figured people use HTML so much that its hard to force in the space.

Iszi

02:10

@thisjosh Maybe I'm not following. Why the space?

this.josh

If you were to write '< dummy_tag>' without the space the chat system removes all characters from the '<' to the '>' if you write </dummy_tag> the system ignores it (unless it is a valid HTML tag for chat)

Iszi

Ooooh, I see. It's only the opening tag that's affected.

I think you mis-read my "in case you didn't realize" bit. I was saying that usage of only the closing tag was sort of like saying "in case you didn't realize...". Sort of like: "The sky is green </sarcasm>" = "The sky is green. In case you didn't realize, yeah I was being sarcastic."

this.josh

No, I got that. I just thought that people forgot to put a space in the leading < scarcasm> resulting in it not being displayed. I though that people were putting open and close tags, but because their fingers are not used to putting the space in the open tag that it was not being desplayed.

Iszi

02:42

@thisjosh Ah, no. I don't think I've ever (or if so, not often) seen the opening tag used.

Rory Alsop

08:13

@Iszi In chat applications and IM I just use the close tag. I figure humans can mentally insert the open tag retrospectively

Rory Alsop

08:56

We now have a good queue of regular blog posts - up until the 4th of October - so that side of things is working well. We also have two more in draft - @Mvy's one on ISO27001, and my (not yet started) OWASP one. The QOTW is a bit more of a rush each week, but I think it is working okay.

M'vy

Hm... too much work those day :P

I really need to finish that one :P

Rory Alsop

What do you guys/gals think? Should we be asking further ahead for the QOTW? Or would it be better to schedule them in every fortnight between the regular posts? They are by their very nature shorter and quicker than the regular ones.

@Mvy :-) Like I said, I actually need to start my Owasp one... real life keeps getting in the way

M'vy

:P

Graham Lee

09:35

morning

Jeff Ferland

'morning

Graham Lee

I was thinking it might be fun to do a blog post that discusses password strength issues and takes in a load of the security.se discussions on the topic. Any value in that?

Rory Alsop

10:14

@GrahamLee morning

@GrahamLee I reckon. a good overview of it all

Graham Lee

Will have a go this evening, I'm taking the coach to DC4420 so should have a couple of hours to draft something (assuming I can get interwebs)

Rory Alsop

10:29

@GrahamLee cool. Passwords are the popular topic

Graham Lee

that's what I thought. And there are confusing and conflicting ideas: should we have maximum lengths, should they be random or correcthorsebatterystaple, should we give up and use biometrics, etc.

(BTW you have to hand it to Randall: I do remember correcthorsebatterystaple)

Rory Alsop

hahahaha - it's already added to everyone's password list. Would be fun to get some stats on how many password audits come up with it over th next year

Jeff Ferland

@RoryAlsop I'm just afraid of blogging about them every week. We'd never stop.

Rory Alsop

@JeffFerland I know. I good summary every once in a while could be good though. If @Graham's one wraps up a chunk of password ideas to date, then we can concentrate on other topics for a while

Graham Lee

that's the plan. Also such a blog post would probably have a long tail of visitors

Rory Alsop

10:38

and if you can hook it into the xkcd spike...all good

Graham Lee

10:50

I'm really all about the SEO ;)

Graham Lee

11:02

So how many more low-value posts about ProteMac NetMine before it's actually a spam campaign?

security.stackexchange.com/questions/1920/…

Rory Alsop

11:58

@GrahamLee it already counts as spam in my book - I'm very intolerant:-)

Stack Exchange

Stack Exchange Security Blog: Some More BSidesLV and DEFCON

posted on August 23, 2011 by Jeff Ferland

Internet connectivity issues kept me from being timely in updating, and a need for sleep upon my return led me to soak up all of the rest of BSides and DEFCON. That means just a few talks are going to be brought up. First, there’s Moxie Marlinspike‘s talk about SSL. In my last post, I had [...]

Scott Pack

12:35

Morning Gents

Graham Lee

Afternoon @ScottPack

Scott Pack

Have the marauding bandits calmed down yet?

Iszi

12:49

Mornin' y'allz.

Okay, can someone tell me WTF? How this doesn't make anyone more secure?

2

A: Who is responsible for a user's password's strength?

It seems to me that there's two separate issues that need to be covered in the question. Users choosing weak passwords. The responsibility for this piece can be conceivably split three ways: The Management and IT Security offices within the organization need to define appropriate policies for...

M'vy

Happy diurnal isomorphism

2

Rory Alsop

@ScottPack what @Mvy said, but with a Scottish accent

M'vy

XD

Graham Lee

@RoryAlsop Sean Connery or Rab C Nesbitt?

Rory Alsop

Shurely only Sean

Scott Pack

13:05

There are other Scotsmen?

Graham Lee

yes, they're all called Rory

Iszi

13:20

Does anyone know a good product which is equivalent to Secunia PSI (or, better, CSI) but is "free for non-profit"?

Rory Alsop

@GrahamLee Just the security ones:-) The others are called Hamish

@Iszi You answered the question, which wasn't around how someone should be more secure, it was around responsibility. I think that individual sort of missed the point of the question

I personally thought your answer had more value in it than mine, which was quite a glib summary (I was busy and harassed so didn't put a huge amount into it)

Iszi

@RoryAlsop That's probably it. But, I still don't think the statement's accurate - the responsibilities I proposed, when properly executed, should still make the organization more secure. And, I see "that individual" seems to have removed his answer?

Scott Pack

@Iszi Did you get a twat from me yesterday? I tried to do it via sms, but I'm thinking I screwed it up.

Rory Alsop

There are some folks who do seem to carry out tit for tat downvotes. Timing on your comment on his, and then his downvote of yours is interesting. Where he is concerned I wouldn't dwell on it

@ScottPack does that mean the same in Ameringlish as in 'proper' English?

Iszi

@ScottPack I got something from you yesterday, but I don't think it's the one you're referring to. Checking now.

Oh, right. Thought I'd answered that.

Scott Pack

13:29

@RoryAlsop I think probably so :)

Rory Alsop

hahahaha - that's fine then

Scott Pack

@Iszi I can't seem to figure out the web interface well enough to see if I had sent it. Phaw.

Graham Lee

@RoryAlsop @Iszi I would say if it does seem to be a repeated campaign then flag it. I imagine the automated abuse detector needs a lot of data before it kicks in.

Scott Pack

I wonder if there's a British version of urbandictionary. That would be pretty neato.

imperialtionary?

Iszi

@GrahamLee We can flag comments, not down-votes. :-(

Graham Lee

13:32

@Iszi flag in the general sense of "inform mods"

Iszi

@ScottPack +1 but we'd need an Aussie one to go with it as well.

Graham Lee

I hope we don't end up with slashdot-style metamoderation, though.

Rory Alsop

@GrahamLee It's one of the 'usual suspects' who responds in an interesting way to negative comments - but who also has some good answers, so the automatic detector probably won't pick it up. It isn't consistently sustained.

Graham Lee

that's why mod involvement might be needed

Rory Alsop

yep - think we should keep an eye, and see how it goes - he has had various warnings in the past

If I get time later on I'll pose the question on Teachers

Graham Lee

13:36

anyway, back later - another interview. Then I'm off to DC4420 - I'll try and draft that blog post on the way (or on the way back after I've had some beers)

Rory Alsop

Have a good time at 4420. Feel free to provide summary of the cool stuff

Iszi

@RoryAlsop That's the really odd part - it not being "consistently sustained". Every time he comes back I find myself wondering "weren't we just rid of him"?

@Iszi Would this question (see pointer) be good for any of the SE sites, or would it get shot down for "shopping recommendation"?

Rory Alsop

Hmmm - thinking it is a bit 'shopping' as it stands. However, why not try asking "Is there any way to do x, y and z (where x, y and z are key attributes you need in a Secunia alternative) with free software"

that sounds more like an answerable question which isn't just shopping

what do you think

am I just stretching with that one

Iszi

13:51

@RoryAlsop It sounds like that question probably would find an acceptable answer, but it still sounds "shopping"-ish.

M'vy

which ?

Scott Pack

@RoryAlsop Regarding the previously inquired upon word. Do you use it to mean the same as 'twit', i.e., a fool?

Rory Alsop

14:12

erm, no - quite a bit less SFW than that

Iszi

@ScottPack Dunno about the other side of the pond, or other parts of the U.S., but that's definitely not what it means down here.

@RoryAlsop Yeah, that sounds right.

Scott Pack

14:26

Oh good. I think we're all on the same page, then. :)

Iszi

14:37

Isn't this just what every IT Security guy would like to overhear in the hallway: "Hey, did you get that e-mail?" "I didn't recognize the e-mail address, so I deleted it."

Rory Alsop

Yay - it's working ;-P

Scott Pack

Well, it said IRS, so I figured it was important enough to follow up on.

That's what took my respect for the CISSP below the red line.

Rory Alsop

@ScottPack that's a popular meme this Autumn. I'm not going to renew this year

Scott Pack

Respect was later made unsalvageable due to an incident on this very site.

Iszi

@ScottPack Oooh, which?

Scott Pack

14:41

I try to make it a point to not finger (giggity) users explicitly. It shouldn't be too difficult to find, though.

Rory Alsop

Hoping it wasn't something I said (blamerory meme)

Scott Pack

@RoryAlsop Oh no, nothing at all to do with you. Just a user that clearly had no experience and no freaking clue about the industry, working on (and then receiving) his CISSP.

Rory Alsop

14:56

ahh - yes

I think it has value in a specific area - relatively junior security practitioner needing to get their CV past initial HR filtering

Iszi

Oh, @ScottPack - Interesting coinkydink: I'm supposed to be off work next Friday.

Rory Alsop

but not much else, sadly - think it has turned into a revenue stream for ISC2

Scott Pack

@Iszi Excellent!

The real unfortunate part, is that you're supposed to have, at minimum, 3 years in the field.

Rory Alsop

If you compare to the value ISACA provide to members (which is huge in terms of documentation, standards, events yada yada) then ISC2 doesn't come close

Scott Pack

That's assuming a prior cert and an applicable degree.

Iszi

14:59

@ScottPack I've got prior certs. Still don't qualify. :-(

Scott Pack

@Iszi With my schooling, I think I do now.

It's really close, so I would have to check the maths.

Rory Alsop

but the problem is that that minimum doesn't help stop people qualifying for the CISSP but who really aren't capable in the security field

which is why I treat it as almost that entry level - like a CEH (although with a different focus)

When hiring, I would accept a CISSP for a junior, entry level recruit, but it wouldn't convince me I should take them on as an experienced hire

Scott Pack

How do you feel about GIACs?

Rory Alsop

Most of the SANS certs actually seem to be of high value. If I saw someone with a GIAC Gold in something I would assume they were a leader in that field

GIAC on a CV puts you much higher up my hiring list

Scott Pack

15:15

That's good to hear.

I'm actually excited, we're pretty far down the path of getting a SANS FlexPass

While not cert granting, at least I'll be able to get some good training.

Rory Alsop

To pass most of them you actually need to be a practitioner with in depth experience, whereas CISSP can easily be bootcamped

Graham Lee

15:34

So, I've been looking for jobs recently, don't have a cert, do have a reputation. Not been a problem.

Scott Pack

That makes sense to me.

Graham Lee

In other news, about to start on that post. I'll draft locally because I'm on $crappynet, and upload to blogoverflow when I get a chance

Scott Pack

Certs are basically a poor man's reputation.

If you don't have one of your own, then you're trading on the rep of the granting agency.

Graham Lee

spot on

or, more accurately, you're trading on the mean reputation of all the other grantees

Scott Pack

I know. That's why I said it.

Too shay.

Rory Alsop

15:39

@GrahamLee reputation counts for so much more - once you have it. I do see the point in the certs for folks who are newer, or not well known in a particular industry or space.

And high value certs are still a plus for experienced folks eg the GIAC Gold, or CREST

Also things like full Membership of the IISP - as to get it you have to have extensive experience and be able to demonstrate your knowledge and experience in a grilling interview

:-)

Scott Pack

/me sighs

Graham Lee

stupid website thinks there are no locations within 10,000 miles of Oxford

Scott Pack

Double click on the Windows RSoT installer, and the drive grinds so much I think it will fall out.

Incognito

16:06

This might sound dumb, but, if I want to set up an SSH key, I need to generate that on the server-side, I can't do that from my client, can i?

I have login/password from a client-side, I'd like to use a key instead. Keys need to be generated on the server, or am I missing something here?

Iszi

@ScottPack Sent you a couple DMs on Twitter.

Hey, would a question along the lines of "Help me ID this vulnerability" be on-topic?

As in, I have Vulnerability Scanner x reporting a vulnerability with Name a, Descrption b, and proprietary ID # c. Can anyone give me more details?

'Cause Name, Description, and ID are really friggin vague in this particular case.

Graham Lee

16:40

@RoryAlsop and anyone else who cares: my post is now pending review at blogoverflow

aking1012

17:04

@ScottPack @GrahamLee - I can respect most of what you guys said yesterday regarding my particular issue. I think it's best if I just keep to myself. Scott - No problem on sounding douchey at that one point when you said something like "At the risk of sounding douchey". I have absolutely no problem with that. At least you put a horribly fine point on your statement.

@ScottPack @GrahamLee - Graham - Valid on most of your points. I just think there should DEFINITELY be an appropriate place to put that type of question...and it is currently lacking if my question is out of bounds IMHO. And good at your blogoverflow post thing.

this.josh

17:21

@Incognito You can generate the key anywhere but it needs to get installed onto the server. If you generate the key on the client it is preferable to transfer the key to the server in the most secure manner possible. In decending order: transfer physically using removable media, on a closed network, and a high security network, VPN, and lastly on an encrypted internet connection.

Thomas Pornin

@Incognito Warning: there are several keys

the server must have one, called "the server key"

to replace a password-based login, you need a "client key"

which you use on the client

this.josh

Oh good Thomas is here.

2

Thomas Pornin

so that key is best generated on the client

try ssh-keygen

this.josh

This doesn't seem correct: "AES-GCM or CCM will tell you if the encrypted data was tampered with." Counters only tell you about the order not the integrity.

aking1012

@Incognito - there are a bunch of ways to do that...my favorite is a custom service that uses AES-192 with a known key to transfer the key from serverside to clientside. then use ssh.

Thomas Pornin

17:23

once the client key is generated, you still have to store on the server the public part

typically in .ssh/authorized_keys

so that the server accepts the key as authenticating you

@thisjosh GCM and CCM are encryption modes which include a keyed integrity check (a MAC)

aking1012

@ThomasPornin - yes. you can do new device enrollment a couple of ways that are reasonably secure. checkpoint has this figured out. take a look at their implementation

this.josh

Oh wow, so every block has a integrity check? Holy computational overdrive!

aking1012

lulz

Thomas Pornin

@thisjosh No, not every block. Only the whole message.

this.josh

If you have one corrupt block (i.e. due to channel noise) does the integrity check fail?

aking1012

17:29

@this.josh - I would think an individual pack CRC would catch that.

Thomas Pornin

@thisjosh That's the point of integrity checks

aking1012

pack == packet

Thomas Pornin

I am not sure we are using the term "block" with the same meaning

Scott Pack

@Iszi I'll have to get back to you on your question. I'm dealing with a toddler, though.

aking1012

okay i'll just stop

Thomas Pornin

17:31

GCM and CCM are encryption modes: they use a block cipher such as AES, and turn it into a way to encrypt a message (a sequence of bytes of arbitrary length)

this.josh

Ok if I have a message M and I am using a block cipher that processes n bytes at a time I think of n as the block size

Thomas Pornin

@thisjosh It is not a fully practical definition

For the encryption part, GCM internally relies on counter mode (CTR), in which the AES is used only to encrypt successive values of a counter

this generates a key-dependent stream, which is combined with the data by bitwise XOR

so you can say that you encrypt the data one bit at a time

aking1012

have something to say if you want to hear it...say so or don't

Thomas Pornin

or maybe you want to say that blocks are 128-bits because the AES primitive works on 128-bit values

so is the block length 1 or 128 ?

or maybe longer ?

because GCM, for a n-bit message, will produce something a bit longer

say n+128

(or so)

this.josh

yes the remainder of the 128 bits that requires padding out to the proper length

Thomas Pornin

17:34

@thisjosh and no... that's the trick

with CTR there is no padding

the extra length is to fit the MAC

Iszi

@ScottPack Ok. I just today realized exactly how quickly this is coming up.

Scott Pack

Surprise!

this.josh

If a message encrypted in a counter mode has some bits of the encrypted message are corrupted in transit, will a counter mode be able to decrypt bits after the corrupted bits?

Iszi

@Iszi Anyone want to help me out with this?

Scott Pack

@Iszi I thought you already asked that question?

Iszi

17:40

@ScottPack Erm, sort of I guess. I'd asked it in a more general "where can I get a CVE ID for CVE_MAP_NOMATCH" vulnerabilities. It wasn't a specific "help me ID this vulnerability [insert available details]".

Thomas Pornin

@thisjosh counter mode is just XOR with a key-dependent stream

it is very resilient to corruption: if you flip a bit in the encrypted message, this "just" flips the corresponding bit in the decrypted data

this is good for resistance to noise, bad for resistance to attacks (the attacker can "flip" bits at will)

Scott Pack

@Iszi I would call it on topic, although you may find that finding a General answer is difficult.

Thomas Pornin

encryption on cell phones uses the same kind of XOR with a key-dependent stream

for the same reasons

Iszi

@ScottPack That's exactly it - I'm not looking for the general answer this time. Looking for a specific item.

Scott Pack

@Iszi The problem there might be localization :) Worth a shot, though.

What's the worst that could happen? It'll get closed.

this.josh

17:47

@Thomas In a chaining mode all bits after the corrupted bits do not decrypt correctly?

Thomas Pornin

@thisjosh that's not what chaining modes are meant for

Incognito

@thisjosh This is what I thought. I keep trying to use ssh-copy-id to accomplish this, but the SSH server has disabled all subsystems exept FTP. =/

Thomas Pornin

with CBC, if you flip one bit in the encrypted stream, this typically garbles the 128-bit block in which the flip occurs, and flips one bit in the next block

with CFB, one flipped bit may change a lot of things in the subsequent data

it really depends on the chaining mode

propagation of errors is not considered to be a security feature

mainly because a mode which propagates errors is also a mode which is not amenable to parallelism

this.josh

Thanks for explaining that.

Incognito

The other end isn't answering my emails asking to set up the key-exchange, so I figured I must be missing something profoundly stupid... then I get an email when I get back from lunch, "I'm not an expert when it comes to keys and stuff \\ Is't it an encryption key or a public key? \\ Sorry for being stupid "

this.josh

17:55

I suspected that the server wasn't one you had control or authority over.

Thomas Pornin

@Incognito An additional complication is that for key-based client authentication to work, the server must be configured to accept that

RSAAuthentication yes
PubkeyAuthentication yes

in /etc/ssh/sshd_config

this might not be the default setting, and if the sysadmin on the server does not understand anything about ssh, you might have a hard time having him configure the server properly

this.josh

If you don't have control or authority over the server, making your ssh sessions more secure may not increase your security. If the administrator doesn't make the whole system more secure you are still vulnerable to the weakest link in the system.

Incognito

@ThomasPornin Does the SSH respond with that information when I attempt to connect? Remember, only the ftp subsystem is enabled.

this.josh

And if ftp is enabled you can be sure the system is vulnerable.

Incognito

@thisjosh No, but I can't automate SFTP uploads with bash, as the commands now require keys for scripting purposes.

Well, I can, thanks to some hackery out of NIST, but I shouldn't. And my password is a very low entropy.

@thisjosh It's SFTP, and some HTTP via apache. The software's called tumbleweed on their end, which is now re-branded: axway.com

this.josh

18:02

Oh ok, when people say ftp I assume ftp and not sftp.

Incognito

@thisjosh It's the FTP subsystem of SSH that I'm referring to.

Scott Pack

Hey Cool. Earthquake.

Thomas Pornin

@Incognito Yes, at some point.

Generate yourself a private key (client key)

then try to connect with sftp -v

in the debug messages, you will see this if the server potentially accepts client public keys:

debug1: Authentications that can continue: publickey,password

if not, you will see this:

debug1: Authentications that can continue: password

Incognito

debug1: Authentications that can continue: password,publickey,keyboard-interactive Okay, so that's a start.

Thomas Pornin

So you "just" have to find a way to store your public key at the appropriate place on the server.

Incognito

18:08

Problem: it's locked down really tight, if the file name isn't "Foo-n-n-n-n.txt" upload's rejected.

Thomas Pornin

that's a problem, indeed

Incognito

And I only have, what I suppose, is a ~/ folder.

Thomas Pornin

if the server is similar to OpenSSH, then it looks for client public keys in ~/.ssh/authorized_keys

(you just copy your .pub file into that name)

Incognito

Upload fails, rename fails.

Thomas Pornin

so you would have to create a .ssh/ subdirectory, then upload the file into it

also OpenSSH tends to be picky about the access rights on the .ssh/ subdirectory

he wants to enforce 0700 rights, not accepting the more usual 0755

Alternatively, you could patch the sftp client to read the password from a local file, instead of asking you to type it every time

Incognito

18:14

sftp> df
Server does not support [email protected] extension
sftp> mkdir test
Couldn't create directory: Permission denied
sftp> rmdir 1271872804770
Couldn't remove directory: Permission denied
sftp> ~~~
Invalid command.
sftp> rename 1271872804770 test
Couldn't rename file "/1271872804770" to "/test": Permission denied
sftp> version
SFTP protocol version 3
sftp> !ls

Iszi

@ScottPack Y'know... I think I'm gonna just ask the vendor of the vulnerability scanning software. Unfortunately, with our organizational structure, there's another person to go through first.

Scott Pack

@Iszi yay :/

Iszi

If we don't get anywhere there, I'm guessing it's more than likely that nobody here can help either.

@ScottPack They're friendly enough. It's just that "extra step" bit that's generally annoying.

Scott Pack

Typically, I go through somebody else to talk to our VA vendor as well, though I have an account on the support site.

Thomas Pornin

"man ssh" indicates an interesting feature with SSH_ASKPASS

Incognito

18:19

@ThomasPornin I've found something from NIST that scripts password inputs, despite ssh authors trying hard to make that a key-only thing.

Thomas Pornin

if the ssh (or sftp) client is executed without a controlling terminal, but needs a passphrase, and both DISPLAY and SSH_ASKPASS are defined, then the command whose name is in the SSH_ASKPASS variable is executed, and should provide the passphrase

@Incognito expect ?

Incognito

@ThomasPornin That's the one.

Thomas Pornin

"expect" is the traditional answer to everything terminal-related

it predates SSH

(by the way, it is not from NIST; but NIST describes how to use it)

(expect was written by Don Libes who now works at NIST)

Incognito

@ThomasPornin Interesting... When I hit nist.gov/el/msid/expect.cfm that's how it looked to me, but now I see the SF page links to the real author.

Iszi

18:50

This one seem dupe-ish to anyone else?

0

Q: IT Security Learning Path

I am a software developer. Currently I am interested in IT security, but I have difficulties about learning pathways to IT security. Is there a learning path for IT security such as for example the path to learn the Java programming language that existed at this link: http://download.oracle.com...

Incognito

@Iszi I'd say it's too vague/open-ended.

IT Security's a fairly wide domain.

Wide enough we have a SE site for it.

Any reply would really just be, "hack all night, get certified by day"

Maybe I'm being too quick to judge, however.

Scott Pack

I thought we've seen a few questions like that.

Iszi

Off-topic, I have an odd coincidence of a tinnitus flare-up with a craving for caffeine and loud music. This does not bode well.

Incognito

Coffee and loud music is basically a way of life for me.

I've started a chat for music on SO's chat, "sound of source code"

Scott Pack

We ran the pot dry at 9am, and I have a notion to only make one per day

Iszi

18:55

I don't do coffee too often. My caffeine comes in the form of what I affectionately call "Gummi Berry Juice".

Scott Pack

I drank one of those at Origins.

Wow did that feel....weird

Iszi

I usually keep 2-4 of those in one of my jacket pockets. Normally run through those in one or two weeks, but some days are worse than others.

Scott Pack

Has your body built up an immunity to the niacin yet?

Iszi

Maybe. I used to be really hard-core with energy drinks like Full Throttle and Rockstar.

Typically would run through two or three big cans of those per day.

And that was some time after I'd gotten over my two-liters-or-more-per-night addiction to Mt. Dew Code Red.

So, if I'm only doing 2-4 5-hour Energy shots per 1-2 weeks, I think I'm in good shape.

Scott Pack

Sounds a bit better on the kidneys, yeah.

Iszi

19:10

It's supplemented though by a Frappuccino every weekday morning.

Definitely need that jump-start when I've got a 1 hr. drive to work.

Scott Pack

Hey, did you know that there's some coffee flavou?ing buried within all that sugar/

Iszi

Yeah. Beats waiting for the coffee to brew though. And, it's much easier to chug down as I rush out the door.

Went through the coffee addiction phase already too, only much earlier.

When I was in high school, one of my work locations was within a short walking distance of a coffee shop. Would usually go through 2-3 big cups o' coffee per shift.

I'm really trying to limit my beverages to water and alcohol these days, with only an occasional soda. Plus the aforementioned incidental energy supplies.

Scott Pack

I try to remember to set up the pot before I leave in the evening. Otherwise, it only takes about 10 minutes to brew, so it's not too bad. The worst part is getting water. The way this building is carved up there is no good way to get to a sink.

Iszi

@ScottPack See, in that 10 minutes I'm almost ready to bolt out the door.

Scott Pack

Oh, I see the confusion. I make coffee at the office. Not at home.

Iszi

19:18

@ScottPack Ah, right.

My aversion to coffee in the workplace mainly revolves around having an open-top (or easily-opened-top) beverage in my work area. Sure, it's just me in this cubicle but then again, it is me in this cubicle.

Ninefingers

19:39

I much prefer tea, being properly British and all that.

Ninefingers

19:54

@Iszi I voted to close on the question you link to, simply because I think its too wide to answer.

Iszi

20:12

@Ninefingers Sorry, which?

Oh, that one.

Ninefingers

@Iszi @Avid has now closed it anyway

Scott Pack

@Ninefingers I was primarily drinking tea for quite a while, but then we hired a new guy who is also a coffee drinker.

I haven't used my kettle in probably a year or more.

Ninefingers

20:29

@ScottPack I just prefer tea really... I like a coffee every now and then, but given a choice it'd usually be tea.

Graham Lee

evening

@Ninefingers nice job on the QotW post :)

Scott Pack

21:02

Right then. Got that all ready. Coffee will be waiting for me when I arrive. 2011 is awesome.

this.josh

21:18

@Ninefingers Are there people who are unproperly Brittish?

Graham Lee

@thisjosh of course, look for people with malleable upper lips

this.josh

Ah found it.

My favorite energy drink brand, no longer available.

Actually available but not with my prefered graphics

Iszi

@thisjosh Wow. I don't care if it actually tastes like "whoop-ass". I wanna try it!

this.josh

Note the letters USA on the character's nuckles

Ninefingers

@GrahamLee Thanks. I used to blog a bit on my own blog, but I'm still looking for a blogging engine I like that isn't wordpress before I start again.

Graham Lee

21:32

@Ninefingers those don't exist. No-one likes any blog engines.

Rory Alsop

@GrahamLee heh - malleable:-)

evenin' all

Ninefingers

@GrahamLee I live in hope... I started writing one on django but like all such part time projects there are more important things to do. I might try moveable type.

Graham Lee

@RoryAlsop sounds almost exactly like "fuck"

seen my draft post?

Rory Alsop

hahahaha - oh, the memories. Haven't seen that in ages

just opening up the post now

looks good - did you write it on the way to or from dc4420?

Graham Lee

to

hence making sense

to be fair I'm more tired than wasted right now

Rory Alsop

21:41

@GrahamLee - schedule options - can pop it in for 18th Oct in the regular schedule. Gets it in place automagically. Sound good.

@GrahamLee good event then?

Graham Lee

sounds good to me

well, good from a networking perspective. The talks...one was some good demos of circumventing Windows policy, the rest were deacon circlejerks

Rory Alsop

@GrahamLee done - and if another password question comes up, you can always edit it in if necessary

Graham Lee

sure

Rory Alsop

@GrahamLee On a roll with the catchphrases tonight - deacon circlejerks...nice :-)

Graham Lee

that was meant to be Defcon circle jerks, though actually I'll leave it as is

Rory Alsop

21:44

that's what I assumed you meant, but it is funnier this way

Graham Lee

damn, it's got to the point where an autocorrecting keyboard is funnier than me

/me gives up drinking

Rory Alsop

hahahahaha

this.josh

22:37

Some days you think about banging your head against the wall three times.

Seems like this needs to include information about the event in the question:

4

Q: Sony Attacks, what would you do?

If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?

incident-response

And more generally how do we keep aging posts relevent?

What the @&^# we have no integrity tag!

this.josh

23:06

Yes, work sucks today.

Scott Pack

23:52

@thisjosh We're, by and large, information security professionals. How on earth would an integrity tag be on-topic?

Transcript for