The DMZ

Stack Exchange

05:12

'Nuh-uh! We let users vote on comments and display them by number of votes. Everyone knows that makes it impossible for a few persistent voices to dominate the discussion.'

Karrax

07:51

Saw a funny question on Reddit the other day. "Why does law enforcement always take with the monitor when they are seizing computer equipment?"

I don't know if it is like that in real life, but in movies I've seen it happend

Rory Alsop

09:06

@Karrax When I have been seizing evidence as first responder to an incident I have never taken the monitor, although if it is on, a photograph of the screen is part of the procedure.

M'vy

09:20

@RoryAlsop or you can take it and photograph it afterwards :P

Karrax

09:38

@RoryAlsop Haha ok.. Nice to know.

You guys haven't received free swag yet have you? It sais in the mail 6-8 weeks time to deliver. I was getting worried when it haven't arrived yet :) It's been only 4 weeks tho

I thought I remember someone talking about their free swag

Nevermind. I just saw an update from Jin that the prints aren't ready yet

AviD

12:00

@nealmcb re captcha - just saw this: nytimes.com/interactive/2012/02/05/opinion/sunday/…

we need security questions like that on this site too!

Hmm, that actually brings up an interesting point - other than the occasional SEI community/chaos team member, this place is completely male.

Some form of party involving frankfurters, as it were.

2

and the site itself only has a small handful of high-rep female users (well, at least as far as we know)

'Course, I'm not counting @Iszi in all this.... ;)

Rory Alsop

@AviD lol

Jeff Ferland

12:40

"To prove you are a human, demonstrate that you are capable of love in the box below:

Sorry. That was infatuation, at best."

AviD

@JeffFerland hmm, maybe we can get that as our CAPTCHA page...?

Iszi

13:26

@AviD C'mon... @ScottPack validated me months ago!

Jeff Ferland

@Iszi That sounds... uh... good for you two!

AviD

@JeffFerland ewww, cmon

@Iszi true, true... thats why I'm not counting you.

besides, as my second-cousin's neighbor's uncle used to day: once a punchline, always a punchline

and while we're on the topic of non-sequiturs - any you blokes have experience with any NoSQL?

Jeff Ferland

13:42

@AviD Yes

AviD

14:04

@JeffFerland oo, really?

specifically looking at cassandra, though possible to switch to others

actually after some google strolling, I'm starting to turn up a little bit of info

i guess a q for the rest wouldnt be wrong.

Jeff Ferland

@AviD Speak your mind, sir.

AviD

but do you happen to have some kind of hardening doc / guidelines / etc?

@JeffFerland not yet sure what my mind is. trying to figure out what we need for it

not really much security stuff for nosqls out there...

even we only have a single q so far

Jeff Ferland

@AviD I have to say, usually one switches the order :)

Restrict to systems that need it, use auth, layer with SSL if performance allows (and connections persist... renegotiating the asymetric part is bad!), and watch your input if building queries.

AviD

@JeffFerland heh. of course.

Jeff Ferland

:)

AviD

14:09

what I meant was, my client is going to be using it as part of his system, and I don't yet know enough about it to have the specific recommendations.

learning, though....

Jeff Ferland

Ahhhh

AviD

@JeffFerland so as it turns out, not all of them support auth - N or Z

Jeff Ferland

@AviD Yeah, there's a lot of performance focus with NoSQL systems, which gives up a lot of control. Not that Memcache is a database, but some play like that... no auth, no logging. If you can send a packet and know a key, you can get an answer.

AviD

SSL - is internal (i.e. gossip intra-node) important to have over SSL (if that part of the network is restricted)?

any specific input (heh) on input validation for nosql?

@JeffFerland right. So, what is done? what CAN be done?

Jeff Ferland

@AviD Depends on architecture and goals. Not necessary, but defense in depth and such.

AviD

14:12

Cassandra had a minimal plugin for authN/Z, but it turns out its a low-security sample only.

it is pluggable, though - so I may just have to tell them to tailor a plugin for it.

@JeffFerland any other specific, non-generic advice?

so far you havent said anything I dont know :)

Jeff Ferland

@AviD Well, you could do mutual machine auth through stunnel or write a proxy app (or plugin) to handle auth and pass queries on

AviD

though validating my perspective surely helps too

@JeffFerland urggh, thats even worse. and probably would kill the performance

Jeff Ferland

@AviD Maybe, maybe not. Symmetric crypto is fast, so as long as you're not renegotiating your connections, you should get plenty of throughput.

AviD

I meant a proxy app

but as I mentioned, Cassandra at least supports a plugin architecture for AuthN/Z

Jeff Ferland

If it's financially worth it, the best thing would be to write that plugin.

I think that's an unlikely case.

Just from instinct, anyway.

AviD

14:17

@JeffFerland really? thinking authz should be handled by the app / perimeter?

Jeff Ferland

@AviD Edit for clarity / expand? Interpreted your question in a few ways.

AviD

@JeffFerland you said you think its unlikely that its worth writing an auth plugin. what would be a better solution for auth (N/Z) ?

Jeff Ferland

@AviD I just mean in terms of financial cost / hours to develop. It's the best method, but I don't think it's the cheapest. Everybody's cost-sensitive and all that.

AviD

@JeffFerland okay, but what other option would you suggest?

I dont think the proxy app would be less expensive, especially if you want to tune for performance.

Jeff Ferland

@AviD If it does fit into the system architecture, app / perimiter auth and restricting access to db to server instances would be an easy pattern.

AviD

14:23

ah, right - basically going back to restricting the network.

Jeff Ferland

@AviD Yup. That's the cheap one.

AviD

but, what if (and this is my scenario) we need internal segregation?

e.g. 2 users can access the db, but with different access?

Jeff Ferland

Generally, there is no RBAC / object level security. So if you're talking different keyspaces (tables in SQL land), then yes. Otherwise, creek + paddle.

Good crash course slide set: slideshare.net/Dataversity/wed-1200-penchikalasrini2color

AviD

@JeffFerland right, thats pretty much the impression I got. And, the only way to implement that, would be some form of plugin.

Right back where I started :)

Jeff Ferland

@AviD Thanks for taking the ride with me? :)

AviD

14:30

@JeffFerland heh. In any event, having my impressions validated by your experience is definitely helpful :)

Scott Pack

@RoryAlsop Same here. And when it has been the police bringing evidence to us for examination, they've never brought the monitor, though I don't know if it was seized.

@Iszi To be fair, I allowed for the possibility that you hired an actor.

AviD

probably will need to pop up a q for some of the details later, but good to know there is someone that could answer

besides, you should at least get the rep for that :)

@ScottPack ah, the equivalent of a CAPTCHA proxy :D

@JeffFerland what about storage encryption?

all I could find is comms encryption

Rory Alsop

for info:

4

Q: Can I encrypt data in a way that it can't be copied or edited?

I want to share my 500 GB hard drive with a friend but I want to encrypt it in a way that all data can be read normally but cannot be copied or edited in any way. Is that possible?

have flagged for migration here - if we get it, was planning on merging with our existing one:

13

Q: Are there DRM techniques to effectively prevent pirating?

Note: I was forwarded here from Skeptics.SE by AviD. I simply copied the entire body of the question but acknowledge that it may need some tweaking to fit properly with this site. Any edits or comments to that effect are welcome. Neal's Note: I've edited it to distinguish it from that question. ...

access-control drm

Scott Pack

@AviD Ah, yes, here we go. twitter.com/#!/packscott/status/109697800677244928

@RoryAlsop Sounds pretty reasonable

Jeff Ferland

@AviD Repat the same circle from above. Plugins, layering (encrypt partition with OS), app... trust the machine.

AviD

14:37

@JeffFerland so, nothing built in.

@RoryAlsop I always find it weird when I see my name on posts of which I have zero recollection.

funny when I'm reading a post and want to upvote it, and realize that I wrote it.

5

even funnier when I want to downvote.

Rory Alsop

@AviD hahahaha - I get that occasionally. I blame old age, and a full brain

AviD

@RoryAlsop funny, I blame old age and an empty brain

Jeff Ferland

@AviD You've got it.

AviD

have you seen this q, @Jeff?

9

Q: How to secure a MongoDB instance?

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.

hardening databases mongodb

which nosql have you experienced?

Jeff Ferland

@AviD Yeah, I think I remember that one. Don't see anything I can really add to it.

AviD

14:43

@JeffFerland well, the accepted answer seems very generic, and not really applying to the specific technology

e.g. the two main bullets re authn/z

Jeff Ferland

@AviD Mongo and Cassandra.

AviD

@JeffFerland excellent. In general, you have any comparison notes?

subjectively, of course.

Jeff Ferland

A few quick metrics:

Setup: both are pretty easy, though Mongo is more brain-dead simple.

Arch: Cassandra is pretty much key->value, or "flat hash" storage that does really well at eventually propagating to many machines. Mongo allow hierarchies and has more play with indexing.

AviD

@JeffFerland interesting

Jeff Ferland

General feeling: coin flip unless your architecture in your head already fits one or the other. I like the nested structure of mongo, but I'm also partial to just about every Apache data project (Hadoop and such).

AviD

14:50

@JeffFerland and security feeling?

Jeff Ferland

@AviD Equally minimalist. Either one would take modification to establish the usual practices we'd recommend for app design. They weighted performance more than anything else.

AviD

@JeffFerland thanks

Jeff Ferland

Maybe a nudge to Cassandra for the API exposure.

AviD

question is, should we be changing our "usual practices for app design", for nosql products/philosophy?

Jeff Ferland

@AviD I call it a back-to-basics thing. Risk, exposure, cost, etc. If you're aware and you accept the risk in trade for performance, then OK. Otherwise, find the more expensive solution whether it be in programming time or slower traditional SQL systems.

AviD

14:54

@JeffFerland heh. fair enough.

Jeff Ferland

I personally think the proxy thing can give very fast performance... can be deployed on every server node with low overhead... auth + log + pass onward while being non-blocking.

AviD

so you're saying, ignore the technical details we've learned, relearned, and can spout in our sleep, regarding securing DB's - go back to principles, and build up the technical details all over.

2

Jeff Ferland

@AviD Yes! Good rephrase.

AviD

great, so we're in agreement.

Jeff Ferland

... and that will be this week's blog contribution from me :)

AviD

14:56

@JeffFerland lol, excellent

well, thanks, I gotta go - but I'll probably come back later with some more heckling :)

Rory Alsop

@JeffFerland sounds good to me - just copy and paste all those sentences into a blog post.... :-)

AviD

17:33

@JeffFerland the problem with that attitude, while great - and correct - is that implemenation details matter. and, coming to a new product/technology, I'm not familiar with the internals.

for example, Hadoop offers really good granularity of access control, similar to most file systems (its based largely on POSIX).
However, when you drill down to some of the internals, it turns out that the access control is enforced *only* on the NameNode, and **not** on the DataNode.

(the NameNode is similar in concept to a DNS server, it tells you where some block of data is stored.)

(hmm, not so different from what SOPA wanted to do :D )

Scott Pack

18:08

@JeffFerland Your vacation picture looks like you're doing something...potentially inappropriate to the rock.

Jeff Ferland

@ScottPack advrider.com/forums/showpost.php?p=18031000&postcount=26316

That photo seems to be a litmus test for snark.

Scott Pack

You mean, to test whether or not someone is snarky?

Jeff Ferland

@AviD Well, yes, the details do matter... and normally I'd just respond with "these are the details." Unfortunately, there are no details to explain. They just lack security controls.

@ScottPack Yes, sort of like a drug test for drugs... only for snarkiness. You win!

Scott Pack

@JeffFerland I'm not entirely sure how I feel about that.

Jeff Ferland

But yeah, I'm expecting to hear a lot of jokes about that rock.

Scott Pack

18:12

I am, however, fairly sure how you feel about that rock.

Jeff Ferland

Like that one

Scott Pack

:)

Rory Alsop

19:01

@JeffFerland Happy to be home! :-)

very - very happy

Jeff Ferland

I'm so cropping that photo

Rory Alsop

Is that body armour/cycling armour?

Jeff Ferland

@RoryAlsop Offroad motorcycle armor

Rory Alsop

ahhh - Quite liking that. I wear various bits of motorbike armour in black and orange for my stage gear, but always on the lookout for cool apparel

Jeff Ferland

@RoryAlsop motorcycle-superstore.com/2/6/10/15869/ITEM/…

Rory Alsop

19:03

excellent - cheers

AviD

@JeffFerland well, I dont mean just details of the security features, I mean internal implementation details, as in how the actual technology works.

such as the NameNode for lookup / data access via DataNodes (for Hadoop)

and, in other news, I have a new favorite site

quickmeme.com

Rory Alsop

19:41

@AviD I read one page

:-)

AviD

painful, isnt it

but handy to have when you need it

@RoryAlsop this one more your type?

3

Iszi

@AviD I think the same applies to TVTropes, and perhaps Wiki.

Scott Pack

19:58

@AviD Doesn't that make you unclean, or something?

Rory Alsop

@AviD mmmmmmmmmmmmmmmmmmmmmmmmmmmm

Scott Pack

/me hasn't had some good floppy bacon for quite a while

Rory Alsop

20:14

microwaved bacon - guaranteed not to be stolen by SWMBO

Scott Pack

@RoryAlsop I did say "good". I mean, don't get me wrong, it's bacon, and I will cook with it. I just won't really enjoy eating it by itself.

Rory Alsop

hahaha

AviD

20:33

@ScottPack only from the grease

or so I've heard... :(

Scott Pack

When I was a kid we would often use bacon grease as the fat for making biscuits. Mmmm

AviD

ooo

isnt that the secret of good cooking? Use bacon grease for everything.

Scott Pack

Not necessarily. Sometimes the flavou?rs don't work so well.

AviD

really? Me an' Joey would disagree.

Scott Pack

Joey?

AviD

20:36

English Trifle

@ScottPack Tribbiani

... Friends?

Scott Pack

Right, Friends I know. I just don't remember him saying that

AviD

"Custard - good. Cream? Good! Meat? goooood."

Scott Pack

I do remember him saying that beer and cereal, not so good.

AviD

not specifically, but he has no problem combining meat flavors with anything else

@ScottPack heh

Scott Pack

Whilst flipping after dinner one night I found some Friends a few weeks ago. I was the only one in the house who wanted to watch it. :(

AviD

20:49

so, I've noticed that while we have a very cool room name, our tagline is kinda, well, dull.

Scott Pack

So it's properly descriptive

AviD

as the room owner, @ScottPack, I hereby request that you change it to something witty or snarky.

for that matter, do we want to consider rotating the room name, too?

Scott Pack

room topic changed to The DMZ: The first breach costs you an arm.... [food] [libations] [security] [xxx]

AviD

not saying we should, just suggesting... I propose`High Entropy`

@ScottPack heh, nice

Scott Pack

Changing room names can be a little wonky

Makes it hard for people to find us

AviD

20:51

@ScottPack obfuscation is the first line of offense

Scott Pack

mm

Rory Alsop

21:12

surely obfuscation is mmmff glmphhh numbly rfrmmmmp

Scott Pack

@RoryAlsop I refuse to be amused by seeing what you did there.

AviD

@ScottPack I refuse too. @RoryAlsop, stop coercing me.

2

Occupy @RoryStreet!

Obfuscate Wall Street!

Scott Pack

At least one of those three comments seems pervy. I'll leave discovering which one as an exercise to the reader.

/me goes back to flagellating with rpmbuild

AviD

@ScottPack this one!

Rory Alsop

@ScottPack I'll tell Lord Thrapston Flagellator!

Scott Pack

21:24

@RoryAlsop He's more than welcome to the abuse

Rory Alsop

heh

Jeff Ferland

21:37

@RoryAlsop Are sysadmins on the UK "instant visa to fill a job we don't have enough" list?

Scott Pack

I thought sysadmins were considered blue collar over there?

Rory Alsop

@JeffFerland ooh - I don't know about that. Probably not - there appear to be a lot of redundancies in our major industries - finance and healthcare

AviD

@ScottPack arent they everywhere? ;)

Jeff Ferland

@RoryAlsop Seems like anything in healthcare is on that list... workpermit.com/uk/…

Ah, expired 2010 for that list.. must look elsewhere

Rory Alsop

@JeffFerland yeah, was going to say that list doesn't feel right

health service is in real trouble right now

banking even worse

back in a bit - need beer :-)

Jeff Ferland

21:42

Ah, one can come in as a sysadmin if it is for "jobs in visual effects and 2D / 3D computer animation for film, television or video games" Meh.

Rory Alsop

ah yes - we have a thriving computer gaming industry locally here in Scotland

AviD

23:10

@RoryAlsop why do gamers need sysadmins? they usually just want screaming graphics cards to run the newest games.

Rory Alsop

23:39

@AviD I reckon you're right...dunno

Transcript for