The DMZ - 2012-05-02

« first day (503 days earlier) ← previous day next day → last day (4681 days later) »

Scott Pack

00:06

@Gilles Meh. The 'A' one just gets in the way of the 'C' one.

Gilles

@ScottPack do you think the tag is useless, or is this a comment about your priorities?

Scott Pack

@Gilles In truth, neither. It was more idle sarcasm regarding the pillars.

Bruno

00:35

I can't believe how many people just copy and paste code that disables certificate verification in SSL on SO, just to avoid the warnings. These answers get high scores too.

26

Q: How to handle invalid SSL certificates with Apache HttpClient?

I know, there are many different questions and so many answers about this problem... But I can't understand... I have: ubuntu-9.10-desktop-amd64 + NetBeans6.7.1 installed "as is" from off. rep. I need connecting to some site over the HTTPS. For this I use Apache's HttpClient. From tutorial I re...

java ssl https httpclient

AviD

00:56

@Bruno or blindly accepts any certificate, or even worse, adding any certificate to the trust store.

I may not know much about boats, but that seems upside down.

Bruno

@Avid, I think adding a given cert to the trust store isn't that bad actually, although I prefer to do it to a specific truststore for a given connection, if necessary. The risk is mitigated if you leave host name verification on. It's also quite similar to what a lot of people do when using SSH: remembering the key the first time (assuming it was right) and monitoring for change.

Yannis Rizos

01:42

7

Q: Programmers.SE Contest: The Complete Outline

Wait! Programmers.SE is having a contest!? What have you been living under a rock? Just kidding (maybe). Yes, Programmers is having a contest. And it's going to be awesome! So how will this contest work? The contest will be divided into 4 weeks. For each of the 4 weeks, there will be a tag d...

discussion featured contest

Hello all! You are all invited to our first contest ;) If you have a programming background, we might have an awesome prize with your name on it!

2

Gilles

@YannisRizos copycat! :)

Yannis Rizos

@Gilles Worst, spammer... I've spammed 3 or 4 chat rooms so far, and MSO... Someone should kick me from chat, where are all the mods? ;P

2 hours later…

Stack Exchange

04:04

The only things you HAVE to know are how to make enough of a living to stay alive and how to get your taxes done. All the fun parts of life are optional.

3 hours later…

AviD

06:44

@Bruno you know what they say about assuming.

the problem with that is, the result would be users simply adding the untrusted cert to the store everytime they hit an untrusted cert. which makes the whole authentication thing irrelevant.

AviD

07:00

@YannisRizos can you remind us when it starts....?

Rory Alsop

07:35

morning @AviD

woo - got another of my mini-milestones. 60k across the SE network

AviD

07:58

@RoryAlsop wow, you've been busy

or rather, you havent been busy, so you've been here ;)

3 hours later…

AviD

11:07

@ScottPack collegehumor.com/video/6763677/…

that's right, cheeseburger pizza.

Iszi

12:04

Morn'

user image

^ Would be even funnier if his first initial was "S.".

Scott Pack

@AviD We are unimpressed. avalanchepizza.net/wp-content/uploads/2011/02/wonderboy.jpg

AviD

@Iszi hehe, made me laugh. especially the "og" on the paper sign.... but why the S?

Scott Pack

@AviD Or, like, half of these. There is a bacon-cheeseburger one on the list about halfway down. avalanchepizza.net/menu

AviD

@ScottPack awesome! looks totally delicious.

Scott Pack

And two blocks is way closer than 6000 miles.

Iszi

12:17

Sonic the Hedgehog (character)

, trademarked Sonic The Hedgehog, is a video game character and the titular protagonist of the Sonic the Hedgehog series released by Sega, as well as in numerous spin-off comics, cartoons, and a feature film. The first game was released on June 23, 1991, to provide Sega with a mascot to rival Nintendo's flagship character Mario (see 1991 in video gaming). Since then, Sonic has become one of the world's best-known video game characters, with his series having sold more than 80 million copies. In 2005, Sonic was one of the first game character inductees into the Walk of Game, alongside Ma...

Scott Pack

@AviD I'm glad you think so. Granted, I have a strong dislike of ketchup, but the Bride of Wonderboy looks pretty foul to me. :/

Iszi

OneBox still befuddles me with its choice of picture for Wiki pages...

AviD

@Iszi ohhhh right. of course.

Iszi

user image

AviD

@ScottPack yknow, at some point, we gotta stop calling some of these "pizza".

Scott Pack

12:19

@AviD You shut your mouth!

AviD

@ScottPack no, for those, I would definitely open my mouth, whatever you want to call them.

assuming they were kosher, of course.

Scott Pack

Of course.

Iszi

In other news... I thought of a question today, but it's probably too S&M: "What are the benefits/drawbacks of all-in-one "smart" ID cards vs. a separate hardware authenticator?"

Scott Pack

I wonder. I'm not sure what our Jewish population is like here. We have gobs of vegetarians/vegans/locovores, so most places tend to cater there.

AviD

locovores?

nevermind...

A locavore is a person interested in eating food that is locally produced, not moved long distances to market. The locavore movement in the United States and elsewhere was spawned as interest in sustainability and eco-consciousness became more prevalent. Derivation The word "locavore" was the word of the year for 2007 in the Oxford American Dictionary. This word was the creation of Jessica Prentice of the San Francisco Bay Area at the time of World Environment Day, 2005. It may be rendered "localvore", depending on regional differences. Strategies The food may be grown in home gardens or...

Scott Pack

12:25

@Iszi That's actually pretty good information to make available, if you slim it down some. I would say focus on the drawbacks. What risks does using all in one smart cards introduce as opposed to traditional separate hardware indicators.

Iszi

Oh, that's right. food trumps security in topic priority here.

AviD

sounds like some crazy paranoid hicks...

@ScottPack yeah, that sounds like a great question.

Iszi

@ScottPack Still, anything comparative does sort-of wander into S&M territory...

AviD

I like any question that starts with "What risks does this introduce... "

Iszi

I suppose I'll throw it up there, and leave it for you guys to edit.

Scott Pack

12:26

@Iszi Granted. I think focusing on asking what risks it introduces will keep it on the right side of the line.

AviD

@Iszi not in this case, because you're not asking about a specific product.

Scott Pack

@AviD Mostly hippies (and their descendents) actually.

AviD

"what risks are there" is not s&m

on the other hand, proper security tradeoff is by definition subjective., but good subjective IMO.

Scott Pack

Indeed.

Iszi

@ScottPack By the way, since when have "hardware authenticators" been "traditionally" separate? I'm thinking of hardware authenticators as in smart cards, not physical keys. In all implementations I've seen (albeit in my limited experience) the "smart card" has been a part of the employee's regular ID.

Scott Pack

12:28

@Iszi I was making an assumption. I've never seen a smart card used.

AviD

dang, now I'm craving me some pizza.

Iszi

@AviD So, you're saying the entire "benefits/drawback" would be "good subjective" enough to stay, without slimming it down to just "drawbacks"?

AviD

not exactly.

Scott Pack

I've seen plenty of places roll out cards with chips on them, only to phase them out later when they realized the chips were never used.

Iszi

@ScottPack Probably because they never enforced their use.

AviD

12:29

I think "what risk does this introduce" is not subjective - and it can go both ways: "... or mitigate".

is this a good risk/tradeoff, is good subjective.

Scott Pack

@Iszi That being said, these same places put a mag stripe on the card, and would use it for various purposes.

Iszi

@AviD That's effectively the same question, re-worded.

AviD

@Iszi but, focus on risks.

Iszi

I'm going to have to be very careful to not put any "here's what I think of this" parts in the question.

It's also, to a certain degree, a usability tradeoff.

I see the main tradeoff being due to user behavior.

AviD

damn users.

Iszi

12:32

Example: Smart cards are used for computer login, and are built into the same ID card used for building access. User leaves smart card in the computer at their desk while on lunch break - can't get back into building.

With a separate hardware authenticator for computer login, you don't have that problem. Granted, users will then be more prone to the same behavior...

Scott Pack

In my thought process I was including a token based two-factor device in the 'hardware authenticator' group. Is there a technical distinction?

Iszi

@ScottPack Token-based, as in RSA SecurID type?

Scott Pack

Or Yubi, or whatever, yeah.

Iszi

I don't know if there's anywhere that uses that as an authenticator for local access. Usually, I think of those for remote access.

Scott Pack

SecurID, I know, has tokens with a USB connector that will inject the passcode, so you don't have to read and type.

@Iszi I think you can use them for local GINA access.

Iszi

12:36

@ScottPack That's what those models do? I thought it was some sort of certificate storage, like a smart card.

Scott Pack

/me looks to see if he still has his documents from their poc

Ok, yes, their Windows agent (at least as early as v6.1) will do local auth.

Iszi

So, how about: "What are the risk tradeoffs of all-in-one 'smart' ID cards, vs. a separate hardware authenticator for computer access?"

Scott Pack

You may be to define, in the question, how you're distinguishing between the two.

Iszi

Know what's amusing when you think about it? The whole "user leaving smart card in computer on lunch break" thing would, in theory, only be a significant factor for about 5-10 years or so. After that, you'll probably have enough "fresh blood" in the company that doesn't remember a time where they didn't have to track their badge, and it will only be the old-timers who now rarely (if at all) forget about it.

So, the question becomes whether or not your help desk and/or building security team can weather the up-tick in calls for that time.

Scott Pack

Pretty much, yeah. We tend to think of it as 3-4 years. Well, with the student population. The employee would be on the order of decades.

Iszi

12:44

@ScottPack Really? You have that high of a turnover rate at a university?

Ah.

Scott Pack

12:59

cool

failblog.org/2012/05/02/…

Iszi

@ScottPack Awesome.

Ok. Posted. Feel free to edit/re-tag.

0

Q: What are the risk tradeoffs of all-in-one "smart" IDs vs. using a separate hardware authenticator?

In many organizations these days, employee IDs are very mutli-functional. They can serve as: Visual identitiy verification. (Including employee photo, name, ID number, and other details on the face) Building access control. (Via RFID, prox card, bar code, magnetic strip, or smart chip) Compu...

authentication risk-management smartcard rfid identification

Scott Pack

I think it looks pretty reasonable.

Maybe we should swap out rfid with best-practices. I think that would make it stronger.

Iszi

@ScottPack I had to catch myself half-way through spelling out the "employee leaves badge in computer on lunch break" scenario.

AviD

13:27

@ScottPack hehe. coronary, indeed. made me laugh, though.

didja notice on Healthcare IT - there was a very active best-practices tag? I was thinking of asking them to ship the contents of that tag over to use wholesale.

Iszi

@AviD Bah. I call mod power abuse. :-P

AviD

we hold the license for best practices.

@Iszi heh. what, you cant read the history?

Iszi

13:57

@AviD Not of deleted posts.

Is this a dupe?

0

Q: IP Spoofing a threat?

Quick Security Question if i may. We have an internal Intranet system which is only accessible from a few internal vlans, our main external firewall blocks all access to the internal webserver – or rather, has no rules to allow access! Now then, we have 100's of branches out in the UK that sit ...

firewalls ip-spoofing

2 hours later…

Iszi

16:02

Interesting tidbit I discovered: If you add a + to the end of a goo.gl link, it will give you a preview of that link, plus some site stats for its target, and a QR code.

Is this really a question for us? I feel it's kind of borderline...

0

Q: Freenode: How to pretend to be two different people

Someone has taken over my account on IRC and I need a way to use a new IP to access the site. I hope this is the correct place to ask this question because I can't get the answer on IRC: 11:49 Alessa: c: realize 2 persons with same getaway. how they can register different accounts without bei...

phwd

Hey @AviD I have a question on WebApps regarding user data encryption, it hasn't had much love on WebApps let me know if you think you could do better

3

Q: Facebook user data encryption

In my country, Austria, a telecommunications data retention law will be executed starting at April 1. Internet carriers are required to store connection data (from which computer to which server), but no actual data payloads, for up to 6 months. I would like to avoid the government knowing which...

Rory Alsop

16:29

for blog reviewers - first draft of QotW 26: security.blogoverflow.com/wp-admin/…

@phwd we could use that - we have a few questions on online anonymity. I'm not sure if it is a dupe of them, but even if it is, this is the right place for it.

phwd

@RoryAlsop Cool, I just sent it. Thanks for following up

Rory Alsop

@phwd no worries

@Iszi I think it feels like NaRQ/Offtopic. Reading the transcript looks like the IRC admin has decided not to believe him.

Iszi

@RoryAlsop I think there's a fine line between on-topic and off-topic here, when it comes to "How to avoid/circumvent/fool I&A" questions. This one definitely feels like it's on the wrong side of that line.

Rory Alsop

yeah

Scott Pack

16:54

/me hates debugging someone else's code

Especially perl.

Iszi

@ScottPack I'm sure someone else hates debugging your code, too.

AviD

@phwd absolutely agree with @RoryAlsop. thanks for sending it over.

@Iszi you dont get it. "Someone else" includes "myself from a month ago".

2

Iszi

@AviD Ah. True, too.

AviD

there was a classic Not Invented Here strip (cant find it right now), where desmond is complaining about the crappy level of code. Turns out it was his code... and he complains how naive he used to be, and would *never* make those bad decisions now. "Wow. When did you write it?"
Desmond: "This morning"...

Scott Pack

@Iszi Probably. However, I tend to have enough trouble reading my own code after a few months, that I end up doing lots of comments and am willing to write longer routines if it means they're clearer.

If I do end up using a stupid trick, I make sure to call it out. Something like, "I don't know how this works, I found it somewhere else, but it magically does X."

AviD

17:05

@ScottPack biggest difference between a newbie programmer and an experienced one.

note the rise of "write-only code".

Scott Pack

eh?

AviD

Writing code for the computer to read is easy. Writing it for your fellow programmer (including yourself) is much harder.

Scott Pack

No doubt

AviD

@ScottPack write-only, as in, it's impossible to read, and if you need to change anything - just delete it all and start over.

oops, gots to go...

Scott Pack

Funk that

Iszi

17:07

@AviD lmgtfy.com/?q=not+invented+here+code+this+morning

Scott Pack

Yeah, same here. Our coder is about to defend his MS thesis in a few minutes.

That means the clock's kicking in for me :-/

Iszi

thiswas.notinventedhe.re/on/2010-04-20

OMG. Firefox is planning another major UI overhaul, already?

computerworld.com/s/article/9226787/…

Iszi

17:49

Oh, for those interested, here's the QR code for a Goo.GL link to Sec.SE:

user image

Gilles

18:24

22

Q: How much influence should an external site/entity have over the questions on a Stack Exchange site?

A question has been asked on the Drupal Answers Meta: better tools for dealing with questions that disclose security issues The OP is essentially asking that there should be some sort of mechanism for posts to be deleted/removed from the site, based on the premise that they might (perhaps unint...

support deleted-questions

This thread needs someone to explain about responsible disclosure

especially to casperOne

I've had my fill of MSO arguments for the week, especially with casperOne

CodeInChaos

18:40

not my favourite SO mode, to say the least

« first day (503 days earlier) ← previous day next day → last day (4681 days later) »

Transcript for

May '122

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile