The DMZ

« first day (540 days earlier) ← previous day next day → last day (4351 days later) »

Stack Exchange

4:28 AM

During the second semester, the path is briefly routed through the dishwasher.

8 hours later…

Ladadadada

12:08 PM

Hee hee:

Iszi Rory or Isznti

@Gilles Doesn't look like a Sec.SE question to me, really.

Stack Exchange

12:20 PM

Stack Exchange Security Blog: QotW #29: Risks of giving developers admin rights to their own PCs

roryalsop on June 08, 2012

Carolinegordon asked Question of the Week number 29 to try and understand what risks are posed by giving developers admin rights to their machines, as it is something many developers expect in order to be able to use their machines effectively, but that security or IT may deny based on company policy.

Interestingly, for a question asked on a security site, the highest voted answers all agree that developers should be given admin rights:

alanbarber listed two very good points – developer toolsets are frequently updated, so the IT load for implementing updates can be high, and debugging tool …

Iszi Rory or Isznti

@RoryAlsop Good QotW post, but I still can't say I agree with the conclusion. Maybe I just don't understand the work environment of software developers enough, but it would seem to me (as it seems was mentioned in at least one answer) that Dev environments should be separated enough from Production that Devs don't really need Admin rights on their "office" workstations.

Rory Alsop

That is a good point - I read it as own PC's being the ones they use for developing

hmmm

Feel free to add a comment to the blog - that is always a good traffic generator

and bumps us up in google rankings, apparently

Iszi Rory or Isznti

@RoryAlsop See, that's just the thing. I added a comment to the question early on, but it seems to have been largely disregarded. :-(

@RoryAlsop Done. Mostly cut-and-paste of above.

Heh. My comment doesn't even appear right away on the question now, because it never got up-voted. Does anyone else find that function just a little annoying? I personally prefer to have comments truncated by timeline.

Rory Alsop

12:53 PM

@IsziRoryorIsznti My apologies for that - thought I had scanned through all the comments, but you are right: it got hidden under the upvoted ones

Iszi Rory or Isznti

@RoryAlsop I wasn't meaning to gripe about you ignoring the comment. Really, my beef is more about the asker not responding to it.

Then again, it looks like the user doesn't really do much on any site - only one or two questions/answers on each site she's been to.

Iszi Rory or Isznti

1:11 PM

How do I change my profile pic on the blog? I feel stupid for not being able to find it...

Rory Alsop

does it take it from Gravatar? I'll go and look

Iszi Rory or Isznti

@RoryAlsop Would be nice if it actually said that somewhere.

Might not be helping that I don't have a Gravatar account that I'm aware of.

Scott Pack

It appears to be gravatar.

I can't find any way to change it, and my profile pictures match.

Iszi Rory or Isznti

Holy crap... So, apparently Gravatar merged with Wordpress. I've got a really ancient Wordpress account that I'd totally forgotten about that uses my same username but it's tied to an e-mail address I didn't even remember existed!

Okay. Fixed it all.

Interesting to note: Though I could have chosen any image to upload for my gravatar, I've grown strangely attached to the auto-generated one StackExchange uses for me.

Iszi Rory or Isznti

1:44 PM

Oooh, good question raised here, about one of LinkedIn's recent announcements...

https://www.computerworld.com/s/article/9227889/LinkedIn_provides_breach_update_sort_of

'Chester Wisniewski, senior security advisor at Sophos called Silveira's comments about salting somewhat confusing. "They are saying that their current production database is now salted, which seems to be technically impossible. They either lost the database some time ago and have been adding salts as users log in, which means not all of them are salted, or they have plaintext copies of the passwords, which defeats the purpose of hashing them to begin with," he said by email.

Rory Alsop

I like the approach last.fm took - if you have an account there, when you log in it will enforce a password change right away :-)

Iszi Rory or Isznti

@RoryAlsop Agreed

5 hours later…

Iszi Rory or Isznti

6:33 PM

Okay... am I mis-reading something here?

-2

A: How can I be sure Lastpass really can't access my passwords?

Based on current news, you can't. I'll paste what I brought up in chat earlier. In short, recent claims of LinkedIn state that they have "salted" their existing database which is impossible without them having access to the cleartext passwords in one way or another. https://www.computerworl...

Now that I think a bit more about it... I suppose LinkedIn could have changed their hashing process entirely so that "salted hash" actually means "hashed SHA1+salt" instead of "hashed password+salt".

1 hour later…

Gilles

7:53 PM

@IsziRoryorIsznti I think it would have been on-topic here, but it was asked on U&L where it's on-topic and it'll stay there. I linked to it here because it's something the denizens here might know

Scott Pack

8:50 PM

Nice views there

3 hours later…

Stack Exchange

11:28 PM

Blog - Stack Exchange: Election participation badges

Shog9 on June 08, 2012

The 2012 Stack Overflow moderator election is off to a good start, with 15 candidates and just under three days left for nominations. Elections are a fairly mature feature of Stack Exchange at this point (Role-playing Games has one in progress now as well), but Stack Overflow remains the largest and I dare say most interesting: with so many members involved (and so many more potentially affected by the outcome) every part of the system is put through the wringer… Including the candidates and voters themselves! …

Gilles

Q: Using nmap's sql-injection script to scan a specific web folder

I'm fairly new to linux and nmap. I'm using debian squeeze. I tried installing an SQL-injection script for nmap. I was able to successfully run a test scan agains my web server running Windows. However, I can't seem to tell the script to run an SQL-injection test on a certain directory. I tried t...