The DMZ

AviD

6:30 AM

@ScottPack ohhh, I was wondering wtf was going on with y'all.

@RoryAlsop that can be easily ~~fixed~~ roried.

Acoustic Kitty was a CIA pet project launched by the Directorate of Science & Technology in the 1960s attempting to use cats in spy missions, intended to spy on the Kremlin, and Soviet embassies. A battery and a microphone were implanted into a cat and an antenna into its tail. This would allow the cats to innocuously record and transmit sound from its surroundings. Due to problems with distraction, the cat's sense of hunger had to be addressed in another operation. Surgical and training expenses are thought to have amounted to over $20 million. The first cat mission was eavesdropping on t...

AviD

7:01 AM

@ScottPack so after consideration, I wont be joining in the fun.

Bastard Tigger From Hell is just too much of a contradiction.

also, it took me years to shed the BOFH outlook, after being one for too long. dont want to fall back into that pattern....

too much negativity in the multiverse, I always say.

Rory Alsop

7:40 AM

@AviD :-)

@AviD >The cat was released nearby, but was hit and killed by a taxi almost immediately. Subsequent tests also failed

AviD

@RoryAlsop just proves truth is more f***ed up than fiction.

Rory Alsop

8:23 AM

0

Q: Security Stack Exchange's Anniversary Competition

July the 12th marks one year since we came out of beta: And we have had continuous growth ever since, steadily gaining new users and questions, and the odd peak where a particular incident or burst of activity has boosted the community. Our birthday is an excellent opportunity to generate anothe...

AviD

8:43 AM

@RoryAlsop happy birthday us!

I'm going out on the edge of the envelope's limb, here:

0

A: Security Stack Exchange's Anniversary Competition

Idea for contest: Most significant hack of the SE stack. That's right, calling open season (with appropriate ground rules, of course) on security vulnerabilities on StackExchange sites. The winner could either be decided by SE, e.g. according to the relative risk rating - we could help w...

Rory Alsop

@AviD hahahahahahahaha - I like it. not sure we'll get approval...

AviD

@RoryAlsop doubtful. but would be fun.

and wreak havoc network-wide.

and chess-piece would probably win, since he has the most CVEs ;-)

Rory Alsop

@AviD :-)

AviD

been thinking about the rewards, but we have a problem with that.

Rory Alsop

oh?

AviD

8:55 AM

as a community, and compared to the other SE communities, are there other sites where the populace is so disparate, with regard to the core activities that make them part of the community?

that is to say - sure, programmers on SO are very different, with dozens of different, dissimilar languages. but ultimately ALL programmers, regardless of language, write code. Thats what they do all day.

Rory Alsop

well, yeah - this is why the core stuff - t-shirts etc - will be easy. But they are low in terms of item value, so you may be right. Would a general - industry conference attendance - be more useful

AviD

same with SF - sure, windows/unix/linux/MF servers are all different, but while the techniques are the unsimilar, the core context is the same.

@RoryAlsop possibly. but - which conference?? not to mention location, flights, hotels, etc....

Rory Alsop

@AviD that's what I mean - it might have to be 'conference up to the value of...'

AviD

@RoryAlsop ah. leave the choice of conf to the winner.

still would be pretty pricey, no? compared to the price of the other prizes.

though I would love to be sent to blackhat, expense paid :)

hmm, perhaps the best prize would be a selection of prizes from the other sites... :D

Rory Alsop

that would be pretty amazing - although aside from the hand shaking and networking, it doesn't have as much going for it as you'd think. I'd rate Defcon much higher!

AviD

9:02 AM

yeah, but its fun.

and defcon is much cheaper, once you're there... ;)

in fact I heard that the bsides that is simultaneous with defcon is even better. makes defcon look like what defcon makes blackhat look like...

AviD

9:15 AM

hang on, @RoryAlsop, but I feel kind of dumb for not thinking of this earlier.... depending on expected prize value, why not hardware??

I mean, duh.

I guess thats one thing we all DO have in common - we all needs thems 'puters.

either laptop, ipad, monitor.... etc.

omigoodness. I just looked over at Unix and Linux - @Gilles is a superstar. More rep than the rest of the top two rows combined. More bear there than @Thomas is here.

@Gilles - how do you have time to answer anywhere else??

Rory Alsop

10:03 AM

@AviD he is pretty awesome, isn't he

Rory Alsop

10:58 AM

So, the highest scoring idea for QotW this week is:

2

A: Vote for your question of the week #30

Are common passwords at particular risk? got lots of votes and some interesting answers. It discusses whether websites should prevent use of certain very-common passwords. Passwords are of broad interest, so this might be a good one for the blog.

any volunteers?

Scott Pack

12:28 PM

Is it just me or is cve.mitre.org worthless as a source of information?

Iszi Rory or Isznti

@ScottPack Glad to know I'm not the only one who's run into this. I like cvedetails.com.

2

AviD

12:44 PM

@ScottPack it depends what you're looking for. but in most cases, yes it would be worthless.

@IsziRoryorIsznti thats really nice.

a few years ago I needed to do some research on this for a certain software vendor, looking for relevant issues in "similar" products.

would have come in very handy then...

AviD

12:58 PM

@RoryAlsop dya know if @Aarthi is monitoring this....?

specifically curious about my proposal... I assume that even in the slim chance it does get approved, it would take a while to work its why through...

Rory Alsop

@AviD I suggest a quick visit to TL - I'm just having a sandwich so could do it now if you are busy

AviD

@aarthi see above... specifically my proposal here meta.security.stackexchange.com/a/814/33

@RoryAlsop naw, rather keep the discussion here :)

also @Aarthi, curious what kind of budget would be available for prizes?

Rory Alsop

did you superping her?

AviD

@RoryAlsop I did. notwithstanding how crude that sounds.

> dude, I'm gonna superping yo momma!

hurhur

she doesnt seem to be in TL now anyway.

Rory Alsop

@AviD lol

Scott Pack

1:08 PM

@IsziRoryorIsznti Well, here's a fantastic example. The F5 thing that happened last week

cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1493

That seems to be my typical level of usefulness from mitre.

Rory Alsop

@ScottPack that is extraordinarily informative :-)

Scott Pack

You thought so too, eh?

Jeff Ferland

Ah, the feeling of a fresh resignation letter.

Scott Pack

Yours or someone else's?

AviD

@ScottPack why are you complaining? you have the number. what else could you possibly need??

Jeff Ferland

1:17 PM

Mine

AviD

@JeffFerland congrats!

Scott Pack

@JeffFerland Do you already have something lined up?

Jeff Ferland

@ScottPack Yes, years of frustration! :P

I haven't signed any offers yet, but I've got a place to land.

Rory Alsop

1:32 PM

@JeffFerland well, congratulations and fingers crossed then

AviD

yaknow, with everyone as a BOFH it's getting difficult to tell at a glance who is who.

or is that whom...?

Rory Alsop

@AviD but they all have different centres

:-)

AviD

@RoryAlsop well, other than @Jeff's (which is blank) it's dang hard to tell what it is at that resolution.

Rory Alsop

@AviD I know - I'll probably get annoyed with it myself in the not too distant future

AviD

@RoryAlsop of course you will. Isn't the point of being a BOFH being annoyed by pretty much everything? ;-)

Scott Pack

1:54 PM

@JeffFerland Congratulations. With any luck wherever you land will actually turn out better :)

We don't have any good open, or else I'd pimp those.

AviD

2:10 PM

@JeffFerland This means you're going to have some free time to jump pass me on the rep boards, doesnt it... :-(

Jeff Ferland

@AviD I was hoping it meant I'd have free time to go play with my motorcycle

Scott Pack

Become a stunt driver!

I hear that's awesome, low stress work.

Ninefingers

What's with the RoryPhones?

AviD

@JeffFerland I'm all for it. just remember that commercial.

Ninefingers

@RoryAlsop Sorry, stupidly busy :(

Scott Pack

2:19 PM

18

Q: BOFH Gravatar Week

This is your chance to show your true colours... Use the (semi-) official Bastard Operator From Hell Gravatar for a week or a while. I don't think there's any particular reason, it just seemed like a good idea.

discussion bofh

AviD

@ScottPack ummm.... because you're laid up in a hospital bed for 3 weeks of every month??

Gilles

18 hours ago, by Iszi Rory or Isznti

4 hours ago, by Scott Pack

12

Q: BOFH Gravatar Week

This is your chance to show your true colours... Use the (semi-) official Bastard Operator From Hell Gravatar for a week or a while. I don't think there's any particular reason, it just seemed like a good idea.

discussion bofh

Jeff Ferland

@AviD I drive ambulances. I'm familiar.

Aarthi

@AviD prizes? umm. budget is. well. you bring us a line-item budget and we'll add/remove as needed.

Scott Pack

@AviD meh

Gilles

2:20 PM

hey, we outnumber the BOFHs now

Scott Pack

@Aarthi I'm noticing a distinct lack of AarthiPhone

AviD

@ScottPack ya, I know. Real Men should just get up and shake it off. Then go have a redbull.

Jeff Ferland

@Gilles And yet.... it doesn't matter, does it? :D

Aarthi

@ScottPack but i'm not a BOFH. i'm much too nice.

Scott Pack

@AviD Exactly. You know how those yanks are, though.

AviD

2:21 PM

@ScottPack heh.

Scott Pack

@Aarthi I'd like to think I'm nice, just snide.

AviD

@Aarthi I. see.

so basically, not much in the way of budget.

Ninefingers

@Aarthi HI!

AviD

@RoryAlsop and I had some ideas, that were probably too expensive then.

Aarthi

@AviD negative! the budget is currently up for negotiations.

AviD

2:22 PM

@Aarthi great!

Gilles

@AviD if you play your cards right, you can have maybe $100

AviD

considering my idea would potentially save SEI tens of thousands of $$$, I'd expect the prizes to be in line with that.

Aarthi

facepalm

Unless I find this memory leak in our API, we won't need help from the outside... — Nick Craver 7 mins ago

AviD

@Aarthi enough for e.g. full coverage for some high-profile conference?

some nice hardware...?

@Aarthi hehe, nice.

Aarthi

@AviD line item request submission! just email community and cc the other mods. community team will review the prizes, veto anything egregious, and we'll negotiate a bit. :D

Gilles

2:24 PM

@AviD you know how it is: first you break in and cost them $manyK, then you have a hope of getting a decent security budget

AviD

@Gilles lol

@Aarthi okaaay.... that's good for the specifics, but what range are we talking about?

or am I just being a frikken MBA all over your rories?

Aarthi

...what?

Scott Pack

@JeffFerland hrw-vip-prod.is.berkeley.edu/psp/JOBSPROD/EMPLOYEE/HRMS/c/…

Jeff Ferland

bluetarp.com/employment/3

Scott Pack

@Aarthi Don't rory about it, he tends towards daft.

Aarthi

2:28 PM

er, okay.

Scott Pack

@JeffFerland Wow, what don't they want?

Aarthi

heeeeeey it's an SE sysadmin, @PeterGrace

Peter Grace

I hear there's troublemakers making trouble in here!

Aarthi

pretty common

Jeff Ferland

@ScottPack Well, I wish they paid more, but they offered it to me.

... and there are huge bonus points for the environment. Very comfortable crowd.

Scott Pack

2:29 PM

@JeffFerland I'm not sure they could pay enough for me to be willing to develop the level of ADHD required for that position :)

2

AviD

@PeterGrace welcome! and expect the worst.

@PeterGrace what's an AviD gardener....?

Aarthi

@AviD He's an experienced ServerFault User; y'all can't scare him.

Peter Grace

Having managed a large security team at my past employer, I'm ready for it.

AviD

@Aarthi doncha know it's our jobs to scare sysadmins...?

Scott Pack

Just look at that mug. Can you imagine the horrors he's already seen?

Peter Grace

2:31 PM

I can't speak for the entirety of the team, but I will politely ask that you guys not add any more work to my kanban board

AviD

@ScottPack ah, he hangs out in the Comms Room?

@PeterGrace lol, never. Except when we do.

Scott Pack

@AviD Precisely

Peter Grace

I tone it down to hang in Comms Room. I'm a /b/ kind of personality.

Scott Pack

Ew

Rory Alsop

@Aarthi for some reason it's been a very rory month in here

Aarthi

2:34 PM

@RoryAlsop :D That's 'cause Rory is a fun word, I think.

@Ninefingers belated hello back!

AviD

@Aarthi you note the room tags, yes?

Aarthi

haha i didn't notice til now

But why isn't he Rory Ferland?

Or Rory Pack?

or RorY

Scott Pack

Speaking of having a Rory-good time, Kontrol just came up on my DeepHackPlaylist.

Rory Alsop

where's @IsziRoryorIsznti when you need an example

AviD

@Aarthi ask @IsziRoryorIsznti.

Rory Alsop

2:36 PM

@ScottPack Yay!

Scott Pack

I thought you would like hearing that.

AviD

2:59 PM

yknow what's cool?

all your tough little bofh telephones, when shrunk to the size of one line, look like little hearts.

2

which makes this room kinda gay.

not that there's anything wrong with that.

just sayin'.

Gilles

@AviD you really really have to use your imagination, but I like it

AviD

@Gilles just have a quick glance. peripheral vision like.

noticed this while I was working on a different window...

AviD

3:19 PM

@Gilles somebody declare Tag Wiki Day?

good work, thanks :)

Iszi Rory or Isznti

3:35 PM

@RoryAlsop Say wha?

AviD

@IsziRoryorIsznti he just wanted to point at you and laugh.

Iszi Rory or Isznti

3:46 PM

@AviD Ah, right. Well, @Aarthi, apparently you're not generally supposed to be allowed to change your screen name more than once a month. So, once the other guys found out I was stuck as-is for awhile, I suppose they decided it wouldn't be worth the bother.

Aarthi

ah

AviD

@Aarthi sorry, we figured it was clear from his name.

besides, we always like pointing at him and laughing.

@Aarthi btw except for quoting @Nick's comment, you didnt actually respond to the main question for which we superpinged you here....

well I guess that and bringing @Peter into the fray...

Aarthi

er sorry, what was it you needed?

AviD

3

A: Security Stack Exchange's Anniversary Competition

Idea for contest: Most significant hack of the SE stack. That's right, calling open season (with appropriate ground rules, of course) on security vulnerabilities on StackExchange sites. The winner could either be decided by SE, e.g. according to the relative risk rating - we could help w...

Aarthi

i can't give you permission to hack the site. that's supremely not under my purview

AviD

4:00 PM

to find out if the was any chance in bastard hell of actually doing that...

Aarthi

@AviD Well, @PeterGrace basically said, "Don't do that, please."

AviD

@Aarthi well, obviously. but what are the chances that those whose purview it is under, would give permission if permission could be given?

@Aarthi heh. true. but I have a feeling that was more like a desperate plea, rather than the official position of the powers that be :)

Aarthi

If you're going to whitehat, I.....can't officially condone that. That's basically the only answer I can give you.

AviD

besides, it should be probably be more work for the devs than the sysadmins....

of course whitehat!

I'd have to flag and ban myself otherwise.

Aarthi

:o

AviD

4:03 PM

actually, not looking for the answer right now, more of a "can you float this up to whoever can"... :)

in the spirit of openness that SEI loves, I'd say this was long overdue

or are yaaa skaaaarrreed...? ]-)

Peter Grace

I can't give an official answer, but I will indicate that since we do process credit card transactions for our careers website, it's not as simple as it seems on first blush to probe our site.

AviD

hmm, credit cards. true, didnt consider careers.

'course there are solutions for that too. after all, PCI would require a pentest every so often....

Peter Grace

Since everything runs on the same webservers, there isn't a safe way for us to say "Sure, go to town on X website."

Well, I don't want to go into too much detail or discussion about how our environment works as these chats are archived and indexed by google.

AviD

but let's assume we can guarantee the "safety" of the credit cards (or at least in relation to this contest)...

@PeterGrace 'course not, that's fair. we'd be talking blackbox anyway, up to the point of SEI's already openness.

Iszi Rory or Isznti

@AviD I'm sure PCI also requires certain service level and non-disclosure agreements with the pentesting organization? Not exactly something you can properly manage in an "open invitation" scenario.

AviD

4:09 PM

anyway, @Peter, @Aarthi - just saying think about it. mebbe discuss with mgmt and devs... I said only partly in jest, but seriously, you'd be getting a valuable service, probably worth upwards of 10,000$...

@IsziRoryorIsznti of course. but doable.

Peter Grace

I'm asking. I'm personally not in favor of it, but doing my due dilligence all the same.

Iszi Rory or Isznti

@PeterGrace Can you comment on the "Hacker" badge alluded to in the "I Just Logged In As You" blog post that @Gilles linked?

Peter Grace

Nope, sorry, I don't know all that much about how the badge system works, that's really a dev level thing. I just keep the lights on.

Iszi Rory or Isznti

Particularly, I noticed no confirmation or denial of its existence in Jeff's blog - not even an acknowledgement of the claim.

Aarthi

@IsziRoryorIsznti It's basically like a unicorn.

It might exist.

I've never seen it awarded, though.

AviD

4:14 PM

@JeffA took that code with him when he left.

@PeterGrace I appreciate.

@PeterGrace are you not in favor of security tests in general, or just the current crowdsourced suggestion?

Scott Pack

@AviD Let's not forget transaction volume, self-assessment questionnaires, etc.

AviD

@ScottPack but of course.

that's why I didnt specify how often, since I dont know how much rory the careers site does.

besides, even with self-?aires, you still have to have the pentests.

every quarter, regardless, if my current memory is correct.

Peter Grace

@AviD as I mentioned before, I ran a large security team at my previous employer. I'll be honest. I don't know any of you guys from Adam. How can I have any assurance that promoting this would help my site other than your "I pinky-swear to be good!"

Scott Pack

@PeterGrace I don't really know you from Peter, either.

Peter Grace

Yes, but, the difference is, I'm not the one volunteering to poke at your systems as a thought-exercise.

Don't take it the wrong way, I love IT security teams. You guys make life easier in a lot of ways

Scott Pack

4:23 PM

I don't blame you at all. I would require some pretty hardcore contracts in place before I even thought about allowing something similar.

Peter Grace

When we contract a McAffee or a Comodo or some other professional organization to get penetration testing, we get bonded and insured companies handling it so that there's a liability chain of custody.

Aarthi

@AviD I'm looking into the matter; I'll have an official response for you soon. For the time being, let's see if other ideas for your anniversary come up, okay?

Iszi Rory or Isznti

We could all pull out our CVE listings and compare them. I'm sure a certain bird/chess piece would love that.

Scott Pack

@IsziRoryorIsznti Authenticating the data would be troublesome at best.

Aarthi

bird/chesspiece?

Iszi Rory or Isznti

4:38 PM

@Aarthi The Sec.SE guys know who I'm talking about.

Aarthi

oh okay

Scott Pack

A particularly singular user :)

Iszi Rory or Isznti

I I was being facetious anyway.

Interesting fact I got from HowTooGeek today, by the way: Harrison Ford has both a species of spider, and a species of ant named for him.

Aarthi

huh

Scott Pack

Hm. I wonder if we can crossbreed them into a spiderous ant? I've got a bad feeling about that.

2

Iszi Rory or Isznti

4:41 PM

@ScottPack Spiderants! Why'd it have to be spiderants?

Scott Pack

Next step: Insult the spiderants, get smacked in the face with a mandible, then sleep with it?

I'm not sure I approve of where this is going.

Iszi Rory or Isznti

@ScottPack Wait-what? I never figured you for an arachno-insecto-phile.

Scott Pack

I certainly don't like where this is going.

Gilles

5:37 PM

@IsziRoryorIsznti AFAIK the Hacker badge is a joke and was never awarded to anyone, but that's from before my time

Nick Chammas

6:05 PM

This is so distressing: google.com/webhp?q=c%23%20hash%20password%20example

...recommendations to use MD5 all over the place.

Iszi Rory or Isznti

6:47 PM

Well, bummer...

Sorry, we've discussed this internally and it's not something we (Stack Exchange) can sanction. In addition to the legal ramifications, we're not comfortable with encouraging attacks on systems with people's private information. — David Fullerton 1 hour ago

Ping @AviD @RoryAlsop

Peter Grace

6:59 PM

You guys got me curious, so I'm firing up openvas on a vps I have. It takes ages to start the server process.

Is there a canonical "What tools can I use when starting vulnerability testing" type question on the site?

AviD

@IsziRoryorIsznti heh, fair enough. @PeterGrace I don't "blame" you either, of course it's a tricky situation.

crowdsourcing a pentest is really "out there" to begin with, I had no doubt of that. but, knowing the majority of the community here, I figured it might be doable.

Peter Grace

Well, suffice to say it got a significant amount of discussion in our company chatroom.

AviD

but the issue of personal data, and credit cards, is a fair problem.

Peter Grace

the sides were quite polarized and I wouldn't be surprised if we did have some sort of policy/event that was friendly to your guys ambitions

AviD

@PeterGrace :)

Iszi Rory or Isznti

7:02 PM

@PeterGrace I'd love to have that chat log.

AviD

@PeterGrace ooo I like the sound of that.

@IsziRoryorIsznti me too!

Iszi Rory or Isznti

Oh, I see we've got SE apps for Chrome, Opera, Firefox, Android, and OS X. When's an iOS app coming?

AviD

@PeterGrace on the other hand, perhaps a publicized, 3rd party appsec pentest might be a good play here...

or even - better yet - 3rd party security code reviews etc... under strict NDA, of course.

NO, I am not just pushing my services to grab a juicy project (though that would be sweet) :-)

@PeterGrace in response to your question - there are different levels to that question, and I think some of them have canonical-ish answers.

network level? OS level? application level? and then there's the question of tailoring the toolset to the type of application.

and not to mention the fact that the tools are a lot less important than the skills of the tester, and his/her methodologies.

Scott Pack

Can you rories please quiet down. You're ruining the sanctity of my chat room.

3

AviD

Can you rories please rory down. You're rorying the rority of my rory room.

Scott Pack

7:09 PM

Roryoff

3

Peter Grace

@AviD To be perfectly honest, I'm just afraid there's something stupidly simple that would be easily exploited.

Iszi Rory or Isznti

@ScottPack Well, rory you - you, rorying Rory.

2

Scott Pack

@PeterGrace Honestly, that's always my fear too.

Peter Grace

But I guess if it was, people would already have found it and exploited it.

Scott Pack

@IsziRoryorIsznti Let's just please calm the rory down. This is all getting a little out of rory if you ask me.

3

Peter Grace

7:11 PM

A lot of people in our organization seem to have a very deep trust in people, and as a sysadmin I have the opposite.

Scott Pack

@PeterGrace Goes back to the Network Programming Creedo that my advisor taught: "Be strict with what you send, and lenient with what you accept."

AviD

@PeterGrace and you can imagine where we are as security freaks....

personally I like trusting people, especially professionals, but it takes quite a lot till I get to that point. First verify, then trust, I guess.

@PeterGrace tell me, if its not considered privileged information, has there ever been a 3rd party sec audit done?

or even a 1st or 2nd party audit, by a security hat?

more curious than anything else...

Gilles

@AviD I like trusting people, but what works is trusting people to do the wrong thing :(

AviD

@Gilles sad state... but yeah, it really depends on which people.

Scott Pack

/me sighs

AviD

7:18 PM

in fact I would say I cant trust people, but I can trust persons.

Scott Pack

Right, so I think I finally managed to get this guy's init script whipped into something usable.

Peter Grace

7:33 PM

@AviD I don't think it's necessarily priviledged, but it's embarassing. Is that a good enough non-answer? :)

AviD

@PeterGrace heh. clear enough, sure :)

perhaps after the first time, and everyone can be sure that there's nothing stupidly simple that everyone missed but could be easily exploited, we could reconsider the open season / crowdsourced pentest.

but just think! crowdsourcing pentest... it would be the first of it's kind, ever! would be a great talk for blackhat... ;-)

Peter Grace

openvasd.

real 45m26.536s
user 1m37.522s
sys 11m38.996s

It took 45 minutes to load openvasd.

is that normal?

AviD

I wouldnt know, sorry.

me, I'm an apps guy :)

windows at most.

Peter Grace

What do you use to pen test?

I was gonna grab nessus but it seemed like openvas was more what people were talking about lately

Scott Pack

Based on the last time I used openvasd? Yeah, that's pretty reasonable.

Nessus usually takes me about 1 minute to start. For a first run closer to 10-15.

Peter Grace

7:46 PM

@ScottPack what's your favorite tool for basic vulnerability assessment/pen testing?

Scott Pack

Downloading and processing plugins takes a long time.

@PeterGrace I use Nessus.

AviD

@PeterGrace mostly manual. but I do start with either/and any of: appscan, netsparker, and acunitex.

but again, I'm talking appsec.

you're talking net/os, right?

Scott Pack

But yeah, my focus has always been more system level and less application garbage.

Peter Grace

yeah, with heavy emphasis on web app.

Scott Pack

I do like how with the ProfesionalFeed we get access to audits for standards compliance testing. Nice feature, even if their Apache CIS audit is so woefully out of date as to be completely useless.

Transcript for