The DMZ

packs

00:00

And...he's gone. WTG Avi.

@AviD The uid/gid of a process in unicees can be changed mid-run, but to the best of my knowledge the binary must implement the change itself.

AviD

@packs shorrry.... looks like chat.se can detect malicious activity and then bluescreened me....

packs

I take that back, anything running with euid 0 (particularly the kernel) should be able to do so, but I'm not aware of any userspace mechanisms to do it.

AviD

well, actually it was stupid flash. I'm starting to agree more and more with steve jobs, about banning flash from istuff...

packs

@AviD np, I'm still catching up on that transcript.

AviD

@packs be able to, but does it?

windows apps can do that to, but the question @Iszi had was does it do it by itself

I didnt think so...

packs

00:06

I think I figured out that the reason I had so much trouble understanding Iszi's issues with how that question was being handled is that I've internalized those aspects of access control. I wasn't really finding a way to see it from his perspective

AviD

@packs Im curious, didja just bang on the keyboard for a while, or is that really an acronym...?

packs

You can actually really see it in action for group membership changes.

@AviD That was a total keyboard bang.

I have no respect for overly long acronyms.

AviD

@packs aww shuckhs, you disappointed me...

was hoping i could get some MILSWANCA points....

packs

I'll turn it into a backronym if you would like....

Anyway, back to groups and such in unicess.

AviD

@packs right, and I realized that he hadn't - and thats why it looks like a bug.

packs

00:08

If a group membership change occurs, it only takes effect on all new login sessions.

AviD

It really is an interesting set of tradeoffs there, though... especially if you're seeing it with fresh eyes

packs

Without question.

AviD

@packs right, as I thought - and same as windows.

packs

I feel like the whole thing might be more prevalent in the Windows side because of kerberos.

AviD

that could be...

packs

00:09

That's just a stab in the dark, I can't really justify it right now

AviD

hmm, just noticed a small difference (I think....)

new process, existing login.... inherits token, or gets new token for new process?

packs

Should inherit. Not token based, remember?

brb

AviD

right, "token" whatever....

okay, so no difference...

packs

00:33

Although....

Since there isn't a security token/ticket, it won't ever get refreshed.

So changes to any environment based access restrictions will only take affect by restarting the process

So I retract what I said earlier about prevalence.

Rory Alsop

hello again

packs

@RoryAlsop!

Rory Alsop

@packs!

:-)

@AviD - ahh - haven't looked at fortify for ages, but yeah - trying to get back up to speed as have a few months of code review work coming up :-)

packs

Now we just need to find a bar tended by a former pitcher.

AviD

@RoryAlsop does it have to be with fortify?

I've actually been using it a lot lately - customer requirement

to my great frustration

Rory Alsop

00:40

yeah - that bit already seems to be agreed :-)

what alternatives do you use over there?

AviD

aww

well I am a big fan of checkmarx

dont have my own license, though...

too expensive

Rory Alsop

checkmarx - will look at that one

ahhh

AviD

and, my biggest code review client insists on fortify

the awesome thing about checkmarx - it's infinitely extensible.

Rory Alsop

Fortify - they do seem to have market share, and they provided decent chocolate at RSA :-)

AviD

it exposes the internal graphs through a very scriptable platform

hehe

I gotta tell you, I've done comparisons numerous times

and EVERY time fortify comes up very short

I think the only real thing it has going for it is coverage

that, and HP is practically giving the licenses away

Rory Alsop

00:44

yeah

I will have to see if I can get a test play with Checkmarx then

but at least it's gotta be simpler than trying to review x million lines by hand :-)

packs

@RoryAlsop Why in my day, we printed it all out on green bar and took the red pen to it!

Rory Alsop

exactly!

packs

And I loved...seeing the looks on those kids faces when they got it back

Rory Alsop

The Akamai talk concentrated on just why that isn't possible any more with large firewall rulebases (the 50k plus rules) - you could see so many wistful faces remembering how it used to be :-)

packs

I'll bet.

Rory Alsop

00:49

The Cisco dude did a great piece at the Qualys booth on why scanning your IP range doesn't work so well in IPv6

similar problem - sheer scale

picasaweb.google.com/lh/photo/…

packs

Shit, I can show you where it doesn't work so well in v4

Rory Alsop

hahahaha

very true

packs

The numbers on that slide scare me

Rory Alsop

I know! - who understands Undecillion anyway

packs

I've never heard the word 'nonillion' before.

AviD

00:53

yeah, htye must have had fun putting that slide together....

@RoryAlsop one caveat you should know going in - I wouldnt be so interested in running it out of the box. Expect to invest some time in writing the queries you want...

not so much finetuning, but really writing what you want to find. Automating your brain, so to speak....

@RoryAlsop do you do a lot of codereviews?

Rory Alsop

yeah - the way timings are right now I probably won't get the leisure, we don't do a huge amount of code review

if the demand is there, we can do most things that come under the infosec category, and I used to do a fair few code reviews, but this is the first since October

Anyway - gotta go sleep before the little ones get me up at unfeasible o'clock to go swimming. Night guys.

AviD

fun fun

gnite

packs

@RoryAlsop enjoy

Code reviews are a service that we don't really offer right now, but my boss and I feel pretty strongly that we need to.

AviD

is there a lot of custom development by you, @packs?

packs

It's just a shame, because I'm the best we have on staff to figure out how to do something like that.

We (university IT) have absolute gobs of custom development.

AviD

01:01

@packs you dont sound enthused....

you could consider outsourcing it, instead....

packs

I'm not a programmer :)

AviD

@packs ah, well...

then definitely consider outsourcing it :)

packs

To be fair, I'm a few months actual work from finishing my MS in CS. So I have a lot of exposure and a fair bit of experience, but since it wasn't something I ever enjoyed then I never really got hot and heavy into it.

The biggest problem with outsourcing are funds. We're a public institution, and the state's not been looking so hot lately.

AviD

so, offshoring then? ;)

packs

We couldn't afford your rates :)

AviD

01:04

lol

packs

Nice try

AviD

meant those cheap workers over in india and far east, but whatevs...

packs

On the plus side, almost all of our custom work is in java.

AviD

me is always a good option, though....

eh. plus == java, why? compared to what?

packs

So at least they've minimized the language set.

AviD

01:05

ahh, yeah, that a plus.

packs

I'm not putting forth that java is any better or worse a language. Just that we're looking at a single one.

AviD

yes, absolutely.

packs

Our department didn't really exist until middle of 2006, so we've been ticking off those boxes as they've trickled to the top.

Your guys chat about Fortify has just reminded me that this one is getting there :)

AviD

NOT fortify, i hope!

packs

I'll keep that resounding endorsement in mind.

AviD

01:09

heh

packs

I should probably either look at the main site, or formulate this into a good Question, but really I would be encouraged to check out free and/or open source tools first.

AviD

as it says in the sidebar - "Fortify Sucks."

I think there are a couple questions around that...

packs

Money for things like that can sometimes be found, but I can see funding code review software being very difficult to convince.

AviD

but I dont think youd have much like getting quality tooling on that.

packs

On a free budget, you mean?

AviD

01:11

There is a project at OWASP - but it seems to be slowish. Lets see now after the latest summit...

@packs yes

packs

So far, we've had good luck with free tools, or at least getting something going with free tools.

For example, we spent a few years with spider, and as a result got funded for a bunch of Identify Finder licenses. That's been working out very well.

AviD

I meant, specifically wrt code review tools.

there are some halfway decent free ones, if all you want is glorified grep

you could even find a couple free that do source-sink flows

but thats not really all I would look for

but, to be fair, fortify doesnt do much more than that, anyway :D

packs

And the only review tool I have experience with is splint, which, as you said, isn't much more than a glorified grep.

Hey, sweet. OWASP has updated their website. And it looks suspiciously more usable. Hm.

AviD

01:31

dunno, looks same unusable...

prettier, though

packs

Well, that's what happens when your website is a wiki :)

AviD

heh

ok, my turn to turn in - tomorrow's a work day for me :)

packs

Well, tomorrow will be a work day for me as well. Different suit, different location, and a boss that I have to sleep beside every night :)

g'night

AviD

@packs ah, but you get to choose all your team :)

(I assume you're talking about your wife - otherwise you might want to get some counseling....)

packs

Heh, yes, home chores and the wife. Although, if most tv shows are to believed, hospitals work that way as well.

Speak of the devil... Guess the kid's asleep. HangWithTheSpouseTime. ta

AviD

01:41

gnite

Iszi

14:08

Mornin

packs

14:25

@Iszi!

Iszi

@packs!

packs

Now that I've acknowledged your existence. Time to start cleaning.

Yay weekends!

Iszi

@packs Meh

Cable guy still hasn't showed. And we were promised an 0800 appointment this time, despite the general window of 0800-1000.

Iszi

15:35

Finally, he's here.

packs

17:16

Nice, thanks guys.

I pretty well got fed up with the whole 2 hour window thing and started asking for a call when they were on their way.

Living 5 minutes (7 with traffic) from work really helps

packs

18:09

@Iszi You get your stuff sorted?

mr_eclair

18:21

hello can any one tell me abt security certifications

which is the best IT security certification ??

packs

That's a pretty subjective question right there :)

Do you want policy, DR, generic, audit, technical, etc?

Iszi

22:09

@packs They came a half-hour past their window, and the job took nearly 6 hours, but it's done.

@mr_eclair Yeah, perhaps a question to be discussed in chat if at all - don't ask it on the site.

Transcript for