@packs I agree. Totally subjective, and dependent upon the requirements of the asker - that's why it's better to discuss here, and not at all suitable for the main site.
@packs Some re-working of the wires coming from the main box and stuff - pretty normal for changing providers. But I could swear it took a lot longer than usual.
Also had to set up the new set-top boxes and modem of course.
@packs Yeah, but there wasn't any actual work on the buried lines themselves. Just mostly re-hooking the stuff that runs in from the outside walls, installing new splitters and stuff.
@Iszi @AviD the reason I closed security.stackexchange.com/questions/2201/… is that it looks like spam. But as @RoryAlsop had already commented that it was a closeworthy question, I decided two arbitrary mods were better than one ;)
@AviD, the rules on changing process user/group I.D. are quite restrictive. A process has two uids/gids, the real and effective. At launch, the real UID is the user who launched the process and the effective UID is the user it's running as. Of course, they're usually the same, but a setuid process gets a different effective UID.
If a process is effectively running as root, then it can use setuid to set its real and effective UIDs to anything. Otherwise it can only use setuid to set its real ID the same as its effective ID.
In the case of a process that's launched with the setuid filesystem bit, it additionally has a saved-set-uid which is the same as the owner of the file. Such a process can use seteuid to switch between the UID of the user who launched it, and the user its running as.
So basically a process can change its UID/GID at real time, but can never use it to acquire privileges it didn't have at launch. In addition, if a process changes UID/GID to anything that isn't root, it can never change back or to anything else. The biggest trick is binaries launched with the setuid bit, where the best options are:
1. try not to. Use the platform's service management framework (if it has one) to launch privileged services on demand
2. perform all privileged tasks then completely relinquish the switched ID and run as the calling user
3. if you can't do either of the above, then you have to be careful about using the correct effective user ID for the correct purpose.
You never know - despite me expectation that I am becoming a pointy haired boss, I find myself getting to do more technical work again now I have a small company
anyway, what I like about Solaris and OS X is that they have decent service management facilities that can launch privileged services like inetd on steroids, so devs don't need to get setuid right.
I don't know enough about the Windows service model to know how it helps devs in that regard. Perhaps I should, but I've got through the last decade without writing any Windows code, I might be able to manage this decade too.
Yeah, they've got consultants who do enterprise security and federal security for customers, but they don't particularly talk about what they're doing publicly
BTW, who were your "Apple security folks" you dined with? I should probably get to know them :)
I sat down with the security guy for Apple mobile on Sunday for dinner and he seems very driven to get it right... not sure how much support he gets though
They are off finding out how much they can say - so will ask if I can pass on details
TBH making the right contacts has been the bit I've got most wrong in starting my company :). I've not heard anything from Google or Microsoft - haven't even tried yet with Nokia or RIM.
needs doing these days - just so many voluble folks that you need to get louder than them until you have proven yourself. Starting to pay off for us now.
Not really - he presented things in a slightly better layout than I have seen before, and was good at connecting with the audience, but all standard stuff
There were very few talks which were all new
Although the Qualys talk (by Cisco) aT RSA on why IPv6 has become a nightmare for them was excellent
just the changes they needed to make because of the scale of the problem - scanning 20 Nonillion IP addresses just isn't feasible :-)
That is what always got me - I keep thinking "do I have anything new?" and being scared to present in case folks are bored but the comments back are all around the value of pulling knowledge/experience together in a way the wider audience groks
guessing most folks don't have the depth of Apple security knowledge you have so most of your stuff is likely to be of interest
yeah, I should probably just go for doing "this is how the security stuff you know relates to the iPhone". The book was basically "this is how the Mac stuff you know relates to security".
Still working on changing the world by making security a default part of requirements/software engineering, but I need to get taken seriously first :-D
...and probably ought to make some money in the meantime, too...
Has been replaced by the SCM toolkit: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en
Over view of SCM toolkit: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm.aspx
SCM getti...
yes, it's about systems administration, but then if we say all sysadmin qs belong on SF and all secure programming qs belong on SO, we're not left with much :)
Writing security policy...but then maybe that belongs on writers.se?
I think non-dairy creamer was only invented because some Americans complained they couldn't shovel corn syrup into their faces quickly enough if they had to drink things that didn't contain it.
@packs - yes, and Norn, which is a version of old Norse. No Gaelic for us, which upset the Scottish council when they tried to get us to change our roadsigns to English/Gaelic - almost a riot
@Graham - yep, used to drive through Twatt on my way to Skaill - the best surfing beach in Europe, by a long shot
My origins are, for better or worse, much simpler. I lived in a single town in Kentucky until I graduated college, then moved to Ohio for 2 years of grad school (back in '04).
I lucked out by skipping that kind of things. One of the senior analysts was a student in a class I TAed, so my name got stuck in his head when an opening came up.
Hello,
I'm not a security literate. If I was. probably I wouldn't be asking this question. As a regular tech news follower. I'm really surprised by the outrage of Anonymous (hacker group). But being a critical thinker, I'm unable to control my curiosity to dig out how exactly they are doing? Fra...
@Iszi The problem being that without anything actually disallowing it the only thing we could really do is look for non-official APs that are broadcasting the official SSID
@packs For that, you're probably better off with adding a WIDS/WIPS to your infrastructure I think. That's kind of where I'd like to get our wireless security pointed in the long run - have a system that's ubiquitous and capable enough to monitor everything, and only actually do walkdowns when something needs to be physically identified.
We're kind of halfway there right now. Still a lot of polishing to be done to the system and procedures.
As I understand it from our network guys, the WIDS/WIPS for us is essentially built-in to the wireless controllers. All the LWAPs basically act as APs and WIDS/WIPS nodes at the same time.
@packs Oh, I'm fairly certain it can handle your network, if it can handle ours. I don't know exactly how many APs we have here, but it's definitely not a number to sneeze at.
Just checked, and it looks like we've got nearly 1500 APs.
Has been replaced by the SCM toolkit: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=fb8b981f-227c-4af6-a44b-b115696a80ac&displaylang=en
Over view of SCM toolkit: http://social.technet.microsoft.com/wiki/contents/articles/microsoft-security-compliance-manager-scm.aspx
SCM getti...
