The DMZ

12:18 AM

Your opinion about this? I think this question is a bit too broad because it sounds more like a research project. But it is specific, though perhaps specifically broad:

0

Q: What methods of federated identity attribute exchange are available and how do they compare?

As Identity systems become more popular across the internet there will be increasing benefits from binding a user's personal information to their digital identity. For example, if you move house, it would be great to be able to update your address in one place, and have that propagate to all Serv...

Scott Pack

2:45 AM

@Gilles I saw it as a low skill question but one worth answering, even it just to show his approach was fundamentally flawed. Looking at it from that perspective, it seemed a reasonable migration to me.

@Gilles I'm going to assume I voted to migrate and not a straight off-topic. I remember voting on the question, but not what my vote was.

AviD

@StackExchange hey, anybody interested in collaborating to win some prizeees?

Scott Pack

@AviD How productive do you want your collaborators to be?

AviD

@ScottPack heh. contributing, surely.

I dont need help sharing the prize.

Scott Pack

@AviD Damn you and your non-zero standards!

Lucas Kauffman

6:40 AM

Drank a good amount of alcohol, no hangover == win

AviD

7:58 AM

NOOOOOOOOOooooooo!!! nypost.com/p/news/business/…

Oh wait, I forgot, I don't care.

Actually maybe this will help force them to find decent kosher alternatives for me...

Rory Alsop

Noooo - "worst hog losses in 14 years" - OMG

Lucas Kauffman

8:19 AM

Morning

@avid do u have 2 fridges at home for meat and dairy?

AviD

8:35 AM

@LucasKauffman heh, no, not at all.

our 2nd fridge is coincidental, simply haven't gotten rid of the old one yet. :)

Lucas Kauffman

How does kosher work?

AviD

8:52 AM

there are SO many details, and different sub-topics, that just listing them would take quite a while. Assuming I knew them all myself, which I dont.

there is the aspect of meat/milk (of which there are many many details), there is the issue of "ritual slaughter" for meat (and which animals are kosher, and which part of those animals, and etc), there is the issue of how certain foods are prepared, wines have their own issues, and more.

for many of these things, I rely on a subject matter expert that has checked and verified.

Rory Alsop

@LucasKauffman I had to review the wikipedia pages when first having these conversations with @AviD. And we have had extensive discussion as to which animals we could eat.

My rule (not kosher, just allergic to fish) is to only eat things with 2 or 4 legs

0 = fish = bad

AviD

of course, we could discuss the possibility of forging the certificate, or impersonating the expert....

Rory Alsop

many = prawny/shrimpy things = bad

AviD

these things have happened, btw.

@RoryAlsop eww.

there are certain things I would have liked to eat, those are NOT amongst them.

btw @RoryAlsop @JeffFerland @GraceNote re the ads - I would have thought that it would be sensible / "easier" to just wait with them - 3 months is not very long, unless we "organize" its unlikely we'd upvote our "special" ads within enough time to matter, and it seemed that we were "happy" with them as they stand, for now.

That said, I am agreeable to doing it "now".

Also, I've noticed I've been overusing these "quotes" things. Fun, though.

Lucas Kauffman

No fish? :o

AviD

9:08 AM

yeah, how do you eat sushi?

Lucas Kauffman

With chopsticks

And soy sauce

Rory Alsop

@AviD vegetarian sushi is just fine. (Sushi only refers to the rice anyway)

AviD

@RoryAlsop I know, as I was typing it I was thinking I should be specific and write sashimi, but I figured there are no Sushi Nazis here ;-)

Rory Alsop

hahahaha

just English Nazis

Lucas Kauffman

But why no fish, it's dericious

Rory Alsop

9:14 AM

because it hates me

AviD

I used to not eat fish at all either (well, except for heavily processed tuna), and started via vegetarian sushi, moving to fish sushi, and from there to real fish.

said sushi provided in our morning carpool by one of those sleazy lawyer types, who overcharged his clients for ~~dinner~~ work late last night.

but yeah, sushi first thing in the morning, with your coffee while stuck in traffic - win!

Rory Alsop

stuck in traffic - not one of the things I like to accept

also - coffee...in my car...not possible. G-forces too high

:-)

Just popped initial QoTW 36 draft for review. As it stands, this is just a straight drag and drop of @Poly's answer. @Iszi's comment on the QoTW meta post was that it might be good to get additional non-tech comments. Does anyone fancy doing a bit of that?

As I'm on holiday today, I think I'm also going to write the blog post on competition winners

and I need to write an article for ISACA this evening :-)

busy

Lucas Kauffman

9:34 AM

Your definition of holiday is different of mine lol

Rory Alsop

@LucasKauffman well, I have been in waiting for an engineer to fix the heating, so I gave myself a todo list.

He has been and sorted the heating, but I might as well finish the list

AviD

@RoryAlsop like I said, the coffee works for the traffic.

'Course, that's one of the reasons I insist on working from my home office as much as possible.

Rory Alsop

My problem is that coffee at home - not that good :-)

Stack Exchange

9:59 AM

Stack Exchange Security Blog: Security Stack Exchange’s first anniversary competition – results!

roryalsop on September 27, 2012

To celebrate our first anniversary since graduation as a fully fledged Stack Exchange site, we recently held a four week competition with prizes for individuals in the community who suggest useful edits, provide high scoring questions or answers, and for those who resurrect unloved questions to allow them to be answered successfully.

These prizes are arranged into three levels (details over on the competition post) with some delicious prizes supplied by the team at Stack Exchange headquarters:

Level 1 prizes are the much sought after Security Stack Exchange T-Shirt – here modelled by community moderator Jeff Ferland: …

Rory Alsop

@JeffFerland - that photo makes it look like you won:-)

Maybe I should use a different T-shirt photo...

Scott Pack

11:39 AM

@AviD So shellfish bad but fish (in general) ok?

@Rory So what you're saying is that @JeffFerland is winning at winning?

3

Lucas Kauffman

12:02 PM

@Rory It comes with dog tags?

vignesh4303

@LucasKauffman any suggestions to test an iphone app for breaching security

@Polynomial congrats mate

Lucas Kauffman

12:25 PM

Yea smartphone penetration framework

Scott Pack

12:47 PM

I'm in your pocket penetrating your phone?

Lucas Kauffman

Btw @poly n1 mate :D

@scottpack u wish

Rory Alsop

1:32 PM

@Lucas yes- dog tags and cool USB cable

Polynomial

@LucasKauffman ty :]

Terry Chia

sup guys. too much crap to go through so i am not even going to attempt. ;)

Polynomial

gonna have to have a play with that when it arrives

that's a point -- how're we organising delivery?

Terry Chia

@Polynomial are you referring to the pineapple? you will have a blast - especially trolling non techy friends with it.

Polynomial

ja, pineapple :P

Terry Chia

1:45 PM

busy three days at a it security conference here in sg.

i just lost my first CTF competition.

Polynomial

heh, least you tried! :)

Terry Chia

no clue on how to even begin on all the file forensics and reverse engineering challenges. it's a sign to buy that book and start learning.

Polynomial

love this image...

pineapple and cheese! :3

Terry Chia

which bundle did you win? the basic one?

Polynomial

not sure, I guess it's the standard one.

Terry Chia

1:49 PM

ahh. good enough. i bought the second package - it comes with a wireless adapter.

Iszi

Hrm. They were strangely non-specific about the model.

Polynomial

indeed.

@RoryAlsop Any idea which model of WiFi Pineapple it is?

apparently there's different types.

Terry Chia

the pineapple is the same, it's just what else you get.

Polynomial

indeed, there are other bits (7dbA antenna for one) on the higher up ones

Rory Alsop

@Polynomial I honestly have no idea

I guess that depends on what @Aarthi and the team have in terms of budget set aside for the prizes

:-)

@Polynomial there will be an email sent out to all the winners to get address details, then I'm guessing SE will either ship them out (definitely in the case of the t-shirts and flash drives) or get them sent from vendor (possibly the pineapple - dunno what is easiest for them)

Polynomial

1:59 PM

@RoryAlsop Right. Best work out where the hell my SE account points to then! :P

Ah, s'all good, it's my proper email :P

Rory Alsop

heh - was just looking at the blog stats - the CRIME post has been by far the most visited every day since it was published :-)

Iszi

@RoryAlsop They didn't give you one when they asked for proposals?

Rory Alsop

@Iszi No - what we did was submit a list of proposed prizes and prices, which they made the decision on

Jeff Ferland

2:39 PM

That reminds me I need to get a talk submitted to Shmoocon

Lucas Kauffman

4:29 PM

Ed skoudis talking atm about cyberwarfare

Scott Pack

4:44 PM

@RoryAlsop Except so far today

Rory Alsop

4:59 PM

@Scott has the competition post beaten it now?

Scott Pack

@RoryAlsop For today? So far.

Rory Alsop

Cool. Tricky to see the stats on my phone:)

Jeff Ferland

5:16 PM

@LucasKauffman You at Derbycon?

Scott Pack

5:38 PM

@RoryAlsop Not surprised.

@JeffFerland I think Skoudis may be at Brucon right now.

Lucas Kauffman

5:56 PM

@jeff Brucon

Lucas Kauffman

6:26 PM

Btw need opinions, sans 560 or oscp?

Scott Pack

6:39 PM

@LucasKauffman I went through OSCP, but a big work thing fell on me and I never actually got enough practical experience to do the exam.

@LucasKauffman I thought it was pretty good. Definitely very hands on.

@LucasKauffman It's a lot like being thrown into a tank and told, "Somewhere in the tank is a secret panel. Find the panel, pick the lock, get the key. Then go find the other secret panel, pick the lock, use the key, get the harpoon gun. The fiendish dire sharks will be released in 45 seconds."

I've never done SEC560, but I am going through SEC503 now. It is pretty good content, I hear that most all of the SANS stuff is pretty good.

Lucas Kauffman

Mmm oscp seems more challenging then

Scott Pack

Also fairly cheap

As I recall it was about $700 for the course including certification exam.

Lucas Kauffman

Yea it's only around 1k I loose a lot more with sans

Btw how is recerting?

Scott Pack

que?

Well, no matter how much clarity you give to the specificity of your question, the answer will still be I don't know.

Lucas Kauffman

7:34 PM

@ScottPack thanks :)

didn't see @RoryM a lot though

we said hi once and then I never saw him again xD

Gilles

7:48 PM

@ScottPack he tried something which should have worked, said that it didn't work without saying in what way, and never responded to requests for clarifications. NaRQ

Scott Pack

@Gilles Ah. Jerk.

Gilles

10:41 PM

1

Q: Can't launch Snort on CentOS 6.3

I have a problem installing Snort on CentOS 6.3 in a virtual environment. When I run snort - ./snort status: Running in packet dump mode --== Initializing Snort ==-- Initializing Output Plugins! Snort BPF option: status pcap DAQ configured to passive. Acquiring network traffic from "eth...

centos pcap

Iszi

11:34 PM

@Gilles Proposing migration? It fits on U&L. (Or maybe SF) Some of our guys might have good input, though.

Gilles

@Iszi no, advertising the question to an audience who might know

I don't know if this is a snort issue or a more general Linux networking issue

Scott Pack

On the plus side, I think I have a notion where it all turned to shit.

Iszi

@Gilles Ok. Just trying to clarify what you were after. Thanks.

Scott Pack

On the downside I'm afraid it might be quite the rabbit hole to figure out who did what and where to make it explode.

@Iszi Gilles has usually been pretty good at explicitly asking for action. I think we can assume a random question will be advertising.

I'm a little scared by the "used a GUI called BASE" bit.

It has admittedly been a number of years, but my memory of BASE is that of a web interface reporting engine on alerts.

Iszi

11:51 PM

So, I just figured out that if I got a second car that averaged around 27 MPG, and made that my daily driver, I could save enough in gas & tolls to make $300/month payments on that car.

Thank you, Excel.

For @JeffFerland, from Infosec Reactions, "How I picture Schmoocon's server when registration starts":

Jeff Ferland

@Iszi Now what if you change it to a 60MPG Ninja 250 that costs <$5,500 including full riding armor?

Iszi

@JeffFerland Not worth the cost to my sanity via spousal disapproval.

But, I could have said bike paid off in a little over a year.

Transcript for