The DMZ

Rory Alsop

14:00

@ScottPack dunno - it's some religious thing, right?

I'm just in it for the pancakes

Scott Pack

I'm reading the wikipedias

About all I know about Catholics is that they have lots of kids and their senior leadership wears a funny looking hat.

Rory Alsop

@ScottPack and has resigned

I did hear that one

Andrew

@RoryAlsop A local pyrotechnics company?

Scott Pack

@RoryAlsop Oh sure, I heard that one too. Apparently he got a better paying gig as Emperor or something.

Rory Alsop

@Andrew yup - they do a lot of the Edinburgh Festival fireworks. And I need better pyro for my gigs

@ScottPack that was Ming, wasn't it?

Andrew

14:03

@RoryAlsop When I was young, pancakes were irreparably linked to the defense contracting industry.

DW$(T$#G

Wait

@RoryAlsop You're in Edinburgh?

Rory Alsop

yep

Scott Pack

@RoryAlsop While Benedict the Merciless does have a nice ring to it, he looks a bit more like Palpatine than he does Ming.

Rory Alsop

@Andrew well - in the suburban belt

Terry Chia

@ScottPack hahaha

Rory Alsop

@ScottPack oh - he does, doesn't he

Andrew

14:03

@ScottPack I have a lot of friends there at Edinburgh U =) I studied in an intensive language program in China with them. Is this related to the arts festival?

Scott Pack

@RoryAlsop Unsee it! I dare you.

Terry Chia

Did you guys hear about the supposed prophecy that the next pope is the last?

lynks

'cyber' appears 36 times in this article bbc.co.uk/news/uk-politics-21414831

Terry Chia

listverse.com/2011/03/11/top-10-prophecies-you-dont-know

Scroll down to #3.

Rory Alsop

@Andrew Well the Edinburgh Festival is a collection of festivals - biggest in the world. Fireworks every night of it, and the conclusion is an epic explosives-fest

lynks

14:05

@Andrew where in China did you study?

Scott Pack

@RoryAlsop And by "epic" you mean "pissed on cider"?

Andrew

@lynks Dalian...I don't have chinese language support on this computer or I'd use hanzi

I guess I could install google IME...

@RoryAlsop Oh I had no idea....I just know a friend runs the book store for the arts festival?...and apparently he loves it.

lynks

@Andrew cool, I studied in Beijing

Rory Alsop

@ScottPack possibly - will ask the guys this afternoon :-)

Andrew

@TerryChia By the way - am I supposed to be using things like w3af for that website, or is that cheating?

Terry Chia

14:07

@Andrew Which one? smashthestack?

Scott Pack

Mmm.....cider

Andrew

@lynks I thought about that, but the pollution scared me away. I heard Dalian was a vacation city so I went for it

Rory Alsop

@TerryChia surely you just don't hire in someone called Peter from Rome and all will be well? End times averted, and all that?

Andrew

@TerryChia Yes

Scott Pack

I got a carboy in the basement. I should make a batch of cider.

Terry Chia

14:08

@Andrew No clue. I think you are supposed to do it manually.

@RoryAlsop Heh. I'm not a Catholic. Don't ask me. Just some random fact I picked up when reading listverse.

Andrew

@TerryChia I mean, I just kinda pointed w3af at the first level with some modules enabled and popped out an answer, and I felt....like my prize had been taken from me. So, I think I'll do the rest manually.

Terry Chia

@Andrew Heh. Which wargame are you attempting?

Andrew

@TerryChia logic?

Terry Chia

They updated the first level of io to make it harder. It used to be braindead simple.

Andrew

@TerryChia I just picked the first one, level 1

Terry Chia

14:10

@Andrew Ahh, have not tried that one yet.

lynks

io is awesome

Terry Chia

@lynks Level 1 used to be just running the strings command. They changed it to involve some slight reversing engineering.

Scott Pack

Hold a tick. Pope Benedict founded the Benedictine Monks who symbol is an olive branch? Do they also hole services with toasted bagels?

Terry Chia

But yeah, io is fun.

lynks

@TerryChia strings command is 1337. Almost as 1337 as the file command.

Terry Chia

14:12

@lynks Not as 1337 as reboot. DOS is what the pros are doing now.

lynks

@TerryChia theres a reboot command? All these years ive been doing shutdown -r

Rory Alsop

@ScottPack Eggs Benedict

Terry Chia

@lynks What is the markdown syntax you used btw? I keep forgetting.

@lynks Yeah.

Not sure if it's standard but the RHEL/Ubuntu distros have em.

Andrew

So uh, on a side note

Would you guys mind supplementing my reading list =P?

lynks

you mean like this? backtick is the delimiter, way over on the left of your keyboard

Terry Chia

14:15

@lynks Ah right..

Scott Pack

@Andrew que?

Andrew

I mean, book recommendations

Terry Chia

reboot just calls shutdown apparently. linux.die.net/man/8/reboot

Rory Alsop

@Terry - you can look at the content of posts here ifyou want to see the markdown (it's what I do)

Terry Chia

@Andrew lightbluetouchpaper.org/2013/02/04/…

Scott Pack

14:16

@TerryChia Right, but it helps keep your stupid muscle memory from doing a shutdown -h now when you meant -r.

Terry Chia

I'm going through it right now. Pretty good read from the first two chapters.

lynks

@TerryChia heh, i know all the guys who post on there, in person.

Terry Chia

@ScottPack Yeah, shorter as well.

Scott Pack

@TerryChia Bitches love short commands.

lynks

@TerryChia oh wait, you meant the book, not the blog. yeah I have that too, really great broad cover of topics.

Andrew

14:18

Thanks =D

Terry Chia

@Andrew I can recommend the nmap book as well if you are really interested in port scanning. I picked up a few good bits of knowledge from it.

Scott Pack

Any particular topic for your reading list?

Terry Chia

This book has been highly recommended to me by @Polynomial on the topic of reverse engineering: amazon.com/Reversing-Secrets-Engineering-Eldad-Eilam/dp/…

lynks

**for crypto:** Applied Cryptography by Bruce Schneier
**for general security concepts:** Security Engineering by Ross Anderson
**for windows internals and malware:** Rootkit Arsenal by Bill Blunden

Terry Chia

About halfway through it, pretty good.

Polynomial

14:21

@TerryChia Yeah, that's a pretty good one for learning about compilation artefacts.

@lynks And that Winternals book ROCKS.

also, Windows Internals 6th Edition by Mark Russinovich.

5th edition if you're targeting Vista.

lynks

i have all the books mentioned so far :P

Terry Chia

@Polynomial Yeah I picked that up as well. It's really more a reference book.

Polynomial

@TerryChia Yeah, though it has some great descriptions of how certain operations work in terms of flow, e.g. thread creation

which can be incredibly useful to know if you want to screw with that flow.

Terry Chia

I think @Andrew has enough recommendations to last a few months. :P

AviD

@lynks for secure coding: Writing Secure Code

Polynomial

14:25

@AviD That book is a little outdated now, though, isn't it?

AviD

@Polynomial last time I had a look (2nd edition) it was almost all still relevant.

only a little bit was technology-specific, the majority is agnostic.

though it has been a few years since I looked at it...

Polynomial

I meant more along the lines of new attack vectors that aren't discussed.

I vaguely remember something in there about password hashing that was horribly outdated.

lynks

local bear spike

Polynomial

@lynks That'd make a good band name.

Andrew

Which Nmap book? Also the security engineering one looks great - but I got a ton of theory like this already (My major is in information security - they just don't teach us the technical side, all theory) Also I have that book on reversing, and it IS good
@ScottPack Particular topic? Well, I'm pretty familiar with all the theoretical concepts behind security and I'm looking for more applied stuff. I recently finished violent python and found it ~ok and finished "advanced penetration testing for highly secured environments" and while instructional I was a bit upset with the reliance on vulne…

Terry Chia

14:28

@Andrew nmap.org/book

It's mostly a nmap manual, but it discusses a few helpful tricks when it comes to port scanning.

It's quite an entertaining read for a technical book as well.

Andrew

@TerryChia I have the pdf version of that =D

Polynomial

@TerryChia Nah, I prefer the one Hackin9 released ;)

nmap DICKS.

:P

Terry Chia

@Polynomial Hahaha!

Did they go with your trolling article?

That was you right?

Polynomial

yeah it was me, but no

they would have

but I had other shit to do and I had to delay

and they eventually said it was too late

Terry Chia

Awwwh pity.

Polynomial

14:30

would've been epic

Andrew

@lynks Is that rootkit arsenal book the one by Bill Blunden published in 2012?

or 2009

Terry Chia

@Andrew Frankly, since you have a good grasp on the theoretical side of things, books really won't do much.

I'd suggest more hands-on practice and keeping up-to-date on the latest news through blogs and such.

Practice does make perfect after all.

lynks

@Andrew i would have to check, but i know mine is the second edition if that helps.

Scott Pack

@Andrew I agree with @TerryChia. Most of the stuff that you're interested in is a lot of hands on experience based. Books help you get started to understand the basics, and then to help describe new techniques or corner cases.

The latter two are really only helpful if you have a good practical base to build on top of.

Andrew

@TerryChia @ScottPack Yea - that was a worry of mine - I've been looking for an internship/mentor (I have a technical interview Feb. 20th =D) to help me take a concept (subvert SEH by forcing it off the stack when an exception is created, rewrite default exception handler's pointer - which has to be located between ESB/ESP in IA-32..) and writing proof of concept.

@lynks that does help

I'm actually trying to start a club at my university to work on the more salient technical aspects of network/webapp/local security...there's a ton of interest but nobody knows what to start with/teach (I've set up a few VM labs for other people that I've completed, but I'm no professional by any measure)

Scott Pack

14:41

@Andrew I wouldn't freak out too much. It's hard to get good experience like that before getting a job. I certainly wouldn't expect a kid straight out of school to be an experienced pentester.

@Andrew To be honest, I probably wouldn't hired one as a senior or mid grade team member either.

@Andrew In most cases the Junior positions on a team are used (or in my opinion should be used) for hiring people that have technical chops, good instincts, and drive, then get them experience and train them up to be proper team members.

Rory Alsop

@ScottPack yep - this is what we do

Andrew

@ScottPack I appreciate the encouragement =D

Scott Pack

In the US, at least, we tend not to have internships/apprenticeship positions like that.

Andrew

Yea - my internship is with a larger automotive manufacturer

Well, potential internship

@RoryAlsop @ScottPack So, how do you train them?

>.>

Scott Pack

@RoryAlsop From what I hear WhiteHat is hardcore on that line too. Their whole goal is to hire kids straight of college, get them trained up, but give advancement opportunities within the company so they don't go someplace else.

Andrew

14:45

<.<

Scott Pack

@Andrew Put you on a team either doing the drudgery or attached to a more senior person.

For the record, I'm not a pen-tester, but I think that's a pretty general purpose strategy.

Rory Alsop

@Andrew Internally - my last place had a course called "Extreme Hacking" which was pretty intensive. 5 14 hr days trying to break systems, with guidance

but generally you shadow a team

you start off with the less fun stuff - doing the nmap/nessus/etc bit., but sit in with the guys doing the clever bits

Scott Pack

@RoryAlsop Do you have them pick up the coffee and waffles?

Andrew

@ScottPack @RoryAlsop Hmmmm....I'm going to leverage that information, thank you.

Rory Alsop

@ScottPack seems to usually be me, actually... my route to the office takes me past cafes

Scott Pack

14:48

@RoryAlsop I suppose that's alright then.

@RoryAlsop We've got interviews for a student position starting tomorrow. Both my boss and I considered, briefly, bringing in people that had listed nanny experience.

Rory Alsop

@ScottPack heh heh heh

Andrew

@ScottPack Call you the dreamsmasher I will.

@ScottPack New kid gets to his first day of work, first thing anyone says to him "You forgot coffee?"

Scott Pack

@Andrew Oo! Speaking of, let me tell you. Out of the ~45 resumes we received about half of them had spelling or grammatical mistakes.

Andrew

@ScottPack . . . How?

Scott Pack

@Andrew Roughly 60% had terrible layout problems. Then another 20% were poorly laid out, if not outright terrible.

Andrew

14:52

@ScottPack Although I know my way around language well, I wouldn't know the difference between a terrible layout and a good layout.

- for resumes

Scott Pack

This has been our largest candidate pool so it's a great example but not unique. Based on my experience hiring college students if you run spell check, have someone not stoned proofread, and can format it to be readable? You'll be in the top 20% easy.

@Andrew To the Googles!

@Andrew How familiar are you with LaTeX?

Andrew

@ScottPack Never heard of it.

@ScottPack wow, LaTeX is amazing.

AviD

@ScottPack screw that, how familiar is he with linkedin?

Andrew

@AviD I don't use social networking sites . . .

AviD

@Andrew linkedin is not a social networking site (at least, no more than stack exchange is).

Scott Pack

14:55

@Andrew Well, here's a template I've made of my resume. It's generated from LaTeX, but this is the basic idea that you need to think of. I'm not going to say that it's awesome, but it's certainly not terrible, and it's gotten me jobs.

AviD

It's an online interactive resume.

Scott Pack

@Andrew dropbox.com/sh/2fiwr53ttmau4bb/tRQJt0zK_s/…

@AviD I haven't generated a resume from it to see how that looks, I should probably do that.

AviD

@ScottPack I dont even mean using it to generate a pdf, I mean I send a link.

you can have a hella more detail there than any kind of document, builtin recommendations - and the value of those recc's (depending on who gave them, etc), and a whole lot more information.

Andrew

@AviD @ScottPack I'm going to have a new resume and a linkedin by tomorrow it seems.

Scott Pack

@AviD Oh sure, but often when applying for jobs you need to submit an actual document.

AviD

14:57

I've also been using Careers2.0 as a kind of "portfolio".

@ScottPack yes. damn them all to hell.

Scott Pack

The only thing I don't like about Careers is that it's so focused on programmers.

AviD

especially when its through a headhunter / placement agency - they need to change up your resume to show they have value.

@ScottPack while thats still true, you can use it well for other SE sites too.

I think the main feature that is still programmer-focused is the linking to github and such.

Andrew

Actually, I can't do a linkedin - I'm pretty sure that my target employer wouldn't want me having one

Scott Pack

@AviD Oh sure, I've got a page filled out. The last time I looked through it I felt like I was having to skip past too many items because I wasn't a coder.

AviD

@Andrew whaaa?

RED FLAG.

Andrew

15:00

@AviD red flag?

Scott Pack

Yeah...we're pretty uncomfortable with you having a LinkedIn account, oh and would you terrible mind filling out your Facebook username/password here so we can check it out? You know, make sure you're not bad mouthing us privately.

AviD

@ScottPack ^ this

Lucas Kauffman

3

Scott Pack

Oh, good call! You should probably read the Mythical Man Month too, @Andrew.

Andrew

@ScottPack what's that?

Scott Pack

15:04

@Andrew amazon.com/The-Mythical-Man-Month-Engineering-Anniversary/dp/…

@Andrew It has lots of good lessons about how work actually happens in the real world. Useful even if you're not a software developer or project manager.

Andrew

@ScottPack Oh cool

Scott Pack

And this is a good one on how to deal with the situation of having multiple, often conflicting, priorities.

amazon.com/Management-System-Administrators-Thomas-Limoncelli/…

Andrew

@ScottPack I've gotten so many great book recommendations just from spending 20 minutes in the chat here haha

Scott Pack

All too often people like us get so bogged down in technical literature that we forget that we are not computers and that we have to talk to, you know, people.

jrg

@ScottPack I have conflict priorities. Do I go get work done, do I go buy the ebook and read it, or do I just say "screw it" and go do work.

that looks like a good dead tree book though.

AviD

15:07

@ScottPack ah, good point:

amazon.com/Peopleware-Productive-Projects-Second-Edition/dp/…

Scott Pack

@jrg At your age my typical answer was either "Fuck it, I'm going for a hike." or "Time to MUD!"

Colin Cassidy

@ScottPack The frightening thing is that the lessons from that book still have not been learned, and we are still making the same mistakes... I suppose that's why I feel like I'm living in a Dilbert Wonderland at times

Scott Pack

@ColinCassidy My hope is that the people who understand those lessons will eventually outlive, and replace, the people who haven't.

Andrew

@ScottPack Yea - one of my majors is entirely based on that problem; every course requires group collaboration and project management of ~5-7 people. Generally we have 5-7 teams per semester. Right now I'm managing 3 while a member of 3 others. It's a little insane.

jrg

@ScottPack haha.

Andrew

15:09

@ScottPack I played MUDs about...oh...12? 13? years ago

Scott Pack

@Andrew The Limoncelli book might be helpful. The typical SysAdmin working condition is that they are, at the same time; trying to respond to customer demands, deal with incidents, deploy new projects, and plan/implement long term architectural designs. That's what a lot of his book is supposed to help you figure out how to deal with.

@Andrew I had quit by that point, but yeah. I moved on to tabletop when I was in college.

Andrew

@ScottPack Yea - I've made a "SE Book List". I'm hoping to review it this weekend and see about which books I'm pretty solid on and which ones seem very unfamiliar.

@ScottPack I played them when I was ~10-12

@ScottPack thereabouts.

Colin Cassidy

theregister.co.uk/2013/02/12/uk_cyber_skills_shortage Jobs for life people :)

Scott Pack

@Andrew I wasn't much older than that when I started, but it was on an Amiga 1000 with an external 1200 baud modem.

God you people are making me feel old. You need to start talking again, @RoryAlsop.

Rory Alsop

@ScottPack busy working

Terry Chia

15:15

@RoryAlsop right...

Rory Alsop

hahahaha

Scott Pack

@RoryAlsop The best part of thesis day is how frequently I get to wait on data collection or processing.

Andrew

@ColinCassidy I wonder if the allies extension would apply to an American seeking employment for the UK doing IS.

Rory Alsop

@ScottPack amusingly I've just had to pass a definition of data processors and data controllers across to a colleague (for some data protection work)

Scott Pack

@RoryAlsop I thought you were on gardening leave?

Colin Cassidy

15:17

@Andrew might depend on the specific areas, I would think that critical infrastructure may be treated differently. I know this is the case in the US, I did ask :)

Andrew

So, our computer labs on campus alternate between open lab time and classrooms throughout the day

Rory Alsop

@ScottPack nah - was hoping for that. Didn't happen.

Andrew

I was listening to music and missed the fact that a professor and class sneaked in and began . . . education

Scott Pack

@RoryAlsop Too bad. My landscaping needs tending.

Andrew

I think I'm in comp sci 100....the freshman next to me smells like cheese popcorn and mountain dew

Scott Pack

15:22

@Andrew Oh, so he must be a Computer Science student.

AviD

@ScottPack ... because he's in comp sci 100?

Great deduction there, Sherlock.

or rather, abduction.

Scott Pack

@AviD No, because he smells like cheese popcorn and mountain dew.

AviD

@ScottPack .... while sitting in comp sci 100.

Is there a 100 class? I thought they start from 101.

Scott Pack

@AviD It depends on the school, often the CS101 class would be "This is a mouse, it goes clicky clicky" level.

I TAed MATH 091 and 093 while I was in college.

AviD

@ScottPack whoa. no prerequisites at all?

Scott Pack

15:29

@AviD Almost definitely not. That's the point of the 100 level courses. Those are the basic general education level.

Andrew

I'm not a student of the class - I just didn't manage to escape before it started

Scott Pack

@AviD Sometimes there may be pre-reqs. For example, at the Math department we had (to the best of my memory) 3 100 level math classes. "General Mathematics and Problem Solving", "College Algebra", and "Calculus 1".

Andrew

@ScottPack My university is also like that.

Scott Pack

@AviD College Algebra and Calculus did have pre-reqs, but they were pretty minimal. You either had to have an ACT math score of X or have taken the next course down.

@AviD All of them counted as your mathematics general education requirement for graduation. Some programs required a specific one, but the idea was that none of them necessarily required you to have had a precious course.

Andrew

@ScottPack CS100 here is an intro C programming course - mouse goes clicky clicky is addressed in "Information Sciences and Technology" 110, but most kids these days simply don't need it.

Scott Pack

15:32

Calc 2, however, required that you have had Calc 1. You could, however, get into Calc 1 just by showing that you could do it.

@Andrew Ah. My undergrad didn't have a CS100, we used Intro to Algorithms for that, it was a 200 level.

Andrew

@ScottPack Oh, CS100 doesn't cover mergesort or anything. The majority of their work is generally: "Write a program that generates five random numbers"

@ScottPack So, stuff my high school covered.

Colin Cassidy

@Andrew cryptographically secure? and you wonder why our software security sucks... :)

Scott Pack

@Andrew That's pretty much how ours was too. It was in a bad situation, though. The Business department, through their MIS program, had been offering the programming classes for nearly 20 years before the CS program came into existence.

Andrew

@ColinCassidy Hah, of course not. If you said "entropy" to a freshman . . . He/she would certainly faint.

Terry Chia

Hmm. And I thought my school was bad...

Scott Pack

15:36

@Andrew The University Curriculum Council wouldn't let CS have a programming class, because CoB already did that, so they used the Intro to Algorithms to get in the CS programming stuff. Then used a second Algorithms course to focus more on actual algorithms.

Andrew

@ScottPack We have an issue with that right now - our information and cyber security (I hate that word) program sends students to the CS college for ASM

Scott Pack

@Andrew ASM?

Terry Chia

Ah well.. university is still about 4 years away for me.

Andrew

@ScottPack assembly

We cover 32 bit architecture over two semesters and 64 bit architecture over one semester

for the security program

Scott Pack

@Andrew Ah. We went to the Electronic Tech department for that. They had nice setups for circuit building and programming on a 68000 series.

Thomas Pornin

15:39

@Andrew This is weird. I suppose you mean that you cover 32-bit x86 architecture in two semesters, then 64-bit x86 for one more semester

Scott Pack

@TerryChia Wow, in the States you would be going to college now.

Andrew

@Thomas Yes

Scott Pack

@Andrew You should tell your teachers they're a punch of pussies and that they should work with SPARC instead of x86.

Andrew

@ScottPack We don't touch hardware - that's entirely EE now. Everything we do is on VMware

Terry Chia

@ScottPack I'm doing a diploma program in something called a polytechnic over here. Not sure what the equivalent is in the states.

1 more year to graduate. Then about 2 and a half years of national service.

Thomas Pornin

15:41

@ScottPack Alpha is better.

Andrew

I should probably clarify: We have five computer science colleges with several majors each and ~3 options per major

Information Science Technology, Computer Science, Security and Risk Analysis, Management of Information Systems, and Electrical Engineering

IST/CS/MIS/SRA do not touch hardware beyond a keyboard, mouse, and screens

Terry Chia

Wow... digitaltrends.com/lifestyle/…

Ladadadada

@ScottPack I was handed that book by my boss within 6 months of becoming a Sysadmin. Bought my own copy about 4 months ago.

Andrew

EE/MIS don't program

IST is CS with some project management

I guess we also have comp ENG

Scott Pack

@TerryChia We have polytechnics here, but to my understanding they tend to be more hands on technical schools as opposed to the liberals arts.

Andrew

15:44

well, anyway, our "infosec" major is actually a sub-option of security and risk analysis (an extremely political major that requires US citizenship) which is basically what I was getting at

Terry Chia

@ScottPack Hmm. Over here, people my age either go to a junior college to take the GCE A Levels, or a polytechnic for a diploma. We have a wide range of diplomas though, , business, sciences, design and IT.

Andrew

we need a broader acceptance of technical schools by parents here

There are many unmotivated students who come to university just because their parents basically force them to

Scott Pack

Tell me about it.

Terry Chia

Eh. I have to go for a degree. :( Scholarship terms..

I would very much rather find a job after getting a diploma.

Andrew

@ScottPack You mentioned you do some hiring, and you're obviously in the security community. As a result I want to ask whether GPEN/GXPN are worthwhile or not - I've seen mixed reviews (To be more specific I'm talking about the SANS 560/660 classes and the attached certs).

Scott Pack

15:55

@Andrew I've never been involved in hiring a proper security person (I'm still the most recent hire from back in 2008). I, however, would put technical value in the GIAC certs.

@Andrew The SANS classes I've seen are pretty good, and while there's always limitations to standardized testing, they seem to do a good job of making them actually test something meaningful.

They used to have multiple tiers, with the highest tier requiring something akin to a research paper.

Andrew

@ScottPack Thanks! I was considering (if I get this internship) using the money for those two classes.

Scott Pack

Phew. SANS is butthurt expensive.

Andrew

Yes.

~5000 per class.

Scott Pack

Then another 500-600 for the cert.

Andrew

Yea...

I really hope it's as good as it claims. I'm also planning on doing PWB really soon (after I find out about the internship)

Lucas Kauffman

16:13

Scott Pack

I don't know that you'll get a whole lot more out of it than just 560.

Lucas Kauffman

I'm going for OSCP this year and SANS next year

Scott Pack

Isn't OSCP the cert that follows the PwB course?

Or has muts changed things up?

Lucas Kauffman

@ScottPack yea

and its super cheap

compared to sans

Scott Pack

Quite right.

Lucas Kauffman

16:15

exam retakes are also only 60 dollars

Scott Pack

Oh, and with PwB you get swfs of all the videos, with SANS OnDemand you have to stream them online.

Lucas Kauffman

@ScottPack Im also doing the security tube courses now as a preparation for PwB

they are even cheaper and give you all vids for downloa

Scott Pack

I need to get back on 560. I'm afraid of when my time might run out.

Lucas Kauffman

@ScottPack you still have few years ahead of you

Scott Pack

@LucasKauffman Qock.

Rory McCune

17:23

@ScottPack @andrew yeah I did the SANS Oracle cert, and it was good and the experience of doing the gold cert was valuable, but I only did it when my employer was paying, 'cause their prices are ridiculous.

Lucas Kauffman

17:34

I still think PwB offers the best value for money and its cert actually proofs that you can actually do a good test and react in unexpected situations

Scott Pack

17:45

@LucasKauffman Uncontested.

It's the next best thing to SANS 560 at a fraction the price.

jcolebrand

I'm curious if I should ask my question on sec.se or somewhere else: Trying to narrow my topics

Rory Alsop

Heh heh heh - Professional pyro is fun! Check out the gallery at www.21ccfireworks.com

jcolebrand

Basically, we're using WIF in our .NET WCF services layer.

jrg

ignore me, i can't scroll.

jcolebrand

But it's causing us grief (slowdowns on the order of 10s + on many requests)

Is this a site to discuss such issues, and to help understand either why it's slowing down, or to understand the ramifications of removing that code?

Scott Pack

17:56

@jrg Silly boy.

Rory Alsop

@jcolebrand it sounds like it could just be a config issue (which wouldn't be on topic) but can you give us a bit more info

what is WIF configured to do

jcolebrand

@RoryAlsop I'm out of my league on that one. There's a discussion floating around, so I'm trying to wrap my head around it

What I know is that my webservices are taking 10+s to return, and it's unduly impacting the UI experience

Lucas Kauffman

@jcolebrand serverfault is probably your best bet, but you'll need a very good formulation as well as configurations stated in your question

jcolebrand

Some of the backend devs are debating if they should remove it

I'm all for simplifying the codebase.

When I walked in the door it was over 5m LOC

Lucas Kauffman

@jcolebrand Legion of Crips?

jcolebrand

17:59

Might as well have been for all the productivity we were seeing

Transcript for