This question might be useful to Joe User, but definitely (IMHO) isn't SE professional quality. Trying to decide if it balances out to a null vote, or if the latter bit is strong enough to earn my down-vote. (Even though it did get an answer out of me.)
When you access a website, lynx provide the option to reject a cookie, what's the point of doing so?
All I thought about is that if you don't accept a cookie, you cookie won't be stolen during a XSS attack, is that everything?
@AviD I think the star feature might have been intended so we can highlight quality insights from our fellow room members. Not sure it worked out quite as they planned...
Some help needed here--->> Using aMule P2P client with Kad/eDonkey. My Kad 'User ID' is hashed and stored in a .dat file in my system. The ReadMe files tell me that Kad uses some crypto hash to hash the 128 bit 'User ID'. How to find it using the hashed value that i have? And of course, how to know which hashing technique is used ?? Doing a google for the hash value gave nothing :(
@RoryAlsop Yes i know that :) But MD5, SHA1 etc. hash values and their reverses are easily available over the net right?? My question was more in that direction- first finding out which hash function was used, and then doing a look-up for the reverse being available... Can i know which hash function was used by looking at the hash value?
@RoryAlsop thank you for your thought leadership, Mr Alsop. I shall now subscribe to your linkedin posts so that I may learn more.
4
The only thing I can think of when I hear thought leadership is Bill Bailey's BBC news sketch. "We are the only ones. Listen to us. Not the others." or whatever it is he's screaming at that point.
@Ninefingers exactly. I hate that too @RoryMcCune.
it's the exact type of corporate speak that drives me away...
it's actually quite a logical phrase, though. It is based on the assumption that only a small percentage of your workers have thought capabilities, the others have to have someone else do the thinking for them.
While abhorent to me, this state of affairs actually is quite typical at large corporates.
@AviD You'd think corporate types would realize when talking to engineers that it is our job to rationalize the seemingly inexplicable and find a logical explanation for it therefore when you come up with something that is basically waffle, our brains process this and flag up all kinds of "no, not right" warning messages.
Smaller companies can't bother wasting resources on incompetents.
@Ninefingers But that would be irrational, based on previous experience.
They have emipricial data that {subset of engineers that work at those large corporates} complain a lot about it, but eventually do just accept the corporatespeak.
Interestingly, those that protest vehemently enough, eventually self-select out of that subset, removing themselves from the equation, and the corporate-types awareness.
The result is a self-causing prophecy - those that put up with it, are ignored precisely because they put up with it; those that do not, are irrelevant and not considered at all.
This is solved for the long term; in the short term, there are always those from the 2nd group who do not yet realize it, and mistakenly believe they can affect a change. Long term these eventually either give up, or give in.
@RoryMcCune heh. my hermitedness is based on philosophical thought process.
I just like it as a model of splitting down people in corporate, it's surprising how well it fits and you can put most people into one of the three camps..
> A secret, resourced organization full of mainland Chinese speakers with direct access to Shanghai-based telecommunications infrastructure is engaged in a multi-year, enterprise scale computer espionage campaign right outside of Unit 61398’s gates, performing tasks similar to Unit 61398’s known mission.
@ScottPack I would. Our office has a 'bring your own' policy, and this guy runs a business from that machine (we share an office with lots of people), I don't know whether he actually uses teamviewer for real. Also, I'm on a fully updated debian so I'm nice and snug. Unfortunately the CEO is on win7, on the same network segment...
I'll try to contact the guy, if he has never heard of TeamViewer, I will be disconnecting the machine and prodding the CEO until he reformats his own machine.
@Tinned_Tuna I will, but as i said. our company lan is out of scope :P I just treat it like a public network. all our assets are serverside, only my machine has access.
I would also recommend immediately calling the fellow and then reporting up your chain to an appropriate supervisor. Particularly for a small team where this doesn't happen often, it's been my experience that they like to know these things sooner rather than later.
@Tinned_Tuna I bet a large amount of money the response is going to be; "oh ok, well I'll have a look when I'm next in" and from the ceo "you should be writing code not unplugging network cables"
@TerryChia essentially, I'm the only person that is remotely technical, and I'm juniorish. Which means people generally don't listen to me. Nobody here has ever had to deal with an incident, the PCs are filled with rubbish that I have no control over or knowledge of. I just try to make sure everything important lives on the server, and that the server stays safe.
> Canada's special operations unit is like a bear alright -- a stealthy grizzly bear that has mastered modern weapons and can silently kill you in the night (so we guess it's more like a group of highly trained humans, which it is, so just ignore the whole bear thing).
@Iszi well, as I am my own boss, I can say that my boss would probably spank me if I tried that.
besides, this time it wasnt so much about that. I think it was the other way - I wanted to run around doing managerial crap, instead of focusing on productive drawing.
But mostly because that word can also be used to indicate masturbation. Frankly, in the US, almost any word can be used to describe masturbation. It mostly depends on the hearing party and the inflection used.
When I was there, I had to deal with the results of a source-code-scanning tool they would use, before releasing a product. The purpose of the tool was to find any offensive or non-PC text anywhere, that could eventually cause embarrasement.
@AviD I remember that the first place I had a job in IT security used to have a similar thing for e-mails. Any which got a number of "points" from a list got blocked. I ended up having to write a regex to work out why it flagged things like "Don't be to hard on yourself" in e-mails...
@RoryAlsop I've been watching too much Numberphile. I was actually compelled to do a Google/Wiki search so I could find out if "ursine number" was a real thing. It appears not. We should find an interesting numerical property of 666 or 66,600 (or both) and define it.
@ThomasPornin Kind of like Irish names are meant to be O'something and the scots are all McSomething (the scots one is kind of true, is funny when conferences try to put all the M's together and there's a lot of scots...)
I get this exception javax.net.ssl.SSLPeerUnverifiedException: No peer certificate when I try to connect to server using self signed certificate.
public class MyHttpsClient extends DefaultHttpClient
{
final Context context;
public MyHttpsClient(Context context)
{
this.context = context;
}
@Ov...
My router's configuration app (browser-interface) has a page for Virtual Server. It has entries I did not create, at least not intentionally using the interface, for Teredo, Skype, Spotify, uTorrent.
I have two questions about this:
1) how did these entries get there in the first place?
2) I ...
Is it sad that I feel like most of my awareness of which Amendment in the Bill of Rights protects which right is coming from news coverage of people claiming the government is trying to violate those rights?
I was wanting to know if the blend in the title of this post provides e-criminals an open field to explore.
What I mean is this: say a fraudster goes and buys a pay-as-go SIM card from a certain Mobile Broadband Network, and tops it up with $10; pays for it with cash - or even, pays someone to g...
I do have a tomcat server that listen on an SSL socket with TLS protocol. When connecting with all desktop browser everything work right. When connecting with Safari on iPad, the SSL handshake fails.
I sniffed what happens but I am unable to understand what is going on. This is the ssldump outpu...
Given that a smart card stores a private key that can't be extracted, it appears that a SIM card is similar to a smart card in these respects.
I need to store (or use an existing) private key on a phone and use that to decrypt data sent from a webservice. I also want the private key store to h...
I want to demonstrate the vulnerability of setuid programs using the TinyCore Linux live cd. That is, I craft a special program, with special permissions, so that it runs as the owner of the file instead of the executing user. These are my steps:
Create a program (see below) with a security hol...
Proposed Q&A site for those who operate motorcycles, scooters, mopeds, and similar vehicles, who are interested or knowledgeable in riding, riding safety, cornering, accident avoidance, and general maintenance.
@Iszi yeah - we think we have it bad in this country, with the RIP act which assumed guilty until proven innocent, but the US sounds ever more scary
just in terms of violating basic rights like free speech, unhindered travel, innocent until proven guilty, reasonable suspicion required before arrest/search etc
It's really sad when common citizens need to consider whole-disk encryption for protection from their government perhaps even more than for protection from thieves.
I find it utterly ridiculous that government agencies can make such policies as these without having to pass them through the Supreme Court. (i.e.: We shouldn't have to wait for someone with the proper support and funding to bring a "test case" to SCOTUS, before our rights will be upheld.)
To be fair, the SCOTUS was never designed to judge constitutionality of laws to begin with. They were simply supposed to be the last arbiter in the appeals process.
@RoryAlsop That guy had already asked questions about the same problem on SO and SF before bringing it to Sec.SE. The SF one didn't involve any code and was barely coherent. I'm glad someone finally pointed him at something that looks useful.
@Tinned_Tuna If HMAC/SHA-256 is broken in the future, then it is kinda your fault for still accepting it to verify integrity of data blobs.
When you accept a set of several MAC algorithms for integrity, your security against alteration is the security of the weakest of all the algorithms you accept. But "weakest" does not mean "weak".
Take the limit: if you do not have a header, and implement only one algorithm, and that algorithm is broken, then you are equally doomed.
@Iszi You voted to close all three, but I answered all three.
@Iszi I get lots of rep by posting good answers to lots of questions.
(which should be obvious)
It so happens that answers on closed questions can still accumulate upvotes.
The only change is that when the question is closed, there won't be extra competing answers. On the other hand, closed questions tend not to attract readers.
Is this CTF thing still ongoing ? This room is peculiarly quiet today.
@Iszi Yeah, they've been using Silverlight for three or four years now.
@Iszi I remember it being a pretty big deal when they switched. I think it was around the same time NBC offered the NCAA Basketball tournament online via Silverlight, which was one of the biggest coming-out events for Silverlight video.