« first day (145 days earlier)      last day (5033 days later) » 

00:33
@ScottPack One "great answer" will definitely do it, if the user has linked accounts.
@Iszi Thanks for restating my point :)
00:52
Urrrgh. Running scans on these systems is so slow. Two entry-level netbooks and a really old laptop. The words "woefully underpowered" come to mind.
01:12
Are those the targets or the scanners?
@ScottPack Regrettably, in this case, they are one in the same.
From what I can tell, only one of these systems (one of the netbooks) actually got infected by anything. The other two belong to someone whose Facebook account looks like it got hijacked, either by hack or malicious app.
How ick
Also, I hate trying to schedule con slots. Always a pain.
01:28
The one infected system caught a fake AV. Windows was alerting to it as Rogue:Win32/FakeSpypro
Did the manual removal on that one, and now running MBAM and Avast to confirm.
Have you had any issues with Ponmocup?
Haven't even heard of it, so I'm gonna say no.
Hrm.
C:\HP\Bin\EndProcess.exe is infected by Win32:KillApp-W [PUP]
Sounds like a common false-positive to me.
I wonder if it would be acceptable to have a CW here of places to download and/or verify the latest versions of common plug-ins like Flash, AIR, Acrobat Reader, Java, etc.
Some of them are easy enough to track down, but it can occasionally be trick to find the non-bundled packages.
01:48
I could see that becoming a nice CW/FAQ
Well, this is just... odd.
So, the DHCP range of this /24 is .100-.149
There's maybe a total of six devices that ever use the network.
Yet, for some reason, I'm getting handed .144
And still, the DHCP Clients Table on the router/AP is empty.
Methinks I'm going to try a router reboot. BRB. Wish me luck.
No good. Still getting higher addresses than I should.
It depends on how the DHCP server was implemented.
Is it using ISC or something else?
It's just a Linksys SOHO router.
02:03
Based on the range, that was my next guess :)
That's not uncommon. I'll often see them hand out addresses kind or randomly around the range
Problem is, it wasn't handing out addresses at all for some devices earlier.
Makes me think the DHCP pool is getting unnecessarily crowded somehow. But, the clients table is empty.
...okay, now the clients table isn't empty, but it's still emptier than it should be.
I think I'm just going to make reservations for the stuff that is always going to be here, so at least those devices shouldn't ever have problems.
That is assuming the device itself isn't acting wonky.
I'd hate for that to be the case. I'm the one that picked it out for her.
I don't have a lot of recent experience with those things, but I do recall the WRT54 and BFSR series having lots of problems locking up.
The BFSR especially seemed to not clean up the translation tables quickly enough, so doing things like torrents would cause big problems.
I actually set mine on a lamp timer to turn off for 15 minutes every day from 4am to 4:15am
I suppose that could work around here. Not at my house, though. I'm actually up that late, from time to time.
02:10
Kids today....
She does have a network printer on the wireless... I'm pretty sure I set it static and out of the DHCP range, but who knows... Maybe that could be causing trouble if it's in range, even though it shouldn't.
Eew. It's in range.
What the heck was I thinking?
An early classic from the Morris paper that invented password hashing: Experience with several earlier remote-access systems showed that such lapses occur with frightening frequency. Perhaps the most memorable such occasion occurred in the early 60’s when a system administrator on the CTSS system at MIT was editing the password file and another system administrator was editing the daily message that is printed on everyone’s terminal on login.
Wait... it's not just in range - it's DHCP.
Seriously, what was I thinking?
... Due to a software design error, the temporary editor files of the two users were interchanged and thus, for a time, the password file was printed on every terminal when it was logged in
Hey, remember the good old days when shadow files were non-default? Good times.
02:17
@ScottPack Well, it didn't cause any problems that I've heard of for a decade or more after it was deployed....
And even now it is just window dressing until someone hacks your system. You just want to have good hashes....
and good passwords....
That is a really funny anecdote. That's a pretty substantial bug when the tmp files weren't just clobbered, but actually interchanged.
indeed
@nealmcb Oh sure, I consider that level of compromise pretty much end-game anyway.
good password hashes known since 1978. Still not deployed most places on the web....
However, since the passwd file must be world readable, it slightly increases the risk profile.
Unsalted md5 should be good enough for anyone.
02:26
Urgh. My 7th-grade science lessons escape me. Could someone help this guy out, by explaining the scientific differences between hypothesis, theory, and law?
1
Q: "Hypothesis" and "theory"

Third IdiotMy basic knowledge of these two words is that they both mean the same thing. So why are they used differently, and what is their difference in meaning?

G'night gents
@ScottPack G'night
03:12
Sometimes I wish you could just downvote a comment.
1
Q: What is meant by channel id > 100 in 802.11?

narayanI was sniffing the in air with my Alfa card. I captured few packets with channel ids > 100. I did not get time to look at the packets. But is it possible to have channel id > 100. What I know is channel id is in between 1-14. How it can be 100+ ? Is it possible?

 
5 hours later…
08:02
@Iszi Moved it - I agree with you and @Avid
08:25
@nealmcb ... you'd spotted my voting behaviour over the past week then:-) 15 more needed:-)
09:18
@ScottPack I remember the days of a particular, nameless, Virtual Memory System that had shadow passwords but not encrypted passwords :P
@GrahamLee wtf?
@RoryAlsop yup, SYSOP could read everyone's password. That wasn't its most hilarious issue though
The best bit was that the password-comparison function was, to put it politely, strcmp(), so it took linear time in first incorrect character position.
oh dear lord
i.e. if you got the first character wrong, it failed really quickly. If you got that right and the second character wrong, it took a bit longer. And so on until you logged in :D
10:01
This question isn't getting any love here - I'm looking at it thinking it could be a useful migrate to SU as the crux of the question is around autorun configs. What do you folks think?
0
Q: Is it possible to by pass auto run restrictions on windows 7?

WZeberaFFSI'm trying to create a startup on a windows 7 for the machine and current user (its a workstation meaning all user data is saved on a server). What i mean whit a startup is to have a program run at login producing the same result as to put a registrar value in bout: HKEY_USERS\Software\Microso...

10:11
@RoryAlsop go for it.
 
1 hour later…
11:24
That might also fit over at SF as well. Fiddling with autorun settings is easily an enterprise desktop management thing.
@ScottPack - Hmmmm - SF or SU. Yeah, both work...
11:39
I see it as being about intent.
Is he trying to do it on a single machine, or does he want to be able to push it out to many.
or what tools would be in use.
If he's using GPOs or SCCM, even on one machine, that's definitely SF.
Breakfast time over.
12:39
I came across another useful userscript, btw
 
1 hour later…
13:52
Dear lord - don't know how else to explain how offtopic this was...
2
Q: What is meant by channel id > 100 in 802.11?

narayanpatraI was sniffing the in air with my Alfa card. I captured few packets with channel ids > 100. I did not get time to look at the packets. But is it possible to have channel id > 100. What I know is channel id is in between 1-14. How it can be 100+ ? Is it possible?

@ScottPack Oooh - interesting
and distinctly useful
I thought so too.
It doesn't happen often, but sometimes I find a SE q/a that's relevant enough to actually print out.
I have done it a couple of times and had to copy and paste into a doc for formatting
And how much fun is that?
that's rhetorical, right?
Pretty much, yeah.
13:59
@RoryAlsop re the trusteer thing
"Trusteer's product is snake oil."
oh - I agree it doesn't do "... protects login credentials and transactions, from desktop to Website, even if a computer is infected with malware."
but what it does do is add a nice layer of protection
so snake-oil - yes, but that is because their marketdroids have pushed the wrong message
exaggeration, not outright lies
If you take that away, doesn't it just do "make sure you're talking to the right server"?
plus "with some checking to prevent MITM" yes
which is a good thing, just not all the wonderful magic stuff they claim
doesn't EV SSL already give me that?
I mean, it gives me that. I realise I'm in the minority when it comes to interpreting SSL certificates.
heh
for a non techy user, the benefit here is that rapport does the EV bit without being vulnerable to a user accepting a malicious cert
14:06
understood, unfortunately my bank doesn't have a "press 4 to indicate that you know what you're talking about, understand risk management and are willing to accept any residual risk" button in their call menu.
@GrahamLee and if they did, people would press it anyway :-)
They could have a ten-question quiz on the SEI's OCTAVE method :D
you should add that in here:
6
Q: How to persuade average people that security matters?

LanceBaynesIf people could be fooled in life so easily ( http://www.bbc.co.uk/realhustle/ ) then in computing.... So what are the best tips, to persuade a regular user to pay a little more attention to security: e.g.: use HTTPS where available, up-to-date softwares, don't log in@a netcafe, don't click on l...

offer training courses
and make it like the X-factor : you can get voted off teh intarwebs for being too security-unsavvy
2
@RoryAlsop I'd rather not: I'm hoping to get the bounty :P
I think you will get it - that's a damn good answer
14:15
thanks blush
/me wonders whether IRC-style /me comments work in here
@GrahamLee - there do seem to be a lot of undocumented things this chatbox does
14:54
@ScottPack Oh - just had a look at the 10k challenge app. C'mon - work harder :-)
3
Q: Server Fault 10k Challenge - Keep Track of Your Progress

George Edison About At the beginning of the year, a group of people made an agreement to each try to earn 10k rep. on Server Fault in the next year. This webpage is designed to make it easy to view progress and track their reputation over the course of the year. License MIT License Download http://c...

15:10
Dude!
I need to get George to update me. My goal was a combined 10k between security and SF.
Doing that makes me look better but I'm still behind.
Also do to this calendar year: 1) Finish thesis and graduate, 2) Take OSP-PWB exam
hahahaha - I wasnt stalking, just trying to find any app which will let us graph security growth over time
Doing your research and writing it up suddenly becomes less important when you get a Real Job (tm) during that time.
/me sighs
15:32
Speaking of which, you could help our my progress by just blindly upvoting all of my stuff. I won't tell :)
@ScottPack - what, did you think I was reading it first? :-)
That takes too long. I vote up everything, except flagged things which I delete.
@GrahamLee LOL - I am certainly finding I hit my vote limit every day now...
oooooh - for mods, we now do have decent analytics data
that must be what @AviD was seeing the other day
with the weekly troughs at weekends
Obviously can't pop it here, but interesting . If you flatten the peaks out it looks like slow growth in new visitors Dec to mid Feb, then a step change in our growth rate until mid April which has now started to flatten out.
Which means we need to do something interesting to bump up visibility again. I feel a blog post or two coming on...
15:50
You ever have one of those times when you're setting up a monitor to see what something does, and in the early stage where you see what everything does, you realize how much activity is actually happening on your system behind your back?
@Iszi (hide it all under the carpet - so you can say you didn't know)
Interestingly - from the stats, we have had a step change in number of Questions and Answers since April 1, which is a really good sign
@RoryAlsop It's my personal system.
@Iszi I guessed it probably was :-)
So, apparently my VPN client does a lot of stuff to the Registry in the background, even when I'm not using it...
@Iszi had that with a certain developer preview of a certain operating system recently. I dropped into the console to see what a particular command did, and realised that the authentication service was restarting every few seconds.
16:01
@GrahamLee You had a dev preview of Badger? Spiffy.
@Iszi oh great, now the killer NDA attack hounds of doom have got your scent.
do they have mod-undelete rights?
:-)
Oh, I forgot that cat isn't officially out of the bag yet. (Pun totally intended.)
NOT ROFLING ANY MORE THANKS @Iszi
16:04
@GrahamLee Ah, sorry 'bout that.
Oh - just saw the sidebar - @AviD, did we decide whether pandas were good to eat and/or kosher yet?
Worst. Pun. Evar!
@RoryAlsop @AviD I thought all carnivores were non-kosher
@GrahamLee Do fish count as carnivores?
I suppose that depends on whether or not fish is considered meat.
So yeah... apparently the Cisco VPN Client service seems to think it needs to do work in the Registry about every 5 seconds.
fish go in the sea and have fins and scales, and are therefore kosher.
16:08
Is it just me, or is something wrong with that?
I'm actually proud of myself. I ran out of all 40 votes a couple of hours ago.
Oh bugger. It's lunch time. I need some lo mein in my belly right now.
I wonder if a question about that would be on-topic for here, SU, or SF?
The kosherness of fish? Probably should be on cooking
Or maybe jews.SE
Pandas are carnivores by descent, but only eat plants by choice - does becoming vegetarian make them kosher?
I always thought that if Ubuntu are going to have a Christian Edition, they should also have Jewbuntu.
Well, not always because Ubuntu hasn't always existed.
@RoryAlsop nope, it's to do with having paws.
16:12
@GrahamLee heh - made me think of the opposable thumbs on cats advert
@ScottPack No, the VPN client and the Registry. Stay on-topic, here. :-P
@Iszi - did you see Bruce Schneier's squids in space post on Friday? Or Charlie Stross's post today?
@RoryAlsop Haven't followed Bruce lately, and hadn't heard of Charlie Stross yet.
Linky?
16:27
he has some brilliant novels - Accelerando, The Atrocity Archive, The Jennifer Morgue, Glasshouse, Halting State, The Fuller Memorandum, Rule 34 (which comes out this summer)
has worked with Cory Doctorrow and is very much in the geek space:-)
17:00
Doctorow? Isn't he that steampunk guy from an XKCD comic?
@ScottPack that'll be the one
you must have read some of his work? A huge chunk of it is free to read at Tor.com
Actually no, I haven't read any of it. That comic is the only way I know his name.
I'll add him to the list, though.
I'm attempting to plow my way through that one Tor product now that it's coming to an end.
Anyone mind helping with an Outlook/Exchange issue?
Well, definitely recommend Cory Doctorrow and Charles Stross
17:15
Guess I'll take it over to SF...
@Iszi Not a huge fan of outlook. If RoryM was here he knows his way round it pretty well
It's a mailbox permissions thing. What's most frustrating is that I've got evidence in front of me that says I've done this before, but I can't for the life of me figure out how.
That seems to describe most outlook issues
 
1 hour later…
18:45
@ScottPack Re: "StackPrinter - The Stack Exchange Printer Suite" - but how does the paper stay current with site activity? Sounds like a design flaw to me :/
With some luck, Microsoft's image will kill Skype off and strike a blow for standards-compliant VOIP....
@RoryAlsop My goodness. Some people just don't get how SE works, do they?
19:23
Y'know, I'm really tempted to tell that guy (and the one or two others who expressed similar sentiment) that they're welcome to raise their issues in Meta, but not to expect them to be well-received.
20:16
Urgh. Trying to figure out how to get Process Monitor to tell me which Registry key this one Control Panel applet is setting when I change a certain thing.
on a side note, have any of you messed with ElJeffe? (by Immunity)
 
3 hours later…
23:22
0
Q: Are GAIC exams open book (Unlike CISSP)?

AbduI have been studying for the CISSP exam to get DoD 8570 compliant. It is a biggie. I noticed that GAIC offers certifications of equal status - BUT OPEN BOOK! Is that true? My boss went into a different 8570 exam expecting it to be open book and was shocked when it wasn't.

Scary - seems like you need a degree in military acronyms to just know what the certification is about....
5
Q: What are the main issues and best practice security controls when exposing SIP and H.323 to the Internet?

frankodwyerWhat are the main issues and recommended controls when exposing SIP and H.323 to the Internet (could be for voice, video, and instant messaging traffic or all three)? Specifically I'm looking for best practices in firewall/DMZ architecture, and any additional recommended security controls, when ...

More scary stuff there - referring to protocols by numbers is even worse than acronyms.
And the notion of protocols using random ports seems like a big problem
23:55
@nealmcb The real scary thing about that guy's questions are that they seem to demonstrate a lack of experience and basic levels of understanding. Not a problem, except that he's attempting to jump nose first into what is largely considered (at least in upper management and HR circles) a terminal certification.
@ScottPack terminal?
Same definition of terminal that is used in academic degrees, so capstone.

« first day (145 days earlier)      last day (5033 days later) »