> Nominations for the Infosecurity Europe 2014 “Hall of Fame”
Computing and information security have attracted many brilliant practitioners who have contributed to their advancement. The Infosecurity Europe 2014 “Hall of Fame” recognises the leading lights and game changers in information security.
In 2014 one person will be inducted into the “Hall of Fame”.
You are invited to nominatea maximum of 3 people to be considered for the Infosecurity Europe “Hall of Fame”. Candidates must meet the following criteria:
That security through obscurity is A Bad Thing is received wisdom and dogma in information security. Telling people why something is to be avoided can be considerably more difficult when there is no line delineating what you are trying to ban from apparently effective strategies.
For example - r...
On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, then by extension surely it must be of some value to keep the algorithm that uses the password secr...
I really like Thomas Pornin's insight about "Security through obscurity" versus "Security through secrecy". The latter is doable, the former mostly self-delusion.
@tylerl this came up in the NGINX support IRC channel on freenode, they wanted to recompile the program to hide the 'nginx' version number in the headers, and remove 'nginx' from the headers, to "hide" what the webserver is, but the response was overwhelmingly "security through obscurity" won't help you here.
hence me hunting around for such a post regarding security through obscurity.
@ThomasW. actually ... it's not necessarily a terrible idea. Version advertisement is a feature used in automated bot attacks against servers. Hide your version, and your attack probability decreases measurably. While you prolly wouldn't want it to be the default, it's helpful if the server string is configurable.
same idea as running sshd on a high port number. It doesn't make you safer against a concerted attacker, but it does remove about 99.9995% of the attack attempts.
@tylerl the problem with a complete recompilation on a Debian based system is you have to recompile every time, and you'd effectively have to custom-build the Debian packages, and that's painful for non-devs
@tylerl having said this, there's a lot better ways to harden your web applications from attack (and subsequently, the web server software can be hardened too),
which IMO is a better approach than trying to use security through obscurity
On the one hand, hiding version numbers doesn't make you significantly safer. But on the other hand. Why the f*** are you advertising your version number?
but correct me if i'm wrong, isn't security through obscurity on its own without any actual hardening of your applications or software, and accordingly not fixing exploitable weaknesses in said applications or software, is equally bad?
in context to what brought me into the discussion initially, though, they (some user) wanted nginx upstream to remove the version strings from their things. Upstream was all "Why? Just so you can obscure things?"
my response was like this, that obscurity alone isn't good
i did, however, suggest that they make it like apache did, so that the version string(s) can be hidden.
but meh
as long as we're all agreeing that security through obscurity alone (without any additional hardening of your applications or fixing of exploits and vulnerabilities) isn't sufficient, then all's good :)
(I do question the sanity of new sysadmins, though, a lot of them think "security through obscurity" alone is useful)
I wonder how SE will react if I nominate myself for mod on Arqade saying that I don't really care about the mod position but I want that swag pack they give out to losers.
Hey @DavidFreitag, you are into micro-controller stuff right? If I pick up a board like this what else do I need to start playing around with it? ti.com/tool/msp-exp430g2
so.... go see Buckingham Palace and Big Ben (mandatory tourist spots), wander round the Science Museum (free entry, w00t!), Natural History Museum (also free entry)
it largely depends on what you're into
you could check out London Hackspace on Tuesday (their open day) if you're into electronics and similar hackery
ie: there are cities where old sewage system was used for "hiding in some war, preparing whatever, plotting..." I find those kind of stories amusing =)
if you're of drinking age (I'm going to assume you are) you should come to one of the /r/LondonSocialClub meets
there's a basement board games thing going off on Sunday at 5pm... basically a bunch of people playing random board games / card games / etc. and getting drunk
@paj28 What happened in that case is actually quite simple to explain. The question, its title, and your answer are all worded in a non-technical fashion. They're interesting to a large demographic (because almost everybody uses bank cards), and they're talking about the safety of our money.
@paj28 Another important aspect is the way the question was worded means that it's allows the liberty of having very diverse takes on it. That means more people will write answers -> the "hotness" score of the question will be higher -> The question will be noticeable network-wide -> More votes overall, which, in turn, means more exposure.
All these factors together makes the question a rep-train.
@paj - did you not see my highest scoring question ever (by a factor of 7 or 8) - it was a sort of joke question before Christmas to win a hat, under the assumption that @AviD was going to delete it. It accidentally fulfilled all of @Adnan's rules of reptraining :-)
With data mining tools like Maltego and other correlation tools for large data sets, if we conduct any transactions online assume that these can all be collated to build a good picture of what we do, buy, read etc (hence Google etc).
If a normal person, with a large online history decides to go ...
From a discussion in the DMZ (security stack exchange's chat room - a place where food and drink are important topics) we began to question the difference between how ice and whisky stones work to cool drinks.
Both are frozen, but when ice is placed in a drink it slowly melts, using energy from ...
@RoryAlsop ha ha - yes I did see that... had to blink a few times. Surprised it didn't get closed as "too broad"
@Adnan that makes perfect sense. I guess it's all about the network-wide views and SecSE is a pretty quiet site compared to some of the others
I would like it though if some of the more technical Q&As got more credit... perhaps some kind of weighting factor so a vote from a person with high rep on this particular site counted for more
Yeah - my take on them is that the really big reptrains gain us new users, and while a good portion are probably high noise, low value, non infosec professionals, some stay and contribute so on balance they are a positive, whereas the really good complex infosec questions will never be reptrains, as the audience is too limited
@deed - I promoted that physics question here, so it got some odd publicity :-)
@deed - kinda. Depends if you like rock music. If so, then yes. Otherwise I'm probably a noise producer :-) (I also moderate the Music Stack Exchange...)
@deed02392 Hmmm.. reminds me of myself 7-8 years ago. I feared external judgment a lot. Until one day I decided to post some of my code online and was told my code sucked. Then I worked to make it suck less. Then I was told it's a bit better.
Later, I started on Stackoverflow. That taught me a lot.. A LOT.
For music, the Internet is so huge the vast majority will not notice or care, some folks will like it, others will rant at you no matter what. At least having it available means you can show others and ask for comments from those whose opinions you trust
Did you see the pictures I popped up on here last night? At Securi-Tay this year because there were only 2 Rories, the organiser announced that it would still be a Rory track, and the other speakers actually changed their slides so they were allcalled Rory
@Terry- the main reason for this is the framework is a wix.com site, and I have just bodged together some sections in html5. I haven't learned the newer html stuff yet, so can't yet build a standalone one
Oh - yes, but I don't have any current licences. For graphics, Erik designs them in PS (or I use Gimp) but for layout I just either write sites using notepad, or I grab modules in wix using html5
Wix also has fan club / membership capabilities - which we want to roll out this summer prior to next album launch
to be honest, when we do it properly, we will have control of server, options, language etc etc etc - but this was a quick and dirty by a non-qualified numpty (ie me)
Looks like I'll end up sending to the Rories, Tildal, and Lucas.
Oh, for some of you who are wondering about the reason behind this sudden generosity. Well, long time ago I had a decent amount of Bitcoins and a while ago started selling them. I've made a very decent amount of money. So.. yeah.
@kiBytes Just remembered, DC4420 is running on Tuesday night, you should definitely not miss it! Central London, beer, security folks, short talks. Always a laugh. dc4420.org
@Adnan well, if you do fancy throwing any beers my way, my email address is my twitter handle at gmail dot com (or decode this if you don't know my twitter handle... Z3N1YmVybGFuZCBbYXRdIGcgbSBhIGkgbCA8ZG90PiBjMG0= )
@RoryAlsop It's not really an appreciation gig or anything. It also has nothing to do with me liking the person. I just feel like spending some of that undeserved Bitcoin money, and the choice of recipients is purely based on convenience
