30,355 reputation
1173148
bio website linkedin.com/in/avidouglen
location Israel
age 39
visits member for 4 years
seen 5 mins ago

Security expert and experienced Windows programmer


Apr
13
accepted AntiXSS for ASP.NET 1.1
Apr
13
accepted What issues are most important to cover in Corporate Security Policy?
Apr
13
accepted Does default ModSecurity protect enough against XSS?
Apr
13
comment How secure are virtual machines really? False sense of security?
Possible duplicate of security.stackexchange.com/questions/2816/… ?
Apr
13
comment strongswan setup for ipsec environment
This sounds like it's a better candidate for serverfault (even though it involves setting up IPsec)...
Apr
12
revised How can I detect users that have requested AD Administrators to reuse an expired password?
edited tags
Apr
12
revised Security Risk of Disabling forceguest in non-AD Environment
edited tags
Apr
12
comment Egress filtering on an office network?
@atdre, Egress filtering is pretty well defined, and the spelling seems to be correct to me (unless there's some weird American/British/European differences, ah @Rory?). See even en.wikipedia.org/wiki/Egress_filtering
Apr
12
revised Is Steganography considered encryption and subject to USA export restrictions?
edited tags
Apr
12
answered Data Encryption and Key Management in C#
Apr
11
comment DNS access limitations
@WZeberaFFS MS DNS definitely does support access control, but I really don't remember the details...
Apr
11
comment Encrypting with Mongo
@Rook Azure is actually used quite a bunch, and is really starting to gain in popularity. Not #1 yet by any means, but steadily gaining percentages.
Apr
11
revised Encrypting with Mongo
edited tags
Apr
11
comment How should passwords be stored if they must be recoverable?
And I believe people who only write exploit code and exclude all else - especially risk analysis - are even bigger danger, because they misdirect limited security resources which might be better spent elsewhere, and cause the (non-security) business to perceive the security industry as hacks focused only on exploits not relevant to the business... So yes, we'll agree to disagree :). Much like compliance experts think that's the most important, and network pros see that as all important, etc, anyone with a narrow expertise tends to see that as the core, and everything else as unimportant.
Apr
11
comment How should passwords be stored if they must be recoverable?
@Rook do you think a car can be made safe simply by repetitive crash testing, without some thought and design? Again, I'm not testing is not necessary, I'm saying it's not all there is. What if the car is not safe when dropped from 50 feet in the air? Or the bulletproof vest wont stop a tank shell (or a rottweiller)? My point is that not everything that can be tested, should be tested (or needs to be) - some things just don't matter. But, I really think we're off context here...
Apr
11
revised How do Azure ACS 2.0 security features compare to ADFS 2.0?
edited tags
Apr
11
revised DNS access limitations
retagged
Apr
11
revised Complexity of web certificate attacks
edited tags
Apr
11
revised Giskismet query, how to select specific data?
edited tags
Apr
11
comment How should passwords be stored if they must be recoverable?
re Mastery - the "act of doing" can only get you past the apprenticeship stage. Yes, it is absolutely necessarily required, but it's not the end of the path, it's the beginning. Yes, any theory (of non-breakability) should be verified by the "doing", however in some cases analysis will tell you that the results of your "doing" just don't matter. And that level of mastership cannot be obtained by just doing, without looking at the bigger picture.