1,111 reputation
268
bio website wernercd.com
location Delaware
age 36
visits member for 4 years, 8 months
seen 11 hours ago

Data Analyst Programmer (Primarily C#)


Jul
31
comment Is my modem compromised?
@wuiyang I recommend a chainsaw followed by gas. Make sure you do it in a well ventilated room or outside.
Jul
29
comment Could malware move during a scan to avoid detection?
Assuming the malware doesn't have "lower" hooks... The question becomes, who has the lowest level hooks? If the malware/rootkits hooks are low enough, they can lie well enough...
Jul
2
comment Unsubscribe safely
@LorenPechtel Personally, I would put those in Bad(Unknown). If Dewalt sends me an email because they got my Address from Lowe's - it's still not something I personally signed up for IMO (even if the small print says Lowe's will share with affiliates). It's unexpected and gets the Report Spam Gmail Salute from lil ole me. It's more of a grey area, since I "trust" "Lowe's".
Jun
30
comment Unsubscribe safely
@JaredBurrows Well, I assume (You know what happens when you assume?) it would be. CURL is going to be simpler - no plugins like Flash, javascript, etc - so that would mean a smaller attack surface. On the flip side... Good and Bad messages can be linked to a secondary page that requires interaction: Are you sure you want to do this? Why? Do you not care about our children? Is it really you clicking the link or are you lying to us (and our poor destitute childred)? that CURL wouldn't be able to interact with.
Jun
30
comment Unsubscribe safely
@JaredBurrows I don't think "how" you click a link (In the gmail web app, in outlook, copy/past link into Netscape Navigator or sending a pigeon... or via CURL) matters in this regard. The question is do "They" know "this" email address is active? If you respond to it in any way, they do. If it's a company you deal with (etc: Lowe's), the know you use this email and the question of "is this email active" is irrelevant so click away... if it's an unknown company, they don't know until you "respond" - even if via CURL.
Jun
30
comment Unsubscribe safely
@Nrc if it's unclear, I'd personally err on the side of not clicking. (or clicking "Mark as spam" in google and forgetting about it)
Jun
30
comment Unsubscribe safely
@Danny. I have heard that is better to **never click to any link in an email**. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails? - Emphasis/paraphrase: "ANY link in ANY email". "Undesired" could be stuff you signed up for (like Lowes Weekly Specials in my example). I would say this question is more broad than "bad".
Jun
28
comment How critical is it to keep your password length secret?
Or lying to waste effort: I have an 18 long(when really it's 16... , or vice versa)
Jun
12
comment How is Gmail susceptible to brute-force attacks?
Oblig: XKCD: Password Reuse Password Entropy is rarely relevant. The real modern danger is password resuse.
Mar
10
comment How to prevent network administrators from accessing USB drive
@immibis if you are worried that your workers have patched/rooted your servers... you have bigger issues. Like why you haven't fired someone you distrust that much?
Nov
27
comment How do you explain to experts that a database server should not reside in the DMZ?
If you aren't holding Credit Card details, what are you holding? Account information? Patient visit information? blueprints for American Made UFOs? If it's that sensitive, maybe you should aim for that level of security or similar levels demanded by say Electronic Health Record systems used for Patient info. No CC info there, but you be screwed sideways if you lose THAT database....
Aug
13
comment Can we trust antivirus software?
@user2813274 CYA can be one of many reasons. Expertise, accountability, vettability, regulations, etc... many reasons outside of finger pointing to consider when purchasing security software (not just AV). Trust also helps keep providers in check. Look at all the blowback from NSA related issues. What company is going to voluntarily install a backdoor when they can lose face and customers?
Jul
29
comment Does clicking lead to DoS attack?
@Bergi The question is: Can simple clicks lead to DoS? Specifically, me clicking real fast (paraphrased). Of course the bandwidth available will affect how many clicks lead to a "DoS". A self-hosted website, behind a home connection will need much fewer clicks than something hosted on a high-availability AWS... This question made me think of the slashdot effect because that's basically what it is, death by a million clicks.
Jul
29
comment Does clicking lead to DoS attack?
see related: en.wikipedia.org/wiki/Slashdot_effect - lots of honest traffic (flash mob) causing a website to go down. Just people clicking to view the site. Not that far of a stretch of many people clicking a link once... to one person clicking many times.
May
22
comment Sending passwords to someone remotely
Use ietf.org/rfc/rfc1149.txt
May
15
comment Why are certificates limited in time?
2038 Problem? ... is often referred to as the Unix Millennium Bug. Great... we just has the Y2K problem. Then the end of the Mayan Calendar. Now this? Guess I'll start stacking up on rice and freeze dried potatoes because I have no faith that systems will be updated by then.
Feb
27
comment Is Adblock (Plus) a security risk?
@Superbest Well... if it isn't an American Companies, then it is some other random company. .. ... I jest I jest. But seriously, I would say the same for most companies - and would say the same if Comcast or Google told me to stop using ABP. You have to raise an eyebrow when a company that profits off of advertisements tells you to stop using an ad blocker.
Feb
27
comment Is Adblock (Plus) a security risk?
Who do you trust more? ABP (which is under constant scrutiny and would be steam rolled if it replaced mybank.com with something else) or Some Random German Company? COULD an addon be used for Evil Purposes? Of course... but without proof it's just blind accusations and FUD.
Jul
12
comment How important is it to protect demo data by HTTPS enabled server?
startssl.com = free ssl cert. Only takes time, and can only be used with 1 sub-domain per certificate (but you can make many certificates... or pay for a wildcard)
Jun
27
comment What anti-keylogging programs can you use when using a public PCs
+1 @Rook My first thoughts exactly. Android and 2-part authentication (Where available).