844 reputation
210
bio website
location
age
visits member for 2 years, 10 months
seen 4 hours ago

Been on the Internet since before there was an Internet. Remember UUCP, news feeds, and Gopher?


Aug
18
comment Why do some people think Linux is more secure than Windows?
In support of your answer and at the peril of causing faith based replies, most of the compromises on the planet are on Linux based servers. The operating system does not confer security on the applications running there-on, so is the operating system an enabler for poor software? The same conclusion can be drawn about all the OS environments out there in that case.
Aug
18
comment Why do some people think Linux is more secure than Windows?
This is one of those questions that often leads to faith based discussion. It's also massively duplicate as this probably is one of the first questions asked in these venues. EXE files are Windows executables and will never run on Linux, but then Linux executables don't run on Windows. Wow, safety by cross platform...
Aug
17
comment How long would it take to brute force the AES encryption?
Badly implemented, fairly quickly. Paying attention to the details, way too long. In your implementation, don't invoke Schneier's law.
Aug
16
comment Is Google spying on all of us?
An email system that scans content, presents ads relevant to that content and then stores an array tag that references what ads were determined to be relevant from your past searches may be an information leak to anyone who uses your computer as to what you search for from that computer. When that is all that is being done, it isn't spying. Spying would be recording what you search and passing it onto other parties. There is a decoupling that occurs here between what the actual content was and the ad content that was determined to be relevant.
Aug
13
comment Preferred access list (WPA2 rogue AP)
Long live CCCP and the Rouge flag!
Aug
12
revised Preferred access list (WPA2 rogue AP)
too many misspellings of rogue (not a red access point)
Aug
12
comment Preferred access list (WPA2 rogue AP)
And Point Number 4 is criminal intent... Needs to be beaten with a Baton Rouge... As opposed to a Baton Rogue.
Aug
12
suggested suggested edit on Preferred access list (WPA2 rogue AP)
Aug
12
comment Why is it a good idea that X.509 digital certificates have an expiry date?
Deadman switch. Fails safe.
Aug
12
comment How can you be caught using Private VPN when there's no logs about who you are?
How about to find a chain of few countries who do not have any diplomatic relations... and are willing to sell you out in exchange for cold, hard currency since there are absolutely no laws preventing foreign entities from setting up shop and filtering all paranoid traffic. Money talks, free untampered communications walks in the lands where kickbacks are king.
Aug
10
comment Why do browsers leak their version info to the webserver?
@LucasKauffman - Which is what most current infection servers do anyway. Bright idea security by obscurity question which is trumped by reality.
Aug
5
comment Should we protect web application source code from being stolen by web hosts through obfuscation?
@Xander - basically one of those check-off-the-list items on audits that everybody in security knows to be an exercise in futility, but we include it so the uneducated management knows we've filled the box, whether it does anything or not.
Aug
3
comment Name of security system
Adequate name would be "Airgap Sneakernet". First came across the term with using floppy disks on Xenix for data transfer. Ethernet interfaces were expensive, the 1/2" coax backbone and taps were problematic and serial cable to the back room was capable only of 9600 baud. Tar it to disks and walk it back.
Aug
3
comment Aviation security - Lessons to learn from PlaneSploit
And GPS is spoofable, might as well add that to the mix.
Jul
27
comment My VPS has been shut down now again for the second time for TOS violations, and I really need some help.
Simply shut off sites that will not upgrade. Failure to follow a proper upgrade path which allows for everyone else to lose their services should not be tolerated.
Jul
26
comment Is committing credit card data to this website considered safe?
You can't verify their compliance, and only their credit card processor can tell you that if they've required the company to pass PCI-DSS assessments. This doesn't mean that they actually do pass PCI-DSS requirements as there's a lot of leeway for small operations.
Jul
19
comment Why do most cars use physical keys and no PIN?
Or the fine Oregon Weather penetrates the keypad leaving the customer ticked. It's been done before, nothing new and didn't enhance the customer experience once the novelty faded. (never lose your key again vs oh crud, what's the new number I changed it to). And for any wisenheimer objections to the external keypad. It's to stop the person from entering the car, physical entry is like physical server access, game over once accomplished.
Jul
18
comment Is it acceptable that a skilled professional pentester deletes or modifies sensitive data in production unintentionally during a pentest?
Who knows what kind of logic bomb you might stumble upon. It's CYA against malicious traps and horrible misconfigurations that were a hidden disaster waiting to take out data the first time somebody triggered the domino string. Basically a "Sorry you don't have working backups, but that issue predates my breathing on your system" clause.
Jul
16
comment Would a massive blacklist of guessable passwords be useful?
Known as a dictionary?
Jul
9
comment Why does one need a high level of privacy/anonymity for legal activities?
Joe User doesn't worry until the horses have left the barn, at which point suddenly it becomes important and then he just yells and screams a lot about the "injustice". The whole privacy issue has been over and done with for some time as you point out. Society has sold its soul for convenience and corporatism is the new black.