Rushyo

492 reputation

310

bio	website	rushyo.com
	location	United Kingdom
	age	26
visits	member for	2 years, 4 months
	seen	Apr 1 at 20:35
stats	profile views	12

	492 reputation	bio	website	rushyo.com	visits	member for	2 years, 4 months
310 badges		location	United Kingdom		seen	Apr 1 at 20:35

summary answers questions tags badges favorites bounties reputation activity

40 Actions

suggestions reviews revisions comments badges posts accepts all

Mar 20	comment	How would one crack a weak but unknown encryption protocol? @TerryChia A principle can be applied successfully 100% of the time and still doesn't become a fact. A fact isn't actionable, like a principle is. You can enact a principle by following it, you can't enact a fact. You don't say "We need to apply the laws of gravity for this". You do say "We need to apply Kerckhoff's principle for this". Someone can choose to ignore Kerckhoff's principle (at their peril). They can't choose to ignore the laws of gravity.
Mar 20	comment	How would one crack a weak but unknown encryption protocol? @SmitJohnth For it to be a rule it would need an obligation. You can apply a rule to a principle (i.e. everyone must follows Kerckhoff's principle to work on this library) but that doesn't make the principle itself a rule.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? It's a principle. It's meant to guide decision making. It's not a law, rule or theory that is actually fact.
Mar 18	comment	How would one crack a weak but unknown encryption protocol? Worse than nothing because it breeds a false sense of security. At least if you don't have a control in place you continue to rationalise future security decisions on that assumption, rather than relying upon the assumption that you have a control in place that is better than it really is.
Mar 4	comment	Automatic robot crawler to check web pages authenticity? +1 for Tripwire, although it's worth noting that managing a Tripwire instance can easily consume a lot of your time.
Mar 4	comment	How dangerous is game guard? @ruief Not meaning to sound snippy but if that were true then we might as well get rid of UAC, SU, ACLs, User Groups...
Mar 1	awarded	Good Answer
Feb 28	comment	I managed to capture a botnet control host, what do I do with it? @Shadur If you really think the data you can collect is that valuable (I suspect it's not) then then you may wish to try something like Volatility to record the current forensic state of your RAM at least. The trouble is that if you screw it up you can end up doing more harm than good.
Feb 28	comment	I managed to capture a botnet control host, what do I do with it? @MasonWheeler That would probably be govcert.nl in this instance.
Feb 28	awarded	Yearling
Feb 28	awarded	Mortarboard
Feb 28	awarded	Nice Answer
Feb 28	comment	How to Secure My DropBox Installation? Quite. This is ideological fluff, not an appropriate answer to the question.
Feb 28	comment	Using ModSecurity as transparent mode It's not clear to me what you're asking. ModSecurity is a server-side technology. It doesn't sit between your server and client.
Feb 28	answered	I managed to capture a botnet control host, what do I do with it?
Feb 28	awarded	Citizen Patrol
Feb 28	comment	I managed to capture a botnet control host, what do I do with it? Given he said 'my webhosting customers' I think it's fair to assume he doesn't have a SIRT/CERT team backing him up.
Feb 28	awarded	Critic
Feb 28	comment	Is it safe to install metasploit in my daily-used computer Unless you're running on a laptop from ancient times, you shouldn't have any trouble running one of the smaller *nix distros. You don't need to feed a dedicated Metasploit VM with RAM and processing power like you would a general-purpose Windows VM.
Feb 24	awarded	Yearling