raesene2

Doesnt look like that comment came from nat? Username for that comment is naikrovek not natfriedman

Or Robert Seacord’s Effective C

Shame they didn’t include traffic to security.stackexchange.com . I would have thought that would show a more noticeable change. Also would be interesting to see what tags there show the biggest increases

Not really. They can be used to replace one element of the docker stack, runc

“Why bother posting this?” - that’s easy, because it might hit the front page of HN and someone from Google might see it and actually apply human reasoning to the problem.

And then it might get resolved well...

Fair play, it is getting late :)

For uk banking systems it is very likely that the passwords are stored symmetrically encrypted with the key stored in an HSM (based on my experience working as an IT security consultant in UK banks).

Whilst limiting passwords isn’t good, with storage in that way i’m nt sure I see many viable attacks on a 12 char random password.

Online brute force will hit the lockout on the site, and even assuming you could get access to the server hosting the encrypted passwords and HSM you cant decrypt the passwords (unless they have made some horrific setup errors), so the only offline attack is to try and brute force the encryption key, which is unlikely to be easy.

If you base off alpine, you can get useful containers quite a lot smaller than 100MB.

One example i use is an agent i deploy to kubernetes clusters to do some security scanning. The scripts are ruby and the image clocks in at 9MB compressed https://hub.docker.com/r/raesene/kaa-agent/tags/

Have you tried pocket? I used to keep a load of bookmarks but the problem was that after a while many of the source urls would die off. So something like pocket is very handy as it takes a copy of the page you're interested in.

Well there is, but it's not cheap. You get a trusted third party to Audit you and publish the result of their Audit, something similar to a SAS70.

It's not a perfect solution but it's an option to consider

The bear is more a favourite animal of the author

Gotta say I disagree with this. I'd say what it means Is recognize that DNS security is important and treat it as such.

The reason I disagree is that if you use something like gmail or outlook.com for logins/ password resets there Is a nasty potential problem which Is if the provider locks you out of your account you could be completely stuffed.

There have been cases of people losing access to their accounts because of ToS breaches in the past. If that account is your login account for other systems you could also lose access to those.

Yeah go look on security stackexchange and you'll see it quite a bit, people just cargo cult the idea of obscurity == bad and don't consider the points made in OP's article

Actually you are , AFAIK, incorrect there. Microsoft's consent decree from their antitrust trial expired in 2011/2012.

It's never a good sign for your argument when you have to resort to ad hominem attacks.... No real point I trying to respond if that's your track but remember this is just a discussion on a website, no need to start throwing around personal accusations, for which you have no evidence.

Might I suggest you take a break from the keyboard, perhaps go for a nice walk in the fresh air:)

Of course I can as it was my personal experience. On the other hand you made a general assertion about their actions which really needs a citation.

Reinstalling an os is a technical task, which requires some knowledge to do effectively. Having been doing this for 25 years or so, I can safely say it's easier now than it used to be...

So a company who doesn't have a monopoly should be restricted from changing their product because it didn't use to be that way....

Seems a bit harsh to me... if Microsoft still occupied the same kind of dominent position they did 15 years ago it would be a different story, but now there are a lot more viable alternatives

So your pc or fedora has a bug which prevents you changing os and it then follows that Microsoft have a monopoly power in PCs... Sorry I don't quite think that follows

I have bought and installed linux on laptops from hp and Lenovo with no problems at all. Also you can buy laptops from Dell with linux pre-installed.

Can you provide any citations for the assertion that Microsoft are currently (2016) forcing hardware companies to tie their products to Windows?

But surely they're not closing off the pc platform, just potentially restricting what can happen on their OS. You can still use PCs with linux without any lock in. Long gone are the days when Microsoft was a monopoly on client computing devices, these days we have linux, Mac osx, chrome OS, Android, steamOS and iOS.

Several of these other platforms are already closed to one degree on another, with iOS probably being the most restrictive, so I'm not sure I see Microsoft as being dominent enough to warrant a claim of monopoly power any more

Pentester: I'll use mass scan, someone else already solved this problem. https://github.com/robertdavidgraham/masscan

My understanding is that most people would suggest that that only applies to the head of state (currently queen Elizabeth)

But Prince Charles isn't the head of state... So assuming that you're suggesting that this principle doesn't just apply to the head of state, where do you cut the line? Should everyone in the royal family be barred from expressing their opinion privately or publicly?

You don't think those protections should be in place for the 99% of users of these devices who have no idea what a firmware is, let alone would want to update them?

Its a shame to see the company react like this, but the author is taking a bit of a risk here.

Finding sql injection requires active testing of the site which, without authority to test, may fall into a gray area of uk law about whether its in breach of the computer misuse act.

Now you'd hope the company will take this as intended, but some organisations will take being embarassed like this poorly.

The wiki is not uneditable. You should be able to create an account, then you can edit pretty much any page on the site..

Assuming it's possible to say that two images are from the same person, it would be trivial to work out specifically who that was with any frequent flyer.

You'd just build up a body of images of "person 1" then cross-reference with flight records till you narrow it down to only being one possible person who had been on all those flights...

I think that what this could achieve is stating the importance of the issues to the main political parties. Most "mainstream" political parties that I've seen will change their positions on things if they think it will get them more votes.

So what would this achieve. Well having a "privacy reform" party candidate on all the ballots would draw attention to the problem, in that voters would see the name and potentially hear about the platform. Also getting on the ballots would be likely to draw some mainstream media attention (heck the Monster raving loony party gets attention in the UK when it's on the ballot at by-elections)

Then if the party actually gets a decent number of votes, it may persuade mainstream parties to change their positions. My feeling is that at the moment none of them think it's that important a topic, so aren't formulating policies on the topic.

Personally I think it's a good idea to try and do something about this now, as once the idea that PRISM etc are fine and accepted gets embedded into culture, the next steps are likely to follow (e.g. what the US seems to be seeing with DEA and other law enforcement areas getting access to data). How long would it be before your local police are trawling your smartphone GPS data to see if you were speeding...)

If anyone's interested in some more details for write endurance I'd recommend Anantechs SSD reviews. http://www.anandtech.com/show/7173/samsung-ssd-840-evo-revie... .

If the numbers in those are accurate it looks like write endurance shouldn't be a problem at least for any consumer drive. The estimate on that review was 12 years in a typical consumer setup, and I'd reckon that almost everyone would have replaced a laptop or PC in that kind of timeframe.

There are some benefits to removing things like banner headers especially where there is limited effort required to do so..

If the version headers are removed a manual attacker would have to try harder (make more requests) to attempt to identify whether the server software is a vulnerable version or not. this increases the opportunities for detective software controls (e.g. IDS) to detect the attacker and to potentially allow for defensive actions (e.g. IP blocking)

Also if a server version banner is present an at vuln. is discovered in that version its much more efficient for attackers to only hit known vulnerable versions and those can be mined from either things like shodan or the Internet census 2012 data.

A smart attacker would probably want to only hit known vulnerable targets to maximise the time before their attack is noticed and analyzed by defensive organisations and if you hit all servers, that'll include all the honeypots out there, making it more likely that your attack gets noticed and new signatures are pushed to alert/block it.

This is, as far as I know, already in the Dropbox T&C's (article here http://articles.businessinsider.com/2011-04-18/tech/30033770...) and their T&C's here https://www.dropbox.com/privacy do mention handing over data in relation to law enforcement requests in section 3