Thursday, January 24, 2008

MadSEC 45699 - 7pm, Thursday, 24 Jan 2008

Yes, I am posting this notice 3 hours after we have meet.

1) The collective has decided that the current meeting numbering scheme is deficient.

In order to satisfy all requirements (new, interesting, secure), from now on I will number the meetings after 2 bytes present in a certain memory location on one of my machines:

dd if=/dev/random bs=1 count=2 2>/dev/null | od -N2 -tu2 | awk '{ print $2 }'


At least it's confusing.

2) I missed about half of the conversations. _My take_ on the ones I remember:
  • complex issue with tracking unauthorized system use (public) by a rogue employee.
  • cross site scripting and request forgery (hey, use site specific browser like WebRunner), input validation, preventing session theft.
  • 2 factor (RSA style) are still cool, especially once systems get compromised, and the need for strong auth is freshly apparent.
  • there is no good, reliable, fast, awesome clustered file system. gfs just does not cut it. Something about dedicated NFS appliances (I mean APPLIANCES) that I've missed.
  • Splunk, esp. version 3 is awesome, and saves our hides.
  • something about shooting to proteins
  • Patricia tries are awesome for working with network traffic (there was a lot of context to this discussion that will remain offline).
  • neat things can be done with iRules on F5s. What's the logic behind embedding TCL in network devices (IOS, F5)? I have "Building Network Management Tools with Tcl/Tk" on my shelf, I know the history, but let's move on.

That was fun. We should do those more often. /me kicking self

01/25/2008 - an addendum from Will:

First, there's the Spolsky article on SLAs and uptime[1]. Then there's test-driven development proponent and Python hacker Grig Gheorghiu thoughts[2] on the matter, with a nice plug for Twill[3]. If you haven't used it, Twill is a super cool scripting language for interacting with web pages.

Lastly, I mentioned Bluearc[4] as a possible vendor for high performance NFS stuff. I don't have direct experience with Bluearc, but BNL, FNAL and Purdue swear by them.

[1] http://www.joelonsoftware.com/items/2008/01/22.html
[2] http://agiletesting.blogspot.com/2008/01/joel-on-checklists.html
[3] http://twill.idyll.org/
[4] http://bluearc.com/

Wednesday, November 7, 2007

MadSec 0.75 - 7pm, Thursday, Nov 15

Next meeting is on Nov 15th, at 7pm.
The place is Angelic Brewpub at 322 W Johnson St


View Larger Map

MadSec 1.5 report

I hope that we were loud and visible enough.

In any case - hereby we proclaim MadSec 1.5 a success. Quick summary of findings follows:

* Telecommuting is awesome

* It's hard to hire people who know both Windows and Unix well

* If you hire Java developers from San Diego, you might have to re-hire midway through the Wisconsin winter. In town, most Java people are sucked into TDS, American Family or Epic.

* Giving people local admin on windows is bad, and it's near impossible to enforce group policies

* THC Hydra works well, but has issues. Medusa is better.

* PIX fixup is anything but a FIX-up.

* AJAX is super nice, but it is a client side tool - userbase of a reasonably successfull product will have at least a few individuals with interest and skillset to poke in the JavaScript. Obfuscation does not help, weak session security will be broken.

* Apparently, I missed a DR drill call. I did not have work phone (not on call - although I usually carry it anyway), my personal one is broken and I did not yet update the contact database because I just got it. I swear!

* Data leakage prevention is a hard problem, Tablus has a neat product, but there is no technological silver bullet solution.

* AV just plain sucks, bit9 has an awesome product which whitelists software allowed to run an a machine with option to block, ask or log/alert on use of non-compliant apps. It is displacing AV, and I hope it spreads like fire.

* Do not store passwords on line - store salted hash of the password, use random salt, one per user, no need to encrypt salt.

* Fortify has a tool that does source code analysis. Talking to programmers about poor coding practices works very well when supported by examples from their own code.

* phpids was reported to be very usefull

Let me know if I missed anything.

Sunday, November 4, 2007

MadSec 1.5 - Wed, Nov 7th

Next meeting is on Nov 7th, at 7pm.
The place is Angelic Brewpub at 322 W Johnson St


View Larger Map