Re: [Full-disclosure] security industry software license

2008-10-14 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Fiat licensure laws are invariably used (if not intended) to restrict new entrants in a profession. The idea is to benefit existing members in that profession (who are "grandfathered" into licensure by virtue of having worked in that profession for a d

[Full-disclosure] ASLR

2008-09-19 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Anyone tried setting the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages key (which, by default, does not exist) so as to mandate ASLR coverage (value of -1 to mandate coverage on all PEs)? Anyone had success (or big

Re: [Full-disclosure] so this is FD...

2008-06-27 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Suggestion - check out the array of good security blogs if you're not already doing so. G - - Original Message - From: "Lucio Crusca" <[EMAIL PROTECTED]> To: Sent: Friday, June 27, 2008 4:46 AM Subject: [Full-disclosure] so this is FD...

Re: [Full-disclosure] Fwd: Joel Esler comment on Sans ISC podcast

2008-06-21 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Responding to such "playground tactics" will only perpetuate the foolishness, as has already been demonstrated repeatedly. For the sake of everyone, I strongly recommend you just add him/they to your filter list. G - - Original Message - Fr

[Full-disclosure] OT: Re: Joel Esler comment on Sans ISC podcast

2008-06-19 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Again, please add annoying/offensive people to your email filters. Keep in mind that, to them, any attention at all is good, even if it's negative attention. G - - Original Message - From: "Ureleet" <[EMAIL PROTECTED]> To: "n3td3v" <[EMAIL

Re: [Full-disclosure] Mambo Cookie Authentication Bypass Exploit

2008-06-10 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 And situations involving social interaction are not for you. Please avoid them at all costs until social skills improve. Oh, and please read the list charter that was recently distributed. On it, you will see that offensive language and personal attac

Re: [Full-disclosure] POP QUIZ

2008-06-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Add offensive list subscribers to your email filter rather than baiting them to continue their offensive posts. - - Original Message - From: Robert Holgstad To: Professor Micheal Chatner ; full-disclosure@lists.grok.org.uk Sent: Monday, Jun

Re: [Full-disclosure] [offtopic] Fwd: Comments on: PhoenixMarsLander site hacked

2008-06-05 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 That's why there are email filters. Pls start using them if you value your sanity. The kind of "publicity" he/they're getting only encourages the naughty behavior. - - Original Message - From: "Patrick Nolan" <[EMAIL PROTECTED]> To: Sent:

Re: [Full-disclosure] Greetz security community members

2008-05-30 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 No begging necessary, Michael. Just update your email filters to weed out offensive or junk email. - - Original Message - From: "Micheal Turner" <[EMAIL PROTECTED]> To: Sent: Thursday, May 29, 2008 3:35 PM Subject: Re: [Full-disclosure] G

Re: [Full-disclosure] Need some help with management

2008-05-22 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Appeal to them with language that they understand. Since they don't seem to be as technical as you are, appeal to them with a financial and/or legal liability argument. Managers understand liability and the bottom line. - - Original Message -

Re: [Full-disclosure] Working exploit for Debian generated SSH Keys

2008-05-20 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yep, agreed. - - G Salut, Garrett, On Mon, 19 May 2008 13:51:29 -0400, Garrett M. Groff wrote: > Generating pseudo-random numbers isn't hard given a good API, but > writing that API is non-trivial (assuming you want high

Re: [Full-disclosure] Working exploit for Debian generated SSH Keys

2008-05-19 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think the "wheel" in this context refers to exploit code, not PRNG code. Generating pseudo-random numbers isn't hard given a good API, but writing that API is non-trivial (assuming you want high entropy/low predictability). And, apparently, screwing

Re: [Full-disclosure] Geeks

2008-05-16 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think Valdis's point was valid. Why the sarcastic comments? (And what's with the mustache wax comment?) - - G - - Original Message - From: "Fredrick Diggle" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Cc: Sent: Friday, May 16, 2008 12:39

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20 (very OT)

2008-05-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Not silly to point that out at all. I borrowed the media term du jour ("Islamic fascists," or alternately, "Islamofascists"). I typically use the term "Salafist radicals" since it's more technically correct and less inflammatory (well, not necessarily

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20

2008-05-09 Thread Garrett M. Groff
s off list. > > J > > On Fri, 09 May 2008 11:33:05 -0400 "Garrett M. Groff" > <[EMAIL PROTECTED]> wrote: >>I think it's time to cut out this anti-semitic crap. It violates >>the list >>charter and it's just embarrassing (to those who hold such

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20

2008-05-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think it's time to cut out this anti-semitic crap. It violates the list charter and it's just embarrassing (to those who hold such hateful opinions). If you want to be complicit in hateful propaganda that echoes that of the mindless Islamic fascism t

Re: [Full-disclosure] OT: get a life

2008-05-06 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 For the people who normally send this sort of filth, can you please do one or both of the following: 1) send to the person and not the entire list 2) indicate the off-topicness of the email in the subject line Alternately, you can just not send emails

Re: [Full-disclosure] HD Moore

2008-05-06 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 These sorts of emails, while perhaps very accurate, only encourage a barrage of emails concerning our apparent involvement in a large governmental conspiracy and/or our "script kiddiness." I think ignoring such emails from netdev are in order, tempting

Re: [Full-disclosure] Misquoted here on FD...

2008-04-22 Thread Garrett M. Groff
Richard, would you have objections to pasting your email to the group? - G - Original Message - From: "Richard Golodner" <[EMAIL PROTECTED]> To: Sent: Tuesday, April 22, 2008 4:19 PM Subject: [Full-disclosure] Misquoted here on FD... > Clearly someone has misused what I have written

Re: [Full-disclosure] Security issueinFilezilla3.0.9.2:passwordsare stored in plain text(sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
My comment was not directed at Netdev. - G > I assume this is a thinly veiled reference to list member n3td3v. > Yes he is an authority and communicates effectively, however I feel > I am not yet ready to be taken under his wing. Nor do I feel he > would accept me, solicited or unsolicited. B

Re: [Full-disclosure] Security issueinFilezilla3.0.9.2:passwordsare stored in plain text(sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
Pretty shocking stuff. I seriously recommend a scholarly, peer-reviewed book on basic social skills. In addition, finding a role model who has both strong domain knowledge (in the field of your choice) and also who communicates effectively (i.e., without losing his/her equanimity when faced wit

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
ure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml) > Groffg, > > On Tue, 22 Apr 2008 13:02:34 -0400 "Garrett M. Groff" > <[EMAIL PROTECTED]> wrote: >>Joey, >> >>The topic write-ups for data compression and cryptography (g

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
Joey, The topic write-ups for data compression and cryptography (go to that page in lieu of "encryption") are reasonably good. You can then branch to other sources for the sake of verification via cross referencing. That should help to elucidate the substantial difference between encrypting dat

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-21 Thread Garrett M. Groff
Joey, Wikipedia has some decent write-ups on both compression and encryption. Understanding those concepts would be helpful before tackling RFCs. Hope that helps. - G On Mon, 21 Apr 2008 22:31:53 EDT, Joey Mengele said: > So are you trying to suggest compression is not as secure as > encrypt

Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-18 Thread Garrett M. Groff
Joey, are you certain that you're looking at RFC 959? There is no 4.3.3 section in RFC 959. - G - Original Message - From: "Joey Mengele" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Cc: Sent: Friday, April 18, 2008 4:26 PM Subject: Re: [Full-disclosure] Security i

Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

2008-04-18 Thread Garrett M. Groff
urity issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) >I disagree, read the RFC. There are plenty of more secure FTP > clients such as the OpenSSH.com groups proactive secure Secure FTP > (sftp) implementation of FTP. > > J > > On Fri, 18

Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

2008-04-18 Thread Garrett M. Groff
That issue is inherent in the FTP protocol, not FileZilla. Resolution: set up FTP server to use either SFTP or FTPS. - G - Original Message - From: "Joey Mengele" <[EMAIL PROTECTED]> To: ; <[EMAIL PROTECTED]> Sent: Friday, April 18, 2008 3:21 PM Subject: Re: [Full-disclosure] Security

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-17 Thread Garrett M. Groff
FYI - my previous email was entirely facetious. To my knowledge, a list entitled "List of Enemies To Be Smitten" does not exist (yet?) and the referenced Wikipedia page is merely a fabrication. - G On Thu, 17 Apr 2008 15:03:11 EDT, "Garrett M. Groff" said: > Fools! D

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-17 Thread Garrett M. Groff
Fools! Do you really want to be added to Netdev's "List of Enemies To Be Smitten"? More on what happens to Netdev's enemies here: http://en.wikipedia.org/wiki/The_Fate_Of_N3tD3v_Enemies - G - Original Message - From: <[EMAIL PROTECTED]> To: "mcwidget" <[EMAIL PROTECTED]> Cc: Sent: Thu

Re: [Full-disclosure] Fwd: n3td3v has a fan

2008-04-14 Thread Garrett M. Groff
I appreciate Valdis's point and agree with it. I'll posit that there is an optimal balance that can be achieved vis-a-vis security. I'll use airport security as my example. In this case, security theater becomes a political necessity (fed gov't needs to look responsive after 9/11 to re-assure pe

Re: [Full-disclosure] n3td3v has a fan

2008-04-10 Thread Garrett M. Groff
Allow me to posit the following: "netdev" wants attention, even if its negative attention. I.e., he is intentionally saying things that are inflammatory/unintelligent/provocative so as to arouse a reaction. To say that this is out of stupidity (or that netdev is unintelligent) is a conclusion t

Re: [Full-disclosure] n3td3v has a fan

2008-04-09 Thread Garrett M. Groff
Good point regarding English grammar. I would definitely dissent with someone who proved to be inordinately picky regarding sentence construction or style. Still, good grammar and judicious use of writing style has its uses. Here are two: professionalism and persuasiveness (yes, they're not mut

Re: [Full-disclosure] n3td3v has a fan

2008-04-08 Thread Garrett M. Groff
Fact is, n3td3v, we're all out to get you. I apologize for not mentioning that earlier. Oh, the NSA is after you as well and is actively involved in the smear campaign. Why? Because, due to your extensive security research, you are a potential threat. At some point you'll be abducted, but I don

Re: [Full-disclosure] Fwd: Let's outlaw mass securityconferencespamming its f****** gay

2008-04-03 Thread Garrett M. Groff
th. This list is un-moderated and, perhaps, there are people who appreciate the information. - G - Original Message - From: "n3td3v" <[EMAIL PROTECTED]> To: "Garrett M. Groff" <[EMAIL PROTECTED]>; "n3td3v" <[EMAIL PROTECTED]>; Sent: Thu

Re: [Full-disclosure] Fwd: Let's outlaw mass securityconferencespamming its f****** gay

2008-04-03 Thread Garrett M. Groff
Regarding the particular person in question, I'll defer to others who know him (or her, or they, or whomever) better than I do. Instead, I'll say that, generally, on lists like FD, there is a minority of out-spoken personalities who sadly support the stereotypical hacker persona: condescending e

Re: [Full-disclosure] CAU-2008-0001 - Slowly Closing Door RaceCondition

2008-04-01 Thread Garrett M. Groff
Although, in all seriousness, I can imagine "physical world" things being compromised, possibly via software attacks alone (or, equally likely, a single disgruntled employee). Allow me to explain using a particular example: safes. Companies that make safes (be they old-fashioned mechanical or e

Re: [Full-disclosure] (no subject)

2008-04-01 Thread Garrett M. Groff
Another approach is that you could stop reading her blog and seek an alternate past-time(s). That would avoid the commission of computer crime and its possible ramifications. - G - Original Message - From: "josh" <[EMAIL PROTECTED]> To: "Cody Roby" <[EMAIL PROTECTED]>; <[EMAIL PROTE

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
y_mi_1.html) (how's that for an IT security tie-in?). I propose that we (and certainly our political luminaries) have a "strategic mindset" in this flatter and more globalized world that we live in. - G - Original Message - From: "Razi Shaban" <[EMAIL PROT

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Your concern in our off-topicness is indeed justified. We have strayed far from the primary topic of the list. - G - Original Message - From: <[EMAIL PROTECTED]> To: Sent: Thursday, March 27, 2008 1:05 PM Subject: Re: [Full-disclosure] Free Iraq Sorry, but am I the only one missing

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Not commenting on the perceived misunderstanding, but I'll post a couple thoughts... One, I disagree with the "rogueness" of the US (beyond that, the debate is semantics, methinks). Having said that, I'm not particularly fond of the current administration and I hope the next president expresses

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
ation of a dictator who supports American policies at the > expense of that nation's people's rights. > > -- > [NAME REMOVED] > > On 3/27/08, Garrett M. Groff <[EMAIL PROTECTED]> wrote: >> Excellent points, with exception to the gratuitious name-calling

Re: [Full-disclosure] Free Iraq..

2008-03-27 Thread Garrett M. Groff
Legal immigration is voluntary, not an "invasion." Further, countries that are able to absorb immigration (like the United States) have benefited in the aggregate economic sense. Contrast that with France. France has had some level of success with immigrants... but not much. The car burnings an

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Excellent points, with exception to the gratuitious name-calling (just b/c there are annoying people on this list who throw out invective doesn't mean we should submit to our temptation to do the same vile practice back to them). I'll add the following (despite the fact that it's grossly off-to

Re: [Full-disclosure] Free Tibet..

2008-03-25 Thread Garrett M. Groff
Maybe the relevance of this post is escaping me. Over the weekend, quite a few unread FD emails were purged to make the task of catching up a little more bearable... But I'll bite. Regarding China, as they've been liberalizing their economy for nearly the last three decades, personal freedoms h

Re: [Full-disclosure] agile hacking?

2008-03-20 Thread Garrett M. Groff
Can emails like the one below be sent to the person & not the entire list... for the benefit of all list members? Thanks. - G - Original Message - From: reepex To: Petko D. Petkov ; full-disclosure@lists.grok.org.uk Sent: Tuesday, March 18, 2008 11:26 PM Subject: Re: [Full-disclosure]