Re: [Full-disclosure] security industry software license

2008-10-14 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Fiat licensure laws are invariably used (if not intended) to restrict new entrants in a profession. The idea is to benefit existing members in that profession (who are grandfathered into licensure by virtue of having worked in that profession for a

[Full-disclosure] ASLR

2008-09-19 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Anyone tried setting the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages key (which, by default, does not exist) so as to mandate ASLR coverage (value of -1 to mandate coverage on all PEs)? Anyone had success (or big

Re: [Full-disclosure] so this is FD...

2008-06-27 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Suggestion - check out the array of good security blogs if you're not already doing so. G - - Original Message - From: Lucio Crusca [EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Sent: Friday, June 27, 2008 4:46 AM Subject:

Re: [Full-disclosure] Fwd: Joel Esler comment on Sans ISC podcast

2008-06-21 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Responding to such playground tactics will only perpetuate the foolishness, as has already been demonstrated repeatedly. For the sake of everyone, I strongly recommend you just add him/they to your filter list. G - - Original Message -

[Full-disclosure] OT: Re: Joel Esler comment on Sans ISC podcast

2008-06-19 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Again, please add annoying/offensive people to your email filters. Keep in mind that, to them, any attention at all is good, even if it's negative attention. G - - Original Message - From: Ureleet [EMAIL PROTECTED] To: n3td3v [EMAIL

Re: [Full-disclosure] Mambo Cookie Authentication Bypass Exploit

2008-06-10 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 And situations involving social interaction are not for you. Please avoid them at all costs until social skills improve. Oh, and please read the list charter that was recently distributed. On it, you will see that offensive language and personal

Re: [Full-disclosure] POP QUIZ

2008-06-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Add offensive list subscribers to your email filter rather than baiting them to continue their offensive posts. - - Original Message - From: Robert Holgstad To: Professor Micheal Chatner ; full-disclosure@lists.grok.org.uk Sent: Monday,

Re: [Full-disclosure] [offtopic] Fwd: Comments on: PhoenixMarsLander site hacked

2008-06-05 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 That's why there are email filters. Pls start using them if you value your sanity. The kind of publicity he/they're getting only encourages the naughty behavior. - - Original Message - From: Patrick Nolan [EMAIL PROTECTED] To:

Re: [Full-disclosure] Greetz security community members

2008-05-30 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 No begging necessary, Michael. Just update your email filters to weed out offensive or junk email. - - Original Message - From: Micheal Turner [EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Sent: Thursday, May 29, 2008 3:35 PM

Re: [Full-disclosure] Need some help with management

2008-05-22 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Appeal to them with language that they understand. Since they don't seem to be as technical as you are, appeal to them with a financial and/or legal liability argument. Managers understand liability and the bottom line. - - Original Message -

Re: [Full-disclosure] Working exploit for Debian generated SSH Keys

2008-05-20 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Yep, agreed. - - G Salut, Garrett, On Mon, 19 May 2008 13:51:29 -0400, Garrett M. Groff wrote: Generating pseudo-random numbers isn't hard given a good API, but writing that API is non-trivial (assuming you want high entropy/low predictability

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20

2008-05-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I think it's time to cut out this anti-semitic crap. It violates the list charter and it's just embarrassing (to those who hold such hateful opinions). If you want to be complicit in hateful propaganda that echoes that of the mindless Islamic fascism

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20

2008-05-09 Thread Garrett M. Groff
. J On Fri, 09 May 2008 11:33:05 -0400 Garrett M. Groff [EMAIL PROTECTED] wrote: I think it's time to cut out this anti-semitic crap. It violates the list charter and it's just embarrassing (to those who hold such hateful opinions). If you want to be complicit in hateful propaganda that echoes

Re: [Full-disclosure] Full-Disclosure Digest, Vol 39, Issue 20 (very OT)

2008-05-09 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Not silly to point that out at all. I borrowed the media term du jour (Islamic fascists, or alternately, Islamofascists). I typically use the term Salafist radicals since it's more technically correct and less inflammatory (well, not necessarily on

Re: [Full-disclosure] HD Moore

2008-05-06 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 These sorts of emails, while perhaps very accurate, only encourage a barrage of emails concerning our apparent involvement in a large governmental conspiracy and/or our script kiddiness. I think ignoring such emails from netdev are in order, tempting

Re: [Full-disclosure] OT: get a life

2008-05-06 Thread Garrett M. Groff
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 For the people who normally send this sort of filth, can you please do one or both of the following: 1) send to the person and not the entire list 2) indicate the off-topicness of the email in the subject line Alternately, you can just not send

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
Joey, The topic write-ups for data compression and cryptography (go to that page in lieu of encryption) are reasonably good. You can then branch to other sources for the sake of verification via cross referencing. That should help to elucidate the substantial difference between encrypting data

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml) Groffg, On Tue, 22 Apr 2008 13:02:34 -0400 Garrett M. Groff [EMAIL PROTECTED] wrote: Joey, The topic write-ups for data compression and cryptography (go to that page in lieu of encryption) are reasonably

Re: [Full-disclosure] Security issueinFilezilla3.0.9.2:passwordsare stored in plain text(sitemanager.xml)

2008-04-22 Thread Garrett M. Groff
Pretty shocking stuff. I seriously recommend a scholarly, peer-reviewed book on basic social skills. In addition, finding a role model who has both strong domain knowledge (in the field of your choice) and also who communicates effectively (i.e., without losing his/her equanimity when faced

Re: [Full-disclosure] Misquoted here on FD...

2008-04-22 Thread Garrett M. Groff
Richard, would you have objections to pasting your email to the group? - G - Original Message - From: Richard Golodner [EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Sent: Tuesday, April 22, 2008 4:19 PM Subject: [Full-disclosure] Misquoted here on FD... Clearly someone has

Re: [Full-disclosure] Security issue in Filezilla3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-21 Thread Garrett M. Groff
Joey, Wikipedia has some decent write-ups on both compression and encryption. Understanding those concepts would be helpful before tackling RFCs. Hope that helps. - G On Mon, 21 Apr 2008 22:31:53 EDT, Joey Mengele said: So are you trying to suggest compression is not as secure as

Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml)

2008-04-18 Thread Garrett M. Groff
issue in Filezilla 3.0.9.2:passwords are stored in plain text (sitemanager.xml) I disagree, read the RFC. There are plenty of more secure FTP clients such as the OpenSSH.com groups proactive secure Secure FTP (sftp) implementation of FTP. J On Fri, 18 Apr 2008 15:36:34 -0400 Garrett M. Groff

Re: [Full-disclosure] Security issue in Filezilla 3.0.9.2:passwordsare stored in plain text (sitemanager.xml)

2008-04-18 Thread Garrett M. Groff
Joey, are you certain that you're looking at RFC 959? There is no 4.3.3 section in RFC 959. - G - Original Message - From: Joey Mengele [EMAIL PROTECTED] To: [EMAIL PROTECTED]; [EMAIL PROTECTED] Cc: full-disclosure@lists.grok.org.uk Sent: Friday, April 18, 2008 4:26 PM Subject: Re:

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-17 Thread Garrett M. Groff
Fools! Do you really want to be added to Netdev's List of Enemies To Be Smitten? More on what happens to Netdev's enemies here: http://en.wikipedia.org/wiki/The_Fate_Of_N3tD3v_Enemies - G - Original Message - From: [EMAIL PROTECTED] To: mcwidget [EMAIL PROTECTED] Cc:

Re: [Full-disclosure] Web Application Security Awareness Day

2008-04-17 Thread Garrett M. Groff
FYI - my previous email was entirely facetious. To my knowledge, a list entitled List of Enemies To Be Smitten does not exist (yet?) and the referenced Wikipedia page is merely a fabrication. - G On Thu, 17 Apr 2008 15:03:11 EDT, Garrett M. Groff said: Fools! Do you really want to be added

Re: [Full-disclosure] Fwd: n3td3v has a fan

2008-04-14 Thread Garrett M. Groff
I appreciate Valdis's point and agree with it. I'll posit that there is an optimal balance that can be achieved vis-a-vis security. I'll use airport security as my example. In this case, security theater becomes a political necessity (fed gov't needs to look responsive after 9/11 to re-assure

Re: [Full-disclosure] n3td3v has a fan

2008-04-10 Thread Garrett M. Groff
Allow me to posit the following: netdev wants attention, even if its negative attention. I.e., he is intentionally saying things that are inflammatory/unintelligent/provocative so as to arouse a reaction. To say that this is out of stupidity (or that netdev is unintelligent) is a conclusion

Re: [Full-disclosure] n3td3v has a fan

2008-04-09 Thread Garrett M. Groff
Good point regarding English grammar. I would definitely dissent with someone who proved to be inordinately picky regarding sentence construction or style. Still, good grammar and judicious use of writing style has its uses. Here are two: professionalism and persuasiveness (yes, they're not

Re: [Full-disclosure] n3td3v has a fan

2008-04-08 Thread Garrett M. Groff
Fact is, n3td3v, we're all out to get you. I apologize for not mentioning that earlier. Oh, the NSA is after you as well and is actively involved in the smear campaign. Why? Because, due to your extensive security research, you are a potential threat. At some point you'll be abducted, but I

Re: [Full-disclosure] Fwd: Let's outlaw mass securityconferencespamming its f****** gay

2008-04-03 Thread Garrett M. Groff
and, perhaps, there are people who appreciate the information. - G - Original Message - From: n3td3v [EMAIL PROTECTED] To: Garrett M. Groff [EMAIL PROTECTED]; n3td3v [EMAIL PROTECTED]; full-disclosure@lists.grok.org.uk Sent: Thursday, April 03, 2008 5:38 PM Subject: Re: [Full-disclosure

Re: [Full-disclosure] (no subject)

2008-04-01 Thread Garrett M. Groff
Another approach is that you could stop reading her blog and seek an alternate past-time(s). That would avoid the commission of computer crime and its possible ramifications. - G - Original Message - From: josh [EMAIL PROTECTED] To: Cody Roby [EMAIL PROTECTED]; [EMAIL PROTECTED];

Re: [Full-disclosure] CAU-2008-0001 - Slowly Closing Door RaceCondition

2008-04-01 Thread Garrett M. Groff
Although, in all seriousness, I can imagine physical world things being compromised, possibly via software attacks alone (or, equally likely, a single disgruntled employee). Allow me to explain using a particular example: safes. Companies that make safes (be they old-fashioned mechanical or

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Excellent points, with exception to the gratuitious name-calling (just b/c there are annoying people on this list who throw out invective doesn't mean we should submit to our temptation to do the same vile practice back to them). I'll add the following (despite the fact that it's grossly

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
exterior connectivity. The strategic vision that I'm suggesting is that we use our global power projection as the initial phase in taking out stubborn regimes. That's a small part of the picture, but still a necessary piece. - G - Original Message - From: [REMOVED] To: Garrett M. Groff

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Not commenting on the perceived misunderstanding, but I'll post a couple thoughts... One, I disagree with the rogueness of the US (beyond that, the debate is semantics, methinks). Having said that, I'm not particularly fond of the current administration and I hope the next president expresses

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
Your concern in our off-topicness is indeed justified. We have strayed far from the primary topic of the list. - G - Original Message - From: [EMAIL PROTECTED] To: full-disclosure@lists.grok.org.uk Sent: Thursday, March 27, 2008 1:05 PM Subject: Re: [Full-disclosure] Free Iraq

Re: [Full-disclosure] Free Iraq

2008-03-27 Thread Garrett M. Groff
that for an IT security tie-in?). I propose that we (and certainly our political luminaries) have a strategic mindset in this flatter and more globalized world that we live in. - G - Original Message - From: Razi Shaban [EMAIL PROTECTED] To: Garrett M. Groff [EMAIL PROTECTED] Cc: full

Re: [Full-disclosure] Free Tibet..

2008-03-25 Thread Garrett M. Groff
Maybe the relevance of this post is escaping me. Over the weekend, quite a few unread FD emails were purged to make the task of catching up a little more bearable... But I'll bite. Regarding China, as they've been liberalizing their economy for nearly the last three decades, personal freedoms

Re: [Full-disclosure] agile hacking?

2008-03-20 Thread Garrett M. Groff
Can emails like the one below be sent to the person not the entire list... for the benefit of all list members? Thanks. - G - Original Message - From: reepex To: Petko D. Petkov ; full-disclosure@lists.grok.org.uk Sent: Tuesday, March 18, 2008 11:26 PM Subject: Re: [Full-disclosure]