Linked by Howard Fosdick on Sat 10th Nov 2012 07:28 UTC
Thread beginning with comment 542305
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Features
Linked by Thom Holwerda on 06/13/13 14:35 UTC
Linked by Thom Holwerda on 06/11/13 17:07 UTC
Linked by Thom Holwerda on 06/10/13 23:13 UTC
Linked by Thom Holwerda on 06/08/13 14:57 UTC
Linked by Thom Holwerda on 06/07/13 11:40 UTC
Linked by Thom Holwerda on 06/04/13 12:45 UTC
Linked by nfeske on 05/31/13 10:12 UTC
Linked by Thom Holwerda on 05/29/13 16:59 UTC
Linked by Thom Holwerda on 05/24/13 17:26 UTC
Linked by Thom Holwerda on 05/21/13 21:38 UTC
More Features »
Sponsored Links



Member since:
2007-03-26
I probably should apologize for the crappy tone of me recent posts. But in all seriousness, the confusion is entirely at your end. You kept confusing the different stages of the process and raising hypothetical arguments of attacks (which you're somehow now blaming me for?)

If you did a little research into this you'd see the circular arguments you keep raising, and then when you started accusing me of the above, well it's no wonder I lost my temper.
I'm sure you've had similar arguments with people where they've failed to grasp basic concepts then accused you of switching contexts because they were incapable of wrapping their heads around the basic theory you were trying to outline.
You don't strike me as unintelligent, so this clearly isn't beyond you; however the arguments you raise made little sense. So I really do suggest you do a little reading up on security blogs (and I mean ones written by respected pen testers - there's a lot of idiots out there who publish grossly misleading (and often down right inaccurate) information). It's scary just how sophisticated some attacks are (which is why I'm a huge advocate of using key based systems to do away with passwords; and using automatic firewalling for the few systems that are dependent on password authentication).
Even just outside of my main job, I do some freelance consultancy and it's pretty alarming just how many servers are exposed to easy attacks due to the administrators running default config (eg no adaptive firewalling, chroot sandboxing, user separation, insecure daemon defaults (eg server tokens enabled in apache) and running local daemon listener on 0.0.0.0).
Security is quite an in-depth and highly specific subject, so it grinds my gears when bad / outdated advice is given so publicly, or when good advice is ignored (particularly if it appears to be ignored purely out of pride).
Anyway, rant over