<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: funny]]></title>
    <link>http://securityratty.com/tag/funny</link>
    <description></description>
    <pubDate>Wed, 01 Oct 2008 10:54:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Hacking a Teleprompter]]></title>
      <link>http://securityratty.com/article/25b0a59eff8bc9d18533528af5f8388a</link>
      <guid>http://securityratty.com/article/25b0a59eff8bc9d18533528af5f8388a</guid>
      <description><![CDATA[Funny...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.youtube.com/watch?v=QrXkmP_3kBs">Funny.</a></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=RyseO"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=RyseO" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=V16FO"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=V16FO" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 03 Dec 2008 10:59:58 +0000</pubDate>
      <category domain="http://securityratty.com/tag/funny">funny</category>
      <source url="http://www.schneier.com/blog/archives/2008/12/hacking_a_telep.html">Hacking a Teleprompter</source>
    </item>
    <item>
      <title><![CDATA[Links List 11.24.08]]></title>
      <link>http://securityratty.com/article/f209f4653ec3034a29d9cf1ff2ca5cd8</link>
      <guid>http://securityratty.com/article/f209f4653ec3034a29d9cf1ff2ca5cd8</guid>
      <description><![CDATA[The hunt for the nations first CTO continues . Although names have been suggested, such as standout nominees include Bruce Schneier, founder of Counterpane and now chief security technology officer at...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/11/markcuban.jpg" border="0" alt="markcuban" width="240" height="164" align="left" /> The hunt for the <a href="http://weblog.infoworld.com/robertxcringely/archives/2008/11/the_once_and_fu.html?source=NLC-NOTES&amp;cgd=2008-11-17" target="_blank">nation’s first CTO continues</a>. Although names have been suggested, such as standout nominees include Bruce Schneier, founder of Counterpane and now chief security technology officer at BT; Mark Cuban for his obvious business sense – and in spite of the <a href="http://www.huffingtonpost.com/2008/11/17/mark-cuban-insider-tradin_n_144320.html" target="_blank">insider trading indictment</a> – and Carly Fiorina, former controversial CEO of HP, the next question is what policies should this CTO pursue? Visit <a href="http://obamacto.org/" target="_blank">ObamaCTO.org</a> to view and vote for policies.</p>
<p>SaaS is taking a bite out of the $18 billion IT management market. A <a href="http://www.informationweek.com/blog/main/archives/2008/11/will_it_managem.html?cid=RSSfeed_IWK_ALL" target="_blank">new Forrester Research report forecasts SaaS-based IT management accounts will be 10%</a> of the market by 2013. The reason: high level of interest from medium-sized and large enterprises. Forrester also predicts that enterprises with 1,000 or more employees will account for 50% of SaaS installations in 2009. We’ve seen this on the service desk side with the <a href="http://www.redmonk.com/cote/2007/01/17/service-nowcom-briefing-itil-saas/" target="_blank">rapid growth of upstart Service-now.com</a>. Companies are looking for easier and rapid deployment, lower upfront and capital costs and rapid time to value – all benefits of SaaS as well as our own <a href="http://www.sciencelogic.com/appliancebenefits.htm" target="_blank">appliance model</a>.</p>
<p><a href="http://chucksblog.emc.com/chucks_blog/2008/11/the-speculation-game-ibm-buys-transitive.html" target="_blank">IBM snapped up Transitive</a> this week. Their QuickTransit software dynamically translates native code <a href="http://arstechnica.com/news.ars/post/20081120-ibm-to-buy-transitive.html" target="_blank">between architectures</a>, enabling apps compiled for one processor to be run on another without any modification. Apple was the first licensee and used it to build Rosetta, a translation system that allowed users of Intel Macs to seamlessly run legacy PowerPC apps. IBM plans to use the technology to move workloads onto IBM systems without recompiling, allowing customers to “save on energy costs due to hardware consolidation and reduced TCO.”</p>
<p>At CA World, CA announced a partnership with Amazon to provide “<a href="http://stage.vambenepe.com/archives/442" target="_blank">management capabilities around Amazon’s EC2</a> utility computing platform, potentially including discovery of software running on EC2 instances, performance monitoring, configuration management, software deployment capabilities and provisioning”. John Willis, in spite of some pretty funny potshots and stories about CA (don’t we all have them), writes that “<a href="http://www.johnmwillis.com/amazon/what-color-is-your-cloud/" target="_blank">CA is the first of the Big Four to take the cloud serious</a>”.</p>
]]></content:encoded>
      <pubDate>Mon, 24 Nov 2008 11:15:36 +0000</pubDate>
      <category domain="http://securityratty.com/tag/software deployment capabilities">software deployment capabilities</category>
      <category domain="http://securityratty.com/tag/software">software</category>
      <category domain="http://securityratty.com/tag/ibm plans">ibm plans</category>
      <category domain="http://securityratty.com/tag/ibm">ibm</category>
      <category domain="http://securityratty.com/tag/apps">apps</category>
      <category domain="http://securityratty.com/tag/legacy powerpc apps">legacy powerpc apps</category>
      <category domain="http://securityratty.com/tag/saas">saas</category>
      <category domain="http://securityratty.com/tag/saas installations">saas installations</category>
      <category domain="http://securityratty.com/tag/market">market</category>
      <source url="http://blog.sciencelogic.com/links-list-112408/11/2008">Links List 11.24.08</source>
    </item>
    <item>
      <title><![CDATA[XSS Comedy III: Tax Cheats with Small Equipment]]></title>
      <link>http://securityratty.com/article/231bdf97af3811aa73d852717e216a77</link>
      <guid>http://securityratty.com/article/231bdf97af3811aa73d852717e216a77</guid>
      <description><![CDATA[As part of an ongoing series, if I may I, the third in a series on the absurd, inane, and perhaps even funny. Lest you forget: the first and second in the series
I don't know about you, but I enjoy...]]></description>
      <content:encoded><![CDATA[As part of an ongoing series, if I may I, the third in a series on the absurd, inane, and perhaps even funny. Lest you forget: the <a href="http://holisticinfosec.blogspot.com/2008/06/xss-comedy-at-mcafee-secures-expense.html" target="_blank">first</a> and <a href="http://holisticinfosec.blogspot.com/2008/09/xss-fortune-cookie.html" target="_blank">second</a> in the series.<br />I don't know about you, but I enjoy occasionally watching offerings like the History Channel, AMC, or the Military Channel. I'm a 40ish, white male and as such I likely fit the general demographic as perceived by the marketing geniuses who buy the late evening advertising blocks on these channels. <br />That does NOT mean that I cheat of my taxes and thus need the services of a plethora of scam artists selling tax relief. Nor does it mean that I have any interest in "enhancement" opportunities like Enzyte or ExtenZe. <br />I just love people who choose to skip out on a primary obligation of citizenship that most of us choose to meet, and expect to magically turn $100,000 in tax debt into $999. Then there are the "businesses" who exploit these folks and willingly convince them of their "success" via the power of advertising, at which point my patience just snaps, as it did last night. <br />Thus, part one of this rant is a mighty <span style="font-weight:bold;">bugger off</span> to all the "tax relief" companies. To their patrons, may I suggest simply paying taxes like the rest of us?<br />Here's an XSS vulnerability in the Freedom Financial Network, "as seen on TV", designed to express precisely how I feel: <br /><br /><a href="http://www.freedomfinancialnetwork.com/tax_debt.php?pid=ffn+go&key=%22%3E%3Cmarquee%3E%3Ch1%3ENOTHING_IS_FREE!%3C%2Fh1%3E%3C%2Fmarquee%3E" target="_blank">http://www.freedomfinancialnetwork.com/tax_debt.php?pid=ffn+go&key=%22%3E%3Cmarquee%3E%3Ch1%3ENOTHING_IS_FREE!%3C%2Fh1%3E%3C%2Fmarquee%3E</a><br /><br />If and when they fix this issue, here's the <a href="http://holisticinfosec.org/video/freedomtaxrelief/nothingisfree.html" target="_blank">video</a> for posterity.<br /><br />Part two of this rant will get you more bang for your buck, and I'm not talking enhancement.<br />Thanks to my utter disdain for the endlessly annoying advertising I went to the ExtenZe site to see what might be broken which immediately led me to discover an entire platform vulnerability in the ColdFusion application built by <a href="http://www.internet-direct-response.com/portfolio.html" target="_blank">Internet Direct Response (IDR)</a>, the wankers who proudly bring you Maxoderm, Vivaxa, Vazomyne, Smoke Away, and Hydroxydrene; all such reputable products, and all repetitively wearing me out via DirectTV. At the ExtenZe site I spotted a variable that seemed worthy of building a <a href="http://www.google.com/search?hl=en&q=inurl:%22microppcsite%22&start=0&sa=N" target="_blank">Googledork</a> from, and I soon discovered that it was a consistent variable in most of the sites pimping this crap; specifically, <span style="font-style:italic;">microppcsite</span>. You can follow all the search results back to our friends at IDR. <br />A little experimentation and I quickly discovered that the similar <span style="font-style:italic;">microppcterm</span> variable was vulnerable to entertaining XSS exploitation so I started with:<br /><br /><a href="http://www.extenzeforlife.com/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EToo_short,_Morningwood?%3C%2Fh1%3E%3C%2Fmarquee%3E&gclid=CJ3T2NXH8JYCFQQCagod7xyBrA" target="_blank">http://www.extenzeforlife.com/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EToo_short,_Morningwood?%3C%2Fh1%3E%3C%2Fmarquee%3E&gclid=CJ3T2NXH8JYCFQQCagod7xyBrA</a><br /><br />Pick your poison, it works on most IDR gems.<br /><br /><a href="http://www.enzyte-male-enhancement.com/google/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EBob_just_wants_your_money.%3C%2Fh1%3E%3C%2Fmarquee%3E" target="_blank">http://www.enzyte-male-enhancement.com/google/?microppcsite=google&microppcterm=%22%3E%3Cmarquee%3E%3Ch1%3EBob_just_wants_your_money.%3C%2Fh1%3E%3C%2Fmarquee%3E</a><br /><br />Again, a <a href="http://holisticinfosec.org/video/enhancement/enhancement.html" target="_blank">video</a>, should IDR choose to fix their app.<br /><br />And now, the grand prize for pathetic: The ExtenZe site is <a href="https://www.mcafeesecure.com/RatingVerify?ref=www.extenzeforlife.com" target="_blank">McAfee Secure</a>. <br /><br />I couldn't make this stuff up if I tried.<br />You thought www stood for world wide web. Try wee willy wankers. *sigh*<br /><br /><a href="http://del.icio.us/post?url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html&title=XSS%20Comedy%20III:%20Tax%20Cheats%20with%20Small%20Equipment " title="XSS Comedy III: Tax Cheats with Small Equipment ">del.icio.us</a> | <a href="http://digg.com/submit?phase=2&amp;url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html" title="XSS Comedy III: Tax Cheats with Small Equipment ">digg</a> | <a href="http://slashdot.org/submit.pl?url=http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html">Submit to Slashdot</a>]]></content:encoded>
      <pubDate>Wed, 12 Nov 2008 13:52:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/idr">idr</category>
      <category domain="http://securityratty.com/tag/idr choose">idr choose</category>
      <category domain="http://securityratty.com/tag/extenze site">extenze site</category>
      <category domain="http://securityratty.com/tag/extenze">extenze</category>
      <category domain="http://securityratty.com/tag/variable">variable</category>
      <category domain="http://securityratty.com/tag/consistent variable">consistent variable</category>
      <category domain="http://securityratty.com/tag/wankers">wankers</category>
      <category domain="http://securityratty.com/tag/choose">choose</category>
      <category domain="http://securityratty.com/tag/tax relief">tax relief</category>
      <source url="http://holisticinfosec.blogspot.com/2008/11/xss-comedy-iii-tax-cheats-with-small.html">XSS Comedy III: Tax Cheats with Small Equipment</source>
    </item>
    <item>
      <title><![CDATA[Links List 10.31.08]]></title>
      <link>http://securityratty.com/article/9428945f69b50703993282159a9d8676</link>
      <guid>http://securityratty.com/article/9428945f69b50703993282159a9d8676</guid>
      <description><![CDATA[Happy Halloween

What an interesting time to hold a technology conference. The DLA Piper Global Technology Leaders Summit last week brought together CXOs from Amazon, Walmart.com, Stanford, Safeway,...]]></description>
      <content:encoded><![CDATA[<p><b>Happy Halloween!</b>
<p><a href="http://blog.sciencelogic.com/wp-content/uploads/2008/10/em7-pumpkin.jpg"><img style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px" height="184" alt="EM7_pumpkin" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/em7-pumpkin-thumb.jpg" width="244" border="0"></a>
<p>What an interesting time to hold a technology conference. The <a href="http://www.eweek.com/c/a/IT-Management/CxOs-Get-Together-for-Candid-OfftheRecord-Chat/?kc=EWKNLNAV10272008STR3" target="_blank">DLA Piper Global Technology Leaders Summit last week</a> brought together CXOs from Amazon, Walmart.com, Stanford, Safeway, Microsoft, Sun, Cisco and others to discuss the state of IT in general and how the economy is impacting it. Some highlights:<br />
<blockquote>
<p>&#8220;Cloud computing for large enterprises is a dead duck, in the opinion of several venture capital firms.&#8221;</p>
</blockquote>
<p>&nbsp;<br />
<blockquote>
<p>&#8220;The current slowdown in the U.S. macroeconomy is definitely going to hurt the IT industry, as it will most of the nation&#8217;s businesses, for at least the next year and most likely into the next two years.&#8221;</p>
</blockquote>
<p>&nbsp;
<p><a href="http://blogs.eweek.com/storage_station/content/general/netapp_cancels_first_user_conference_cites_travel_issues.html" target="_blank">NetApp cancelled its first user conference</a> slated for 2009 citing economy-driven restrictions on <a href="http://www.btnonline.com/businesstravelnews/headlines/frontpage_display.jsp?vnu_content_id=1003875472" target="_blank">business travel</a>.
<p>We recently wrote about the possible <a href="http://blog.sciencelogic.com/are-there-recession-proof-it-products/10/2008" target="_blank">upside for MSPs</a> in this economic downtown. A <a href="http://www.infoworld.com/article/08/10/29/Recession_set_to_boost_outsourcing_1.html?source=NLC-TB&amp;cgd=2008-10-30" target="_blank">survey from EquaTerra</a> of more than 200 outsourcing service suppliers announced that “more than 40 percent of those polled had seen increased demand levels, despite the economic downturn.” The survey suggests that outsourcing projects are changing, with a strong focus on quick return on investment replacing longer-term initiatives to improve end-to-end business processes, according to InfoWorld. So as we saw during <a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008" target="_blank">our own surveys</a> this year, it looks like IT will spend time and money against the practical projects that should and could get done and not taking on ITIL and CMDB projects.
<p>Jonathan Schwartz as a puppet talking about open source and his ponytail. The driest Sesame Street take-off you’ll ever see. Check out the <a href="http://www.techcrunchit.com/2008/10/14/continuous-partial-innovation/" target="_blank">video here</a>. For those of you playing a drinking game at home, “ponytail”.
<p>Denise Dubie <a href="http://www.networkworld.com/newsletters/nsm/2008/102708nsm2.html?nlhtnsm=ts_102908&amp;nladname=102908networksystemsmanagemental" target="_blank">posted a follow up</a> to her article <a href="http://www.networkworld.com/community/node/33996" target="_blank">Novell’s Managed Objects buy</a>, and shared insights from different commenters, including <a href="http://www.networkworld.com/community/node/33996#comment-191253" target="_blank">yours truly</a>.
<p>One of our favorites, the IT Skeptic was <a href="http://www.johnmwillis.com/itil/5-questions-for-the-itskeptic/" target="_blank">featured on John Willis’ blog</a> this week, answering some questions about CMDB, ITSMF and more. He also provided his insight into IBM Tivoli, although he “tries to stay non-partisan”.
<p>Inexplicable. HP posted <a href="http://blogs.wsj.com/biztech/2008/10/27/h-p-commercializes-halloween-with-monsters-that-speak-technobabble/" target="_blank">Halloween-themed videos about datacenters</a> on YouTube this week. Unlike the great <a href="http://www.youtube.com/watch?v=MSqXKp-00hM" target="_blank">IBM videos about the mainframe</a>, these videos speak techno-babble without tempering the lingo with being funny or tongue-in-cheek. Various frightening creatures share information on service management processes and discuss virtualization techniques to help consolidate hardware. Scary.</p>
]]></content:encoded>
      <pubDate>Fri, 31 Oct 2008 18:10:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/projects">projects</category>
      <category domain="http://securityratty.com/tag/practical projects">practical projects</category>
      <category domain="http://securityratty.com/tag/discuss virtualization techniques">discuss virtualization techniques</category>
      <category domain="http://securityratty.com/tag/discuss">discuss</category>
      <category domain="http://securityratty.com/tag/cmdb projects">cmdb projects</category>
      <category domain="http://securityratty.com/tag/cmdb">cmdb</category>
      <category domain="http://securityratty.com/tag/ibm videos">ibm videos</category>
      <category domain="http://securityratty.com/tag/videos">videos</category>
      <category domain="http://securityratty.com/tag/survey suggests">survey suggests</category>
      <source url="http://blog.sciencelogic.com/links-list-103108/10/2008">Links List 10.31.08</source>
    </item>
    <item>
      <title><![CDATA[From Talking to Building]]></title>
      <link>http://securityratty.com/article/15706a77090e85e543e0cd36f7156801</link>
      <guid>http://securityratty.com/article/15706a77090e85e543e0cd36f7156801</guid>
      <description><![CDATA[Ah, the first week at a new place . An exciting time! Even though being in Kuala Lumpur would probable be even more exciting
In any case, excitement is a good cause for sharing it. So, why am I...]]></description>
      <content:encoded><![CDATA[<p>Ah, the first week at <a href="http://www.qualys.com">a new place</a>. An exciting time! Even though <a href="http://chuvakin.blogspot.com/2008/10/on-hitb-2008-conference.html">being in Kuala Lumpur</a> would probable be even more exciting :-)</p>  <p>In any case,&#160; excitement is a good cause for sharing&#160; it. So, why am I excited? Is it only the “new-ness” of my position? </p>  <p>Not so.</p>  <p>I am most excited to be <strong>building</strong> again. That is <em>building</em> as opposed to <em>talking</em>. I <a href="http://chuvakin.blogspot.com/2008/10/change.html">loved being an evangelist</a> and I think I did make the world <a href="http://blog.loglogic.com/images/i-heart-logs.jpg">love logs</a> just a bit more. However, I happen to think that while <a href="http://www.chuvakin.org/secpublic.html">speaking</a> and <a href="http://www.chuvakin.org/newsecurity.html">writing</a> leaves a scratch on the fabric of the Universe, building products <em>that solve people’s problems, that make people happy and that are&#160; both affordable and enjoyable to use</em> is leaving A BIGGER scratch.&#160; As one old wizard said, it allows one to “strike sparks off the guard rail of the Universe!” </p>  <p>That is exactly why I am excited. What I do today will soon [hopefully!] translate into new products that people will enjoy to use <em>(despite the fact that they are compliance-related :-)) </em>and that will solve problems that cause “pain and suffering” on a grand scale.&#160; (No, I am not saying what these are :-))</p>  <p>Having you define things THEN seeing them actually manifest in the real world THEN seeing people smile and say “Thanks!” is HUGELY exciting. Earning revenue in the process definitely doesn’t hurt either :-)</p>  <p>BTW, now I read all this stuff about “security and clouds” and laugh (I can tell you later why it is so funny to me now)</p>  <div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=d4UwM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=d4UwM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=zMy5M"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=zMy5M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=B25gM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=B25gM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/436244684" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 29 Oct 2008 10:52:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/people smile">people smile</category>
      <category domain="http://securityratty.com/tag/solve peoples">solve peoples</category>
      <category domain="http://securityratty.com/tag/bigger scratch">bigger scratch</category>
      <category domain="http://securityratty.com/tag/world love logs">world love logs</category>
      <category domain="http://securityratty.com/tag/people happy">people happy</category>
      <category domain="http://securityratty.com/tag/solve">solve</category>
      <category domain="http://securityratty.com/tag/scratch">scratch</category>
      <category domain="http://securityratty.com/tag/real world">real world</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/436244684/from-talking-to-building.html">From Talking to Building</source>
    </item>
    <item>
      <title><![CDATA[Friday Squid Blogging: Giant Squid in The Onion ]]></title>
      <link>http://securityratty.com/article/c12097c0bc33f500becfaa41a05274c0</link>
      <guid>http://securityratty.com/article/c12097c0bc33f500becfaa41a05274c0</guid>
      <description><![CDATA[Funny...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.theonion.com/content/news/900_pound_giant_squid_joins_cast?utm_source=onion_rss_daily">Funny stuff</a>.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=b2c2M"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=b2c2M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=gReVM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=gReVM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 17 Oct 2008 12:55:57 +0000</pubDate>
      <category domain="http://securityratty.com/tag/funny stuff">funny stuff</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/friday_squid_bl_145.html">Friday Squid Blogging: Giant Squid in The Onion </source>
    </item>
    <item>
      <title><![CDATA[NSA's Warrantless Eavesdropping Targets Innocent Americans]]></title>
      <link>http://securityratty.com/article/a797174a1bf4c09ff4760533fc0fdda1</link>
      <guid>http://securityratty.com/article/a797174a1bf4c09ff4760533fc0fdda1</guid>
      <description><![CDATA[Remember when the U.S. government said it was only spying on terrorists? Anyone with any common sense knew it was lying -- power without oversight is always abused -- but even I didn't think
it was...]]></description>
      <content:encoded><![CDATA[<p>Remember when the U.S. government said it was only spying on terrorists?  Anyone with any common sense knew it was lying -- power without oversight is always abused -- but even I didn't think<br />
<a href="http://www.nytimes.com/2008/10/10/washington/10nsa.html">it</a> <a href="http://abcnews.go.com/Blotter/story?id=5987804&page=1">was</a> <a href="http://www.upi.com/Top_News/2008/10/10/Spy_agency_accused_of_improper_listening/UPI-99751223644874/">this</a> <a href="http://www.reuters.com/article/domesticNews/idUSTRE4990CD20081010">bad</a>:</p>

<blockquote>Faulk says he and others in his section of the NSA facility at Fort Gordon routinely shared salacious or tantalizing phone calls that had been intercepted, alerting office mates to certain time codes of "cuts" that were available on each operator's computer.

<p>"Hey, check this out," Faulk says he would be told, "there's good phone sex or there's some pillow talk, pull up this call, it's really funny, go check it out. It would be some colonel making pillow talk and we would say, 'Wow, this was crazy'," Faulk told ABC News.</blockquote></p>

<p>Warrants are a security device.  They protect us against government abuse of power.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ZIwjM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ZIwjM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=dLnOM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=dLnOM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 15 Oct 2008 08:39:38 +0000</pubDate>
      <category domain="http://securityratty.com/tag/pillow talk">pillow talk</category>
      <category domain="http://securityratty.com/tag/fort gordon routinely">fort gordon routinely</category>
      <category domain="http://securityratty.com/tag/faulk">faulk</category>
      <category domain="http://securityratty.com/tag/phone sex">phone sex</category>
      <category domain="http://securityratty.com/tag/check">check</category>
      <category domain="http://securityratty.com/tag/security device">security device</category>
      <category domain="http://securityratty.com/tag/power">power</category>
      <category domain="http://securityratty.com/tag/time codes">time codes</category>
      <category domain="http://securityratty.com/tag/common sense">common sense</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/nsas_warrantles.html">NSA's Warrantless Eavesdropping Targets Innocent Americans</source>
    </item>
    <item>
      <title><![CDATA[Links List 10.10.08]]></title>
      <link>http://securityratty.com/article/e68ccc27eb670a14c5008d0e963a10e2</link>
      <guid>http://securityratty.com/article/e68ccc27eb670a14c5008d0e963a10e2</guid>
      <description><![CDATA[You cannot turn around without bumping into another bad news story about the economy. From layoffs (10% of eBays workforce, 7.5% of HPs ) to the bailouts to the $7 billion loan the state of California...]]></description>
      <content:encoded><![CDATA[<p>You cannot turn around without bumping into another bad news story about the economy. From layoffs (10% of <a href="http://www.webguild.org/2008/10/ebay-layoffs-announced.php" target="_blank">eBay&#8217;s</a> workforce, 7.5% of <a href="http://www.pcworld.com/businesscenter/article/151102/hp_announces_24600_layoffs_in_wake_of_eds_acquisition.html" target="_blank">HP&#8217;s</a>) to the bailouts to the <a href="http://www.businessweek.com/bwdaily/dnflash/content/oct2008/db2008103_878150.htm?chan=top+news_top+news+index+-+temp_news+%2B+analysis" target="_blank">$7 billion loan</a> the state of California needs to make payroll this month. Really, 7 beeeellllyon dollars? How many people shook their heads and felt sorry for the people working at financial services companies, all the while thinking that the tech sector was a pretty secure place to be (as long as you weren&#8217;t in the IT department at a financial services company)? Well, now apparently comes the wake up call for tech. Oh yeah, a bunch of those startups and not-so-young-anymore startups are FUNDED. They&#8217;re not making MONEY &#8211; or at least certainly not enough to actually be PROFITABLE, given the way they&#8217;ve been spending on payroll, sales and marketing to grow as quickly as possible. To get to that visibility and magic number of customers which means a big payoff for the investors and the founders. From the reports, it&#8217;s back to basics time, or at least that&#8217;s what the <a href="http://valleywag.com/5061391/its-always-darkest-before-its-pitch-black" target="_blank">VCs are telling their portfolio companies</a>. Cut costs. Layoff people. Focus on selling. And get profitable. Duh.</p>
<p>So can <a href="http://blogs.zdnet.com/open-source/?p=2972" target="_blank">open source weather out the economic storm</a>? Emerging from the dot-com bust, open source has matured, its legal framework and values are established, and serious players are in the game. But as this post on ZDNet points out, consolidation is on the way. &#8220;IDC renamed its LinuxWorld Show in San Francisco next year Open Source World &#8211; a clear shot across the bow at O&#8217;Reilly&#8217;s OSCON.&#8221; Will open source (from free to lower-cost alternatives to commercial software) flourish in a time of tightening budgets or will projects quietly go away for lack of funding (VC and that pesky business model thing) and, let&#8217;s face it, the &#8220;extra time&#8221; of IT pros tasked yet again to do more with less?</p>
<p>It&#8217;s October 2008 and Charles Babcock writes, &#8220;<a href="http://www.informationweek.com/news/software/server_virtualization/showArticle.jhtml?articleID=210800267" target="_blank">CA Embraces Virtualization As Future of Data Center Management</a>&#8221;. Beyond keeping up with what competitors are doing, I enjoy this article for the masterful way it depicts the nightmare that is working with traditional frameworks. Too slow, too expensive, too complex, too many modules &#8211; it&#8217;s all in here. And somehow, I don&#8217;t think that was the point of it. So, $154,000 for CA Data Center Automation Manager &#8211; which can &#8220;consult&#8221; the CA CMDB (pricing starting at what do you think, something like $500K to a million &#8211; don&#8217;t forget those services) plus CA Wily APM (Introscope 8 and Wily Customer Experience Manager 4.2; pricing anyone?) metrics that get fed back into Data Center Automation Manager to help determine the virtual machine resources that are needed. Plus can also integrate info from CA Endeavor&#8217;s software change management tracking and CA SysView and in future with CA Management Suite for Mainframe Linux, potentially. I am not kidding about this list. And, we&#8217;ve been hearing this for a while &#8211; &#8220;Unicenter&#8221; the brand goes away and is replaced by &#8220;CA NSM&#8221;. The brand goes away. Why retire a successful brand? Ah.</p>
<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" height="110" alt="joe_tucci" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/joe-tucci1.jpg" width="170" align="left" border="0" />I love this post on EMC, &#8220;<a href="http://www.eweek.com/c/c/Data-Storage/Eleven-Things-You-Didnt-Know-about-the-Worlds-Largest-External-Disk-Storage-Company/?kc=EWKNLNAV10102008STR2" target="_blank">Eleven Things You Didn&#8217;t Know About the World&#8217;s Largest External Disk Storage Company</a>.&#8221; Although I guess I really don&#8217;t know much about Joe Tucci, since #11 says:</p>
<blockquote><p>&#8220;Contrary to conventional thought, it is not true that the EMC President/CEO is the older, gentler brother of the fictional patriarch of HBO&#8217;s hit television series.&#8221; Hunh. I just googled him, thinking maybe it was a resemblance thing. Nope.&quot;</p>
</blockquote>
<p> And on a much lighter note. A funny from Dell. 2 years later, I just stumbled across this Proprietaryville , Jibjab-ish video, called <a href="http://www.youtube.com/watch?v=LOAunpk54PA&amp;eurl" target="_blank">Dell the Journey</a>. Legacy systems being escorted onto the Retirement Home bus. Michael Dell as knight in shining armor, singing no less. Joe Tucci and Larry Ellison showing up as heroes leading the charge against Proprietaryville (yes, funny in and of itself). And my favorite, &#8220;Now let&#8217;s go kick some proprietary apps.&#8221;</p>
<p> <img style="border-right: 0px; border-top: 0px; border-left: 0px; border-bottom: 0px" height="146" alt="delljibjab" src="http://blog.sciencelogic.com/wp-content/uploads/2008/10/delljibjab1.jpg" width="240" border="0" /></p>
]]></content:encoded>
      <pubDate>Fri, 10 Oct 2008 17:15:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/services">services</category>
      <category domain="http://securityratty.com/tag/financial services company">financial services company</category>
      <category domain="http://securityratty.com/tag/source">source</category>
      <category domain="http://securityratty.com/tag/source weather">source weather</category>
      <category domain="http://securityratty.com/tag/time">time</category>
      <category domain="http://securityratty.com/tag/extra time">extra time</category>
      <category domain="http://securityratty.com/tag/successful brand">successful brand</category>
      <category domain="http://securityratty.com/tag/joe tucci">joe tucci</category>
      <category domain="http://securityratty.com/tag/dell">dell</category>
      <source url="http://blog.sciencelogic.com/links-list-101008/10/2008">Links List 10.10.08</source>
    </item>
    <item>
      <title><![CDATA["New Attack" Against Encrypted Images]]></title>
      <link>http://securityratty.com/article/d53a9071459b26f731fbd3ec643dbde8</link>
      <guid>http://securityratty.com/article/d53a9071459b26f731fbd3ec643dbde8</guid>
      <description><![CDATA[In a blatant attempt to get some PR : In a new paper, Bernd Roellgen of Munich-based encryption outfit PMC Ciphers, explains how it is possible to compare an encrypted backup image file made with...]]></description>
      <content:encoded><![CDATA[<p>In a blatant attempt to get some <a href="http://www.techworld.com/security/news/index.cfm?newsid=105263">PR</a>:</p>

<blockquote>In a new paper, Bernd Roellgen of Munich-based encryption outfit PMC Ciphers, explains how it is possible to compare an encrypted backup image file made with almost any commercial encryption program or algorithm to an original that has subsequently changed so that small but telling quantities of data 'leaks'.</blockquote>

<p><a href="http://www.turbocrypt.com/vpics/9a8f098c615a425eab6d17c804dd67ae/whitepapers/backup_attack.pdf">Here's</a> the paper.  Turns out that if you use a block cipher in Electronic Codebook Mode, identical plaintexts encrypt to identical ciphertexts.</p>

<p>Yeah, we already knew that.</p>

<p>And -1 point for a security company requiring the use of Javascript, and not failing gracefully for a browser that doesn't have it enabled.</p>

<p>And -- ahem -- what is it with that photograph in the paper?  Couldn't the researchers have found something a little less adolescent?</p>

<p>For the record, I <a href="http://www.schneier.com/crypto-gram-0303.html#4">doghoused</a> PMC Ciphers back in 2003:</p>

<blockquote>PMC Ciphers. The theory description is so filled with pseudo-cryptography that it's funny to read. Hypotheses are presented as conclusions. Current research is misstated or ignored. The first link is a technical paper with four references, three of them written before 1975. Who needs thirty years of cryptographic research when you have polymorphic cipher theory?</blockquote>

<p>EDITED TO ADD (10/9):  I didn't realize it, but last year PMC Ciphers <a href="http://www.ciphers.de/eng/content/Backround-Info/Bruce-Schneiers-comments.html">responded</a> to my doghousing them.  Funny stuff.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=oYuwM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=oYuwM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=jkURM"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=jkURM" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Thu, 09 Oct 2008 02:44:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/pmc ciphers">pmc ciphers</category>
      <category domain="http://securityratty.com/tag/paper">paper</category>
      <category domain="http://securityratty.com/tag/technical paper">technical paper</category>
      <category domain="http://securityratty.com/tag/commercial encryption program">commercial encryption program</category>
      <category domain="http://securityratty.com/tag/polymorphic cipher theory">polymorphic cipher theory</category>
      <category domain="http://securityratty.com/tag/funny">funny</category>
      <category domain="http://securityratty.com/tag/backup image file">backup image file</category>
      <category domain="http://securityratty.com/tag/identical plaintexts encrypt">identical plaintexts encrypt</category>
      <category domain="http://securityratty.com/tag/funny stuff">funny stuff</category>
      <source url="http://www.schneier.com/blog/archives/2008/10/new_attack_agai.html">"New Attack" Against Encrypted Images</source>
    </item>
    <item>
      <title><![CDATA[Dedicated to All PMs Out There]]></title>
      <link>http://securityratty.com/article/739788c64f71326b08b839e5515ee124</link>
      <guid>http://securityratty.com/article/739788c64f71326b08b839e5515ee124</guid>
      <description><![CDATA[A must read on product management... funny as life

You Might be a PM if
someone asks about your weekend plans and your answer consists of a list of Pri ones, twos, and threes
youve ever ended a...]]></description>
      <content:encoded><![CDATA[<a href="http://securitybuddha.com/2008/09/30/you-might-be-a-pm-if/">A must read</a> on product management... funny as life :-)<br /><br />"<a href="http://securitybuddha.com/2008/09/30/you-might-be-a-pm-if/" rel="bookmark" title="Permanent Link: You Might be a PM if…">You Might be a PM if…</a>    <!-- IF YOU'RE GOING TO USE GOOGLE ADS, THIS IS A GOOD PLACE TO PUT THEM -->           <p>  · … someone asks about your weekend plans and your answer consists of a list of Pri ones, twos, and threes.</p><p>· … you’ve ever ended a relationship using a PowerPoint presentation."</p><p>(<a href="http://securitybuddha.com/2008/09/30/you-might-be-a-pm-if/">more</a>)<br /></p><div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=6SFfM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=6SFfM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=xuaQM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=xuaQM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=tFgDM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=tFgDM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/408639873" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 10:54:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/product management">product management</category>
      <category domain="http://securityratty.com/tag/powerpoint presentation">powerpoint presentation</category>
      <category domain="http://securityratty.com/tag/answer consists">answer consists</category>
      <category domain="http://securityratty.com/tag/weekend plans">weekend plans</category>
      <category domain="http://securityratty.com/tag/funny">funny</category>
      <category domain="http://securityratty.com/tag/org">org</category>
      <category domain="http://securityratty.com/tag/relationship">relationship</category>
      <category domain="http://securityratty.com/tag/threes">threes</category>
      <category domain="http://securityratty.com/tag/pri">pri</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/408639873/dedicated-to-all-pms-out-there.html">Dedicated to All PMs Out There</source>
    </item>
  </channel>
</rss>
