This is dedicated to all the hackers and the crackers, to the hackers and the crackers.
I see in binary, I speak source code, step on my toes, I'll post a million jpegs of you
in a fag pose.
In your digital stance, getting firewalled ho, cause I'm riding the net in my six-fold.
I was a dick with my 56, now with my cable I'm able to get that stable.
On the out, my name is Ace and I'm a Leo. On the digital highway, my name is Neo and I'm a hero.
In a flash, I'll sue you on burning Dreamcast. You need some ISO? Let me through my hard drive rifle.
Our exchange you could never stifle. In a digital hug, you just caught the love bug.
I bootlegged your CD, I caused a fight between Un and Jay-Z.
Your CG, it's all gonna be free, whether we take it by force or we take it nicely.
You feel that rattling your bones when I tell you we just hacked out Jones?
And NASDAQ leaves your fight on your back, cause I am he who loves to hack and crack.
Cause I am he who loves to hack and crack.
This is dedicated to the hackers and the crickets.
Serial codes, source codes, ISOs, RAMs, SIPs, SISs.
This is dedicated to the hackers and crack.
Hello everybody and welcome to Binary Revolution Radio episode number 183, I think.
I have to actually check here and make sure because I have been away from the show for a little while.
But I am back this week joining a co-host who's been on more frequently than me, I think, this season.
Savant is with us on the show again this week.
How you doing?
And let's see, today's date is January 23rd, 2007.
Hey, I think this is the first show I've done for 2007.
You're welcome.
So, we are going to jump right into some housekeeping.
Not gonna mess around or any of that kind of good stuff, cause we got a lot of housekeeping to do.
A little bit of email to do.
And we have a pretty long topic to talk about later on.
So, let's take care of some housekeeping.
I'll go ahead and knock a few things out first, cause I've got quite a few little things to talk about.
I'll try to keep them brief.
First of all, I have to announce that I owned myself in IRC earlier this week.
So, in front of only one witness, but you know what?
Doesn't really matter.
Next Gen busted me.
He was the only other person in the channel.
I accidentally did a cut and paste of the old slash identify, or slash chan serve identify.
So, the password was thrown right out there.
So, yeah.
Kind of fucked that one up a little bit.
You know what?
Did you recover?
Huh?
Oh, yeah.
I immediately changed the passwords, of course.
But it was pretty stupid.
I could have gotten owned even worse.
But, you know.
Shit happens.
What are you gonna do?
Everybody has a little finger fuck once in a while.
Oh, wait a minute.
That sounded...
That's gonna end up in a remix somewhere, too, isn't it?
We really ought to formalize a remix contest.
Yeah.
If you guys are up for it.
Maybe at some point.
I just...
There's just so much material.
I keep screwing everything up.
So many out of context comments.
Oh, it's all good.
So, yeah.
I kind of screwed that up.
But, hey.
What are you gonna do?
Move on with life.
And, of course, everybody...
Well, actually, only one person actually got my password.
So, I gotta give some initial shouts out to Eyeball, who actually got the joke that one of my passwords was,
or the reference to what one of my passwords was referring to.
That made no sense.
But, anyway.
And my Uber IRC password, which was literally Uber IRC password.
So, that was pretty funny, too.
One, two, three, four, five.
That's the same combination I have in my luggage.
Exactly.
Well, because they kept breaking into it when I had my birthday on it, so...
Well, let's see.
What else for housekeeping?
I'm not...
I've talked about this off and on over the past few weeks.
I'm sure Ratchet has passed a little information on as well about the server and its stability.
That's a tough word to say on the radio.
Server stability.
We seem to have it under control now, as far as we can tell.
Well, I'm not going to rehash it over and over again because, well, it was just a really tricky situation.
I appreciate everybody's help and a lot of people offering suggestions and ideas and whatnot,
but it's really hard to do when you're not actually seeing what we're seeing.
A lot of the suggestions coming in are just not appropriate because they just don't fit,
or they're things we've already done, or they're things that just are irrelevant to what's going on.
But just to dispel a couple of myths or rumors that I saw quite a bit,
it doesn't really help.
A few people suggested...
Hold on, I've got to have some iced tea here.
I'm new to this radio thing, apparently.
I've got a few suggestions of people saying,
why don't we delete some of the older posts out of the forum
or remove some of the users who haven't finished authenticating yet.
It doesn't really matter how many users are there
or how many records there are in the database or any of that kind of stuff.
Not on this small of a scale that we are right now.
So we can delete all the old threads or migrate them off to a backup or something like that.
It's going to make a negligible difference.
If the indexes are created properly, it's going to find everything just as fast
with such a small number of records and the hundreds of thousands of posts and stuff that we have.
It's just not going to make a difference at all.
That's not the way to go.
That's really not the solution.
The suggestion some people made of changing from Apache to some other,
it was one I saw quite a bit, tiny web server.
I don't remember what it was exactly.
Switching web servers is not exactly something that's easy to do.
There's a whole lot of reconfiguring.
It would take us more time.
Again, it wasn't really Apache that was the problem per se.
The long and short of it was that we didn't have enough memory anymore.
We simply had outgrown the box.
And we kind of sort of knew that and suspected that and we did see it coming.
It seemed to happen real suddenly, though.
That's the thing.
I guess it just finally hit its breaking point where it started giving up.
And we were trying to tweak it to make it work a little better.
So we were trying to optimize MySQL in the way that it handles and uses memory.
So that's really where the detail was getting down into.
So we're talking about going in and tweaking a lot of the MySQL settings,
a lot of the PHP settings and PHP INI,
a lot of the Apache settings and HTTP CONF.
So we're going through all of these things trying to tweak minuscule little things
just to try to make it use our memory a little bit more efficiently
so that we would not have to upgrade.
And no matter what we came up with and no matter how we tried to tweak it,
the bottom line was it needed more memory than we were able to give it.
That's it.
End of story.
So, you know, again, we appreciate the help.
I know somebody had sent me a, I don't remember if it was an email or what it was,
about how they admin 50 to 100 servers a day or something
and how there's no reason six of us couldn't figure out or do this
and we didn't know what we were doing or something.
That's not the case at all.
Well, I can admin 50 to 100 servers a day if they're all running smoothly
and there's not really any problems.
But when you get down to the point where you're trying to milk
every last bit of performance out of your box,
that's when you've got to spend time to try to get that thing under control.
And we have, frankly, couldn't do that.
We had to get more memory because that was the only thing that would solve the problem.
So we've done that as a temporary solution.
There will be a longer-term solution coming up.
So we'll announce that when it happens or if and when it happens.
But we've already alluded to it in the forums
about how we're going to have to upgrade boxes to something more powerful
because we're just outgrowing what we have.
So we're trying to keep BinRev alive every way that we can.
I'm trying not to completely turn into a beggar on the air.
I know that's the running joke in IRC, the whole we'll hack for food
or, you know, begging BinRev Photoshop with me holding a cardboard sign
and that's all good and everything.
I'm trying to avoid...
That's so funny.
I know, it was good.
Honestly, I am trying to avoid going that far,
but we're going to have to do something because, I mean, it's going to cost...
Quite frankly, it's going to be about $300 out of my pocket more.
And that adds up.
You know, that's going to be about, what, $10 a day?
Yeah, about that.
That, just to give anybody listening, if you've ever wondered,
it's going to cost about $10 a day to keep BinRev up and running.
Just to give you a ballpark.
So, you know, we're going to have...
We'll try to put up some donation links or something from people who have offered to help,
which we very, very much appreciate.
Even if it's just a few bucks here and there, any little bit will help.
And I'm doing exactly what I said I wasn't going to do,
so I'm going to move on to the next topic, which is our forums upgrade.
We finally got the server stable, so stable enough that we could actually go in
and do some upgrading to the server, upgrading to the forums, I should say.
So we have updated the forums as of a couple days ago.
I think it was Sunday evening we did that, Sunday night.
So forums are in place, so go check them out.
And we are in the progress of skinning them.
They changed the way...
See, this is the one thing that kind of annoys me about Envision is
even when they make their point upgrades,
upgrades, they're changing the skins, the way the skins work and the design works.
So the old skins that worked on the old versions
do not migrate over and work successfully in the new version.
So they all have to be tweaked, modified, rewritten, whatever the case may be.
So that's kind of sucky on a point release,
but they did add a lot of cool features in it,
so at the same time it was really a bigger release than it may appear.
So we are in the process of trying to tweak the graphics a little bit,
make them look a little bit more hacker-ish, a little bit nicer,
put the BinRev logo at the top of some of them.
And we are doing that as we speak,
and hopefully in the future we will get another custom theme back up and running,
maybe fix our old custom theme and get it working.
And finally in housekeeping this week,
we have been working on one of our sites that was, I guess, neglected.
It had fallen on hard times because there was no one to administer it.
That was HackerEvents.org,
which in my mind is really our first success story
from the new projects forum that we created about a month or two ago.
Got some volunteers, some people together who are willing to work on this.
We've been meeting in IRC, which has worked out really well.
We've had all five people be very active.
We meet, talk about, discuss things.
It's truly a group project, which is exactly what I love seeing
and which is exactly what this community is about
and exactly what I hoped would come out of creating that forum in the first place.
So I'm very excited and happy to see something like this.
We are in the process of adding lots of events to it day by day.
Anybody who has any that they want to submit,
like local events, Linux user groups, security groups,
anything even remotely related that somebody might find interesting to the hacker community,
add it there, and one of the admins will add it to the list and approve it.
And I think they're going to be skinning it and making that look a little bit nicer as well.
But for now, it's just running the calendar itself,
and the content is, of course, most important.
So that's it for my housekeeping.
Now, Savant, while I take a breath here,
I know you had a West Coast BINREV event you were going to talk about, right?
Yep.
Sip your iced tea, man.
You've heard it.
So West Coast BINREV,
or the loosely collected affiliated BINREVers of us in California
and other parts of the adjoining area,
we're planning a trip to Disneyland in February.
Hit your pens.
I'll wait.
All right.
February 20, I want to say 24th and 25th,
we're going to the Anaheim Disneyland.
It's going to be pretty much an all-day thing.
So far, confirmed are myself and Verbal and our lady friends
and Strom and Generic and a couple other babies.
So sign up.
Come on in.
I mean, if there's enough people together,
then maybe we can find out about a group discount.
Otherwise, yeah, try to make it down.
We're also working on a special hotel afterparty, BYOL.
Which is, of course, bring your own loop.
Oh, okay.
I had to ask about that one.
I'm not into those, uh...
I'm not sure about those kind of parties.
You know, I've got to tell you,
I'm kind of worried right now
because the box that we're recording on,
the fans kicked in pretty awful loud.
It might even be picked up by the microphone.
I'm not sure.
So hopefully this thing doesn't die halfway through the recording here.
No, it would be the lost episode.
It might be sweet.
Well, you know what?
I'm such an ass,
I'd probably just release it anyway.
At this stage...
Like, I don't know what you get, bitches.
That's right.
That's where you don't complain.
Oh, man.
Yeah, actually,
we were going to try to get something together
similar here at the BR-407,
the Orlando meeting,
because we also have a Disney X,
Disney World down here,
Disney blank.
So we were thinking of at least getting together.
Do you have something called a Downtown Disney
or a Disney...
What is it called?
Disney Quest?
Yeah, they've got the shops and shit.
Yeah, yeah.
It's just like a big kind of...
It's like what Disney does,
a strip mall.
Yeah, totally a Disney mall.
Absolutely, yeah.
We've got those, too.
And it's actually...
It was an article that you had written a while back
that actually inspired me to think,
yeah, we should get a bunch of hackers
to get a Disneyland.
Was your War Driving with Mickey article.
Yeah, that was nice.
I thought that the spin of the Disneyland trip
would be Hack Disneyland
will have a bounty hunting contest
where everybody there could come up
with some sort of hack,
like in the Carousel of Progress,
there's all sorts of computers there
that you can use.
Some sort of hack that would be voted on
and then depending on who executed it,
it would be like a game of Hacker Horse
or a scapger hunt of sorts.
Hacker Horse?
Yeah.
Oh.
Well, one of the things I wanted to do
was go around and enumerate
all of the payphones there for Yapple.
Definitely.
So that's another cool thing
you might be able to do
because you know there's always...
At least for ours,
there's always people there,
even late into the evening.
There's always people around,
so if they accept incoming calls,
you're always going to get somebody on there.
Yep.
So that could be fun.
You could even do it in character voices
or something like,
Oh, Mickey!
I'm going to kick your ass!
Oh, boy!
That was actually pretty good,
I must say.
Oh, thank you.
That was almost...
I've got the mouse hostage.
That was almost as good as...
almost as good as Rax's Kermit the Frog.
Oh, shit.
I hear that.
Put those together.
It's also a great place to social engineer
because you've got all the employees working there
and they're all Disney-fied.
They have to smile and whatever,
but you can kind of go in there
and I won't say fuck with them,
but you can go in there
and try to weasel information out of them
and they're trying to walk that tightrope
into being nice
and always answer your questions
and the customer's always right.
You might give them to get up,
give up a little bit of information, yeah.
Well, here's something.
To get...
Now, disabled people
and sometimes special guests
have what's called a Tinkerbell Pass
that they give out in the guest services.
If you have a Tinkerbell Pass,
it's an automatic front to the line
for you and your party.
Now, if you hurt yourself on the park property,
usually they'll give you one
or something of that nature,
you know, vis-a-vis,
buyer-view-wear,
hideous corpus and all that shit.
If you get bitch slapped by chicken?
You might get kicked out of the park
if you're kind of trying to defraud them,
but I'll just plant that seed.
Or you might get bitch slapped by Tigger.
Right.
You might get...
You might get Tigger slapped.
You're right.
But yeah, so that's it for me.
Housekeeping.
All right, cool, cool.
You know what else I...
Here's a...
I don't know why we're talking
and promoting Disney here,
but actually I learned something
kind of bizarre about Disney.
My friend,
a good friend of mine
I went to college with actually,
was down here for his vacation,
brought his family down.
He's got an eight-year-old son.
And this is probably not interesting
to any of my listeners,
but it was just weird
because I never knew it.
All of the employees,
Imagineers, associates,
whatever they're called,
in every store around there,
walking around the park,
anything,
any of the ones that you see,
I don't think the food people,
but any of the other employees
that you see,
they have...
And they sell at the parks,
they sell all these different
Disney World pins
that you can put on your hat,
these hat pins,
or like in the Boy Scouts,
we used to trade pins
and stuff all the time.
Yeah, you can get them
in kiosks.
Right.
They have them all over
the place down here,
but I didn't realize this.
I know that people collect them
and whatever, fine.
I didn't realize
that all of the employees,
their shirts are covered with them.
And I thought it was just flair,
you know?
It's just flair.
I didn't think anything of it.
But my friend,
his eight-year-old son,
I find out now
that those Disney employees
that have the flair on there,
they have to trade you
those pins anytime you want.
So he was going around
to all of these people
with these little pins
he's collected.
And he knows all this stuff.
He's like,
oh, well, this one's a rare.
There's only 2,000 made
of this one.
And this one is only released
in like Switzo Disney
in Switzerland or some shit.
And he's going around
looking and eyeballing
all the employees
and like making them trade him
all the cool pins
that he wanted.
I don't know.
I just thought it was cool
because that's like a weird thing
that nobody,
at least I didn't know.
So that falls kind of
in the hacker sphere.
It's stuff that we weren't
supposed to know
or that's not all that public.
Did you know that?
Yeah, you know,
I'd heard something about it
when I was in school.
There were these girls
that I used to hang out with.
They were Disney super freaks.
And they had mentioned
something about that,
but I didn't know
that they were required to trade.
I thought it was
that they were allowed to.
No, I think if a kid
offers them, they have to.
Now, I'm going to put on my
this could be
complete bullshit hat,
but I've seen pictures
and I'm pretty sure
that it's confirmed
that there is an actual
pseudo half-court basketball hoop
in the top of the Matterhorn
in the Anaheim Disneyland.
And as legend goes
that this is because
in the days
when they were getting
the zoning permits
for Disneyland
that they couldn't have
on the eyesore
that was the Matterhorn
unless it was deemed
like a sporting piece
of sporting equipment
or something along those lines.
Correct me if I'm wrong.
I know you guys
are all going to blast me
in emails
if I fuck this up.
But if you Google it,
there is a picture of it.
Just Google for Matterhorn basketball
or something like that.
Oh, that's a new one.
This is turning into
like a Disney Secrets episode
or something.
See, look at this.
There's all kinds of shit
that you'll have to look forward
if you come on the 24th and 25th.
Yeah, seriously.
It really is.
Disney is, listen,
Disney is a fun place
and a cool place to hang out.
There's lots of stuff like that.
It is, what is it?
It's magical.
It's, yeah,
have a magical day.
That was their slogan
they were all talking about.
I went to a seminar there one time
presented by some of the Disney
speech therapists,
speech givers
or whatever,
speech therapists.
And they were emphasized
how, you know,
they're imagineers
and everything is about imagination
and have a magical day
and all this kind of stuff.
So they do all kinds of stuff.
And of course,
I'm sure you've heard
of the hidden Mickeys.
Oh, yeah.
They have all these hidden Mickeys.
And I got to say,
that's kind of fun
as you're walking around.
Like, as a hacker,
I'm always noticing odd things
or looking for computers
or things that catch my eye.
Like, I joked about my,
how I always see numbers
and I always see
some hidden meaning in them
and patterns
and stuff like that.
And always notice
little things
that are out of the way.
And hidden Mickeys
are just little pictures
of Mickey Mouse ears,
a little standard
Mickey Mouse logo
that they hide
in the rocks
or in the sidewalk
or in any number of places,
swirls of paint
that they've intentionally made
look like the logo.
I don't know.
I guess we've promoted
Disney enough.
We should probably move on
to some e-mail.
Alright, e-mail time.
You ready?
Let's do it.
I'm ready.
I've got my
my lashing pants on.
Alright.
Hey, you've got pants on?
Yeah, for once.
Damn.
Well, I'm already pants-less
so I guess I'm going to
have to continue here.
Don't you hate
when you're sitting
without pants
and your butt
sticks to the leather chair?
That's just,
that's just rough.
You've got to put down
wax paper.
Really?
Yeah, it does.
Even if that solves
one problem
but you know
I have a freshly
shaven sack
so when I get up
I have the whole
bat wings
so you know
I've got that problem
to deal with too.
I thought that was
photoshopped
but I guess not.
No, that was
completely real.
Oh.
Yeah, are we going
to get e-mails
asking me what
bat wings are?
We'll move on.
E-mails,
actually let's,
I'll encapsulate
several of the e-mails
quickly
because quite a few
e-mails of people
talking about
the audio quality
Ratchet was having
some asterisk problem
some VoIP issues
I believe on his end
where the timing
was coming through weird.
I don't know exactly
how or what
he could change
to fix it
and I guess he hadn't
gotten around
to doing it either
but it was a weird thing
that the longer we talked
the more and more
out of sync
we were getting
as far as him
and I having the conversation
when we recorded
and I guess other people
had this as well
everything sounded fine
to us
there was no delay
we were talking normally
of course
obviously I can't
answer a question
that hasn't been asked yet
but for some reason
the way the separate lines
or whatever the separate
voices were getting recorded
it was causing
some kind of lag
to writing maybe
maybe one was writing
faster than the other
I'm not exactly sure
how the writing
to disc works
but it was getting
out of sync
when it was actually
getting written to disc
I think is what was happening
but that's all
water under the bridge
it's irrelevant now
because I am back
on the mic
so you'll have to deal
with my wonderful
wonderful radio voice
he said sarcastically
so our first actual email
this week
letter number one
is from
Redbox Chili Pepper
says
in the last episode
Savant
that's you
quoted Mike Myers
from Wayne's World
then he says
that it's a quote
from the movie
Ferris Bueller's Day Off
a movie from an entirely
different decade
than Wayne's World
how can I trust
your supposedly
extensive hacker knowledge
if you can't even
cite movies properly
my faith in BinRev
is completely shaken
I can't go on like this
thanks for all the good years
but goodbye
a former listener
Redbox Chili Pepper
now Savant
I got fucking pwned
it's true
on a scale of one to ten
exactly how retarded
are you?
at least eleven
Ferris Bueller
and Wayne's World
come on
you know what
okay
and there is no
excuse for that
but that movie
both of them
are excellent
excellent movies
so in favor
of killing myself
which is what
I recommended
that people do
if they hadn't
seen that movie
I'm going to be
taking lashes
for the next two weeks
and I'm giving up
my op status
for a week
but he's right
he's absolutely right
now it's funny
a couple things
number one
his last episode
I went on air
is officially stating
that it was the first episode
I'd ever done
without drinking
any sort of alcohol
while recording
well actually
and you have
another unique
lifestyle change
this week
to announce
well first of all
that I am drinking
on the air today
so everything
should be accurate
again but if not
feel free to flame me
and yeah
like Stank was saying
this is day four
of no cigarette
smoking for me
four days
and you're already
freaked out this bad
it was worse man
it was a lot worse
you got the patch
no the patch
gives me crazy
fever dreams
I'm trying the
nicotine gum
this time around
and I gotta say
it's working pretty
well for my
Nick Fit
okay see I've always
wondered
that gum
is it just
is it nasty
now the original
formula for Nicorette
was complete
ass nasty
you had to sort of
put it up in your
cheek and bite down
on it like it was
a piece of chewing
tobacco or something
however
and that's why
I always avoided it
but they've done
something with it
redesigned the formula
this is the fruit
chill version
it tastes like
Wrigley's
and you can chew
it and the more
you chew it
then the more
nicotine is
distributed
so like if I'm
freaking out
and I'm chewing
real fast
like a maniac
on speed or
something
then I get more
nicotine and I
calm down faster
because I'm like
the little monkey
who pushes the
red button
or do you just
do you pop like
five or six of
them at a time
does that help
well what I've
been doing
I'm not that bad
yet
what I've been
doing is sort of
tricking myself
and then I'll take
regular gum like
a spirit man or
whatever the fuck
and pop a bunch
of them in my
pocket with the
regular nicotine
and so
you're trying to
hack yourself
you're trying to
hack your own
brain into thinking
I have to do
something if I'm
going to quit
because I've been
smoking a pack a day
for five years
oh man
yeah
you got a lot of
damage to undo
yeah well
four days is the
longest I've made
it without anything
so
well
next week on the
show we'll let
you know if he's
relapsed or not
well you'll know
in the newspapers
when they talk
about local hacker
being arrested for
homicide
uh oh
well and
back to this email
the other thing I
got to say is
come on RBCP
let's get real here
I mean
faith in Binrev
are you kidding me
with that
I mean seriously
do you really think
I'm buying that
yeah
he went out to
say my supposedly
extensive hacker
knowledge but I
want to know
who sold you
that line of
bullshit
I have never
ever claimed to
be lead or to
know what the
fuck I was
talking about
but um
you know
in another
chance of
coincidence
I fished out
my PLA
best of radio
mix a couple
days ago from
Hope 5
or excuse me
6
see there I go
again fucking
up
I need to
take a sip
hold on
anyway
and so yeah
I was just
listening to that
again I had no
idea that he was
a fan of the
show
emphasis on was
he's yeah
we lost him
we blew it
because of you
you cost us a
listener and it's
right there in
writing it's
directly attributed
to you I blame
that one for you
you owe me
okay for losing
RBCP I demand
in return a big
titty blonde
listener big
titty blonde
chick listener
so okay
that that I'll
consider that even
sorry RBCP but
you know tits are
greater than PLA
that's sorry
so you want me to
like get said
said listener to
write BRR on her
tits or something
and take a
picture
oh dude that
would be I
would so put
that on the
radio's page
right up at the
top at the
beginning of the
radio archive page
alright well I
know I actually
know a listener
that might do it
but probably
under the pretense
of her face
not being it
so you just
have to take
my word that
she's blonde
or that she's a
chick
yes
are we gonna
have like
are we gonna
have dudes
sending in
pictures of
them
their chest
with BRR
across it
hey whatever
what you
request in the
IRC channel
is none of
my business
on the air
right now
I guess we
just put out
a call to
anybody that
wants to
submit their
boobies with
BRR on them
but I don't
have a whole lot
of faith that
we're gonna get
any real boobies
because we don't
have any real
female listeners
I think we've
established that
right
they're all the
same guy
yeah maybe
one or two
so I tell you
what we'll put
them all up in
the bin rev gallery
somewhere anybody
that submits
anything we'll put
it up for the
hell of it
why not
alright let's
see next email
next email comes
from jukebox
or juke80x
we're gonna go
with jukebox
I'm pretty sure
jukebox says
black rachet
I guess that's
probably ratchet
there
it's french
yeah
here's a list
of mistakes
made during the
show with
corrections
Dan he doesn't
fuck around
he just goes
right in
he's like
here's where
you fucked up
number one
let's see
made during the
show with
corrections
one the show
aired on
January 16th
not 17th
wah wah
the SAT
changed a couple
of years ago
so the highest
score available
is now a
2400
I've never
actually taken
the SAT
just for the
record
nor have I
isn't that
interesting enough
hackers never
seemed to
to take the
SAT
there was a
quote unquote
computer glitch
I'm doing the
little fingers in
the air sign
for
yeah
there was a
computer glitch
that happened
and I never
took the
SATs either
but I do have
two degrees
so
and number
three
oh here it
goes
the joke
made about
quote having
mono for a
year
was a reference
from Wayne's
world
not
Ferris Bueller's
day
off
Savant
dude
you're so
getting roasted
for this
yeah
you know
but
you know
who
Black Rache
should have
also caught
this as well
though
he should have
known better
he didn't
correct you
no
but he should
have known
better than
having me on
the show
again
well that too
but you know
what are you
going to do
we got to have
somebody from
the west coast
to represent
and lord knows
Verbal's not
around these days
anyway
let's see
next email
is
let me see
here
let your cock
be your master
okay I'm sorry
that one's
I got to read
that later
okay
that one is
yeah
okay
actually you know
what funny story
I'll interject here
I have a
trio
700w
smartphone
whatever the hell
the official terms
are these days
where I have my
email sent
one of my
accounts anyway
and it's kind of
a funny thing
here speaking of
your cock
will be your
master
unfortunately the
way this thing
works is it
also forwards
my spam to me
so yeah
there's some
spam slipping
through there
always is
you can't get
it all
and occasionally
I will get
a nasty message
like that
which is
potentially
embarrassing
if you're
ever
like I was
showing a
friend the
cell phone
one time
and he's
showing him
how the
pocket
outlook
and how
the email
works
and he
started
scrolling
through there
and there
was a couple
old spams
on there
and it was
it was a
friend of
mine
so it was
just kind
of funny
but one
other time
I was actually
sitting in a
meeting with a
room full of
people about a
conference room
we had a
conference call
going on
I got a
phone vibrated
that had an
email so I
look at it
and right there
big letters in the
headline was
something I don't
remember exact
something like
we can help you
come bucket loads
or something like
that
and I
literally
I had to put my
hand over my
mouth because I
laughed and people
looked up and I
wondered what the
hell I laughed when I
read it because it was
just so bizarrely funny
so you got to be
careful with what
comes across there
especially if you're
giving it to your boss
or a female co-worker
and that happens to
jump right on the
screen you just
happen to receive that
email right then
that's pretty awkward
timing
besides I already
come bucket load so
I don't really need
that
yeah so can you
forward that to me
yeah actually actually
I will I well you
mean forward you the
email or forward you
a sample of the
actual product
no no I've got
plenty to provide
I'm talking about
the email
got it no problem
all right let's see
last email this week
is from replica
replica says dear
black ratchet and
co-host
all right well
black ratchet is
going to be played
in this email by
savant savant you're
going to be black
ratchet for this
hello
oh let's see
debian gen 2 no
gen 2 linux no
gen 2 asterisk and
ipods is that the
joke
yeah that's one
all right dear
black ratchet and
co-host hey guys I
just recently entered
the t-shirt business
and soon I'll be
coming up with my
own line of t-shirts
once I get better
with photoshop I
was wondering if you
guys know if it
would be legal to
make and sale sell
my own linux slash
unix t-shirts am I
allowed to make a
profit also has
stank dog found
someone to make the
binary revolution
t binary revolution
shirts if he hasn't
please have him
shoot me an email and
we can see if we can
figure something out
replica yes thank you
for the offer but we
do have the t-shirt
hookup here locally
with me because it's
all going to have to
go through me
unfortunately because I
come out of pocket
with this like I do
with every freaking
thing else we do the
only thing we really
need is to get the art
finalized so I am
hopefully working with
some people on that
right now as far as
can you sell linux
shirts or are you
allowed to make a
profit I guess the long
answer to this and
tell me what you think
about this the long
answer is that
technically you have to
be careful that you
don't use any
copyrighted phrases
logos images that
sort of thing as you
get a little bling
bling message there
yeah sorry about that
get be careful that
you don't use them
you can't go out there
and use one of the
slogans that like you
can't just go steal one
from Jinx hackware or
or hacker threads or
one of you can't go out
there and steal one at
least not a copy written
one if it's something
that's like a command or
something I don't I
don't know what the
answer that but the
official answer that I'm
going to give you is
that you have to get a
lawyer and do a proper
copyright search on it
to make sure you're free
and clear that's the
official answer now I
know you're not going to
do that I wouldn't I
mean I would I wouldn't
recommend otherwise but
unofficially the stanks
unofficial advice or
unofficial opinion is
that I would just do a
cursory search make sure
that there isn't already
somebody out there making
t-shirts with the same
thing and make sure you're
not ripping anybody else
off I think that's that's
good enough that in my
that's what I would do if
it were me so well he
he specifically stated
linux and unix shirts so
I mean I would argue
that since they're open
source you should be able
to reproduce them I mean
but like tux for example
I had I've heard conflicting
stories some people saying
that tux is copyrighted and
other people say that it's
not copyrighted I think it's
under gpl the tux logo I'm
not even going to venture a
yeah so it's you have to do
you have to go look it up I
mean it sounds nice to say it
was open source but I mean if
you've got a linux joke
wouldn't putting the words of
a joke in print be disclosing
the source
yeah but you can copyright or
at least trademark slogans and
stuff like that so yeah that's
true
it's it's more than likely you're
going to be fine but you just
you just never know you never
know some company may have
their you know what is it does
does Oracle have a trademark or
on unbreakable or something like
that unbreakable Linux or
something no idea yeah I mean you
just you just got to be careful
because you may think that
unbreakable Linux would be a cool
shirt it sounds pretty cool but you
may get some weird shit from
Oracle I don't know I'm just
making up an example I don't know
if that's true or not the bottom
line is just be careful and you
should be okay if you're making
up your own unique things your
own clever slogans or whatever
you should be okay for the most
part but I would spend a good
amount of time searching on your
own just to make sure it's not
already out there
in worst case scenario even if
someone does get pissed you're
probably just going to see you
from their lawyers I doubt very
much that they would take you to
court without at least telling you
to stop what you're doing yeah
you get a C&D and and we've
gotten those before and usually
just cooperate for the most part
it's not a problem there you know
if they've got a valid claim that
is some people are basically
ignored and told to fuck off but
other people they've and you can
we're not going to go any detail
but you've seen some of the stuff
that we get and how we respond to
it and hey sometimes they're right
we've done something or there's a
copyright violation that we we have
to just suck it up and deal with it
whether we like it or not so be
careful but for the most part yeah
you're going to be safe and if you
do get it you know they're going
to it's going to be a cease and
desist first of all and and then
again unless you become any kind of
larger scale you're not you're not
a blip on the radar no one's even
going to notice you for the most
part unless you blatantly steal
something that's well obviously
well known yeah and scalp it it's
outside of the Oracle Oracle con or
something yeah if you're selling
bootleg copies of Oracle 10g on
burn to DVD out inside of the Oracle
conference annual event you know
yeah you might not get away with
that well okay so that was quite a
bit of stuff I had to catch up with
emails and housekeeping and whatnot so
let's jump into some main topic while
we still got a decent amount of
showtime left and my main topic for
this week is inspired by let's see
this is an article that I ripped out
of a magazine it's a few months old
now this is from September 06 but it's
pretty much not something that's
exactly timely it's called top 14
security tactics or the online version
of it oh my gosh what you're going to
have to save me here is it tiny URL
okay it's a tiny URL slash three seven
lima kilo lima eight that's l-k-l-8
37 l-k-l-8 yeah got it got it got it I
was trying to I was trying to do my
black graduate phonetic oh yeah no you're
not you're only him for that email you're
not him anymore now can't I just pretend
yes you can pretend okay I don't want
to hear any more Boy Scout stories
though all right fair enough well the
online version is just called the 14
best ways to protect your computers
same exact article two different
titles because the one I pulled out was
from Info World magazine so that's
where the tiny URL will take you
infoworld.com so I thought it'd be kind
of interesting I've reason I pulled this
article out is it's well 14 ways to
protect your computer I guess we don't
do top 10 lists anymore anything it's
14 which seems like a strange number
but whatever and let's see I guess the
all it says at the beginning it goes
down it goes into the list pretty
quickly it just says no need for
pricey complex complex security systems
a few simple checks and management
policies will have major impact forget
expensive IDS is host space and unified
threat management appliances here's how to
really get the best security bang for
your buck well we'll be the judge of
that we'll decide that are you ready for
this well do it do it do it all right
actually I have to stop doing on there
yeah Fred Lackey would be the actually
the final say-so on this so we're just
going to try to do our best to live up to
the Lackey expertise it is absolutely
okay number one prevent the installation or
execution of unauthorized software or
content learn what is running on your
computers and why if you don't know
what's on your systems you can't protect
them adequately well duh yeah look up in
the sky do you see the duh signal some of
these some of these are going to be like
that some of these are going to be really
simple and straightforward that are common
sense but people still aren't doing to
be quite honest I mean people are still
blindly running stuff no you're right
well you know all right but see here's
the thing like I know I get frustrated
like I went off one time when we were
doing the malware about how stupid people
are for clicking and falling for this
shit and I do believe that but let's be
honest there's always even as saturated
as the internet is and how many people
have access there's there's always new
people coming online there's always people
who are learning it for the first time
young people older people anybody there's
always people coming online that don't
know this stuff that have never done
this stuff before they're just learning
it so there's always going to be a
constant influx of noobs to the
interweb as a whole so who will get
owned by the wallet inspector at least
once exactly exactly but they'll get
they'll be able to come load buckets if
they order the proper medication yeah
don't forget to forward that to me yeah
yeah let me I should okay let me write
that down forward buckets of come to
savant there's another out of context
one so yeah present prevent insulation
or execution of authorize well I'll tell
you what else oh actually this is going
to segue or sidetrack into another topic
I've been using Vista now for the past
couple months since I've been on the
show regularly so a little more Vista
experience and that's one of the things
that Vista does is it pops up for every
little thing that wants to run or wants
to execute saying are you sure do you
want to do this do you authorize this
application to run this application wants
to connect to the internet this
application wants to launch this other
application it's a little bit annoying
but it is better security so you know
that's the thing about Microsoft is I
got to you got to admit a little bit
that they're in a catch-22 situation
you know they're damned if they do and
they're damned if they don't if they
don't implement the security measures
people talk about how insecure they are
but when they do people bitch about
what a hassle and how annoying it is
well I just do you really think that
that's gonna gonna do the trick I mean
it's the same problem as the ULA right
it's true people are gonna click through
people are gonna click through but the
ULA is like pages and pages of stuff
this is a quick message so yes it will
certainly still happen there's no debate
there but hopefully not as bad because
come on nobody reads ULA's I mean at
some point it's going to come up in
court a situation and maybe it already
has it's going to come up in court where
they're going to stop enforcing ULA's
because they're becoming so ignored that
they're no longer a true effective and
reasonable way to enforce your license
because they're so blatantly ignored that
they could not possibly be upheld in
court I see that day coming eventually
it's probably not too far off yeah well
then again our legal system you never
know these days I guess but yeah
actually you know what since I mentioned
Vista I'll briefly sidetrack here one of
the things I've noticed about Vista is
it is incredibly self-healing like I've
had a lot of little things happen with
Vista like I had I had it power off one
actually my power to the house went off
for a second while I was installing
something which is usually a clusterfuck
right there but when it came back up it
recognized it and uninstalled the
previous version half what everything
that it had done so far and then picked
up and reinstalled from scratch what I was
trying to do so it's got a lot of health
self-healing in there there was one time
where I had changed some network settings
and it redetected and reset all of my
network stuff up correctly without me
really doing anything and there was
something else similar to that as well
where I think an application had
crashed and it was able to detect why
and offer an actual useful solution to
solve it like running it in legacy mode
or some other such nonsense I don't know
but it worked so it's actually very
self-healing which is one of the things I
had not really seen so well in my
testing running of the beta version so
that's one cool thing about Vista I've
been impressed with lately it's got lots
of flair though I got to tell you it is
loaded with flair unnecessary flair
certainly there's no way in hell anybody
should upgrade from Windows XP to Vista
no way if it wasn't free I wouldn't have
uploaded I wouldn't have upgraded either
if I didn't already have a free license
do you think that the flair is a direct
response to those shitty ass Mac versus
PC commercials that that Jimmy Fallon
wannabe is doing you know it's um it's
it's so so obvious that they've ripped
off a lot of stuff from Mac so so obvious
that they've copied a lot of stuff but um
I don't think the flair necessarily is
I think it's just I think they finally
adopted video accelerators for use in an
operating system now video accelerators
are for gaming and maybe some video
editing but do you really need a video
accelerator for your operating system I
mean come on is it really that important
I mean it's don't get me wrong it's cool I
like dragging Windows around that are
transparent or watching my video play as
I alt tab through them it's playing
while it's sideways in the alt tab or
Windows tab or whatever it's called which
is kind of cool um they're they're neat
and pretty and all but they're not
exactly enhancing I'm not getting any
additional um productivity or anything
like that from them and if you don't
have a video accelerator then it just
basically runs like Windows XP with a
little bit different shell I mean it's
yeah there's certainly no reason to
upgrade well real quick while we're
talking about any user license
agreements um if you ever read the
generic Microsoft uh EULA for their
software there's a section in there
about Java support that says you know
do not use Microsoft or Java products in
life support machines or aircraft or
anything that basically your life is on
the line and then it goes on to say that
they are not responsible for death or
injuries as a result of their operating
system well that should be I got a tiny
roll on that um if you guys if you're
ready is 30 that tiny earl dot com slash
32 U is an uvula 86 and V is a vagina
all right um well I would say don't use
Java would be on this top 14 security
tips if you ask me but we all know my
my thoughts of Java so yeah all right
let's see uh back to our list here as
we sidetracked um number two don't let
non-admin users be logged in as
administrators or root what gee you
think what no um this changes
everything yeah I know man I that
messes up completely how I admin my
boxing I let my babysitter you know
make herself a slash home when I'm
not when I'm gone I let your babysitter
make herself at home too slash home yeah
oh okay uh let's see so that was pretty
obvious there's not much to elaborate
there you don't let non-admin users be
yeah that's pretty dumb uh number three
secure your email convert all incoming
HTML content to plain text and block all
file extensions by default except the
handful or two you want to allow now
this one I don't know um that's easier
said than done in my opinion like one of
the things that annoys the hell out of
me with Microsoft Outlook is the fact
that it does block every freaking
extension known to mankind you have to
trick your own Microsoft Outlook your
own exchange server to pass a zip file
across to a co-worker or something like
you have to rename it dot jizz or
something just to fool the damn thing
into allowing you to move to send the
file to somebody else because if God
forbid you send a zip file that means
it's a virus or something so it's
annoying as all hell to do what this
guy's suggesting secure yes no debate
there but it's kind of one of those
things about yeah your computer's
secure if it's coded in a block of
concrete yeah it's secure but there's a
usability trade-off there and to me
blocking every file extension I would
say block things like VBS stuff like
that some scripting languages that could
execute on command on demand and maybe
that's all he's referring to here but I
don't know what do you think and the
incoming HTML you can sanitize the HTML
there are algorithms and applications
that will do that as well I mean
security it shouldn't be completely
transparent I suppose I tend to agree
with him I definitely use text only
email but as far as locking out all
extensions that's definitely best
policy but I think you're right it
could be a little restrictive well and
again although I'm sorry go ahead 90% of
people who use email in the corporate
environment or at home or you know
grandma sending pictures of her kittens
who are kids or whatever I think that's
probably a good policy or her titties I
mean I wouldn't worry about running
extensions like .text or you know unless
there's another jpeg of death pictures or
something I would say that they just be
more diligent about which extensions are
allowed but maybe there should be a
wizard or something I don't know I don't
know well and you know what else it is
also it's it's about the audience too I
mean yeah it depends on what you're
doing and this comes back to you know
we got to do the new 2600 came out this
this week or two weeks ago I don't know
and there was another article in there
again I'm getting kind of tired of these
articles there was one of three issues
ago called what was it something about
why administrators make policies or
something like that and it lists all their
policies and reasons behind them well he
has some very good points in some of
those things and if you're an
administrator at a company and you're
trying to protect your system then yeah
you are going to be pretty harsh on what
you allow and don't allow and I could see
blocking a lot of this stuff but it also
depends on what your business does if
your business is of sending Excel
spreadsheet information back and forth you
don't want to block XLS so you're going to
have to make some allowances I guess
depending on your business use and what's
going to be useful to you you can't block
everything blindly you have I see I guess
I'm I understand what he's saying and I
agree with both you that it's certainly
best case scenario you can't get any
better than blocking everything but at
the same time I've just always been a
firm believer that education is the way to
solve these things not rigid restrictions
that make that unusable for the high
percentage of users who do know what
the fuck they're doing just to cover
that three percent of fucktards that
work at the company you know what I
mean right so I understand why they
make them in that article in 2600 which
had a response the episode the issue
after that about why we break rules and
now there's another one in the current
one I guess responding to the response
and countering the counter I don't know
what the hell it's about but anyway I
certainly don't disagree that there are
reasons that people make all these
rules and actually this list kind of is
those rules I guess if you want to
think of it like that blocking
attachments and sanitizing incoming
HDL but what about sometimes you want
HTML coming in sometimes you need HTML
coming in that's true you know there's
again there's solutions out there you
can have things that that block it
initially and says this contains HTML do
you want to view it and if you know it's
safe like you're expecting your I don't
know your email yeah or email of your
your cell phone bill or something is
what I was going to say or something
that you know is safe HTML from a
company or a person you know so alright
so that one's I think a little bit
idealistic an unrealistic but it's it's
certainly valid and valuable number four
oh it's important to remember that
they're talking about how to not spend
$10,000 on a hardware appliance when
this is something you should be doing
first and I think that that still
applies well that's true but I guess
if you're a smaller businesses but
large businesses should spring the
money forward obviously on the on that
and the real small ones probably aren't
so there's not you know there's I don't
think there is much in between you're
either a small business who you're
going to let it all go or you're a big
business and you're going to block
everything with your appliances I don't
know how many people fall into that
middle ground probably more than I'm
giving credit for I don't know anyway
number four secure your passwords no
shit Sherlock no require long passwords
10 character or longer for normal users
15 characters or longer for admin
accounts implement account lockout if
even if even with only wow that's an
awful sentence if even only with only a
one-minute lockout on Windows disable
LM password hashes on Unix Linux use
the newer crypt three hashes MD five
style hashes or even better be crypt
hashes if your OS supports it well
MD five is nothing so again ideally sure
longer passwords stronger passwords are
better but Betty in accounting wants to
make her password whatever her cat's
name is or her grandchild you know what I
mean well then Betty in accounting
should use the past phrase instead of a
password like mitten is the cutest
fucking cat ever I hear really strong
password and it'd be easy to remember
absolutely agree on this 100% 100% it's
kind of um I don't think I have to admit I
don't think I've ever seen in practice
though password requirements that differ
based on use 10 characters for normal
users 15 for admin accounts you can
state that as a policy but I don't
think I've ever seen that technically
enforced I don't think I've ever seen
an error that says warning you're an
admin and your password must be 15
characters where it's smart enough to
tell one from the other have you ever
seen that before I mean I think it's
doable some third-party web application
installing some form or something maybe
but even then that was a big if the
developers were that security minded but
even then I don't think in sort of any
sort of general distribution software
you know what though that that is not
that's damn easy actually to implement
technically I mean there's nothing to
that designate what's an admin account
or not and when you accept the password
check is it admin then say it has
different criteria actually I think
that's something that should be done
more often I think I like that a lot
again Betty in accounting is going to
be a little miffed at it but she's
going to have to adapt and once again
it comes back to what I said earlier
it's education people need to know
this now there's also and this is the
biggest example for that delicate
balance if you make them change their
password every week with those
policies of making it they're going to
run out of ideas they're going to
start reusing passwords they're going
to start making easier passwords out of
frustration agree completely you got
to have that balance so I think like
what common what I've seen very
commonly is myself for an example is
we change every I think four months
and we require mixed case numbers and
special at least one number at least one
special character and mixed case and
all the passwords with a minimum of
eight characters I think it is I prefer
longer but we go with eight for the most
part and I think that's a pretty good
balance I'll tell you what most of those
passwords are though they're fives
instead of s's threes instead of e's
and an exclamation point at the end
actually I do not fall into the I
sometimes I will mix them up but I
don't have any regular I don't always
change my e's to threes I don't always
change my one eyes to ones but I will
occasionally you got to keep that
mixed up too because yes you you don't
want to make a pattern it's funny you
mentioned because that's actually an
article that I'm finally getting around
to writing again now that I have some
time and that's one of the articles I
was working on but anyway let's kind of
catch up here because we're running
not short yet but we're starting to run
out of time remember number five is
actually I think one of the other best
ones it's called well it says number
five practice deny by default and least
privilege whenever possible when
developing least privileged security
policies use role-based security instead
of one such as instead of one IT
security group you should have a group
for each IT role yeah that's a little
overkill but the bottom line of least
privilege whenever possible least
privilege is I think absolutely on
point don't give anybody any more
access than they need absolutely need
yeah yeah and and especially like
there's a really good example of that
is any type of EAP software any type of
enterprise level system of any kind
where you're rolling it out
accountants only need to access what
accountants need to access so you can
make a role and that's what he's
saying by these role-based stuff and I
look at that this decoder calling me
in the middle of the show his call
coming on the other line and I'm not
going to answer it can you still hear
me okay by the way yeah okay you're
going to get voxed for a second as
decoder there he goes he hung up
decoder is on this week's episode of
binary revolution radio unbeknownst to
him but I was saying that's what he's
saying by roles if you're in
accounting you have an accounting
role set up and they're only allowed
access to screens a b c d and e whereas
people over in the ass wiping
department I don't know they only get
access to screen 7 to order more TP I
don't know whatever the case may be and
only give them access to what they need
and what they use now there's one
caveat I'm going to throw into this
that frustrates me as a programmer and
now he's calling my cell phone decoder I'm
going to have to get back to you there
buddy one caveat to that is as a
programmer I get frustrated if I get
clumped into one of those groups and I
need access to some other tables or you
know somebody from accounting calls me
and wants me to check something or fix
something for him but I don't have
access to accounting because they only
gave me least privilege you got to make
some exceptions there for staff you got
to extend certain levels of trust to
your IT group your IT people but
definitely for users I'm on board with
that 110 percent
you know
let's just go on to the next one so it
pretty much goes into the same thing
okay six is define and enforce security
domains who needs access to what what
types of traffic are legitimate answer
these questions and then design
perimeter defenses take baselines and
note abnormal traffic well you talk
about that and I'm going to have some
ice tea
absolutely okay well it reminds me of when
I worked at the my previous company is a
tech janitor we had a huge problem with
the majority of the staff and we're
talking 200 people in the house
running off of I think 61 it wasn't a
fat pipe but anyway they would always go
to my space just constantly like
majority of the traffic my space would
get 60 to 80 percent more hits than our
home page would you know from internal
use and the problem with my space is
that it does cater the lowest common
denominator people are used to a
certain level of idiocy and so things
like getting my space fished or getting
trojans set along the lines it may seem
like benign activity but really if if
betting accounting uses the same profile
password as she does for your w2 forms
then there's a real problem here she
shouldn't be checking from work in the
first place and I know that's kind of a
sort of off topic red but really deny by
default least privilege wherever possible
in the security domain you have to
consider that everything is a threat
unless you've specifically analyzed and
assessed it beforehand and have
established that it's okay to this
extent but it's just blatant wild
rampaging activity on your network is
going to end up in more security
breaches than than not yeah I you know
the easy answer that is just everybody
should block my space that that's at the
end well I think we did a DNS poison
locally and redirected it to mcdonald's
there you go let's see number seven
encrypt all confidential data whenever
possible especially on portable computers
and media there's no excuse for not
doing this the bad PR you'll get blah
blah blah encryption very good thing
absolutely no debating there's no
denying that's got to be a great
practice I think I've gone into I think
verbal and I have talked about this
before because verbal also very much
agrees with this and playing devil's
advocate to him my defense or my
reasoning anyway is that encryption is
still not easy enough for your everyday
user to use it still hasn't been
incorporated easily enough into the
outlook and the Thunderbird and the
different clients that they're using
some of it is you know they've made it
very easily very easy for you to set up
SSL on your website and when you
somebody browses to it redirects it
encrypts all that traffic so that you
can securely purchase things through
the web or whatever but it's not that
level on other applications other than
online other than browsers right well
there's the GPG plug-in for Thunderbird
that if you haven't checked out you're
really ought to because it makes the
whole process pretty easy yeah outlet
doesn't have any free easily accessible
or at least corporate aware suite like
one thing I've noticed with management
types is that if you throw the word
free or open source in front of them
they automatically assume cheap and
unreliable yeah and if something's free
then how could it be any good and so
you might find a lot of apprehension
there why would we use a free product
to encrypt our most important data
let's just not encrypt it at all right
well any kind of encryption is better
than no encryption first of all right but
yeah and actually that mentality is
starting to change it's probably for the
bad reasons the reason being they're
saving money they're being penny
pinchers but that's a whole nother
topic all together I guess but one
other thing kind of related to this and
maybe this would make a show in and of
itself is the the new onset of these
new encrypted file systems and things
that are integrated that will encrypt
everything on your hard drive completely
authenticated with just you logging in
one time and if anybody were to ever get
it they'd never be able to get it
unencrypted there's been a lot of
breakthroughs in that and again we could
go into that in more detail but I think
I think we'll just go along with
encryption is good certainly we support
that and the easier it becomes for your
everyday Thelma in accounting or
grandmother to use then it will
definitely change a lot of things number
eight update patch management for OS's
and all applications have you patched
macromedia flash real player and
adobe acrobat lately yeah I guess you
can't really debate well actually I
could think of one debate for that but
I pretty much agree with this there's
something to be said about not
upgrading to things right away because
there's sometimes bugs in there
sometimes they're not backwards
compatible ie 7 is a great example a
lot of people a lot of corporations
aren't moved to that yet because it's
not backwards compatible with a lot
of their applications doesn't have
good legacy support so there's
something to be said about not
always upgrading immediately but for
the most part the benefits are going
to outweigh that never upgrade to a
beta but don't most applications now
call home and tell you that there's
an upgrade available they've been
really good about that but yeah it's
becoming more and more common for
sure yeah that that's definitely a
great thing because the other thing
is human nature you're going to
forget about it quite frankly
especially when you've got tons of
applications installed one you know
okay I'm going to rant for a mini
second here but most people that I've
ever had those calls of my neighbors
hey will you fix my computer those
fucking calls it never fails it never
ever fails that I always got that
little yellow shield on the bottom
corner you've got the Java update thing
next to what you've got the fucking
Dell support logo you've got 14
important updates pending nobody does
this shit I mean I'm sure our
listeners who are tech savvy enough to
actually care to click a radio show do
but goddamn like it's one of those
things where you know you could use
Kazaa and your fucking peer-to-peer
applications all day and night for the
most part as long as your shit patched I
mean the people are still getting caught
with you know blaster or code red or
something because they're downloading
their goddamn Britney Spears naked videos
off the fucking peer-to-peer and they're
they're not running their updates okay
yeah the you know that goes back to
I need another piece of gum hold on
that goes back to what you said earlier
about there's always new people but you
know what that to me falls more under
just pure laziness and sometimes it's
also why I never do side work like that
anymore I might help out a friend or
family that asks or something but for
most part to me they learn the lesson
better if I tell them that oh the
solution is and sometimes it's better
to lie sometimes it's easier to say
you know what you you've gotten a
virus you've gotten a malware you've
gotten spyware and there's no way to
clean it up you have to reformat your
drive and start over that's the best
way to drill the message home because
then they realize oh I better be more
careful next time because I just lost
everything right so sometimes that you
got to play the tough love when it comes
to that my opinion of course no I agree
completely number nine is that we're
wrong number nine implement anti-virus
anti-spam and anti spyware tools on the
gateway and or at the host level well
yeah that's pretty straightforward I can't
argue with that one no be careful though
and we've gone into this in the show in
the past you know with with some of
these gateways and actually not even
with the gateway even on your on your
client side sometimes you get false
positives you're going to lose email
that's not really spam just because it
triggers certain keywords and stuff so
it's going to happen occasionally but
the the gains far outweigh the risks in
that situation I think number 10 this
one could be number 10 is embrace
security by obscurity rename your admin
and root accounts to something else don't
have an account called exchange admin
don't give your file server name such as
fs1 exchange one or gateway serve one put
services on non-default ports when you
can you can move ssh to 30456 or blah
blah blah blah blah blah I think we get the
point there now you know hackers for years
have screamed about never relying on
security for obscurity and I've always
disagreed with it and let me explain
why it's because everything that he
suggested to do here is perfectly valid
security by obscurity in and of itself of
course is terrible you can't expect your
your software or anything to be secure
just because you don't document it
somewhere publicize it that's there if
that's your only measure of security
that's terrible but you should always
basically what I interpret this is take
everything off of default yep that's
pretty much what I'm saying when they
say of security through obscurity yeah
move it off of whatever default port it
uses change the default username change
your default passwords etc etc the way
that should read is never rely on only
security through obscurity but
definitely implemented security is a
layered process you need to have as
many defense in depth rings as possible
and you know that's a cliche you hear a
lot in security world secure in the
technical security world is layered
security but it's so accurate and so
true it really is it's one of those
fucking dusting is like the the bottom
line I mean this is if you're serious
about securing your shit and if you're
a corporation if you're a company with
something to lose then that is step
number one after you know enforce good
passwords you know I even layer layers of
security and that makes no sense like
for example I don't run only one like
like for example virus checking is only
one form of security one layer of
security that you're protecting yourself
front but I don't even run only one
virus scanner I run two or three virus
scanners on all my systems because the
signatures are never all up to date on
each other they've always got
differences and that's just one
example I mean same thing with spyware
I don't just run out of where I'll put
on search and destroy I'll put on any
number of others you know I'll try
several ones that I never go with just
one solution I don't have just one
firewall on my systems at home I just
don't do it you can have layers of
your layers that sounds kind of
weird anyway number 11 number 11 scan
for and investigate unexpected
listening TCP or UDP ports on your
network well that one's not really so
much for the user client side of things
that's obviously for the administrator
side of things if you see something on
your server that you don't recognize
and you didn't install yeah check it
out because that's root catch you've
been you've been root kitted you've
been root rooted and it's installed
something on there and if you've got
something shouting out to IRC and your
box is an exchange server that doesn't
use IS IRC or whatever yep you got
owned then you got to check into it and
it will moreover things like the older
versions of iTunes or win amps that
people would think are pretty benign and
used to listen to their music at their
workstations they have you know local
exploits that will pop to admin access
or or buffer overflows or you know
insert your favorite exploit here
right so it's not I mean it's it's
also the devil you know not just the
devil you don't true true yeah that's a
good point it is client side as much
more I was thinking more server side
and admin side but you're right
absolutely that's a good point client
side too but you know and this is again
back to real realistically any user using
Windows of any flavor Windows XP whatever
you've got 50 80 117 services running at
any given fucking point when there's
Windows XP and you can't find an isolate
one little thing in there very easily
certainly not grandma or Thelma Lou in
accounting whatever I keep changing her
name to they're not going to notice
they're not going to know where to look
and even if they did they're not going
to notice they're going to see stuff and
I think I told this story on the air a
long time ago about my sister got the
teddy bear virus that's that's what she
called it it was because it was one of
the Windows system files that has a
little teddy bear icon on it while it's
running and she got one of those chain
letter emails that said warning this is a
virus you must delete it and she's like
oh I better I found it I better delete
it I know it was funny that was good
stuff oh I boy I I let her have it for
that one she felt pretty stupid now the
teddy bear virus she called it so yeah I'm
not sure I was going with that but that
was a funny story number 12 track where
everyone browses on the internet and for
how long nope nope nope nope I don't like
this one already number 12 track where
everyone browses on the internet and for
how long post the findings on a real
time online report that is accessible by
anyone this recommendation tends to make
users internet surfing habits self-policing
I bet it will also lead to a sudden
increase in productivity well I'm gonna
have to give you a big fat fuck you on
that one certainly businesses have the
right I wouldn't debate that they have
the right it's their equipment it's their
network they certainly have the right to
spy and track everything they want but a it's
not ethical in my opinion and be if you know of
individual employees or something that may
be abusing the service then focus on those
employees but don't blanketly don't throw a
blanket over your whole company and catch
everybody up in that net and track everything
they do I do not like this one at all I know I
know I know I it is it's kind of for me too it's
well-intended I know if you're thinking from an
admin standpoint you want to protect your
server and stuff like that and productivity but
you know what well saying let I tell you what
let's also let me let me also throw this in the
logistics behind that you're gonna have to hire
somebody full-time practically who's going to
go through and monitor and watch what is
considered allowable or safe and not allowable
what where do we draw the line I mean I can
go to binrev.com and get a lot of good useful
information for my programming or for something
I'm working on but that'd be the first thing
that would be banned or blocked you know so
there's a catch-22 I can go into IRC during
the day and go into pound coding on the IRC
binrev net server and get an answer to my
question but I don't want that being posted
out there that I'm hanging out in IRC or I'm
unproductive or somebody puts a kiddie porn joke
on there and then that gets stuck up on a wall
somewhere that's not cool oh and then think of
think of the justification okay Joe Joe in
accounts payable or something is gay and he's
not out but his boyfriend sends him a link that
has you know maybe some css tag from
joesgaylover.com or something okay just
hypothetically now if this gets automatically
posted even though Joe who's been completely
quiet and compliant about his sexuality this
whole time is suddenly outed you know on
this this scrolling LED ticker this defcon
wall of shame I mean what's the liability
for the company or something like that I
mean yeah it is kind of a wall of sheep for
millions it is it is kind of a wall of
sheep isn't it yeah um yeah that's a good
point yeah I think that's going a little
far political stepping into evil or
dictatorship I mean the more you threaten
someone to do something like the more
people are going to look into ways to
circumvent that the harder you squeeze the
more people are going to slip through but
that's not any excuse that there's no
exchange for just being a good manager
and talking to them personally about it
exactly and you know what I would refer
those users who are concerned about that
back to number seven encrypt all confidential
data whenever possible yep tunnel your
shit through SSH they're not going to be
able to do shit I feel like kind of a
hypocrite of course if I and then on one
hand telling people to not do anything
and on the other hand to encrypt it but I
mean that's the hacker mentality I guess
well it's a duality to it it's not black
and white it's not that quite that simple
you know if I'm at okay let's say um
political affiliation or um come on is
there really anything wrong with um
exchanging email with a family member
or something I mean people are entitled
to break time if there are you can you
know people are abusing it you know
people aren't getting their work done or
if you catch somebody on multiple
occasions then yes monitor them that I
see you have that right as no as an
employee as a company I should say I can
see that and I can understand that and I
don't know that I would argue against it
in that case but throwing this net out
there for everybody and just phishing
that's the way that's what I don't like
about it it's just casting the net
target it focus it and then from again
the administration standpoint the
logistics it takes time you're going to
hire somebody is it really worth you
spending all the time parsing through
logs posting this kind of stuff looking
through it you're going to have legal
issues like you said I don't know that
one I'm going to so far I'm going to say
that's the only one I will out and out
disagree with only the way that it's
implemented again it can be more fine
tuned I could work with it having a
policy having a policy is one thing but
the way you enforce it is a whole
different thing entirely so I don't
debate the policy I debate the
application or the enforcement of said
policy let's see quickly wrap up these
last two number 13 automate security if
you don't automate it you won't do it
consistently I don't know about that
well that kind of comes back to what we
said earlier about applications
reminding you that they need to be
upgraded or telling you when a new
upgrade is available I mean I guess
you could make a policy or make a
conscious decision the beginning of
every month upgrade the server I do
that with the bin ref server all the
time it ought to a lot of stuff most
stuff is automatically it does
automatically happen but I still go
there once a month and manually
upgrade things just in case something
didn't upgrade that should have or there
was a failure or connection problem or
something just to back it up just don't
get too comfortable in your
automation that you're not actually
securing systems anymore you're just
hoping that the machine's working
properly right right absolutely and
number 14 you know what in 14 to me
this one should be number one I don't
know why this is the last one because
I've said it twice I think in this
episode number one should be but
they've got it listed as 14 educate
staff and employees about security risks
and create appropriate policies and
procedures education I said that that
is the key to all of this stuff I'm
sorry you can be you can be an
accountant you can be a secretary you
can be a janitor you can be whatever it
is in the company but just it's not that
big a deal to have everybody go in for a
week a day even a few hours or a few
minutes a half an hour explanation of
this is how our email system works you
should never do this you should never
do that and here's why people aren't
stupid educate them teach them what to
do and what not to do and they'll get
the hang of it and they will hopefully
not there's always going to be some
people that do it anyway there's always
going to people that ignore you and
there are going to be fucktards that
don't get it no matter how many times
you tell them well you fire them
because you don't want them working
for you anyway if they're that rock
stupid
well hey now every company is that every
corporate environment that I've worked
at I've had to sit through once a year
at least a fucking two hour long video
and talk about sexual harassment
policies and it's required by the state
and all that shit well you know what
that seems to me to be way more obvious
than most of the things that we covered
in these emails and yet it is still
required by law so how is this any
different
yeah I agree absolutely right
well I mean I guess that's all we can
really say about that yeah and I think
that's all we can really say about the
article he does mention in his closing
statement that he left off something
that could be there very easily be there
and that is physical security and that
is I agree with that too I would have
made that a 15th one myself and of
course I'm sure other people listeners
might have others they would add or
maybe they would debate or argue with
some of the ones we've talked about and
if you do of course feel free to email
us radio at binrev.com and tell us that
you agree or disagree with some of
these policies we're not going to take
too much offense and I think that's
going to do it for this episode we've
got
wow I've got a lot of topics I want to
cover here in the upcoming months I've
got several new guest hosts coming on
the show that I'm trying to work out
trying to get some some new people on
here that are fairly well-known
people that we've just never I don't
know I just never invited on I'm
going to start getting some people on
the show and some new topics so I'm
got a lot of stuff coming up in the
next month or two while mr. ratchet
mr. rashay takes a break and takes
care of a few things so I you're stuck
with me for at least a month or so so
let's see how about we move into some
shouts this week mine are pretty easy
for me this week I'm going to give
shouts out to all the guys working on
hackerevents.org that I mentioned
earlier specifically to zal91 who's
also been helping with some graphic
stuff to live and dead risk-free
kotrin and enigma all friends of the
show and the finrev so my shouts go to
them this week how about you okay I'm
everyone you just named with specific
regards to zal91 big up to that guy
great box everyone in pound cookie
Damon the PLA and red box chili pepper
and my girlfriend Elizabeth who will
probably never ever hear this oh man
score let's see side of the week side of
the week this week is I gotta say kind
of pervish like anything we do on the
show is not pervish but it's that
deleted YouTube video site somebody had
posted this in the forums I believe and
I've just been completely addicted by
it even though it's filled with jail
bait I learned by the way I learned
this in IRC I learned all the terrible
things in IRC I didn't know what JB
stood for JB stands for jail bait for
anybody that doesn't know that if
people are in IRC talking about oh
wow this is totally JB oh my gosh look
at all the JB I'm like what the fuck is
JB I don't know what that means stands
it turns out that stands for jail bait I
did not realize that so there's lots of
jail bait at today's side of the week
oh I'm terrible actually there's don't
get me wrong there's not actually
really bad stuff that I've seen
anyway it's a bunch of chicks
dancing around in their in their
bedrooms dancing to don't you wish
your girlfriend was hot like me
don't you somebody's gonna loop that
one as well but anyway the site which
I haven't said yet is let's see
www.youtube.infamousx.com
that's I-N-F-A-M-O-U-S-X all one word
infamousx.com youtube.infamousx.com
our closing music this week is actually
from my good friend MC Frontalot who he
and I are actually working on some
projects as well but he just released a
new single from his nerdcore rising
album it's called this old man this is
actually my favorite song my favorite
beat from the whole album so this is one
of my favorite songs I'm glad he
actually released this one as the next
single so listen to this and enjoy it
and go buy nerdcore rising the album
bitches and you won't hear the word
bitches on any of his rhymes either he's
much more eloquent than I am me I'm just
low-class white trash trailer trash
whatever other cliche you want but
whatever I am we will see you next week
same hack time same hack channel
I keep getting older and hairier on my neck
back and derriere ho but not atop the paint
dear DNA let's negotiate I'll trade a fading
vision you can have that back plus the 30 year old man
belly is kinda whack my hearing is hearing
death this and I wheeze yo please take me from the wrist
hurt disease it's invisible that these a whole list of ailments
should do anything for the crew I'm a fail ten times out of ten
to age in reverse like morgue is there anything sadder than a dork
for whom the new hotness is not just inaccessible it's rumbled against you kids
reduce your decibels don't make me come over there and shake my cane
it's that rapper from the double a-r-b and he insane this old man he rhymed once he put up some valiant france with a wig
whacked better like a pupil of some charm this old man kept driving on
joints creaking while I squeak around the stage hello grandmother's telling me I ought to act my age deep range
already I don't got no brain medicine if we were running out of food on a boat I'd get jettisoned
or eaten I'm unsweetened
don't tell me that I got the shorted straw I'm not a cretin just a little senile and gassy and slow
but I bet I'm very salty and I can still row let's gobble on that infant
infants are useless also very soft which is good cause I'm truthless
come on kids you wanna get rescued or what don't mumble all amongst yourselves speak up
I lost my ear horn the other day on the bus you would think by the way you whippersnappers make a fuss
that I said something crazy profound a brim scene wait where the ocean go where have you taken me
this old man he run twice he found this would not suffice with a wick whack better like a pupil of some men
this old man was our right grif for this old man was our right grif
now front of lights shopping for the top of the hill should have bought a burial plot
soon as I got ill but I foolishly thought that I could put it off
now I'm ghoulishly fraught with the
soft in the head hard in the disposition
how to earn this intractable attrition
of the vigor that I figured would be mine for life
is there no upside?
well the rhymes are rife every year I'm alive
that's my vocabulary gonna do it cause I'm staring at the ceiling in the mortuary
plus I'm probably wise by now
and could do all the things old people talk about
like count pills, argue bills at diners
get a little tiny funky car and be a shriner
go to the haberdasher
so I could look dapper
get stroke and forget
I'm too old to be a rapper
this old man, he rhymes thrice
he spoke a thin gruel of lies
with a wick-wack bitter like a mute-fulness and spunk
this old man's rhymes was fun
this old man, he rhymes thrice
right till he grew liver spots
with a wick-wack bitter like a mute-fulness and sheer
why he rhymes, remains unclear
when are the guitar this morning!
I mean I am an eight how theucklehead
yes to the beat
the music is
chorus of reason
by my power
will show fullingers
with a power
toldcock
it's amazing
it's what...
wow...
you
forever
enjoy