Emergent Chaos » Uncategorized

Twitter Weekly Updates for 2012-02-12

adam — Sun, 12 Feb 2012 08:00:00 +0000

RT @tkeanini Overcoming the fear of disclosure http://t.co/DZdkeyNh << TK is spot on. Our fear blocks feedback loops. #
MT @qld_oic ..empowering young people to establish good cyber safety behaviour #oicprivacycomp http://t.co/vkr3VZ3A [$1000 prize for video] #
RT @mortman Yet More On Threat Modeling: A Mini-Rant http://t.co/ZPxVa9HE cc @adamshostack @alexhutton #newschool #
RT @securityskeptic @mortman The danger of comparing security to a silver bullet is that there's no #killshot in security << APT!!! #
RT @WeldPond I suggest regular auditing against known weak passwords with L0phtCrack :) http://t.co/3w9HhKm4 #
RT @jack_daniel Rereading New School of Information Security, we're talking to @adamshostack on @pauldotcom this week. Great little book. #
I'm on @pauldotcom this Thursday, 3PM Seattle time. #
RT @fivethirtyeight When the data and your model clash, it's usually not the data's fault. #
RT @caitlynkorb @Jim_Harper declares an #Everify rebellion. Grab your pitchforks! http://t.co/545ed12q #nationalID #realID #immigration #
New blog: "Have you seen the little piggies?" http://t.co/nH7HxlgL #
RT @msftcitizenship Record breaking year for @microsoft employees with $100.5 million to nonprofits in 2011! http://t.co/8qfOpZVF #
Wow. 12 USB best practices, and nothing on autorun. How was that list generated, @RSAConference @wireheadlance @infosecisland? #
Infosec will only break out of the echo chamber and get results by subjecting our practices to empirical testing. #
RT @jayjacobs: patterns produce #datagasm http://t.co/1Udq6yhw looking forward to the 2012 #DBIR < No fair showing graphs without labels! #
RT @pauldotcom RT @InternMike: @adamshostack on tonight's @pauldotcom Ep. 277 6PM ET: http://t.co/GrMnG5t6 #
RT @dakami Prediction: Drivers remotely monitored by insurers will end up with higher accident, claim, & injury rates than unmonitored. #
RT @egoodman History Dept. needs help breaking code in a Civil War-era diary. Do it. This is what the Internet is for. http://t.co/duTdxyxq #
Hey, I'm about to be on http://t.co/JRACOWSK! Come listen in and hang in the chatroom! #
RT @_nomap UC Berkeley study analyzes the costs unintended consequences of a biometric worker ID system in the US http://t.co/kQRaqaP6 [PDF] #
RT @danwallach I blog about the new IEEE Security & Privacy copyright agreement. https://t.co/dl9LqOdy < Important for academics & the field #
hmmm, when I anonymize a paper w/ copy & paste, I end up w "Organization Word." Maybe I should leave that in, \footnote{anonymity is hard} #

Twitter Weekly Updates for 2012-02-05

adam — Sun, 05 Feb 2012 08:00:00 +0000

RT @Entropologist Passwords should be a mix of letters, numbers, special characters and longer than 8 characters… like "' or 1=1;–" #
RT @ioerror Researchers taking a stand against Elsevier: http://t.co/TMZqj2E9 #
RT @ashk4n Even experts are having a hard time differentiating between android malware & mobile ads these days http://t.co/t5qAQANP #
Tinker, Tailor is amazing and wraps up very neatly at the end. Too neatly. I think there's a mole on the screenwriting team. #
New blog: "Yes, Google+ Is a Failure" follows up on "Google+ Failed Because of Real Names" http://t.co/0hYfNxXX #
RT @AdrianChen At Google, we want to simplify things. So we're combining our 40 different services into a single INESCAPABLE GORGON'S STARE. #
RT @jeremiahg "China Hackers Target Law Firms as Back Doors in Search for Deal Data" http://t.co/mO3PFURn #
RT @jeremiahg I wonder how a breach of a law firm is affected by attourney-client priviledge. << good q! Fact of breach is not advice? #
RT @BlackHatEvents Just announced for #BlackHat USA: acclaimed author @nealstephenson to keynote 2012- read here: http://t.co/4p2J1abm #
RT @dakami: should be a yearly award for Best Security Data, [...] best collection and disbursement of hard data and cogent analysis < YES #
RT @real_life_CISO suspect that their clients need to determine materiality and notify their shareholders accordingly. Bet most won't… #
New blog "More on Real Names Policies" http://t.co/KeqjQ35M #
RT @josephmenn At least VeriSign confessed in fine print. Many didn't. Hacked companies still not telling investors http://t.co/xmCeH6we #
RT @samablog Fuck the NFL. They're as bad as the TSA. Maybe I should protest by refusing to watch. http://t.co/r5WfgtRa #
I love it! Moar games please! @jeremiahg @mattjay @manicode define a goal & audience, then get @jesseschell's book. Email me for more #
RT @msftsdl Evolving Secure Code at #Microsoft and Beyond http://t.co/i6TJPTj0 by Steve Lipner #TwCNext #SDC2012 #BITS #
Looking for more ideas on "Time for an Award for Best Data?" http://t.co/Mph30gKn #
RT @mortman Google Droids, Happy Friday http://t.co/zllR3kwL #
Just to this amazing article by @Beschizza on Twitter's mis-direction & newspeak around their censorship policy. http://t.co/n02us2wU #
RT: @VERISIGN Our statement on the 2010 security breach http://t.co/B1SkDDWl << Verisign should release the detailed investigation report #
New blog: "Dear Verisign, Trust Requires Transparency" http://t.co/iAZKFX1g #
New blog: "Dear Verisign, Trust Requires Transparency" http://t.co/iAZKFX1g (cc @josephmenn @thedarktangent @rmogull @mortman @jack_daniel) #
"Why are we only hearing about the @Verisign breach now?" in Time's techland blog: http://t.co/no4Cp2eg #
RT @Stepto New Post on my blog: In Which I leave Microsoft. http://t.co/lNebkU10 < I'm sad and excited for you at the same time #
Why does the National Academy of Sciences need to charge me $10 for a PDF that Scribd would serve for free? How does that advance science? #

A quick pointer

cwalsh — Mon, 30 Jan 2012 04:43:38 +0000

I wrote a blog post regarding the BSidesSF/RSA conf dust-up.

(If I knew how to work Adam’s twitter integration thingy, you’d have been spared this)

Twitter Weekly Updates for 2012-01-29

adam — Sun, 29 Jan 2012 08:00:00 +0000

Vincent Brown (@politico_ie) should be given an uninterrupted hour with the ECB execs: https://t.co/SZYOtveo #
RT @marciahofmann Supreme Court: government installation & use of a GPS device to monitor a vehicle's movements is a 4th Amendment search. #
RT @normative RT @thinkprogress: BREAKING: Rand Paul is being detained by TSA in Nashville (via @moirabagley) < Nudatrons a campaign issue? #
How do we win the fight against nude scanners in America? Does it help that @senrandpaul and @ronpaul are paying attention? #
RT @BlackHatEvents First Round of #BlackHat EU Briefings have been announced. Check out the early selections here: https://t.co/eF9URe7R #
I'm particularly excited by the HDMI & SSL Intercept proxy talks, but @WeldPond's talk also looks really interesting. #blackhat #
RT @MSFTsdl Check out a demo of the SDL Threat Modeling Tool #MSFT #SDL http://t.co/0k29g47I by @adamshostack #
New blog: "Vendor Shout Out: Gourmet Depot" http://t.co/VbneQAIX #
RT @mortman I just love getting getting spam via linkedin << Help perk up @mortman's day! :) #
RT @ioerror A write-up of UK and USA censorship of the Tor Project website: https://t.co/zzcLYdoC #
Let me see if I understand this, @O2. Previously, you were censoring the web and not admitting it, now you admit it? #
RT @josephmenn Whom to follow in cybersecurity. Congrats to @briankrebs, @adamshostack, @jack_daniel, @taosecurity etc. http://t.co/Lq2upZO5 #
RT @jdp23 A3: Infomediaries …. they're baaaaaack! #privchat << infomediaries are the PKI of privacy–always gonna be the year of PKI #
RT @mortman @WeldPond Here you go http://t.co/cAZERJkv << We should really check for Javascript off & say congratulations. :) #
RT @thedarktangent New #DEFCON 20 CTF information to be posted end of the month, we are growing the contest and helping the teams out! #
RT @singe Since awareness of Google's creepy data collection is about to be newstormed. Please highlight GoogleSharing http://t.co/BoSySekb #
RT @singlyinc In support of women in open technology, Singly is matching donations to @adainitiative until Thursday! http://t.co/1bWMZ9oc #
RT @briankrebs If you're a customer of mobile provider O2, apparently anyone can snarf your mobile # when you browse http://t.co/MStGOUCJ #
RT @mortman RT @jeremiahg: Interesting concept, "Open Security Audits" http://t.co/tdCXfOGH <– Now _that_ is #newschool cc @adamshostack #
RT @SpireSec Plugged one of my favorites about patch timing in my vuln post: http://t.co/qU5ycCZf <- Thanks! #
New blog: "Google+ Failed Because of Real Names" http://t.co/JFaa1EqR #
New blog: "Google+ Failed Because of Real Names" http://t.co/JFaa1EqR /cc @3ricj #
RT @ashk4n Seems like opportune time to update our '88% Google Coverage map' to incl mobile, social, payments, etc http://t.co/vOXrZYCR #
RT @m3sweatt seems so. And @google still discriminates against what the call "common names", like mine: http://t.co/VCK8rXao @3ricj #
RT @Kym_Possible Tech game at MITRE booth has tablets for prizes… Go play! #shmoocon << Games have no place in security! #
RT @LaraSee Did you know that the House of Angostura represents 3% of Trinidad and Tobago’s entire non-petrochemical manufacturing GDP? #
The Phantom Menace in 3D? Yeah, that's what that movie was missing. depth of character. #

Turn Off Javascript

arthur — Tue, 24 Jan 2012 18:04:03 +0000

For @weldpond:

Please turn off JavaScript. We don’t require it and it only increases your vulnerability.

Vendor shout out: Gourmet Depot

adam — Tue, 24 Jan 2012 16:04:02 +0000

You know those random parts of kitchen appliances that break, and the manufacturer is no longer making, and so you buy a new one that breaks after 4 months? Yeah, you know what I’m talking about.

Next time, look to Gourmet Depot and see if they have replacement parts.

It was easy to find their recommendation for our specific coffee machine, the recommended pot fits great, and was cheap.

Check out Gourmet Depot next time you’re in this bind.

Twitter Weekly Updates for 2012-01-22

adam — Sun, 22 Jan 2012 08:00:00 +0000

What's the best history of @Defcon Capture the Flag? (cc @rileycaezar @thedarktangent ) #
RT @thedarktangent What's the best history of #DEFCON Capture the Flag? @adamshostack asks, & we need to update the site. Send your links! #
RT @jccannon7 My sci fi book launches today. More info at http://t.co/bVd8mUSg #
RT @mortman New posts: The "Continuous Deployment and Security" http://t.co/zTxci3p5 of "Chocolate Waffles" http://t.co/lwhYRA4q #
RT @_nomap CCTV operators in London have remote access to the surveillance network, so that they can work from home. http://t.co/z13fwG26 #
How did @kuow find a guest on technology who's not familiar with @GreatDismal (William Gibson)? Impressive! #
Congrats to @metrixcreate for being the first to show @greatdismal a 3d printed object. #
RT @TimKarr Not so free at last: Sony issues takedown notices for those posting MLK's "I have a dream speech" http://t.co/hkKuNTLE #
Is it just me or is AT&T wireless displaying a fail whale in Seattle? #
My friend @votescannell is running for the Alaska State Legislature. You should follow her & vote for her! #
RT @pmocek Eric Rachner settles his suit against Seattle over 2008 false arrest by the ever-out-of-control @SeattlePD http://t.co/RLva48KO #
NoScript routes around Wikipedia blackout. There's a metaphor here. #
New blog: "Seattle in the snow" http://t.co/CacTHp1Z #
RT @josephmenn Former HBGary Federal CEO @aaronbarr, who drew @LulzSec fire for doxing anons, has left his subsequent job at Sayres #
New blog: "Seattle in the Snow"
http://t.co/CacTHp1Z Give us your 2mm! :) #
RT @hmason E-mail is still the biggest social network << Always will be. De-centralized, choose your name, many accounts per person. #
MT @rmogull Finished a call on exec protection. Not something I usually cover, told them hire an expert << Not thought leader behavior! ;) #
New bloggage: "More on the weather" http://t.co/xhSng7Dl #
Kahneman prefers short words since long ones take up more mental space, & slow thinking. Jargonistas, take note! #
RT @oneraindrop Money Games for teaching kids financial literacy, just as important to teach parents budgets, saving http://t.co/kHPZNs3R #

Ulf Muller

adam — Tue, 17 Jan 2012 16:27:05 +0000

I am saddened to pass on the news that Ulf Müller, a colleague at Zero-Knowledge Systems, has died in tragic and violent circumstances.

I remember Ulf as quiet, gentle, kind and am tremendously saddened by his loss.

The most recent news story is “Computer-Experte in Transporter erschlagen“.

Nils Kammenhuber of the Technical University of Munich is acting as a representative for the family.

Twitter Weekly Updates for 2012-01-15

adam — Sun, 15 Jan 2012 08:00:00 +0000

New blog: Shocking News of the Day: Social Security Numbers Suck http://t.co/VuMV3faO #
RT @PogoWasRight Does *any* federal govt agency actually respond to FOI requests within 20 days? << Send GAO a FOIA with that question? :) #
RT @Digital4rensics On Computer Security Incident Information Sharing: http://t.co/GhGYOOjP – New Post Up! #
New worst practice: blocking paste of passwords in a web site. Do you want to make it hard to use a tool to keep good passwords? #
MT @EPICprivacy "People frustrated by not having a meaningful way to respond to #privacy invasions" listen to @marcrote http://t.co/ber8xWnS #
New School Approaches to Passwords: http://t.co/1MbVSXhd #
RT @0xabad1dea "the United States Court of Appeals affirmed Glik's First A right to record the actions of the police." http://t.co/LPV2SuCq #
RT @WeldPond Asterisk Hack Post-mortem http://t.co/UXTGCbsm << See, it doesn't hurt! #
RT @WeldPond Asterisk Hack Post-mortem http://t.co/UXTGCbsm << See it doesn't hurt to disclose! #
New blog: "The New School of Software Engineering?" http://t.co/VzhpNzxQ (H/T @curphey) #
Quick blog: "Google+ is not a space for free expression" http://t.co/vYE6yHLq #
RT @cstross: Facebook outs teenage gay man, destroying his life, via behavioural advertising: https://t.co/d9IPw9yO #
RT @normative @techdirt: The TSA Posts Its 'Top Good Catches Of 2011' List, Not One Of Which Is An Actual Terrorist http://t.co/kkwRR2ys #
New blog: Please vote New School for security blogger awards. http://t.co/j5Wx1Xx8 (plus endorsments: @rmogull & co, @chriseng & @DennisF) #
RT @MSFTsdl New Blog Post: http://t.co/q0sOsWuS Trustworthy Computing’s 10 Year Milestone – Reflecting on Humble Beginnings #security #
RT @DarkReading Not even DoD's CAC cards are safe anymore: Sykipot malware steals their creds. http://t.co/UDaebXWk #
RT @RSAConference RT @delphiisCEO New blog "Security's Dark Little Secret" http://t.co/OaTqsOXC << maybe we should start learning? :) #
RT @EPICprivacy EPIC in the News: DHS' X-ray scanners could be cancer risk to border crossers http://t.co/kZZ7eZDA via @declanm #
RT @alexmImmunity Liked Cushman's keynote and I agree with his points about having a social eng. & tradecraft depts in a pen-testing shop #
RT @Privacyactivism Passively scanning passengers going through ferry turnstiles in NYC with out their knowledge? http://t.co/gLM8jPaS #
"Because the technology does not use whole body imaging, privacy issues will not be a concern." http://t.co/gLM8jPaS << I call bullshit. #
RT @451wendy Analyst note from yesterday: Microsoft may offer 'big security data' for free https://t.co/0h7NNoh8 #
I love it when a plan comes together. #
RT @alexvans "Good" advert explaining what my brother @nickovs does these days http://t.co/ZsMaM2ML << Reads other people's email? ;) #
Where's the best history of the @defcon CTF? #

Twitter Weekly Updates for 2012-01-08

adam — Sun, 08 Jan 2012 08:00:00 +0000

RT @RegoftheDay Happy new year! 40,000 new laws take effect starting today. http://t.co/EOVyRya9 #
RT @StevenLevy Always suspected those xray "backscatter" machines will kill more of us than terrorists will. Now this. http://t.co/ag2lFWWc #
New podcast with @dgwbirch: http://t.co/HKeKOVyW #
New short blog: "The irony overfloweth" http://t.co/6VsrF9JO #
Wow. The Wikipedia article on Infosec certifications currently lacks any dissent on the value of certs. http://t.co/SzdJZHAp #
RT @jayjacobs I've taken a job with the Verizon Risk Intelligence team! << Congratulations to Jay, @wadebaker & the rest of the DBIR team! #
Reflections on trusting "Verified" http://t.co/2FgkajVz #
RT @gbullard The first correction listed is the greatest I've ever seen:
http://t.co/6aRN9uK6 #
New School blog: "Comments on Steve Bellovin's Lessons from Suppressing Research" http://t.co/W2wEUMDB #
RT @tgoetz glad to see the FDA issue some sort of restriction on antibiotics in animals, even if a watered-down version http://t.co/kCI5fZzo #
RT @DanielSolove I will be speaking at Microsoft (DC) tomorrow: about my PII article. Event description here: http://t.co/iMrPChQf #
Some additional comments on the password change paper: http://t.co/oYDhY0EA #
RT @hypatiadotca For all the Sous Vide geeks: Open Source PID (via @3ricj) http://t.co/zYFZ6DVA #
RT @thisisparker Very cool: @Schneier auctioning off galley copies of new book "Liars and Outliers"; proceeds to @EFF and @EPICPrivacy #
RT @ErrataRob Vint Cerf is profoundly wrong in saying that the Internet is not a human right http://t.co/wrfyIzA1 #
RT @Jim_Harper @adamshostack @thisisparker I think you mean @schneierblog #
RT @csoandy Ahhh, one hour, second trick of Elevation of Privilege. Good game, @adamshostack. << glad it helps! #
RT @csoandy Lots of trash talking. "I don't see how that's possible here!" "Can't you see how easy this is!" Good framework. #
RT @SecWonk CPEs 4Free: @adamshostack on @Kaspersky Podcast, Methods of Compromise+ New School & Learning http://t.co/uqRH3iBG #CPEs4Free #
RT @Ellen_CK Keynoting BSides PHX http://t.co/NgIIzh7F :) << Cool! #
RT @DanaEpp Get to introduce threat modeling via "Elevation of Privilege" game to new members of the dev team. Good way to end the week! #