Interesting: White Hat Hacker Smack Talk

Reading SANS Internet Storm Center diary is part of my morning ritual and today I got a good laugh out of an entry by Tom Liston where he cracks some questionable javascript and even tells the black hat how to fix it:

"So... all of you JavaScript geniuses out there, please take note: I "cracked" this obfuscation while munching on in-flight pretzels and working ON MY CELLPHONE. If you seriously don't want someone to know what you're up to, then I think your encoding techniques should require cracking on something that doesn't ring..."

Here is a link to the full entry Climb a small mountain ...

Interesting: Google Reader

If you keep up with lots of news sites and blogs and aren't using and RSS aggregator, well, do it now. I've been using Google Reader for a couple of months and I'm very happy with it. It's easy to use and I don't have to open another app to access my feeds. Check out Scoble's demo and the Google Reader Blog for more info.

If you'd rather have a stand alone app, check out these. And definatly check out netnewswire if you have a mac.

You can even check out my shared feeds if you want.

Interesting: I'm getting old

Last Saturday I travelled back to Cherokee to play in a charity baseball game to honor my recently retired high school baseball coach, Richard Phillips. The turnout was really good, lots of family, friends and kids and the proceeds went to buy new equipment for the current highschool team.

It was great to be back on a baseball field with guys I haven't seen in years. There were enough for four teams, one older and two younger. Team 4 won our game 5 - 2, I went 2 - 3 with an RBI and a run scored. We won't talk about fielding :)

It was a lot of fun and I hope it becomes a tradtion. Here are a few pics I put up over at flickr.

Security: MS06-040 Patch

Microsoft has released a new patch to fix a buffer overrun vulnerability in a service that runs on Windows 2000, XP and 2003 systems. This is a remote code execution hole that would allow an attacker to take complete control of a system.

If you are behind a firewall that blocks ports 137-139 & 445 then you are somewhat shielded from this problem, however, it's best to apply the patch.

SANS has more information on the current worm activity.

Interesting: Microsoft buys up SysInternals

The announcement came this week from Mark Russinovich of SysInternals that he, co-founder Bryce Cogswell and the tools are moving to Microsoft. It's not really all that surprising being that Mark is better at building tools for the Windows platform than many of the folks already at Microsoft. SysInternals hosts many excellent troubleshooting and recovery tools including Process Explorer and Rootkit Revealer.

All the tools and support are currently still available from the site while Microsoft reviews the options of how to best leverage its new purchase. I already have them all, but I'll be sure to download current versions of everything just in case Bill deceides to hide them behind WGA.

Mark says "I’m looking forward to making Windows an even better platform for all of us!" Russinovich will be appointed as a Microsoft Technical Fellow, a title "awarded to someone whose technical vision, expertise, and world-class leadership is widely recognized." Microsoft currently has 14 Technical Fellows. Analysts are hoping that Russinovich and Cogswell will each add to the stability and security of future versions of Windows.

Here's to hoping for even better tools now that he is on the inside.

Interesting: Getting a little slack about this

Wow, it's been awhile since I put anything here. Since the whole point was to get me to start writing something on a regular basis I'm just going to throw some random links out here from stuff I've been looking at.

Microsoft's Powershell has had much of my attention for the last month, although I'm still not where I want to be with it. A command shell with access to .NET objects is double plus good if you want to automate ... well, anything in Windows. Scott Hanselman has so many things to say about I'm just going to link to a google search. Ars Technica has a guided tour that explains much of the reasoning and syntax in Powershell. There is also a Microsoft Blog for PowerShell. There are tons of other resources out there for this awesome tool and I'll likely post much more about it as I get more comfortable using it.

I've been slowly becoming more and more of a web hermit, although you'd think that would make me post more ... apparently not.

I keep finding PETA more and more disturbing.

I've also been trying to figure out if Chappelle Theory is a joke, a whacko conspiracy theorist, or actually the truth.

I got a new monitor that I'm very happy with. Although the price has gone down steadily, I still got a much better deal than what Dell lists.

And I've been to the beach, the Southern League Double A All-Star Game in Montgomery and spent a massive amount of time sitting on my back porch with a laptop. I should really post some pics at flickr and link to them, but I'm lazy ... maybe next time.

Interesting: Encryption

Why do we need to have secrets? Bruce Schneier says "Too many wrongly characterize the debate as 'security versus privacy.' The real choice is liberty versus control." He explains, in his essay The Eternal Value of Privacy, that privacy is a basic right and is needed to maintain the human condition. Just because I want privacy doesn't mean I'm doing anything wrong.

So, cryptography is a tool for freedom and here are several cryptography tools that anyone can easily use:

Torpark is a portable, secure browser that can run off a thumb drive. It combines Mozilla Firefox and Tor, the EFF's anonymous internet communications system. Here is an article with more information about torpark.

Encrypted gmail from Richard Jones is a very easy way to send encrypted email messages.

Password Safe is a password manager originally created by Bruce Schneier. This free program allows you to save all your passwords for different web sites and programs in one easy, secure location.

Getting a little more advanced, "OpenPGP is a non-proprietary protocol for encrypting email using public key cryptography. It is based on PGP as originally developed by Phil Zimmermann." OpenPGP is an email encryption tool.

And, IMNSHO, the best tool available for making secure connections over public internet, OpenSSH. "OpenSSH encrypts all traffic (including passwords) to effectively eliminate eavesdropping, connection hijacking, and other attacks. Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, and supports all SSH protocol versions." SSH stands for Secure Shell, take a look at the site for more information.

I'm also going to include this link to a cryptography podcast series that gives some great info and points out some other resources.

In conclusion, JOIN THE EFF!!! I don't need a reason to want privacy, anyone wanting to watch me better have a very good reason ... and some damn fast computers to break my encryption :)