Headlines from the Computer Security Blogosphere

News and Notes for Information Security Buyers

[powered by WordPress.]

May 16, 2008

Data isn’t ‘private’ if you put it on a social networking site

by @ 7:55 am. Filed under Privacy, privacy

Private: confined to particular persons or groups or providing privacy; “a private place”; “private discussions”; “private lessons”; “a private club” … i.e. something a social network isn’t.

I get annoyed with people who use the word ‘privacy’ when talking about their information on a social networking site; by definition, anything put on a Facebook or MySpace is there for sharing and is no longer private. If you want to keep your information private, don’t put it somewhere that’s specifically designed around the concept of blasting your info to as many people as possible in the first place!

We’ve got mashables and all the other technologies that are designed to share our information, or data portability as it’s called. People want to be able take their information from one application to another as easily and transparently as possible. That’s great, it’s wonderful for sharing information. It’s also about as far away from ‘privacy’ as you can get.

There’s a big hubbub in the blogosphere because Facebook is blocking or limiting the amount of information other sites, like Google’s Friend Connect, can collect from the Facebook API. Facebook claims it’s about privacy; they believe users should have the right to control where their information goes and how it’s being used. I agree with that statement, but if someone is putting their personal information on Facebook, then they’ve made the choice of giving up that control, since any screen scraper or search engine can be used to pull down the information with very little effort. While I hate agreeing with Michael Arrington, he’s right; Facebook’s decision to limit what other social networks can pull from the FB API is about protecting Facebook’s business model and has nothing at all to do with their user’s privacy. Facebook wants to squeeze every possible cent from the value of your information before they let anyone else have it. I don’t blame them, I just don’t have to give them anything to work with.

Robert Scoble is wrong, privacy isn’t dead; people are just willing to give up privacy for the convenience of being part of a social network. If someone wants their data to be private, they shouldn’t be putting it online. Privacy isn’t dead, but you’ve made a decision to give up your privacy when you put it online. You have to weigh the value of having that social interaction versus what your information is worth to you. Most people make that decision without any conscious thought, which isn’t Facebook’s fault. Not everyone is a professional paranoid who spend a large amount of their time thinking about these issues, but everyone should at least be aware of what they’re putting online.

The Internet, and especially a social network, is designed around the concept of information sharing. Privacy is about controlling your information and controlling who has access to your information. If you put that information on Facebook, you’ve ceded that control to them, and even they don’t have that much control over who can access it. You can control where and when you put your information online, but once it’s there, privacy isn’t applicable. You’ve chosen to put it in a public forum, therefore your information obviously wasn’t something you wanted to keep private in the first place.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

May 15, 2008

Links for 2008-05-15 [del.icio.us]

by @ 11:59 pm. Filed under Uncategorized

Strong Sense Critical Thinker

by @ 11:11 pm. Filed under Critical Thinking

I mentioned before that in Susan Wolcott’s: Steps for Better Thinking Rubric(.pdf), skilled thinkers use general principles to interpret information, i.e. they use a model and they know which model they are using.

Since critical thinkers know which model they are using, they can easily question their model and adapt it to new facts and reality. They know the strengths and weaknesses of their model and know about many other models that could be used to interpret reality.

The Critical Thinking Community calls such a thinker a strong sense critical thinker:

strong sense critical thinker: One who is predominantly characterized by the following traits: 1)an ability to question deeply one’s own framework of thought, 2) an ability to reconstruct sympathetically and imaginatively the strongest versions of points of view and frameworks of thought opposed to one’s own, 3) an ability to reason dialectically (multilogically) in such a way as to determine when one’s own point of view is at its weakest and when an opposing point of view is at its strongest.

Strong sense critical thinkers are not routinely blinded by their own points of view. They know they have points of view and therefore recognize on what framework of assumptions and ideas their own thinking is based. They realize the necessity of putting their own assumptions and ideas to the test of the strongest objections that can be leveled against them.

xkcd: Security Holes

by @ 10:19 pm. Filed under Uncategorized

Not to be outdone by Dilbert, xkcd has it’s own Debian related humor today. Who ever thought that the words “encryption” and “humor” would apply to the same blog post.


[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Matt Asay again shows that he doesn’t know much about open source security

by @ 9:43 pm. Filed under open source, alan shimel, Tenable Network Security, ron gula, matt assay

I often comment or blog disagreeing with Matt Asay and his views on open source and security. Frankly from the comments Matt leaves back, I think he views me as a pain in his butt and why if I don't agree with him do I read his blog. I read Matt's blog because I often do agree with him, but I also read it because I think it important that just because you don't agree with someones views, doesn't mean they have nothing to say. However, I also feel that I have the right to call BS when I see it. Matt's article yesterday on Tenable's new licensing is one of those times. Matt you don't know what you are talking about on this one. If you are not going to take the time to dig in than just stay out.

First a little background. Tenable announced the other day a change in their licensing of their NASL feed. For those who don't know, Tenable is the owner of the formerly open sourced Nessus vulnerability scanner. They also develop and publish a feed of NASL scripts which run in Nessus, which are likewise no longer and some say never were open sourced. I know Ron Gula pretty well and understand perfectly why Nessus is no longer under a GPL license for a few years now. I also understand the economics and reasons why they would charge for their NASL feed. I think it is good business and more power to Ron, Jack, Renaud and the rest of the Tenable gang. The change in their license is that now commercial customers will have to pay for the NASL feed, whereas before only people who resold the feed or otherwise profited from it would have to pay for the "registered feed". Now schools and charities can still get the feed for free, but others have to pay. Again, I don't have the slightest problem with this and wish them well.

Matt sticks his two cents here and at the same time sticks his foot in his mouth. For some reason Matt has not realized that Nessus has not been open sourced since the release of the 3.x version some time ago. It is not like this is a secret, Tenable is very "open" about it and there has been much written about it. Because they are still open in Matt's eyes, they can do little wrong. Matt this is just plain negligence on your part, go beyond the press release before writing! Matt talks about and links to Pierre Teilhard de Chardin's blog article about Tenable closing the source to Nessus and still doesn't take notice that it is no longer open source. Matt did you read the article you linked to?

Matt than goes on to try and claim that it is OK for Tenable to charge for the NASL scripts because "the code is free, but the information that flows through it (Up-to-date vulnerability information, for example) is not". Matt, NASL scripts are scripts. I would think the word scripts in the name would be a dead give away. Don't you think that implies some code?

Yes, you can "drill your own wells" as Matt says and write your own NASL scripts. We do it at StillSecure for our own VAM vulnerability product. But we also use our own customized version of Nessus based off of the old 2.x open source code.

The fact is there is nothing open sourced about the current version of Nessus and NASL scripts and Ron and company don't make any bones about it. Matt your readers expect more from you. Do a little homework before you spout off!

More PHP Annoyances

by @ 2:21 pm. Filed under Uncategorized

PHP’s sort() function works pretty well.  It does what you think it would do, IE, sorting an array.  However, it’s return value is not what I think it should be, ie, an array…  Now, while it’s nice that I don’t have to do:

$array = sort($array);

It is *highly* annoying that I can’t just:

print_r(sort($array));

The Debian random number generator

by @ 12:45 pm. Filed under Humor
http://img502.imageshack.us/img502/2996/pmeo9hcjp7aw9.jpg

Ouch! That hurts, and I don’t even run Debian. Thanks, Stepto.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Shrdlu on GRC FTW

by @ 12:03 pm. Filed under Security, compliance, information security, Risk Analysis, risk management, risk, GRC, information+security, information_security, risk+management, risk_management, Risk_Analysis

Shrdlu is entertaining and insightful and writes everything I wish I could have written on the Blogo-topic du jour, GRC.

Time to get a new set of keys

by @ 9:25 am. Filed under Encryption, Security Advisories, Debian, SSH, Ubuntu

If you’re using Debian or Ubuntu, it looks like you need to generate a new set of keys immediately, if not sooner! The SSH keys on those systems used the PID of the process as a seed for generating the old keys, which severely limits the randomness of the keys and has made it possible for a rainbow table of all possible keys to be generated.

There’s some debate about whether this vulnerability is related to an increase in SSH scanning on the Internet, but that’s really immaterial; it will cause a rise in SSH scans soon. Better to secure your system now and stay ahead of the curve than be one of the people unlucky enough to get compromised. As always, the real danger is not what’s happening today, but what happens in a few months when the awareness dies down and people who didn’t get the alerts leave their vulnerable machines on the Internet.

The Internet Storm Center thinks this is really important, so you probably should too.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

Links for 2008-05-14 [del.icio.us]

by @ 12:59 am. Filed under Uncategorized

[powered by WordPress.]

Headlines from the Information Security Blogosphere
Add your feed to this box

Security Catalyst

©Viralinks

Get a Daily Digest Of This Feed To Your Inbox



Powered by FeedBlitz

Subscribe To This Feed



Google Reader or Homepage
del.icio.us ComputerSecurity
Add to My Yahoo!
Subscribe with Bloglines
Subscribe in NewsGator Online

myFeedster
Add to My AOL
Furl ComputerSecurity
Subscribe in Rojo
Subscribe with Pluck RSS reader
Add 'ComputerSecurity' to Newsburst from CNET News.com

Permanent Links

  • Seven Reasons to Carry the Information Security Blogosphere Headlines Feed

  • Terms and Conditions for use of the Headlines from the Information Security Blogosphere Feedbox

  • internal links:

    categories: