Comments for Persona Non Grata

Comment on Hacio’r Iaith – Hacio beth? | Hacking what? by Dan Q

Dan Q — Thu, 02 Feb 2012 11:37:58 +0000

Hope it all went well! I’ve done a couple of barcamps over this end of the country and they’ve been fabulous: the philosophy works incredibly well in geeky pastimes because we’re the kind of people who all have fun projects on, and because we’re also the kind of people who are interested in all kinds of different areas. As a result, the unconference nature of a barcamp means that everybody gets to hear interesting things, and be heard on the things that they think might interest others.

Somehow, at the last one I was at, I ran a workshop on getting started with Android development! No idea how that happened!

Comment on Hacio’r Iaith – Hacio beth? | Hacking what? by Hacio’r Iaith 2012 | Gwenu Dan Fysiau

Hacio’r Iaith 2012 | Gwenu Dan Fysiau — Wed, 25 Jan 2012 08:53:52 +0000

[...] Dyma gofnod gan Bryn sy’n esbonio ychydig am drefn digwyddiad o’r fath. [...]

Comment on Hacio’r Iaith – Hacio beth? | Hacking what? by Hacio'r Iaith - Hacio'r Beth? | Hacio'r Iaith

Hacio'r Iaith - Hacio'r Beth? | Hacio'r Iaith — Mon, 23 Jan 2012 12:45:40 +0000

[...] Hacio’r Iaith – Hacio’r Beth?Ryff geid Bryn Salisbury i wneud y mwyaf o’ch Hacio’r Iaith cyntaf – wedi ei gyhoeddi’n wreiddiol ar ei flog: Persona Non Grata: Hacio’r Iaith – Hacio’r Beth? | Hacking what?”. [...]

Comment on Datblygu Diogel | Secure Development by sioda

sioda — Sat, 29 Oct 2011 13:49:33 +0000

I can attest that the comment doesn’t sound at all like Jericho of attrition.org. He would not have been so polite
http://attrition.org/postal/

.sioda,

Comment on Datblygu Diogel | Secure Development by The Real Jericho

The Real Jericho — Fri, 28 Oct 2011 23:51:37 +0000

The comment above from ‘Jericho’ was not done by Jericho of attrition.org. Don’t mind the spoofing, just want to be clear though.

Comment on Datblygu Diogel | Secure Development by J4vv4D

J4vv4D — Fri, 28 Oct 2011 11:46:10 +0000

Seeing as we’re using analogies within analogies within analogies.

Dan – you’re wrong.

From a protection perspective let me introduce another analogy.

I know that bullet proof glass will stop a bullet so I have it installed. I don’t need to know how a gun works, the velocity of a bullet, the different types of bullets or anything like that. All I’ll need to know is how to install it properly in the window-frames. Which is in effect what a coder is doing. Installing / building something to the best of their ability.

Fully understanding how attacks work and the methodologies of the bad guys falls under the remit of pen testers.

Comment on Datblygu Diogel | Secure Development by Bryn_S

Bryn_S — Thu, 27 Oct 2011 09:16:41 +0000

Thanks Dan, some good points raised. Is it not dependant on who you’re talking to though? You’re an experienced coder, but if you’re new at it, doesn’t a friendlier/positive approach carry more weight? Rather than scaring the poor bugger to death?

Comment on Datblygu Diogel | Secure Development by Dan Q

Dan Q — Thu, 27 Oct 2011 09:06:44 +0000

No.

Security engineering is by definition a preventative measure: an effort to stop the bad guys (or just guys with strange names, like little Bobby Tables) from successfully attacking your system. To do this, you must take the approach of looking at how such attacks work.

To take an example: if you were in charge of training police officers, you wouldn’t spend your time showing them what a well-behaved, law-abiding citizen looks like. It’s no use demonstrating how to not have to arrest people.

You need to see what the bad things are if you’re going to combat them.

Comment on Datblygu Diogel | Secure Development by Bryn_S

Bryn_S — Wed, 26 Oct 2011 20:22:11 +0000

Jericho – again, sorry… I’ve re-read both the English and Welsh versions, and the English version is a little ambiguous (the Welsh version was a lot clearer). I’ve made a quick edit which should make it a bit clearer.

Comment on Datblygu Diogel | Secure Development by Bryn_S

Bryn_S — Wed, 26 Oct 2011 20:08:35 +0000

Hi Jericho,

Thanks for the comment… I don’t think I was pretending it was my idea at all. I did intact mention to our mutual friend that I was going to put it together as a talk (which he seemed to suggest was a good idea – I’m a little restricted from being quite so overt about naming the people I get to work with).

Given a lot of my work tends to revolve around helping people with their security programs, I’d like to be able to advise them on the best way of doing things, and if we can get better results through showing people how it should be done, rather than scaring them with how badly it can go wrong, then all the better.

Thanks for the slide references, but I was more keen to use a session as a discussion (rather than a presentation) to crowd-source the ideal solution.