security

I was downloading from a very intermittent webserver and the download kept quitting less than 80% in. And if my timing wasn’t perfect, the web browser wouldn’t resume it. Then I thought to try to resume my downloads with wget.

wget is a command line tool for Linux, other Unix-like operating systems, and Windows. It is good for resuming downloads and can even do it automatically.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

The safety of open source software is a question that comes up periodically from time to time. Let’s talk about why the question keeps coming up, and what’s different about open source software versus closed source software.

The main thing that can get you when it comes to the safety of open source software is anything but obvious. Hint: it isn’t the development model.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

The recent Log4J vulnerability brought increased attention on 0 day attacks, but it’s a question that never really goes away. How common are zero day attacks?

Zero day attacks are less common than they seem because attackers don’t understand them as well as less new and novel attacks. Managing those less novel vulnerabilities is a real challenge for many organizations, but it’s something they must get a handle on to defend themselves effectively.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

If you work in IT or security, you are pretty much expected to know what a user story is. That can be a problem if your background is not in software development, or if your education or background predates the agile software development model. So what is a user story and how do you write one?

User stories are similar to milestones in project management. That was how it was first explained to me. But you don’t write a user story quite the same way that you would write a milestone in project management. The other thing is mixing the two can lead to miscommunication. I was once involved in a meeting where a manager insisted on using user stories, because he had been a software developer, but this wasn’t a project involving software development. So nobody else knew what he was talking about.

User stories are a product management or software development tool. They aren’t something everyone knows.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

Sometimes, if you get a new device, or if you connect to a network you’ve never connected to, you can receive a message that says your Wi-Fi is not secure. Why does my wifi say not secure? Here’s why, and also why you shouldn’t ignore that message.

That message got your attention, didn’t it? It’s designed to get your attention. And it’s really easy to dismiss it as being alarmist. People have a tendency to either greatly overestimate or underestimate how much interest someone might have in attacking them. Especially if I tell you that the security that you’re getting a warning about has much more to do with privacy than it does with viruses. That message does not mean that this network is any more or less likely to infect you with a viruses.

But you need to do something about it when you see this message. First let me tell you why, then I will tell you what you need to do.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

Over the weekend of Nov 13, 2021, the FBI acknowledged unauthorized emails coming from a legitimate FBI email address to about 100,000 organizations warning them about ransomware. It appears to be the work of a self-styled white hat hacker, or security researcher.

I am a security professional. I am going to remind everyone that these are not the opinion of my current or any former employer. I have strong opinions on the, and those opinions are incredibly unpopular among security professionals. They may or may not agree with me privately, but agreeing with me publicly is not a great idea.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

I hear the argument all the time that if you aren’t doing anything wrong, you don’t have to worry about privacy. So is data privacy important? I’ll tell you why it is.

There was a very vocal element of society that was very anti-data privacy until 2021. Once the COVID vaccine was released, suddenly they became very concerned about their privacy. I hope that element of society learned some empathy from this. How they felt about their privacy is how the rest of us feel when it comes to large corporations tracking our every move.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net

What is ASM in security? ASM stands for attack surface management. It solves a real security problem. But it may not be the security problem that you think it solves, and it also doesn’t solve it as completely as it sounds like it may. Let’s talk about what ASM does and whether you might want it.

Read more

Dave Farquhar

David Farquhar is a computer security professional, entrepreneur, and author. He has written professionally about computers since 1991, so he was writing about retro computers when they were still new. He has been working in IT professionally since 1994 and has specialized in vulnerability management since 2013. He holds Security+ and CISSP certifications. Today he blogs five times a week, mostly about retro computers and retro gaming covering the time period from 1975 to 2000.

dfarq.homeip.net