Going along with my ongoing fascination with efficiency, I’m going to be breaking my habit of using “www” in front of the domains that don’t require it, i.e. most of them.

For anyone who’s not up to speed, in the URL http://www.cnn.com, the com portion refers to the top-level-domain, which roughly determines what sort of organization the domain is. The cnn portion is the real meat. It’s the domain itself, i.e. the organization. http:// is the protocol used by the browser to reach the resource, but that’s not important here.

The trick is, anything to the left of the domain (in this case cnn) is a hostname. So if you want to further specify within the cnn domain where you want to go, you append a hostname. If they had mail services and you were setting up your email client to work with that account, you’d perhaps enter mail.cnn.com. If they hosted a file transfer service, you may contact ftp.cnn.com, etc.

For serving web pages, however, which is the most commonly offered service online, no hostname is usually needed. It used to be, in the beginning of the Internet, that a special machine named “www” would host the web content, and in order to reach that machine users would have to enter http://www.domain.tld. That’s usually not the case anymore. For most sites, you can just enter http://domain.tld and end up at the web server for the organization.

This is a minor issue, to be sure, but if there’s no reason to type extra stuff, why do it? Here are some sites that allow you to enter just the domain:

http://cnn.com http://slashdot.org http://wired.com http://boingboing.net http://yahoo.com http://google.com http://microsoft.com http://redhat.com http://novell.com http://ibm.com http://hp.com

…just to name a few.

*Note: Some of the sites above actually redirect you to www.domain.tld, but that’s just as good as it not being needed. Either way, it’s not necessary for you to type it.

With my recent attainment of the GSEC credential, I’ve had some discussions about how it compares to the CISSP in terms of difficulty and respectability. Here is one such discussion from a forum I frequent.:

The main reason the CISSP in more respected is because of the standards the ISC2 has established, such as proving the identification of the applicant, verifying they meet the experience requirements, and the way the exam is hosted.

That definitely earns the exam some respect, to be sure, but keep in mind that the first time pass rate is over 70%.

I would give you this analogy: The CISSP is like taking the SAT’s You walk into a room with just a pencil and take a 6hr, 250 question exam that many of the times has more than 1 right answer but you have to draw on your experience to determine which one is “more right” The GSEC is like creating and turning in an Essay and taking an open book test.

Ok, let me put it this way, which of those two scenarios do you think represents reality in the infosec world? Cramming facts and regurgitating them via #2 pencil, or dealing with harder, more technical questions with access to any book and any search engine you want?

It’s the latter.

That’s what problem-solving is — you have Google, you have the text books, you have anything you want. That doesn’t make complex problems easy, it just makes them possible. That’s how the real world works.

Put it this way, I’d be willing to bet that 50% of all CISSPs don’t know what netcat is. What does that say about their infosec skills? What percentage of GSEC holders know what it is? Probably 99%.

Don’t confuse world-wide acceptance with proof of superiority. CISSP is standard, it requires experience, and it’s got a good, broad base of questions, but it’s the kind of test people cram for, pass, and then forget the material it was made up of. That’s not a good measure of a dedicated, technical infosec professional; it’s more a measure of someone who takes their career seriously and knows how to study.

I’ve met CISSPs who can’t configure a home network — no joke. Again, I studied for it and passed it in one week’s time, and that’s with zero previous study of the test materials.

More than I can a test that has a 70% first-time-pass rate that’s explicitly designed for managers and non-technical types. It’s for a wide, wide base of knowledge - not for testing whether or not you’d be qualified to actually do anything.

Don’t get me wrong, if you are going to do one first, or only one of the two, I’d say to get the CISSP. It’s more recognized and more respected than any other cert out there. All I am saying is that you shouldn’t confuse this with its difficulty. Almost nobody knows anything about the GSE certification either, but the two PhDs that have it said it was harder to get than their degrees.

I think after you have both you may see it more the way I do. It’s almost as simple as academic vs. hands-on, or birds-eye-view vs. in-the-trenches. I’d hire a GSEC holder to do some security on a network with significantly less reservation, whereas a CISSP-holder would have to go through the same sorts of checks that someone with nothing more than a 4-year degree would. Just because they can study and take themselves seriously doesn’t mean they know or love their discipline.:

I saw a forum post recently that covered cool SSIDs for wireless APs. Here’s my favorite so far:

HONEYNET

Any other ideas?

As I covered to some degree in an earlier post, quicksearches are quite sick. They let you search sites from Firefox’s address bar.

Well, here’s an awesome site featuring some quicksearch links for sites that I didn’t know you could do it with. Very cool indeed.

http://www.pitt.edu/~crp11/firefox/quicksearches/

For all those who like the search bar within Firefox, or like going to the sites themselves to do the searches, I humbly ask you to reconsider. With all these options, it’s time to take another look at what quicksearching has to offer. Using this, the address bar virtually becomes your one-stop-shop for all your search needs.

Well, I just passed the final exam for the GIAC GSEC credential from SANS, and I have to say it’s a pretty good feeling. It’s still less respected in most circles than the CISSP, but that’s because less people know about it. I think that’s likely to start changing very soon, though.

If I were to go for another SANS cert, I think it’d be the GSFW, but right now finishing my bachelors is the top priority. With my two most-desired certs taken care of, I can now focus completely on that task. Ultimately, I think employability comes down to a special combination of the following:

1. Experience
2. Degree
3. Certifications

It seems that 2 and 3 have been switching places as of late due to a number of factors. Perhaps the biggest one is the lack of quality control in today’s universities. To put it bluntly, an employer cannot any longer be sure that someone with a bachelors in computers is going to be valuable to his/her organization.

There are great IT people out there with degrees, and great ones without them. It’s hit or miss really. I still think there’s a higher chance that the person will be decent at something if they have the degree, but it’s not the kind of indicator it used to be.

As for me, I choose to have all three — experience, certs, and the degree. Can’t go wrong there.

Just found this link on my buddy’s Delicious page that shows how to catch your breath (or get it back to being natural) when you’re having trouble doing so.

Vaccuming Your Lungs

So yeah, I jumped on a bandwagon recently, and I’m loving the ride. It’s a bit bumpy at times (the potholes in the road were put there by pride), but other than that it’s great.

A buddy of mine showed me both the Moleskine and Fisher Space Pen product lines, and I just had to jump in with both feet. I got myself one of the larger notbooks from Moleskine, and two of the pens. They rock.

I highly suggest anyone into this sort of stuff try out the combo — there’s plenty of room on this bandwagon.

In light of the MD5 breakage a while back, and the SHA-1 discovery from the same team a couple days ago, I think posting this piece by my friend Steve Friedl is in order. It’s an excellent primer on the whole concept of hashes.

I just purchased a Valentine’s Day present from Tiffany’s over the weekend and was somewhat surprised at being asked for my name because I was paying cash. They wanted both my first and last names, but didn’t ask for I.D..

I find this a bit odd.

To me, the notion of purchasing with a credit card and being prompted for identification, creating a paper trail, having my number in a database, etc. all are a bit invasive. That’s old news, and it’s something I’m mostly immune to given its advantages.

But I’ve always taken solice in the belief that if I wanted to, I could avoid this evil by paying cash. That seems to not be the case anymore. As most things dealing with privacy in this country, I see this getting worse and not better. How long until they prompt for I.D. when someone pays cash? And how long until that I.D. is bound to the individual by something other than picture?

It’s all a bit eerie, if you ask me.

This display on a couple’s home in Sacramento, Ca. has caused quite a controversy. As you can tell from the link, there are all sorts of calls to have the effigy removed. The absolute worst part about it is the fact that the people are being called “unamerican”.

They keep using that word; I don’t think it means what they think it means.

Here’s my response, as posted to a forum I frequent:

Spit on the guy, call him names, do what you will, but don’t try to pass a law to prevent them from being able to do it. The fact that someone can do something so distasteful, and be legally within their rights to do so, is precisely what makes this country worth dying for. The notion that laws limiting this sort of crass display are now needed because the country’s going to hell and we need some decent laws to clean it up is the single most dangerous idea circulating in this country. What it equates to is the beginning of the end for America as we know it. I’m not saying that a country with some of these laws wouldn’t make some people feel better, or maybe bring about some less offensive displays, but there are already places that have no such public protest. China comes to mind. The fundamentalists attempting to bring decency back to this country will be its undoing, and if the founders could see it happening they’d be weeping. That’s not to say that the base, idiotic behavior going on as a result of our free society and political correctness isn’t repulsive, but trying to abolish the freedom that allowed that stupidity to exist in the first place is infinitely worse.