The trivium is made up of grammar, logic, and rhetoric.

Here’s a really cool simplification, from Wikipedia:

1. Logic is concerned with the thing as-it-is-known,
2. Grammar is concerned with the thing-as-it-is-symbolized, and
3. Rhetoric is concerned with the thing-as-it-is-communicated.

First of all, just as a bit of trivia, CAPTCHA is based on a test for intelligence — a Turing Test. It stands for “Completely Automated Public Turing test to tell Computers and Humans Apart”.

And here’s how not to do it…

Don’t make the text you want them to type into the field selectable with a mouse. For the love of God. A guy just told me he saw a developer show off his new rock solid CAPTCHA implementation. He demo’d it by highlighting the CAPTCHA text, copying it, and pasting it into the field.

Voila!

Devs don’t need security training, they need to get out more. How about reading some technology news? How about paying attention to the IT world as a whole? Making CAPTCHA text selectable? In. Sane.

Two muffins are in an oven. The first muffin says to the second muffin, “Wow, it’s really hot in here.” The other muffin says,”Ahhhh! It’s a talking muffin!”

This is an nmap (3.50) scan of all 65,535 TCP ports on a default, non-hacked 1.1.3 iPhone. The scan was performed from an OS X system (MacPorts) sitting adjacent to the iPhone on a wireless network.

It appears there’s just one tcpwrapped service, on port 62,078, and Fyodor has evidently already added the requisite fingerprints since nmap’s OS detection pegged it perfectly as an iPhone.

kairin ~ $ sudo nmap -p 1-65535 -sV -O 10.10.126.2

Starting Nmap 4.50 ( http://insecure.org ) at 2008-01-24 20:50 PST

Interesting ports on 10.10.126.2:
Not shown: 65534 closed ports
PORT      STATE SERVICE    VERSION
62078/tcp open  tcpwrapped

MAC Address: 00:1C:B3:70:6A:DA (Apple)
Device type: phone|media device
Running: Apple embedded
OS details: Apple iPhone mobile phone or iPod Touch (Darwin 9.0.0d1)

The other day I was listening to a hardcore (see close-minded) Christian conservative rant on about various topics. I made some reference to his beliefs being popular in the American South, where he was from.

He was quite sure that had nothing to do with his beliefs. He said it has nothing to do with where he was raised — “it’s just what he believes”.

So I asked if he thought he’d believe the same things (about Jesus and such) if he were born in the Bay Area like I was. Or in Saudi Arabia. Yes, he thought he would have the same values because they’re a part of him, not where he grew up, and that they are correct so he would have found them regardless.

How lucky for him to have been born in the right place.:

This is just a Kerry / Bush breakdown, but I bet it corresponds quite strongly to general Republican / Democrat breakdowns regardless of candidate or election.

So what can we gather from this?

[ Slave States, Democrats and Republicans ]

[ Cat Box ]

Many are wondering how OS X will fare against malware once it becomes a serious target. We won’t have to wait long; OS X is taking off and we’re going to see major efforts focused on it starting this year.

Some say it’ll be shown to be an open wound as soon as it’s given attention, while others think it’s inherently more secure than Windows and will handle the pressure fine.

I think we have a decent model to evaluate — Firefox.

A very similar debate existed prior to Firefox making it big, and what was the outcome? The answer is rather complex, but I think most will agree it reduces to something like this.

Firefox ended up having a significant number of vulnerabilities — far more than its fanboys ever imagined. But even after having its aura of invulnerability stripped away it still comes out far better than Internet Explorer in terms of relative risk to a user.

That’s my opinion, of course, but I think it’s an impartial and informed one. I’ve triaged upteen kagillion Windows systems that have been owned by malware, but I can’t recall a single one where the only browser used was Firefox. True, we need to take into account the kind of user that employs Firefox exclusively, i.e. an advanced one, but still.

My point is very simply that I expect the same kind of result from OS X.

It will take a massive thrashing starting in 2008 as its marketshare grows, and there will be an eruption of articles and blog posts exclaiming, “OS X just as vulnerable as Windows afterall!”.

But in the end, once things have stabilized and we have time to look back, the vulnerability numbers (and more importantly the relative impact) will show that OS X is far more secure than Windows. Not secure, not even almost secure, but much better than Windows.:

I’ve just put up a study piece on Zone Transfers.

[ dmiessler.com | study | Zone Transfers ]