Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror

Comment Re: Trump did not win 2020 (Score 1) 146

âoe Do you really think Trump was so bad that Republicans rigged the election to keep him out of office?â

Yes thatâ(TM)s what theyâ(TM)re saying. What too many experts misunderstood was Trump ran against the GOP in the primary: he positioned himself as the (ironically) anti-elite candidate and positioned (successfully) the other GOP candidates as elites (and the DNC as the party of the elites). He ran as a populist, an anti-elite populist, while the experts kept assuming he was a loyal member of the GOP.

Itâ(TM)s why so many experts got the Hillary v Trump election so wrong, they kept thinking it was a classic GOP v DNC match up, when it was really a different axis altogether he messaged around. So yeah, when some of his supporters say the election was stolen, theyâ(TM)re not limiting their ire to Democrats, theyâ(TM)re including Republicans as well, because they donâ(TM)t trust the GOP either. Populism v Elitism is the actual axis theyâ(TM)re on, not GOP v DNC.

Comment Re:Maybe they did, maybe they didn't. Commission s (Score 1) 110

The independent analysis by a law firm hired by thr court says they didn't knowingly do anything wrong. It sounds like the cops are trying to cover their ass, however.

The contract says they are allowed to pick locks.
The contract says they can work "in the day and in the evening", etc.

The county is a subdivision of the state, created by the state. States tell counties what they can and cannot do. Counties don't tell the state what the state can do.

I haven't spent a hundred hours looking into every be little detail, but it sounds like the pentesters did roughly what they were hired to do, and the cops got embarrassed.

I think youre right. If the Sherrifs department was also responsible for the security of the building, then this is a conflict of interest: theyre aggrieved and possibly embarrassed.

Comment Re:The World's Most Dangerous Job (Score 1) 110

Am I the only one here who wouldn't do this "penetration testing" job for any amount of money - in the USA, at least. There seem to be enough Americans who think nothing of using 'lethal force' if someone puts a single foot on their property, and cops who will shoot an unarmed kid for running away that I'd be scared of my life every minute. All it needs is one trigger-happy idiot to assume you ARE a terrorist/intruder/criminal/black and bang, you're dead. These guys must have big balls, and for that alone they should be exempt from prosecution...

In general we dont recommend customers do this kind of testing unless they had a solid program. If you think your physical security is lacking, then a daytime site assessment with the cooperation of the site is both a lot more effective and its safe. You can just tour the site, and look at anything you want preferably with someone from the site thats an SME on their measures along to show you what they have, how they use it, and to prove it works to you.

It can also be an excellent opportunity to build repor with the site and to get people to tell you what their problems are. Most people who care about security will gladly tell you whats lacking and what they would like to improve. That kind of candor is impossible to get if you've made the site look stupid. Active penetration testing is a little too kungfu hollywood bad assery for nearly everyone. Its only useful if your program is solid, and you want to test the entire program. For example, an actual force on force excercis: you're testing the site response basically. And to your point - hell yes you might get shot which is why this kind of "Sneakers" like pentesting is really a bad idea and almost always asked for by amateurs. Some standard says they have to have it, so they slap it into an SOW.

Personally, I dont do these kind of assessment anymore, theyre a waste. If the customer asked me to assess their physical security controls, I'd ask for a daytime tour and have someone come along thats authorized to touch and modify things, and ask them to show me how the control works. And leave it up to them to prove it to me, and I would never tell them how to do it, you dont want to be accussed of telling them to break something, or trigger an alarm like if you told them to pop open an iStar IDS control panel.

So yeah, no I wouldnt recommend doing this kind of work, its like testing someone to see if they have high blood pressure by telling them to run a marathon. These easier ways to test for that wont get you killed, and are far more pleasant.

Comment This what people do when their security sucks (Score 1) 110

I'm sorry, but this is how organizations behave when they know they have security issues and want to hide that fact. A pentesters job is to test security controls in the wild, under realistic scenarios. The Sheriff is changing the subject, they got in. So theres problems with the security of those buildings, fix it, end of discussion. And apparently the state is conducting these assessments because they suspect some counties have security problems, which in this case they do.

The fact that this time the people that broke in were friendly should be seen as a plus, you Mr. Sherrif are getting a get of jail free card. You get to correct these problems before real harm occurs. If these had been actual burglars or as they histronically implied terrorists, well the outcome would have pretty bad for the county.

Comment Why would you use company resources to do this? (Score 3, Insightful) 55

It seems kind of naive to assume you can use any companies systems and rooms without them knowing what youre doing, or at least wanting to know. And if youre doing this to schedule meetings to plan protests of the company itself? Seems pretty obvious any company would want to know about that. Whether or not you should be able to do this, its just wishful thinking to think any company isnt going to notice when more than 100 employees decide to hold a meeting that doesnt involve management, or otherwise isnt clearly work related. And if its to protest the company? Come on. Theyll know.

So, for Google employees: of course theyre "spying" on you, you work for them. They literally want to know what youre doing all day. If you dont want Google to know what youre doing, do it outside of work. Use some common sense.

Comment Re:Moral of the story (Score 1) 311

It's not the same as re-telling a secret. You have an intellectual property interest in your own likeness. Whether you agree or disagree with whether that "should" be the case, unless the pictures were taken in public, or she waived her rights for the distribution of those images, she has a cause of action against the person who distributed them without her permission.

Look at it this way. In the most straightforward case, if you sneak into someone's house and take a picture of them when they're naked, clearly the fact that you own the camera doesn't mean you own the right to distribute such a picture. The person whose picture is being taken didn't consent. Now, let's take a case where the person consents to the picture. Does that consent to have a picture being taken implicitly grant the right to distribute those pictures? At a minimum, it would depend on the facts. A picture taken of someone posing for a picture in front of a fancy restaurant with a bunch of friends, you could argue the right to redistribute was implied in that consent, and certainly it's not really practical to get a signed consent form of all the people in the picture. Nude photos taken in a private bedroom? You can be damned sure that consent to have the picture taken did not carry with it the right to redistribute unless that was explicit (and as the person doing the redistribution you would probably need it to be in writing to cover your ass).

Slashdot Top Deals

Yet magic and hierarchy arise from the same source, and this source has a null pointer.

Working...