Slashdot Mirror

Could this revamp be due to pressure from companies which have built commercial offerings on Snort? Guardent's SDA tool is basically a Snort box, x86 linux on commodity hardware. How many other money-making ventures out there depend on Snort, and what influence do they have over the Marty?

"In the period 1992-1994, Word wiped the floor with WordPerfect in reviews, winning just about all of them. "

Excuse my tinfoil hat, but wasn't that about the time that Windows finally stopped sucking utterly, and became a tool that everyone, including PHBs, could use? Isn't this the era of PC Magazine, and John Dvorak, and everyone's grandmother getting a PC?
Word was never technically superior, it merely appealed to a broader (and simpler) audience. There is a difference. Word won because it got reviews from trade rags. Word won due to a cultural shift - where document presentation became more important than its content, where a document's formatting is more important than its timely production. Word is the Guardent of word processors.
In answer to the folks who claim WP was a lousy product, I have two words: Reveal Codes.
I only jumped to Word97 from PC Word 5, then only because it was a 32bit app. By then, WP was dead and buried. I made the jump to Word2000 at work, then to OOo, which I use under the radar to publish all of my documents, typically via PDF.

I used to work for a Managed Security Provider, and hated the corporate bullshit, the lying, the incompetence. So I quit and got a job as a Caretaker on the Appalachian Trail for a summer. Very rewarding experience, I met people from all over, had some quality down time, and saw some amazing things.

You only live once, and the Big Day is coming. Enjoy your life.

Look here for a perfect example.

Tell those ISPs to go fsck themselves.

IPSec traffic OFTEN looks like "hack" attacks - weird, short packets, protocol 50 and (sometimes 51), streams of UDP 500, etc. Because it's all binary, its more likely to trigger the "shellcode" sort of alerts. An IDS will see the binary stream "F00F" in your payloads and assume you're doing a DoS attack or something. Trust me, I know - I helped build the first version of Guardent'sIDS solution.

Guardent is making a lot of noise about this sort of thing. Conspiracy theorists unite!

http://www.guardent.com/A0208102000.html

Prior to Guardent's discovery, it was believed that TCP sessions were sufficiently protected from attacks by the random generation of initial sequence numbers. It is now known that these numbers are guessable on many platforms, with a high degree of accuracy.

---
Civilians: Someone set up us the bomb.

This will come off as a bit biased (which it is), but I work for a company that has written some software called Hailstorm that's very good at helping you test your own security. It's especially good in situations where you have written something custom, whether it be a CGI script or some sort of server program. It succeeds where security scanners fail, because it can help you find problems that are previously unknown. To see it in action analyzing IDS systems, check out the article at SecurityFocus. Good security consulting firms are VERY expenseive, so Hailstorm may be a good choice depending on what you are really looking for.

If you want to hire a security firm, I would suggest a few different companies: Securify, a division of Kroll-O'Gara; Guardent; Ernst & Young; @Stake; and Foundstone.

Also, if you are interested in trying out Hailstorm (which, for the time being, only runs on NT 4.0/W2K, although it can test applications on any OS), shoot me an email (removing the obvious part), and I'll help you out. A trial version can be downloaded at www.ClickToSecure.com.