16s

In a well-monitored environment, it should draw attention and cause them to investigate the internal host making the queries.

I really like your blog post and your ideas.

With new versions of BIND 10 allowing Python scripting, PowerDNS with Lua scripting and Unbound with Python, I think we'll start seeing more corps controlling DNS queries (or attempting to do so) with whitelists/blackslists, but for the time being, things are mostly wide-open.

There's a comment in the source code about b64:

# If you don't like non-valid characters in the hostname,

# then use hex encoding rather than base64

So far, I've not encountered a failure using b64 encoding. But that could be an issue. And as you say, other encodings could be used if that does prove to be a problem.

Those examples tunnel traffic over DNS. They do not specifically break large files up into small chunks and exfiltrate them off of a secure network with simple DNS queries.

This is an actual working example, not theory on how to do it. IMO, that's what makes it significant. Lot's of people talk about how this can be done, few show actual working examples (with source code) that others can re-create on their networks.

As more and more people write code and become technically literate, I think we'll see lots of this sort of thing. Once the majority of normal people "get it" then it's all down hill for those trying to control ideas.

Would it be possible for devs and small companies in other countries to take advantage of New Zealand laws without actually being there?

You'd have to have the ability to change DNS records for their domains. If you can point "whatever.com" to a NS that you control, it's game over until they take it back.

This is true. And if the FCC were to give up spectrum for use in mesh networks, they could always require that no encryption be used. They mandate this with amateur radio. A HAM's license could be revoked if he was caught sending encrypted transmissions.

Two teaspoons of Taster's Choice. That's my perfect coffee. It's quick, affordable and gets the job done. Doesn't taste bad either.

I understand this. When security is not part of the culture of the company, and management just wants to ship software, devs won't have time to test. MS used to be this way (back before XP SP2). They stopped and made security a focus and allowed devs to work on securing the software. Today, they are much better off because of that. Not all companies think about security. Many only think about the bottom line.

Unrealistic deadlines and sales reps promising features to clients is a large part of the problem. Get the changes in, test the usability, and ship it. Get it out to the client pronto. We have an earnings report due by X date and this will help the bottom line.

It's not that devs and DBAs don't care, it's that in many cases (not all) they aren't given the time to carefully test the system to see how it might be abused.

And also, many companies view security testing as an afterthought or an audit requirement. If they do not have to do it (time is money) they won't. And when they are forced to do it, they rush through it.

In some ways this is a philosophical fight between a group that wants to ship software and make a profit and a group that wants to design and test systems to make sure they are correct. Suits vs technologists.

Why is that variable set at 10? Who would question that?

The spec says 10 too. It's the "at least 10" part that was missed. That's very subtle, does not stand out and is easily over-looked unless someone is really auditing code and reading specs carefully.

Lot's of very skilled people interview poorly. Nervousness, social stress, anxiety etc. So don't feel bad, people who interview applicants a lot know this. It's not a mark against you. If they are interested in you, they'll find a way to learn if you have the knowledge/skills they require for the job.

If I don't know the answer to a question or if it is ambiguious, I tell them. For example, I was once asked to describe how a TCP sessions ends. Well, that's implementation defined. What OS? Are we talking FIN ACKs or do TCP resets count as ending a session too? The RFC may say this, but in the real-world, software sometimes does it like that. Etc, etc.

And, many times the questions aren't made to be answered, but to draw things out of you (like the one above). And in these cases, you can turn the questions back on them. Put them on the answering end ;) and that's OK, those exchanges tell both sides a lot about the other.

I do like a few black and white questions. Like, "How many bits are in an IPv4 address" or "What data structure is a C++ set typically implemented in" and if candidates have no idea on an answer, then I do have concern over that. However, if they do not know the answer, but understand types and their sizes and data structures and their pros/cons, then that's good enough in some cases as well.

In many cases, you need only a few watts (5 or less) and with a good antenna can transmit globally.

I'm glad he made it out, but that's a sad story. When you stop and think about what he's saying, it's depressing. And, it's true.

+1 Email encryption in the cloud isn't secure. It's convenient, easy to use and makes you feel warm and fuzzy, but that's about it. OpenPGP still stands.

As others have mentioned. One-time pads are unbreakable:

"While he was at Bell Labs, Shannon proved that the cryptographic one-time pad is unbreakable in his classified research that was later published in October 1949" - http://en.wikipedia.org/wiki/Claude_Shannon

They can also be made to decrypt to any plaintext string

http://16s.us/FreeOTP/nsa/

However, OTP does not scale to more than two or three people, they don't work at all on very large messages as the key has to be as large as the message and they have authentication issues. For two people sending small messages, one-time pads are ideal and if the pads are created, used and destroyed correctly, the encryption is, indeed, unbreakable.

Threats, imprisonment and physical violence can be used to attack crypto as well. Go after the weakest link.

Use OpenPGP software on your local device (GnuPG). Never copy your private key into the could. Set a super strong password on the private key. You now can have point to point encryption that is "military grade" (per Bruce Schneier) and no one but you has access to the private key.

It's not that hard to do either. Nice point and click convenient web interface or true privacy. Pick one.

No central control. Point to point. It's like amateur radio communication where two people can talk directly with each other radio to radio.

I believe it was written at Stanford. That caltech site describes how to use it.

http://www.slac.stanford.edu/~abh/bbcp

Many Unix systems include Perl by default. This seems like a small thing, but in areas where 3rd-party software is not allowed (security and audit compliance issues), having a Perl interpreter is wonderful.

Whether you fully misrepresent the story (tell a complete lie) or omit a portion of the story (tell a partial lie), they are both still lying. A partial lie is not more noble than a complete one.

An omission of fact is a lie. Try doing it under oath. You'll go to jail.

Source - "Also known as a continuing misrepresentation, a lie by omission occurs when an important fact is left out in order to foster a misconception. Lying by omission includes failures to correct pre-existing misconceptions. When the seller of a car declares it has been serviced regularly but does not tell that a fault was reported at the last service, the seller lies by omission. It can be compared to dissimulation" http://en.wikipedia.org/wiki/Lie

I make no judgement as to whether it is good or bad. That's just how it is.

Cryptographic hash functions must be efficient to compute. Those examples (scrypt, bcrypt, etc) were designed to be difficult to compute. Those are password hash functions, not cryptogrpahic hash functions. Two totally different things with different purposes.

I call it the Fart App Generation. Triviality rules the day. People make money selling whoopee cushions too. And if you find meaning in that, then more power to you. It's not for me though.