danielrm26

I strongly disagree. When so many people don't have any idea what the issue is, the most useful resource is something that approaches at THIS level, with links to deeper coverage.

If you dive super deep you don't have a summary in plain language, you have a competing explanation.

There are already a million of those; this isn't that.

Updated. Thanks for the input.

Can I use that?

Apologies. I was trying to keep it as simple as possible. I don't think people who need to know it to that degree will even need the summary I provided.

Super off-topic, but I bet you'd be far happier if you used only one.

Author here: I thought it got better after the list, not worse. <shrug>

Anyway, the claims aren't sourced because they're obvious. Only someone looking for conflict is going to ask for the claim that our country is loosing access to quality education.

And if you can't make the jump on your own that this leads to more uneducated people, well, then my powers to assist you have reached their limit.

Ok, fair point.

I'd say it differently, though. Instead of defending the original point, which was bad, I'd instead say among all other controls--most important of which is patching, removing passwords, etc.--one control is running below 1024.

I could go for that.

Except I actually think the gain from being up high (over 60K) is greater than the gain from being below 1024. It's not about being invincible, it's about not being a target at all.

> I want some assurance that when I ssh into a box, that I'm hitting a true and sanctioned sshd.

You don't get that from it being on 22; you get it from verifying host keys.

If you have random people spinning up daemons on your servers then you don't have an SSH problem.

Here's my response to this, point by point:

http://www.danielmiessler.com/blog/putting-ssh-another-port-...

Obscurity is only a poor security layer if it's used as a substitute for security instead of a supplement.

http://www.danielmiessler.com/blog/putting-ssh-another-port-...

Camouflage on tanks doesn't remove the armor; it just lowers the chance that it'll be needed.

Gratuitous, but I'll add anyway:

http://danielmiessler.com/study/vim

I go into a good amount of depth of how to get away from memorization and into thinking and having it happen.

A good example of Apple "intangibles" becoming tangible. These combine to become experience, which is really what it's about.

Nice to actually have a handle for something as important as this element of a user's enjoyment with using a touchscreen.

Hard to have capabilities without free will.

And since we don't, it's all about managing outcomes by using data to intelligently adjust variables.

Before he dies he wants to run nginx and varnish caching so that his site will survive the front page of HN.

The problem with this is that it assumes perfect judgement from the whistleblower. I explain this more here: http://danielmiessler.com/blog/why-its-dangerous-to-call-whi...

Ok, but wasn't that like 6 years too late?

No, but it'd be something. Silence is the worst possible thing he can say about it.

It's fascinating to think about how overall economy might be affected by simply adding a row to a database. Did that money actually become real when that row was created? If the money was withdrawn and spent, wouldn't it be real then?

Makes you wonder about the regulation of money in general.

Would you hug Hilary Clinton if you’ve met her on two or three different occasions? Of course not. And it’s the same for the female CEO of a major bank. So then, why would you hug a female work associate that you’ve only met twice?

Answer: you don’t hug Mrs. Clinton or the female CEO because you respect them too much.

Now, notice that this is how men treat ALL males.

http://danielmiessler.com/blog/on-hugs-vs-handshakes-for-fem...

Keep in mind that you can just set the port in your SSH config and you won't have to set it every time.

That's exactly the point, isn't it?

You can just set it in your SSH config for that destination and it'll use that port every time you do ssh destination.com.

I wouldn't say better: I'd say that it's another optional layer. Sometimes you cannot do that, where you can change the SSH config for all users to use a different port.

This is definitely true, but the assumption is that long-term active users to a sticky portal can be monetized--it's just a matter of figuring out the best way to do that.

And the distinction of a destination vs. a tool seems like a valuable one. Google knows this, which is why they are pushing Google+ so hard.

I think a lot of this confusion comes from what appears to be a mismatch between how he was when he was up and coming, vs. how he was in his later time as president.

If you watch his older speeches and ad-hoc interactions, he was extremely sharp. And if you watch him later he seemed easily confused and steeped in dogma.

I almost feel like he was poisoned, or beaten down, by the pressure of the presidency and the various narratives from Rove, Cheney, etc.

Either way, there's likely truth to both accounts--that he is both much brighter than people think he is, and that he often acted like a complete idiot.

How about "keeping bad things from happening"? That's only one level of abstraction up from that. Could be lucrative.

I'd say there are three main reasons:

1) Legacy systems not supporting special characters, 2) The desire to keep support overhead down, and use of the system up, by keeping users' passwords actually rememberable. In other words, if you let users make and use paswords they can't remember, they will, and as a result they'll either annoy you about it or stop using the site due to the hassle, and 3) Developers not wanting to have to worry about parsing special characters from untrusted users, which could potentially be dangerous.

In the past the top reason was probably the lack of ability to support the passwords (#1), and today it's probably the lack of desire to support them--mostly from #2, but partially from #3.

There's an easy way to test this: visit a very large site while tcpdump or Burp is capturing all your HTTP traffic. And upon first touch of the site, put your finger on the screen.

Does the stream of requests from your phone stop? No, it doesn't. The requests visibly continue to be made in the background as the page continues to load, so your comment isn't accurate.