Presentation: Attack Progressions

[GreyGeek]

I had time to listen to your talk today, Steve. It was very enjoyable. Thanks for posting it.
You have a natural, quick witted talent to speak at these events.

I especially liked your anecdotes about you and your son, Dillon, and you crashing his program with "47". I had a parallel experience with my son, whom I taught how to code and employed in my consulting business. Good times, great memories.

Your comments on bad guys targeting communication protocols between functions in applications was interesting.

GUI programming has encouraged apps which do everything including the kitchen sink. As you mentioned, it gives bad guys places to hide their stuff. My first thought when you discussed that was the change I've observed in Linux over the last 15 years which deals with the decline of single purpose utility apps in favor of GUI wrappers to them, including combinations of them, that actually deceased the functionality of the utilities by limiting the users choices to a few of the most popular switches. Lazy programmers? How many Linux users know how to use the man pages to learn about the various switch options that CLI utilities have? Something as simple as ls or netstat....

[Feathers McGraw]

When I switched to Linux and first discovered configuration files, it was a bit of a revelation. I had a problem with window snapping/resizing, and luckily Steve knew a configuration parameter that wasn't in the GUI settings. Opened the config file, and there it was!

I also discovered pretty quickly that the man pages are one of the best places to get information. I'm always surprised that they're so clear and concise, I think it says something about the community that even these seemingly "tedious" tasks get done really well.

Compare that with the "help" pages on Windows and most proprietary software. I guess that's what you get when the person writing the manual would rather be doing something else!

[NickStone]

What are 'man pages'? Are they pages aimed at men?

[Feathers McGraw]

I can't work out if you're being sarcastic or not (about the first bit).

Either way, this is probably the best answer:

Try this:

man woman

Feathers

[GreyGeek]

What are 'man pages'? Are they pages aimed at men?

I'm sure you are jesting, but in case you are not ...

"Man" is an abbreviation for "Manual", as in manuals, which are text pages that describe command line (CLI) utilities. For example, while in a Konsole one can issue something like

netstat -lpa

Don't know what "-", "p" and "a" (which are called switches) stand for? Open the man pages and read:

man netstat


If you open Konqueror and enter

man:netstat

in the URL you will get an HTML of its man page. When I first began using Linux there was a command called "more", which has been replaced by "less". When I am doing a global search using "locate", for example, and I want to page the listing, I use

locate something | less

which would allow me to page forward and backward to view my search results. Think that is all it is good for? Put

man:less

into Konqueror's URL and see how many switches that "simple" CLI command has, and what power it has!



In addition to "man" there is also "info" and "apropos". The latter used to involve a console menu structure but apparently no longer does. You can google them to find out more about them.

[oshunluvr]

Pffttt, everyone knows there's no "man" page for women!

[richb]

Should be renamed per pages, for person, to be politically correct.

[Feathers McGraw]

Should be renamed per pages, for person, to be politically correct.

Imagine...

per cat

[SteveRiley]

I'm always surprised that they're so clear and concise

man lsof would be an exception to this notion. It reads like someone's PhD thesis

[SteveRiley]

Pffttt, everyone knows there's no "man" page for women!

True, but there is

man man

the existence of which is certainly amusing. Or maybe just salient -- I am, after all, in San Francisco this week

[SteveRiley]

You have a natural, quick witted talent to speak at these events.

Thanks much, Jerry. I think it's important to use stories and anecdotes to support larger principles. Listeners can relate similar experiences, and thereby retain information longer. My son cringes every time I mention that I've told that story, but secretly he likes being part of my talks

Attackers moving from boxes to protocols is one problem, yes. IT service models are undergoing a major fundamental change today (see software defined networking, network functions virtualization, service chaining). Protocols are moving into the background and APIs are moving to the foreground. Most of these APIs are open, which is good. But you'd be lidding yourself if you thought people were seriously considering how these APIs might be abused beyond trivial cases.

[oshunluvr]

stuart@office:~$ man woman
No manual entry for woman
stuart@office:~$

Hmmm...

[SteveRiley]

No manual entry for woman

Hmmm...

For the authors of man pages, this is very likely to be a statement of fact

[Simon]

In my cultural heritage there are few taboos about sex, but you guys are making me blush.

[GreyGeek]

man lsof would be an exception to this notion. It reads like someone's PhD thesis

Probably was. The author of lsof, Victor A. Abell, is the retired Associate Director of the Purdue University Computing Center. He wrote that utility for Unix in the late 1980s or early 1990. Solaris used it. He became enamored with FreeBSD, where his home page resides.
One thing for sure ... it sure is powerful!