Schneier on Security

My favorite has to be Bellovin's EvilBit RFC

http://www.ietf.org/rfc/rfc3514.txt

@Nick Weaver: that's not from this year, though.

The german IT news site Heise had an article, that Mozilla was sueing Microsoft, because they had a patent on tabs originating from and old patent for tabs on index cards; and because Microsoft was using tabs in IE, they were to be sued for 1.4 billion dollars...
Here's the article:
http://www.heise.de/newsticker/meldung/87582

google's got a good one.

arggh. damn too smart site. :)

project teaspoon:

http://googleblog.blogspot.com/2007/04/project-teaspoon.html

I'm a big fan of the Maria Sharapova/Cisco XSS joke:
http://www.securitylab.ru/news/extra/293608.php

Skype Revenue from National Security Agency?

http://www.oreillynet.com/etel/blog/2007/04/skype_revenue_from_national_se_1.html

"Window Transparency Information Disclosure" a April 1 joke? Yeah sure, in ths "Security Advisory". However, you would be surprised how much informaton can be obtained by just peeking through any window of just an office building. This is not the 'open door' I alsways hope it to be when advising companies on their securty.

Not security-related, but a real gem nonetheless:

http://www.realclimate.org/index.php/archives/2007/04/the-sheep-albedo-feedbacki/

Securitylab putting XSS to good use:

http://www.securitylab.ru/news/extra/293608.php

In a political vein:

AFD: Shadowy monitoring of antiwar groups.
http://polizeros.com/2007/04/01/afd-shadowy-monitoring-of-antiwar-groups/

EverQuest announced new models for all playable character races: http://eqplayers.station.sony.com/news_article.vm?id=50397

I was mid giggle when it occurred to me you're got to be a real geek to get most of these.

@Alex
Man you gotta get out more and stop holding on so tight. :)

Giggles aside, it's good that people put stuff like this out there. We are proned to give credibility to information on the net, simply because it is not obviously a hoax, or because it is worded professionally and looks well put together. There is a vast amount of information out there and we must be able to differentiate between good and bad info.

@cmills

I am often proned by information found on the net. Sometimes I'm alternately proned and supinated, aka ROTFL.

Must.

Have.

Threat.

Alert.

Jesus.

Don't know if it's a problem on my end or on the host's, but I keep getting a DNS error when I try to hit threat alert jesus (pardon me, Jesus with the captol J). Maybe the site got ganked.

@ anonymous:
I seem to recall a certain site on which was being marketed a gun which fired a projectile, implanting a small RFID chip in a person from long distances. Too many folks took that one seriously.

even some cosmological events retain soundwave information.

A few years ago, scientists detected a sound that pre-dated the big bang. A spokesman described the sound as "Oops."

Posted to a CISSP mailing list yesterday (all below is quoted):

Organizations around the world are archiving data at a geometrically-increasing rate. Leading scientists worldwide estimate that this will lead to a world-wide electron shortage by 2050. With the cost of conversion higher than ever, it is time to develop more effective data management strategies in order to preserve electrons and avoid expected economic sanctions in the future.

Read entire story here:

http://peterhgregory.wordpress.com/2007/04/01/alert-manage-data-now-to-avoid-the-worldwide-electron-shortage/

When I reported yesterday that "EverQuest announced new models for all playable character races: http://eqplayers.station.sony.com/news_article.vm?id=50397", I had not logged into the game yet. As it turns out, it was not an idle announcement. They actually patched the game on April First that turned all player characters (and also non-player characters of the same races as the player characters) into stick figures! Best. April. Fools. Ever!

The "Window Transparency" thing is not much of a joke, given that it corresponds to NIST 800-53 control PE-5, "Access control for display medium--The organization controls physical access to information system devices that display information to prevent unauthorized individuals from observing the display output."

This control is required for all moderate- and high-impact systems in the U.S. Federal government.

The "Month of Bug Bugs" from McAfee is pretty humorous - http://www.avertlabs.com/research/blog/?p=239

My favorite part is "Where can I submit my malicious code for review?
If you would like feedback on your malicious code, you can submit it here."

Looks CLOSELY at the anchor tag for the word "here" ;-)

I'd really like to have the Threat Alert Jesus. It's almost depressing that it's only an April Fool's joke. :-/

I don't care if it rains or freezes, just as long as I got my Threat Alert Jesus!

This is depressingly related. Security guard picks up girl, warns her not to gossip.
* Sucks learned it was April fool 's joke!

Threat Alert Jesus is identifiable as a joke in the web page itself. Look at the telephone number - 1-800-555-LORD.
The exchange 555 is a system only exchange, used for long distance information. using any area code (AAA) the phone number of AAA-555-nnnn, where nnnn can be any digits, gets you to the information system for that area code.
The 555 exchange is also used to give phone numbers in movies, television, and radio shows, to be sure that they don't accidentally give a real number to the audience. Think about the harassment situation and resulting legal problems of causing a DOS on a phone line by using it in a movie.
Oh, and think back to the old movies and radio shows in the 30's to 60's. The phone numbers were always KLondike 5-nnnn. Hmmmm. KL5 = 555.