Josh Wieder

I am always looking out for new gimmicks to trick poor innocent souls on the internet into stumbling onto my website, so after countless prompts and notifications, I have finally broke down and activated a Google+ Account. I'm interested in showing authorship in my search results , and now I can be sure that at least the FBI is reading my blog . It's still a work in progress, but I am not sure what the point is after an initial inspection. MySpace was for 12 year old girls and awful bands. Facebook is for stalking your ex and so you in turn can be stalked by your government. Google+ ... what is Google+ for? I found some friends and coworkers and added them to circles. This was okay, and they always have some interesting things to say in the stream, but I found after a while that their comments were pushed underneath a bunch of posts by people I don't know about topics I don't care about. Here are a brief list of some of the random things added to my stream that I ha

I have seen quite a bit of advice on the Internet that is unsound over the years, enough that I thought I am rarely surprised by idiocy. The video above though - this one made me laugh out loud. You know the video is going to be a gem from the title - "Apple Keyboard Secret That Apple Does Not Tell You". Anything with "The Secret That X Doesn't Want You to Know" is usually a window into the mind of a lunatic, and this does not disappoint. Give it a click - its only about 30 seconds long.

A few months ago, I wrote a post about websockets and IIS7 , explaining how some extensive hacking is needed to get websockets working and providing a link to an application that would accomplish just that. That post was very popular - Microsoft developers are obviously looking for ways to implement web sockets, and there is not a lot of documentation out there to assist them yet. With the release of Windows Server 2012, Microsoft is now including native suppor t for WebSockets. Unfortunately the 2008 hack (released by HTML5Labs) is now deprecated, and has been removed from the developer's website. Because there is so much interest, and no longer a fix to implement websockets in IIS7 that I am readily aware of, I am going to start putting together some information for developers here on IIS8. This post will just have the basics, and I will expand on the topic through later posts. To get started, it is necessary to enable the WebSocket Protocol Module. The module is available as a

Have you encountered error 0x84B30002 when uninstalling MSSQL 2008 R2, preventing the uninstall from proceeding? I have. So far I have only encountered the issue with Express Edition, although rumor has it that the error can occur with other editions as well. The error message will be displayed in a pop-up as well as the summary.txt log file in the installation directory. Here is how to fix it: Launch the registry editor by typing regedit in the Run bar in the start menu. Navigate to the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ After expanding uninstall, you will need to locate each key related to the SQL instance you are attempting to remove - if there is only one instance on the server, locate each key with the word SQL in the DisplayName field.  Within each key, locate the GUID. It will look something like this:  234A1B2C-12AB-1AB2-B1C2-A12B345678C1   and be typically contained in either the ModifyPath or Uninstall

That Was Quick Italian security consultants ITSEC discovered the security hole following an analysis of the Unified Extensible Firmware Interface (UEFI), a successor to the legacy BIOS firmware interface, that Microsoft began fully supporting with 64-bit versions of Windows 7. Tip of the Hat to The Register, linked above.  [EDIT: The article specifies the payload as a "bootkit". This was deliberately omitted on my part. The word "bootkit" strikes me as part of that trend to modify prefixes of words to make them ludicrously specific, like how Watergate became EverythingUnderTheSun-Gate. Its a cheap way to feign familiarity through reference. Is there a relevant disharmony between the terms bootloader and rootkit I'm ignoring? If so feel free to shine light on my ignorance via email or in the comments.] Since we are on the topic of hardware hacking, last week I caught a printer spamming - as in, a printer that was network available that had been compromis

I received a notification from a large security auditing firm that of the ciphers currently available, only RC4 ciphers will be considered PCI compliant. My assumption based on the notification is that this move is intended as a rejection of CBC (Cipher Block Chaining). Well, that's fine as far as I am concerned. CBC has some serious issues as implemented in SSL v3 / TLS v1.0. In a nutshell, you can time responses for applications using the block cipher to get ranges of possible data in SSLv3 and partial payload decryption in TLS. So-called "stream" ciphers like RC4 are immune to this particular attack vector. You don't get private keys from the attack, its by no means a fast attack (minimum of three hours), and you need access to monitor the session . Further, patches for CBC exist to over-ride the timing exploit (for example the NSS libraries used by Mozilla have been patched). I will save debunking the man in the middle hysteria for a later post. What frustrate

We're all grown ups here. Can we agree to never say "app" in polite conversation ever again? I have trouble conceiving of another term that is more likely to make you look like a buffoon ("Social Media Guru" is a close second). Let's all have a bit of dignity and speak like we were taught to do so in schools and not marketing meetings. ლ(ಠ益ಠლ)