Joel Esler, Sourcefire, Snort, Immunet, ClamAV, Apple, and Network Security. This is my blog.
Friday, February 12
Tuesday, August 11
Walking and Running Barefoot
Walking and Running Barefoot
Thursday, August 21
What do the freshman know?
What do the freshman know?
Wednesday, May 28
Podcast Episode Five has been released!
Morning everyone,
Just a quick note to let everyone know that we put out Podcast Episode 5 this morning. We had a special guest with us! Larry Pesce of PaulDotCom Security Weekly! The guys over at PaulDotCom do a great job, and we loved having Larry on the show! Congradulations to Paul, as he is home with a new baby!
Don't forget the Live Podcast that we are doing at SANSFIRE on July 23rd at 8pm.
iTunes users, go here to subscribe.
Non-iTunes users, go here to download.
Thanks!
Podcast Episode Five has been released!
Morning everyone,
Just a quick note to let everyone know that we put out Podcast Episode 5 this morning. We had a special guest with us! Larry Pesce of PaulDotCom Security Weekly! The guys over at PaulDotCom do a great job, and we loved having Larry on the show! Congradulations to Paul, as he is home with a new baby!
Don't forget the Live Podcast that we are doing at SANSFIRE on July 23rd at 8pm.
iTunes users, go here to subscribe.
Non-iTunes users, go here to download.
Thanks!
Thursday, March 27
A new podcast hits the airwaves
A new podcast hits the airwaves
Monday, March 24
Happy Birthday OSX!

Happy Birthday OSX!

Tuesday, March 4
I'm over it. (The flu that is)
I'm over it. (The flu that is)
Thursday, February 14
Teen hax0rs iPhone. Again.
Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."
When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone. However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.
>People want to be able to take their phones to other networks. I have a buddy of mine that has his on T-Mobile.
But I know alot of people that have hacked their iPhones for the apps. I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone. That's all I wanted. After I got that, there really wasn't any other apps I was interested in.
There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.
If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.
Teen hax0rs iPhone. Again.
Money quote: "The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device's memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable."
When the SDK comes out, I am sure some of the hacking (or the pace of it) will probably slow down, because people will actually have a legit way of getting apps on the iPhone. However, there will be a certain percentage that will be interested in it because of the SIM card unlocks.
>People want to be able to take their phones to other networks. I have a buddy of mine that has his on T-Mobile.
But I know alot of people that have hacked their iPhones for the apps. I used to have my iPhone hacked, but then the firmware update (1.1.1)? came out that allowed me to download music directly on the phone. That's all I wanted. After I got that, there really wasn't any other apps I was interested in.
There are a couple Apps I would like Apple to come out with.
1) A to-do syncer
2) Notes syncer
3) .mac syncing OTA
4) iChat interface.
If Apple had those features on the iPhone (while the top two are also updates to iTunes, pretty much), I'd be pretty happy.
Thanks goes to Craig who sent me this article.
Thursday, January 24
Getting Things Done (GTD), Mutt, and Vim
The point of GTD is to make the world and your email in particular work for you, not you work for it. I don't want to manually have to edit a "X" header everytime I want to tag an email with "Defer" or "Reply". I want to just hit a one or two keystroke combination and be done with it.
The major point of GTD is to navigate through life easier, not have alot of things pending in your mind. Get it out of your mind and get it on paper, (or whatever) and be done with
thinking about it. Just have it in a trusted bucket where you can store stuff.
So I have a different theory. First off let me preface this by saying that I do not keep my To-Do list and "Next Actions" list in Mutt. I use a VIM outline. This is an excellent way for me to keep up on how things are going with my actions simply by looking at them. I know what needs
to be done next, I know what things I am waiting on, all at a glance. This is how I envisioned it.
My contexts are simple:
@home -- All the tasks that could be done at home, Cleaning the Garage, organizing the basement, getting the taxes together, being an awesome dad. You get the picture.
@work -- All the tasks that could be (should be, have to be) accomplished at work. Doing Timesheets, filing bug reports, answering email, talking with a coworker about a project.
@waiting -- Stuff I am waiting on someone else for. Do I need to ping them? No, but I reguarily review my @waiting list to make sure that people get back to me on items, and if they don't then I make a next action item to ping them back @work or @home.
@someday -- Someday/Maybe. All the things I'd like to accomplish someday. Clean out my Closet, Finish that Snort paper i've been working on.
@review -- Weekly/Daily tasks. This is usually the first thing I check. Things I need to do "today". If I need to do something on a particular day, I'll make an appt in iCal to do it. Nothing goes on the calendar unless it WILL get done that day. The Calendar is sacred territory. Then I make a reminder in iCal to alert me. Things I need to accomplish that are "next action items" in @home or @work, I'll simply say "check @work" in my @review list. Simple.
@phone -- Phone calls I need to make. These can be done anywhere. Whenever I have a chance to do them, I'll make a couple phone calls. Things rarely go in there because I basically loathe talking on the phone. I'd rather do everything through IRC, IM, or email. I keep records of stuff this way.
That's it. Under the contexts, if I have a particular project I'll indent it. For example.
@home
Clean Garage
-- Go to Lowe's
-- Buy Shelves
-- Assemble Shelves
-- Make time to clean Garage
-- Clean Garage
Simple enough. When I indent once, it's a project, any indents under the project are next action items. Now, next to the Next action items, I have lines. "--". Let me define my lines.
-- To do.
++ Cancelled.
\- Done
-> Deferred or assigned to someone else
?- Waiting on this.
That's it. No need to get tricky. Now I can easily glance at my list and tell what needs to be done, what has been done, and what I am waiting on.
KISS principle. Keep It Simple Stupid!
Now, for the other part. Email, mutt (or muttng -- which I use) and how I have it implemented.
Before I started the GTD philsophy, I used the folder method. You know the one.. "All email from Sourcefire goes in the Sourcefire folder." "All email from snort-users list goes in the snort-users list folder." What do you wind up with? A hundred folders! This isn't the most
efficient way to do anything. So I had to get away from that. I started thinking, what is the most efficient way of sorting email? I got a hold of a friend of mine Emory, and asked him what he did (he's a big GTD guy as well), and he gave me a couple thoughts. So I took his ideas, combined them with a couple of my ideas, and here we are.
I made 4 folders.
_Read -- Emails I have read.
_Reply -- Emails I need to reply to, but it will take me over 2 minutes to do so. (GTD's philosophy is, if it takes >2 minutes to do something, you need to alot some time to do it. If it takes <2>
_Waiting -- Emails that I am waiting on someone else to get back to me about the contents on.
_Defer -- Emails that I assigned to someone else but I need to stay in on until completion (things rarely go here).
I have another folder called "lists" that I already had. Under the folder lists I had about 20 subfolders with all the listservers I subscribe to. This.. was too much for easy sorting.
First thing I did was move all the email from all the subfolders under "lists" and put it in "lists". Of course, I wound up with about 13,000 emails in here, but who cares? It's all in context and it will make more sense in a second.
Second thing I did was change all my procmail recipes (or rules) to instead of putting everything in subfolders of "lists", just dump it all in "lists".
Third thing I did was get rid of all the auto-processing rules to sort emails by sender. I had rules in there, if they came from sourcefire.com to put into a folder called sourcefire. If it came from apple.com or mac.com, put it in apple. Too much. Put it all in the inbox. Pretty
simple so far.
The next thing I did, since I am going to have more email coming into my inbox now, is to have a way to easily process it. I wanted to be able to read an email, mark it, and know exactly where it is. "Hey that email from Billy-bob, is it in sourcefire? is it in snort-users? In defer? Where
the hell did I put that". Spotlight on the mac makes this very nice, however, I am using mutt. So I needed a better way. Finally I came up with my answer. Macros. I wanted to be able to mash a key or two and have my email sort automatically after I get done reading it. So I made
some muttng macros.
macro index,pager \
macro index,pager \
macro index,pager \
macro index,pager \
macro index,pager \
macro index,pager \
Now, when I mash "esc 1" the email is copied to _Read and marked for deletion in Inbox. No selecting the folder, no hitting "yes" no hitting enter. I just mash Esc-1. Done.
Same thing with 2, 3, 4, 5, and 6. I don't have to change headers or anything. They are sorted by folder, and I don't have to worry about it. I use the sidebar patch (built into muttng) to see how many emails I have in each folder at a glance. If you use mutt and you don't use the
sidebar, I suggest a look. Very handy.
That's it. In my sidebar I have 6 folders. Now my workflow is simple.
Email comes in, do I need to respond, or assign it to someone else? Yes or No? If yes, will the response take longer than two minutes. If Yes, file to _Reply, if No, respond. If I do not need to respond file to _Read. If I need to assign it to someone else, forward it. If I need to
track it, the email goes to _defer until tracking is done, then it goes to _read.
All listserv traffic goes to lists. I check this a couple times a day just to skim through.
The spam folder is for spam (duh). And I get ALOT of spam. Fortunately for me, I have built some really bullet-proof spam rules in procmail and they do 95% of the sorting for me. However. Everyone once in awhile, a real email will get sent to spam (empty subjects, people who write in all caps, people who send me subjects with all Caps, or a whole bunch of
!!!!!).
The only other folder that is automatically filed is a folder called "big". All emails that have attachments that are over 3 mb/s in size go to this folder. This rarely happens and 100% of the time people will ask me "Hey I just sent you an email with a bunch of pictures in it, did you get it?" I'll go check big. Done.
I think this system will work for me. Let me know if any of it works out for you.
Getting Things Done (GTD), Mutt, and Vim
The point of GTD is to make the world and your email in particular work for you, not you work for it. I don't want to manually have to edit a "X" header everytime I want to tag an email with "Defer" or "Reply". I want to just hit a one or two keystroke combination and be done with it.
The major point of GTD is to navigate through life easier, not have alot of things pending in your mind. Get it out of your mind and get it on paper, (or whatever) and be done with thinking about it. Just have it in a trusted bucket where you can store stuff.
So I have a different theory. First off let me preface this by saying that I do not keep my To-Do list and "Next Actions" list in Mutt. I use a VIM outline. This is an excellent way for me to keep up on how things are going with my actions simply by looking at them. I know what needs
to be done next, I know what things I am waiting on, all at a glance. This is how I envisioned it.
My contexts are simple:
@home -- All the tasks that could be done at home, Cleaning the Garage, organizing the basement, getting the taxes together, being an awesome dad. You get the picture.
@work -- All the tasks that could be (should be, have to be) accomplished at work. Doing Timesheets, filing bug reports, answering email, talking with a coworker about a project.
@waiting -- Stuff I am waiting on someone else for. Do I need to ping them? No, but I reguarily review my @waiting list to make sure that people get back to me on items, and if they don't then I make a next action item to ping them back @work or @home.
@someday -- Someday/Maybe. All the things I'd like to accomplish someday. Clean out my Closet, Finish that Snort paper i've been working on.
@review -- Weekly/Daily tasks. This is usually the first thing I check. Things I need to do "today". If I need to do something on a particular day, I'll make an appt in iCal to do it. Nothing goes on the calendar unless it WILL get done that day. The Calendar is sacred territory. Then I make a reminder in iCal to alert me. Things I need to accomplish that are "next action items" in @home or @work, I'll simply say "check @work" in my @review list. Simple.
@phone -- Phone calls I need to make. These can be done anywhere. Whenever I have a chance to do them, I'll make a couple phone calls. Things rarely go in there because I basically loathe talking on the phone. I'd rather do everything through IRC, IM, or email. I keep records of stuff this way.
That's it. Under the contexts, if I have a particular project I'll indent it. For example.
@home
Clean Garage
-- Go to Lowe's
-- Buy Shelves
-- Assemble Shelves
-- Make time to clean Garage
-- Clean Garage
Simple enough. When I indent once, it's a project, any indents under the project are next action items. Now, next to the Next action items, I have lines. "--". Let me define my lines.
-- To do.
++ Cancelled.
\- Done
-> Deferred or assigned to someone else
?- Waiting on this.
That's it. No need to get tricky. Now I can easily glance at my list and tell what needs to be done, what has been done, and what I am waiting on.
KISS principle. Keep It Simple Stupid!
Now, for the other part. Email, mutt (or muttng -- which I use) and how I have it implemented.
Before I started the GTD philsophy, I used the folder method. You know the one.. "All email from Sourcefire goes in the Sourcefire folder." "All email from snort-users list goes in the snort-users list folder." What do you wind up with? A hundred folders! This isn't the most
efficient way to do anything. So I had to get away from that. I started thinking, what is the most efficient way of sorting email? I got a hold of a friend of mine Emory, and asked him what he did (he's a big GTD guy as well), and he gave me a couple thoughts. So I took his ideas, combined them with a couple of my ideas, and here we are.
I made 3 folders.
Archive -- Emails I have read.
Listservs -- Emails from Listservers, I don't read these as often and all the listserv traffic is put into this folder on the server.
Waiting -- Emails that I am waiting on someone else to get back to me about the contents on.
First thing I did was move all the email from all the lists under "listservs". Of course, I wound up with about 13,000 emails in here, but who cares? It's all in context and it will make more sense in a second.
Second thing I did was change all my procmail recipes (or rules) to instead of putting everything in subfolders of "lists", just dump it all in "listservs".
Third thing I did was get rid of all the auto-processing rules to sort emails by sender. I had rules in there, if they came from sourcefire.com to put into a folder called sourcefire. If it came from apple.com or mac.com, put it in apple. Too much. Put it all in the inbox. Pretty
simple so far.
The next thing I did, since I am going to have more email coming into my inbox now, is to have a way to easily process it. I wanted to be able to read an email, mark it, and know exactly where it is. "Hey that email from Billy-bob, is it in sourcefire? is it in snort-users? In defer? Where the hell did I put that". Spotlight on the mac makes this very nice, however, I am using mutt. So I needed a better way. Finally I came up with my answer. Macros. I wanted to be able to mash a key or two and have my email sort automatically after I get done reading it. So I made some muttng macros.
macro index,pager \e1 "<copy-message>=Archive\ny<delete-message>" "Save Message to Archive"
macro index,pager \e2 "<copy-message>=Listservs\ny<delete-message>" "Save Message to Listservs"
macro index,pager \e3 "<copy-message>=Waiting\ny<delete-message>" "Save Message to Waiting"
Now, when I mash "esc 1" the email is copied to Archive and marked for deletion in Inbox. No selecting the folder, no hitting "yes" no hitting enter. I just mash Esc-1. Done.
Same thing with 2, 3, 4, 5, and 6. I don't have to change headers or anything. They are sorted by folder, and I don't have to worry about it. I use the sidebar patch (built into muttng) to see how many emails I have in each folder at a glance. If you use mutt and you don't use the
sidebar, I suggest a look. Very handy.
That's it. In my sidebar I have 6 folders. Now my workflow is simple.
Email comes in, do I need to respond, or assign it to someone else? Yes or No? If yes, will the response take longer than two minutes. If Yes, file to Archive, if No, respond. If I do not need to respond file to Archive. If I need to assign it to someone else, forward it. If I need to
track it, the email goes to Archive and I create a todo in Omnifocus to track it until tracking is done, then it goes to Archive.
All listserv traffic goes to listservs. I check this a couple times a day just to skim through.
The spam folder is for spam (duh). And I get ALOT of spam. Fortunately for me, I have built some really bullet-proof spam rules in procmail and they do 95% of the sorting for me. However. Everyone once in awhile, a real email will get sent to spam (empty subjects, people who write in all caps, people who send me subjects with all Caps, or a whole bunch of "!!!!!").
I think this system will work for me. Let me know if any of it works out for you.
