Testing for my CSSLP and trying uCertify.

As part of my stated goal to become more active in the Information Security market (following my career path of Integration-Performance-Security), I have decided to certify as a CSSLP. There is a wealth of knowledge out there about the SSDLC part of things that I don't really hold, and it is time.

By way of Coincidence, uCertify emailed me just the other day and offered me the opportunity  to try out one of their prep kits. Needless to say I selected the Certified Secure Software Lifecycle Professional kit.  So I am going to get to review the kit in the best way possible - actually taking the exam!

The initial look of the kit is very nice - it is an installed package rather than a web based thing, which gives some nice user interface features but makes it a little less accessible. The learning mode is tightly integrated with the practice tests, which will help me a lot. I already know about 70% of what is on the test, so I need something that will help me focus on the 30% and uCertify seems to be doing that.

Plan on hearing a little more from me in the next month about this - I plan to test around the end of February. Wish me luck!

Referencing a C# class library in HTML5 Metro UI

I am sure that you, like me, are hoping that you can use your C# code as the backend to your HTML5 Metro applications. For instance, I need to use the Meetup API that I am developing in a metro application that I am planning. I don't want to rewrite all of that in JavaScript.

In the solution that needs the C# class, right click on the solution in Solution Explorer and select Add New Project. I used new rather than trying to import one becasue the import facility is a little buggy in Visual Studio 2011. Click on Visual C# and then select Class Library as shown in Figure 1.

 

Figure 1- Add a class library

Once the project is added , you need to make two changed before you can reference it in your HTML5 application. First, the output type of the assembly needs to be set to WinMD File, as shown in Figure 2.  You can change this in the Properties.

 

Second, you need to seal the class. You can do that in the code for the class, using the sealed declaration, like this:

    public sealed class WebService
    {
        public string BaseUri { get; set; }

    }

Note that implementation inheritance isn't alloweed in Metro applications, so you need to head back to the 90s to get your polymorphism working, sorry!

 

MetroUI:Another user has already installed an unpackaged version of this application.

If you have had to delete your user profile in Windows 8 to get around the known Internet Explorer 10 bug, you might have run into this error when trying to run an app from Visual Studio

Error    2    Another user has already installed an unpackaged version of this application.                    The current user cannot replace this with a packaged version.                    The conflicting package is 00392a51-cf7d-4fd5-bde7-be48dcef9ec2 and it was published by CN=sempf     ToDoTodayApp

The reason this happens is the Package Name parameter of Metro apps.  In the Package.appxmanifest you can see the GIUD that is used for the unique app identity.

<Package xmlns="http://schemas.microsoft.com/appx/2010/manifest">
  <Identity Name="00392a51-cf7d-4fd5-bde7-be48dcef9ec2" Version="1.0.0.0" Publisher="CN=sempf" />
  <Properties>
    <DisplayName>ToDoTodayApp</DisplayName>
    <Description>ToDoTodayApp</Description>
    <PublisherDisplayName>sempf</PublisherDisplayName>
    <Logo>images\storelogo.png</Logo>
  </Properties>

All I had to do to get around the problem was alter the GUID, and the program ran fine.

On popular events and the efficacy of registrations

Codemash - probably the single best regional development conference in the country - sold out of 1200 tickets in 20 minutes.  This is pretty impressive, but hardly unheard of.  ShmooCon, the DC security conference, sells out in a few seconds every year. and has gone to a lottery system to distribute tickets. This is not optimal because many who want to go and should go are not admitted by pure bad luck, making the conference worse overall.  While degradation in quality is an effective way to reduce queue length, it isn't one that anyone really wants.

I am fascinated with the economics and psychology behind popular events and their queues.  Generally, for something like a concert, you will drive the queue length down with cost.  You want to see Madonna?  Fine - $350. Too rich for your blood? Good - we had too many people anyway.  This works for a lot of entertainment topics, actually, since there is no moral standard for admittance.

Colleges are another story.  A good college will have an abundance of admissions, but only a few will be accepted.  Private schools will filter with cost as well - but is this a good idea?  Do you want those with the most money, or those who have the best chance for success? Those two items won't always overlap.  The Objectivist seminar that used to be in Virginia every year had a good solution: they filtered with high cost but had a scholarship program.  To apply for a scholarship, you needed to do a LOT of writing, and it had to be GOOD.  Few went to the trouble, but those who did REALLY wanted to be there. I know, because I was a recipient in 1997.

But how to reduce the queue for something like Codemash? Eventually something like a lottery will have to be instituted, because next year noone trying to register more than a few people at a time will be able to get tickets. But see, that is a problem, as this is a conference where people who really WANT to be there, should be there.  High prices have a similar problem - in general the community is not short on funds so that will probably do nothing except tick people off. (Although a charity could get involved which would be neat).  Even then, do we really want to put the con out of the reach of students? Early registration - effectively reserving space WAY in advance - is another possible solution. I am sure there are other options - guess I need to get out the queuing textbook from OSU.

They aren't kidding about that 'enable exceptions' thing

In the default templates for WinJS Windows 8 applications, there are two lines that are easy to ignore:

 

    // Uncomment the following line to enable first chance exceptions.
    // Debug.enableFirstChanceException(true);

 

They aren't kidding.  I was doing a little work with the Pastebin API (shh, don't tell anyone) and had failed to declare a variable.

Over and over, I would run it and have no idea that something was wrong.  I would have to set a breakpoint and know where to look to find errors.  It sucked.  I am too used to an IDE.

Then I remembered those lines, uncommented the Debug member there, and was good to go.  It seems painfully obvious now, but it didn't before and if I can help someone else not pull their hair out, we are all the better.

Generally, though, I am not sure how I feel about this.  It seems a lot like On Error Resume Next in VBscript, and we all know how THAT turned out.

Notes from my Pentesting ASP.NET talk for DODD today

As promised, here are the relevant links to things I talked about at the OWASP talk today.

Thanks to DODD for inviting me out and for the nice certificate! Oh, and the food was awesome - one sure way to get speakers out there.

 

Got a cub scout in Simon Kenton council? Cross stitch?

The council patch is DMC 307

The Den patch is DMC 939

The international Scouting patch is DMC 550

The Pack Number is DMC 817

The 100 year ring is DMC 310

Just a PSA from your friendly neighborhood scouting family.

Want some popcorn?

 

Dual boot Windows 7 and Windows 8

 

When Windows 8 released, I was waiting.  I am not usually the first in line for OS releases, but this time I had a vested interest. I have a book in the works, and this release was an important part.

I was ready with VirtualBox, Windows Virtual PC, and a spare laptop (in case I needed to install on the metal). When the ISOs were available, I was first in line, with a fast connection, and I did the Pokemon bit – gotta get ‘em all.

VirtualBox refused to honor the 64 bit virtualization of my HP XW6200. Aaaand, so did Virtual PC. And guess what – the spare laptop I had was 32 bit too. I was stuck.

Except I had my main laptop, which was 64 bit and had Grub and a Linux partition.  Maybe, just maybe I could instead turn it into a dual booting Windows 7 / Windows 7 laptop.  This post is about how I did it.

Getting rid of Linux

The first time I had to do was get rid of Linux. I did this by removing the partitions that it lived on (That Wubu had made for me) and making them into an empty partition. I did this with the Disk Manager.

In Windows XP and prior, disk partitioning required a tool purchase. In Vista, Microsoft included a tool called Disk Management, part of the Computer Management control panel. To get there, open the Control Panel, change to Icon View, click Administrative Tools, and open the Computer Management panel.

image

This image shows my desktop right now, but the laptop had 6 partitions

  • The original Vista recovery partition
  • The C partition
  • Grub
  • Ubuntu 10
  • Ubuntu11
  • System Reserved

So I deleted the two Ubuntu partitions and Grub and made them into an empty partition. I made one on my desktop to show what I mean.

image

Here, I have a 250 GB unallocated partition.  I can right click on it and name it so I can be sure to get the right one when I am installing Windows 8.

Making a Windows 8 boot UBS drive

Now I needed to install – and I didn’t have any blank DVDs. (Really) I did have a 75 gig USB drive though. My laptop had the capability to boot from USB (as many do) so I decided to make a bootable USB drive.

  1. Start with a drive that you can empty (You can add stuff later if you need to).
  2. Extract the ISO to a file directory on your hard drive. Use WinRAR if you have nothing to do that.
  3. Download NovaCorp’s WinToFlash product.
  4. It runs right from the download no need to install
  5. Use the Windows Setup Transfer Wizard to move the extracted files from the ISO to the USB
  6. There ya go!

Making a Windows Partition

So I rebooted after this activity, and I got a Grub error. As it turns out, Grub doesn’t LIKE it when you delete its master boot record. I needed to load up a repair utility. Since I had a Windows 8 boot drive now, I booted to it by setting my BIOS to boot from USB, and entered the Repair menu.

From there I went to Advanced Tools, got a command prompt, and entered two commands:

bootsect /nt60 C:

and then

bootrec /fixmbr

Rebooted and then Windows 7 booted just fine.

Installing Windows 8

Installing Windows 8 was an awesome experience. I shut down Windows 7 and changed the boot partition to the USB drive again. When it came up, I had a normal Windows 8 install experience, which took about 10 minutes.

The installer auto rebooted, and I still had the bootable USB drive in. Since my BIOD was set to boot from that drive, it went back to the installer startup. I just shut down my machine, and unplugged the USB drive, restarted and the installer continued.

After installation, I rebooted to discover that Windows 8 comes with a boot manager! I get a big, neat MetroUI selection screen asking my if I want to boot into Windows 7 or Windows 8.

The Finished Product

I was stuck in 1024/786, but I had a landscape display. In a last ditch attempt, I navigated to the Display Settings, selected Advanced and then Update Driver.

image

Here I tried the Search Automatically feature and what do you know, it worked.

Now I have a perfectly working Windows 8 and Windows 7 partition, and I can freely boot between the two. The Windows 8 partition even has my Windows 7 partition mounted as a drive!

Nice work, Microsoft. Your work really showed on this one.

Recipe: Grilled Jalepeno Poppers

10 fresh jalepeno peppers

2oz Cream Cheese

2oz Shredded Chedder Cheese

2oz Real Bacon Bits

Pepper Grilling Rack, or carefully folded foil.

 

Using gloves, take the tops off of the peppers, and seed and core them.

Mix the cheeses and the bacon in a bowl.

Fill each pepper with the cheese mixture, then drop into grilling rack.

Grill on medium heat for 30 minutes, or until peppers have softened.

 

 

 

How I play miniatures with a 6 year old

My recent tweets about Warhammer with my son Adam have brought in a few questions, mostly: “How do you play that incredibly complicated game with a 6 year old?” Good question, that.  I can’t usually remember the Warhammer rules, so how am I expecting him to be able to get them.

The answer was a simple but balanced set of rules that I came up with merging some basic ideas from a lot of miniatures games.  I thought I would codify them here in case anyone else wants to try them with their kids.

Remember, this is VERY SIMPLE, so there is a lot of room for adjudication. A hard core gamer would find this very boring. Adam loves it, though.

Tourna

Tourna is a turn based miniatures game for two to four players.

Basics

Tourna is played with miniatures and dice.  Any miniatures can be used, including non-traditional figures like Legos or plastic animals. As long as they can be isolated (for instance, a lot of figures molded to a common base won’t work), then grouped into units, they will work.

At its core, Tourma is about building armies based on an agreed number of ‘dice’ in total.  Each individual miniature, or “figure”, is assigned a certain number of dice, which represents both that figure’s attack and defense value. If both sides have the same number of dice on their side, the game is balanced and may commence.

Setup

Tourna is best played on a flat clean surface like the dining room table.  After deciding on a source for miniatures, dice values need to be assigned.

Generally, individual figures are 1 dice, and generals are 2 dice.  Vehicles or machinery are 2 or 4 dice.  For instance:

Bill is playing dinosaurs.  He has 16 basic figures and 2 generals in two ‘units’, or groups that move together. His side totals 20 dice, because 16x1 = 16 and 2x2 = 4, and 16+4 = 20.

Adam is playing Legos.  He has a tank, which we decide is worth 4 dice.  Beyond that, he has 8 mounted figures with a general (total 10 dice) and 6 gunners. 4+10+6 = 20.  The sides are even, and play can begin.

IMG_20110727_192208
Simple game setup using Brettonians from Warhammer

Units stay together through the game, and can either move or battle.

Units may be designated as ‘shooters’ but they have a harder to-hit and damage roll. (See ‘Battle’)

Movement

Movement is measured in inches.  Distance can be scaled to your environment, and decided based on the figures you have available. 

A good starting point is to allow shooters to move 2 inches per turn, footmen to move 4 inches per turn, and mounted (vehicle or horse) to move 8 inches per turn.

Units are allowed one free reformation per turn.  They can rotate in place, or change formation either before or after they move.

Mounted units can ‘charge’ in exception to the ‘move or battle’ rule.  If the opposing unit is within range of the mounted unit’s movement, the mounted unit can elect to move to base to base contact, and then melee.

Battle

Battle in Tourna is restricted to melee and shooting.  Decide if each unit contains shooters at setup.

Melee

Units in base to base contact may melee.  All units except machines can melee, regardless if they are designated as a shooter.

The unit whose turn it is is attacking and the opposing unit is defending.  Attacking units may roll one six-sided die for each die of value they bring to the game.  Units roll to hit first, and if they hit then they roll for damage.  There is no special defense number for opposing units – only the attacker numbers matter.

Melee-only units hit on a roll of 3-4-5-6 on a 6 sided die.  They damage on a roll of 4-5-6.

Shooters (whether shooting or in melee) hit on a roll of 4-5-6 on a six sided die.  They damage on a roll of 5-6.

So, for instance, Bill’s unit of 8 Velicoraptors and one General is in base to base contact with Adam’s mounted unit.  The Velicoraptors are not shooters.  The General is worth two dice. Bill rolls 10 six sided dice for the 8 dinos and one general. 6 of the dice are 3 or higher, so he rerolls them for damage.  3 of them are 4 or higher, so Adam’s unit takes three dice of damage.  Bill can choose if that is 3 figures, or 1 figure and 1 (2 dice) general.

Shooting

Shooting can only be accomplished by figured designated at Setup as shooters. They can shoot the entire length of the play area. There is no distance measurement.

Shooting is line-of-sight.  One member of the shooting unit must be able to see one member of the defending unit to be able to aim for it.  All members of the shooting unit must shoot at the same defending unit. Shooters cannot move and shoot in the same turn.

Shooters cannot shoot into a melee.

Shooting units hit on a 4-5-6 on a six sided die (shooting or melee) and damage on 5-6.

So, for instance, during Adam’s turn he decides to shoot the one of Bill’s units of dinos that isn’t in melee with the mounted unit. He has 6 Lego gunners, and can draw an unobstructed line of sight from one of the gunner figures to one of the target dino figures.  He rolls six dice for the to-hit, and gets two dice at 4 or above.  He rerolls those two dice and rolls one 6, so does one die of damage to the dino unit.  He can either remove one of the figured from the unit, or reduce the general to a one die figure.

Machines, terrain and whatnot

Machines with shooting capability can shoot based on the number of dice they are.  They hit like shooters – 4-5-6 to-hit and 5-6- to damage.  They can only shoot at one unit at a time.  Machines have no melee capability.

Machines without shooting capability are treated like terrain. Shooters can’t shoot through terrain. There is no bonus for cover. Terrain and machines block line-of-sight.

Endgame

The game is over when one player is left with figures still in the game.  That player is the winner.

Bill Sempf

Husband. Father. Pentester. Secure software composer. Brewer. Lockpicker. Ninja. Insurrectionist. Lumberjack. All words that have been used to describe me recently. I help people write more secure software.

PageList

profile for Bill Sempf on Stack Exchange, a network of free, community-driven Q&A sites

MonthList