I spent the weekend in Berlin attending a conference called PH-Neutral, run primarily by the Phenoelit crew. This was the first European security conference I’ve attended and I found it quite different from any North American security gathering I’ve been to, such as BlackHat, CanSecWest, SOURCE Boston, BlueHat, or RSA. Everything was far more casual and laid back, which is something I had heard about European conferences but hadn’t experienced until now (even EUSecWest is held in a club whereas CanSecWest is in a Marriott).

Yesterday, Dave Lewis over at LiquidMatrix Security Digest cried foul at Core Security for releasing too much detail about a recent DoS vulnerability they had discovered. His specific gripe was that they provided an IDA Pro excerpt that showed where the vulnerability was triggered. The excerpt is short, so I’ll even copy/paste it here:

.text:00405C1B mov esi, [ebp+dwLen] ; Our value from packet
…
.text:00405C20 push edi
.text:00405C21 test esi, esi ; Check value != 0
…
.text:00405C31 push esi …

I was checking out the “new and improved” Dilbert website a few minutes ago, checking out some of the new features and lamenting the overzealous use of Flash. One new feature is called “Mashups.” Naturally, you’d assume that this was some fancy Web 2.0 API that one might use to create a “killer app” combining Google Maps, Twitter, traffic delays, police reports, and Dilbert comics, all neatly packaged up as a privacy-invading Facebook plugin. Sorry, no such luck. “Mashups” turns out to be a way for readers to unleash their inner comedian and create customized punch …