I hope that headline got your attention. That was my goal. It’s offensive when someone generalizes about the overall intelligence and thoughtfulness of an entire group of people. And yet, that’s the habit we as an industry seem to have fallen in to. In IT and in InfoSec, over and over again I hear “Stupid users”, “those idiot users”, “my users are such dumb shits”. It’s almost a mantra; it’s uttered that frequently.

My focus here is in the security realm because that’s where I am and what I do. In the security community, I hear the sentiment echoed over and over again as well. Dumb users who repeatedly “click on shit” that ends up compromising my security. I’d like to turn that around a bit. Any time one of my users “click on shit”, I’d like to suggest that it is I who have failed and not them. Myself and my team have failed to properly educate them, I have failed to teach them how to identify the latest phishing scam, we have failed to teach them to type the URL themselves rather than blindly clicking on links. We have let the company down, not those “dumb users”. I feel very strongly that a big part of my job should be end user education. As tired as military analogies maybe, they are our front line, they are our border guards. Without their participation and involvement in securing our environment, we can’t ever hope to be successful.

So please stop looking down at those “dumb users” and make them a part of your security team. Educate them and make sure they understand that they play a vital part in securing the enterprise. In fact, as a whole, I could argue that they play a much more important role than you do, so please act like it.

Also, please consider bringing your expertise to the newly launched Security Awareness Training Framework (SATF). We are working to develop a framework (similar to what is being done with Penetration Testing PTES) that will help security programs and practitioners develop a complete and comprehensive security awareness program. This isn’t a small task but we are a small group of folks working on this in our free time and any extra set of hands would be appreciated.

P.S. I don’t think information security folks are dumb, in fact, I’m often awed and intimidated by the intelligence of some of my peers.

The reason Moxie had agreed to meet with me was to discuss the possibility of him speaking at a fledgling organization I was trying to get started. I had it in my head that Pittsburgh needed a security community. So a couple friends and I had started PittSUG, the Pittsburgh Security Users Group and we were hoping to lure Moxie, bribe him if that’s what it took, to get him to speak at our event. So I sat there explaining to Moxie what my idea was for the Users Group. He seemed into the idea, but he wanted to make sure I understood that no one was going to come and drop 0-day at PittSUG. I was kind of surprised by this, it had never occurred to me to even think that someone would drop 0-day at PittSUG. Probably, because I don’t deal in 0-day, I don’t think there’s any risk of me uncovering some 0-day.

The goal of PittSUG was to deal in what I described that day as “commodity” security
information. In my career, I have encountered plenty of Information Security professionals who don’t understand the very basics — from being warned that I would infect my Linux box by running strings on a W32 binary to what I can only call a mystical belief about how TCP/IP networking works, as if once you got below layer 7, it all became black magic and could behave without rules and defy both logic and reason. Many of these Info Sec professionals not only didn’t understand what the tool was doing behind the scenes, they didn’t even understand the tool. With PittSUG, I hoped to fix this. Okay, not fix it, but at least make a dent in it. Unfortunately, the PittSUG experiment didn’t last long. We quickly ran out of people willing to speak and teach at the meetings. However, I know we were partially successful.

Our last event was a CTF, created by the core group of PittSUG. The goal was collecting flags hidden through-out various machines. We had totally outdone ourselves, the contestants really struggled and we watched with pride, we had really created a challenge. And then something great happened, all of us spontaneously sat down with the less experienced contestants and started leading them through the exercises. We didn’t really decide for this to happen, it just kind of morphed into a training session. Suddenly flags were falling and those frustrated faces became smiles. The folks at that CTF had really learned some things, we spent time not only showing them how to use the tools, but we also spent time explaining what was happening behind the scenes.

This afternoon I listened to the AIDE talk from Keith Pachulski (SecOps) on the failures of the penetration testing industry. A good portion of his talk was addressed at individuals like the ones I mentioned previously, the ones who think TCP/IP is a mystery and ICMP is a clown faced rap group. As he talked, I couldn’t help but wonder if we aren’t doing it wrong. As a community, we seem to raise up those who bring the 0-day, but not so much those in the trenches teaching the “commodity” security lessons. I understand why; 0-day is sexy. Explaining a MITM attack only to realize the person you are explaining it to has no idea what an ARP table is, is everything but sexy. I also think a lot of us are self taught, we do this not because we want a paycheck, but because we really love this, we love the challenge and the we love losing ourselves in the Matrix. I think in a lot of cases we expect the same effort and interest from our peers and we are frustrated and disappointed when we don’t get it.

So what’s the point of all this? My point is this, Adrian Crenshaw and those like him are doing it right. Irongeek.com has some great video’s and some amazing tutorials. Adrian will be the first to admit he isn’t an expert, but he’s turned that enthusiasm for Information Security into a great learning resource. Maybe if we had more Adrian’s in the community, we’d have fewer people who only know Metasploit for db_autopwn and more who know how to find targeted and specific attacks. And just maybe they will not only be able to chose the right attack for the right target, they might even be able to explain what it’s doing under the covers.

We need those like Moxie and Tavis Ormandy dropping those awesome 0-days because we need those flaws found and brought to the light of day by the good guys, but we also desperately need the Irongeeks who aren’t afraid to teach the stuff so many of us take for granted. Next time your local con or Bsides event has a call-for-papers, please don’t be afraid to submit a talk about something you think everyone knows, because you might be surprised how much your talk will benefit those in the audience.

I present a repost of the 25 blasphemous quotes.

Please consider reposting this on you site or linking to it to show your support! We’ve lived with religious tyranny long enough.

From today, 1 January 2010, the new Irish blasphemy law becomes operational, and we begin our campaign to have it repealed. Blasphemy is now a crime punishable by a €25,000 fine. The new law defines blasphemy as publishing or uttering matter that is grossly abusive or insulting in relation to matters held sacred by any religion, thereby intentionally causing outrage among a substantial number of adherents of that religion, with some defences permitted.

This new law is both silly and dangerous. It is silly because medieval religious laws have no place in a modern secular republic, where the criminal law should protect people and not ideas. And it is dangerous because it incentives religious outrage, and because Islamic States led by Pakistan are already using the wording of this Irish law to promote new blasphemy laws at UN level.

We believe in the golden rule: that we have a right to be treated justly, and that we have a responsibility to treat other people justly. Blasphemy laws are unjust: they silence people in order to protect ideas. In a civilised society, people have a right to to express and to hear ideas about religion even if other people find those ideas to be outrageous.

Publication of 25 blasphemous quotes

In this context we now publish a list of 25 blasphemous quotes, which have previously been published by or uttered by or attributed to Jesus Christ, Muhammad, Mark Twain, Tom Lehrer, Randy Newman, James Kirkup, Monty Python, Rev Ian Paisley, Conor Cruise O’Brien, Frank Zappa, Salman Rushdie, Bjork, Amanda Donohoe, George Carlin, Paul Woodfull, Jerry Springer the Opera, Tim Minchin, Richard Dawkins, Pope Benedict XVI, Christopher Hitchens, PZ Myers, Ian O’Doherty, Cardinal Cormac Murphy-O’Connor and Dermot Ahern.

Despite these quotes being abusive and insulting in relation to matters held sacred by various religions, we unreservedly support the right of these people to have published or uttered them, and we unreservedly support the right of any Irish citizen to make comparable statements about matters held sacred by any religion without fear of being criminalised, and without having to prove to a court that a reasonable person would find any particular value in the statement.

Campaign begins to repeal the Irish blasphemy law

We ask Fianna Fail and the Green Party to repeal their anachronistic blasphemy law, as part of the revision of the Defamation Act that is included within the Act. We ask them to hold a referendum to remove the reference to blasphemy from the Irish Constitution.

We also ask all TDs and Senators to support a referendum to remove references to God from the Irish Constitution, including the clauses that prevent atheists from being appointed as President of Ireland or as a Judge without swearing a religious oath asking God to direct them in their work.

If you run a website, blog or other media publication, please feel free to republish this statement and the list of quotes yourself, in order to show your support for the campaign to repeal the Irish blasphemy law and to promote a rational, ethical, secular Ireland.

List of 25 Blasphemous Quotes Published by Atheist Ireland

1. Jesus Christ, when asked if he was the son of God, in Matthew 26:64: “Thou hast said: nevertheless I say unto you, Hereafter shall ye see the Son of man sitting on the right hand of power, and coming in the clouds of heaven.” According to the Christian Bible, the Jewish chief priests and elders and council deemed this statement by Jesus to be blasphemous, and they sentenced Jesus to death for saying it.

2. Jesus Christ, talking to Jews about their God, in John 8:44: “Ye are of your father the devil, and the lusts of your father ye will do. He was a murderer from the beginning, and abode not in the truth, because there is no truth in him.” This is one of several chapters in the Christian Bible that can give a scriptural foundation to Christian anti-Semitism. The first part of John 8, the story of “whoever is without sin cast the first stone”, was not in the original version, but was added centuries later. The original John 8 is a debate between Jesus and some Jews. In brief, Jesus calls the Jews who disbelieve him sons of the Devil, the Jews try to stone him, and Jesus runs away and hides.

3. Muhammad, quoted in Hadith of Bukhari, Vol 1 Book 8 Hadith 427: “May Allah curse the Jews and Christians for they built the places of worship at the graves of their prophets.” This quote is attributed to Muhammad on his death-bed as a warning to Muslims not to copy this practice of the Jews and Christians. It is one of several passages in the Koran and in Hadith that can give a scriptural foundation to Islamic anti-Semitism, including the assertion in Sura 5:60 that Allah cursed Jews and turned some of them into apes and swine.

4. Mark Twain, describing the Christian Bible in Letters from the Earth, 1909: “Also it has another name – The Word of God. For the Christian thinks every word of it was dictated by God. It is full of interest. It has noble poetry in it; and some clever fables; and some blood-drenched history; and some good morals; and a wealth of obscenity; and upwards of a thousand lies… But you notice that when the Lord God of Heaven and Earth, adored Father of Man, goes to war, there is no limit. He is totally without mercy – he, who is called the Fountain of Mercy. He slays, slays, slays! All the men, all the beasts, all the boys, all the babies; also all the women and all the girls, except those that have not been deflowered. He makes no distinction between innocent and guilty… What the insane Father required was blood and misery; he was indifferent as to who furnished it.” Twain’s book was published posthumously in 1939. His daughter, Clara Clemens, at first objected to it being published, but later changed her mind in 1960 when she believed that public opinion had grown more tolerant of the expression of such ideas. That was half a century before Fianna Fail and the Green Party imposed a new blasphemy law on the people of Ireland.

5. Tom Lehrer, The Vatican Rag, 1963: “Get in line in that processional, step into that small confessional. There, the guy who’s got religion’ll tell you if your sin’s original. If it is, try playing it safer, drink the wine and chew the wafer. Two, four, six, eight, time to transubstantiate!”

6. Randy Newman, God’s Song, 1972: “And the Lord said: I burn down your cities – how blind you must be. I take from you your children, and you say how blessed are we. You all must be crazy to put your faith in me. That’s why I love mankind.”

7. James Kirkup, The Love That Dares to Speak its Name, 1976: “While they prepared the tomb I kept guard over him. His mother and the Magdalen had gone to fetch clean linen to shroud his nakedness. I was alone with him… I laid my lips around the tip of that great cock, the instrument of our salvation, our eternal joy. The shaft, still throbbed, anointed with death’s final ejaculation.” This extract is from a poem that led to the last successful blasphemy prosecution in Britain, when Denis Lemon was given a suspended prison sentence after he published it in the now-defunct magazine Gay News. In 2002, a public reading of the poem, on the steps of St. Martin-in-the-Fields church in Trafalgar Square, failed to lead to any prosecution. In 2008, the British Parliament abolished the common law offences of blasphemy and blasphemous libel.

8. Matthias, son of Deuteronomy of Gath, in Monty Python’s Life of Brian, 1979: “Look, I had a lovely supper, and all I said to my wife was that piece of halibut was good enough for Jehovah.”

9. Rev Ian Paisley MEP to the Pope in the European Parliament, 1988: “I denounce you as the Antichrist.” Paisley’s website describes the Antichrist as being “a liar, the true son of the father of lies, the original liar from the beginning… he will imitate Christ, a diabolical imitation, Satan transformed into an angel of light, which will deceive the world.”

10. Conor Cruise O’Brien, 1989: “In the last century the Arab thinker Jamal al-Afghani wrote: ‘Every Muslim is sick and his only remedy is in the Koran.’ Unfortunately the sickness gets worse the more the remedy is taken.”

11. Frank Zappa, 1989: “If you want to get together in any exclusive situation and have people love you, fine – but to hang all this desperate sociology on the idea of The Cloud-Guy who has The Big Book, who knows if you’ve been bad or good – and cares about any of it – to hang it all on that, folks, is the chimpanzee part of the brain working.”

12. Salman Rushdie, 1990: “The idea of the sacred is quite simply one of the most conservative notions in any culture, because it seeks to turn other ideas – uncertainty, progress, change – into crimes.” In 1989, Ayatollah Khomeini of Iran issued a fatwa ordering Muslims to kill Rushdie because of blasphemous passages in Rushdie’s novel The Satanic Verses.

13. Bjork, 1995: “I do not believe in religion, but if I had to choose one it would be Buddhism. It seems more livable, closer to men… I’ve been reading about reincarnation, and the Buddhists say we come back as animals and they refer to them as lesser beings. Well, animals aren’t lesser beings, they’re just like us. So I say fuck the Buddhists.”

14. Amanda Donohoe on her role in the Ken Russell movie Lair of the White Worm, 1995: “Spitting on Christ was a great deal of fun. I can’t embrace a male god who has persecuted female sexuality throughout the ages, and that persecution still goes on today all over the world.”

15. George Carlin, 1999: “Religion easily has the greatest bullshit story ever told. Think about it. Religion has actually convinced people that there’s an invisible man living in the sky who watches everything you do, every minute of every day. And the invisible man has a special list of ten things he does not want you to do. And if you do any of these ten things, he has a special place, full of fire and smoke and burning and torture and anguish, where he will send you to live and suffer and burn and choke and scream and cry forever and ever ’til the end of time! But He loves you. He loves you, and He needs money! He always needs money! He’s all-powerful, all-perfect, all-knowing, and all-wise, somehow just can’t handle money! Religion takes in billions of dollars, they pay no taxes, and they always need a little more. Now, talk about a good bullshit story. Holy Shit!”

16. Paul Woodfull as Ding Dong Denny O’Reilly, The Ballad of Jaysus Christ, 2000: “He said me ma’s a virgin and sure no one disagreed, Cause they knew a lad who walks on water’s handy with his feet… Jaysus oh Jaysus, as cool as bleedin’ ice, With all the scrubbers in Israel he could not be enticed, Jaysus oh Jaysus, it’s funny you never rode, Cause it’s you I do be shoutin’ for each time I shoot me load.”

17. Jesus Christ, in Jerry Springer The Opera, 2003: “Actually, I’m a bit gay.” In 2005, the Christian Institute tried to bring a prosecution against the BBC for screening Jerry Springer the Opera, but the UK courts refused to issue a summons.

18. Tim Minchin, Ten-foot Cock and a Few Hundred Virgins, 2005: “So you’re gonna live in paradise, With a ten-foot cock and a few hundred virgins, So you’re gonna sacrifice your life, For a shot at the greener grass, And when the Lord comes down with his shiny rod of judgment, He’s gonna kick my heathen ass.”

19. Richard Dawkins in The God Delusion, 2006: “The God of the Old Testament is arguably the most unpleasant character in all fiction: jealous and proud of it; a petty, unjust, unforgiving control-freak; a vindictive, bloodthirsty ethnic cleanser; a misogynistic, homophobic, racist, infanticidal, genocidal, filicidal, pestilential, megalomaniacal, sadomasochistic, capriciously malevolent bully.” In 2007 Turkish publisher Erol Karaaslan was charged with the crime of insulting believers for publishing a Turkish translation of The God Delusion. He was acquitted in 2008, but another charge was brought in 2009. Karaaslan told the court that “it is a right to criticise religions and beliefs as part of the freedom of thought and expression.”

20. Pope Benedict XVI quoting a 14th century Byzantine emperor, 2006: “Show me just what Muhammad brought that was new and there you will find things only evil and inhuman, such as his command to spread by the sword the faith he preached.” This statement has already led to both outrage and condemnation of the outrage. The Organisation of the Islamic Conference, the world’s largest Muslim body, said it was a “character assassination of the prophet Muhammad”. The Malaysian Prime Minister said that “the Pope must not take lightly the spread of outrage that has been created.” Pakistan’s foreign Ministry spokesperson said that “anyone who describes Islam as a religion as intolerant encourages violence”. The European Commission said that “reactions which are disproportionate and which are tantamount to rejecting freedom of speech are unacceptable.”

21. Christopher Hitchens in God is not Great, 2007: “There is some question as to whether Islam is a separate religion at all… Islam when examined is not much more than a rather obvious and ill-arranged set of plagiarisms, helping itself from earlier books and traditions as occasion appeared to require… It makes immense claims for itself, invokes prostrate submission or ‘surrender’ as a maxim to its adherents, and demands deference and respect from nonbelievers into the bargain. There is nothing-absolutely nothing-in its teachings that can even begin to justify such arrogance and presumption.”

22. PZ Myers, on the Roman Catholic communion host, 2008: “You would not believe how many people are writing to me, insisting that these horrible little crackers (they look like flattened bits of styrofoam) are literally pieces of their god, and that this omnipotent being who created the universe can actually be seriously harmed by some third-rate liberal intellectual at a third-rate university… However, inspired by an old woodcut of Jews stabbing the host, I thought of a simple, quick thing to do: I pierced it with a rusty nail (I hope Jesus’s tetanus shots are up to date). And then I simply threw it in the trash, followed by the classic, decorative items of trash cans everywhere, old coffeegrounds and a banana peel.”

23. Ian O’Doherty, 2009: “(If defamation of religion was illegal) it would be a crime for me to say that the notion of transubstantiation is so ridiculous that even a small child should be able to see the insanity and utter physical impossibility of a piece of bread and some wine somehow taking on corporeal form. It would be a crime for me to say that Islam is a backward desert superstition that has no place in modern, enlightened Europe and it would be a crime to point out that Jewish settlers in Israel who believe they have a God given right to take the land are, frankly, mad. All the above assertions will, no doubt, offend someone or other.”

24. Cardinal Cormac Murphy-O’Connor, 2009: “Whether a person is atheist or any other, there is in fact in my view something not totally human if they leave out the transcendent… we call it God… I think that if you leave that out you are not fully human.” Because atheism is not a religion, the Irish blasphemy law does not protect atheists from abusive and insulting statements about their fundamental beliefs. While atheists are not seeking such protection, we include the statement here to point out that it is discriminatory that this law does not hold all citizens equal.

25. Dermot Ahern, Irish Minister for Justice, introducing his blasphemy law at an Oireachtas Justice Committee meeting, 2009, and referring to comments made about him personally: “They are blasphemous.” Deputy Pat Rabbitte replied: “Given the Minister’s self-image, it could very well be that we are blaspheming,” and Minister Ahern replied: “Deputy Rabbitte says that I am close to the baby Jesus, I am so pure.” So here we have an Irish Justice Minister joking about himself being blasphemed, at a parliamentary Justice Committee discussing his own blasphemy law, that could make his own jokes illegal.

Finally, as a bonus, Micheal Martin, Irish Minister for Foreign Affairs, opposing attempts by Islamic States to make defamation of religion a crime at UN level, 2009: “We believe that the concept of defamation of religion is not consistent with the promotion and protection of human rights. It can be used to justify arbitrary limitations on, or the denial of, freedom of expression. Indeed, Ireland considers that freedom of expression is a key and inherent element in the manifestation of freedom of thought and conscience and as such is complementary to freedom of religion or belief.” Just months after Minister Martin made this comment, his colleague Dermot Ahern introduced Ireland’s new blasphemy law.

The folks at Pauldotcom posted this pic….it was too good not to share.

To turn off the PC speaker drop to a terminal and execute the following commands to regain your sanity and turn off that “BEEP”.

Open a terminal

sudo nano /etc/modprobe.d/blacklist

add the following to the end of the file on a new line:

blacklist pcspkr