Dec 31, 2049 23:59:59 for you old Clipper 5.x guru’s out there. But the site above shows how to put a sliding epoch in place that can let your legacy live on for a few more years.

Talking about the end of their calendar is like talking about the end of a crystal lattice. It draws upon concepts that are outside the reference frame of the question; it is complete nonsense.

Incidentally, one way of fixing the ntp and Unix epoch problems listed in a relatively permanent way, would be to craft a computer standard using a cyclic definition of time similar to the Mayan one (or most other traditional societies…), acknowledging that things naturally cycle back to zero eventually. A negative 38 year, 15 day mortgage would (if we kept the basis the same) accrue the same interest as a 30 year mortgage, because in such a system, that is the same interval of time.

1. Using it as a “shocking” display to stakeholders who may not understand the real world impact of vulnerabilities on their organization. By “showing” them with a Pen test (and in a positive way, you don’t want to beat them over the head with the results) you can start to gather buy-in for your overall InfoSec program.

2. To test IDS/Incident Response procedures. When you have tools designed to detect the bad guys getting in and respond to that event, a test goes a long way in understanding where the weaknesses lie in your detection/response plans.

Thanks for the post.

First is that developers are not pentesters and usually shouldn’t be. mostly because they look as the problem as an problem with a single application and not how all those issues fit together as its related to your network security posture and for protection of your critical assets/data/or IP.

Second, you’ve described perfectly what should go on during a vulnerability assessment and application (source) review and not a pentest.

we need to get away from “pentests” that attempt to find every possible vulnerability, those are vulnerability assessments or if you want to justify your existence vulnerability assessments with exploitation or vulnerability assessment with source code audit and not pentests.

Its time for a pentest when you’ve done all the things you mentioned in your posts and you think your app is good to go & no one can break it or into it. Or more importantly you think you can catch the attacker once he’s in your network and one 0day doesnt ruin your whole day.

Your find every vulnerability pentest can be / should be/ and rapidly is being replaced by a monkey with a scanner or an appliance in a rack.

see chris nickerson for the rest of the rant…