3 ms·

As cool as this looks, not sure how this is any easier to use than a simple Python or Ruby script (or even Bash, if that's more your thing). EDIT: In lieu of

by jnbiche 10y ago

As cool as this looks, not sure how this is any easier to use than a simple Python or Ruby script (or even Bash, if that's more your thing). EDIT: In lieu of downvoting, would someone like to explain their disagreement? I'm curious. Perhaps this would open up certain programming powers up to non-coders, but for anyone who knows how to code, it seems much easier to just write a script to make these kinds of transformations.

Leftium 10y ago
I made a field visit to an MSSP[1] and they used a tool just like this (although not nearly as complete). Most security analysts don't know how to code. Even if they do know how to code, it's faster to take advantage of a nice interface that's already been made. The security analysts need to consider data from thousands of different alerts on a daily basis. There is definitely room for automation, but I think there will always be some need for human judgement and manual analysis (which tools like this will greatly expedite). [1]: https://www.wikiwand.com/en/Managed_security_service https://www.wikiwand.com/en/Managed_security_service
strictnein 10y ago
Making all of these available and chaining all of these together wouldn't be a simple script. It would be a humongous collection of different scripts.
- jnbiche 10y ago
  > Making all of these available and chaining all of these together wouldn't be a simple script. All transformations are readily available in the standard library of a language like Python or Ruby. And note that this CyberChef tool doesn't chain them together either. The user does that. Likewise with a Python or Ruby script. I guess I can see how this would be useful if you don't know how to code, but I don't know anyone who would be able to use a tool like this who doesn't know how to code. Also, I can see how this would be useful in the same way that a web app like jsfiddle is useful, to make a quick example to share with others. In any case, I clearly wrong, since I've been so highly downvoted.
  - fastball 10y ago
    Even if you know how to code, this would still be faster for lots of use cases...
    - jnbiche 10y ago
      Are you comfortable using a scripting language like Python, Ruby, or Bash, and a shortcut-driven text editor like Vim or eMacs? Perhaps because I'm skilled at Vim, using Python and Vim is unquestionably quicker for me than using a mouse to drag/paste/click a bunch of boxes around for any imaginable use case. I suppose if you're used to using mouse-driven programming environments like Windows often is used, this might be quicker...
jxy 10y ago
I got -4 just for stating the same opinion, and found out your comment at the end of this page. Since everything is really text here, the typical UNIX way of doing things seems to be much more practical in dealing text transformations here. I second your `Bash' opinion. I could imagine a package populate your PATH as PATH=DataFormat:EncryptionEncoding:PublicKey:… and simply put nice little binaries, each of which does one thing and one thing only, and you can use them like, cat FILE | toBase64 | entropy A nice interface of such thing in Haskell or APL would really shine. I bet GCHQ must have a much nicer internal library (which runs at a fraction of their machines' peak FLOPS) in one of their favorite languages that they can script and launch multiple tries by pushing a few buttons on their keyboard. And of course they are not sharing that. Alas, point-and-click lovers seem to be the majority here on HN.
- bbcbasic 10y ago
  -4, that's a bit harsh. :-o

by jnbiche 10y ago

Leftium 10y ago

I made a field visit to an MSSP[1] and they used a tool just like this (although not nearly as complete). Most security analysts don't know how to code. Even if they do know how to code, it's faster to take advantage of a nice interface that's already been made. The security analysts need to consider data from thousands of different alerts on a daily basis. There is definitely room for automation, but I think there will always be some need for human judgement and manual analysis (which tools like this will greatly expedite). [1]: https://www.wikiwand.com/en/Managed_security_service https://www.wikiwand.com/en/Managed_security_service

strictnein 10y ago

Making all of these available and chaining all of these together wouldn't be a simple script. It would be a humongous collection of different scripts.

jnbiche 10y ago
> Making all of these available and chaining all of these together wouldn't be a simple script. All transformations are readily available in the standard library of a language like Python or Ruby. And note that this CyberChef tool doesn't chain them together either. The user does that. Likewise with a Python or Ruby script. I guess I can see how this would be useful if you don't know how to code, but I don't know anyone who would be able to use a tool like this who doesn't know how to code. Also, I can see how this would be useful in the same way that a web app like jsfiddle is useful, to make a quick example to share with others. In any case, I clearly wrong, since I've been so highly downvoted.
- fastball 10y ago
  Even if you know how to code, this would still be faster for lots of use cases...
  - jnbiche 10y ago
    Are you comfortable using a scripting language like Python, Ruby, or Bash, and a shortcut-driven text editor like Vim or eMacs? Perhaps because I'm skilled at Vim, using Python and Vim is unquestionably quicker for me than using a mouse to drag/paste/click a bunch of boxes around for any imaginable use case. I suppose if you're used to using mouse-driven programming environments like Windows often is used, this might be quicker...

jxy 10y ago

I got -4 just for stating the same opinion, and found out your comment at the end of this page. Since everything is really text here, the typical UNIX way of doing things seems to be much more practical in dealing text transformations here. I second your `Bash' opinion. I could imagine a package populate your PATH as PATH=DataFormat:EncryptionEncoding:PublicKey:… and simply put nice little binaries, each of which does one thing and one thing only, and you can use them like, cat FILE | toBase64 | entropy A nice interface of such thing in Haskell or APL would really shine. I bet GCHQ must have a much nicer internal library (which runs at a fraction of their machines' peak FLOPS) in one of their favorite languages that they can script and launch multiple tries by pushing a few buttons on their keyboard. And of course they are not sharing that. Alas, point-and-click lovers seem to be the majority here on HN.

bbcbasic 10y ago
-4, that's a bit harsh. :-o