During incident handling, time is precious. I try to make myself take notes and communicate about the incident over logged channels like e-mail and IM - to the point that I think some team members have rules specifically for e-mail from me.

The detailed timelines that can be reconstructed from these notes are crucial when preparing post-mortem documents!

I have a simple philosophy: Fill what's empty. Empty what's full. Scratch where it itches Script the process wherever possible.

— Alice Roosevelt Longworth (and Grant Stavely)

Initially, I thought bash history could help.

# Bash settings
export HISTTIMEFORMAT="%s "
export HISTCONTROL=ignoredups
export HISTFILESIZE="9999999"

But what about the command output? There is a better way:

Firstly, and this is something that took getting used to, set up a fancy shell prompt to provide the log with context and time stamping:

--(grant@sensor)-(1/pts/1)-(17:32:33-UTC/28-Apr-08)--
--($:/nsm/)-

Gross! A two-line shell prompt! Trust me, it's useful.

Then just add to your shell start-up:

# start script to log everything now!
exec /usr/bin/script -f /nsm/var/handlerlog/$USER.shell_log.` date +'%Y-%m-%d:%H:%M:%S' `.$$

Script will then log everything that prints to the console with the prompt providing context.

@wardspan where are the cool kids?

RT @0xcharlie: Yeah! @dionthegod won the pwnie for best research. Congrats!

@jackwillk welcome, I am at the far side of the pool wishing I had my suit.

New school: The Verizon 2010 Data Breach Investigations Report: http://securityblog.verizonbusiness.com/2010/07/28/2010-dbir-released/

@charmsec I'll need you to set up the Skype telepresence rig you promised me. I look forward to catching up w/ those of you in LV this week!

Because @_defcon_ attendees are changing their profile pictures to network easier, I've found a video to augment mine: http://goo.gl/ATYN

@kathybarnett it's tough to cycle without going clipless. The real advantage though: Goofy shoes + Bunny-hops.

I'm clicking a cow. http://goo.gl/Wiad

"Hi, I hold ignorant and often illogical, divisive positions."

...

"refudiate—oops, refute/repudiate. *undo*"

LANGUAGE GAFFES! BURN HER!

One of our cats has a clear plastic cone-collar on 'til something clears up. Her reaction suggest like she's experiencing the 4th dimension.

I͈̮͕̼͓̗͚̎͗̊̈́ͤ̋t͍͉͎͇̫̥͍̿͒̔̊̏'s͖̻̩̙̮̘͇ Z̮̱̼̟̘̙̰ͪͭa̮̗̱͙̞̻͛̂ͅl͕̋́̽d̲̰̱ͯͅo͚ͮ͑ͨ͋̋̓ ̗̳͚̯ͫ̉͐̂ͫͨḁ͚̩̗̂̂̊ͨ̊g͚͚̘̜̦̲ͦ̊ͭ̇̚ͅa̝ͥ͂ͭ̍̿ȉ͈͆ͬ̃̌n̼͙͉͚̜̾͆ͯ̾̂.

Logged User-Agent strings differing from legit ones by typos or truncation are: a) Purloined letters b) Lazy c) Stupid d) What are logs?

@will_torres uh, hey Will?

Wanna see my bracket for the World Cup?

[

@bbaskin An expanded URL only claims to not be a 302. The web is a Skinner box: I just frantically click on everything underlined. Yay!

I accidentally bought a large-print _Evil_Eye_The_Origins_And_Practices_of_Superstition. And you know what that means. http://goo.gl/WmAk

@jackwillk getting back into home brewing is as easy as having an address to ask @MoreBeer_B3 to send ingredients to. Go for it!

I enjoyed @cshirky's Cognitive Surplus this week.

Where Carr seems to continue rediscovering Plato on media, Shirky finds opportunity.

"Memes!", H4cKe® said, kicking up his feet to pause from writing "show-us-your-tits" jokes on his black-background website. #pebkac

@jackwillk at least you acknowledge that your fear is irrational! http://goo.gl/2kZ0