« first day (1564 days earlier)   

1:03 AM
It's been a wierd day. Just been sat with JJ and Baz and the guys from the stranglers and the rezillos. Top blokes!
 
 
7 hours later…
8:11 AM
I found @RоryMcCune's spirit animal.
@RoryAlsop that message yesterday was surreal.
I just joined this site, but I understand it better than the moderators AND the whole community! you're wrong about whats ontopic!
Also, I dismiss your claim about me being dismissive.
Brilliant.
 
8:33 AM
@RoryAlsop lucky lucky lucky lucky !
@AviD s/bad/awesome/
 
heh, figured you'd enjoy them
got some new ones?
 
@AviD yeah I don't think I'd heard all of those before
 
you guys should be penpals
 
@AviD penpals... this is a hipster thing right, probably use quill pens too :op
 
hah
 
8:39 AM
@AviD Is that a new startup from SV?
 
lol omigawd that would actually probably work
 
Sounds like @AviD is writing some Javascript tonight!
 
lawl
 
@AviD yeah artisan curated penpal community
 
"small batch" artisan curated penpal community
 
8:42 AM
Like Tinder, but for penpals?
 
heh, this hurts mah braain
hey @RоryMcCune, you happen to plan on visiting here this week? OWASP chapter meeting is gonna have 200 people...
 
@AviD ..ya know weirdly enough, I haven't got any international travel plans for this week :op
congrats on the numbers for the meeting though :)
 
ta :-)
I do have to admit, I dont think any of the talks this time are crazy interesting, but there you have it...
- Collateral DDoS
- Transcending From Digital to Physical
- Shell over what ?! Naughty CDN manipulations
 
@AviD CDN one could be fun..
 
@RоryMcCune yeah thats the only one I'm looking forward to
 
8:51 AM
and the DDoS one might be interesting if it's covering some of the Baidu/github style DDoS which is fairly topical at the moment
 
though the physical hacking one might be mildly amusing.
@RоryMcCune I think so, but to me its still "meh"
 
@AviD yeah there was a talk at the last conf. I went to that was basically pictures/stories of a guy getting into all sorts of high security establishments that he shouldn't have been able to
was quite amusing
 
dont get me wrong, I think the talks will go over well. obviously there is enough people coming to hear them... I just personally dont find those the draw.
@RоryMcCune lemme guess, Ira Winkler? ;-)
 
GitHub is holding up pretty well against the DDoS. Pretty impressive stuff.
 
@TerryChia youre pretty impressive stuff.
 
8:53 AM
@AviD no actually, a guy who goes by the name of freaky clown
 
@AviD Stop being a #simon.
 
@RоryMcCune oh! I've heard of him.
didnt he used to work with you?
@TerryChia hey now, @Simon got that from me.
 
@__Freakyclown__, England
Geek, Nerd, Hacker, lockpicker, and founder of the Surrey and Hampshire Hackspace. My tweets and website are my own views and not that of my employer.
15.1k tweets, 2.4k followers, following 1.6k users
 
well, not the creepy part.
 
@AviD Poor @Simon.
 
8:54 AM
@AviD no he's a Portcullis type...
@AviD works with @poly
 
@RоryMcCune oh so maybe it was @Poly that worked with him
 
@AviD yarr
 
@RоryMcCune yeah, that
@RоryMcCune dont you mean "yarp"?
 
@AviD no, I was going for the pirate sobriquet
 
9:23 AM
quite possibly, the only thing worse than trying to read a contract, is to slog through an NDA.
Same amount of legalese, same level of idiot talk corpspeak, just that it has so much less to say, in the same amount of pages.
 
@AviD you keep stuff we tell you secret, we'll keep stuff you tell us secret... Done!
 
@RоryMcCune right?
 
@AviD yeah and they manage usually to string that out to pages and pages
 
if you reeeeheeelly wanna be a li'l bitch about it, mention penalties or jurisdiction.
@RоryMcCune exactly.
also, why are they ever different?
 
@RоryMcCune Sure, how else are the lawyers supposed to pay for those expensive school fees?
 
9:28 AM
with contracts, I could poooosbily understand that it needs to be tailored for each situation. (It doesnt. Thats lawyer bullshit.) But NDAs should be 100% standard.
 
@AviD different lawyers! Amusingly in the UK pentest scene you can see docs that have been "inspired" by other ones quite heavily
'cause they're mostly the same you can easily re-purpose them
 
@RоryMcCune "repurpose" aka "copy/paste"
okay, like opensource licenses are pretty standard - sure, you have a halfdozen variants, mostly to account for the FOSS cancer, and some for specfiic meta-organizations (e.g. apache). but THATS IT. Choose one of those, end of story.
why are NDAs not the goddamn same??
 
@AviD ooh open source licenses, they can get pretty contentious about that choice...
@AviD Lawyers!
 
fine, but a programmer does not need to read and reread and check with a lawyer EVERY SINGLE TIME he uses an opensource package.
 
@RоryMcCune "free software"
 
9:32 AM
aww hell I think Imma make an anonymous twitter account to just like post all my NDA clients SUPER SECRET INFORMATION
no, a tumblr, so other people can post to it too
@NDA_Violations, just registered
 
@AviD Oooh, hipster!
 
@TerryChia right?
 
@AviD wait. THATS WHAT I HAVE BEEN DOING WRONG!
 
@RоryMcCune the worst part is that some of those lawyers do try to sneak in really vicious language, even things that have nothing to do with NDA. so you really do have to read every last line.
like that one that tried sneaking in control of any IP I have.
so adorable
 
@AviD yeah I had a couple of contract "surprises" when I was freelance, luckily I'm paranoid to read everything first
 
9:36 AM
I think my contract has that. :p
 
@JourneymanGeek in an employment contract, that is plenty evil enough. However, in a freelancing / vendor contract - its just plain ridiculous.
 
(Tho, its more to keep artists from freelancing. Which happens anyway)
Ahh. Then ya
 
@JourneymanGeek doesnt matter. Its a total lack of respect towards the employees, treating them as interchangable cogs instead of people who are paid to brain all day.
why the hell is there a statement about exporting from the U.S. and complying with the Department of Commerce??
 
now I'm looking for the line about farm animals and biological experiements.
 
9:41 AM
Copy pasted contract?
And they owning your immortal soul or what remains .
 
@JourneymanGeek no, "Corporate Standard".
seriously, just reinforces my opinion not to be an employee at that type of place anymore. Makes me glad I'm not.
 
@AviD Hipster startups are just much better aren't they?
 
@TerryChia actually I'm looking for a neckbeard startup.
 
@AviD I think that would be the FSF. ;)
 
I cant distort my brain to fit with VC / SV / hipster groupthink.
@TerryChia ha! okay not that neckbeardy.
yknow, sensible people.
 
9:45 AM
@AviD Richard Stallman?
 
@TerryChia hahaha! nice.
seriously though, I am looking for one that is sensible, and avoiding SV style startups.
 
Morning all
 
unfortunately many of the ones here also are trying to emulate the SV crap.
@RoryAlsop is it? IS IT??
 
@RoryAlsop Watcha
 
@JourneymanGeek oh hey. I just realized, that U.S. export stuff might apply to me anyway - online storage and whatnot.
not to mention possible eventual travel with docs on my laptop....
 
9:48 AM
@AviD s/online/cloud
 
@TerryChia damn, I keep getting the hipster buzzwords wrong
oddly, that is also the corpspeak buzzwords.
 
10:17 AM
@AviD @RоryMcCune Perhaps you can help, I seem to remember a Windows utility you can install for right click -> view checksum of any files. Any ideas?
 
uhh
isnt that built in?
pretty sure its built in
 
@AviD I don't see it.
 
no not built in
funny, thought I had that
it was a tab on the properties page, with all different hashes
havent needed it in a while
 
@AviD Something similar, yes. IIRC I had to install something for it.
Oooh, I think I found it: code.kliu.org/hashcheck
 
@TerryChia There's a powershell cmdlet for that now as well :)
 
10:25 AM
@RоryMcCune oh yeah, I think thats what i used last time I needed it
then again, there's a powershell cmdlet for just about anything
 
@AviD BTW did you see what wget works in Powershell now, as they just aliased it to the relevant cmdlet
 
Get-MoreCoffee
@RоryMcCune heh cool
 
Feels like it. I got 2 hours sleep. Had a few issues last night
I usually need double that
 
@RoryAlsop are you pulling a @Lucas?
;-)
 
He's not my type
:-)
Cash card got eaten by machine. Car got locked in car park. Had to take kids snowboarding today
This morning was a nightmare
 
10:35 AM
ouch
doesnt sound like a good start to the day
 
That said, I was sat drinking with the stranglers for 3 hours. Awesome
 
its days like that that you say, screw it all, and get back into bed with a bottle of vodka.
 
And the rezillos
 
@RoryAlsop how did the car get stuck?
 
And we managed to blag a guest pass for the head of Metropolis records through the stranglers bassist, as he had been left off the guest list by accident. Very surreal
 
10:36 AM
that is very cool
 
@RоryMcCune - mostly through me not realising the car park shuts earlier on a Saturday and opens later on a Sunday
It does say it on the sign, but I failed to notice it
 
@RoryAlsop ahh not a 24-hour one.. I see , yeah some car parks are weird like that. if it's a pay/display unmanned job you think they'd just leave it open 24/7
 
And no late trains or buses. And when I phoned Claire, she had already had cider
 
@RoryAlsop ugh
 
Luckily blagged a lift back with a guy from the show
 
10:39 AM
@RoryAlsop I take it you didn't try to repeat the linlithgow experiment?
@RoryAlsop nice
 
Lol - no
I definitely owe Chris a nice whisky
 
@RoryAlsop yarr, very handy that, being stranded in glasgow less fun
 
As he went miles out of his way
I was almost resigned to getting an hotel room
 
@RoryAlsop would've been an expensive end to the night!
 
I did ask at the Malmaison, as that's where the afterparty was. If they has any free rooms I probably would have gone for it
 
10:58 AM
@RоryMcCune I take back what I said about reading MNDA documents. Now I'm digging through several thousand pages of IBM documentation, dem lawyers have got a lot to learn.
though it all seems mostly not helpful, almost zero information about security is available.
except for one example, about how to use debugging logs to track when somebody is trying to break the security. Of course, this is a language for client-side applications, running in the scope of the user's client. So those logs are especially trustworthy, especially in the case of a malicious user.
 
@AviD I think what you need is a "support contract" :)
How else is IBM supposed to make money?
 
@TerryChia how about, by NOT making crap products and inventing proprietary programming languages with zero benefit over what existed a decade ago?
 
@AviD Sure, and pigs can fly.
 
true. Nobody got mocked for buying into IBM's koolaid.
Is that how that saying goes?
 
@RoryAlsop that's why I always have a sleepingbag and pillow in my car :P just in case I get stuck somewhere
 
11:09 AM
@AviD they tried that. Then they sold it all to lenovo
who somehow fucked it up
 
@AviD zOS rocks though
its sexy as fuuuuuck
 
@JourneymanGeek that was just the military grade laptops, not their software lines
@LucasKauffman dont know about it being sexy, but definitely better than it's predecessors
 
unfortunately I doubt they would be able to ship to the UK
 
it's their dev tools especially that are a premium level of suck.
@RоryMcCune hahaha
could probably attach that to the top of a guitar, right?
 
@LucasKauffman said no-one.... EVAR
@AviD well yeah, or use it to clear a path through the crowd...
 
11:21 AM
> Why not both?
@RоryMcCune oo @RoryAlsop you can even order it in bright orange!!
 
> eliminating weeds between pavement cracks
Wut
 
@AviD yea IBM charges shitloads for every piece of program they make and some of it doesnt do much more than hello world
 
and yet entire enterprise systems are built on that framework
 
@AviD I wish I had a business like that
and then I could hold money fights
where you throw money at eachother
 
Hey guys! Brand new Linux zero-day privilege escalation!
How to get a root shell on Ubuntu 11-14 (haven't tested earlier) $ sudo bash # Prerequisite: some user requirements, and the password.
 
11:27 AM
@LucasKauffman like the wolf of wall street?
 
@AviD Yeah. but everybody wins an Oscar.
 
Id rather a more modest success that actually DOES SOMETHING GOOD IN THE WORLD
 
@AviD You could join the FSF.
 
@TerryChia no, I said DO something GOOD.
I'm... not sure which part you misunderstood.
heh. FINALLY some information about 4GL that actually makes some sense
> First, sit on a banana, then you roll over and eat fried chicken(while rolling) then jump up and kill the walrus of the 4th demonsion, then the gods of hot sauce and hairy chinese food will present to you the procedures to exucute those files.
Now I just have to find that damn walrus again.
 
12:27 PM
OK, I need to consult with you fellows.
well, some of you.
so its like this - since I cannot find any actual security information for Informix-4GL, such as secure coding and etc, I'm trying to figure out what possible issues could possibly be an issue for insecure coding.
taking into consideration that 4GL is designed for the client part of client/server systems; the 4GL connects directly to a specific database; connection details are in the ODBC connection (not in code) and code only constrains to the specific connection; user authentication, authorization, etc is implemented in the database itself, not in the 4GL; and of course users run the app on their client and connect directly to the database.
aside from possible confused deputy type attacks, and framework-level bugs - what else could possibly be in play here?
there is no direct memory management; direct access to the db precludes SQLi type attacks; etc etc.
any thoughts?
@RоryMcCune this is right up your alley.
 
1:16 PM
nothing?
Imma write a nasty meta post about how people dont answer my obscure question within minutes over the weekend.
thats how we're supposed to do this, right? I'm not up on all the hipster mannerisms yet.
 
1
Q: Distribution of Ones in a Psuedorandom Sequence

William HirdLet S be a string in the set (0,1) produced by taking the AND of the output of two maximal length linear feedback shift registers of large period (say 128 bits). It's easy to see from the truth table of the AND gate that you will end up with a string consisting of (approximately) 75% zeroes and 2...

not about security, but about RNG
I think a few of the regulars here can answer this one
 
@AviD s/meta/Medium
 
@TerryChia heh, but I was referring more to the likes of this:
-6
Q: what does it take to get an answer?

CodeMedSo far I have posted 4 questions on this site. The first three questions all received +1. I interpret this to mean that my questions are acceptable and do not violate any site rules. But yet none of my questions on this site have yet been answered. I am starting to wonder if I should just s...

 
1:32 PM
Is a question about whether a specific setup (say, Windows Firewall) is/isn't vulnerable to specific things (say, a non-admin user account trying to get around it) on-topic here?
the setup I have in mind is a little more complicated than that....I just want to check before I write a whole big question :)
 
@Shokhet: Sounds more superusery to be honest
 
What I'm trying to do is take a group of computers and make them completely incapable of Internet access, but for security reasons, which is why I thought of this exchange.
 
@Shokhet Erm, wouldn't it be simpler not to connect them to the Internet..?
 
@TerryChia :) ...I'm working with a bunch of other people, and some of them have broken the rule in the past...the higher ups have decided that company machines should have their web access completely disabled.
 
@Shokhet Borderline. What kind of expertise are you after? If you want to reach experts in configuration file syntax, SU. If you want to reach experts in policies (e.g. does this provide adequate logging), Sec.SE.
 
1:40 PM
@Shokhet: we did that at work ;p
(I think we use firewall rules and vlan tagging tho)
 
@JourneymanGeek Oh really? I thought our we were the only ones to try this :)
 
@Shokhet: we have different reasons tho
 
@Gilles So I think I know how to do it, but I was asked for my opinion on if it would work... I don't see any way to break my colleague's system, but I thought I'd ask the real experts.
@JourneymanGeek Oh really? What happened by you guys?
 
@AviD So if most of the security decisions happen server-side then there would seem to be a limit to concerns in the client code. It would partially depend on the level of trust placed on the client computing environment, but things like sensitive data written to client-side logs, or code opening up exposures like TCP ports (unlikely) or registered hooks to other programs that could be abused (perhaps more possible) could still be relevant
 
@RоryMcCune oo of course, any kind of client side data - logs, caching, etc
the others are probably part of confused deputy
and of course there are design issues
@RоryMcCune thanks
 
1:47 PM
@AviD Just like your face.
 
@AviD indeed. the Roscoe P Coltrane of bugs :)
 
I guess its not much different from e.g. VB client that connects straight to the DB, I just need to try and remember the 90's now...
@RоryMcCune hehe
 
@AviD yeah it is a bit of an old-school set-up but I'm guessing still very common in corps
 
@RоryMcCune unfortunately so
 
@AviD the other one to watch for would be if they try to artificially add restrictions in the client (e.g. DB permissions aren't fine grained enough so they try to restrict stuff in the client, which is obv. bypassable)
 
1:49 PM
@RоryMcCune thats a good point, I was starting to think about that - insecurity by fake security
 
Thick clients with just a DB server-side always make me jumpy as DBs aren't always the most granular of targets...
 
@RоryMcCune absolutely
 
@Shokhet: Oh, clients insist on it
Cutting off internet is easy. We have internet access, but only though a terminal server
 
@JourneymanGeek Interesting.
 
the idea is we can download but not upload stuff easily (and piss off a lot of users in the process)
 
1:57 PM
I see.
 
'Just' cutting off internet is easy ;p
Doing it at the system level is dumb tho
You'd want to do it at a network wide level (either by not connecting to the network at all, or use your firewall to block access to various segments)
 
That's true for desktops. Our machines are laptops, which people take home (and to "really secure" internet cafes!) to finish up different things after hours...my coworker thinks that the system level is better for that, because our problem is actually people connecting to other networks.
 
yeah.... nope. not gonna happen. way too easy to bypass, if they wanted to - and I am assuming these are programmers, who are at least mildly technical.
 
Most are at least mildly technical :)
 
you are much better off if you learn to actually trust your people, or get people that you CAN trust.
 
2:04 PM
Yeah, but atm we gotta work with what we have.
 
@Shokhet ah, so not JS / PHP coders, eh? ;-)
@Shokhet right, exactly. realize that if they want to get around your roadblocks, they will, and just be more pissed off for it.
mind you, I am far from corporate mainstream mindset on this.
which is why I dont work for corporate, I only fight them about it.
 
@AviD There's nothing that can be done about that? ...my friend tells me that the BIOS can be locked....I don't see a way around that.
@AviD I don't particularly care about mainstream, I care about what works :)
 
@Shokhet sure. but lock what?
prevent the ethernet port from working?
I mean, yeah, if thats what you want to do, it can be done. But that seems counterproductive.
 
His plan (I thought I mentioned this earlier, but perhaps not) was to set up an admin account with Windows Firewall, and allow no connections. Give the user a regular account, and then lock the BIOS so the boot device can't be changed.
Would that work?
 
@Shokhet so basically the machine cannot connect to ANY network?
how is possible to get any work done?
 
2:09 PM
@AviD Yes.
 
how is code shared / versioncontrolled / uploaded / etc?
1 min ago, by AviD
I mean, yeah, if thats what you want to do, it can be done. But that seems counterproductive.
 
@AviD USB drives of course. :)
 
@AviD I don't make the decisions....that's what they want.
 
@TerryChia dont be ridiculous. It gets printed out and then retyped on the mainframe.
 
I mean, so far it seems to work
@AviD Precisely :)
 
2:10 PM
@Shokhet okay I get that, but how do THEY want it to work?
@Shokhet wait, seriously?
 
@AviD No, joking :)
 
whew :-)
so seriously, if the laptops cannot connect to any network, how in 2015 do they actually do any work?
 
This isn't a company; it's a school that wants their students to be able to type notes on their laptops, but not have web access....basically, computers as glorified typewriters.
 
@Shokhet okay, but still.... how is that expected to work in 2015?
 
@AviD A yeshiva student doesn't really need the web, does he? ...most yeshivos don't have computers at all, as far as I'm aware.
 
2:18 PM
lets say, hypothetically, that this makes sense.
if these machines are owned by the school, and intended only for this use, I would say they should get machines with no wifi hardware (otherwise shut it off in the bios); cut the wire for the ethernet port (or even fill it with cement) - some BIOSes will let you shut it off at that level too. Basically shut off the hardware, and protect the BIOS with a STRONG, UNIQUE system password. Intel's vPro may help here.
@Shokhet ahhh okay
so why computers at all?
@Shokhet and, FTR, I disagree with that statement, strongly
 
@AviD It's a lot easier and neater to type notes, besides for other things a computer can do, like hold shiurim etc.
@AviD Which, the first or the second?
 
@Shokhet the implied from the first - they they dont have use for the web
gtg
 
@AviD I didn't say I agreed either -- but it is what it is.
@AviD Thanks for your help!
 
2:31 PM
I gotta go now, also...thanks for your help, everyone!
 
2:42 PM
@Shokhet: get laptops without ethernet ports, remove the wifi cards ;p
 
2:56 PM
@JourneymanGeek heh. I said the opposite, but I guess nowadays your way is more common...
 
yup
and if its a mini pci-e card, pretty trivial
 
This is interesting, especially after my rant at lawyers this morning... Just saw this: OWASP Secure Software Contract Annex /cc @RоryMcCune
 
3:28 PM
@AviD *Americans would use
 
who else drinks beer from a can?
 
and in related stuff lattice.cf/index.html <-- sounds right up @AviD / @TerryChia 's respective streets
Tagline: "Resilient sub-structure for your microservice"
 
@RоryMcCune I... what? Don't even.
 
@AviD hey hey no falling behind here, microservices are in (you wouldn't want to be running a stinky monolith would you?) and so you need a containerized substructre for them, right!
 
umm
nevermind, I'll get one of my kids to explain it to me
 
3:40 PM
@AviD the horrifying thing is, some people would probably say that and mean it!
"Monolith" is the latest insult to hurl at a codebase
 
and I would have no idea what they think they mean
 
micro-services are the answer to monoliths
 
@RоryMcCune I thought the omniscient Dave was the answer to monoliths.
 
@AviD heh
one example of many posts on the subject engineering.groupon.com/2013/misc/…
 
@RоryMcCune whut. "I" tier? i.e. "infinite tiers"?
 
 
2 hours later…
5:37 PM
@RоryMcCune that is awesome!
 
 
4 hours later…
9:13 PM
@RoryAlsop speaking of awesome BTW, if you were a fan of Baldurs gate and similar games, Pillars of Eternity it reaaaally good
 

« first day (1564 days earlier)