The DMZ

12:00 AM

I have a feeling their social media marketing guy is going to be sooooo fired on Monday.

I sent a complaint to their email, but I have a feeling it'll end up being processed by the same guy manning Twitter.

@Polynomial I'd hope so. that's incredibly unprofessional behaviour. There should be no way that fellow should be allowed to continue being the public communication channel for anything.

Polynomial

wow, some dude just asked 6 questions in a row.

Xander

@Polynomial LOL. Just marveling at the same thing.

@Polynomial And his mildly paranoid questions slightly resemble those of our earlier former eastern-block visitor.

@Polynomial Can you clarify your comment? What isn't true?

Polynomial

12:17 AM

I'm posting an answer.

Scott Pack

@TildalWave I just had a glass of chardonnay with dinner.

Xander

@Polynomial Ok, thanks.

@pl

@Polynomial Ah, ok. So I was talking about an entirely different mechanism than what you describe...What I have on my laptop. vxlabs.com/2012/12/22/…

Polynomial

Ah, yes, that's different. It's hardware full-disk crypto.

Xander

12:33 AM

@Polynomial Yeah, exposed the same way though. As a disk password after the BIOS password.

Polynomial

yup

at work I have to type 4 different passwords before I even get into the OS.

BIOS boot, DriveLock, full-disk crypto, OS password

it's getting silly trying to remember them all :P

Xander

@Polynomial LOL!

Polynomial

add all the wiki, svn, VPN, webservice, server, etc. passwords I need to know... it's hurting my head!

any idea why this got a -1?

-1

Q: Privacy issues with keyservers

When you retrieve someone's information from a keyserver to add him to your pgp keyring, is that made through SSL or is the connection encrypted? Do keyservers keep logs of who adds whom to their keyrings? What information is made public?

Xander

@Polynomial Tell me about it. I'd be lost without KeyPass. I have a section just for work - related credentials, and subsections for client site credentials....

Polynomial

I get that it maybe can't be answered w.r.t. what's logged, but the rest is fine.

@Xander same. I have to remember the stuff for booting and stuff, but the rest goes in KeePass with a ridiculously long passphrase

Xander

12:42 AM

@Polynomial Nope. Seems as reasonalbe as the rest of his questions.

Polynomial

wow, only 883 rep short of 30k now :)

Rory Alsop

That won't last long :-)

@poly - re that key server question, guessing it is because of multiple questions so have suggested they are split out

Polynomial

@RoryAlsop yeah, I guess that makes sense.

Polynomial

1:35 AM

lolwat

AudioMicro's twitter feed is ran by their director of operations.

Terry Chia

2:06 AM

@Adnan That can be easily misinterpreted.

Scott Pack

Well sure. Director of Operations/Chief Operating Office/Head of Marketing/Chief Maintenance Office/Head of PR/Spouse of Owner

Lucas Kauffman

9:09 AM

@ScottPack I had that with a few guys that left the company and started one themselves, they all became head of something without having anyone beneath them

Rory Alsop

9:50 AM

Think I was CEO, Director and CISO at my last one. Oh, and music coordinator:)

Polynomial

10:40 AM

my house-mate is playing jazz at 10am on a Saturday

this is odd.

IT'S A NEW DAWN, IT'S A NEW DAY, IT'S A NEW LIFE!

Rory McCune

@polynomial and you feel good?

Polynomial

I was about to suffix it with ".... and I'm hung over as fuuuuuuuuuuuuck!"

Rory McCune

Cant really see nina simone singing that line...

Polynomial

10:56 AM

who did the really famous male version of that?

not the crappy Michael Buble one, the one that sounds a bit like Bill Withers

TildalWave

11:07 AM

Muse? Morning!

Polynomial

nah

like proper old black guy at the piano style jazz

TildalWave

Sammy Davis junior?

Polynomial

Nah

think this kind of quality voice, except more powerful: youtube.com/watch?v=tIdIqbv7SPo

TildalWave

still searching but cheers for the Bill Withers ... nice morning coffee song

It's definitely a guy on piano? Because Coltrane also had that song, but that's saxophone.

Polynomial

nah, he's not on a piano I don't think, he just sings

not coltrane though

it's been used on a few adverts

TildalWave

11:21 AM

Bobby Darin? But he's not black... hmmmm

Terry Chia

@TildalWave That's racist. :P

TildalWave

lol

►

for the picture :)

TildalWave

11:37 AM

@makerofthings7 Can I ask you to continue the conversation about that iframe/xss here or if you make a new chat? It's gathering too many comments and not all of them are necessarily needed to explain what OP was asking. You can contact me also via email that can be found on my webpage under contacts. Cheers!

@Polynomial Vocal only with no instruments support? Could be Gregory Porter, tho I'm not sure how that would work in commercials youtube.com/watch?v=YG60-0mA9Gg

Polynomial

@TildalWave nah, it's not greg. his voice is too clear. this guy had that kinda husky voice.

TildalWave

ok so... "feeling good" song, proper old, black male singer, smoker's voice, jazz (blues?) version,... band or big band? there's also some Broadway style version but that's probably not it?

TildalWave

12:01 PM

@Polynomial Damn there's 100,000 versions, most of them pretty good... I think it might be easier if you could remember one of the adverts you heard it in.

Not "proper old" (CD says 2009) but great vocal... dunno why I didn't think of it before cuz I have this CD lol... sounds like a version that could be used in commercials too: Joe Bonamassa (from The Ballad of John Henry)

►

@Polynomial he has a bit of husky voice when he's hitting high notes... is this the one you were thinking of?

Adnan

12:17 PM

@Polynomial Any Folk Metal band you'd recommend?

Polynomial

@TildalWave nope, not ol' Joe.

@Adnan Folk metal? Er... Eluveitie is probably my favourite.

Inis Mona and Calling The Rain are two of their best tracks

saw them live when they supported DevilDriver, they were epic. Did a two minute bagpipe vs. flute battle in the middle of one of their tracks.

Adnan

@Polynomial Jesus!! Inis Mona is very epic!

Polynomial

yup

Adnan

Thanks, now I have some stash for this week

Polynomial

they all learnt a dead language so they could be more authentic

so they have songs written in Gaulish

Adnan

12:28 PM

@Polynomial Get out of here!

Polynomial

@Adnan yup. they're proper into getting it right.

between all of them they can play 14 different instruments.

some of which I've never even heard of

Adnan

@Polynomial Well, you got those recommendations bang on (did I use it correctly?). Calling The Rain is also very good.

Polynomial

@Adnan if you're into silly stuff, check out Alestorm

they did a cover of You Are A Pirate from Lazytown, which is hilarious

Adnan

@Polynomial Either you, or somebody else, shared that video a while ago

Polynomial

►

DO WHAT YOU WANT BECAUSE A PIRATE IS FREE

all of their stuff is pretty silly.

►

MAKE THAT BASTARD WALK THE PLANK WITH A BOTTLE OF RUM AND A YOHOHO

*headbangs*

Adnan

12:35 PM

@Polynomial The lyrics might be a bit silly, but the music is really neat

Polynomial

it's exactly the kind of music that Scottish people would sing if they were actually pirates.

(speaking as a mostly-scot)

Adnan

Polynomial

haha

Adnan

I should grow my hair, but damn it's so difficult with curly hair.

Polynomial

I prefer this kind of headbanging: youtube.com/…

Adnan

12:39 PM

@Polynomial Do you have the hair for it?

Polynomial

of course.

Adnan

@Polynomial GOD DAMN IT!

Polynomial

both Rories can vouch for the glory of my hair ^^

Adnan

@Polynomial Familiar with Moonsorrow?

Polynomial

I will be in about 5 minutes.

haha, love the 80s screen blend effects on their videos

old analog chroma-key stuff

Adnan

12:43 PM

I recommend Sankarihauta and Jotunheim

Polynomial

not folk metal, but if you wanna hear one of the best damn metal track intros ever, listen to this...

►

Adnan

@Polynomial Most of their songs are pretty long, Jotunheim for example.

@Polynomial Once my current track is over.

Polynomial

every time I hear the intro on this track it makes the hairs on the back of my arms stand on end

shame the actual track is mediocre, because it's such an epic intro

good guitar work though

Adnan

@Polynomial Hmm.. then I'll pause the current one.. I don't do this very often

Polynomial

it's one of those tracks where it's so varied you're not quite sure where they're going with it, and the guitar work is amazing, but then they ruin the whole thing with one of the most over the top breakdowns ever.

Adnan

12:48 PM

@Polynomial It was worth it. 1 minute and 22 seconds .. fucking great!

Polynomial

:D

pissed I didn't get to see them live though. they were meant to support DevilDriver and Cannibal Corpse on a double-headliner gig a while back, but their drummer quit the band just before the tour and they got replaced with some random Italian band I didn't enjoy at all.

Adnan

@Polynomial are you going to Download?

Polynomial

nah, couldn't afford it with moving house to London

plus I tend to prefer the more intimate gigs in smaller venues, instead of barely being able to hear most of the acts.

Slipknot and Rage Against The Machine were the only two bands I really enjoyed at Download

Adnan

@Polynomial Same here with Nummirock

I wanna go for Wintersun and Ensiferum, but 108 euros is a not that cheap

Polynomial

Ensiferum are pretty good, but yeah I probably wouldn't pay 108 euros for that.

holy shit, this girl can growl

►

I think I'm in love.

Adnan

1:01 PM

@Polynomial Reminds me of Angela Gossow

Polynomial

yeah, similar.

never been a big Arch Enemy fan though

I love her hair too. It's like somewhere between Cradle of Filth and My Little Pony.

Adnan

@Polynomial After Image-Googling "alissa white-gluz", I understand why anyone would be in love with her.. damn!

Polynomial

yeah, er... drool

Adnan

Can't find the correct verb for googling with Google Image

Polynomial

heh

TildalWave

1:08 PM

hey @Adnan morning! :)

@Polynomial oh Ball.Ox I can't find it then lol

Adnan

1:44 PM

@TildalWave Morning morning!

Happy Easter, everybody!

2

TildalWave

Oh cheers! Yes indeed. Happy Easter to all! :)

Adnan

@TildalWave Since you're a family man, any ideas for the Sunday's breakfast?

@TildalWave I'm assuming you guys also have this Easter breakfast

TildalWave

@Adnan Well lent is by then over so you're allowed to eat meat IIRC starting Easter Sunday morning. The rest is then probably more local traditions probably, but we usually have eggs and ham.

Probably cobbler for desert

Adnan

@TildalWave I don't know what's that

TildalWave

I'll be going over to parents so I don't have to worry about that this year. My GF just posted a blog on one of our Orthodox/Christian Easters we had a few years back when they both fell on the same day... with a photo of how the table looked like. If you're interested, I have a link for that blog on my website.

@Adnan There's all kinds of recipes for cobblers, but this crockpot cobbler recipe seems fairly easy if it helps: busycooks.about.com/od/dessertrecipe1/r/crockcobbler.htm

cooking time... now that's another matter lol

Everything that we traditionally have for Easter takes a long time to prepare, so I'm really glad I don't have to do it this year. Mom probably started a few days ago, tho :)

Adnan

2:01 PM

@TildalWave Closest thing I can think of is piirakka, which can also be used as a normal meal with salad and meat.

TildalWave

@Adnan yes that looks quite similar actually

Adnan

It also can be made with berries, so yeah, that's probably it

@TildalWave Lucky you!

TildalWave

@Adnan This year yes :) Last year I was cooking nearly for a week before Easter tho

Oh,-- two times, for Orthodox and for Catholic dates, a week apart last year!!

I like cooking tho, so it's fun to try new things. A bit of a bummer if you don't get it right, but you can always get some old farts to help you out... problem is, how to later get rid of them :)))

Adnan

@TildalWave A week! Jesus! What were you cooking?

TildalWave

Well one of our traditions here is the Easter cake. That takes nearly a day to prepare. Then one day to get stuff from the local market, buy other stuff, put some things to dry, some to boil... I made wine leaf sarmale that are really tricky to roll with my thick fingers lol,... baked ham in bread, then the sauces, selection of drinks (tasting, of course lol)... nothing of it is fast to make

this is the cake... can have various fillings, but the dough is quite tricky to prepare

Oh and Easter eggs... some just colored, some with various decor on them, some hand painted,... but that's already the fun part and you do it with the help of others

Adnan

2:25 PM

@TildalWave Wow! Looks very tricky! I guess I'll just bake a basic fill-less cake.

@TildalWave Have fun at your mother's. If you stay alive after all that food, we'll see you.

TildalWave

@Adnan heh yeah thanks that's always the trickiest bit :))) You enjoy your holidays too! ;)

Lucas Kauffman

4:29 PM

1

Q: Secure erase iOS devices

All iOS devices from the iPhone 3GS have a hardware encryption chip, right? When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are deleted. However, the data is still present on the device in an encrypted state. Does this mean...

encryption forensics ios

military grade wiping algorithm

Scott Pack

5:41 PM

@TildalWave That looks pretty fantastic.

TildalWave

6:46 PM

@ScottPack Yes it's something I'm looking forward too, as we only get to eat these for Xmas and Easter usually, they're too difficult to make otherwise. The more usual ones for any other day are commonly just with raisins or even estragon and cottage cheese, my favorite. You're staying home for the holidays?

This is the type I like the most. Funny enough it's supposed to be a lot easier to make (so say my mom) but I know how to make the Easter one but always fail to make this one even close to how it's supposed to be. It always collapses for some reason.

Adnan

@TildalWave Ahh! Stop doing that! Those look amazing!

Also, anybody smells sockpuppeting in this question?

0

Q: secure website against the ping of death attacks

Any programmer is interested in securing his website. So I found this http://www.youtube.com/watch?v=DB4eMFrQYiY&feature=youtube_gdata_player which talks about crashing a website using cmd only. How to secure any website against this type of attak. Since anyone can do it which makes things h...

attacks

TildalWave

@Adnan you can find some comfort in the fact the latter never looks as amazing as on the photo if I'm making it :)

@Adnan LOL @ YouTube video at 2:16 :)))

Adnan

@TildalWave Yeah, I'm getting an orgasm just feeling his 1337ness.

TildalWave

@Adnan I'm still waiting for him to discover the -t flag :) or indeed how to copy/paste in the command prompt :))

Adnan

@TildalWave but I'm more interested in the fact that the question sucks and the accepted answer sucks on the same level. Both accounts were created today, about 30 minutes apart, and it happened that one of them answered the other's question.

TildalWave

6:58 PM

oh he found the -t flag

Adnan

Plus, the person benefiting from the rep (the answerer) has used his full name and linked to his blog, while the other is a nobody.

Looks like sockpuppeting, smells like sockpuppetting (eww), I say it is.

Rory Alsop

@Poly and @Adnan - alt fest next August - that's looking very interesting now.although not quite as heavy - is more industrial. And we might be playing, just negotiating now.

Adnan

@RoryAlsop Damn! It's all the way there in the UK, too far for me.

Plus visa stuff since UK isn't in the Schengen area.

TildalWave

Could be, hard to say... but the answer is just some generic crap, so I don't see it getting many upvotes. The question isn't upvoted either, so maybe they are indeed two different users.

Adnan

@TildalWave Well, you need 15 rep to upvote.

TildalWave

7:06 PM

@Adnan yup but the one with the accepted answer has 16 now and didn't upvote the question

Adnan

@TildalWave He probably tried before accepting the answer and wasn't able to upvote, then he still didn't figure out he's able to do so now that he has 16.

@RoryAlsop whaa whaa?! They're having KMFDM and Covenant at AltFest!! How much is the ticket? :D

TildalWave

7:35 PM

@Adnan I don't see any other correlation between these two accounts tho. OK, both on SO and Sec.SE only, but the other questions/answers from them are not linked. Tough to say really, I think it's best we don't speculate and just act on proven facts. Does smell like sockpuppeting, but I can't find proof for it.

Rory Alsop

8:02 PM

@adnan - there is a kick starter page open for a couple more days that gives excellent prices. Will be good fun. We're supporting KMFDM for the second time next month. They are a great bunch of guys. At their last Glasgow gig we managed to get them to carry our dancers on stage :)

@tildal and @adnan - different IP addresses, and nothing useful statistically to prove sockage. Remember you can always down vote answers if they are rubbish, and they can be deleted or changed to comments if relevant.

Adnan

@RoryAlsop Damn it! That sounds awesome! For a city in Finland, the scene here is utter garbage.

Rory Alsop

8:18 PM

In fact I think we have supported 6 of those headline acts :-)

Lucas Kauffman

8:33 PM

This answer:

38

Q: SQL injection that gets around mysql_real_escape_string()

Is there an SQL injection possibility even when using mysql_real_escape_string() function? Consider this sample situation. SQL is constructed in PHP like this: $login = mysql_real_escape_string(GetFromPost('login')); $password = mysql_real_escape_string(GetFromPost('password')); $sql = "SELECT...

php mysql sql security sql-injection

reminded me of this guy:

TildalWave

2

Lucas Kauffman

haha

right I should have a bottle of lachouffe here

somewhere...

TildalWave

@LucasKauffman I'm saving it for tomorrow ;)

Lucas Kauffman

I forgot I bought it

and noticed it this morning

TildalWave

@LucasKauffman That top answer there hurts my head! And it's still not solving anything. And the best answer is of course down at #3 and barely looked at. Was the first to actually suggest using prepared statements and sanitizing input parameters.

Lucas Kauffman

8:54 PM

@TildalWave the first also suggests prepared statements no?

TildalWave

@LucasKauffman yes, 4 months after #3 did

Lucas Kauffman

aha

TildalWave

@LucasKauffman sorry... 16 months after :)

Thomas Pornin

@TildalWave Building SQL statements in code is an inversion of semantics. It is inherently bad, wrong, and evil. There should be no need to discuss the subject any further.

3

TildalWave

@ThomasPornin yup, but tell that to most PHP programmers, not us here ;)

Lucas Kauffman

9:01 PM

Everytime you build a site using php, God kills a kitten

4

TildalWave

I demonstrated yesterday night to a mate of mine that's not tech savvy how easy it is to gain admin privileges on some generic PHP based website. I let him chose a site, and it took me less than it took him to finish his glass of beer.

Lucas Kauffman

TildalWave

Oh, needless to say they had all the purchases (it was some online shop), user credentials,... all of it non-encrypted in database, but that didn't even matter as I had complete CMS control with ability to inspect pretty much any record, or even shut down the site. I stopped at that, as we weren't after doing any harm,... OK, I removed my traces in their logs. Problem is, how to tell them without ending up being prosecuted?

It would probably take a few days to sanitize, but can cost them their business if left as is. This is true for most of the websites in my country.... it's like they have no clue there might be people with less than honest intentions out there.

For legal reasons, I should probably mention we were both drunk. And I have empty bottles of wine to prove that! :))

Lucas Kauffman

@TildalWave for legal reasons I'd delete all of that :P

TildalWave

@LucasKauffman yeah you're probably right lol

@LucasKauffman Ah never mind, it's OK. We didn't really do anything, I just mistyped my password LOL

@LucasKauffman Bastard nearly drank all my La Chouffe reserves, he needs to go to prison!! :))

But seriously, how do you tell administrators of such sites they're making it too easy and will eventually lead to CC info stolen?

Thomas Pornin

9:27 PM

@TildalWave If you already went to the trouble of hacking in, then erasing your tracks in the log files, you could just go the whole way and send them an anonymized email.

TildalWave

@ThomasPornin Yup I'll do that but not by going in again, no need for that. But I wouldn't mind making some dough out of it (legal ways, no funny business).

Thomas Pornin

@TildalWave Many sysadmins are prone to see such business proposals as blackmail attempts.

TildalWave

@ThomasPornin Yup. Problem with this ones (and I've seen such demos on other websites in the vicinity also) is they're risking it big time. One script kiddie and they're done. How to make them realize the threat?

BTW my mate was purchasing stuff at them, meaning his CC details are a very low hanging fruit on such sites also.

Lucas Kauffman

@TildalWave oh in that case, what was that site again ;D?

TildalWave

10:13 PM

OK mail sent. I'm such a good citizen :))

Transcript for