heyyoooo party people

sooo too many beers on an empty stomach, whilst meeting your new boss, is probably not the best idea I've had recently.

then again writing about it in a prublic place such as this, is probably not so much either.

w0000t

did I miss anything this week?

@AviD Everything.

give me examples. Be specific.

@AviD You missed this:

@FEichinger no, I got the email for that.

I'm thinking of being just active enough so I can convince them to change it to community.se.

@AviD Shuddupwedontneedthisnameargumentallthetime.

@ScottPack I just had a reeelllyy nice beer - pacbrewlab.com/beers/squid-ink

kinda like a stout, if it was an IPA.

@AviD Just generally mocking you about your new Apple-love. ;)

Can we get a supervillain.stackexchange site going?

@Simon

@TerryChia I have NO idea what you're talking about.

So we go into the Hipster store, pick out a shiny new toy. Walk out to the car, get in. I say "Sooo am I hipster now?"

3 minutes later: "I think we need to rewrite the whole system in Rust."

So we're doing that now.

@AviD HIPSTER!

heh. no, not really.

I'm considered the windows freak there.

@avid (cat sitting on me causes short replies :op)

and yeah, I did find a windows only bug the first week. was... surprising.

@r

@AviD hipster devs don't do debugging :op

@RоryMcCune oh yeeeaaahh babay, I know what that's like ;-P

@AviD what are they writing it in then?

@RоryMcCune heh, not really rust

actually not that hipstery

I guessed that might be a bit extreme, even for a start-up..

@RоryMcCune "Move fast, break things" ;)

mostly java, there is a temporary internal app temporarily in node.js, probably wind up in .net, some other stuff going on

@AviD s/there/everywhere

@AviD I guess these days Java is a fairly safe choice, although slightly painful to write in..

ha

@AviD What client-side Javascript MVC framework are you learning this week?

heh, nope

yeah, you don't get to mock me anymore. My job is awesome.

@AviD Nope. The mocking ain't gonna stop.

@AviD so you're getting a surface pro 3 as your company PC right?

well, at least not mock me about work. Feel free to mock me on other topics.

@RоryMcCune ooohh I should have asked for that.

@AviD Oh no, mocking your D is just mean.

@TerryChia would also make NO sense.

@AviD oh schoolboy error, they're actually out in the US too :op

HAHA ITS SO BIIIG

@AviD Maybe you should write a new client-side Javascript MVC framework. Name it TiggerJS.

@TerryChia nice. and its bouncy.

@AviD You message editing fogey.

hheh

interesting starting to see some cheapish windows 8 tablets coming along.

Just ordered an 8" tablet only £82...

hey @deed02392 hows the job going?

you still CTF'ing?

wired.com/2014/07/usb-security <-- now that's potentially interesting...

@RоryMcCune looks like a fantastic opportunity to make some serious bucks by starting a KickStarter project to make an active USB IO adapter that prevents writing to certain interrupts unless you press some button or something like that

Maybe @DavidFreitag could design it and we help him write microcode for it

@TildalWave definitely some scope for some kind of USB drive with non-rewritable firmware as well, hell I'd buy one :)

@RоryMcCune I was thinking of some simple pass-through IO adapter that blocks writing to certain interrupts. With a fancy red and green LEDs and a big pink "I don't care" button so it appeals to people like @kalina :))

@TildalWave yeah if that could work it would be a pretty cool idea "USB Condom (tm)" stops you getting infected

@RоryMcCune hehehe

if you tell us which uni I'm sure someone will be glad to demonstrate exactly how much their sense of security is worth :)

@TildalWave So this is bad enough advice that I should report it up the chain of IS to someone in their security team?

@StrongBad well I guess it depend on how much you care, just don't get yourself in trouble

@TildalWave You mean, in trouble with the university powers that be?

@FaheemMitha I meant with the ones you were in contact before, but I don't know how sensitive they might or might not be to others suggesting they could do their work better :shrug:

@TildalWave Oh, right, whoever made the suggestion.

I think @StrongBad is looking to find out whether (a) this is really as stupid a suggestion as it sounds and (b) what his choices/options are. Though I don't presume to speak for him.

Yup, I'd just avoid mentioning that previous suggestion and simply bring to their attention the same issue again. They might still not do anything about it and say it's simply because they have to have services up and running 24/7 but don't have personnel to retype the password each time the service needs to reboot, i.e. lack of funding. That's in my experience quite common excuse at universities, I wouldn't be too surprised if I heard it again.

@FaheemMitha I want to know both of those things, but also if it is as stupid as it sounds, I really think the person should be corrected.

@StrongBad Agreed. People like that are dangerous.

@TildalWave Yes, uni IT depts tend to get short thrift.

They think it is something they can save money on.

@RоryMcCune really well thanks @RоryMcCune :) yeah still doing it but less so now, got actual work to do now :O

@deed02392 coolio :) they got you helping out on tests already.. good stuff

@RоryMcCune It's a research demo for a BBC journalist, I'm demo'ing my research project I only started last week so quite a bit to do - need to find an exploit yet!

Well, found a vuln actually but I need to script it

@DavidFreitag I haven't watched it yet, I'll try to do that tonight.

@deed02392 shiney! hitting the big times early

woo! it was handy cos I'd already done a bit of reverse engineering on it for the pure fun of it before I came here.

@deed02392 Are you going to hack TOR? ;)

haha no @TerryChia

@deed02392 Pffft! What are they paying you for then! Get on it man!

Holy shit! rackspace.com/blog/…

Free Rackspace hosting for a year.

@TerryChia nice find

@deed02392 It's on HN. :P

doesn't Amazon do free EC2 instances as long as you don't use it too much?

@deed02392 For a year as well I think, but this looks much more comprehensive.

ah I see, I thought it was open ended.

but anything free is good!

Plus I'm a huge fan of Rackspace. They are a huge sponsor of the project I'm contributing to and they hire a lot of Python guys.

Is it a VPS?

I've heard of them but don't know much about them

from this article they seem like a good bunch

@Simon You can spin up load balancers, cloud servers whatever.

Cool. I'm lacking a lot of knowledge about those things so it would be a great thing to be playing with.

Never configured anything else than simple LAMP servers.

Also, I need an infrastructure to push my Python project :D

@Simon Just use Heroku for the time being?

@TerryChia Unfortunately, Heroku doesn't support sqlite.

I probably should migrate to postgresql anyway though.

@Simon Use a real database...?

Lawl, yeah.

If you are using an ORM it shouldn't be difficult.

Yes I am.

I guess that is now at the top of my to-do list.

@TildalWave I'm game.

@Simon It was fantastic

@DavidFreitag fuck me now that's a bouncy castle!

@TildalWave That was only the last half hour of a 72 hours event. SO. MANY. FIREWORKS.

besty party eva

@RоryMcCune hey I said hello to Colin for you, he was pleased to hear about you and yes he remembers you well :)

@TildalWave I'd prefer an "I don't care" button to be purple with a smiley face on it

purple is much better than pink

@deed02392 heh coolio :) glad he doesn't just remember me as member of staff at $annoying_customer1 ('cause they really were an annoying company for suppliers :)

@kalina watcha' you've not been about for a bit.. been off working on ......

?

@Simon Either (a) use something cloudy (heroku, google app engine, etc.) or for local deployment you're prolly best off with nginx/fastcgi or apache+fcgid

@RоryMcCune Maybe that's why he remembers you well. ;)

Also TIL Puerto Rico at 30C/86F is decidedly hotter than Phoenix at 45C/115F

"Dry heat" means something

@TerryChia well I did try to make it less painful for the testing companies where I could!

session keys should be stored hashed, right?

@tylerl Duh...

@kalina we do need a lead designer :)

@kalina The PCB will likely be a nice dark purple, if that counts for anything.

@bamboon Not generally. Why?

(And my session key, I'm assuming you're referring to the session id that identifies a specific session.)

@Xander was reading it here stackoverflow.com/a/477578/893693 part II, last paragraph. Now however, I found out that django doesn't do that so I am confused.

yes, I do.

@bamboon Ah, so, he's not talking about a session id, but a persistent (long-lived) authentication token. Session Ids are by definition short-lived...They're only good for the duration of a session. (General convention is that they use a 20 minute sliding expiration, reset on each request, YMMV for any specific application.)

@bamboon A persistent authentication token can be presented at any time to an application in order to create an authenticated session (or request) in the exact same way credentials can be used to create an authenticated session, and so is very different from an existing session id which allows for only a very limited reuse window.

@bamboon They're more along the lines of Google's application specific passwords that you have to use for applications that don't support two-factor auth, once you've turned two-factor auth on for your Google account.

@tylerl I'll check that out, thanks.

@Xander Ah, thanks for the detailed explanation. However, isn't his point still valid? Once an attacker got hold of the database he can still impersonate all the users and refresh the session key even though he only has a window of X Minutes.

@bamboon Session ids are rarely ever stored in a database. Usually they're in-memory only. If they are stored in a database, (which is indeed sometimes done in web farm environments) it should be a separate database from the rest of the application data. Additionally, while there is some risk if they're stolen, because of the short time-frame in which they're valid, the risk is low, and not really worth the performance or complexity trade-off.

Hmm, to me webfarm is > 1 node. Is a simple md5sum really that much overhead?

@RоryMcCune oh you know... stuff

@bamboon You lose the ability to use the value as a lookup key, which is what session IDs are. So you need an ADDITIONAL token beyond just the session id.

@kalina E:D Beta?

@tylerl Maybe there is a misunderstanding here, lookup then simply is md5(session_id)?

@bamboon Yes, there probably is a misunderstanding, since you're question dosent' seem to make sense to me

^^

@tylerl which one specifically?

@bamboon what exactly are you trying to accomplish?

@tylerl I am wondering why session keys shouldn't be stored hashed as otherwise an attacker can impersonate users after stealing the database. To me it is explained here security.stackexchange.com/a/63438/44150 quite well but now I saw that django doesn't do it and that's why I am confused. Xander now said that it's not worth the extra effort.

@bamboon Typically sessions are short-lived enough that defending them against server-side attacks isn't worth the effort. Sessions disappear typically expire after a number of minutes or hours, so an attacker typically won't target them if he already has access to your entire server.

you defend sessions in client-side attacks like firesheep because that's a different sort of attack story.

I prefer storing (fast) hashes of session ids, reset tokens, etc.

@tylerl ok, that argument makes sense to me. So yes, if he already has write access he can skip the session ids.

@RоryMcCune cc @deed02392 - is that The Colin who used to work at $annoying_customer1?

@RоryMcCune no games, no time

@kalina I need to practice my dogfighting, but no time...

@bamboon No, it isn't that much overhead, but there's so little risk, that it doesn't generally offset. And even in webfarms, you rarely use a database to store sessions...That's just one option that you might choose if you have a webfarm.

I can just imagine @kalina swooping round an asteroid and blasting me into little pieces

In memory state servers are usually a better option than a SQL database.

time and time again

@Xander Yeah, but by that you mean something like memcached or redis, right, and not like in http-server server memory?

@bamboon Yup. Exactly.

@bamboon Ideally, from the webserver's perspective, there is no list of session IDs to steal. Instead, the server has a GET/PUT interface with no insight into what's actually present.

@tylerl @bamboon ^ - This.

400 helpful flags

#yolo

@Simon You have 400 helpful flags?

@Xander I have 400 helpful flags.

@tylerl you mean that your cache shouldn't have an API to list all its elements?

@Simon Nice! Congrats.

Thank you. I'll try to get the gold badge.

finding that I forgot to delete tripwires configuration file after finishing setting it up panics

Huehuehue. I love catching eBay screw-ups.

@RoryAlsop @RоryMcCune vaguely sounds like it, Colin alluded their relationship was one of a customer-supplier type

@RoryAlsop @deed02392 nooo this is the colin who was the relationship manager for one of the pen testing suppliers to $annoying_customer1 and had the delights of the vagaries of dealing with their managers...

Ah. Yes. That Colin.

@Simon