The DMZ

6:19 AM

@DavidFreitag nice

Let's start a betting pool on the name of the soon-to-be released Xen vuln.

6:35 AM

@TerryChia what options have you come up with so far?

@RoryAlsop Dunno. I'm not exactly good at naming stuff. :P

@TerryChia See - I'd like it to be called Fro-Xen, then it could have a theme song as well...

4

that kids know

@RoryAlsop Purrrrfect.

swiftonsecurity.tumblr.com/post/98675308034/…

7:14 AM

Shellshock

securityreactions.tumblr.com/post/98750025317/shellshock

@Iszi heh

@RoryAlsop I'm starting to wonder if we should really bother with that Shellshock post I made. Seems I'm the only one maintaining it, (granted I've only given it one update) and that's not at all the intent.

@Iszi If it was on meta I could add the 'featured' tag and it would get highlighted.

I might get time at lunch to trawl through the shellshock tag to see what could be merged in

It's gotten a fair number of votes, and I guess a moderate view count. It's just that nobody seems interested in adding to the answer.

...and it's way past bedtime. G'night.

7:29 AM

@Iszi night

8:12 AM

@Iszi is the goal to have all affected products or just OSs?

@RоryMcCune Products might be a never ending list...

Reason I ask is that there's a good list on Oracles site of affected products which I could go find again, but it's more appliance style stuff

@TerryChia well yeah but if I'm worried about whether I'm at risk it's relevant...

8:48 AM

hmm, where should i go if i have a question thats more like: "this is my setup, i have these things enabled, is this secure? and how could it be done better?" things, concerning a windows server? o.o

@Lighty use a SCAP for baselining

@LucasKauffman a-wut?

@Lighty scap.nist.gov

you can baseline against STIGs from the DoD

they're pretty strict and cover the most crucial things

@LucasKauffman So much consultant buzzwords. ;)

EY has trained you well.

@TerryChia Well you need to keep a helicopter perspective of things. It's important to keep driving synergy. Soon we will be able to put that into the cloud and perform Big and Fast Data analytics on it. That will cause our pipeline to fill even more than before and allow us to obtain market leadership.

2

8:59 AM

eh, it would more be for a hobby server at home... like, i run a server that has a minecraft application, teamviewer, remotedesktop and such running PUBICLY on ze interwebz, i use this and this and these firewall rules, what can i do to help fuel my paranoia more?" blablabla

@Lighty oh yea DISA isn't made for that, it's made to make things secure, not a hotpot of backdoors

@LucasKauffman well, i have my modem firewall really tight, and windows firewall blocks EVERYTHING except browser, java (MC), remote desktop, windows updates and Teamviewer

and the only ports open are the ports needed for the server

@Lighty question, why are you using teamviewer?

there's also RDP you know

which is 100000 x faster than Teamviewer

because of the drag n drop FTP-like function, and as backup (whitelisted to certain ID's), because the Remote Desktop is scoped to 2 IP's (one local IP, and my freinds home IP)

10:14 AM

sethbling.com/minecraft2

someone made minecraft in Excel

@Lighty someone has too much time on their hands!

@Lighty Still a better runtime than Java.

Yes, yes I'm joking.

@TerryChia as someone who had mroe then enough experience with MC/Java not doing what it should do, yes xD

Excel VBA is turing-complete right?

@TerryChia eh?

10:22 AM

153

Q: What is Turing Complete?

What does the expression "Turing Complete" mean? Can you give a simple explanation, without going into too many theoretical details?

@TerryChia ooohhh

yea, Excel VBA is really powerfull if you know how to use it right

from a simple overview to a complete "flat" database with buttons, functions and such

cool toys

Q: How to perform SQL injection in edit profile page?

10:33 AM

0

If I leave the edit profile vulnerable to SQL Injection, How can I inject SQL commands to show all the data from my database? Imagine that the address field is vulnerable in Edit Profile page.

sql-injection databases validation vulnerability

i dont really get what hes asking

maybe im still sleeping, i dunno

that guy has alot of good questions, but also bad ones, i like him, he likes to learn it seems

@Lighty he seems (to me) to be asking a generic question about extracting data from a vulnerable UPDATE SQL query

it's not really possible to answer without knowing things like "does the page return verbose errors"

yea, i was really confused with that he meant the profile edit page on SE xD

thats why i posted it here, i had no idea what it meant

@Lighty I don't think he means that, but as you say his wording ain't the best.

better then mine :P

11:16 AM

@Lighty *than

i wonder

if people comment on your question/awnser or whatever on this site

and they reply with a www.lmgtfy.com link/joke

is that being a d!ck? o.o

@Lighty generally considered so, yes

2

Adnan

12:14 PM

Most boring security gathering. Ever.

So far, I haven't seen a Finn with good presentation skills

Arperum

@Adnan But have you seen a presentation about knives or hate yet? These might be better. </stereotype>

@Adnan Do they have beer?

@Adnan guess they didn't hire strippers this year

CodesInChaos

@RоryMcCune Four Horsemen of the Infocalypse

@CodesInChaos nice, I'd not heard that term before but it fits well!

Q: Python 2 and 3 compatible method to convert bytes to integer

1:01 PM

0

I have a byte string similar to the following. foo = b"\x00\xff" I want to convert foo each hex value into an integer. I can use the following in Python 3. In [0]: foo[0] Out[0]: 0 In [1]: foo[1] Out[1]: 255 Python 2 requires an ord() call. In [0]: ord(foo[0]) Out[0]: 0 In [1]: ord(f...

python python-3.x python-2.x

Answers welcomed. :)

1:21 PM

@RоryMcCune I think products are relevant. I know I saw something about F5 appliances. Been meaning to look that up and add it in. What I did for Cisco was to just put a link to their all-in-one status page. I imagine most other appliance vendors will have similar.

hm, is there a rule that covers the subject of poeple being too lazy to google? i.e., the question they ask can be found in the first page of a google/bing/yahoo/whatever search?

Arperum

@Lighty "Simple answer and free rep"