Man M$ is really trying to get me on the Windows 10 bandwagon

@DavidFreitag well. The way I see it is you'll have to at some point.

I didn't do it for free

Windows 8 sucked so bad I bought windows 10

@RoryAlsop Win7forlyfe

@DavidFreitag 7 is definitely okay, but it has limitations I needed to overcome for my new gaming rig. Like total RAM accessible etc

bit of a showstopper, that one

@RoryAlsop What do you mean? I have 32GB of ram on my 7 machine...

Oh, that's because you bought home premium

I have 7 ultimate

yarr

@DavidFreitag I have to use Windows 7 on one of my machines. It's quaint. But not really in a good way. It was great in its day.

@Xander What is wrong with it?

I think it's funny that you describe 7 as "quaint"

@DavidFreitag Nothing really, other than looking out-dated. It also seems slow to me. 8 and 10 do perform better, but I don't know how much of the perceived slowness is just the hardware I have 7 running on now, and how much is the actual improvements.

@Xander I've never noticed a performance issue. I've had 7, 8, and 10 on my desktop and the performance on various tests were as near as makes no difference the same.

I detest the layout of 8 and 10. 7 was never perfect but it's way better than 8 and 10.

@DavidFreitag Bah. Give me 10 and multiple desktops any day. That was one thing Linux window managers had on Windows, until 10.

@Xander That may work for you, but it's a feature I'd never use.

@DavidFreitag just throw on classic shell or start QP

@JourneymanGeek I did that with 8, no thanks.

My big issue is how updates are opaque and mandatory.

morning DMZ

Morning

@DavidFreitag I do hate all the nonsense with tiles in the start menu and the way it tries to treat everything as a mobile app despite not being at all mobile

@RoryAlsop I can't stand it and that's why I'll never use it

and using classic shell to change it is just a hack

No thanks

But win 7 annoyed me as much, and win 8 was just hideous

XP was the last UI I liked

@RoryAlsop Something something dinosaur something something fossil.

"Back in my day, tablets were made of stone"

burn windows 10 alive

@RoryAlsop ditto

#Fogeys :op

:P

Gimme later DirectX and I'm going back to XP

@TildalWave and security patches/other security improvements?

if you're expecting security of Windows, you're doing it wrong

@TildalWave strawman, windows 10 has a good number of security improvements which help

erm, strawman back

whilst there is obviously no one panacea to rule out the desktop OS as a source of security improvements seems like a bad idea

you honestly disregard security of the client OS?

yes

so local access control sandboxing mandatory access control

throw them all away

chmod 777 * /

really

99% of the time it's PEBKAC not patches

exploit developers have to work much harder to bypass modern OS protections

you really want to make it easier for them

lower the bar of exploit development

that seems.... backwards

no, I don't care how difficult it would be for them because we're talking of a personal gaming rig

@TildalWave people's gaming rigs are also where they do home shopping/banking

in most cases

I'm not doing nor do I expect to be doing in the future anything serious on Windows

@TildalWave your moving the goalposts you said "If you're expecting security of Windows, you're doing it wrong"

@RоryMcCune phew, I do banking by proxy :P

implying that the whole OS security was irrelevant

whereas I'm very appreciative of the efforts that MS have made to improve things

at least they're trying

well yeah, I see your point, I said it bad ... I should have said "Gimme later DirectX and I'm going back to XP for my leisure station"

I simply hate UI of any Windoze OS since XP

cool, I have a bit of a bee in my bonnet about the "traditional IT" view of MS security :)

seems most effort went into making it easier to screw it up

heh I think that windows 8 was bad for desktops

and 10 kind of fixes things but still feels weird

but it doesn't get in my way too much

my main bugbear in 10 is the privacy stuff that they did a really bad job of explaining, making it easy to configure

they've kind of fixed that now, but still lame

for anything serious, it takes me about half an hour to install OS and about a week to set it up the way I like and/or need it... anything after XP made that significantly harder or even impossible while giving the impression of more control... In other words, I've never managed to make myself a setup that I'd be comfortable in since XP

oh shoot this isn't coming out right, where's that ovid quote

this will do :)

hi :)

hi @kalina

@RоryMcCune the only thing I dislike about Windows 10 is the UI. I do like the improved security

In fact I'm a huge convert, supporting MS's security activities, compared to my old, long ago view that Unix was bettererer

@RoryAlsop Wierdly, the only OS shell UIs I've hated is gnome 2 and OS X

And I've gotten somewhat used to the latter.

Gnome was sort of OK after much configuration. Much better than KDE

gnome 2 would not be consigned to the dungheap of history fast enough.

Heh. <3 KDE ;p

But it had too much baggage

(or lxde I suppose if you want lighter)

@RоryMcCune Yeah :( Fuck it

It makes it more challenging, though

But if I wanted less baggage, I'd use a purely cli system

I just find with Windows 10 I need to put shortcuts for everything on the desktop, as trying to use that application search box is stupidly hideous

lol

Yeah, there's that

tho I pin instead

Pin?

Pin stuff to the taskbar?

My wife uses Windows 10... I prefer to #Fogey it up

Oh, I try and avoid that. I just have browsers and office on the task bar

lol

I am just falling out of love with windows, period. 8 was bad, 10 is an abomination.

hm. I have firefox and steam pinned ;p

Back in my day, we had a better UI (win98/win2k default), and we had to walk backwards, downhill, in the sunny weather, to utilize buffer overflows. and back then, it was called an underflow because we didn't have enough bufferage to overflow it

Lol

@Saladin - piece of advice. Please don't ping people who have made it very obvious that your attention is unwelcome

@RоryMcCune Actually, come to think of it, not anymore... at least for mobile apps. The reason for this is all the apps that give every damn dev near-complete control of your entire phone. Facebook, Keyboard apps (free keylogger), etc.

@sal Coming into the room and focusing your first comment on the individual you have annoyed the most is not at all friendly

Back in my days there were pirate radios broadcasting latest ZX Spectrum games

@TildalWave Those still exist in Fallout 4, I think

and double-decker cassette recorders for ultimate piracy experience :)

LOL

and sneakernet

@MarkHulkalo s/mobile/android/ :)

@MarkHulkalo back in the day, tablets were made of stone. And we used to hack them out from the frigid bowels of the earth, while it rained lava, with our bare hands cause we were too poor to own chistles, and carried them in the hot sun, uphill, both ways, in the snow.

@RоryMcCune So iPhones don't have the same issue?

we are in talking format now. She talked to me.

@MarkHulkalo iPhones are a lot better, Android is just getting their permissions model in order, to where iOS and Windows Phone have been for a while + iOS app store authorisation process is Much more robust than google play

@TildalWave Sneakernet is still the fastest method of transporting large amounts of data.

you can tell by how much devs complain about it :)

we agreed to "talk" and it is working gladly

@RоryMcCune Yeah, I don't trust Android phones. Didn't realize iPhones were better in that regard...

@MarkHulkalo I've not heard of any untargeted malware in the iOS app store that lasted in there an appreciable amount of time. There's been the odd bit of spyware but it tends to get pulled quite quickly

I'm sure dedicated targeted attackers can bypass it, but general population of users doesn't need to worry about that

Yeah, neither OS is all that secure anyway

Yep, pretty much

@MarkHulkalo that's unlikely to change ... funny enough, I've seen some interesting proposals for interplanetary sneakernets LOL

You spend enough time reverse-engineering something, you'll find an issue. My favorite is parts where a compiler deliberately optimizes out buffer/stack protection

@TildalWave if we do matter FTL and not information FTL.... it would be essential, and is a thrope in a lot of sci fi ;p

@JourneymanGeek you can't do matter FTL without information FTL tho

Well, if we can do FTL, we can make FTL internet

Because we can have drones FTL'ing across the universe and sending signals, then FTL'ing out of there

there's at the very least information about the state of matter that you'd want to preserve

@TildalWave That essentially what a FTL sneakernet would be.

@TildalWave depends on the nature of FTL - you might end up wrapping space around a craft to send it, or each 'way' you travel through a wormhole may be one way or...

aka spooky action at a distance

quantum entanglement?

basically yes

Where is kalina? I miss kalina.

me 2

hey @AviD have you read contrastsecurity.com/owasp-benchmark

Wow, minecraft is currently using... 24.28GB of ram.

@DavidFreitag That's a lot. even for modded minecraft norms.

@Arperum It's FTB Infinity unlimited

@DavidFreitag Sounds like a pack made to munch resources...

@Arperum Pretty sure it's a memory leak

@DavidFreitag No shit.

Half of the mods probably have a couple memory leaks each. ANd you have a shitton of them.

@Arperum Well there's a difference between memory intensive mod packs and memory leaks...

@DavidFreitag Your pack will probably be both.

based on the name.

I did not look it up.

anyway, back afk, mowing the lawn.

@MarkHulkalo are you serious, it's called sleep

@kalina: "Sleep?" TELL ME MORE? Is this a replacement for caffeine?

@kalina Clearly you are a Synth.

WTB option to disable head bobbing in fallout

that's not really a security question tho, maybe Super User

there's a print_friendlist function in DHT_test.c of ToxCore ... and I imagine there's other APIs you could use

void print_friendlist(DHT *dht)
{
    uint32_t i, k;
    IP_Port p_ip;
    printf("_________________FRIENDS__________________________________\n");

    for (k = 0; k < dht->num_friends; k++) {
        printf("FRIEND %u\n", k);
        printf("ID: ");

        print_client_id(dht->friends_list[k].public_key);

        int friendok = DHT_getfriendip(dht, dht->friends_list[k].public_key, &p_ip);
        printf("\nIP: %s:%u (%d)", ip_ntoa(&p_ip.ip), ntohs(p_ip.port), friendok);

        printf("\nCLIENTS IN LIST:\n\n");

It gives you full syntax to retrieve IP and port out of Public ID

HAHAHHAHAHAHAHA SOMEONE IS USING A FOR LOOP WHAT A NEWWWWWWWWWWWWWBIE

what instead of a do while one? :P

CLEARLY THE ANSWER IS RECURSION HARHARHAR

I heard of an engineering manager who fired people for using for loops instead of recursion

And refused to hire anyone who used for loops

why?

seems silly

He might be a little special in the skull-socket?

ah right

I take it he uses a binary set for his booleans too?

Probably

I once used that,... kinda var b00l = set of [false, true]:))

just for kicks of course

Nice

oh no it's not nice at all but it does make newbs wonder how if b00l[1] { do(something) } does something LOL

HI

ello

hey there.....

m having A problem with my moto g gen3, i had performed hardware reset on the phone and now its asking for the previously synchronized mail id, and the problem is i dont remember the old 1, basically now i want to bypass the account logon screen. so that i can get acces to my phone.

Are questions on specific methods and their impact on security in Java on topic on the site? Specifically, someone told me about a possible HTTP response splitting attack when reusing HttpServletRequest#getQueryString()'s value in the Location header, but since it doesn't percent-decode the string I just don't see how (as opposed to getParameter(String) which does percent-decode the value).

@vabojuninho if it lets you skip that piece, just hit skip

if not - you may be out of luck

My ones certainly let you hit the Skip button

Obviously you won't get access to any data on the phone as it's all wiped

@DanielBeck that seems like it could be on topic

@TildalWave How would you not know? And that is definitely nice. :)

quick question: if I send traffic with a source IP address in the 192.168.x.x range (rfc1918 addresses), do routers filter it out? So it'll never arrive at the destination? (The destination IP is a normal, public IP address)

I would just test it but my NAT rewrites the source of course...

Do you mean you want the destination IP to see you as 192.168.x.x?

yes

Not possible unless you're on their network.

It's the same as IP spoofing. Can't do it.

I assume it's best practice to filter it out, but is it really common that ISPs or core internet routers filter that stuff?

That's just your internal address, so it only works internally

Your router sends and receives packets as your ISP-assigned IP

I understand I won't receive responses from the remote machine, just that the remote machine sees the source as being local

and IP spoofing is perfectly possible with UDP as far as I know

Yeah, but you aren't gonna get anything back

I understand that, but the only goal is that the remote machine sees the source as being local

Hmm

Does it have to respond?

no

question is if and how often public routers (like the ones from my ISP) filter RFC1918 source addresses out

Good question... I am not sure

But my assumption is that it would be filtered out. It would be incredibly moronic for it not to

However... huh...

Yeah but from what I've seen "moronic" does not begin to describe some sysadmins ;)

I'm pretty sure it would be caught by an ingress filter

Googling, I do find this on Wikipedia: "Less commonly, ISP edge routers drop such egress traffic from customers, which reduces the impact to the Internet of such misconfigured or malicious hosts on the customer's network." But there is no source or any other way to tell how often "less common" is

It's possible with UDP, but it would likely be caught by an ingress filter

it does say "Organizational edge routers are usually configured to drop ingress IP traffic for these networks" which makes sense for large businesses that took the money to pay people to properly think about this, but not for smaller or low-profit-margin businesses

On the flip side, you can change your IP address and connect/receive on some ISPs. But you'll likely need to stay on the same subnet. Still, the ISPs will detect that.

Because most ISPs require your device to be registered on their network before allowing access

hmm I'm not sure I understand what you mean

You could go to your TCP/IP settings and change them to what they are now

But change the last portion of the IP address to something else

Like say you're 76.101.124.10

you could become 76.101.124.234

ah I get what you mean

It's still caught by the ISP since the device needs to be registered :b

So you can't switch your modem out unless it's registered to someone else already

yeah my ISP assigns static addresses (and no port filters, yay for hosting email), no go here. But it's not what I'm after anyway

I know, just throwing that out there

You can definitely do it with UDP as long as it isn't filtered out

But you could technically do it...

hmm thinking whether the question is a good fit for security.SE

I'd say it's just a networking question, but the help pages on both superuser and serverfault aren't really... helping

If you found a way to edit the firmware of a router and get it flashed, you can make sure that when it receives data from a certain IP address, it gets "displayed" as something else. And you'd need to make it a dedicated local IP address, so when data is sent to that specific local address, it would forward it to the correct IP address without the user knowing

It would require a LOT of effort

Are you willing to put in that much effort?

I may or may not have had to do something like that before

:b

There are many ways to obfuscate your presence on a network, and that's one of them

well the end goal is determining the feasibility of spoofing a TCP connection as being local... I know it's possible (wrote a PoC, so I know it's possible, I'll be posting my findings on hacker news in a few days) but the question is whether I can spoof it as being local over the Internet. This would enable me to appear as a local or even localhost source to other people's mailservers

I don't know enough about networking to answer that. I think it would be a good post for SEC.SE, though.

But I'm almost positive that it would be dropped by an ingress filter

alright, thanks for your input :)

Just posted: security.stackexchange.com/q/106731/10863

that's a good question

added to favs

I'd imagine that any black hole detection would filter that out, but with so many crap routers out there I wouldn't be surprised if most actually don't do anything about that

just asked my ISP (XS4ALL) on whether they do it. The first-line helpdesk says "I guess we don't but I don't know. Sysadmin is gone by now [it's 10pm here] but I like these technical puzzles so you'll hear from me when I manage to catch him". Heh, 'I like technical puzzles', that's why this is my ISP :D

@RоryMcCune no, should I? I am scared to.

btw @all how did our trolldrama yesterday end up?

Ended up in some enforced peace :-)

@AviD heh, it's not scary, but kind of an "interesting" marketing slant on OWASP projects ....

reconnaisance has only 1 question, and it appears like it should be filed under reconnaissance instead

Any mods or similar who might be able to fix this?

@NateKerkhofs sorted, thanks

silly typo

@TildalWave Agreed. See Chinese routers for sale on the local market outlets in China for 20 RMB each (~$3.30)... lol