Alex Ionescue is speaking on Hyper-V. \o/

Morning all

hey

good morning

Love the xkcd :)

@M'vy yes - I like that homage

@Flyk That is one impressive post. If I had an account I'd upvote it.

@Arperum you should make an account and upvote it

because they're still defending meta tags

@Flyk The deleting/undeleting of the post is confusing though in the review history.

Also: account made and upvote given.

it got mine as well - looks very well thought out. I wonder, though, if because it is so comprehensive, that you'll get individuals who disagree with one section of it deciding to downvote and rant at the whole thing.

@RoryAlsop they're trying to

@Arperum <3

@Flyk - that sucks :-(

I'm trying to get them to understand that it's not acceptable to have a vampires because a movie has a vampire in it when there is a movie called Vampires that could potentially have a question about it

and that their primary use of tags should be movie names and tv show names with a handful of additional tags used to cover the rest of the scope of the site

but they're like "but, if a question is about the title of a movie, shouldn't it be title mission-impossible?"

and "but we're not stack overflow"

and "sci fi and fantasy use meta tags"

@Flyk inb4 incoming "your mom" & meta-tags reply.

if they are entrnched, you may be tilting at windmills :-(

@M'vy did I ninjaed myself here? can't tell.

@RoryAlsop hence why I'm looking for people from outside of movies & tv, with a more comprehensive experience of how the tag system was intended to be used, to vote

even the mods on this site don't understand the word "meta"

@Flyk 'this site' meaning Sec, or meaning Movies? Just asking because I think I'm okay with the term

eh

I haven't posted a massive post on the tagging mess on this site

let's assume we're talking about the one where I have

@Flyk I know - just being flippant :-)

@Flyk you're turning soft FLyk :P

@M'vy I have to, I got a warning from a moderator about my behavior for being dismissive of a newbie that thinks having 5k rep and being around for a few months gives you massive insight to the way the tagging system is intended to be used

using arguments like "I don't understand what a meta tag is, so tagging a movie that contains sex with sex is perfectly acceptable"

argh sad...

the irony is, every time I step down and become slightly kinder in my approach, an entire crowd of people somewhere goes "eugh, what the hell, you're going soft, we want the old kalina back"

@Flyk we're just teasing you :)

teasing is basically torture unless it escalates into fun

Anyway the post looks great

let's see what happens when people start going "but I like violence for movies where people punch each other"

@Flyk I have a few nits to pick about your meta tag section - but it will need to wait till after the weekend, I really have to run out

@AviD for example?

I get to spend the entire weekend on a kibbutz with the inlaws

thankfully we have a heatwave just in time

@Flyk like, packing up the kids and driving away

TTFN!

psh

I'm not even going to wish you a good time, I'm going to spend the entire weekend trying to guess what your issue is now

...

here's a thought, and tell me to stfu if I'm completely crazy/wrong/silly

if a company says "we've detected unauthorized activity on our system so we highly suggest you reset all of your passwords"

or "we've been hacked! We've reset all passwords!"

surely if you were going to hack a company in some way, you'd compromise the way passwords are stored so you can easily decrypt them, no?

getting everybody to reset their passwords would actually be a further vulnerability in itself?

I guess ultimately, the problem is actually trusting other people with your data more than anything

@Flyk Not if they first made sure the hacker was kicked out of the system + all his malicious code removed + point of entrance locked down.

This is awesome cc @RоryMcCune

dj3le.spdns.de:8901

@Arperum which would surely require a significant period of downtime while the investigation takes place, which isn't what happens in many instances

a full evaluation of a modern website and the systems it is running on isn't something that will happen overnight, in a week, probably even in a month in some instances

so based on the zero downtime the website experienced, it's a safe conclusion that they've not fully investigated the problem and that there's no guarantee the problem is fixed or if the system is even compromised

also, look at me trying to be on topic

I think I'm going to change my default policy on "we've been hacked" messages to "please delete my account"

it doesn't protect against any data that has already been stolen but it prevents my data from staying in the hands of idiots who don't care enough to protect it properly

maybe if everybody adopted that approach, after a few rounds of wiping out companies through mass user migration after they're hacked, people will start paying attention to security

I see @Simon has a job writing dialogue for pillars of eternity...

@RоryMcCune doubtful, that contains punctuation

@Flyk It depends how you define a hack and how far in they get.

For example, in the easy case of say sql injection, you haven't actually got the ability to run a process on their server

but you might be able to get their code to dump tables from their databases

like, the username and password database, for example

there are, if you like, levels of badness. Bad = can manipulate webserver to extract data, very bad=can run arbitrary commands in the context of the webserver (so can do bad, plus affect what's being served, probably), and terrible= root of webserver (can do anything to it).

That's of course a simplification because some hacks, like just taking control of the domain don't touch their server at all, but don't need to once you've poisoned dns.

then of course there's the architecture question

for example, suppose you hack a "government webserver"

did you just hack the poster they put up (their www, if they have any brains separate from the rest of their stuff)

or did you actually break into their private network as in say the Sony breach

to be topical, have you just made it inside the DMZ, or have you made it all the way inside.

@Rhino you can run applications via sql in some instances, for instance if you enable xp_cmdshell on mssql

@Flyk that's not the point

@Flyk the point is not what might happen -- it's what really has happened

if, in one case, the attacker only got SQL injection (not arbitrary commands), then there a different set of mitigations and responses are appropriate to an attack which achieved different "things."

@Flyk Yep, true, in which case very bad - got arbitrary execution on the server presumably in the context of the db engine. As @Tinned_Tuna says, it's what has taken place that matters.

So if they got root, or maybe even arbitrary execution for example, they may well be able to change the password storage policy as you say.

You have to know how far they got so you can work out at what level you can trust things again.

Which is why many people say the only solution is to "nuke it from orbit"

@Rhino which obviously didn't happen in the context of "we got hacked but we never went offline"

@Flyk Indeed. You can of course make a judgement call based on how serious you think their response was as to whether you trust them with your data again.

They could also be running a load balancer and when they say they got hacked, only one instance was affected

so they isolated it, patched the others and failed over to them

From your side, there's a question as to how much data you trusted with them also as to the risk associated with that

if you like, describe each leak as if it happens with an impact score

for example if someone hacks my twitter account - okay, not associated with my real ID, contains minimal personal info, unique password - easy to contain and fix so, not so bad.

On the other hand, if someone hacks my bank, that's a much, much higher impact level and I would absolutely consider a different provider

Once you understand the potential loss of data from a provider or source, you can then work out how you mitigate that (and how much "security" you need).

So for example

I have a goodreads account

Do I care who knows what books I read?

No. Not a biggie if their entire infrastructure is hacked as far as the impact on me is concerned.

Sure, I'll be a bit annoyed and maybe think twice about www.secureversionofbooksilikesharingsite.com that pops up afterwards

on the other hand, linkedin. I have connections on linkedin that have the potential to affect my career - this is a very large risk.

Of course, it's your data, it's totally up to you. If you want a uniform policy, go for it. I don't bother with that because I find that personally I can only do "really secure" for a small amount of things so I want to prioritize those appropriately.

@RоryMcCune If he had wouldn't it just say "donut donut donut"?

WallOText

@raz I know sorry about that

when a rhino gets going...

wtf who's posting war and peace in here

@Rhino Rocksteady?

to be honest, I much prefer @Rhino's rants to some of the others that I see. There's a person in another channel who ranted about labour vs. tories for the better part of an hour

to themselves.

I don't even remember what started their rant.

o lawd

@Tinned_Tuna Ah see that's easy. They're both subsets of what are more commonly termed "morons".

@Rhino heh, either way, I've had my fill of the polemic for one day.

@Tinned_Tuna I can well imagine. I can't wait for the election to be over

Which elections?

@raz In the UK we have an election this year - 7th May

Woah you can be elected king!?

You must really like this Elizabeth lady

She's been elected forever

@raz There are a whole lot more people who are involved in politics.</ignoresarcasmandthelike>

Yeah but they don't get an entire house now do they.

@raz actually the queen owns several castles and rather a lot of land

as well as a few horses

and a number of corgis.

Damn it stop using your sensibility

This is why we left you

@raz Some of them do (at least over here in Belgium)

@Arperum Our prime minister always gets number 10.

As well as a country estate to go and visit

And vmware doesn't support Linux 4.0 >.<

so my £50 tablet showed up

seems ok so far and the Office365 sub registered

What tablet is it?

essentially it's buy a years Office365 sub get a tablet for -£10

ah, the downvoting has started on my mtv meta post

@raz HP Stream 7

@Flyk why does the post get deleted and undeleted like 50 times?

@Ohnana I wasn't ready to post it and I couldn't edit it while it was deleted

it's a large subject and they love their meta tags

I see

I didn't want a knee jerk reaction to downvoting it because I missed something obvious

still getting the knee jerk reaction

but c'est la vie

it doesn't compute at all how people can disagree with removing nearly all of these tags and the offer is clear at the top that it's a discussion and things change

@Flyk They should probably create a tag for how much they love meta tags.

@RоryMcCune How do you like it?

movies.stackexchange.com/questions/tagged/meta-tag

@raz Sounds pretty meta to me.

faaaack how do you onebox tags

/sudoku

@Ohnana meta-tag?

@Ohnana MOVIES!

@Arperum yeah that shit

[tag:meta-tag]

^What he said.

that's right, it suddenly turns into wiki formatting

however it does not link to another SE site than the parent one

@Ohnana Also, that SE should have the largest spoiler alert ever.

[meta-tag:tagname]

security

meta-tag

lawl

also goddamn the tagging is awful on that site

feel free to vote on the post :p

@Ohnana yes

questions aren't so hot either but yanno

too much identification

brings traffic to the site

browsing questions about the mentalist

identification questions isn't the next thing on my list but it's certainly on there

I DID NOT KNOW THESE THINGS

also apparently front-brakes only on a bike is okay? stack exchange is so enlightening

0_0

Wouldn't that throw you forward when you hit the breaks?

apparently that's only an issue with kids, and if you're going fast downhill

leaning back/tapping the back brakes is enough to keep you firmly planted

i'd test it but i've seen too many over-handlebars accidents

sudden stopping without extreme weight distribution would probably throw you over the handlebars and taking all your weight off the front wheel would likely cause you to skid anyway

yeah your back wheel would skid. which isn't the end of the world, but if your front wheel skids, you're fucked

@JourneymanGeek It would. I once somehow ended up with my foot in my front wheel (no clue how I slipped from the pedal) and that resulted in me flying straight over the handlebars.

@Ohnana don't do that on mountain bike with discs-brakes

@M'vy idk shit about mountain bikes, I'm talking city-trippers

@Arperum oh jeezus! did you make it out okay?

@Ohnana I hate bicyclists.

@Ohnana Well, one day I did that. Sent me flying over my bike.

@raz when you're driving, or just in principle?

@Ohnana Mostly while walking. Because they think they also own the sidewalks for some reason.

I've never gone over my handlebars, and I do a lot of cycling. I also usually front-brake, supplementing with a bit of back.

@raz I stand my ground in the face of those people.

But they also blow through stop signs. I almost hit one.

@raz total douche move. although if there aren't bike lanes, you're taking your life in your hands

I want the police to start actually pulling them over for that and issuing fines.

@Ohnana THEN DON'T RIDE A BIKE.

the stop sign laws are weird

Sorry, got a little upset there.

bikes are allowed to do a "rolling stop"

@raz BUY MY GAS BITCH

:U

@Ohnana Rolling stops are fine, but if you blow through going full speed. And I can't see you because you're behind a bunch of parked cars I'm not gonna feel bad if you fly over my hood.

@raz basically yeah. you're supposed to coast and look with your damn eyeballs.

Oh they look. They just don't care. Damn kids... get off my lawn!

@Ohnana I ride a fixed wheel, so I can stop my bike with my legs if I have to

although, the last time I did this I burnt a hole in my tyre and inner tube

and had to walk the rest of the way to work

i learned to ride a bike on a fixed wheel

@raz Yeah, that's stupid.

the brake mechanism was awful

@Ohnana They're quite common for young kids; less so for adults who tend to have gears or even motors.

Although Avi will be pleased to know the cycling equivalent of hipster is owning a fixed wheel - even more so if you have those big white wheels with only three spokes.

Thus I am at least partially a hipster

you're also a rebel -- most of them are outlawed on public roads

the "brakeless" ones anyway

@Ohnana Mine has brakes, front and back.

@Ohnana I was wearing a helmet at the time, helmet was complete dead, I had a small wound on my forehead, but I properly survived.(I was probably 10 or 11 when that happened)

@Arperum ouch.

@Ohnana Meh, not my worst crash. I wrecked a couple bikes through crashes. (one of them involved a car, all the other crashes just involved stupidity and reckless behaviour)

I've had my share of stupid good luck in surviving all kinds of crashes/falls/general stupidities. I've also had my share of stupid bad luck. Most recent case: my godfather died ~two weeks ago, got cremated the day before my birthday, and yesterday one of my cats got hit and killed by a car, that cat was the last thing I got from him before he died :(

sad

@CodesInChaos Well played

@Flyk I punctuate your mom.

@Simon I find this highly offensive while simultaneously wishing you would punctuate my mom, with a knife

<nathan fillion gif>

:)

@Flyk If by "highly offensive" you mean that you're not offended at all, I believe ya.

@raz not too bad so far, although I think if you push it at all hard, it would die a death but for the money it looks pretty good....

> die a death

???

@Ohnana Metaphor to add emphasis on the importance of death .

Duh.

@Simon fucking literature students

@RоryMcCune Maybe... a blue death?

My stomach is mad at me and I don't understand why :(

@raz heh potentiallly, although it's been stable so far (TBH windows 8.1 hardly ever blue screens these days)

@RоryMcCune Yeah this is true. Even Win7 was extremely stable. Huge step up from XP/Vista

@raz yeah apart from the lack of a decent shell (which you can kind of get round with cmder) and the metro interface stuff (Which you can easily get rid of) I quite like Windows 8.1

For some reason I have New Found Glory's Hit or Miss stuck in my head.

@RоryMcCune I get annoyed by some of the user abstraction, but I get that for most people that wouldn't bother them.

@RоryMcCune apart from the useful part of an OS and the user interface it's okay -- glowing reviews!

@raz yeah for low level stuff that could be annoying

"This job would be great if it weren't for the fucking customers."

@Ohnana show me an OS that you can't pick holes in

I was just getting those out of the way before the fanboys inevitably mentioned them :)

@RоryMcCune linux is pretty hard too-- you can move the goalposts around quite a bit :)

but seriously that just struck me as funny

wow I chat killed really hard

i'm sorry chat you deserve better!

I'm really starting to hate dealing with outside engineering companies

@RoryAlsop That is really awesome

ikr?

radios on the internet!

@Ohnana That's a bit of an over simplification, but yes.

i was reading up on it. how does software tuning allow multiple people to use something simultaneously? does it just transcieve on multiple frequencies at once?

@Ohnana Yes, there are also multiple radios which helps a bit.

@DavidFreitag oh so it's like a radio cluster

that makes sense

@Ohnana With an 84m wide antenna.

NOICE. bet the neighbours love that shit

@DavidFreitag well, although I was vaguely aware of software radio I hadn't really looked at it until Securi-Tay, and there was a guy who did a whole talk on it. Been finding out more ever since

@RoryAlsop You'll like this then: windytan.com

also would the guy running it be the station operator, or would it be the people tuning it?

(hope he doesn't have a technician's licence lol)

@Ohnana As far as I could see it accepts data from input sound channels

You tell it the frequency to transmit on and it takes input from your microphone etc. and transmits it on that frequency band.

@DavidFreitag that's what I mean. who's responsible under FCC regulations?

@Ohnana He's in Germany.

just kidding

And I would have to say since it's technically his property, he would be responsible.

@RoryAlsop she does lots of SDR-based attacks, there's even an entry there about how she used an SDR to decode the signal that the wireless bus terminal screens receive.

Man, The Observatory is going to get frozen again.

@DavidFreitag very cool

@RoryAlsop She also has some videos from a few sec conferences on youtube. Interesting stuff.