The DMZ

Ohnana

7:02 PM

yay you answered your question

Simon

yay

etherealflux

that seems reasonable

I bet

that was implemented because of export restrictions

that was surprisingly hard to wrangle

Martin Rory Ingesen

The last episode of Mr Robot made me feel sad and unwell. I'm not sure if I'm up for watching the new one.

TildalWave

which one is out now? 6?

etherealflux

@MartinRoryIngesen did it involve PHP?

Martin Rory Ingesen

7:15 PM

@TildalWave Yeah.

@etherealflux No, the technicalities are pretty good. But one of the scenes struck home emotionally.

TildalWave

I watched up to ep 5. It's still watchable but I do get annoyed by its Wikipedia type hacking slang. I mean who the heck says things like "I have to prepare a social engineering attack"??

Simon

People who like everything to be dramatic.

etherealflux

You might as well go all the way, though

TildalWave

onebox a donut?

Simon

ONE BOX OF DONUTS?

OM NOM NOOOOOOM

Iszi

7:21 PM

@TildalWave I thought you were talking about Mr. Robot - not </scorpion>?

Simon

oszi pls stop

Martin Rory Ingesen

@TildalWave Yeah. But it's by far the best hacking show I've seen in a while.

Iszi

@etherealflux That's what @Simon's mom said.

TildalWave

@Iszi not wot?

Simon

oszi wat did i say pls

Iszi

7:22 PM

Scorpion (TV series)

Scorpion (stylized as </SCORPION>) is an American drama television series loosely based on the life of self-proclaimed genius and computer expert Walter O'Brien. In the series, O'Brien and his genius friends help each other to solve complex global problems and save lives. Scorpion airs in the United States on Mondays at 9:00 p.m. ET on CBS. The first season premiered on September 22, 2014, as part of the 2014–15 television season, and concluded on April 20, 2015. On October 27, 2014, CBS placed a full season episode order for the first season. On January 12, 2015, the show was renewed for a second...

Thomas Pornin

@tylerl As far as I known, the contents of the 'Received' headers are traditional but non-standard. Every server puts there whatever it wishes to put.

etherealflux

Isn't that the one where they had FreddyW on a guest actor?

TildalWave

@Simon see? it worked :)

etherealflux

ah yes, the dreaded "banana" phase of computer security

Thomas Pornin

@tylerl My guess is that one of the "128" is for the AES key size, the other is for the "equivalent strength" of the key exchange mechanism (ECDHE, hence probably with the P-256 curve, so "128-bit" strength).

Martin Rory Ingesen

7:24 PM

The banana cycle!

Ohnana

@TildalWave what the fuck

Simon

om nom

I think I'm hungry because this banana looks tasty as hell.

TildalWave

@Ohnana you're not familiar with sec.se memes are you?

etherealflux

I'm actually not familiar with this particular specimen

but I'm also made of spiders so I dunno ¯\_(ツ)_/¯

oh dear

he lost an arm

David Freitag

Guardians of the Galaxy [Awesome Mix Vol. 1] Full Soundtrack (Peter Quill Songs)

►

TildalWave

7:28 PM

@etherealflux crested black macaque

Simon

@etherealflux Is it a part of you that scared the crap out of me in the shower on Wednesday morning?

If so, soz, u ded son.

etherealflux

...why is there an escape character? formatting tricks?

Simon

Huh\?

You're crazy son.

etherealflux

\

huh

tylerl

@ThomasPornin I looked it up in the Gmail source code -- the first number is the key size in use, and the second number is the max key size supported by the protocol

etherealflux

7:29 PM

maybe it was unicode nonsense

adding a second \ made a single one appear

Simon

\\

u cray

David Freitag

@etherealflux Maybe you are just losing your mind, and you are actually talking to a rotten pumpkin in the park.

tylerl

@ThomasPornin so with AES-128 it's always 128/128, but if your protocol supports variable key size, this is where you can see which key size was used.

Simon

@RoryAlsop Yup, he's doing it again, the grammar he's tring to fix is actually wrong too: security.stackexchange.com/review/suggested-edits/56267

etherealflux

@Simon ow, that plural-singular disagreement at the end

Simon

7:35 PM

@etherealflux Yeeeeep.

@TildalWave Stop accepting this guy's edits, he was suspended for suggesting sucky edits.

etherealflux

Alternatively, let me edit his edits

loudly

WE DO NOT SPLIT OUR INFINITIVES, MAGGOT

GIVE ME FIFTY PUSHUPS

TildalWave

@Simon it wasn't that bad of an edit

Simon

@TildalWave Please, he actually inserted a grammatical error.

TildalWave

but I rejected many of his before, true that

@Simon TWSS

Simon

PLS

TildalWave

7:40 PM

hehe

didn't see it then

Simon

It's fine, I'm just getting genuinely annoyed by this guy.

TildalWave

well ditto, but I'm not gonna reject things based on who suggests them

Simon

True.

etherealflux

I'll edit it

Simon

Do you know how to Anglisch though?

Gilles

7:42 PM

@TildalWave Please don't accept suggested edits that are half wrong, half badly-formatted irrelevant quote

etherealflux

I copyedited a novel once

good enough

Gilles

(apparently today is bash on TildalWave for accepting edits day)

etherealflux

(the story was awful because I wrote it before knowing how to write)

Simon

@Gilles Hahaha.

etherealflux

how about this

>If you put a browser like Safari or Chrome into the background on iOS, but leave many tabs open, will they keep refreshing and sending my IP address/other details to the open websites? What about when I have the browser open - will tabs I'm not currently look at refresh by themselves?

too many opens

TildalWave

7:45 PM

@Gilles Well I accepted a half bad suggested edit based on it being a half good one :P

etherealflux

also eeew clashing points of view

Simon

@etherealflux will tabs I'm not

w0t

etherealflux

send help

more coffee

Gilles

@TildalWave this one was half bad and half bad

TildalWave

also, it takes two to accept it, so I only half accepted a half good half bad one

@Gilles why? because it links to SANS?

David Freitag

7:46 PM

Wow I missed defqon1 2015 by miiiiiiles

Simon

@DavidFreitag Yep, June brah.

Gilles

@TildalWave the first paragraph is just an example but it's presented as a definition. The second paragraph is too much information and out of context, plus it's badly formatted.

Three wrongs don't make a right.

David Freitag

@Simon Thanks for letting me know, man.

Simon

@DavidFreitag My pleasure.

TildalWave

OK I'm gonna say something that not everyone will agree with: I think that even having bad tag wikis is better than having none. No wiki means people will just remain lethargic about it. A bad wiki means someone will be annoyed enough about it to actually write a good one over it.

tylerl

7:48 PM

"lethargic"?

Gilles

@TildalWave a bad wiki means that someone scouring the list for wikis needing writing won't see them

TildalWave

@tylerl google it :P

David Freitag

Slow wifi is probably the only thing that makes me want to club baby seals.

Simon

rip baby seals

tylerl

@TildalWave Familiar with the word, don't think it fits

TildalWave

7:50 PM

@tylerl lazy to write one, not bothered by seeing it empty,... how doesn't it?

Simon

Today is the national criticize @TildalWave day.

Gilles

@tylerl I think @TildalWave meant to write “apathetic”

Simon

Everyone, fill in!

etherealflux

complacent

indifferent

Simon

donutic

etherealflux

7:50 PM

^

TildalWave

> feeling a lack of energy or a lack of interest in doing things

this is what I meant with it

Gilles

@AviD Ok, it's decided. Instead of bashing Simon, everybody bash TildalWave!

David Freitag

@Simon No, that's what people get when they wait behind someone taking forever at the dunkin donuts drivethrough.

Simon

@DavidFreitag pls, you mean at Tim Horton's.

Gilles

@TildalWave doesn't really work for a lack of interest in doing a specific thing

David Freitag

7:51 PM

@Simon At what?

Simon

AT TIMMIES YOU DONUT

etherealflux

@Simon i'm sorry i don't speak maple syrup

Herringbone_Cat

@Simon Tim horton's only exists in Canada, afaik

David Freitag

@Simon Timmy can't make donuts, he blew his hand off with fireworks!

Simon

IT'S FRIDAY AFTERNOON, I CAN'T HANDLE 3 CONSECUTIVE REPLIES.

@Herringbone_Cat There are some in the North of the States.

David Freitag

7:52 PM

@Simon Then perhaps you shouldn't be so wrong next time.

etherealflux

Timmy was a chemist's son, but Timmy is no more

TildalWave

Jesus it's the national anal retentive day or something?

Martin Rory Ingesen

@Gilles But what if that makes people afraid to write tag wikis? Because of the "it can't be bad on the first try"?

etherealflux

for what Timmy thought was H2O, was actually H2SO4

^

Simon

@etherealflux Well too bad, I'm trilingual then.

etherealflux

7:53 PM

it took me a while to even contribute anything on the site, since I was worried I'd do a bad thing

David Freitag

Actually I have to admit there was a Tim Hortons near where I work, but it closed

Presumably because the parking lot was always a ghost town

Simon

@DavidFreitag rip

TildalWave

@Gilles you do know what I meant, right?

David Freitag

It's now a shell gas station.

@TildalWave It seems to me they just want to argue with you. You got your point across well enough.

TildalWave

@DavidFreitag oh wait, I didn't even use Wiki yet :)

Herringbone_Cat

7:55 PM

@Simon Interesting. I lived in upstate NY 2002-2006, but I never noticed one. But they do appear to exist.

Martin Rory Ingesen

@etherealflux Yeah. It's pretty much like trying to edit Wikipedia.

David Freitag

@Herringbone_Cat I think that's because they all closed. Americans just can't support something Canadian, especially when their employees don't apologize nearly enough.

@etherealflux That must have been seriously painful.

etherealflux

@DavidFreitag Depends on the dilution, really

nitric acid is more fun, anyways

pretty sure it's why my knuckles turned yellow for a month

David Freitag

Pretty sure drinking acid is going to be pretty painful.

Simon

@DavidFreitag Or you're just gonna end up trippin' real good.

David Freitag

7:58 PM

@Simon Yeah, trippin' over the organs spilling out of the large hole in your abdomin

etherealflux

@DavidFreitag Well, things like cola and orange juice are quite acidic

Simon

@DavidFreitag aawww yuuuuh

etherealflux

Acids are less exciting than bases, anyways

bases turn your skin into soap

messin up your ester bonds

Simon

@etherealflux Sounds like this could be profitable.

David Freitag

@etherealflux Yes but not sulfuric acid.

@etherealflux Bases are terrifying.

At least with an acid you know right away that your hand is melting off.

Gilles

8:00 PM

@TildalWave Yes, I do. I got it from the context. But tylerl is correct when he says it isn't idiomatic English.

@MartinRoryIngesen extraordinary claims require extraordinary evidence

Simon

@Gilles QU'EST-CE QUE TU SAIS TOI À PROPOS DE ÇA ANYWAY ESPÈCE DE FRANÇAIS?

:p

Gilles

@Simon ERREUR DE SYNTAXE APRÈS « ÇA »

Simon

@Gilles Bahahaha.

Lucas Kauffman

@RoryAlsop submitted something for the blog, if you got time to QA and post :3ß

TildalWave

@Gilles Dude, you're in DMZ!

etherealflux

8:02 PM

ur mum isn't idiomatic English

Gilles

@TildalWave Yes, I am. So our nitpicking is allowed and even encouraged.

TildalWave

I also don't care what ~~ancient Greek~~ erm, Latin derived word isn't idiomatic English. :P

gross

You're gross.

8:05 PM

TWSS

Simon

"Look at me, I'm looking through Gmail's source code, blablabla, I bet you're all jealous"

WELL YES I AM SLIGHTLY JEALOUS IF YOU'RE ASKING.

tylerl

Head louse

The head louse (Pediculus humanus capitis) is an obligate ectoparasite of humans that causes pediculosis capitis. Head lice are wingless insects spending their entire life on the human scalp and feeding exclusively on human blood. Humans are the only known hosts of this specific parasite, while chimpanzees host a closely related species, Pediculus schaeffi. Other species of lice infest most orders of mammals and all orders of birds. Like all lice, head lice differ from other hematophagic ectoparasites such as the flea in that lice spend their entire life cycle on a host. Head lice cannot fly, and...

"Nit"

lol @ flag

flag on the play!

Oh no, is it me?

@tylerl nitwit! :)

8:07 PM

brb going to space

Rоry McCune

@Simon someone flagged @tylerl's head louse post

Simon

Oh come on.

Richard

@RоryMcCune - Someone dismissed the flag

Oh wait, that was me

Simon

I honestly have no idea who's flagging stuff here but all I have to say that this is not welcome at all.

Gilles

@Simon that message was admittedly lousy

4

Rоry McCune

8:08 PM

@Gilles g.r.oa.n

Simon

@Gilles Hahaha.

TildalWave

Why're here so many folks on a Friday? What's wrong with your beer people? :OO

Simon

@TildalWave Leaving work in about 10 @@@

tylerl

Rоry McCune

@TildalWave what's wrong with DMZ+Whisky?

TildalWave

8:09 PM

@RоryMcCune nothing, but you're not obnoxious

Rоry McCune

@Simon slow-poke.. if you were in a decent time-zone you'd be home by now :op

Martin Rory Ingesen

@TildalWave What, can't I drink beer and chat in the DMZ?

Simon

@RоryMcCune :(

@Richard Cheers for dismissing it by the way.

TildalWave

@MartinRoryIngesen of course you can, I am

Martin Rory Ingesen

@TildalWave Skål!

TildalWave

8:11 PM

my point was that some either aren't or it doesn't do them any good

@MartinRoryIngesen Skål!

Rоry McCune

Richard

@Simon - No worries.

Mjolnir slumbers once more

Simon

You can lift that?

You must be worthy.

Richard

I have a selection

Rоry McCune

@Simon d'ya even lift.... bro

Richard

8:14 PM

Simon

@Richard You're lucky that I'm about to leave, otherwise I'd totally call you a "nurd".

My personal fave

rofl

:D

Is it wrong that I liked Thor much more in the Avengers than in his own movies?

ohnuhnuh pls

Martin Rory Ingesen

8:17 PM

Hopefully, when he's grown up in the realm of Security.SE, a viking descendant will carry the mod hammer with great pride and justice.

@Simon It's not not not wrong.

Ohnana

@Simon wat

also, am I missing something here? sektioneins.de/en/blog/15-07-31-php_challenge_2015.html

Gilles

@Simon POURQUOI TU VIENS JAMAIS CHEZ COSETTE

David Freitag

@Ohnana Presumably it has something to do with this:

> Attention this code is installed on a Mac OS X 10.9 system that is running PHP 5.4.30

Ohnana

i'm installing php right now so i'll see if my hilariously simple answer is right

David Freitag

It's PHP, the only answer is that he installed PHP in the first place.

Ohnana

8:27 PM

lawl

on fedora php has a package dependancy on httpd...

why.

CodesInChaos

You're confusing. Between those Thor gifs and @Richard's posts I almost thought I were in Mos Eisley, not the DMZ.

Richard

@CodesInChaos - Blah blah blah network security

blah blah blah php

happy now?

David Freitag

@Richard No, not enough donuts and boobies.

CodesInChaos

@Richard You're an obvious impostor. We never talk about network security here.

2

David Freitag

@CodesInChaos I wouldn't say never, but it is a very infrequent topic.

Gilles

8:31 PM

@CodesInChaos security is one of the officially approved topics

Richard

@Gilles - Along with boobies-n-beer?

Gilles

@Richard libations, so that glass is half full

Rory Alsop

@TildalWave I'm drinking, sat in a hot tub on the decking overlooking the car park that is the M20.

@Lucas - I will review that tomorrow

TildalWave

@RoryAlsop hehehe cute so it's yuppies go home o'clock?

David Freitag

@RoryAlsop Helicopter ride home from work?

@Ohnana Ew Fedora? Ew

TildalWave

8:41 PM

hmm wait it's August 1st tomorrow and the beginning of a weekend... that's all those people going to France / Spain / ...?

David Freitag

Is there some special significance to 8/1?

TildalWave

@DavidFreitag psst you'll invoke @AviD and his viral videos!

Ohnana

@DavidFreitag hey fuck you i like the mate spin

David Freitag

@TildalWave I am genuinely curious.

@Ohnana Arch4lyfe

TildalWave

@DavidFreitag in some European countries, 8/1 is the beginning of the summer vacations season or whatsitcalled

David Freitag

8:44 PM

@TildalWave But... august is the end of summer...

Leaves are already starting to turn orange here

TildalWave

@DavidFreitag in UK summer is officially from August 1st to August 2nd :)

David Freitag

@TildalWave lol.

Rоry McCune

BTW any of you chaps and chapesses who run andrdoid and haven't got the cyanogen patch may want to be a bit careful with their phones for the next while... sounds like exploitation of stagefright-style vulns is starting to happen and people are poking around for other apps that use those codecs..

@DavidFreitag huhwut?

David Freitag

@RоryMcCune Chapesses read "cheapasses"

Rоry McCune

@DavidFreitag ahh no, female version of chap :)

David Freitag

8:50 PM

hehe

@RоryMcCune Given that most phones are not rootable, that isn't really a viable solution.

Rоry McCune

@DavidFreitag yeah the problem is that for a lot of people there literally is no solution to this

David Freitag

@RоryMcCune A lot meaning >70%

Rоry McCune

which is why I think it'll be a tempting target for bad guys

people are sitting ducks

in fact their like sitting ducks with the feet stuck to the floor

David Freitag

Perhaps this will lead to a class action lawsuit against manufacturers who stop updating their old phones

Rоry McCune

@DavidFreitag yeah manufacturers/carriers need to take responsibility

David Freitag

8:52 PM

@RоryMcCune Like fish in a barrel.

Rоry McCune

especially where they sell 2 years contracts and less than 2 years of updates!

David Freitag

@RоryMcCune outside of any major legal action, I highly doubt many of the major manufacturers will take this seriously.

Ohnana

@RоryMcCune yeha i've turned off auto-retrieval in pretty much everything now

Rоry McCune

@DavidFreitag well unless someone creates a worm and nukes a percentage of their customer base

David Freitag

@Ohnana I solved the solution by jamming my head further into the bucket of sand that it was lodged in.

@RоryMcCune I almost hope that happens, honestly.

Rоry McCune

8:53 PM

@Ohnana yeah that'll help, the risk I've heard is that these codecs may be used elsewhere, things like game or indeed anything that processes media is theoretically vulnerable

Ohnana

@RоryMcCune fark

Rоry McCune

it does make me laugh that Google have loads of really top-notch researchers finding really obscure OSX/Windows vulns and they couldn't catch this

David Freitag

@Ohnana Yep, time to get a bucket. I have a few to go around, but you need your own sand.

Rоry McCune

at the moment it's not confirmed, but I'll bet there won't be many android phones at BH/Defcon next week...

David Freitag

lol

If I get nuked by it, it will only be a reason for me to put a new rom on there.

TildalWave

8:58 PM

this is MMS only, right?

David Freitag

4 mins ago, by Rоry McCune

@Ohnana yeah that'll help, the risk I've heard is that these codecs may be used elsewhere, things like game or indeed anything that processes media is theoretically vulnerable

TildalWave

I have those hosted on my provider and I just get a normal SMS from the network that there are some

David Freitag

It would be seriously funny if the facebook app was found vulnerable.

Transcript for