The DMZ

@AviD indeed but it does still somewhat surprise me when people who really really should know better and have a large financial incentive to do it right (who's going to be keen to do business with hacking team now) make basic errors

AviD

@AviD @RоryMcCune how would you say "hacked" in Valerian? I dont think "hackuris" cuts it.

@RоryMcCune in my experience its the opposite. some of the best "hackers" (cyber term) are also very much "hackers" (oldschoold term), ie. not following best practices as a way of life.

its what makes them so damn good at offense in the first place.

Rоry McCune

@AviD I know it does go that way, it's just kind of ironic that it does...

AviD

not sure its ironic, but it is sad.

Rоry McCune

9:52 AM

Bad day? Could be worse. It's now someone at @hackingteam's job to call up the Russian secret police and inform them there's been a breach

Tweeted by liamosaur on July 6, 2015 at 8:15 AM

AviD

10:07 AM

Perhaps, even within the next 15 years, nanobot technology will have advanced enough to be able to make a violin small enough for them.

2

Iszi

1:13 PM

@AviD For the latter, don't you mean "hacks"?

raz

1:56 PM

Sometimes questions like these just make my head spin

1

Q: How does a password authentication over a TCP protocol actually work?

When coming up with a password based login protocol, many solutions come in mind: User sends password in plain text. Compute hash on Server, compare to hash in database. - Bad because attacker can intercept credentials User sends hash of password, server compares hash to hash in database. - Ba...

CodesInChaos

Could you vote on a couple of dangerously wrong answers on stackoverflow?

67

Q: Generating a random password in php

I am trying to generate a random password in php. However I am getting all 'a's and the return type is of type array and I would like it to be a string. Any ideas on how to correct the code? Thanks. function randomPassword() { $alphabet = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXY...

php random

Terry Chia

@CodesInChaos Hah. I think I came across that answer when I was young and naive.

Rоry McCune

2:23 PM

@TerryChia wow a whole week ago :op

sorry open goal, had to take the shot

raz

@RоryMcCune Kinda like the US's 4th goal last night

@CodesInChaos Whatever ^_^

Stack Exchange

My country's World Cup win was exciting and all, but c'mon, what if the players wore nylon wings and COULD LITERALLY FLY?

raz

@StackExchange Awesome, do I get to answer those questions for my new profile?

AviD

2:55 PM

@Iszi yes, but I was choosing not to go with the pejorative.

@raz WHEELS HAVE NEVER BEEN INVENTED BEFORE!

@raz THIS IS THE VERY FIRST TIME ANYONE HAS NEEDED THIS VERY SPECIFIC REQUIREMENT OF AUTHENTICATING USERS!

@CodesInChaos wow. even worse than I expected.

Iszi

@raz Ummm.... you know that's just the automatic XKCD feed, right?

AviD

3:09 PM

@Iszi you're an automatic feed. #simon

Rоry McCune

BTW I take it Doughnut boy is off on his hols as he's not been about for a bit...

AviD

you talking about donut holes now?

Rоry McCune

@AviD Def. hols . UK english slang for vacation.

AviD

oh, I know. But donut holes is funnier.

Iszi

3:53 PM

@AviD No, donut holes are funnier. "Donut holes" is definitely funny though.

AviD

@Iszi except that I was referring to the term donut holes, and not the holes themselves. #GrammarUberNazi

Rоry McCune

@AviD your punctuation game was weak then #PunctuationNazi

Iszi

@AviD Hence why I gave the example with quotation marks, to show what you should have done.

AviD

@RоryMcCune your a punctuation game

Iszi

#YoMommaNazi

AviD

3:55 PM

@Iszi unnecessary, strictly speaking.

Iszi

@AviD Wow. Can't tell if that's deliberate, or...

Rоry McCune

@AviD s/your/you're/

AviD

@Iszi hehehe of course it was

Rоry McCune

4:13 PM

everyone ready for another round of "Guess the OpenSSL Security Vulnerability"? mta.openssl.org/pipermail/openssl-announce/2015-July/…

the only clue is... it exists in 1.0.1 and 1.0.2 but not in 1.0.0 and 0.9.8

oh and it's "high" severity

ya know what would be a good idea. Make a list of all known security research companies who look at crypto and then monitor their activity for newly registered domain names

then from that work out the likely bug they're going to assign to that name

raz

@Iszi Yeah but I need to take my anger out on something

@AviD I like inventing wheels, especially new ones.

security.stackexchange.com/review/suggested-edits/54402

seriously, someone needs to tell this guy how to edit.

AJ Henderson

4:49 PM

businessinsider.com/…

that's slightly terrifying

raz

That sucks

I'd rather not be like China, but that's me.

AJ Henderson

it's funny because just the other day I was telling someone you don't really have to worry about the government getting super scary unless they try to outlaw encryption

seeing this a week later = me not particularly happy

atleast it isn't the US trying to do it yet

raz

5:10 PM

@AJHenderson You think the US would have more success?

AJ Henderson

I think any government could enforce it if they wanted to. It would be a bit hard once they got to the practical implications though

not that those couldn't be worked around with some effort

and I'm not entirely sure that the population would even particularly care

never mind that it's the last barrier to a completely orwellian surveillance state being a lightswitch away

Iszi

@RоryMcCune That should be more than enough for @ThomasPornin to have it figured up by COB, DMZ time.

Why do companies only partially release vulnerability info? Details should be full or none until the patch is released. Otherwise it really serves no purpose - probably does more harm than good.

Rory Alsop

5:25 PM

@AJHenderson proves he us a bit of a tool when it comes to infosec

@Iszi to test @ThomasPornin ?

AJ Henderson

@RoryAlsop no kidding

Iszi

@RoryAlsop I'm not much educated on UK politics, but in general shouldn't you just end that sentence at "tool" for practically any given politician?

AJ Henderson

@Iszi well, yes, but they generally atleast try to avoid making it obvious

schroeder

Good Morning from the fires of hell

AJ Henderson

@schroeder what, did you go in to politics over night?

schroeder

5:34 PM

lol

Rory Alsop

@Iszi yup, you're right

Simon

6:13 PM

@RoryAlsop May I suggest you protect this question (security.stackexchange.com/questions/93149/…) to avoid answers like this: security.stackexchange.com/questions/93149/…?

But yes in this case, he would have been able to post cuz association bonus.

schroeder

I protected it

Simon

Cheers.

raz

Does increasing password strength actually help against WEP?

Rory Alsop

Hello @Simon - Canada day celebrations good?

Simon

@RoryAlsop We don't celebrate Canada day very much in Québec :p

But yes, we had the day off at least!

raz

6:24 PM

Are you one of the voters to secede?

Simon

It's a tough call, I'm still unsure if I'm in favor.

There's a ton of corruption in Québec's government so I doubt that we'd be better off by ourselves.

raz

@Simon Yeah, turns out running a country is hard

Simon

Especially when all you care about is yourself and money.

And then those donuts get elected continuously.

Thomas Pornin

@Iszi Meh. Probably some buffer overflow in a feature they implemented in 1.0.1 (thus, older versions are "immune").

@Iszi Releasing partial vulnerability info is supposed to be useful in that it allows people to schedule the installation of patches.

Instead of doing it "as usual" (i.e. when half the staff is running in circles shouting "the End of Times is upon us !")

raz

@ThomasPornin Isn't everyone running around shouting "THE END OF TIMES IS UPON US!"?

Mrtn

6:33 PM

THE END OF TIME IS UPON US!

Simon

pls

Lucas Kauffman

@Simon Do they at least appologize for the corruption?

schroeder

... it's the French ...

Simon

Yeah, I guess our French blood makes us argue and not apologize.

@raz Did you see the length of that xkcd? Those guys seem to be productive, maybe they should ask their help to work on the CSS!

Iszi

7:03 PM

@ThomasPornin Yeah, that's fine. But instead of saying "hey, we're releasing patches for X but Y isn't affected by the vulnerability" just say "hey, we're releasing patches for X".

Or something like that. There should be a way for them to say a patch is coming without having to spell out what it's all about. And if not, then they should just go full disclosure so we don't have to worry about the bad guys learning stuff before some (or most) good guys do.

David Freitag

Oh man I had a great time this weekend.

We nearly burned the entire neighborhood to the ground and I have a broken leg.

raz

@DavidFreitag Nice!

David Freitag

@raz We won the 'who has the bigger fireworks' contest :D

We also may have fired a 2" mortar directly at someone's shed.

raz

8:08 PM

@DavidFreitag Now that's a party!

David Freitag

@raz We finished the night with a 6" shell that set every car alarm off for a few blocks.

raz

Damn, in a city, suburbs, or BFN?

David Freitag

suburbs

It was very eerie hearing hundreds of car alarms going off.

raz

I bet

how'd you break your leg?

David Freitag

Hiking

Well, more accurately: rock climbing

The helicopter ride was fun. You know, after they injected me with morphine and stabilized my leg.

raz

8:14 PM

@DavidFreitag compound fracture?

morphine doesn't do anything for me

Just give me the oxy, I'll wait the 20 minutes

David Freitag

TBH I don't actually know that it was morphine, but whatever it was it was brilliant

@raz Yup, made a really great crunch sound when I hit the ground.

raz

@DavidFreitag Generally if it's for immediate pain, it's morphine. Morphine is supposed to address pain immediately. While pills can take some time to take affect.

@DavidFreitag winces

David Freitag

@raz Yeah I was in shock for a while. I would have tried to stand but there was bone sticking out so I figured I'd better not.

Fibula snapped completely and took a chip out of my tibia, which is also fractured.

raz

And that's why I don't go rock climbing

David Freitag

It was a lot of fun

Rory Alsop

9:05 PM

Owwwww. Hope you have a good doc, and that it fixes well

schroeder

But I'm sure it will all be fine! [Rory meant to say :)]

David Freitag

@RoryAlsop Well my health insurance is great, I only paid $500 for the hospital trip and the heli ride. Other than that it's just a bit inconvenient. They put a steel pin in my fibula and they said it should heal up just fine in a few months.

(only...)

Iszi

9:21 PM

@DavidFreitag Hey, $500 for a hospital visit that required a heli ride? That's fantastic.

'Round here, an ambulance ride of just a couple miles costs $300+ on its own if you're paying out of pocket.

David Freitag

@Iszi Right, but that's like saying getting stabbed is better than getting shot.

Kinda misses the point.

Iszi

@DavidFreitag My point is, the out-of-pocket cost for you was probably a couple thousand at least. Only having to pay $500 of that is a pretty good deal.

David Freitag

Well, I pay something like $35/mo for the insurance

Iszi

9:42 PM

@DavidFreitag You don't get to complain anymore. My payments probably work out to $100/month per person for my family, and that trip of yours would have likely cost me over $2,000 before the insurance put in a dime. :-P

David Freitag

@Iszi Well, sure, but I'm a 23 year old guy, I'm the cheapest type of human to insure.

And, other than a slight case of broken leg, perfectly healthy.

Iszi

@DavidFreitag My insurance costs don't take age or individual health into account. If you worked for my employer, you'd be paying the same amount I do for the same plan - or more, if you want the "nicer" plan.

("Nicer" in this case being differentiated by out-of-network coverage.)

David Freitag

@Iszi Our prices are calculated by age and health (because of our provider). I have the second best plan, which has a $500 deductible. All of my copays are $20 and scans are free.

Iszi

@DavidFreitag We're not so lucky. Everyone gets the same plan choices, for the same cost, as everyone else. And everything is 100% out-of-pocket until you hit the deductible (which is a lot more than $500), and then the insurance only covers 90% after that.

We used to have plans with copays, but the deductibles weren't much better and the premiums were higher.

David Freitag

But some of my coworkers would be paying upwards of $300/mo for the same plan as me.

It probably helps that it's just me and not a spouse/kids as well.

Transcript for