@RоryMcCune What security implications?

If anyone is interested in kernel dev this seems pretty interesting: eudyptula-challenge.org

@TerryChia Yeah, I remember seeing that several months ago. But I wonder what the end goal is. They mention getting your patches into mainline as part of the challenge, which sounds... questionable. I have half a mind to sign on just to see what they're playing at.

@tylerl That's definitely not happening I think. :P

@TerryChia which part?

@tylerl Getting patches into the main kernel tree.

@TerryChia well, what if they start with pre-arranged puzzles for you to solve and then switch to solving actual bugs or feature requests, even though you think it's still all made up.

kinda like Ender's Game

@tylerl That would be interesting but I don't see the logistics of that working out.

Anyway, the first two challenges are easy at least. I have to compile the kernel for the second one so I'm procrastinating.

@TerryChia recompile the whole thing? or just build a module?

@tylerl Recompile.

The first challenge is building a simple module.

... and back

@TerryChia The way it looks like they operate is that to get started you pull an image file from their repo. What security checks are done by them on images in the repo. It seems improbable that they'd review the whole OS as there's loads of them in there (a search for rails images turns up 98 results)

the concept of downloading a relatively random OS/app stack over HTTP (I think need to check) and then using that as the base for a part of your business makes me shudder ...

@RоryMcCune The same guarantee you get when using Chef cookbooks you find on the Internet..?

You can always build your own stack.

@TerryChia sure and what percentage of people will... if the happy path says "do this" they will

@RоryMcCune You can always find idiots who screw up.

here's a scenario for you. Want to PWN lots of start-ups. make some really good chef/docker/etc images and put a little additional binary in there that calls home after a couple of hours...

There are very real security issues with containers but that isn't one of them imo.

@TerryChia yep but the whole concept of the tool is that that's how it should be used...

@TerryChia srsly happy path is run totally untrusted code from the 'net and that's not a security issue.....

heck I looked at openstack a couple of days ago via devstack and the idea for that is "to install run a shell script on your server as root and we'll go install a ton of software from a variety of locations, good luck doing patch management with that"

eh perhaps I'm getting old/grumpy :)

@RоryMcCune You did get the point that devstack is for development and not something you run in production right?

@TerryChia sure, again one point is I'll wager that people use it for prod like tasks, but the other is that I'm guessing it uses the same components as open stack, which looked like a bit stack of open source components. I'd hope that anyone installing it for real will validate each component before using it, but....

@RоryMcCune People running serious stuff on Openstack will almost definitely buy support from RH/Canonical etc.

And seriously, Openstack is something 99% of companies will not need.

@TerryChia to an extent I was just mentioning it as another example, docker is something people are using in production...

@RоryMcCune Really? No one should be using docker in production right now. It's barely out of beta.

@TerryChia well I've seen arch docs for at least one system that is docker on openstack..

also Ubuntu were making a big thing of their docker support in 14.04

although annoyingly with them the command is docker.io and not docker

'cause they already have an app called docker

@RоryMcCune RHEL 7 will have support for it as well. But something being in an LTS distro doesn't mean that you should be using it right now. If you aren't waiting for 1.0 before running in prod you are either very brave or very stupid. :P

On another note, I wonder how long I will need to compile the linux kernel in a VM....

@TerryChia I'd agree that people should be being very careful about using it, but I'd say that inclusion in an LTS distro is likely to make a lot of people think it is stable especially when ubuntu are making a point of the added support on their blog (with no caveats about it not being ready for prime time)

wb @RoryAlsop

Hello all

Tell you what, the combination of sunshine, a surprise public holiday, and packing for a trip to Vegas all adds up to getting very little time on here

I've missed the chat

@RoryAlsop Ooooh sounds like fun.

@RoryAlsop and we have missed you <3

@LucasKauffman pfffft

@DavidFreitag Conference, but getting a couple of days either side for relaxing

@RoryAlsop what conf are you going to?

@LucasKauffman ISACA global leadership conf

@RoryAlsop But still. It's Vegas baby!

@DavidFreitag sadly, I haven't had the time to practice Blackjack, so as I'm not prepared to lose money I will not be gambling. I'm actually not a fan of Vegas - it just reminds me of a debauched Blackpool with more lights and money

I do love the countryside around it though - the bits without any humans

:-)

@RoryAlsop Poker is more fun anyway. :P

Looks like this will be a busy week I need to build a new PC and update all my computers to Ubuntu 14.04 LTS

@TerryChia isn't that the same thing

:-P

like 21's

@RoryAlsop Not even close. :P

no?

@RoryAlsop Well there is an awesome place nearby i think you'd love in bonneville ;]

@DavidFreitag I know - but I'm not getting there...I'm taking my wife along on this trip, so we'll be checking out the Grand Canyon, Lake Mead, Zion National Park and a couple of other bits

@RoryAlsop oooo equally as awesome. I want to do a cross-country drive one of these days and stay in that area as long as possible

@RoryAlsop you should get remaried in vegas

@RoryAlsop Poker is the one with flushes, straights etc.

@LucasKauffman But I quite like my current wife...

@TerryChia (I know - I was being deliberately obtuse)

@RoryAlsop I meant remarying her

@RoryAlsop Heh.

as in vegas marriage

@LucasKauffman I vaguely toyed with the idea, but the cost of 6 Elvises (Elvi?) and a host of singing dwarves was going to cost too much

@LucasKauffman I don't think many typically remember their Vegas marriages...

@RoryAlsop hahaha

@RoryAlsop Just play the Hobbit movies in the background.

@LucasKauffman (seriously - one dozen dwarves were going to cost an extra 2 grand!)

not that I did too much research

ahem

@RoryAlsop no I can see that :P

dwarves were cheaper than Playboy bunnies though...

@RoryAlsop You should bring the band along. Do a surprise US tour :P

@DavidFreitag We have some reasonable offers at venues both east and west coast - but the travel makes it not yet feasible. Discussions are underway - it could yet happen

@RoryAlsop Yeah I imagine you would have to sign more than just a few shows across the states to make it worth while.

@DavidFreitag Yup - we'd have to sell a lot of t-shirts...

@RoryAlsop You could all dress up as Playboy bunnies.

@TerryChia erm...yes, okay...

@TerryChia A dinosaur in a tutu and bunny ears?

@DavidFreitag Not a tutu. A kilt.

@TerryChia I could be wrong but last i checked the playboy bunnies didn't wear kilts...

@DavidFreitag Well, we are mixing and matching stuff after all.

@TerryChia Yes i suppose. Just no bagpipes please.

So. Much. Candy.

STEVE GIBSON ALERT

@RoryAlsop when we did the canyon trip we went with these guys pinkjeeptours.com/las-vegas . was good and the bit we went to hardly had any people, just a crazy cowboy dude sleeping right on the edge

@RоryMcCune Good god those vehicles are hideous. I'd be glad they were in the desert so nobody would see me near one.

@RоryMcCune cool - will check them out this afternoon

@DavidFreitag they were nice on the inside, didn't see the outside that much, they are distinctive tho..

They should be using Aztecs.

Hot Pink Aztec

@ScottPack I think I just threw up a little in my mouth.

I'm not the world's leading Jeep expert, but it certainly appears that the Pink Jeeps are not, strictly speaking, actually Jeeps.\

@tylerl Custom-designed by Chrysler for the company. So, it could be argued that they are. pinkjeeptours.com/las-vegas/our-tours/our-vehicles

@Iszi That must've cost them a pretty penny...

@Iszi Ah. so because it's a Chrystler, it is therefore a Jeep.

@tylerl No, I said it could be argued that it's a Jeep. Not that I would agree with the assessment. Especially with that paint.

FWIW: I see no actual Chrysler or Jeep branding on the vehicles.

I figure if they're going to get that fugly they might as well go all out and make a Pepto Pink Aztec.

@Iszi But it's clear that it's built on a Dodge Ram chassis.

@ScottPack Pepto Pink to remind you of what you need to reach for when you look at them?

It's just an overly hideous color.

Or rather, a Ram chassis, if they have been built since Chrysler dropped the "Dodge" for the Ram line.

@Xander Oh, c'mon... we're not really that pedantic around here, are we?

@Iszi Sorry, can't help myself.

Yeah, it's pretty well done that.

Also $200.

@Iszi heh, just saw that myself

@tylerl Chrystler? Is that a Chrysler on Easter?

@TildalWave It's the Jesus Car. Drives on water.

@tylerl That makes perfect sense given they only drive around in the desert.

@tylerl just because the water tends to reduce them to rust, that doesn't mean the red substance they're spewing out at the back is wine :P

it's still iron rich though :)

@TildalWave wine is rich in iron?

@tylerl red one is, isn't it?

Red wine is rich in tannins

@TildalWave helifino

at least some of the red wines here are ... terrano for example, but I'm not sure for others

@ScottPack man, are we gonna talk about it or drink it?

wow this is new to me: google.com/search?q=red+wine+rich+in+iron

@TildalWave talk about it. Unless you've installed the proprietary drink-over-ip browser extension

@tylerl I stocked up on it before Easter, so I dunno about you, but I'm drinking it :P Google says that Merlot has 0.7 mg of iron per serving, that's good enough for me

what's the suggested intake of iron per day? :)

@TildalWave Did you see that someone thinks the OneDrive file tweaking is a bug? How could that be?

@TildalWave ods.od.nih.gov/factsheets/Iron-HealthProfessional

ah... around 1 to 2 mg ... so, that's only 2-3 servings of Merlot

@tylerl Wait what? It says I need 8 mg, which is almost 2 bottles of Merlot LOL

@TildalWave chug chug!

@tylerl choo choo!

Jesus my head hurts.

I had salad today and some asparagus, so I think I'll be fine with less

@tylerl iron deficiency, surely :)

@TildalWave needz moar alkahol

or one strong serving of 9-iron to the head :))

@TildalWave Wouldn't that be more like a strong dose of titanium?

@DavidFreitag details ...

@tylerl I have discovered, through perusing their site, that one of the tours does use pink Jeep Wranglers. Guessing they then expanded into the big custom built things

@TildalWave Somehow i don't find that surprising.

@TildalWave I'm not a big fan of red wine. Too drying usually.

@DavidFreitag I do find it a bit surprising, because it's not like they could have expected that nobody would notice. If it's truly a "bug" then the accident was that they got caught, not that they've been putting tracking cookies in your files.

@tylerl Or they expected people to notice but didn't care.

@RoryAlsop yeah I have a feeling that when I did it (2007'ish IIRC) it wasn't those custom things. Was pink tho'

Woohoo implicitly typed arrays. Mmmm love dat syntactic sugar.

Here's cool live streams from the depths of the Gulf of Mexico via NOAA Okeanos Explorer: oceanexplorer.noaa.gov/okeanos/media/exstream/exstream_04.html

live screensaver :)

@TildalWave Very cool :]

why do we even have a hacking tag?

...y'know, that may be a good question. It's just a bit too late for me to decide. And there was another beer festival 48 seconds walk up the road from my house, so I am in no state to make competent decisions on anything

@RoryAlsop Mmm...Beer. Yummy.

I started this proposal for a CTF StackExchange if anyone is interested: area51.stackexchange.com/proposals/68005/capture-the-flag

@LucasKauffman you might like this vine.co/v/MiAMY06TDUY LOL

@RoryAlsop You make me sad.

@DavidFreitag That doesn't sound so bad. It's pretty common for people to start their second job in their late 20s or early 30s.

We have someone asking about THC Hydra on Unix & Linux, and no experts to answer. This guy isn't good at asking questions, so for all I know his questions may be crap.