« first day (1594 days earlier)      last day (3278 days later) » 
06:00 - 13:0013:00 - 22:00

Adi
6:36 AM
Here you go, the flip side of clueless parents
13
Q: I want to expose my 5YO daughter to boys and girls toys equally, but she just turned her nose up at Star Wars. What do I do?

hawkeyeMy aspiration is to give my daughter experiences of boys and girls toys. My background is that I work as a software engineer, and had experiences of lego, mechano, programming and sci-fi movies. I don't want to hold that stuff back from my daughter. She has decided at an early age (2) that sh...

 
6:58 AM
@Adi A post-natal abortion is the best option
 
Adi
7:41 AM
Advise your clients who use WordPress to disable comments until they push 4.2.1
Looks like 4.2.1 is available
 
7:59 AM
35
A: how/why does npm recommend not running as root?

ZedActually, npm does not recommend not running as root. Well, not any more. It has changed around the same time that you asked your question. This is how the README looked like on February 7, 2011: "Using sudo with npm is Very Not Recommended. Anyone can publish anything, and package installations...

 
@Adi I use wordpress :O :o :o
 
^ heh, zed knows the score
 
but I use moderation
 
Adi
@LucasKauffman Vuln.'ed
 
@LucasKauffman you're careful not to use too much Wordpress?
 
8:00 AM
@RоryMcCune yea I have an IPS in front and some other security detection mechanisms, plus some modified mod_security
but I need to migrate it
I'm just lazy
I want to migrate to what Terry is using
 
@LucasKauffman what's terry using?
 
that git stuff
 
Jekyll/Octopress?
yeah I use that too
 
yea
I just need to find a way to port some of my blogposts
maybe not all of them
but some
 
Adi
8:03 AM
Oh yeah, Jekyll is pretty cool
 
I'm going to try that then
curious if it works well
 
in theory it should do, after all it's just text data
 
Adi
Oh gaaiz, check the WordPress patch
 
@RоryMcCune yea but I have tons of code snippets as well
 
Adi
"SELECT comment_ID FROM $wpdb->comments
 	WHERE comment_date_gmt > '2015-04-26'
 	AND CHAR_LENGTH( comment_content ) >= $content_length
 	AND ( comment_content LIKE '%<%' OR comment_content LIKE '%>%' )"
Exploit = Cleaned!
Exploits used before the 26th? Eeeh, who cares!
 
8:12 AM
I looked at the change log and thought it was a interesting fix…
Just delete all comments that are broken created after the time we introducted the bug/bug became known.
It's a clear "oh shit lets use the auto updater for evil" I think
 
Adi
@BarryCarlyon Well, in their defense, the patch does introduce limiting new comments to 63kb.
 
Indeed. I just thought the DB upgrade steps were odd. But I think they did it since the bug was publically disclosed before the fix was deployed/released.
The site with the disclousure on it is dated the 26th
 
Adi
I'm a bit conflicted here. Klikki have been contacting WordPress since November. Even the Finnish national cyber security agency contacted them about it
 
Fix dropping late last night on the 27th (uk time)
 
Adi
and they didn't fix it
 
8:16 AM
That bit I wasn't aware of.
 
Adi
yet I'm still annoyed that Klikki made it public before the update
Which, when I think about it, wouldn't have happened if they didn't go public
 
I grumble enough when WordPress deploys a new update and it takes like 20 minutes to an hour before the tag is on SVN
 
@Adi perhaps they were "inspired" by google
and hey they gave wordpress waaay more slack than google do on their advisories
 
Adi
I'm still waiting for WordPress' side of the story
It sounds a bit strange to me
 
-5
Q: Is the host OS and data 100% safe if I install dangerous cracked software in Virtual Machine?

AnnieThere are two "hack" software core which are Bol and L# for the game LOL, the software let the player to semi auto or total auto in game by running scripts. There were people used Bol and somehow Bol format their whole harddisk. L# is going to switch from free to monthly paid service soon so I ma...

I know this is a dupe but can't seem to find the post on security of host machine from VM exploit:
Anyone have better search-fu?
 
NINJA ADI
 
Adi search-fu too stronk
 
Lol
 
Adi
@LucasKauffman Sounds like Estonian accent
 
8:25 AM
I blame search being difficult on a phone
Thanks
 
@Adi yeah doesn't sound particuarly good for them, if they have been ignoring hackerone that kind of ruins the point of hackerone
 
Adi
@RоryMcCune Which is why I find Klikki's story a bit weak
Does WP have a history of doing that in other cases?
 
@Adi I don't explicitly recall hearing that but I don't particularly follow wordpress sec. too closely...
 
I want to ditch php asap
just because it's php
 
In this case you can't really blame php
 
8:31 AM
@CodesInChaos It's always PHPs fault!
 
Adi
We really need to have a bot here
Well, or use stars better
You know, to highlight important news/links rather than comments about penetration
 
I'm using Hipchat now for team collaboration
it's pretty neat
 
There are important news?
 
Adi
:|
 
@LucasKauffman you mean corp nonboration
or team corplaboration
it was pretty neat 15 years ago. in 2015, it is a big sucky pile of suck.
@RоryMcCune I see we follow a lot of the same twitters ;-)
 
8:38 AM
@AviD heh indeed. Interesting to see that the problems with this stuff have been known/discussed for 4 years yet they're largely still present.
 
yeah.
 
@AviD :o
 
it used to drive me crazy at typical big corps, like $BIGBANK, where I do another test 6 years later and find the same damn things I found the first time around
 
@AviD Either you're cynical or I'm still too positive :P
 
-2
A: Google: "Unusual traffic from your computer network"

mehi figured it out. it's not me. it's everyone else.

@LucasKauffman both. its incredibly sucky compared to better solutions today.
 
8:40 AM
@AviD ha, we used to start putting in constraints in pentests, like not using overflow exploits to get domain admin, just abusing misconfigurations
 
@Adi all I've seen on Twitter is "yay they fixed it quick" things seen cagey overall
 
as much as the vitriol against e.g. Slack is justified, they are sooooo much better than hipchat it is almost ridiculous to compare.
 
I do think slack is nicer than hipchat. But Hipchat does have video calling baked in
 
o_O
 
Adi
Imagine all of us, 24/7, on group video chat
 
8:42 AM
To the google hangouts.
 
Adi
> Oh, hai gais! I just woke up. Making breakfast
 
@Adi kinda like working at a typical open plan office, right?
 
Which doesn't do enough…
 
like Facebook.
 
@AviD we just started using it yesterday for a team of 3 people working on a single framework
 
8:42 AM
@Adi would need to put on pants.
 
A nice proper group video chat should be doable these days with decent drop in/out
 
@AviD yea and then just shouting and making phonecall all day, not putting your phone on mute
classic
 
Adi
@AviD I'd need to put underwear on
Somebody is cybering with me
 
Adi
So you can see my hands
 
8:45 AM
I can't see you
 
Adi
Now you can
Why do you keep asking me to take my pants off
 
gonna reload I no see :-P
Works firewall might be being a jerk. I jsut get a black box top right
 
Adi
I get a blackbox instead of you as well
I thought that's how you normally look
 
Adi
I guess me taking my pants off went unseen :(
 
8:48 AM
Awwwww man…
 
Adi
Don't worry. Soon I'm starting my nudist YouTube channel
 
I do like it's use of the sublime engine tho
(Yes I'm magento/wordpress by day)
 
@BarryCarlyon you seen the recent magneto vuln? its a doozy.
 
Indeed.
I'll just take over your WHOLE store
Whats funnier is the guy I gave up trying to help installing the patch over on mageoverflow
So far for the patch I've received 3 admin messages and an email :-P
I do tend to keep up with the SUPEE's as they come out.
 
9:03 AM
@LucasKauffman BTW if you're planning on using Jekyll I'd wait till v3 comes out which should be relatively soon..
 
@RоryMcCune I'd be careful of those later version, at some point it changes to Hyde.
Ha. Ha. Hardy Frikkin Har.
 
@AviD you know someone will have come out with a package called hyde
 
but of course. Us programmers are a hilarious bunch, with an original and surprising sense of humour.
especially the open source ones.
 
9:20 AM
@RоryMcCune Hyde already exists.
Jekyll theme I'm using for my blog: github.com/poole/hyde
 
@TerryChia yeah the darn copycat pythonistas
@TerryChia it's also a python static site generator apparently
 
Ahh. Did not know that.
 
9:36 AM
see? damn original, dem opensourcer coders.
 
@AviD meh why qualify, all coders. I was looking at Microsoft WebAPI 2 last night and was just thinking "this is what rails was doing like 8-10 years ago"
 
Hurr Durr Ima Sheep
 
@RоryMcCune except webapi does it with more awesome.
 
@AviD mmm? how so?
 
that's MS thing, doncha know? Let others figure it, then swoop in and do it better.
 
9:39 AM
@RоryMcCune less hipster more enterprise.
 
@AviD nicely framed
 
@RоryMcCune like .NET and Java.
 
@TerryChia you're right they should really be doing artisanal Erlang frameworks with small batch ethically sourced haskell plugins
2
 
@TerryChia @RоryMcCune this exactly.
hmm, I think @TerryChia may have been dually mocking?
 
@AviD yeah double whammy
 
9:42 AM
@AviD Two birds, one mock.
 
@TerryChia except that it wasnt a good burn. it was solid.
urggh @RоryMcCune @Adi appsec not looking good. :-(
 
Adi
@AviD Warum?
 
I might be in Amsterdam that week with no possiblity of coming to the conf. Major bummer.
salute!
 
@AviD you can at least meet up for beers no?
 
I have to check the timings, I might at least be able to join the evenings.
 
Adi
9:47 AM
@AviD "timings"
knobhead!
 
@LucasKauffman hope so, though of course wont be able to have too many - need to wake up early and stand in front of a class all day, cant risk hangover...
@Adi what?
 
@AviD just tell them you need to check with the "Security training advisory panel" in the evenings
 
Adi
Of course you can make time for a beer
 
@AviD where you teaching? I might be able to pop down to Amsterdam, it's only a two hour drive
 
as in, how the times work out, vs. distance from the conf, etc
@Adi oh sure, at least that
 
9:48 AM
but parking is mucho expensive in Amsterdam :(
 
@LucasKauffman not sure on the details yet, working it out now
@RоryMcCune lol, excellent, I love that
@LucasKauffman are you planning on going to appsec?
 
probably can't
can make it for the evening but probably not the conf
it will depend, if I get lucky I can plan in a closing meeting then
 
@LucasKauffman same same
 
because I still have some engagements running there but they're all closing
 
oh man, Imma need somebody to collect all the swags for me!
 
9:53 AM
Amsterdam isn't great for beer tho
Although they do have La Chouffe on tap quite often
 
@LucasKauffman I have to be careful with that. last time I wandered around Amsterdam looking for a pub, I followed the shiny red lights.
 
@AviD hahaha, you ended up in the banana bar?
 
@LucasKauffman "banana bar", is that what they call it?
 
I've heard of this establishment
and I sure ain't clicking that link
 
9:56 AM
ah no, the other red lights... trying to figure out where the entrance is, and why everybody has their windows right on the street... I did realize just in time, though it was a little uncomfortable walking briskly away from there.
 
@AviD hahaha, it's quite touristy
@AviD without joking, I had one of my clients taking me there to visit it, she used to live right next to it
 
dem dutch be karaizey
oh man! I am SO bummed by this, gonna be RIGHT there and wont even be able to catch a keynote.
not even a single session at all.
 
@AviD beer session
I also know a nice sushi place there
 
@LucasKauffman heh, well, of course.
 
@AviD do you eat sushi?
 
10:01 AM
@LucasKauffman me no can do, I'll be brown bagging it.
 
brown bagging it?
 
@LucasKauffman in general, yes, but I doubt that place is kosher.
@LucasKauffman i.e. bringing myself a packed lunch.
 
@AviD ah you need a kosher meal?
ah I see
 
indeed
 
I'm not sure what the size of the jewish community is in NL
I know it's easy to get in Antwerp
 
10:02 AM
hey @RоryMcCune
Sorry, I'm so bad at replying on here
 
@deed02392 watcha'
 
I always have too many tabs open to see it
 
there are some, if I was there for a long time, or over the weekend, I would order in - I've done that there before
 
How are you?
 
just for a few days, not worth bothering
 
10:02 AM
@deed02392 heh yeah it's like the IRC channel, ends up hidden behind stuff
@deed02392 not bad. Making a trip to sunny leatherhead in a couple of weeks
 
10:35 AM
oh awesome!
we'll finally meet
the trouble is it doesn't change the favicon to let me know there's a message waiting for me
 
we can extend the verification
I was verified by RoryM who also verified Adi and RoryA and Marion
RoryA verified Avid
I verified Terry
I think Scott verified Iszi, but I can't remember if Iszi or Scott got verified by anyone else
 
@LucasKauffman @ScottPack was verified by his own beard.
 
I've not seen @Iszi or @ScottPack in a while
 
\o/ BEARD \o/
 
Adi
10:56 AM
What's the idiom on showing someone something before showing it to someone else?
"Hey, I just want to XXXX this by you before I show it to Tom"
Oooh, run by
yes
 
does anyone here have wubikey?
yubikey?
because I was wondering, can you collapse it?
 
Adi
@LucasKauffman I have an ePass2003
Almost the same :D
what do you mean collapse it?
 
like collapse the usb drive bit
so it's protected
I want a FIDO compliant key
so either ordering a yubikey
or an alternative that does FIDO
 
Adi
I'm sorry, I don't know what "collapse" mean here
 
@Adi as in move the USB part inside the key so it's shielded from the outside
 
Adi
11:01 AM
Protected from?
Snapping?
As far as I know, that thing is tiny. I don't know what you need to move where
2
When I saw it with a coworker, I didn't believe at first
 
@Adi that's a nano, I was going for a standard
 
Adi
Oooh. There's more than one version?!
I had no idea. I only saw that one
 
@LucasKauffman Trust is not transitive
 
@LucasKauffman @Simon has a wubwubkey
2
 
Adi
We need a verification chart.
Was @Lucas verified by anybody?
 
11:07 AM
@Adi oh I didnt realize you were already insulting @Simon.
 
Adi
Other than @Terry
 
@CodesInChaos you never heard of Web of Trust?
what kind of cryptobeargrapher are you?
 
@Adi RoryM
 
11:30 AM
@AviD Trust not being transitive is the main reason why web of trust doesn't work well.
When I verify somebody idenity, I'm not attesting that they're trustworthy.
And even if I trust somebody to be non malicious, that doesn't mean that I trust their judgment.
 
@CodesInChaos this so much!!
 
@CodesInChaos isn't that fact that key signing parties is the least fun type of parties why web of trust doesn't work well?
 
I keep ranting about browsers talking about TLS certs in terms of "trust this website" Just cuz I know who you are, doesnt mean I should trust you!
 
@AviD "knows who this particular CA claims you are" will be more accurate.
 
11:45 AM
true. Or, "any CA" really, since noone ever checks which CA it is...
 
@deed02392 yeah if you have audio on it pings you...
 
Reminds be of a bitcoin ponzi a couple of years ago. The scammer had pretty high WoT ratings. Some by his cronies, some because a ponzi pays out until the operator decides to quit.
 
isnt all of bitcoin pretty much a ponzi?
 
12:02 PM
@AviD I was waiting for that comment.
 
12:23 PM
@AviD WUBWUBKEY <3
Is it a MIDI controller?
I'm tempted to add a prefix to my name.
That would screw you guys up.
 
its the same as a yubikey, but instead of authentication it just plays some horrible music.
 
pls
You guys have 10 minutes to get some signatures in your petition, otherwise I'm adding a prefix to my display name.
 
Simon is now known as pls Simon
 
@Simon dooo it add 🍩 as your prefix
then we can just go @🍩 and it'll find you
 
@RоryMcCune ô_ô
 
12:32 PM
This is the best idea.
 
@CodesInChaos Very good idea but I'm still unsure.
 
@Simon 🍩🍩🍩🍩🍩🍩🍩
 
soz
SYNC YOU GOD DAMN SYNCLESS THING
 
@Simon I can't believe I went to the hassle of finding you the perfect name prefix and now you wont use it!
 
:D
You may call me an ungrateful bitch.
Or maybe that's a way of protesting due to the bad spelling of "donuts".
 
12:37 PM
@Simon well that and I wanted to wait for you to do it, then I'd point out that it's the unicode "Doughnut" symbol fileformat.info/info/unicode/char/1f369/browsertest.htm
:)
 
IT'S EVEN MISSPELLED ON THAT PAGE
 
what about 🍁 instead?
 
It's a square!
 
@Simon that's amusing. your canadian browser doesn't support unicode maple leaves...
 
:(
 
raz
12:40 PM
@RоryMcCune ahahaha
My American browser doesn't support silly symbols
 
all pls
WHEN WILL MY DAMN NAME SYNC IN DA CHAT?
 
what the heck backward browser are you two using?
 
raz
"Oh don't mess with Canada! They'll.... dry up and blow away!"
 
When its time
 
Is it time yet?
 
12:41 PM
it shall not ever
 
raz
It is time
 
you only changed it on sec.se, not on chat.se
 
o
HOW DO I DO THAT6
OH MY GOD FUCKING KEYBOARD
 
also - incredibly stupid. quick change it back before anyone notices.
 
12:41 PM
I DON'T WANT CAPS LOCK TO ACT AS SHIFT
 
not to late to save yourself the shame
also I think you are misusing the term "addicted"
 
I DON'T KNOW HOW TO CHANGE IT
 
raz
Simon stop yelling
 
soz
 
@raz HE CAN'T HEAR OVER ALL THE ACIDIC WUBWUBWUBBING
 
12:44 PM
WUBWUBWUB MOTHERFUCKER
 
@RоryMcCune I never really do though annoyingly
 
@deed02392 yah benefits of home work, no problem with sound/music :)
 
raz
@AviD I was wub wub wubbing his mom last night
You know.. when that BASS drops!
 
all
I don't know how to change my name here.
I suck.
 
raz
Why do you want to change your name?
 
12:53 PM
@raz because he sucks.
he's trying to distance himself from his own reputation.
 
@raz Because I often see new or old users who are also named "Simon" and believe it or not, I'm afraid that their actions will make me look dumb.
 
It'll never work, though. Because he sucks.
 
For example:
You cannot conclude that the password was stored in plain text, but please note that being not hashed does not exactly mean that the password is being stored in plain. It's possible that some (reversible) encryption is used, but from a security standpoint it's almost the same as being stored in plain text. If someone gains ilegitimate access to the server's database to obtain the "encrypted" version of the password, they're equally likely to be able to obtain the private keys to decypher it. The only thing you can conclude is that you should never trust an administrator. — Simón Apr 1 at 6:34
 
@Simon ...
 
Fucking useless comment is useless and I've also said that in my answer.
 
12:54 PM
@Simon but.... wait. you....
 
@Simon I am certain you're better at that then them.
 
@CodesInChaos pls sir
 
@CodesInChaos hahaha thank you, that is what I was trying to say
@Simon why is that useless? it is completely correct, and often an important distinction.
once again, you just did a better job than he did.
 
@AviD Is it? The difference between "plaintext" and "ciphertext + key" is rather small.
 
@AviD Yet he felt the need to add his grain of salt below my answer, for whatever reason.
 
12:56 PM
it is a factual difference, not a threat one.
and for that matter, the threat tree is different too.
@Simon "better job" of making you look stupid.
 
MY NAME WON'T CHANGE HERE HELP
 
It's nitpicking. Plaintext or plaintext equivalent -- who cares about the difference.
 
@AviD oh pls no.
See, even CodesInDonut agrees.
 
@CodesInChaos well, for one, if you go complain to the company that they are storing it in plaintext, dem consultants will turn around and say "NOPE!"
secondly, there is still a non-trivial threat scenario that is protected in one, but not the other
 
It's like storing the key under the door mat.
 
12:58 PM
e.g. consider an SQL Injection attack that can only pull out all data from db tables.
 
Oh noes, dem SQL injection
 
so you have the password / encrypted password - but no access to the key.
so yeah, if the server is violated, then the key is accessible, no difference.
 
I'm a hipster and use mongo, so I don't have to worry about SQLI.
 
malicious insider / administrator - no difference.
@CodesInChaos ha! well played.
 
I only need to worry about the DB not giving a damn about consistency.
 
12:59 PM
Why don't both of you get a room?
 
06:00 - 13:0013:00 - 22:00

« first day (1594 days earlier)      last day (3278 days later) »