« first day (1715 days earlier)      last day (3170 days later) » 

1:42 AM
@Iszi It's true. I used to be much higher but with The Comms Room moving to Slack my overal chat participation has been slipping, causing me to drop down the ranks. Incidentally, I also comprise nearly 25% of the overall instances of the word "fuck".
 
 
5 hours later…
6:41 AM
@ScottPack huh, the Comms Room is moving to Slack? That is... interesting, I guess?
 
7:12 AM
Hi there
@AviD can they do that?
 
@M'vy apparently... I am curious what that means.
 
@AviD I am also curious why
 
They should also move to Quora, while they're at it.
tbf, Slack is all about the chat, so it is understandably more full featured.
and I'm sure all the SE plugs would be easy to customize and slackbotify.
 
everyone seems to be on slack these days
shame they don't offer a self-hosted option
I can only imagine how much sensitive company information is not lying around in slack chat rooms
 
7:27 AM
@RоryMcCune heh, I've been using it for OWASP lately...
 
@AviD ah I saw the rooms but hadn't chipped in on them much as yet..
 
the one annoying thing there is they configured slackbot pretty aggressively.
 
@AviD what so it tells you to smeg off a lot?
 
anytime anybody says the word project, development, test, etc, slackbot jumps up to shout links about it. crazy.
 
@AviD yikes
 
7:31 AM
yeah... and anything that is like the name of a specific project, gets that link too
like I said, aggressive
cursing the slackbot is a common pasttime.
 
So is cursing the simon to be fair…
 
8:36 AM
Simon is Slackbot?
 
@RoryAlsop that... explains.... EVERYTHING!
 
8:57 AM
@AviD: has moved
There's some decent full featured DIY alternatives. I used to run an instance of maiou.
 
9:49 AM
@RoryAlsop nah, Slackbot is more intelligent.
 
 
2 hours later…
11:47 AM
@AviD inb4: pls
 
heh. Maybe we can get @ManishEarth to rig up a SimonBot for the DMZ...
 
now that is the definition of sleeping through all of your alarms
 
@kalina well I guess you'll have caught up on your lost sleep anyway!
 
I still have a sufficient amount of sleep debt to go back to bed and sleep until my next birthday
 
@kalina that could be anywhere from 12 hours to 364 days and 12 hours
 
12:03 PM
it could
although I'm pretty sure my birthdate has been mentioned in chat more than once
 
possibly there is a lot of history in chat
 
@ScottPack WTF? When did The Comms Room move to Slack?
 
@kalina I assumed that was just a cunning bluff to throw us off the scent (as we know Taylor Swift's official birthday)
 
who knows
 
you
:-)
 
12:10 PM
well, other than me
I'll tell you what I do know
I'm looking at my monitor setup and concluding that I really don't want to dismantle it
so I reckon I'll just pick up another monitor on the way to gaming
 
@kalina Hoping to have my new PC parts delivered today. Not ordered the monitors yet - price not quite right, but no rush on them
 
not that I'm all that motivated to even move atm
bed so comfy
.oO( drifting back to sleeps )
 
raz
Wow this question is GOLD
-3
Q: Tunnelling for security

moziemozieI want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS How to do dis? EDIT: Software I am using is notepad.exe I have tried to do Document.Cookie but that didnt work.

 
@raz Why does there have to be a delay on the "flag for deletion" option?
 
raz
@Iszi A delay?
 
12:34 PM
@raz Yeah, I think a question has to have been closed for two days or so before you have the option to flag for deletion.
 
raz
Ohhhh, I never realized that
 
Is anyone else finding this comment exchange a little odd, especially considering the homonymous names?
0
Q: Why are discovered vulnerabilities of suspicious/illegal online software published?

JosephFor example, the Tor network has recently been hit by a reveal of a major exploit in a research paper. Isn’t publishing the details on the exploits completely counter-productive as the developers of Tor can then find the exploit and issue a fix? Would it not be better to not publish a paper and...

 
raz
Yeah I thought he was having a conversation with himself at first.
Then I realized the distinction
 
@raz I'm still not convinced he isn't.
 
1:03 PM
@RoryAlsop @AviD My flag for this question as off-topic has been declined: security.stackexchange.com/questions/97414/…
So, InfoSec.SE is now the official support forum for Hydra?
Good to know!
 
@Simon next time you complain about a question or flag in the form of "So, InfoSec.SE is now X for Y? Good to know!", I swear WILL ban you from chat.
now, about that question, I think you are not wrong.
 
@AviD What about if we complain about @Simon in that form?
 
There have been a lot of good flags that have been declined lately.
@raz can tell you all about it.
 
@TerryChia Dunno, give it a shot? I might have to ban him anyway.
@Simon ooo you're no happy with your new moderator-elect.
 
And I'm trying to find a good question to do with X Y thing.
 
1:07 PM
@Simon Your face is a X Y thing.
 
So, InfoSec.SE is now the official support for Cloudflare's free SSL options?
 
lol boy here WANTS to get hisself kicked.
 
1
Q: Cloudflare's free SSL options require trusting them, what could they do to change that?

BreakhtySo Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. This article explores the shortcomings of the Flexible and Full (non-strict) SSL options: https://scotthelme.co.uk/cloudflares-great-new-features-and-why-i-wont-use-them/ The Full Strict SSL option encrypts cl...

 
methinks he doesnt believe I'm serious.
 
I hate my new job, let me have some fun in here at least.
 
1:08 PM
oh heh, almost missed that.
SO close.
@Simon really? bummer. Why?
 
raz
Yeah I don't get the declined flags lately
 
@AviD Was supposed to work on X thing, spent 2 hours and a half in 2 months on it and have been doing YZABC.
And needless to say that YZABC stuff sucks.
 
For the record, those wondering why I did not follow through with this chat.stackexchange.com/transcript/message/23707538#23707538 reagarding this chat.stackexchange.com/transcript/message/23707594#23707594, is because it was not of the complete form.
 
I'm also always on a fucking timer "you gotta complete YZABC in Q hours".
 
@Simon ooh, I've been there.
and you keep hoping it will change when things settle down. But, spoiler alert: they won't. Not ever.
Not for you, anyway.
 
1:10 PM
I miss my old job where I had more responsibilities and was almost never stressed out.
 
@AviD Doesn't "X-elect" only apply during the period after the election, but before the inauguration? I think we're past that now.
 
@Iszi hmm, you could be right.
 
I know, I'm now the official guy for YZABC and will always have to deal with it.
So, yep, fuck this place.
 
@Simon that is exactly what I had when I was at $HIPSTERSTARTUP last year. My mistake was starting with YZABC instead of focusing on X to begin with.
 
raz
@Simon We had a guy looking at a bug for a month. He didn't do anything. My boss gave it to me, in 2 hours I did more than he did.
 
1:11 PM
that ship hath sailed.
when you leave, and are replaced, your replacement will go straight to X, because they will have realized that YZABC is either irrlelevant, unimportant, or solved by X anyway.
 
raz
@Simon Dude don't get pidgin holed, if that shit happens gtfo of that place ASAP. You can rot down that rabbit hole if you're not careful.
 
@AviD Yeeeep.
 
@AviD Good to know!
 
@raz Thinking of emailing my ex-boss big time.
 
raz
All of a sudden you'll wake up 10 years from now hating life.
Take that experience and go to a better YYZ company.
 
1:13 PM
@raz That's "pidgeon-holed". I'm pretty sure a "pidgin-hole" would be something completely different, though I'm not certain exactly what it would be.
 
@Simon no, that's worse.
 
raz
@Iszi I'm an enjaneer, I'm not paid to spell!
 
@Iszi yeah, but I like his version better.
 
@AviD Meh, the only "decent" reason I had was to leave was that I wanted to concentrate on web development.
Now, I miss configuring servers.
 
so, get another job.
remote, if need be.
 
raz
1:14 PM
@Simon Turns out there's a ton of companies that do web development.
 
they can mail you your donutsalary.
 
raz
^^
 
Meh, not sure if I strictly want to do web dev now.
 
@Simon Reminds me how I moved out of desktop support and into IT Security to get away from stupid people. Now, instead of just dealing with a bunch of random stupid people, I have to deal with the same stupid people every day. Not sure which I prefer, really.
 
raz
I'm not sure if I could handle IT Security
I feel like I'd get fired in 2 hours.
 
1:17 PM
@Iszi I'd probably prefer to deal with different dumb people than the same group.
I'm hesitating to join a $BIG_CORP though.
 
raz
DAMN IT. The Scapy doxygen page went away :(
 
I just want to be at peace when I come back home and not ever have to worry about working on evenings/weekends.
And not be on a fucking timer.
 
@raz oo I like me some Scapa.
not my favorite - it's a bit, raw, I guess would be the word, but still very enjoyable.
 
raz
I have a feeling we're talking about two different things
 
@raz no, same thing. I know my opinion is not popular, but I still prefer the Islays.
I'm sure that @RoryAlsop can tell you more about it's qualities though.
 
raz
1:25 PM
... I have no idea what you're talking about.
 
I DON'T KNOW WHAT TO DO WITH MY PROFESSIONAL LIFE
HA, ME A PROFESSIONAL!
I can do the pls dance like a pro.
 
@Simon GET A HAIRCUT AND GET A REAL JOB
 
raz
@AviD lol
Scapa might help fix my anger
Definitely not the same thing as Scapy
 
@AviD by real job you mean .NET developer don't you..
 
I shave my hair and leave about half an inch.
That's a good haircut.
I tried to find a job as a junior InfoSec donut but there are quite rare in the area I believe.
They're looking for 150 years of experience minimum.
 
1:30 PM
@Simon pen test companies tend to be less picky 'cause there's a shortage of staff in most places...
 
o
 
@Simon hell look at some of the reprobates who got into security consulting in here :op
 
Yeah like that bald guy, lulz.
I'd say that I have the basics nailed down but I'd still need a company willing to teach me a lot.
I've never done an actual pen test.
I should probably look for that kind of job instead of going back to my ex-employer.
 
@Simon if you ask @LucasKauffman or @Adi they could likely telly you about the OSCP which could be a useful intro to the work/get you a leg up into it..
 
> CLEAN YOUR ACT UP AND DONT BE A SLOB
> GET IT TOGETHER LIKE YOUR BIG BROTHER BOB
 
1:35 PM
@RоryMcCune This is most-likely what I'd like to do: offensive-security.com/information-security-certifications/…
 
@Simon yeah I've not seen as much about that one but likely it'll be along the same lines
 
@Simon YES. can even do remote, for many jobs
 
Not sure if I'm ready for a remote job though.
I'd have to get a new apartment.
 
@RоryMcCune I meant this, btw:
 
@Simon If you're getting into an industry I wouldn't recommend shooting for remote initially
you'd be better off being in an office
 
1:37 PM
That too.
 
@RоryMcCune yeah I guess, if he still needs to learn the ropes.
 
@Simon Deloittes have security people in Montreal
 
@RоryMcCune though most often he would be sent out to the client...
 
@AviD for web app. testing , a fair quantity is remote
so can be done from the office
 
Dayum, you gotta pay more for X days of lab access.
 
1:39 PM
@RоryMcCune depends - the big corp-ish consultants often have big corp-ish clients that insist on it being done onsite...
 
30 days is probably not enough if I'm working full-time at the same time.
 
@AviD could be, we do work for some pretty big co's and it very much depends on the type of test. Annual tests of prod. sites are usually remote
sites in development vary
there's a lot of cloud hosted stuff these days
A LOT
so with that it doesn't really matter
one of my first checks with new tests now is "Is it Azure/AWS hosted and have they gone through the auth process"
 
"doesnt matter" != "client doesnt care" ;-)
 
@AviD sure, just giving my experience of testing :)
 
I had a client insist on flying me international to sit in a closed office to test a site that was in the cloud. Wasnt even anybody relevant local there to talk to....
@RоryMcCune sure, now I would insist on working smarter. I.e. lazier.
 
1:42 PM
@AviD yeah I find with some, that just charging more for on-site and then charging expenses on top of that discourages them if it's pointless
 
What does a pen testing job typically involve anyway? Do you have to complete the pen test within X hours?
 
@RоryMcCune yeah. At that point I won't mind as much, since I'm getting paid enough extra, AND they know what they're paying for (the warm fuzzy feeling of me holding their hand while they go to pee.)
@Simon timewise, there are usually 2 constraints: Calendar-date ("I need this report by tomorrow!"), and billable hours. I.e. the client agreed to pay X, you aint gettin paid for more time than that.
depending on balance, often we would load up more pentesters on the project to finish the same amount of hours quicker.
was more tricky from a project management perspective, but I never claimed that was efficient.
 
@Simon so typically you get a period of time to complete a test and write a report. For me that varies between 2 days and 10 days with the odd outlier
@AviD yeah that happens a lot and I get sufficiently annoyed that I feel like buying people copies of the mythical man-month
@Simon so for a web app test I might get a couple of sets of creds and a URL of a login page for a site and 3-5 days to assess it
 
I see!
 
@RоryMcCune yes exactly. when I was at $CONSULTING_COMPANY I often quoted that for them...
that said, in very large, complex systems, sometimes it does make sense to slice it in chunks.
 
1:50 PM
@AviD the best quote I saw was to suggest that They also get nine women pregnant so they can get the baby in one month
@AviD sure where there's easy divisions, but you still need to allow more time for collating the report, which rarely happens
@Simon deliverable is the report (in most cases) so you will likely learn to love/hate word. More modern companies might do things like have you file bug reports, but honestly I don't see that much
 
@RоryMcCune yeah..... UNLESS you have one person that is particularly suited for writing up reports, and less for the hands on testing itself... and fantastic pentesters who cannot write a report to save his job.
yes, been there done that.
 
I wonder how long it takes to complete the certification if you take a class beforehand.
 
@AviD as long as said fantastic pen tester is good enough at communicating with the rest of the team so they know what the findings are....
 
@RоryMcCune In non-corp-ish places I've moved them to Excel, so that is kinda a compromise.
@RоryMcCune yeah
 
@AviD we have a thing that autogenerates an excel summary from the word report :)
@Simon the OSCP is interesting, you take the course over a period of time then the exam itself is a 24-hour excercise..
 
1:53 PM
not even just a summary, the whole thing. like a list of bug reports.
 
@RоryMcCune Whoa.
 
@Simon so I guess the webby one may be similar
 
Maybe I should do the OSCP one like you said though.
 
@Simon well no, if you want to do web app. testing that OSWE one sounds better
 
Ahh, well yes I do seem to have an affinity with web but I also like web servers hardening very much.
 
1:56 PM
@Simon well OSCP goes into binary reversing and stuff
as I say @LucasKauffman and @Adi are your people for that.
as IIRC they've both done it
 
Murnin
 
@Adi @LucasKauffman If one of you lads can tell me about your OSCP experience, I'd appreciate it.
 
2:13 PM
hello
@RоryMcCune limited binary reversing, it's more or less altering shellcode, OSCE is more the binary reversing
@RоryMcCune to buy the OSCE you actually need to pass a binary reversing test :P
 
@LucasKauffman Wow, it looks very intense!
 
@Simon It's known to break donuts
 
I think OSWE is most-likely what I want though.
 
2:30 PM
> I want to tunnel HTTP over DNS over IPSEC over PPTP over Telnet over PNG (imbedded via Steganography) over HTTPS
 
raz
@RоryMcCune As well as me
 
@M'vy that one's good.
 
raz
@M'vy Don't forget that they're using Notepad
 
@raz :)))
technically, it could be feasible. Though really a pain in the ***
 
raz
19
Q: A design update is coming!

Stéphane MartinMost of the changes won’t be visible; these tweaks go along with recent updates that were made to Stack Overflow: We are moving the site's CSS to a newly refactored LESS system, so that it's easier for us to fix SE network CSS bugs globally and launch new features in the future. We are updating...

@Simon They've got 4 days
 
2:35 PM
@raz Definitely going to call them out on September 1st if nothing has changed.
 
Does anyone know how they hacked Ashley Madisson?
I can't seem to find the technicalities
 
@LucasKauffman I presume there's a missing "how" somewhere in there?
 
@Iszi between know and they?
 
@Iszi ... Are you going mad?
 
@LucasKauffman That's what I was figuring. Unless the question was meant to be different?
Wait, WTF?
I could swear that didn't used to be there - but there's no edits?
 
Adi
2:43 PM
@LucasKauffman Two theories so far
@Lucas There's this ibtimes.co.uk/…
 
I need to get my eyes checked, or change my ADD meds, or both. And probably something else. Like medicinal marijuana.
 
Adi
Both seem to be plausible, but Krebs' is more convincing
 
@Adi yea but Krebs says who did it not how they did it
I'm just wondering if it's rogue employee or social engineering
 
2:46 PM
@Adi What if Krebs said what McAfee said?
 
Adi
@Iszi Word for word?
 
@Adi Now, let's not talk crazy talk here.
 
Adi
@LucasKauffman Well, if Kerbs' analysis is correct, then it's probably social engineering
if McAfee is correct, then it's a rogue employee
But, to be honest, I'm leaning towards a rogue employee either way
 
 
1 hour later…
3:53 PM
@AviD Scapa is indeed very nice. It is the 2nd closest distillery to the house where I grew up. But it has generally been a part time distillery, unlike the Highland Park. It also takes its water from the other side of the Pomona divide and has a distinctly different flavour
@RоryMcCune some of whom we know, I think
 
4:09 PM
@RоryMcCune and @AviD - news.stv.tv/east-central/…
 
HAM Sammich!
What's going on in wacky town today?
 
4:34 PM
@JukEboX i'm losing my marbles
 
@Ohnana what's wrong Tootles?
 
@JukEboX schoolwork
 
Yeah feel bad for kids going back to school already.
 
i'm in finals week
fuck those people lol
 
Finals?
Graduating soon then?
 
5:17 PM
@RoryAlsop @RоryMcCune you guys should team up to make a Rory whisky
 
5:40 PM
@JukEboX i'm a sophmore
my school does classes all year round
 
5:53 PM
@LucasKauffman - I have already distilled one and it has been in cask just over a year.
Another for years before it becomes whisky
 
@RoryAlsop "Rory: single Barel"
 
American oak Bourbon casks, lightly smokey, lightly peated
Mmmm
 
@RoryAlsop pls taster pls :3
@RoryAlsop you could call it "Rory's Lockerby's single barrel, still smoking"
 
6:38 PM
@Ohnana College?
 
raz
your mom goes to college
 
@raz LOOL YESS!!! Someone else who gets that!
@raz give me some tots
 
raz
EAT THE FOOD TINA
 
6:59 PM
@lucas - in four years I'll have 75 bottles of the stuff :-)
 
@RoryAlsop Nice!
 
7:18 PM
Bret Copeland on August 27, 2015
There are lots of domain-specific languages for schedules. The most prominent might be Cron (for *nix scheduled tasks), but there's also RRULE (for iCalendar events) and many others. Cron isn't exactly what I'd call human-friendly. Can you tell me what 10 8,20 * 8 1-5 means if you don't use Cron often? Some DSL's go in the opposite direction and are wildly verbose, or will sacrifice expressiveness for simplicity.
 
7:43 PM
@StackExchange SHUT UP I HATE YOU
 
@Simon You're just mad because you don't have new profiles yet.
 
raz
7:55 PM
@DavidFreitag 4 days, and the HELL WILL RAIN DOWN UPON SE
 
@raz wat
 
raz
@TildalWave By the end of August 2015 (see, I said 2015 :) ) — Stéphane Martin Aug 6 at 7:11
That we should have the new profile
4 days
And that post will be downvoted so hard @Simon's mom will fall off her pole
 
@raz He never did confirm which era, or standard calendar, "2015" was referring to.
 
raz
@Iszi I hate you
 
oszi pls
When communicating with other humans, it is best to use the very same era that we live in and the standard calendar.
 
8:00 PM
@Simon The era in which we live is defined by the standard calendar, and the standard calendar may vary depending on the reader/speaker unless it is specifically defined.
 
@Simon Once again, you have made the false supposition that @Iszi is human.
 
@DavidFreitag I dunno about "false" just yet... "unproven" maybe.
 
@Iszi But after all, everything is simply a figment of my imagination. "Proven" is not possible.
 
@DavidFreitag Ok, how about "unverified"?
 
@Iszi I thought you had that particular procedure done already?
 
8:03 PM
@DavidFreitag For gender, and "within an acceptable margin of error" - nothing was said of species.
 
@Iszi For all we know, you could be a boobie.
 
@DavidFreitag If I had boobies, I'd be so distracted with myself I'd never leave home.
 
@Iszi A boobie with boobies? Interesting concept.
 
@DavidFreitag Surely someone's already done it. Not Googling that from work, though.
 
@Iszi Just search for "birds with chesticles" no one will notice.
2
 
8:12 PM
I like both
 
 
1 hour later…
9:38 PM
@DavidFreitag Because that's totally working out for about half of the US Congress
 
@KnightOfNi wat
 
@DavidFreitag google.com/…
 
@KnightOfNi I don't see the controversy. We are biologically programmed to like boobies.
 
Had to filter out something about a bill on banning porn... but once I did it became clear that Mike Bennett would never let that happen
 
Not once have I ever heard anyone say "Man, I really hate boobies" and actually mean it.
2
 
9:45 PM
@DavidFreitag That actually made me look up "I hate boobies"... and the top result seems, if anything, worse
 
@KnightOfNi Oh?
 
Yup... "Why I hate Breast Cancer Awareness Month"
I mean, I can think of some good reasons to hate it...
 
@KnightOfNi Because boobs are great?
 
But overall you put up with it because it's well-intentioned and if you don't, you're the asshole who wants people to die of breast cancer
 
@KnightOfNi That's exactly what I was thinking... lol
 
9:48 PM
@DavidFreitag lol, that's the new motto of breast cancer awareness month "Fuck mammectomies, boobies are great"
^ in a report recently released by John's Hopkins...
 
@KnightOfNi There are far too many syllables in that word to make it a good motto.
 
well, we could apply an xkcd-style simplification and make it "breast cutting"
 
Or, how about "Fuck cancer, boobs are great"
 
@DavidFreitag Now that's a motto Congress can get behind!
 
If they added an "mmmkay" at the end of that, though.
 
9:54 PM
@DavidFreitag what?
 
Well... that was... informative?
 
You would be the first to claim that South Park was informative, I think.
 
This is interesting. Pretty sure I'd never have thought to call Snowden a "freedom fighter". howtogeek.com/trivia/…
 
@Iszi Why not?
 
10:10 PM
@DavidFreitag I'm not saying they're wrong. Just that I'd never considered it before in quite those terms.
 
10:27 PM
@JukEboX yea
@DavidFreitag because it's a loaded buzzword that usually refers to someone who follows the status quo while blowing up enemies of the state
 
@Ohnana well so is your face, but you don't see me complaining...
 
@DavidFreitag you're simoning too hard
 
@Ohnana Giggity.
 
10:59 PM
@AviD @Iszi It was a community rather than a platform movement. The vahst majority of participants in there had become rather disillusioned with SF as a site and mostly just used the chat room as a community separate from StackExchange. Hence the move to Slack.
 
11:35 PM
@kalina ^
 
@RoryAlsop Heh, that's me when a show ends :]
 

« first day (1715 days earlier)      last day (3170 days later) »