The DMZ

Terry Chia

00:21

@LucasKauffman Yay i'll be there for the next one.

So i'll be joining 2 CTFs in a span of 5 days. Interesting.

Iszi

04:04

@RoryAlsop Are these as awesome as they sound?

Scotch egg

A Scotch egg consists of a hard-boiled egg wrapped in sausage meat, coated in breadcrumbs and deep-fried. Origin The London department store Fortnum & Mason claims to have invented Scotch eggs in 1738, but they may have been inspired by the Moghul dish nargisi kofta ("Narcissus meatballs"). The earliest printed recipe is the 1809 edition of Mrs. Rundell's A New System of Domestic Cookery. Mrs. Rundell—and later 19th-century authors—served them hot, with gravy. Serving Scotch eggs are usually a picnic food and home-made. In the UK, pre-packed, plastic-wrapped Scotch eggs are commonly...

Terry Chia

04:30

@Iszi That sounds delicious. :O

Iszi

04:43

@TerryChia Hence my inquiry to the Scotsman.

Lucas Kauffman

05:53

I love those, been a while since Ibate one

Jeff Ferland

08:18

I can't believe this damn thing just became a repevator...

5

Q: Does disabling right click has any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?

Terry Chia

08:50

@JeffFerland It's always the stupid ones.

2

Is it a dupe though? I seem to recall something similar, but not the exact question.

Jeff Ferland

I didn't find anything, and it's now a popular .SE question so fuck it all

Rory McCune

09:11

superuser doesn't allow the word "problem" in titles?

Jeff Ferland

well, definitely bedtime

AviD

09:33

@JeffFerland I didnt want to upvote any answer on that type of question, but your tacit condoning of cast iron hairstyling has required my approval.

M'vy

hiya

Rory Alsop

10:03

@RoryMcCune guessing they had so many 'problem' titles that it got banned

sorry I don't have an answer - will be interesting to find out if that info is logged

@M'vy mornin

Rory McCune

yeah it's been a weird issue (TBH I think I'm just going to solve it by running Linux as the primary OS and using windows 8 in a VM). Was also very aggravating when it happened as I was standing in a datacentre looking to scan some systems (luckily it's a local place so I got quickly nip home and fix it!)

@RoryAlsop BTW when you starting at the new place?

Ninefingers

35

Q: Houston, we have a porblem

Since it's forbidden to use the word "problem" in titles, and there's not even a way for experienced users to add it (or mods) we all know users just get around that filter by typing various permutations of the word "problem". The filter has scientifically™ been proven effective. The bottom line...

discussion title filtering quality-filter question-restrictions

Rory Alsop

@RoryMcCune not till 25th of next month. So I finish up on 5 March - off to drink with @AviD and go to conf for a week, then a week off, pottering, trying to do the things I would have done, had I been given gardening leave

Rory McCune

@Ninefingers heh yeah I just changed it to a synonym "issue" so really it doesn't help much...

@RoryAlsop shame you didn't get gardening leave :( have they managed to line up anyone to fill your role for a hand-over?

Rory Alsop

10:27

@RoryMcCune no, but they have interviewed a few names you would know:-)

Rory McCune

10:38

@RoryAlsop heh well I guess it's a small world up here :)

Adnan

I hate that moment when you have to explain your code to a new dev, suddenly you become aware of how bad your code is.

AviD

@Adnan why dont you just write good code?

Terry Chia

@Adnan Shame on you!

Adnan

@AviD Because I wouldn't get to whine about, would I?!

@TerryChia Well shame on all of us.

AviD

@Adnan then you would get to whine about other people's code.

Adnan

10:48

"Good code" is a magical concept, that only exists in the minds of people who don't have jobs or don't have tasks in their current job. It's just not real. Unlike, of course, pownies and security-aware bears.

lynks

I think some of the best lessons in coding I've had have been when integrating libraries. Some are great, some are terrible.

It makes the whole 'minimum viable interface' thing really hit home.

Terry Chia

@Adnan Have a look at Adobe Photoshop 1.0.1's code. It's apparently very good. theverge.com/2013/2/14/3990378/…

lynks

probably one of the worst was rackspace's cloudfiles php library. I ended up writing my own based on curl.

Adnan

AviD

@Adnan you know the only real measurement of good code is, right?

Terry Chia

10:54

Have you guys seen this? arstechnica.com/information-technology/2013/02/…

Seems interesting.

Adnan

@lynks, Injecting code, eh?

AviD

@TerryChia so does your mom

Adnan

@AviD how do you know?

lynks

@Adnan perils of a tiled window manager, sometime i lose track of where the focus is :P

Rory McCune

@lynks speaking of which, did you see the cool libcurl vulnerability from earlier on this month.. blog.volema.com/curl-rce.html

Terry Chia

10:55

@AviD Ouch, that hurts. So very much.

Adnan

@lynks which window manager?

lynks

@Adnan i use i3

and put the mouse reallllyy far away on the desk to discourage using it completely

Adnan

@lynks Damn hipsters!

Terry Chia

@AviD I always thought that particular comic was from XKCD. Seems like I was wrong.

lynks

@Adnan i3 is flawless victory if you use more than one monitor.

@Adnan mouse usage is hipster

Adnan

10:57

@lynks What's the mainstream these days then?

Terry Chia

@Adnan Butterflies.

lynks

watched a documentary on The Pirate Bay last night (its on iplayer for you uk folks), and was very pleased to see they all used vim

Adnan

@lynks Notepad++ ftw!

Great! One more reason for people to hate me!

lynks

@Adnan I actually used to use notepad++, switched from that to JEdit because I mostly write Java, eventually found my way to vim and have found my home :P

Rory Alsop

Real programmers set the universal constants at the start such that the universe evolves to contain the disk with the data they want.

@lynks I watched the Anonymous documentary - it too will be on iPlayer (was BBC4)

was pretty good

Adnan

11:03

@RoryAlsop how did this one slip me?!

Rory Alsop

@lynks I was a vi fan many many years ago, but now use notepad++ or ultraedit

@Adnan I lucked upon it while avoiding the Brits

Terry Chia

@RoryAlsop vi is annoying. vim is sooooo much better.

lynks

@RoryAlsop so what made you switch away from vi to a heavier gui with less customisability? (serious question)

Terry Chia

@lynks I'm guessing age. ;)

Rory Alsop

@lynks ease of use. Plain and simple.

I got annoyed at having to remember key combinations in vi

(probably age, as @Terry said - the memory just isn't that good)

Rory McCune

11:07

I think that vi is good if you use it a lot. I know the absolute basics in it, so yeah I end up with notepad++ or gedit a lot

lynks

@RoryAlsop my muscle memory is getting reasonably good, i'm rarely aware of what keys i'm actually pressing.

somehow, code appears.

and the vim + i3 combination is wonderful

Rory Alsop

@lynks magic happens

...

profit

Rory McCune

@lynks I think if I had a job that needed day-in-day-out text editing I might make the effort to learn vi but heck given my time split I'm probably better in MS Word than vi :)

AviD

@lynks like a monkey.

lynks

@RoryMcCune I think that's the clincher for me. I use vim 9-5 non stop, and then when i get home i have the exact same config. so for me it was worth learning.

@AviD I would hope that I converge on correct code slightly faster than a random character generator.

although admittedly, I will never be as fast as the best-case random generation.

CodesInChaos

11:48

0

A: is 1024 bit rsa secure

When a locksmith sells you a lock, he doesn't tell you that you just need to know how to pick a lock to open the door... When Security companies sell you a security algorithm, they do not tell you that you just need an honest science PhD to break the code. C. Shannon, a famous WWII mathematicia...

oh the conspiracy

Terry Chia

12

Q: Does disabling right click have any impact on security?

On a banking website I see that they have disabled right-click. Does that make the site any more secure? Is it a good general practice?

web-application appsec banks

I think this should be protected.

@RoryAlsop @AviD.

AviD

@TerryChia agreed

CodesInChaos

client side security is the only true security

never trust the server

Adnan

@CodesInChaos I'm trying to come up with something smart & funny as a reply.. can't think of anything

Tinned_Tuna

@CodesInChaos Oh god I wish I had enough rep on StackOverflow to downvote.

1: Assume your adversary has more computing power than available under our current understanding of physics

2: Look, our cryptosystem is broken! All of them!

I'm going to derp off to lunch with a vague anger at someone on the internet being wrong.

CodesInChaos

12:01

Not the one time pad. It's the one true cipher

Terry Chia

What do you want me to do? LEAVE? Then they'll keep being wrong!

It seems like today is XKCD day around here eh?

Adnan

@TerryChia Everyday could be XKCD day on SE chat

Ninefingers

@LucasKauffman I can't do the CTF on the eve of the 1st March cause I'm off out that evening, but I can do Sat the 2nd if that's OK, bearing in mind I'm on GMT therefore that should hopefully mean it's still running, right?

CodesInChaos

@Adnan I'm actually serious. I want an end-to-end encrypted internet that does trust servers as little as possible. Host proof file hosting, encrypted messaging,... It just doesn't really fit his question, since the bank is the other end.

(Though you can argue that you should need to trust a bank to transfer money)

Adnan

@CodesInChaos That's a nice, but dreamy vision. Much as that Venus Project

How would you rate the severity of the following security issue:
Leaving .bak files of configuration files that contain database server credentials. Note that the database server cannot be accessed from the internet.

Hgih? Moderate? Low?

AviD

12:05

@CodesInChaos not if your bank is bitcoin

@Adnan moderate. there is real chance for damage, but only by an insider.

actually, that depends on your trust model - while insiders should never be automatically "trusted", it still depends on how much you do trust them.

CodesInChaos

@AviD That's what I was alluding to with that sentence. But I'm not in the mood to argue about the advantages and disadvantages of decentralized money transfer.

Rory McCune

@Adnan I'd agree with @AviD medium, bad for insiders or if other vulnerabilities come up which expose the database server..

Adnan

@AviD & @RoryMcCune, yup, tought so. Thank you guys.

AviD

this is ridiculous. security.stackexchange.com/review/…

It seems there is a "space problem". We need moar spaces.

Adnan

Some body hacked Thomas' account!!

lynks

12:20

@Adnan check his stats, he clearly just spams the 'accept' button, the dirty bear.

Adnan

@lynks High rep & good answers != permission to screw with the system

lynks

is this it? time for the revolution? down with the bears!

Terry Chia

@Adnan The system bends over backwards to accommodate The Bear.

Adnan

12:45

One more question related to the previous one. Do you know of any CWE entry regarding the backup files security issue?

No need to, found it

CodesInChaos

13:04

@Adnan Guess he mixed up the sides

Adnan

@CodesInChaos Yup, he took the enemy's side.

Scott Pack

13:23

@Iszi Oh, so you've noticed that Netflix uses Silverlight? Welcome to the World of Streaming!

lynks

@ScottPack that upsets me deeply, i have to boot my laptop into windows to use netflix :(

Scott Pack

@lynks I set up one of my media centers as Windows for that purpose. Then we used it twice and dropped the streaming package.

That was back when they split it off to its own package. I should probably look at that setup again.

lynks

Ive only ever really used it for breaking bad and extreme boredom.

Adnan

So you guys don't use alternative TV watching methods?

lynks

@Adnan such as?

Tinned_Tuna

13:30

Alternative TV watching methods?

Adnan

@lynks borrowing the episodes from people on the internet pieces by piece, for example.

Tinned_Tuna

TV Watching?

Adnan

@Tinned_Tuna Anything interesting you wanna share?

lynks

@Adnan ahh yeah sometimes, but mostly for an old film that i have a hankering for. i used to torrent all sorts, but frankly, streaming is cheap, high-res, reliable etc. finally the industry is catching up.

Adnan

chat.SE should use SSL

At least for the DMZ

Scott Pack

13:38

Feel free to go hang yourself up for flaying at meta.SO.

3

Adnan

13:54

@ScottPack Jesus! I just had one look at a couple of posts there! Horror, I tell you, horror!

Scott Pack

@Adnan I think the kindest word I've heard to describe the culture at mSO was "dismissive".

Adnan

@ScottPack I remember one time I talked about how the new review system is being abused by unnecessary upvotes, edits, and comments. I suggested creating the "Seems okay" or "No action needed" for First Post & Late Answers.

I was instantly hammered by a moderator there who turned the situation into a personal matter, suggesting that the problem was in me for not skipping and not in the review system.

Yup, here it is

70

Q: "Late Answers" and "First Posts" encouraging unnecessary actions

I've come across many posts that can only be described as okay (see examples below). They're not good enough to deserve an Upvote and not bad enough to deserve a Downvote, there's no point in editing them except maybe to correct one letter, there's no need for a comment and they don't have spam o...

discussion feature-request status-completed review review-abuse

Scott Pack

Yeah, reading through Servy's commends. Nice.

lynks

is SO the defacto 'stack exchange' hub for things like that? i mean that meta question refers to the whole of SE really.

Scott Pack

meta.stackoverflow is both meta.stackoverflow and meta.stackexchange

Now you hear the guys on the podcast complain about the review queueue system because at the beginning they had people just hammering the buttons for no reason other than to rack up more reviews.

Adnan

14:03

Damn.. I wish I took a screenshot of the mod's answer. He deleted it

Scott Pack

Probably shog. It looks like he later recanted.

Tinned_Tuna

@Adnan I barely watch any TV, only when I visit my parent's house do I watch TV... I have books!

Adnan

Yeah it's him, but in a previous indecent there was a big fuss about naming mods when complaining about a mod's action

Ever since that, I stopped mentioning their names.

Scott Pack

meh

Terry Chia

@Adnan Incident you mean?

heh indecent.

Adnan

14:07

@TerryChia oh damn! Yes exactly

Scott Pack

I'm not all keen on assigning blame when it's not needed, but I also am all for calling a spade a spade.

Terry Chia

Luckily I mostly hang out on Sec.SE. Mostly sensible people here.

Adnan

@Tinned_Tuna Well, you're smart and you read books and stuff. But us, the normal folks who watch TV, our knowledge comes from TV and other mainstream mediums.

Scott Pack

Except for that jerkface @AviD.

Terry Chia

@ScottPack Well yeah. I thought that goes without saying. He dislikes vim!

AviD

14:09

@ScottPack that's racist.

@TerryChia like you said, sensible people.

Adnan

Which reminds me, I have to go continue watching Meet the Admins on the IT Channel

Scott Pack

@AviD You're one to talk.

Adnan

Since we're all sensible grownups. May I sense you?

At night

In the ass

4

with a cactus

Terry Chia

Feb 13 at 15:56, by AviD

> DAFUQ: Disturbing Anomalous Freakishly Unbelievable Quote

lynks

im going to star 'in the ass' just so polynomial has something to WTF about when he gets here.

Scott Pack

14:12

That sounds rather uncomfortable.

lynks

speaking of which, i havent seen poly in ages. and did the securitay videos go up?

Terry Chia

@lynks yup they did youtube.com/playlist?list=PL2Nv8J__40K29OGsyNURKOxmsI6JYuy9b

lynks

@TerryChia woo thanks :)

AviD

@lynks he must be busy with his cactus.

Tinned_Tuna

14:33

@Adnan actually, it's the opposite, I find it too much effort to watch TV.

@Adnan and too costly.

Iszi

@RoryAlsop No comment on Scotch eggs? @RoryMcCune?

Tinned_Tuna

15:25

Client: Why is this issue chargable?

Us: Because you are the one who caused it.

Terry Chia

Hmm, I just found a flash drive I lost about 2 months ago.

lynks

Should I add more 'help' this answer? I could baby-step him through it, but I don't see the point in going much further; security.stackexchange.com/a/31274/9377

Adnan

I can't believe this is getting upvoted

8

A: Does disabling right click have any impact on security?

I actually think it might compromise security by a fraction. The one who are prevented by the disabling of the button would never be able to compromise the security at all. But disabling the right click might annoy someone who can get past it to do exactly that, and by doing that breaking down a ...

Can someone please check the up/down count?

Terry Chia

@lynks I think it's a good start.

I haven't actually looked at the binary, but couldn't he just edit the binary to jump to whatever memory address the login() function is at?

Iszi

@Adnan Of the answer? +9/-1 Of the question, +29/-1

lynks

15:30

@TerryChia yeah absolutely, but I think theres a bit more to be learnt by figuring out what the thing does, and subverting a specific behaviour

Terry Chia

@lynks Good answer that points him in the right direction nonetheless. Got my upvote. :)

Adnan

@lynks wow.. a really good answer. I like that you didn't give the thing away.

Terry Chia

@Adnan That's usually the result of a crappy question getting on the supercollider..

lynks

@Adnan thanks :) although now i have the post-answer-doubts. I only gave the exe a cursory glance in IDA, but it seemed simple enough.

Terry Chia

I want IDA. :(

lynks

15:35

@TerryChia IDA free :P

Terry Chia

Ahhh. Heh. Nah, i'll stick to gdb.

lynks

@TerryChia i love gdb, but can you use it for exe files? through some cygwin magic if some kind?

Adnan

@TerryChia What's that?

Terry Chia

@lynks Ahh, that I'm not too sure. Haven really touched on reverse engineering much.

@Adnan The GNU Debugger.

@Adnan Oh wait, IDA. hex-rays.com/products/ida/index.shtml

lynks

@Adnan its the gnu debugger, the standard-issue linux binary debugger, which is very awesome.

Terry Chia

15:37

Olly works well enough on windows.

Although the interface is god awful.

Adnan

Well, now I'm confused

I've used something called gdb before

is it, like, part of IDA?

Terry Chia

@Adnan No, it's a standard linux utility.

Scott Pack

gdb is an open source debugger produced by the GNU project.

Terry Chia

IDA is another software altogether.

Adnan

Ahaaa.. Okay okay.. now I get it

In a security audit report, should I mention things like the password policy? (note: the audit task specifically says "Code security analysis"

I'm auditing the source code of a web application

Iszi

15:41

@Adnan Is the policy due to lack of an organizational policy? Should the code have been expected to enforce the policy, or is it handled by an external source?

Adnan

@Iszi That's why I'm conflicted on this one. There doesn't seem to be an enforced password policy in the organization in general

But still, I think it's a weakness in the application.

But then again, shouldn't the application adhere to the company's policy?

Iszi

@Adnan Sounds like a question you might want to ask before presenting it as a finding within the scope of your report. Do they allow for "Informational" findings?

Adnan

@Iszi I wasn't told not to include informational findings

I've checked a previous report they had, it contained findings with severity "None".

Those were general security practices and recommendations

Iszi

Up to you if you want to rate it that way, but that might be the way to get it into the report if the organization lacks a current policy.

I don't do code analysis myself, but I personally wouldn't expect the code to be responsible for enforcing a security policy the organization does not themselves have in place. Still, I would want some way to make note of it as a shortcoming.

Adnan

@Iszi Yup, that's what I thought. I'll send this up and inform my supervisor and he'll find a way to pass it to the client

Iszi

15:47

@Adnan Sounds like the right track to me.

Thomas Pornin

@JeffFerland Good answer to a stupid question that everybody feels entitled to have an opinion on. How could it not become a rep train ?

Adnan

"Phenethylamines i Have Known and Loved"

Sounds like something form 50 Shades of Grey

Thomas Pornin

@TerryChia You don't mess with the Bear. For this specific case, I just am quite fond of bold characters and italics to emphasize parts of a sentence.

2

Adnan

@ThomasPornin Duly noted. Will keep that in mind for my next suggested edit

Thomas Pornin

@Adnan ... as long as you keep it tasteful, of course.

lynks

16:01

@ThomasPornin is it ok if i write a script to edit all of your posts with 'You don't mess with the Bear.' appended?

Thomas Pornin

@lynks That's OK with me.

Tinned_Tuna

Oddly enough, when I read @ThomasPornin's posts, I read the bold bits, then the italics completely out of context, then I read the whole answer.

I like the moment of "Ahh, that's what that fragment was all abouit"

lynks

people were asking about scotch eggs? i eat them probably 3 times a week, whadyawannaknow?

Rory Alsop

@iszi - sorry, was at the gym and am in the middle of getting a tattoo so hadn't logged in. To answer your question, for me scotch eggs are meh...

Tinned_Tuna

16:16

@RoryAlsop you're on the DMZ whilst getting a tattoo?

What're you getting & where?

Rory McCune

@RoryAlsop what he said .

Iszi

@Tinned_Tuna Probably a Metaltech logo somewhere you don't need to be concerned with. Either that, or just the words "All Aboard".

Tinned_Tuna

owch

@RoryMcCune while you're there you should totally get a septum piercing, or maybe a nipple piercing. I hear tell they're not at all painful.

Rory McCune

@Tinned_Tuna lol other @Rory I'm not tattooed at all!

@RoryAlsop here's a tattoo idea for you... imgur.com/fFluPeb

Tinned_Tuna

Oops, sorry @RoryMcCune, too many Rories

Rory McCune

16:30

@Tinned_Tuna Blasphemy! you can't have too many Rories! :op

Tinned_Tuna

That would take an age to synthesize, I reckon...

+1 Rory

I'm slightly tempted to make a user just called "YetAnotherRory"

But that seems a little silly :-p

Rory McCune

@Tinned_Tuna you could abbreviate it to YAR, and then use it on International Talk like a Pirate day!

TildalWave

You can never be "just another" Rory!

In here, so I've noticed, you either ARE Rory, or you're not. I'm the latter LOL

Tinned_Tuna

I think we should have another tag "More Rory than is technically safe"

Iszi

@Tinned_Tuna You could just change your username to Tinned_Rory. Check out the Memes thread on Meta. We've been through this before. I was "Iszi Rory or Isznti" and @ScottPack was "Rory Pack".

10

A: The Memes of IT Security

Rory As you've already mentioned, Rory has become a bit of a meme within the IT Security StackExchange community. Usage of this meme often takes the form of word substitution a-la "smurf". Usage Examples: Jeff Ferland: It's a quite a rory of a problem, really Ninefingers: At a g...

Tinned_Tuna

16:35

I think Rory_Tuna would be better, because then you get 3 options when you try to tab-complete Ror-

Rory McCune

yep when I first started hanging out in the DMZ the theme was Rory Rory Rory Rory, it was a touch confusing at first!

lynks

'A Touch Confusing' could be a good name for a Jimmy Savile biography...BaDumTiss

Iszi

@lynks Don't know who that is - guessing it has something to do with child molestation?

And Wiki says yes, yes it is.

lynks

@Iszi yeah you got it in one. he was a childrens tv personality right through the 60s-70s, turns out he was a pedo.

Tinned_Tuna

I've actually been to Savile Park in Leeds ...

lynks

16:46

@Tinned_Tuna do you want to talk about it?

The DMZ is here for you.

TildalWave

"DMZ'll Fix It!" ROFLMAO

Tinned_Tuna

It was just odd. It was after he died and all the stuff came out about him. I just kinda stood there and thought "Well, i guess they can tear a head stone down, but replacing signs on a kid's park, well that's a whole different matter."

lynks

@Tinned_Tuna heh yeah.

Tinned_Tuna

anyways, that's my savile story! He posthumously creeped me out and destroyed a little of my faith in humanity.

Also, it was in Leeds, so it was pretty bad already.

3

TildalWave