The Bridge

badp

11:01 AM

Who doesn't exist now?

Kevin van der Velden

@badp I don't know, hardly any of our conversations exist

badp

Ɛ ǝɟᴉ˥ ɟlɐH :ɹǝʍsu∀

fredley

Existence is futile

Wipqozn

In other news, this can be re-opened:

-4

Q: How does Silent Hill: Shattered Memories relate to the rest of the Silent Hill series?

Well I Don't Have PSP So I Haven't Played Shattered Memories But I Have Tried Reading It's Story On Wikipedia. now i'm confused , i don't understand it's story and it's relevant to previous games and it's characters , anyone knows the story and cares to explain?? i don't understand , harry mason ...

silent-hill-series

Arperum

Hi mobile chat!

Kevin van der Velden

11:07 AM

@Arperum nooooh, not mobile chat!

Arperum

Meh, at a restaurant during work hours for free. well, boss pays.

Kevin van der Velden

Free for you =p

badp

Poor kitten just barfed out a leaf :(

a whole leaf

I don't know how that worked out

Kevin van der Velden

Well the kitten barfed it out, so it didn't at all work out

5pike

@badp Worked out as intended.

Private Pansy

11:20 AM

I hate my job. I hate my job so much.

Kevin van der Velden

@PrivatePansy =[

LessPop_MoreFizz

Why did I follow the links to the Reddit threads on the subject. I should have known better. Now I am angry as well as sad.

Kevin van der Velden

Jeah, don't do that, reddit is bad =p

LessPop_MoreFizz

@KevinvanderVelden I had hoped that maybe, just maybe, a tragedy would've resulted in people leaving their shit behind - or at least being properly heavily moderated - and maybe a nice sentiment or two might pop up, but nope.

Private Pansy

On what subject?

Kevin van der Velden

11:31 AM

@LessPop_MoreFizz moderation?! What kind of free speech hater are you?

LessPop_MoreFizz

@PrivatePansy Kate/Jerle/Damiya's passing yesterday.

She was an old e-acquaintance from way, way, back; and I just saw links to the LOL and DOTA subreddit threads and... oh god they are awful.

@KevinvanderVelden Someone literally made this argument to say why it should be okay to joke about a woman who took her own life, in the thread that links to her suicide note on Facebook. I just don't even know what to say about that.

Kevin van der Velden

@LessPop_MoreFizz "Grab the pitchforks" isn't acceptable right?

LessPop_MoreFizz

@KevinvanderVelden I am too sad to properly get into lynchmob mode.

Private Pansy

So. One of our drivers who went for vaccination has a fear of needles, so the doctor gave him morphine to ease the procedure. He was then told, in no uncertain terms not to ride his motorcycle afterwards by no less than the doctor, medic, his escort and his commanding officer

Kevin van der Velden

@PrivatePansy there is no good way this story can go now

LessPop_MoreFizz

11:46 AM

@PrivatePansy He now has needles permanently stuck in his arm, doesn't he?

Well, not permanently, but for several days/weeks of IV drip.

Private Pansy

It's not that bad. Only a minor scrape, though he won't be able to drive for a while

Still, the feeling when you hear the news is the worst feeling in the world

I got the news that he got into an accident before hearing about how bad it was, and you sort of assume the worst

The worst part is that I and a colleague saw him ride out of camp when we left for lunch. I had a chance (though probably a very slim one) of flagging him down at that point

Then we came back from lunch and heard he got into an accident. I almost threw up on the spot

RPi Awesomeness

@PrivatePansy Oh... :(

Kevin van der Velden

@PrivatePansy You are in no way at fault here, he was clearly told he should not be driving and thought he could (and was wrong). You probably know this already but it still needs to be said

RPi Awesomeness

@KevinvanderVelden Exactly what I was going to say

5pike

@PrivatePansy Understandable. Motorcycle accidents can be pretty bad.

And what Kevin said

RPi Awesomeness

11:53 AM

was anyone else hurt?

Private Pansy

No, don't think so

RPi Awesomeness

Well, that's a good thing! Should always try to find the silver lining!

Martin Sojka

@PrivatePansy Actually ... I never assume that. I just ask if I can visit or call the person, and if yes where. Then I do so and ask for details.

(Unless they're dead or in coma, that is)

badp

@PrivatePansy So all that's left is the civil and penal consequences of driving while drugged!

Uh, it seems he can get away with $1,000 and no jail time.

Wipqozn

12:10 PM

Powerlord, cp_gravelpit

246 1 7

team-fortress-2 ps3 ps4 steam technical-issues tf2-mann-vs-machine wii-u

@Powerlord You're such a scamp. I'm surprised you didn't delete again right away like you did with the last account.

Private Pansy

This morning I drove a safety vehicle to provide coverage for a route march that consisted of one (1) participant

Matt Эллен

the needs of few outweighed the needs of the many

Private Pansy

Together with me was a supervising officer, a conducting officer, a safety officer, and a few more guys who seem to have tagged along just for the ride

badp

Huh -- if you are caught driving while on alcohol for the third time and you kill somebody, the Singaporean court may subject you to "caning with no more than 6 strokes"

(on top of everything else, obviously)

Private Pansy

I think I was the only conscript in attendance. The number of regulars "supervising" this event was greater than the number of regulars we have in the MT line with more than 100 conscripts

Wipqozn

12:12 PM

@PrivatePansy How long are you acting as a driver?

I remember you saying it was an easy gig.

Private Pansy

@Wipqozn I'm usually a supervisor. I don't usually drive.

This time, they ran out of drivers who are not Malay to enter the racist camp

Wipqozn

@PrivatePansy I like to think that the camp is actually named "The Racist Camp". That it has a sign on the way in saying "The Racist Camp".

Lazers

1

Q: Small soldiers game based on the film

The game is based on the film ‘Small Soldiers’ and the main theme of the game is that you spawn toy characters out of toy boxes to fight against the toy soldiers, I played this game in the late 90’s/early 2000’s, it was also on PC. Does anyone know this game?

game-identification

0

Q: What is Karma and paragon, and how to get it?

From the screenshots of a reddit post complaining about the bugs in 0.9.8.0 I saw that you can have karma and paragon. Here is a link to the picture. I didn't include it directly to avoid possible spoilers for other people. So don't click it if you don't want to know possible other resources. Ho...

kittens-game

Private Pansy

@Wipqozn It might as well be

Okay, one more story. We have a problem with people not performing certain procedures which help ensure that expensive and (sometimes) deadly mistakes don't happen.

Of course, 99% of the time not performing those procedure will result in absolutely nothing going wrong, but in the 1% of the time when things go wrong, the mistake will usually be rather costly

So how do you make sure people perform these procedures? In my case, it's the handing over and taking over of some radio sets which are used when drivers go out to drive.

It doesn't take more than a few minutes to go over the day's records and make sure all the radio sets are accounted for. But if they don't, most of the time these radio sets don't go missing either. Nobody in their right minds would steal these things

badp

> peppy music WE INTERRUPT THIS RADIO PROGRAM WITH AN IMPORTANT MESSAGE FROM SUPERVISOR OF DRIVING AFFAIRS, PRIVATE PANSY

Private Pansy

12:21 PM

But when they do, these radio sets are $400 a pop My superior proposed we add more paperwork to help solve this problem

It's such an army way of thinking of this. Do more paperwork, and problems will go away on their own

badp

oh, not that kind of taking over :(

Private Pansy

The problem is I can't convince otherwise, and I'm not altogether sure it isn't the best solution either

So now I'm roped into the never ending nightmare of army bureaucracy

Martin Sojka

@PrivatePansy Slapping RFID tags on them to be scanned when moving out/into storage didn't appear to anyone?

Private Pansy

@MartinSojka One of the first thing that came to mind

fredley

oooooh

Private Pansy

12:26 PM

But of course the army being completely techno-phobic, and incredibly stingy with money, the chances of that happening is... slim

Martin Sojka

RFID scanners start at $25 (US), RFID tags are cents at most. The most cost would be in coding a bit of glue software between the scanner and the inventory management software (... or just a simple database or even Excel table).

Private Pansy

@MartinSojka Haha, are you trying to apply logic into the way army does its purchasing?

Tim Stone

@MartinSojka Yes, but think of all the money necessary to print the paperwork that would be required to acquisition each RFID tag?

Private Pansy

And of course all of the things I mentioned above happened in one day

That's one typical day at work. I hate my work.

Tim Stone

Plus you'd then need more paperwork to verify on check in that a unit still had its RFID tag intact.

Then you'd shake your fist at how ridiculous that is, and there'd be more paperwork!

Martin Sojka

12:29 PM

@PrivatePansy Not really, just trying to show just how screwed up the reasoning is in reality. I have friends both in the military and working for the Airbus Defence & Space in developing military drones, I know the stories ...

Arperum

@KevinvanderVelden Exactly, I even got payed for being there! (away from the office for 2.5 hours, instead of a lunchbreak of 30 min.

Wipqozn

@StrixVaria took about an hour for me I believe. I love having Fibre. 50/30 is super rad.

Private Pansy

@TimStone That reminds me of how, when I was still a trainee, I was fairly impressed with how the army uses GPS to track all its vehicles

Then when I came into the job, I got a report that about a fifth of our vehicles potentially had faulty transponders, some of which had last check-in timing from several years ago

Tim Stone

Heh

Wipqozn

@GnomeSlice I really hope that's released here in NA, and within a reasonable time. It looks like so much fun. I could really go for a good survival horror game too.

Rapitor

12:35 PM

o/

badp

@fredley gfycat.com/ImpossibleGloriousCub

It's never been easier to have strongly persistent, instantly synced unusable messes :P

fredley

@badp ha

Ugh, new iTunes Connect interface is horrible

Private Pansy

@badp They've adhered to the Chrome belief that spaces for tabs and windows are infinitely subdivisible

GnomeSlice

so my power is going out for 8 hours today

badp

@PrivatePansy gfycat.com/WellinformedIdleAlbacoretuna

fredley

12:43 PM

ughghghghghghg Cannot submit updated app (from xCode), binary already uploaded. iTunes Connect: no uploaded binary

UGHGHGHGHGHG

badp

fredley

Of course, the 'add build' button that you need to click is only visible if you open the page in Safari.

>.<

"It just works", iff you're using only Apple products.

That second f is important

Wipqozn

@fredley Your mom's important.

Oh buuuurrrrnnnnnnn

Rapitor

@Wipqozn too far

Wipqozn

haha oh man @GnomeSlice I forgot about this picture

Good times.

Also, I like your new gravatar @GnomeSlice. Although I wish it was higher quality. It's a bit blurry.

Lazers

12:48 PM

0

Q: How do I get more zebra's?

One of the achievments is: Heart Of Darkness -Become a chieftain of a zebra tribe. (How is this even possible?) - Have more then one zebra (sic) I already have my first Zebra which I got when I build a ship. I only don't know how to get a second Zebra. So how do I get the 2nd Zebra?

kittens-game

fredley

@Wipqozn I like the gravatar that my script has assigned you.

Kevin van der Velden

@fredley yes, it is best @Wipqozn avatar

fredley

ALL HAIL WIPQALOT

Wipqozn

@fredley You're the worst.

And yet, I also love you for the same reasons I hate you.

You're just such a scamp.

fredley

badp's law of fredley states that best fredley == worst fredley

Kevin van der Velden

12:56 PM

@fredley well there's only one fredley... wait... DO YOU HAVE AN EVIL CLONE ARMY OF @fredleys?

Wipqozn

@KevinvanderVelden If there's only one @fredley then his equation is automatically true. There's no need for more.

Plus I don't think the world could handle more than one @fredley.

Kevin van der Velden

@Wipqozn but there could be more! Don't discount the option of evil @fredley clone armies

Sterno

It's not so much that you don't have a turtle avatar... it's that your current avatar is lame.

fredley

I definitely have no clone armies

Wipqozn

@Sterno Do you have something against 19th century Russian composers? What a plebeian.

Sterno

1:04 PM

@Lazers That was literally 3 seconds of googling to find the answer

Lazers

0

Q: How do I manually install addons?

In Garry's Mod, there are addons; some of which are legacy (.zip files that you can download off garrysmod.com) or workshop files (anything with .gma). I've downloaded some addons, most of which are from the workshop. On my main account, all the addons work fine and they work as per normal... Ho...

garrys-mod steam-workshop

0

Q: What am I supposed to do with the blue signs appearing after a captain is killed?

Everytime I kill a captain (or higher rank) there's a blue sign appearing on his body (the bow, sword or dagger). Can I grab it? What is the use for it? I tried a few times to grab it (in wrath and regular world) without success.

shadow-of-mordor

evil fredley

@fredley definitely

fredley

@evilfredley shhh you

Kevin van der Velden

AAAAaaaAAAH THE @FREDLEYS ARE INVADING

fredley

@KevinvanderVelden No we're not

evil fredley

1:11 PM

@KevinvanderVelden No we're not

Wipqozn

@Sterno Your mom's 3 seconds of work.

man, I am really out of control this morning.

Sterno

2

I like how all I have to do to find that image now is google image search "wipqozn's socks"

7

Kevin van der Velden

@evilfredley well, at least this porkchop approaches normal porkchop colors, compared to diamond chop at least

evil fredley

@KevinvanderVelden Blood diamond

Kevin van der Velden

@evilfredley aah, hence the evil. Got it

evil fredley

1:14 PM

@KevinvanderVelden You're catching on

Wipqozn

@Sterno Well, this is the worst.

fredley

@Wipqozn Still not as bad as your actual socks

badp

my mod abuse senses are tingling

StrixVaria

I wonder what would happen if I merged @fredley into @evilfredley

evil fredley

@StrixVaria I can't imagine anything terrible would happen. At all.

Kevin van der Velden

1:17 PM

@StrixVaria would that create @moderatelyunpleasantfredley? No wait, that's assuming regular fredley isn't evil

Jutschge

it would give us an even weirder meat color, that's for sure

evil fredley

regular fredley is a shining paragon of goodness.

compared to me

Unionhawk

What. The. Fuck.

4

fredley

@Unionhawk I like how that could be applied to any of the current conversation threads.

Kevin van der Velden

@Unionhawk Which wtf? Porkchop colors, @Wipqozn socks? Evil fredleys saying non-evil fredleys are good?

Origami Robot

1:22 PM

sigh

Kevin van der Velden

It's not that bad @OrigamiRobot, at least you're not autocaddering yet

Unionhawk

@ori yep.

Origami Robot

@KevinvanderVelden At least I get paid for that.

evil fredley

I hear fredley's clone army pays really well

Unionhawk

@kevin I'm wtfing at a mod talking to himself with a sock, which isn't technically disallowed, but still

Frank

1:25 PM

@evilfredley Lies! All lies!

Kevin van der Velden

@Unionhawk it is very clear it's a sock, it even says so in the description! And the sock came by the reputation honestly

So that's fully allowed

evil fredley

@Frank No, I'm just evil, not a liar. Not like regular fredley.

Frank

@evilfredley That's what every evil liar would say!

Lazers

0

Q: What does each item card do?

I just started playing adventure mode in Hyrule Warriors and I'm slightly confused on what each item does. For example I tried used a compass to find a hidden area and it was under a rock so I tired to use the bombs and nothing happened. So what can each item card do and also do item cards resp...

hyrule-warriors

evil fredley

@Frank How would you know that??

Kevin van der Velden

1:28 PM

@evilfredley duh, @Frank is also an evil liar.

fredley

Frank

@KevinvanderVelden Nah. Just grumpy.

Kevin van der Velden

3 mins ago, by Frank

@evilfredley That's what every evil liar would say!

Frank

@KevinvanderVelden I didn't say I was evil.

Kevin van der Velden

@Frank no, I just did

fredley

1:30 PM

@KevinvanderVelden Basically case closed

Unionhawk

But you didn't say you weren't, not evil

fredley

@Unionhawk Even if he did, how would we know he wasn't lying?

Origami Robot

sigh

Stack Exchange

fredley has added evil fredley to the list of this room's owners.

evil fredley has removed Wipqozn from the list of this room's owners.

8

StrixVaria

I played Shadows of Mordor for only 15 minutes and now I'm at work and I probably won't even be able to play tonight so I'll have another entire work between :(

Stack Exchange

1:32 PM

fredley has removed evil fredley from the list of this room's owners.

5pike

@StrixVaria At least you have it ready to play. I have to download it and repair my controller.

Unionhawk

@fredley thank you for continuing to make me kind of regret not putting my #1 vote to another candidate

fredley

@Unionhawk The love is kinda mutual

Origami Robot

Fun fact about Shadow of Mordor. Sometimes you will fight a captain you've already killed.

5pike

@OrigamiRobot see this

Sconibulus

1:34 PM

@OrigamiRobot so zombie orc farming simulator?

Origami Robot

@Sconibulus Not zombies, just not dead

Wipqozn

@StrixVaria I didn't think I'd be able to play tonight, but I cancelled the plans I had.

Origami Robot

It's just a "surprise, your arrow didn't actually kill me."

5pike

@OrigamiRobot Or "Surprise, the sword you rammed through my skull didn't actually kill me".

Kevin van der Velden

@5pike to be fair, people have survived having railroad spikes go through their skull

5pike

1:37 PM

@KevinvanderVelden True, but it's still a bit ... strange (and hilarious).

Lazers

2

Q: Is there a downside to slaughtering everyone I meet?

I was ambushed by a named enemy not long after jumping off the first tower and being unleashed into the vast world. I defeated him, and the game made a big deal about his death, awarding me Power and crossing off his name like I accomplished something useful. Are there a finite number of enemies...

shadow-of-mordor

2

0

Q: Is the "staff credits" music in DKC Tropical Freeze accessible aside from beating the game?

It doesn't seem to be listed the the music section of the extras. The only place I can find it is on YouTube, and both there and in the credits the song fades out prematurely.

dkc-tropical-freeze

Frank

@Lazers "Is killing everyone I meet a bad thing?"

fredley

One redundant comment removed already

I wish there was a 'lock comments only' option

Frank

To be fair, the title doesn't really match what's being asked about.

"Why do I have a list of people, and what does killing them do for me?" would probably be better.

Unionhawk

At least we don't have "another one for meta.explainingallthejokes" anymore

StrixVaria

1:46 PM

@Frank That's not what I want to know, thanks.

I didn't even mention a list of people.

Frank

> and crossing off his name like I accomplished something useful

Crossing it off of what?

StrixVaria

@Frank Rendering it on the screen, then crossing it off.

Alone.

A list of one, if you will.

Kevin van der Velden

@Frank the ingame list of currently active captains

Or have you not unlocked that?

Unionhawk

It literally crosses his name off

Frank

@KevinvanderVelden I ain't playing Shadow of Mordor. Everything is coming straight from the question and some guessing.

StrixVaria

1:48 PM

I am not far in the game at all, but I don't want to kill my way into a corner. Hence the question.

Kevin van der Velden

@StrixVaria from what I've seen in (a) review, they are replenished over time

badp

oh my god

Origami Robot

@StrixVaria You can't kill your way into a corner. New captains will be promoted to fill the gaps.

Rapitor

@StrixVaria as far as I know, the nemesis system can never be "emptied"

badp

how do illiterate people go as far as joining a TF2 server

Rapitor

1:49 PM

if that's what you are asking

Kevin van der Velden

But I don't have that game either, it's on my wish list

Unionhawk

Also, don't have time to write up an answer, but captains repopulate over time and also when you die

StrixVaria

@OrigamiRobot Neat.

badp

They must have obtained a computer first

Rapitor

@badp click buttons

badp

1:49 PM

then they must've logged in on steam

StrixVaria

Ugh I'm so upset that I'm not playing right now.

badp

then they must've identified TF2 and the "play game" button

Origami Robot

Now as to whether there's something more useful to do with them instead of outright killing them, that answer is yes.

badp

then they must've identified the game list, and the game in the game list, then they must have learned to double click

Origami Robot

You can interrogate captains to learn about other captains.

StrixVaria

1:50 PM

Last night as I was just getting into it a friend asked me to play LoL and I had already said no the last like 4 times he asked, so I switched.

@OrigamiRobot Oh neat.

Origami Robot

As always, when you finish the interrogation, you auto kill them.

badp

finally they must've identified the play game button and they must've figured out how to join a team and pick a class

StrixVaria

There was a guy with the green "worm" icon over his head nearby, and I was focused on trying to interrogate him, so I didn't even think about interrogating the named guy.

badp

and then how to move and shoot

that's an amazing accomplishment

Rapitor

@OrigamiRobot no? in the trailers for the game you could take them over and have them infiltrate

Kevin van der Velden

1:51 PM

Heh, the perfect summing up of reddit

Rapitor

is that late in the game?

Unionhawk

That's a later mechanic, I think

Origami Robot

@Rapitor From what I've seen so far, the infiltration part is simply story.

I'm only 10% in

Kevin van der Velden

@Rapitor I think it might be take over -> read mind -> death, or take over -> order them to do stuff

Again, this is from watching gameplay footage, not actually playing

Rapitor

If/when I do get the game, I plan on making Ratbag my best friend and partner

because why not

Unionhawk

1:53 PM

Early game your options are gain Intel or kill

badp

@KevinvanderVelden Well, I’m going to visit Reddit now just to spite you. So there!!

Kevin van der Velden

@badp is currently browsing /r/diy

badp

@KevinvanderVelden I'm browsing reddit.com/r/pcmasterrace, tyvm

Kevin van der Velden

Also good

5pike

@StrixVaria Compiled and answer for you. Most things are findings from articles and wikis.

4

Kevin van der Velden

2:05 PM

@5pike poor cats

Powerlord

is currently browsing non-Reddit sites, since Reddit us blocked from work

badp

huh

5pike

@KevinvanderVelden "WHY U DO THIS?"

badp

for the "Microsoft doesn't know how to count" series, the Windows TP is 6.4 instead of 6.3

Origami Robot

@5pike The gray one at the top is like "You motherfucker"

Private Pansy

2:10 PM

@5pike So the cats associate a plate being put down as mealtime?

evil fredley

@5pike That's too much even for me

Private Pansy

I don't understand why the cats were trying to pick up food when it's obviously not in the plate though

Kevin van der Velden

You're really getting a lot out of that sock puppet today aren't you?

@PrivatePansy probably a case of looking for food more than trying to pick it up

Powerlord

@badp Well, you know due to compat reasons MS will likely never have a .0 release ever again, right?

Thank XP's super duper long lasting presence for that one.

badp

@Powerlord perhaps, but what happened to 6.3?

...oh, it's Windows 8.1?!

wat.

Private Pansy

2:16 PM

@badp reddit.com/r/programming/comments/2i14ny/…

Origami Robot

@PrivatePansy They're sniffing the plate.

Powerlord

@badp Well, you saw the article about Windows 9, right? :P

badp

@PrivatePansy I'm fully aware of this. That's got nothing to do about skipping 6.3, except they didn't: WIndows 6.3 is actually Windows 8.1

I didn't think a glorified service pack would cause a version number bump.

Private Pansy

IsWindows8Point1OrGreater() is an actual function in the Windows API

2

badp

if nothing else there's more like it

is that going to stop people from being dumb? nah.

Private Pansy

2:19 PM

It is, surprisingly enough, supported from Windows 2000 onwards

Kevin van der Velden

@PrivatePansy kinda sorta. It's an inline function so it exist only in the compiled version of a program that uses it

badp

I for one can't wait for Windows 7.0 :P

Powerlord

@badp 7.1 you mean, right?

Kevin van der Velden

@PrivatePansy It probably just asks the OS for the version in a way that's been supported since 2000 and then compares it in the proper way

badp

@Powerlord It's okay, Windows 7.0 is probably going to be Metro-only after all :P

Kevin van der Velden

2:20 PM

Heck, it's not even in the regular windows API but in a helper header.

Private Pansy

@KevinvanderVelden Probably, unless the developers of Windows 2000 have also discovered the principles of time travel

badp

besides

stuff that hasn't been updated since Vista has come out is going to have much bigger problems than OS version detection

Kevin van der Velden

@PrivatePansy well it could trawl through the registry randomly and not use a win 2000 feature

badp

and you can already fake the Windows version reported to programs through the compatibilty tab

Private Pansy

@badp Quite sure the version reporting API isn't the only thing faked by the compatibility thingamajig

badp

2:22 PM

@PrivatePansy I'm just saying faking it is pretty easy

2

Origami Robot

THIS IS THE PROPER WAY TO PRINT THINGS IN AUTOCAD

Private Pansy

@OrigamiRobot Non-freehand circle and drop shadow? BURN THE HERETIC!

Origami Robot

I HOPE THIS KNOWLEDGE RUINS ALL YOUR DAYS

@PrivatePansy WHAT PART OF "FUCK THE POLICE" ARE YOU NOT GETTING?

fredley

Day already ruined by Wipqozn

2

Frank

@OrigamiRobot Nope. Today is a good morning.

Kevin van der Velden

2:26 PM

@OrigamiRobot how come? We're not the ones using it.

Origami Robot

@Frank THAT IS FALSE BY DEFINITION

Frank

@OrigamiRobot Your definition is flawed. Patch it for the proper one.

Fluttershy

@Wipqozn I did not own it. Until now. Now I own it.

Origami Robot

@Frank TODAY IS NOT A MORNING

Frank

@OrigamiRobot Today is currently in morning. So yes, it is a morning.

For another 2.5 hours.

Origami Robot

2:28 PM

THAT'S NOT WHAT "TODAY" MEANS

Private Pansy

@Frank I live in the future. I've already experienced morning, afternoon, and evening. And I can tell you it was terrible.

Powerlord

@KevinvanderVelden You mean the VerifyVersionInfo API?

Private Pansy

(Read transcript above for exact details of terribleness)

Powerlord

...but yes, apparently Windows 8.1 returns 6.3 as its version for applications using an appropriate manifest.

Kevin van der Velden

@Powerlord I have no idea, I do not have the windows API headers available to me apparently.

badp

2:31 PM

@KevinvanderVelden That's understandable, you're probably being developed under Linux currently.

Kevin van der Velden

@badp suuure, something like that

badp

@KevinvanderVelden yep={ :;}; nice `pidof hl3.exe`;

ah whatever, you're nice enough now.

Kevin van der Velden

@badp -bash: syntaxfout nabij onverwacht symbool '}'

Don't ask me why my bash is in dutch, I have no idea

badp

@KevinvanderVelden env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

...or better, curl https://shellshocker.net/shellshock_test.sh | bash

Kevin van der Velden

@badp yep, my bash is still vulnerable =p

badp

2:36 PM

@KevinvanderVelden grats :P

cygwin's bash still has the "redir_stack bug" thing.

Matt Эллен

h4><0r2 @KevinvanderVelden

Kevin van der Velden

There's one that says not vulnerable!

It instead crashes with a segfault

Powerlord

CVE-2014-6271 (original shellshock): not vulnerable
bash: shellshocker: command not found
CVE-2014-6278 (Florian's patch): not vulnerable
CVE-2014-7169 (taviso bug): not vulnerable
CVE-2014-//// (exploit 3 on shellshocker.net): not vulnerable
CVE-2014-7186 (redir_stack bug): not vulnerable
CVE-2014-7187 (nested loops off by one): not vulnerable

\o/

Kevin van der Velden

Nice

Jason Berkan

'bash' is not recognized as an internal or external command,
operable program or batch file.

\o/

badp

2:39 PM

boo

Kevin van der Velden

@JasonBerkan /o\

badp

I mean

fish is better, but...

Kevin van der Velden

That's a sad person, or possibly superman

fredley

►

Trout. Are. Freshwater. Fish. And. Have. Underwater weapons.

Jason Berkan

With the bash thing, though, I don't understand why people were freaking out so much. Isn't it normal to give the web user (i.e. the user running cgi-bin stuff) absolutely no rights at all? That's the way IIS is setup.

Kevin van der Velden

2:44 PM

@JasonBerkan it's normal, it's best practice, it's also commonly ignored

Powerlord

@JasonBerkan Yes.

5pike

@JasonBerkan Laziness of people triumphs again.

Powerlord

iirc the default way Apache is set up on most systems does this.

5pike

@Powerlord Yeah. Default user is www-data (on debian, at least).

badp

@JasonBerkan depends: even if the website only has read-only access to its own source code (say, it's PHP), you can still use the vulnerability to download the website's source code

more commonly it'll have write access to the source code folder

things get pretty interesting pretty quickly, I mean.

Jason Berkan

2:48 PM

@badp PHP = ick. And if it has write access, you have a vulnerability.

Kevin van der Velden

@JasonBerkan and that is why people are freaking out, even a user with no rights still has the rights to do whatever the website is already doing

badp

@JasonBerkan eh, it's not a vulnerability per se; it merely makes other vulnerabilities more dangerous

spugsley

CHEROKEE TOMORROWWWWWWWWWWWWWWWWWW

fredley

Down with PHP, up with Python

spugsley

also I love my new phone :3

badp

2:52 PM

@fredley Regrettably, the same applies to Python

spugsley

ALSO HELLLOOOOOOOOO

Kevin van der Velden

HELLO SPUGSLEY

badp

even if you only have .pyc files in there, they're pretty easily reverse compiled.

Rapitor

@spugsley \o

Jason Berkan

@KevinvanderVelden ? The website can do <x> and now I can do <x> by hacking. So what? I'll admit access to the source code would be an issue, but with proper security, even the source code shouldn't allow you to do anything you can't do through the website.

badp

2:53 PM

I dunno if the existing tools deal with Python 3.x, but who uses 3.x? :(

Frank

@spugsley My Nexus 5 is on it's way!

Kevin van der Velden

@JasonBerkan reading the database isn't an issue?

spugsley

@Frank Fun :3 I didn't know phones could work so good. I always get the cheapest option. This time I got the one I wanted and it's the best!

Kevin van der Velden

@badp existing tools are available for python 3 as well

spugsley

and my battery is so good :o I still had 82% when I went to bed last night O-o

badp

2:54 PM

@JasonBerkan I also have a shell to connect to your database from, and the db username and password have to be readable from your server executable

you can't really be very clever as, again, you already have the source code

Jason Berkan

@KevinvanderVelden But how? You can't execute any programs. Maybe I don't understand how PHP does SQL access.

fredley

@badp Still, down with PHP

Batophobia

Down with pants!

badp

@JasonBerkan you can download all the programs you need

just compile them statically so they work regardless of whatever libraries you have up there

Jason Berkan

@badp I'm assuming the web user does not have write or execute access, because that is a massive security hole, regardless of any other bugs / issues.

badp

2:56 PM

@JasonBerkan how can he not have write or execute access?

Kevin van der Velden

@JasonBerkan you assume correctly... in the .1% of servers correctly set up

badp

The user has to execute the server executable in the first place

Kevin van der Velden

@badp not necessarily

You can start the server from root, listen to port 80, and then change which user you are running as

Jason Berkan

@badp Wow. Unix is weird.

badp

@KevinvanderVelden Actually you have to do that, but still, you're calling bash here, aren't you?

Powerlord

2:57 PM

@KevinvanderVelden The user still needs permission to execute CGI Scripts.

Kevin van der Velden

So in that way, you'd only need read access to the files and list it

badp

The whole point of the vulnerability is that bash is executed

I don't even think there's a way to completely prevent an user from being able to execute anything at all

as for write access, well, where are you going to put user avatars or uploaded images or something?

Powerlord

and frankly, if the web user doesn't have permission to write files it can't do either logging or file uploads.

badp

...or logging

Kevin van der Velden

@badp you can have access to call only bash, and have the first argument be the script you want to access

badp

2:59 PM

yeah they could be on a partition mounted noexec

Kevin van der Velden

@badp in a directory with permissions set so that you can write it to

badp

37 secs ago, by Powerlord

and frankly, if the web user doesn't have permission to write files it can't do either logging or file uploads.

@KevinvanderVelden It's easy to make up countermeasures on the spot once you know what the threat is

Transcript for