« first day (949 days earlier)      last day (3929 days later) » 
00:00 - 14:0014:00 - 00:00

12:26 AM
@Gilles Riddle me this. When I pop over to the flags tab, and there was a flag there, I couldn't do anything about the flag itself. No approve, reject, etc. Is that expected?
 
@ScottPack a chat flag? no idea, I rarely interact with these
flags are usually dealt with in milliseconds, and the UI doesn't refresh immediately
 
@Gilles No, a site flag. Chat flags are easy. The notification pops up, I click on it, select invalid.
 
@ScottPack oh. I can't see a flag now
 
When I did see a site flag I there didn't seem to be any way for me to act on the flag itself, which I thought 10kers could.
 
@ScottPack you can't accept/reject the flag
you can pile on, or raise an “invalid flag”, or do other things (e.g. write a comment for guidance, vote to close, vote to delete, edit, ...)
 
12:37 AM
Sure, but I thought you could dispute it. Which is somehow different from a reject but not.
 
@ScottPack dispute = “invalid flag” = raise another flag on the same post that says “invalid flag”
 
Ah. I'll have to check that out the next time I see one come up.
 
@ScottPack get 10k on SO, there are always a few hundred flags in the queue
 
That sounds terrible for several reasons.
I have to say, though, the stats information is pretty interesting.
 
 
1 hour later…
2:08 AM
Morning all.
 
Hey you.
I take it you're in India?
 
2:23 AM
Yup New Delhi right now
In UTC+5.5
 
Oh. My. God. You're in the tomorrow!
You're from the future....
 
Wow!
 
So it is 8am, 29 degrees, humidity through the roof as it is monsoon season, and the drivers here are crazy. But we have a nice 5star hotel with a spa, gym, pools and a bar. Ain't all bad I suppose.
 
So it's like being in Florida?
 
@ScottPack Since PHP is a very secure language, validating only client-side is more than enough, right?
Cool! I'm glad that you agree.
 
2:33 AM
I recommend you do all your validation in javascript.
 
@ScottPack Of course that's what I'm doing! I trust JS 100% so I don't need to validate on server-side.
 
Good man.
 
@scott - possibly like florida, but you guys at least follow things like lanes, or direction of traffic. ..
 
@RoryAlsop While normally I would agree, it does depend on the exact geriatrocy of the person driving that Lincoln.
 
A salt per user would be a good practice, right?
 
2:48 AM
Make sure to pick the right salt for your purposes.
 
@ScottPack Sea salt will do the job.
 
For instance, kosher salt is awesome for most all cooking. Except for dissolving, then regular table salt works pretty well. Or popcorn, when you want something even finer.
Seasalt is a nice flavor enhancer.
 
@ScottPack Indeed.
 
 
2 hours later…
4:45 AM
 
 
3 hours later…
7:30 AM
@TildalWave nice one on the CTF
 
@LucasKauffman Thanks, but you should congratulate more others... @Gilles and @p____h in particular, but also @D3C4FF and @HamZa, because I barely had any time for it... and actually still up from yesterday and not quite finished with what I wanted to publish by today :(
 
@Gilles @p____h @D3C4FF @HamZa Congratulations!
 
7:58 AM
Damn, who approved that SQLi suggested edit? The problem is now that it should actually solve OP's problem (doesn't show wrong syntax in the question) :P
 
@TildalWave I didn't
 
@ScottPack dammit, man, all my salt is kosher!
 
@LucasKauffman yeah but what do I do now? I roll it back?
 
@TildalWave you can
1
A: SQL injection can bypass login but not drop table

Lucas KauffmanIt might be that the function you use in PHP does not allow stacked queries or because the user which is configured to perform the queries does not have drop table privileges. I suggest you log all the output and exceptions thrown by the application. It could give a clue where your problem lies. ...

the OP answers his own question rather than aproving mine which details the same
bastard.
 
8:14 AM
@LucasKauffman I hope you're happy now: "Daily vote limit reached! Vote again in 16 hours." :P Now what do I do for those 16 hours? :)
 
@TildalWave create a sockpuppet
@TildalWave and you need to make it original :P
with its own avatar
 
@LucasKauffman Your luck sucks. xP
 
@RohanDurve-Decode141 my luck? :P
 
8:30 AM
Well, the fact that he thinks he "answered his own question".
@TildalWave I'm gonna let this one go since even with the ', Lucas's answer is most correct.
 
@RohanDurve-Decode141 It is... but he was getting syntax error because of those miscounted apostrophes. If he corrected that, he'd realize how that story ends ;)
 
And why would he even bother with '1'='1'? Why not simply 1=1? He's already out of the string literal, then goes back in just to confuse him further LOL
 
Rofl, truedat, maybe he's evading his custom make-shift WAF that detects and blocks 1=1
 
Oh... I forgot I can't expect consistency... it's PHP, and we all know how to write in PHP, right? Only 2 commands you'll ever need: ctrl+c and ctrl+v :)
@RohanDurve-Decode141 then 2<>3
 
8:37 AM
<> is not a valid operator in his dict.
 
@RohanDurve-Decode141 != then :P
anyway,... there's millions of ways to evaluate two values and return a boolean really
 
You don't give up do you? Fine, I surrender.
 
9:10 AM
@RohanDurve-Decode141 You must be French.
 
9:43 AM
@AviD ouch that's mean even if he was :))
 
@TildalWave and meaner if he wasn't ;-)
 
@AviD exactly
but it doesn't make much sense, does it? Saying that French always surrender... if they did, they'd never have surrendered in surrendering, which is a paradox :P
 
10:01 AM
It's like with a certain famous local politician, every considers him a big loser (he's been prime minister 2 or 3 times, but never elected to it.. same as every other position...) and he always loses any election.
So the joke goes that they held a contest to see who is the biggest loser, and he came in second...
 
Where did we end up in the ufoctf? The scoreboard seems to be offline
 
@lynks somebody hacked the scoreboard.
 
@AviD oh thats a little immature
 
hehe, I really have no clue.
besides, unless it was clearly scoped out of the CTF, all's fair in hacks and war.
 
10:20 AM
we were doing rather well at one point, and I think my friend's team won.
 
10:31 AM
@AviD haha
@lynks 29th
 
@LucasKauffman rgr
 
@lynks Alright Lima Yankee November Kilo Sierra, you are cleared for landing on runway 33L
 
@LucasKauffman Lima Charlie.
 
I hate Lima Beans.
 
@AviD lima charlie = load and clear
 
10:43 AM
@LucasKauffman seems a bit weak, considering its the team representing sec.se.... ;-)
@lynks oh, I know. I used to read Tom Clancy.
 
@AviD 29th is good. Our previous placements: ctftime.org/team/3585
 
@lynks hmm. I thought you guys were winners.
 
@AviD hey, I just coded a really neat word-cloud layout thingy. I'm winning all over the place.
 
@lynks heh, awesome.
why didnt you use a ready-made gadget?
 
 
10:52 AM
@lynks oo prettyyy
 
@AviD was just part of a larger program, and It's only like 5 lines of code for the layout.
@AviD and yes, our training set is mostly the matrix.
 
heh
 
> Goldfish Crackers
That's racist! :D
 
@AviD 29 isn't bad I think
 
Is Furrys' theorem relevant here? — innisfree 33 mins ago
Apparently that's a real thing
 
11:11 AM
need more rep...
 
11:26 AM
 
@LucasKauffman :'(
@LucasKauffman How much do you need?
 
@Adnan about 300 more
then I can pass hendrik
and I become an all time top 10 user
plays mortal combat music
 
@LucasKauffman Given that he doesn't participate so much, I think you'll be there by the weekend.
 
we need better questions though
or a small rep train would be nice as well
 
@LucasKauffman We need to get
 
11:35 AM
 
More than 30% of the questions there are reptrains
 
damnit
the IT department hasn't put my administrator rights back
 
@LucasKauffman Dobby said no?
 
@TildalWave apparantly, I need to have Truecrypt installed
 
hello
 
11:41 AM
wow
Your suggesting did the trick @MichaelHampton. Perhaps you'd like to make it into an answer, so I can accept it? The problem was the httpd directory, which was 700. I changed it to 777 & added +x. Might try to tighted it up a little now though. Thanks. — Peter Snow 12 mins ago
"so yea I just made that file available to anyone and made sure that every single file is executable"
 
@HamZa Hello hello
 
@LucasKauffman yeah I LOLed too
@HamZa g'day
 
^ That guy
@HamZa hey whatsup
 
@LucasKauffman fine and you ?
 
@HamZa good good
 
11:47 AM
@TildalWave it seems that Gilles did solve that gif challenge meta.security.stackexchange.com/a/1348/25859
 
@HamZa yup :)
Yeeey, it works :) the above PNG has the ZIP file attached to it after IEND flag (can be extracted as a data chunk using TweakPNG for example). Easy SE friendly file upload hehe
there's the saved page zipped in it with all the challenges we did or didn't do ;)
 
Yeah, hi @Tildal and @lucas, and fuck @Adnan
I don't like @HamZa anymore.
 
@Adnan huh?
 
great work everyone, sad I missed this one.
 
@TildalWave he's saying he wants a threesome with you and Lucas
 
11:55 AM
@TildalWave I'm just whining
 
@Adnan lolwut ?
 
@lynks so you were busy with your gf relationship huh? dare I ask how tired you are? :))
 
@Adnan there there, spill the beans
@lynks guess you were penetrating other stuff ;D
 
@LucasKauffman I am...
 
@TildalWave completely knackered. we hiked up two mountains in one weekend.
 
11:56 AM
I am.. :'(
 
my shins are killing me
:P
 
@lynks boobies!!
 
hiking, is that what you call it these days?
 
@TildalWave brecon beacons
 
@Adnan what's up ?
 
11:57 AM
@lynks I was close enough... they look like the top of a sunbathing babe
 
@TildalWave xD
 
@HamZa Naaa, nothing. I was just poking you
 
@Adnan you dirty boy.
 
@lynks shouldnt hold them behind your ears for so long.
 
@Adnan he who knows you need some emotional support :)
 
11:58 AM
@Adnan just saw you answered the FileZilla question too, with your fancy images. :P
@Adnan It's okay to cry. We are here for you. We will always be there for you and support you... and maybe mock you a little too, but only a little!
 
@LucasKauffman mock his little.
 
@LucasKauffman Yaaay. I can now rule the world!!
@LucasKauffman Well, you just need fancy images. Fancy images always get you the reps
 
@Adnan haha
 
12:14 PM
First @Lucus, as I made clear, this was a diagnostic move, not a permanent one. 2nd) this is only permissions to a web log directory and 3rd) I'm the only user on the system, so where was the risk? Might I suggest that instead of trolling, you use your skills to offer advice rather than to judge. — Peter Snow 11 mins ago
4777 is not a risk.
 
@LucasKauffman Of course not. chmod -R 4777 / is the first thing I do to when I install Linux on my systems.
 
@TerryChia I tried that once for kicks, it breaks the system :p
 
@LucasKauffman LOL accuses you of trolling and judging, which you were not, and the goes on accusing and judging
 
@LucasKauffman Heh. What caused it to break?
 
@LucasKauffman Which skills in particular do you use for judging?
 
12:24 PM
-4
Q: Name of security weakness when missed check for acess right

user28554Can you explain me some names(from cwe.mitre.org) for type of weakness when you miss or improperly(when you have same role with other user and can own his data) check rights for user in asp.net mvc app to edit security sensitive object! Thanks for answer.

how can this one have 4 downvotes and not a single VTC?
 
@LucasKauffman Bro, do you even have skills to offer advice?
 
@Adnan he's a senior troll by now, he has skills to offer advice rather than to judge
 
lulz
 
@TildalWave But honestly, why don't you VTC it?
 
@Adnan I was just curious ... thought to let you bite your nails for a while :)))
 
12:30 PM
@TildalWave as "too broad" ?
 
@TildalWave vtc is like...4 clicks, I need a lie down after 2.
 
@HamZa LOL no... "unclear"... because he didn't accept @LucasKauffman's answer in 3 hours and if that doesn't answer it then hell if I know what he means
 
Oh haaaai @Terry
Do you know what's 12650 -12591 = ?
 
@lynks you click in bed too much! :P
@Adnan 59?
 
@LucasKauffman isn't that answer NAA?
 
12:33 PM
@Adnan how many candles fit the cake?
 
@Adnan I'm pretty sure I've told you this before: Spongebob says "imagination" not "magic" in that scene.
 
An illegal prime is a prime number that represents information which is forbidden to possess or distribute. One of the first illegal primes was discovered in 2001. When interpreted in a particular way, it describes a computer program that bypasses the digital rights management scheme used on DVDs. Distribution of such a program in the United States is illegal under the Digital Millennium Copyright Act. An illegal prime is a kind of illegal number. Background One of the earliest illegal prime numbers was generated in March 2001 by Phil Carmody. Its binary representation corresponds to a ...
3
 
@Simon It's a meme. It doesn't have to be accurate...
 
@LucasKauffman From now on, this will be my theme song.
@TerryChia When it's about Spongebob, it has to be. You must respect him.
 
12:37 PM
@Simon which one?
 
@LucasKauffman The 99 little bugs in the code one.
 
@HamZa "An illegal prime is a prime number that represents information which is forbidden to possess or distribute" ... what, @Rory's age?
 
@HamZa love this. I remember someone saying how PI contains a high-resolution jpg encoded child-porn image. and also the bible. side by side.
 
@lynks seriously o_O
 
@Simon haha :p
 
12:39 PM
@HamZa @HamZa PI as a decimal doesnt repeat...so eventually all permutations have to appear.
 
@TildalWave that's an integer overflow not an illegal prime
 
@TildalWave no, his name.
 
@lynks no, that doesn't follow
 
@Gilles orly?
 
0.123456781011121314151617182021... doesn't contain all permutations (it doesn't contain the digit 9) but doesn't repeat
it is widely believed, but not known, that pi contains all permutations
In mathematics, a normal number is a real number whose infinite sequence of digits in every base b is distributed uniformly in the sense that each of the b digit values has the same natural density 1/b, also all possible b2 pairs of digits are equally likely with density b−2, all b3 triplets of digits equally likely with density b−3, etc. In lay terms, this means that no digit, or combination of digits, occurs more frequently than any other, and this is true whether the number is written in base 10, binary, or any other base. A normal number can be thought o...
 
12:41 PM
@Gilles given a target granularity (say the length of the bible), if each 'sample' (bible length block) has to be different, surely the one that matches the bible comes up eventually?
 
@Gilles well, eventually, it is either that or repetition. There is no 3rd option, though there is no proof of one way or the other.
 
@AviD no
 
@AviD nuh uh
 
I just gave an example
 
Google "Penrose Tiling", similar principle
 
12:43 PM
Sounds like everybody had a great weekend to discuss about normal numbers.
 
hmm.
 
@TildalWave That's how much rep I need to pass @Terry
 
“normal number” is actually not the concept we're discussing, this one requires equirepartition and not just existence
 
@Adnan Ahh, would have thought you are pass me by now.
 
the French term is “nombre univers”, I don't know the English word
 
12:44 PM
@Gilles so your base-9 example here...isnt that just an encoding?
 
@Gilles universal number?
 
@lynks it is not a base-9 example, I wrote in base 10
 
@Gilles That's odd, I've never heard that term before.
 
of course you can construct more elaborate examples
Un nombre univers est un nombre réel dans lequel on peut trouver n'importe quelle succession de chiffres de longueur finie, pour une base donnée. Ainsi, si l'on se donne une manière de coder un livre selon une suite de chiffres (ce qui est le cas dans un format informatique), on trouvera dans un nombre univers tous les livres déjà écrits et à venir. Mais on ne peut bien sûr pas en tirer une quelconque information : ce serait aussi efficace que de générer une succession aléatoire de lettres et de réessayer jusqu'à obtenir le livre que l'on cherche, et cela suppose de le connaître déjà lett...
 
En mathématiques, un nombre normal est un nombre réel tel que la fréquence d'apparition de tout n-uplet dans la suite de ses « décimales » dans toute base est équirépartie. Définition Soient B un ensemble fini de cardinal b>1 et x un nombre réel. Si s est une suite finie de chiffres en base B, nous écrivons N(s,n) pour le nombre d'apparitions de la suite s parmi les n premiers chiffres de x. Le nombre x est appelé normal en base B si \forall k\ge 1, \forall s \in B^k,\quad \lim_{n} \frac{N(s,n)}{n}\ =\ \frac{1}{b^{k}}. Le nombre x est dit nombre normal (ou quelquefois nombre a...
Is that a different term then?
Nombre univers would be for computing I guess?
 
12:45 PM
that's a different concept
 
@Gilles well at the end of the day it's just infinitely zooming in into a part of an infinite resolution circle and looking if it's flat at any zoom level... it's a bit like testing limits of our own patience :) (I might have over-simplified things for cosmetic effect :P)
 
kk
 
@TildalWave no, universality of pi has nothing to do with the “flatness” of a circle
@lynks if each bible-length block has to be different, then the sequence cannot be infinite, because there's only a finite number of bible-length blocks
 
@Gilles I thought that the higher precision PI can enable you to describe a more perfect circle?
 
@TildalWave “higher precision PI”? You aren't talking about the number pi then, but about approximations of pi that you're using for some drawing process
pi is a number. It doesn't have precision, it just is
 
12:48 PM
@Gilles like Rory then
 
@lynks like Rory vs a photo of Rory
a photo has a resolution, the subject of the photo doesn't
 
@TerryChia Not yet.
 
158
Q: Does Pi contain all possible number combinations?

Ritwik GI came across the following image, which states: $\pi$ Pi Pi is an infinite, nonrepeating (sic) decimal - meaning that every possible number combination exists somewhere in pi. Converted into ASCII text, somewhere in that infinite string if digits is the name of every person you w...

 
@Gilles well I might lack words to describe it :P
 
That also means that Pi contains itself an infinite number of times. It's Pi, all the way down! — Andrew Lewis Oct 19 '12 at 15:27
 
12:52 PM
> Odds are we'll see a 60-year-old Princess Leia in a metal bikini before we ever get to play 1313.
 
lol
 
That mental image....
 
@Gilles is there a decimal precision of PI that we know can't change no matter how much further we calculate it?
 
@lynks note that this is actually false
@TildalWave numbers don't have a “decimal precision”. Approximations do
 
@TildalWave I strongly believe that your question does not make sense. Please reword.
 
12:56 PM
in the same way that objects don't have a resolution, photos do
 
@ThomasPornin hehe g'day :)
 
So you're saying that π is a bit like reddit? — Mark Byers Oct 19 '12 at 11:00
 
@Gilles yep I felt that one might be a little odd. Btw, my continued interest has led me to en.wikipedia.org/wiki/The_Library_of_Babel#Plot_summary which I find hugely interesting.
^^ and here we have a prime example of what happens when you continue typing after a short copy-and-paste break.
 
@TildalWave Hello. As @Gilles says, a number is a number. "Precision" is what you have when you try to designate a number by another number, which is not exactly the same. For instance, you want to designate Pi (a number) by some finite sequence of digits (another number, distinct from Pi, but which has the good property of fitting in your computer).
 
Oh @Tildal - my age is perfectly legal. It just buffer-overflows most people :-)
 
1:02 PM
Now how can I get rid of that annoying flag ?
 
@RoryAlsop 902
 
@ThomasPornin Roar at it.
 
oh, sorry, now its 1103
 
Because @Lucas indulges in lmgtfy, I have a yellow flag on top of my sec.SE tabs and the only option I have is to add another flag myself.
 
the flag indicator used to be shown only when there were more than 5 flags to show. Apparently now it's shown whenever there's one
@ThomasPornin you can also vote to delete
 
1:06 PM
@ThomasPornin OK, I'm sure I have worded my question completely incorrectly... let's try again... calculating PI using infinite series, can we say with certainty that at some n-th term, we have z decimal positions that will not change with any n+x where x >= 1 term? And you know what? It makes even less sense now, but it might be a bit more precise question LOL :P
 
looks like someone is testing a bot
 
@ThomasPornin The answer itself is correct, I just added Google-fu because I believe it's better to learn a man how to fish rather than just giving him the fish.
 
@LucasKauffman yup, there was a “not an answer” flag which I counterflagged (“invalid flag”)
because you do give the answer
 
@LucasKauffman What about to barter to get the fish?
 
@LucasKauffman Don't teach the man to fish. Else there won't be any left for The Bear.
 
1:08 PM
@TerryChia The bear is a master fisherman
 
@TildalWave Ok, I see your point now. Yes, for most Pi-computing algorithms, you can reach points where you can say with 100% guarantee "at that point, I have the first N digits right". E.g. because you can prove that the sum of the remaining terms in the series can be proven to be lower than 10^-N.
 
@TerryChia lol fail
 
@LucasKauffman Give a man a fish, and you will feed him for one day. Pontificate about how learning to fish is more important, and he will hate you for your whole life.
8
 
@TerryChia that's a picture of thomas last year in spring
 
1:10 PM
lol
 
@TerryChia it doesn't really matter but the proper reject reason for a spambot is “vandalism”
 
@Gilles haha
 
@ThomasPornin or until he starves to death
 
It's trying to inject code in the comments or what?
 
Now I have a permanent "0" on the top row.
 
1:13 PM
@ThomasPornin it'll go away when a mod comes along
plus a few minutes for caching
looks like an old bug that came back with the recent flagging overhaul
 
@ThomasPornin OK thanks, so taking this "further"... to what "decimal precision" have we so far calculated it using any method? I mean... if I started printing out the decimal places only with 0s and using 10pt font, could I "climb on a Moon", or something like that?
 
1
Q: flag number not disappearing

WarrenFaithBrowser: Chrome Version 28.0.1500.71 on Xubuntu 13.04 I recently experiencing the issue that the flag number is not being removed when I click on it and the popup tells me that there is no flag anymore. The pop up text and the "show all" are displaying that there are none anymore but the number...

 
Any 10k+er seeing a problem with flag notifications?
 
@Adnan No, why?
 
1:19 PM
@Simon Hah!
 
@Adnan scroll up? Read the message just before yours?
 
@TerryChia :(
 
So with a 10pt font (assuming 10pt per digit), you get about 35 millions of kilometers -- almost 100 times farther than the Moon, but not enough to reach Mars or Venus.
 
 
@ThomasPornin I'm sure you can easily get laid by sharing this fact to a woman.
 
1:21 PM
@TildalWave you'll have a hard time printing out most numbers with just 0s
 
@Gilles Adnan fail!
@lynks Subzero! One of my favorites!
 
@Adnan That's the general consensus.
 
@Gilles yes yes... wait, calculating my "printable space elevator" :P
 
@lynks Did he get the mask in the new one?
 
@Adnan new one? I was just enjoying watching subzero wash his hands.
 
1:24 PM
@lynks that's a weird fetish, but hey, rule 34
 
@Gilles lolwut the world is big ..
sigh
Best title of the week. — HamZa 20 mins ago
 
@Gilles Ahaaaaa! So turns out the question is about offensive flags in chat.
 
For the record, I am seeing it both with Chromium and Firefox (with two distinct accounts) so that's probably not a browser-specific bug. — Thomas Pornin 10 mins ago
not many people can test 10k behavior with two distinct accounts
nonetheless @ThomasPornin you shouldn't make that too public, there's a risk that someone from SE will forcibly merge your accounts
 
@Gilles What the hell?! Really?
Also, do they merge the rep?
 
@Gilles Sockpuppets are allowed as long as "they don't vote for each other or for the same thing".
At least, so I was told.
 
1:35 PM
That is the message - long as they are provably separate.
 
I calculate that you could make roughly 100 round trips to Moon and back with 10^13 digits printed out... or describe the circle circumferencing Earth with 6338 dpi precision by using PI to 10^13 digits precise
 
@ThomasPornin there's a difference between “it's allowed” and “an employee who notices it is sure to leave it alone”
 
16 mins ago, by Thomas Pornin
So with a 10pt font (assuming 10pt per digit), you get about 35 millions of kilometers -- almost 100 times farther than the Moon, but not enough to reach Mars or Venus.
 
This is a neat prank
40
Q: Who chmod's a rogue chmod?

sundarToday I was told a tale by a Unix trainer, a tale where the root password got leaked to the students, and one of the fellas removed the execute permission from /usr/bin/chmod itself. How do you recover chmod in this case and make it executable again? Let's say getting it from an external source o...

 
@Gilles They actually sent goodies upon graduation to an account whose email address is "sockpuppet@bolet.org" so I daresay that if they have not caught up now, then they never will.
 
1:38 PM
@ThomasPornin damn, missed that when I was busy entering numbers in my calculator :)) thanks... I just took A4 size sheets of paper with a rough estimate of 50 lines per page... but that's a lot bigger than 10pt font
and I rounded it up since it's not really some meaningful data :)
 
@Adnan meh, trivial to reverse
also annoying for the users while the admins haven't fixed it
 
@Gilles Is it? I don't know, the answers don't seem to mention how to fix it.
 
@Gilles Although the "right" response, in sec.SE context, is that the machine should be burnt at the stake, and a new one installed. Bad guy went root, so anything could have happened (including reflashing firmware and other annoying things).
 
@Adnan having reading problems today? the top answer gives a command line
@ThomasPornin yeah, sure. It's trivial to reverse if what happened was chmod of /bin/chmod, not if all is known is that this happened
 
@Adnan Would it not be much more damaging to chmod +s /bin/chmod ?
 
1:44 PM
@lynks indirectly, yes, because it would allow people other than the ones who had the root password to do anything they want (and go pretty much undetected)
 
@Gilles Really?
 
@Gilles If the sysadmin is not in the habit of keeping an eye on setuid programs, that could be pretty nasty and stealthy...
tries it out on his work machine
 
@lynks keeping an eye on setuid programs? That's pretty much useless
there are far stealthier ways of planting backdoors. chmod back after you've planted the backdoor
 
@Gilles throwing a setuid root shell executable into some deep directory tree is a fairly quick/hacky privilege backdoor. But yeah, a proper rootkit is ofc the way forward.
 
@lynks and once you've done that, load a backdoor into the kernel
 
1:48 PM
@Gilles And then add a patch to the kernel upgrade mechanism so that the new kernel are backdoored as well.
 
Good morning ladies and gents
 
@GreenFly Gents ? There are gentlemen here ?
 
@GreenFly there is a bear !
 
Morning sir.
 
@Thomas excuse me. I will try again
Good morning ladies
@Simon how are you this fine day?
 
1:50 PM
@GreenFly Ladies and scoundrels will work.
 
@GreenFly I'm fine, thank you. How about you?
 
@Simon I'm wonderful
@TerryChia one can find that sometimes the company of scoundrels is far more enjoyable than others.
 
@GreenFly Any new things with your theft incident?
 
@Adnan the guy was bailed out and it seems he's awaiting trial
 
@GreenFly lol reading your question, what an event ...
 
1:57 PM
@GreenFly What about the person who did the job? The actual thief
 
@HamZa it was an interesting experience
 
00:00 - 14:0014:00 - 00:00

« first day (949 days earlier)      last day (3929 days later) »