The DMZ - 2011-08-02 (page 1 of 2)

« first day (229 days earlier) ← previous day next day → last day (4656 days later) »

12:24 AM

@Iszi Pretty much. Almost looks like some Perl that I've seen.

6 hours later…

6:52 AM

@RoryAlsop, @AviD : There is a comment to clear. Looks like the OP made a manipulation mistake, so don't want to flag as spam: security.stackexchange.com/questions/5847/…

5 hours later…

11:32 AM

@Iszi Some of the pizza places where I grew up would stop at gas stations and pick up things for you on the delivery. Round here we have 3rd parties that do food pickup and delivery that will accomplish the same thing.

11:53 AM

@Mvy done

@ScottPack including beer - some still do back home, but in the city it's all done by 3rd parties now

@AviD @Hendrik - Very amused by the google translate of that spiegel.de page

12:09 PM

@RoryAlsop Have you tried bear ?

Once, I ate some polar bear

it's a bit strong

@ThomasPornin no, not any kind of bear

(I've never really been up the far north of the world)

some day

I'm sure there was a sci-fi story about a group of people who tried to eat something endangered from every country. Not very ecologically sound:-)

@ThomasPornin @Grahamlee, @JeffFerland, @Mvy, @nealmcb, @ninefingers, @rakkhi, @ScottPack - anyone fancy taking up the media sanitisation blog post QOTW #4?

@RoryAlsop I'll take it.

Writing a blog post looks better than working on X.509 certificate validation

^^

What's the problem with certificates?

@Mvy The principle is sound and simple. Then it was addressed by accumulating standards on top one another.

Read this to get a grasp of it: cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt

This is an old document, it lacks the last ten years of development

@ThomasPornin - cool.

@ThomasPornin remember flicking through that to try and find some useful nugget for some reason once - serious pile of s.....tandards:-)

12:26 PM

ASN.1, PKCS#<fill_number_here>, X.509. Never thought of it, but yes I goes to a nice stack.

PER, DEM...

Why don't people try to make some common standards...

@Mvy There is an xkcd comic for that

The problem is that they are trying to make common standards

The one guy who did not try to make a common standard was Zimmerman, and he wrote PGP, which is all weird and clunky and sloppily-hacked-together, but at least remains sufficiently small to be implemented in a reasonable amount of time.

hm

The good point of certificate is the chain of certification. We don't have it with PGP. So I keep balancing whether I shall use one over the other for mails.

Ended up I don't use any because at last, nobody cares...

@CRoss goes a little blurry in the avatar list... I did not recognised you.

12:44 PM

@Mvy I am using PGP with some customers, in the way which works well: get keys from key servers, check fingerprints by phone. No actual "certification" involved.

S/MIME with X.509 certificates is a solution which is looking for a problem to solve.

Well, the problem is the same. Authentication. Indeed you can confirm fingerprints with people you know. But what about people you don't know?

@Mvy If I do not know them why would I want to talk to them, securely or not ?

Public administrations?

I am not going to send confidential information by email to someone I have not "cleared" one way or another

As for public administrations, the problem will not arise until they go beyond the victorian-steam-engine stage, and discover electricity.

3

@ThomasPornin you have a point here. XD

1:08 PM

@ThomasPornin we can live in hope

The Evil Phoenix

1:21 PM

mornin everyone

Hi @TheEvilPhoenix

Ok; mailbox cleared...

Hi @Thee

1:37 PM

I saw somebody saying they were bringing Security.SE shirts to Black Hat...

I want to know who to talk to so I can get some shipped to hand out at Security BSides and DEFCON

Hi @Jeff - guessing the best option would be @RobertCartaino

@RoryAlsop Particular room I should look in to find the fellow?

he was the guy I was speaking to before BsidesSF - unfortunately we couldn't get them sorted before the event.

teacher's lounge, if you are a mod anywhere.

Blargh. Not a mod.

or failing that, email

do you want me to ping him on techer's lounge to let him know you'r plans?

1:41 PM

That would be good.

@JeffFerland okay - have left a ping to pop over here and chat with you

Oh hai @Grace

:-)

Hi

If only @Iszi were here - we seem to have problems identifying his/her pronoun too:-)

Oh @GraceNote ?

I would recommend not getting caught up on that. It's unnecessary.

1:51 PM

LOL

sorry

It's alright, no need to apologize.

(was more a joke for Iszi - but he's not in)

@Grace - can you help @Jeff with his query re schwag at cons?

@RoryAlsop I can listen, I don't know how much I can help directly though

@GraceNote Wondering about sourcing some Security.SE shirts to hand out at BSidesLV and DEFCON

@JeffFerland - you still there?

ah - I'll shut up now then :-)

1:54 PM

I bet I can get Kaminski to wear one :)

@JeffFerland Now THAT would be a total win:-)

Kaminski? Don't recall his first name.

Dan

Dan Kaminski... Mr. DNS

one of the first security 'rock stars'

1:58 PM

I had a teacher with that name.

Dan Kaminsky is an American security researcher. He formerly worked for Cisco, Avaya, and IOActive, where he was the Director of Penetration Testing. He is known among computer security experts for his work on DNS cache poisoning (also known as "The Kaminsky Bug"), and for showing that the Sony Rootkit had infected at least 568,200 computers and for his talks at the Black Hat Briefings. In June 2010, Dan released Interpolique, a beta framework for addressing injection attacks such as SQL Injection and Cross Site Scripting in a manner comfortable to developers. On June 16, 2010, Dan was ...

DNS rickrolling = WIN

saw him talk in 2006 - very good public speaker

Anyway, have some connections to him, Strachs (guy on the front page of Wired), etc.... so get me swag :)

... or he was, I thought?

The "we can open all the doors in your prison" tlak

Has Jin ever talked about cards/T-Shirts before? Also, when is this conference?

2:02 PM

BSides starts tomorrow. DEFCON is in full swing Friday-Sunday.

If there hasn't been any prior discussion I doubt you'll be able to get t-shirts going in the next four days

Jin talked about it there : meta.security.stackexchange.com/questions/345/…

(first occurrence)

I know he was working on it.

Yeah, T-Shirts are pretty much a no-go if you need them this week. Those things don't just come off a printer

Gaming had designed for their T-Shirts and it took a month and longer, as it were, for them to arrive.

@IvoFlipse made a photo of his pack on G+

Yeah.

2:08 PM

:D

What should the process be - I know after discussions with Jin and others about specifically these 3 conferences (the biggest concentration of security folks annually) that it sounded like they were being printed and would be generally ready - but I'm guessing I got the wrong end of the stick there?

@Rory Eventually a meta thread will start up saying "Security swag for the top 2 pages of users"

To have the wrong end of the stick??? @RoryAlsop's daily expression feed.

I'm not sure about organizing shirts and stuff for conferences; you would probably have to start up a meta thread much ahead of time

I'm gonna improve my english expressions in there

2:11 PM

@Mvy English slang and gutter argot for the non-British

hm.

Is there anything other than Shirts and Cards that is wanted for this event?

@Mvy Wrong end of the stick means to have a misunderstanding

yep I got that :P

@GraceNote I think they were the most likely to generate interest and be seen

2:12 PM

That's funny, because a priori each end is as good as the other :P

@GraceNote I think shirts & cards would be sufficient / most effective. Nobody will be sporting coffee mugs.

The Evil Phoenix

heh

infosec folks are just like normal IT folks - if it is a t-shirt in black they'll be interested

@GraceNote If I can get design files and approval to submit a voucher for some number of shirts / cost, I can get them in time for the Cons

The Evil Phoenix

lol

i'll take a tshirt and a coffee mug :P

just because i can :P

and... considering how much coffee i drink on a daily basis...

:P

2:13 PM

@JeffFerland I will pass that on

How many people do we have attending this conference?

@GraceNote Last year, DEFCON had over 10,000 attendees and 3 days of speakers across four tracks, plus side-talks and contests.

@JeffFerland I meant, from here, to determine how many people we would need to provide stuff to

only a handful

So, five?

@Zuly, @Jeff, @JustinClarke definites

2:17 PM

Official word is, "BSides is out of the question, but we may be able to get something working for DEFCON if we get all of the information we need today"

(trawling my tweets to see who else...but do we want to make a call at 5 in order to get a definite number

@GraceNote That's a good word. What information do you need?

if there are only 3 that gives the option to provide a couple of t-shirts to folks like dan kaminsky...very high profile presenter

If Barkode attends this year, I can get one on him too, I think. No Ninja party due to his health, but he's a big social point of the con.

@JeffFerland I'll be needing names and mailing addresses for all of the people, as well as some estimates for numbers.

2:21 PM

@GraceNote What channel should I send my info through? email addy?

@JeffFerland I'll provide you an email address once I make some confirmation.

oh, by the way @Jeff - I am incredibly jealous. Last BH/Defcon I got to was 2006. Hopefully next year in my new role. Have a brilliant time!

@RoryAlsop 3rd year running... gets more awesome every time!

@ThomasPornin - got one over here appropriate for you. I'll point them our way, but thought I'd let you know

0

Q: Algorithm for one way password encryption

What is the most secure one way encryption algorithm to encrypt passwords? MD5 and SHA (1..512) are frequently used, but they are designed for speed what is bad for preventing brute force attacks on encrypted passwords. The algorithm shouldn't be too exotic, so that it can be used with common ...

security encryption hash passwords password-protection

@JeffFerland I used to send my team - most cost effective sec training, even including cost of flights and hotels from Scotland

@RoryAlsop "Most secure" almost sounds S&A.

2:24 PM

it was just harder to justify for me as I get more pointy haired

@RoryAlsop Looks like a migrate-and-close-for-duplicate situation

@Iszi afternoon

@RoryAlsop I think I missed something...?

@RoryAlsop I learn as much in that conference as I do the rest of the year. I probably drink as much in that week as the rest of the year too.

@ThomasPornin will do that

2:25 PM

@RoryAlsop U.S. EDT, damnit! It's morning!

@Iszi nah - I was just messing

Well it's 16h26. Tea time for me.

@Mvy sounds a little late for golf ;)

... that's my horrid pun for the year. I'm done.

@JeffFerland oh, dear lord...

Another thing, we could agree to say "Plop" as a synonym to "good morning" "good evening" "good night" "hi" "bye" etc.

@JeffFerland I dunno what to reply to this.

2:29 PM

heh - think @Scott had a phrase which worked, but I can't find it right now. was something timezone-independent

@Mvy "Don't feed the trolls" is probably the closest thing that relates to that line. Never encourage anything that bad!

@JeffFerland ▲+1

@Thomas, this one may be more interesting then:

3

Q: How can four employees calculate the average of their salaries without knowing other's salary using RSA?

I know of a solution. But this has a limitation that information is partially passed around and there needs some trust level. I'm wondering if any variant of public-private key (e.g. RSA) algorithm can solve this. --Spoiler Alert: solution without RSA-- Salary of A: x Salary of B: y Salary of...

puzzle cryptography

Oh wait? what?

Lol

Okay, question - DEFCON is entirely different from the Black Hat conference that Zuly talks about on your Meta, aye/nay, @Rory and @JeffFerland?

2:32 PM

Why four salaries BTW?

it's a puzzle - not really crypto, but amusing nonetheless

Makes me think of Diffie Hellman

@GraceNote Blackhat is the expensive corporate pressing the flesh conference, Defcon began as the underground counterpoint, but now it is the big one, and BSides is underground to them both

@RoryAlsop I think it was a programming gag having to do with a variable for the time of day.

@GraceNote Same city, many of the same speakers, back-to-back and organized by the same company. Black Hat is the "corporate" one. DEFCON is the community one. I more highly regard DEFCON myself.

2:33 PM

Defcon starts at end of blackhat

Actually there is some high crypto which can be done for that

depending on how far you want to go into mistrust

www.defcon.org

... and Blackhat was started after the creation of DEFCON. It's more of a cash cow for the organizer.

e.g. if some participants want to make invalid messages in an attempt to get information from other

or quite the protocol in the middle

www.blackhat.com

2:34 PM

Got it

@ThomasPornin Love it :P

headdesk "Can you write up a budget in the next 80 minutes, minus the 30 you have scheduled for a pentest call?"

Salary of A:  x
Salary of B:  y
Salary of C:  z
Salary of D: u

mathematicians...

@JeffFerland correct answer: can you stick your head....

It's looking like we should have a greenlight for the swag, since Zuly already had shirts and such for the Black Hat Conference. I just need a confirmation from the top, but all other components check out.

2:45 PM

@GraceNote any estimate on the production amount? I want to get an idea of what groups / how many folks I can plan on shirting beforehand

@JeffFerland The people who the swag will be distributed to, how does this compare to the group that will be for the Black Hat Conference?

@RoryAlsop I can't recall what that would have been. I still maintain that USEastCoast is the canonical timezone.

@ScottPack :-) but as we all know GMT is measured from the official centreline, and UTC has the word Universal in it, so we must be right, right?

@ScottPack Yeah US-Eastern!

Hi five!

@GraceNote remarkably similar in both attendees and speakers I reckon

2:49 PM

@RoryAlsop Let's be honest, old man. We don't go around mucking with pitch and masts anymore. I do, however, think it's cute how much you blokes seem to be hanging on :)

hehe - excellent. I do like mucking around with masts - not used pitch for a bit, though...

carbon fibre is more my thing

Sailing always seemed like something that would be fun to try out. The lakes and waterways of my youth are much more conducive to pontoons and paddles.

@ScottPack I think it's mandatory in Orkney!

massive tide-races, continuous high winds == fun!

That seems to make a bit of sense. How else would one get to the post office?

@GraceNote I don't know. Most of the folks I've got in my head are DEFCON only. Some key spearkers, the Seattle group that includes some of the conference organizers, some of the contest participants. I can definitely distribute 100 shirts with various groups and very broad exposure.

2:54 PM

@Scott nah - the post office and the bank fly to you

@JeffFerland Defcon will always be the higher value end. Black hat is very suit wearing!

@RoryAlsop so no swag for them?

I think I need to push rather hard to make it out to Defcon next year.

@ScottPack rbs.co.uk/personal/ways-to-bank-with-us/mobile-bank/…

@ScottPack We should try and push for a large sec.se contingent for next year, or get @Jeff to help convert the existing Defcon population to sec.se users:-)

15 new users per shirt. how many users do we want? :)

@Scott - this is what I learned to fly in. And also what flew the bank and the post office to the islands:

user image

@JeffFerland as long as they wash in between, I don't care how many share:-)

3:03 PM

@JeffF Refresh my memory on attendees. I'm going to send out emails to get everyone's mailing addresses.

@GraceNote from this site? I think it's 3 people including myself. @Zuly and @JustinClarke

So really I just need to get yours and Justin's. I'm not sure what to do about Zuly... Zuly already has some level of swag from the Black Hat COnference, and if it leads immediately to the next, is there even a home trip in between to retrieve a new shipment?

@GraceNote was planning on shipment in my name to hotel. I'm leaving in 5 hours.

@JeffFerland That works.

Justin Clarke, London, United Kingdom

375 4

appsec web-application code-review owasp-top-ten sql-injection countermeasure tools

This Justin, correct?

@Jeff - do you know @Justin?

He's connectjunkie

@GraceNote Yep that's him

already on his way - he's head of Owasp London

3:09 PM

@RoryAlsop I don't know him.

and owns Gotham Digital in London

@RoryAlsop I agree, that could be a great event. I've yet to have had a chance (or made the chance I suppose) to hit one of those up.

not to worry - I'm sure I can arrange for him to meet you if that's the only way to get swag etc

in fact - if you do twitter, he is easily findable as @connectjunkie on there

do you have a twitter account? I'll DM him to follow you then comms are simple:-)

HA! Tweet of the week: "Find your robot name: Take the first 16 digits of your credit card & combine w/ the start / expiry dates and security code. What's yours?"

I liked that one

I'd hate to think someone might just do it....

3:14 PM

hunter2

Some people are just plain foolhardy. The sad thing is that these kind of things do work.

I bet we could get one or two users here to give it up if we told them to hash it first and then generated something from the hash... never mind that it reduces the problem complexity to 10^24 or so

@JeffFerland go on - try it on @Thomas :-)

I bet that will end with @ThomasPornin getting the Credit card number of @Jeff

heh heh heh

@GraceNote followed

This could be exciting....

3:19 PM

@JeffFerland The first digits actually identify the bank. The last digit is usually a simple checksum over the previous ones.

starts his PGP Desktop install

The the expiry date is only a month in the next few years, so there are no more than 50 possible expiry dates

Total entropy is about 10^18

It would still require a bit of work

Say 100 GPU to explore the whole space within two or three months

Well, if we want to be really particular, AMEX cards are setup so that the last five digits are an account issuance order + check sum digit. The first digit is a 3, so that leaves 8 digits to make the account number.

@Jeff, how much do you have on your account ?

... and Thomas is now one step closer to my account number :P

3:22 PM

@ThomasPornin yeah, that's the real question. :P

@ThomasPornin how much would you like to pay off? :)

@ThomasPornin let me just send you one of my pre-printed checks and you can send me another check for the difference.

@JeffFerland You live in Nigeria ?

XD

commute time - catch you anon

same

3:24 PM

Enjoy

... take the MD5hash of each number in your card, post the first characters from the hash output... oh, good point.. MD5 is insecure... why don't you hash it with SHA256 and then we know your card will be safe XD

"I think this project will cost you about $45k if you do what I tell you, and $180,000 if you keep derailing me every time I talk to you." There. I made a budget.

I figure it'll be easier to pickpocket someone else's card, put in some very light obfuscation of that, then be off with it. If you somehow derive my card number from that, well, I don't know what I'd say.

@GraceNote I heard that the market price of a stolen credit card number is around 10$ or so these days.

@ThomasPornin That seems decidedly expensive

@GraceNote Profit margin is high on use, I imagine.

3:32 PM

@GraceNote This is rather apropos.

Security

@ScottPack Quite

@ScottPack Classic XKCD

So, $5 if you do the work yourself, $10 if I hit him with my own wrench.

That's a good $15-20 wrench right there. I would probably suggest a Monkey or pipe instead.

4:00 PM

@ScottPack Yesterday I uprooted a few plum trees and a maple tree; I could extract a length of reasonably hard wood from that.

Wood is good for the environment-friendly interrogator.

@ThomasPornin And splintery!

1 hour later…

5:05 PM

@RoryAlsop Draft written. Anyone to review it ?

Anyone know what timezone Zuly and Justin are in?

5:32 PM

@ThomasPornin S/MIME isn't just about confidentiality. There are lots of good reasons to want to be able to sign messages to people who don't know you and won't phone you to check a fingerprint. I should check the status of using DNSSEC and signing keys in DNS to allow verification of that sort of thing.

6:02 PM

@nealmcb Actually these are not good reason to want to be able to sign messages. Nobody really wants to sign things. What we want is that other people sign things they send us.

Signing is mostly a way, for the signer, to become liable for what he signs.

I am quite eager to receive signed emails, as long as that signature means that I will be able to exhibit the emails as proof, should any legal action ensue.

The management wants people to learn to expect signed messages, so they don't swallow forgeries. So does the school administration, etc. To avoid having to followup up a forgery with "Today is not a snow day!"

@RoryAlsop Tell them to hash it first for "security" :) [hmm - I wonder how much entropy there is in a credit card number? :]

2 hours later…

7:54 PM

"Your password please"

user image

@ScottPack

I'm not entirely sure I want to know where you got that picture.

8:22 PM

@ScottPack evening

G'day!

Rebuilt my desktop, got the graphics working, now just waiting for CrashPlan to finish restoring files.

I'm actually impressed with out well that process is going.

excellent

@RoryAlsop actually it is crypto secure multiparty computation

Pretty much just click the checkboxes and hit the big 'Restore' button. Now I don't feel so bad about recommending it to people.

my day was a bit boring, but then I found out that not only are we playing at the Scottish New Music awards, but we have been nominated for an award. (Yeah, my day not quite so professional...:-)

@ScottPack that's pretty good

This question seems interesting - which is why I asked him to migrate

8:26 PM

@RoryAlsop Congrats! When is that shindig going down?

0

Q: What tools exist for Open Source Intelligence (OSINT)?

I'm starting to do some research in the area of open source intelligence (OSINT). I'd like to compile a list of tools/resources (software/web based/libraries/etc) that can be used to profile, social engineer, crawl social media and public databases, etc. Please skim this wiki page before postin...

tools opensource social-engineering intelligence

@thisjosh Excellent

@ScottPack 4th of september

@this - I'm intrigued by your avatar. Is it based on an equation, or just pleasing to the eye

@Scott -

Maltego and Pipl both make me happy.

scotmusicawards.co.uk

At least there's a cute girl to distract from your creepy ass mask.

I believe it is based on a set of equations, I got it from a public domain math textbook.

8:28 PM

Maltego is excellent - have seen some awesome demos (bit hard work getting it set up) - one involved Tony Hawk's global treasure hunt thing

@Scott - actually Jill, the girl bottom right, is way cuter than this pic makes out

and the other one way less cute

The Sensational Alex Harvey Band will be there too!

Not sure from the organisers whether it will be Nazareth as well (as they shared some folks)

The first time I used Maltego I got so giddy that I brought Katie downstairs to look her up. Lots of fun.

Maybe it is just SAHB

@ScottPack Hahahahahaha

For some reason it spooks spouses:-)

The real problem with secure multiparty computation is that you usually need a random element which injects uncertainty into the result

So we need to know to what accuracy they want to know the average

While prepping his Strong Password talk for our seminar last year, one of our guys gave his wife a run-through.

She freaked out and changed all her passwords on the spot :)

@thisjosh I remember reading a mathematical explanation of a proof similar to this and kind of understood it at the time. Not so much any more...

@ScottPack Result:-)

8:32 PM

@Rory Likely the cave example, one party knows the combination to go between the left and right side of the cave

that one really confused me

I believe US time zones did not become standard untill completion of the transcontinental railroad

I believe US time zones are not standard yet.

Time in Indiana

Time in Indiana refers to the controversial time zone division of Indiana, and to the state's historical response to daylight saving time. The official dividing line between Eastern Time and Central Time has, over time, progressively moved west, from the Indiana–Ohio border, to a position where it divided Indiana down the middle, to the Indiana–Illinois border as it is today. Effective March 9, 2008, twelve counties in Indiana observe Central Time. These twelve counties are Jasper, Lake, La Porte, Newton, Porter, and Starke in the northwest, near Chicago, and Gibson, Perry, Posey, Spen...

Oh they're standard, but you know how americans are, unhappy without something to rebel against

no no - that's the Scots

:-)

8:39 PM

Or maybe the transcontinental railroad did not reach Indiana, which is an entirely plausible theory.

@thisjosh Hey, quizz time: what are the three countries which do not use metric system ?

When you say use you mean as common in commerce?

I mean as: being the referent system for anything legal

The US is the easy one

yes

There are 3? I thought it was only the United States and some island nation that was small enough to be a rounding error.

8:41 PM

UK commonly uses pounds for weight instead of kilograms

@ScottPack that's us, isn't it

@thisjosh I think the UK now defines pounds relatively to kilograms

so they use pounds but that's metric system with a disguise

we use stones for weight of people, feet and inches for height, centimetres for measuring small things, I wouldn't have a clue how much a kilogram is

@RoryAlsop Well, nominally yes, but from what's in my memory even you would consider them such.

and I drive at x miles per hour, but I buy my petrol in litres

8:42 PM

(just a way to keep that French garlic smell away)

Is Bermuda a sovriegn country?

@RoryAlsop Thinking of kilograms in terms of pounds will confuse you. Consider them in terms of slugs and you'll be fine.

No, Bermuda is not sovereign

@RoryAlsop And let's not forget that you measure your fuel efficiency in litres/100mi.

Cayman Islands?

8:43 PM

@thisjosh Neither

@ScottPack no - miles per gallon

The other 2 are land countries

I think car manufacturers do, but no-one understands them

switzerland?

@RoryAlsop No, Swiss people are boring but sane. They use the metric system.

hahahahahaha - what a wonderful description

8:45 PM

you arn't counting Antartica are you?

@RoryAlsop Oh, when did that change? I was still seeing litres/100mi as of 2004. Confused the hell out of me when trying to decide on a rental.

Ah, a great geopolitical puzzle is Antartica.

Ok, answer time:

The US is the only industrialized country that doesn't use it, so that certainly narrows down the list.

Liberia and Myanmar

@ScottPack it was always mpg, but they keep trying to make it litres

8:46 PM

I should have guessed Liberia.

(Myanmar being previously known as Burma)

@RoryAlsop Assholes.

hard to get

what do liberia and myanmar use?

It had to be sufficiently away from Europe

8:46 PM

I think Liberia uses US measures

which makes sense since it was a US pseudo-colony

and not a source of modern technology

In Myanmar they are quite mad

for instance all their banknotes are multiples of 9

@ThomasPornin We like to refer to it as the 'Back to Africa Movement'.

because it was decreed that 9 was a "lucky number"

so I am not sure they actually measure things in an Euclidian space

2

I was having trouble because I can think of formal UK colonies but no US colonies

except the Philipines and Puerto Rico

8:48 PM

@thisjosh Puerto Rico is a protectorate, not a colony.

@ThomasPornin Left hand rule for them?

Well, technically it's a Commonwealth, but good luck figuring out the distinction.

@Sco And the difference is?

They don't get a vote do they?

Do they pay taxes?

@thisjosh:

very explanatory

Yes I've seen the Triumverate before...

8:51 PM

@thisjosh It is a bit of a tighter connection than, say, Guam, but still not a full state.

I really dig that video.

Oh video, sorry will need to wait till I fire up the ephemeral browser

oh - I want a browser called ephemeral - just sounds cooler than chrome, safari etc

@thisjosh To the best of my knowledge they are in the same boat as DC. They have a non-voting Congressional representative, they do pay most (if not all) of the normal taxes, they cannot vote in Presidential elections, etc

@ThomasPornin - your QOTW post looks good. I'll schedule it in (it can still be edited while in the schedule queueueueueue)

There was a bit of discussion with @thisjosh - would you prefer tomorrow or Friday?

Wed might be a better choice for more views

« first day (229 days earlier) ← previous day next day → last day (4656 days later) »

Transcript for

Aug '112

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile