The Comms Room

1:54 AM

> This server is not vulnerable to the POODLE attack because it doesn't support SSL 3. MORE INFO »
> This server supports TLS_FALLBACK_SCSV to prevent protocol downgrade attacks.

Bob

@MichaelHampton :)

Hm.

Bob

2:09 AM

@MichaelHampton How did you enable TLS_FALLBACK_SCSV?

Mark Henderson

Fucking dell. "Please enter your order number" copy paste from email "Please enter a valid order number"

Michael Hampton

@Bob yum update openssl

Bob

@MichaelHampton Oh. Debian probably hasn't done that yet, then.

More accurately, it's there in unstable and probably stable (can't see changelog), but not testing yet. Same old.

I really should just use unstable.

Michael Hampton

Now all I have to do is get new certificates.

ssllabs is complaining about certificates with SHA1 signatures

Bob

@MichaelHampton Eh. If they expire soon enough then it doesn't really matter.

It's complaining about the intermediate certificates on mine. Not much I can do about that anyway.

Michael Hampton

2:15 AM

Expires in 1 year 1 month...

> Certificate uses SHA1. When renewing, ensure you upgrade to SHA256. MORE INFO »

Bob

I can't remember what the problem with SHA1 actually is.

Michael Hampton

@Bob There is a significant attack which has made SHA-1 too weak to use in ... a few years from now.

Bob

@MichaelHampton Define "significant"

All I see are ocllision attacks.

Wouldn't a (second?) preimage attack be required?

A plan collision attack just needs to generate two inputs that hash to the same output. A second preimage (an input that hashes to a given output) is much harder, and AFAIK what's actually required to impersonate some certificate.

Michael Hampton

Don't look at me. I only do what Bruce Schneier tells me to do.

Bob

Hm... actually, now that I think about it, it's not really required to get the same hash as another specific certificate (unless you want to attack pinned certs), but matching the hash of any signed cert would still be equally trusted by browsers.

Yea, that's an issue.

ewwhite

2:44 AM

0

Q: How does the creation of memory storage inside a SD card/flash drive work?

I hope this is the right place to ask this question. As all of you already know about SD cards and flash drives; I would like to know how do you create memory storage in those devices? How do you create a specified amount of memory storage which can be programmed into SD cards, flash drives, et...

Ry Jones

@ewwhite looks good to me, what's your beef? maybe he wants to format his four gig card to thirty two gigs.

Bob

@RyJones doesn't really seem appropriate to SF

maybe SU, but I dunno

Ry Jones

@Bob Sorry, I left off the "this guy is a fucking idiot" tag as well as the "this is obvious sarcasm" tag.

Bob

@RyJones Hm. My sarcasm detector must be wonky today.

Journeyman Geek

You need to smack it a few times.

Ry Jones

2:51 AM

I voted -1, that's all I can do

Journeyman Geek

I VTCed ;p

Ry Jones

I am but a prole with no such power

Journeyman Geek

0_0

Ry Jones

2

Q: Server 08 Print server deploying to server 03

Server 08 R2 setup as a printer server with 300+ printers installed. I created an empty GPO and enforced it on the OU containing a few servers that are server 03 that I need the printers to be deployed to. No event logs, Logged in and out, did a gpupdate /force gpresult shows the GPO is applie...

windows-server-2008 windows-server-2003 print-server

I know you love print spooler questions

@cole see above

0

Q: Scan through USB connected printer on Print Server

I have two printers, a Lexmark laser printer, and a Canon colour printer/scanner. They are both hooked up via USB to my Print Server. They are set up in Print Management and shared as \\PS1\Lexmark and \\PS1\Canon. When the client computers use the Canon printer via print server, they are not se...

windows-server-2012 printing windows-server-2012-r2 drivers scanner

Mark Henderson

3:10 AM

So I just spend $460 on network and power cables

Shit adds up quick

Bob

ouch

how much did you get for that?

Mark Henderson

@Bob 40x 2m network cables in an assortment of colours, 18 IEC power cables (half red, half blue), and some cable labels

And a 2U lockable drawer

Bob

3:26 AM

@MarkHenderson Huh. Not bad.

Labels are stupidly expensive :\

Mark Henderson

@Bob Yeah

I'll never use that many though

Even if I label the cable every meter I won't use that many

I also only have $160 of this projects budget left so this better be the last thing I need to order

(fairly sure it is)

Iain

5:43 AM

G'day

There are so many weird projects that I had to read the question serverfault.com/questions/637709/…

spam btw

Wesley

@Iain bite

Journeyman Geek

ugh

I swear I'd love to put our old backup system in a shredder.

And I could, cause it seems to be badly labelled cds.

Nick

6:44 AM

Yay no work today...

Unfortunately I am also sick

Jenny D

7:26 AM

morning

Ry Jones

7:40 AM

@JennyD salut

Jenny D

@RyJones salut, ça va?

Ry Jones

@JennyD très bien. Vu? (and that's the limit of my jr high french)

Jenny D

@RyJones :-) I'm reasonably good. This Friday may possibly maybe not entirely be the worst kind of Monday.

Ry Jones

@JennyD ah, start of the week, is it?

Jenny D

@RyJones No; it's just that generally any day is the worst kind of Monday while it's going on

Ry Jones

7:46 AM

@JennyD Understood. I'm trying to get the steam up to write a long email on white space standards... I don't have the heart to beat anyone up over trivia such as this

Jenny D

@RyJones my take on coding standards (including whitespace) is that they're like traffic rules. It doesn't matter so much what the rule is; all that matters is that everyone does it the same way. You may have a brilliant way of driving through a roundabout, but if everyone else does it differently you'll end up with problems....

Ry Jones

@JennyD the issue is the tool version changes the output, so people are getting conflicting results depending on the tool they happen to install

I really don't care. I'm sure there's something better to talk about. :)

Jenny D

ouch, that can cause problems, yes...

I will go back to writing perl scripts and hope I do a better job of it than I did yesterday

Ry Jones

perl is a cruel master. I wish you good fortune, as this day's journey is done for me and I must retire.

Jenny D

@RyJones sleep well

perl is actually one of my favourite masters; yesterday I was just being stupid which I can be in any language whatsoever...

tombull89

7:59 AM

non uniform day today for "culteral diversity"...so explain the Superman Onsie.

Journeyman Geek

@tombull89: Kryptonian culture needs to be respected!

That is the ONSIE OF COURAGE!

Jenny D

@tombull89 that sounds like a naive idea that could go spectacularly wrong

dawud

morning

Jenny D

not the superman onsie, the whole thing I mean

tombull89

@JennyD normally it's a competition between the girls to see how much make-up they can wear.

Jenny D

8:06 AM

@tombull89 I just get this picture in my head of someone trying to be "diverse" by wearing a Halloween Sexy Indian costume or something.

dawud

8:46 AM

...only a few hours away from a whole week of holidays \o/

Chopper3

@dawud oh nice, what are you doing?

dawud

I'm flying to Spain this evening, and expect to spend at least two days climbing, if the weather is nice

Chopper3

@dawud sounds great, won't be too hot this time of year either, hope you have a nice time

dawud

9:01 AM

other than that, mandatory visit to family mambers, a couple of nice beefsteaks, a walk to the mountains nearby and taking care of my cats

@Chopper3 thanks!

RobM

9:25 AM

That moment when one of our helldesk technicians stops the college principal on the way to a meeting to ask him if he knows who rebecca black is.

tombull89

@RobM :|

RobM

:-S

The principal now wishes that he took my suggestion to 'just walk away'.

But at least he now knows that today is friday and saturday comes after

it's like a portal to 3 years ago!

faker

9:45 AM

I'm coming back after 2 days of vacation to find half our search cluster offline. When asking wtf is going on they say nobody knew what to do. That was blocking new search indexes from getting pushed live for 2 days

and it's well documented in the wiki what to do :(

Dennis Nolte

9:59 AM

@RobM at least the technician got enough balls to stop him/her, there are plenty of techs who have some issues speaking to the higher ups (something like: this will not work because X)

Dennis Nolte

10:09 AM

am i just inexperienced that i find this comment "you have to have a good reason for installing a server of whatever behind nat." to be not that true?
http://serverfault.com/questions/637711/openvpn-client-port-forwarding/637735?noredirect=1#comment768415_637735

is it not perfectly valid to have the sales person vpn to your office, while you do not let the vpn server need an actual "routeable" IP?

RobM

@DennisNolte true, and actually most of our big cheeses are pretty cool with stopping and chatting nonsense here

Michael Hampton

@DennisNolte We only accept NAT because there aren't enough IPv4 addresses for everyone. In an ideal Internet it would never have been invented - or necessary.

And I haven't had enough coffee to understand what he's getting at in that comment.

Dennis Nolte

@MichaelHampton ye, ideal internet , sure, with no exploits and perfectly secure firewalls (if you need them at all)

Jenny D

@MichaelHampton There are a few people who are utterly convinced that NAT is Teh EVUL!!! I'm guessing this is one of them.

Michael Hampton

@DennisNolte Eh?

@JennyD Well, it is...

Dan

10:18 AM

I'm bricking it

Jenny D

@MichaelHampton It's a technique that can be useful when applied properly, worse than useless when applied improperly. Much like pretty much everything we work with.

Dan

Go live today of my biggest mission critical NetScaler install

Two HA pairs, load balancing all internal services plus reverse proxy, VPN, content/resource switching

Michael Hampton

Useful, yes, I suppose so. I'm still looking forward to the day when it's only a historical curiosity.

Dan

@MichaelHampton Yeah, but you're looking forward to IPv6

Dennis Nolte

well, you talked about the ideal internet, if i extract that term and increase it a bit to the rest of the fucks which do not work or are bad currently i added my above sentence.

In absence of NAT every device shoudl have to be pretty more secure than currently, which depending on your point of view, would either be good or bad.

Michael Hampton

10:21 AM

@DennisNolte NAT isn't a firewall. A firewall is a firewall.

Dan

@DennisNolte I'm with this - I know NAT is a protocol abuse and that we'll have firewalls, but ultimately having a device behind NAT is extremely safe until you manually forward ports

Michael Hampton

It might be an accidental firewall :)

Dan

I just quite like the disconnect between internal and external

They're different, rather just being separated by a wall

Dennis Nolte

@MichaelHampton i agree with you, but you as i know full well how much this works for SOHO who sometimes not even have their own router, let alone someone who actually manages or understands enough about it to even care about security.

so tell them to spend X000$ on firewall/router + setup from some conslutant(!) and they will respond : why, it works now..

Michael Hampton

@DennisNolte Eh... sure, a lot of SOHO routers are crap. Not sure where this came from though.

Dennis Nolte

10:25 AM

thought without NAT possibly we would have higher security standards by everyone 10-15 years ago i guess.

@MichaelHampton either i am unable to make my point correctly, or you need more coffee, so tell me when you got your first liter down, so i might try again :)

Michael Hampton

25

A: What's the responsibility of an IPv6 owner?

Having used IPv6 for the better part of a decade now, and watching the changes go by, I have a little bit of perspective on this. The most important point here is this: NAT is not the firewall. These are two completely distinct things. In Linux it happens to be implemented as part of the firewal...

I was awake when I wrote that. Maybe it's relevant here.

Dennis Nolte

10:40 AM

thx for the link, interessting follow up links:
i wonder if this was "fixed" since 2010:
Credit-card information is one special case. That's subject to the PCI-DSS standards, and the standards state directly that servers that contain such data have to be behind a NAT gateway.

Michael Hampton

@DennisNolte Yes, that was fixed quite a while back.

Dennis Nolte

@MichaelHampton ye, i was not finished reading the answer when i did write my comment here.

Michael Hampton

@DennisNolte Ha. The original title of that question was better: Switch to IPv6 and get rid of NAT? Are you kidding?

Nick

Formatting my main workstation with a huge headache... what could possibly go wrong?

Michael Hampton

Dan

10:44 AM

@MichaelHampton Ooh, is that out now

I actually got the offical Beta of XP, no idea where that CD went though - should have kept it safe :(

Nick

@MichaelHampton plot twist: my workstation doesnt have a disk bay, using a USB drive

Dennis Kaarsemaker

►

tombull89

@Nick backed up your favourites?

Nick

@tombull89 They are always back u... oh shit havent backed up my code for atleast a week

Michael Hampton

@Dan I had the beta of Windows 95...it was an important factor in me becoming a Linux user.

Dan

10:48 AM

@MichaelHampton Haha

I hated Win 95

tombull89

98SE fo' lyfe

that startup tune...oohhh...ahhh...DONG blows your speakers

Nick

We have a Unix SE and Apple SE... we need a windows 95 SE

2

Michael Hampton

@Nick There's an Emacs now...

Nick

@MichaelHampton you know a text editor has a lot of features when it needs an entire Q&A site

Michael Hampton

Text editor? I was talking about emacs.

Bob

10:51 AM

@MichaelHampton That reminds me.

Dan

@MichaelHampton Isn't that what emacs is?

What was that shitty addon you could get for 95?

Dennis Nolte

microsoft encarta?

Michael Hampton

@Dan Plus!

Dennis Nolte

ah that one, some x more games and everyone wanted them..

Bob

Huh. I just found a Dig It CD. Isn't that some old DOS game? o.O

Nick

10:53 AM

I just found a missed call from a city 3 hours away... wat

Dan

@MichaelHampton Oh god, yes

Michael Hampton

@Dan emacs happens to include a text editor, but it's also a complete operating system and set of applications.

2

Bob

@Dan en.wikipedia.org/wiki/Microsoft_Bob?

> The price was $5.00 per month to send up to 15 emails per month.

...

Dennis Kaarsemaker

@MichaelHampton if only the text editor was halfway decent.

Dan

Emacs

Emacs /ˈiːmæks/ and its derivatives are a family of text editors that are characterized by their extensibility. The manual for the most widely-used variant, GNU Emacs, describes it as "the extensible, customizable, self-documenting, real-time display editor". Development of the first Emacs began in the mid-1970s and continues actively as of 2014. Emacs has over 2,000 built-in commands and allows the user to combine these commands into macros to automate work. The use of Emacs Lisp, a variant of the Lisp programming language, provides a deep extension capability. The original EMACS was written in...

Where's this OS?

Michael Hampton

11:05 AM

You're looking at it :)

21

Q: Emacs-as-OS: obsolete?

In an attempt to reach at least beginner status with such a legendary editor, I have been coding in Emacs for the last two months. I try to keep an open heart, but I find myself continally disagreeing with one core design choice: that Emacs allow its users to never have to leave. In a 2010 worl...