The DMZ

Rory Alsop

6:15 AM

@JeffFerland I approve of this.

Lucas Kauffman

6:50 AM

@RoryAlsop You should ask @TildalWave to make you a "Rory's seal of approval"

AviD

@DavidFreitag cool! show us a pic

@LucasKauffman no no, he's still working on my owasp flag. maybe after.

AviD

7:22 AM

oh btw @DavidFreitag, re our conversation yesterday:

Samsung 850 EVO 500GB SSD $160 http://www.amazon.com/Samsung-2-5-Inch-Internal-MZ-75E500B-AM/dp/B00OBRE5UE?psc=1&SubscriptionId=AKIAJM4NKIQGABP2PIRA&tag=thewire06-20&linkCode=xm2&camp=2025&creative=165953&creativeASIN=B00OBRE5UE&ascsubtag=WC24023

Tweeted by SwiftOnSecurity on July 9, 2015 at 1:51 AM

but I'm curious, how would you protect against hardware crashes? get 2 and run them in RAID/SS?

AviD

8:33 AM

hahahahahah Intel has special guidance for their people to deal with Israelis.... Seems spot on.

The interesting part, for me, is that when I go other places I am always surprised that other people are NOT like this.

well shucks, I had to go and tweet that.

BlueBerry - vignesh4303

8:57 AM

@AviD hi friend

one small issue with respective to stackexchange and my firm hope you could help me with it

it might be a funny issue ,but personally sounds like this is the right place to talk about this,@thomas pornin sir i always love to read your post and often visit your profile at crypto and DMZ StackExchange websites,but one humble request to u kindly remove porn from ur name, since in my company the squid filters its keyword and i wasn't able to view your profile :(

3

Journeyman Geek

That is his real name. You need better filters.

BlueBerry - vignesh4303

@thomaspornini know that its personal issue ,but kindly take at as humble request from ur fan

AviD

Wow.

Just... wow.

BlueBerry - vignesh4303

@AviD i often read and visit profiles of poly,avid,journey,thomas,tomleek,adnan,schoereader huge fan of u all keep up the good work :)

@JourneymanGeek is it possible to add certain filters?since porn is the keyword which pass over at url and squid blocks me the access,where can i post this question friend maybe superuser suits it?

@AviD does this question fit for superuser or dmz?

AviD

definitely not here. Depends on what kind of filters you have, such that would block a man's name.

Perhaps Parenting.

BlueBerry - vignesh4303

9:09 AM

@AviD how to effectively filter it in terms of technical perspective ,any additional setting can i add in squid?

AviD

I think you need to remove settings, not add new ones.

Other than that, I have no further information.

BlueBerry - vignesh4303

he blocks based on this squidblacklist.org/downloads.html website

but dmz was accessible and all others accessible ,other than thomas sir's profile :(

AviD

first of all, you can use this link if you really want to insist on stalking his profile: security.stackexchange.com/users/655

second of all, perhaps find a professional to set up the proxy rules, not somebody incompetent enough to block like this.

BlueBerry - vignesh4303

@AviD it redirects with his username so cant load it :(

AviD

ah, okay. But still.

BlueBerry - vignesh4303

9:16 AM

@AviD cant use proxy sites any other way to stalking on his profile

Journeyman Geek

9:27 AM

Scunthorpe problem

The Scunthorpe problem is the blocking of e-mails, forum posts or search results by a spam filter or search engine because their text contains a string of letters that are shared with an obscene word. While computers can easily identify strings of text within a document, broad blocking rules may result in false positives, causing innocent phrases to be blocked. == Origin and history == The problem was named after an incident in 1996 in which AOL's profanity filter prevented residents of the town of Scunthorpe, Lincolnshire, England, from creating accounts with AOL, because the town's name contains...

AviD

@JourneymanGeek I thought it was known as the U.S. Embassy problem.

but yeah, that too.

Journeyman Geek

I've never heard of the US Embassy problem

AviD

really? it was one of the more popular issues with scunthorpe style filtering.

especially for embassy workers.

Journeyman Geek

I guess different cultural environments? ;p

AviD

same would apply to any embASSy....

Journeyman Geek

9:30 AM

ahh, embdonkeyy.

AviD

@JourneymanGeek I like how that references George Carlin's classic 7 dirty words.

@JourneymanGeek yup.

either way, it is a braindead stupid idea to try and filter in that way, even back then. Doing it now isnt just incompetence, it should be considered criminal negligence.

If only there was some way to show damages....

Journeyman Geek

Show? I'd rather deal damage

AviD

@JourneymanGeek I was talking an actual civil lawsuit. That would be nice.

Journeyman Geek

ahh

AviD

perhaps @Thomas donkeynin can press charges for being offended.

Journeyman Geek

9:34 AM

(heh, my work has a refreshingly enlightened view on that)

"Don't get us in trouble, We trust you"

shouldn't that be thomas smutin?

AviD

@JourneymanGeek wait wait, was this really YOU asking??

35

Q: How can I watch porn, safely, and not get a virus? (and not infect corporate data also)

I'm part of a small office in the middle of nowhere, and we just got absorbed into a large mega corporation. Sometimes we watch porn, at the office, on company computers, using the company Internet. It makes good for a good background distraction (I know I'm not the only one who does this so ...

Journeyman Geek

naw

We're not in the middle of nowhere for one\

My office is in a bona fide super villan lair and all.

AviD

@JourneymanGeek no, you're at the edge of nowhere

Journeyman Geek

big difference.

AviD

@JourneymanGeek I told Jim Manico I'm jealous - he lives in Hawaii with an actual volcano across the street. I have to settle for the underground bomb shelter with missiles.

Journeyman Geek

9:37 AM

also, I work near a jawa sandcrawler

AviD

@AviD okay looking at that question again, the comments there are hilarious.

i like this a very much. i am thick like a can of pepsi. — AckSynFool Jul 23 '14 at 5:23

Journeyman Geek

o0

AviD

I dont even know what that means, but its damn funny. Sounds like a Borat line.

@JourneymanGeek heh thats cool

Journeyman Geek

annoyingly, I've no clue where the sandcrawler is ;p

AviD

well, obviously it moves around.

to avoid the storm troopers

disguised as sand people

wait, was that racist?

Journeyman Geek

9:41 AM

maybe.

AviD

wasnt meant that way.

oh damn. Was all of starwars a huge racist metaphor??

Journeyman Geek

Almost certainly

And sexist probably

AviD

@JourneymanGeek well sure, nowhere near the Bechdel test.

Journeyman Geek

And chewbacca clearly followed han cause of ~~helsinki~~ stockholm syndrome.

AviD

@JourneymanGeek oh? I assumed it was sexual attraction.

Journeyman Geek

9:42 AM

Yeah. At least they only made 3 movies

could be both.

Clearly

@JourneymanGeek heh.

They probably made torrid love, until han traded up

AviD

so you dont consider the Holiday Special?

Journeyman Geek

9:43 AM

Was it a full length movie?

AviD

Star Wars Holiday Special

The Star Wars Holiday Special is a 1978 American television film set in the Star Wars galaxy. It starred the film's main cast while introducing the character Boba Fett, who would appear in later films. It was one of the first official Star Wars spin-offs, and was directed by Steve Binder. The show was broadcast in its entirety only once, in the United States, on November 17, 1978 (the week before Thanksgiving), on the U.S. television network CBS from 8:00 pm to 10:00 pm, Eastern Standard Time (EST), pre-empting Wonder Woman and The Incredible Hulk; and on the Canadian television network CTV from...

Journeyman Geek

ahh

Ok

4 movies

AviD

yaknow... I've never actually seen it. As bad as everyone says it is, I feel like it might be important to see it once.

then again.... this.

You think it's so legendarily bad that you'll torrent it and sit through it just for the kitschy nerd cred. I, too, once thought as you did.

Journeyman Geek

actually

there's one movie that was so bad I had to stop after 5 minutes

despite the first movie of the series being one of my great guilty pleasures

AviD

10:02 AM

come on, Matrix Revolutions wasnt that bad.

Journeyman Geek

(star ship troopers)

AviD

ah

Journeyman Geek

First movie is alright for mindless entertainment. I can't remember if it was the second or third movie that looked like it was made by drunk film students

the last one (with casper van diem (?)) was ok.

Animated SST shows tended to be better for some reason

ahh

Starship Troopers 2: Hero of the Federation

Starship Troopers 2: Hero of the Federation is the 2004 direct-to-video sequel to the 1997 feature film Starship Troopers. It had a $7 million budget as opposed to the $105 million of the original. Even though the film received only a direct-to-video released in the United States, it was granted a theatrical release in Japan and Spain. It has almost no relationship to the novel Starship Troopers by Robert A. Heinlein; even less than the first Starship Troopers film, which was based on an original screenplay that was revised to co-opt character names and story elements of the Heinlein book. None...

terribad

Funny thing is I watched SST. Loved the movie. Read the book....

Books better

AviD

10:34 AM

272

Q: Upcoming login changes (Stage 1 now LIVE)

As y'all know, our current flavor of "global authentication" leaves a few things to be desired. It's flaky, requires a page refresh, etc. etc. Wouldn't it be nice if you could just sign in once and be automatically logged in across the network? We are ready to roll out Stage 1 of Project "Make...

discussion featured login auto-login

also while you're there, go upvote my comment.

Is the implementation of this opensource, or been reviewed with an eye to security? There are many many things that could go wrong, and many things that very often do. Even with SEI's fantastic developers, it is likely that there are some security bugs - I wouldn't go try to hack on it without permission, but it is something that should be considered. — AviD 22 secs ago

Rоry McCune

11:25 AM

@AviD I once had an instance of that at work, was looking at e-mails that had hit our "bad words" filter (don't ask) and couldn't work out why one was triggering when all it said was "Don't be too hard on yourself". ended up writing a regex to work it out...

AviD

hehe

reminds me of my time at microsoft - all source code is passed through a politically correct filter. I did have a look at some of the flags it raised.... Carol Van Dyke left a comment in the code with her name, as did Willie Dickinson... a linked list implementation had a method called getHead()... there were others that I dont remember.

the linked list one made me laugh the most though, it actually took me a while to figure out why it was flagged.

then I started thinking about the guy whose job it was to come up with this big list of all the baaaaad words. That would be a good job for @Simon.

Rоry McCune

yeah I've seen some of those. that said on my e-mail monitoring days, it did need doing to an extent, when we started we had all sorts going through the system (which was how I ended up seeing the tubgirl image, amongst others...)

AviD

oh gersh, I do not want to know what that is.

Rоry McCune

@AviD yeah the one who made the list at the company I was at, at the time, must have had an ... interesting... approach , I recall the first entry on the list was "Spanking Nuns"

@AviD correct, you do not, it's one of those things I could gladly have done without seeing ... ever

AviD

I think i did tell you about the funny story we had with email monitoring, when I was at the police... Somebody sent an email to everybody starting with a certain letter - which was the equivalent of mailing all department groups. So, everybody got a powerpoint with his favorite porn.

Rоry McCune

11:32 AM

@AviD oooops

AviD

@RоryMcCune waat? that's not smut, that's a birthday party activity!

Rоry McCune

(note to self) be careful of any party invites from @AviD

AviD

@RоryMcCune hahaha

Terry Chia

@RоryMcCune O_O

AviD

yesterday at yoga a new teacher was having us do something weird with our knees, I told her it was like doing Speed Twister.

then I thought - Speed Twister would be an awesome drunk party game!

Journeyman Geek

11:38 AM

Or a position.

AviD

right foot on blue - *go!*
left hand on red - *go!*
left foot on yellow - *go!*
right foot on green - *go!* left foot on blue - *go!* left hand on blue - *go!* *go!* *go!* *go!*

Adi

12:24 PM

WHAAAAAT!!!

MELON IS BACK?!

AviD

@Adi yes friend, can you please change your face picture

also your address is not comfortable for me

Adi

Slightly NSFW video, and very NSFW audio (if your office speaks Dutch)

Lil Kleine & Ronnie Flex - Drank & Drugs (prod. Jack Chiraq) - #NewWave

I dont

I like it!

whats with all the duckfacing

Adi

12:27 PM

@AviD The duckface girl is actually quite hot

AviD

hard to tell

Adi

@AviD Google Olivia Lonsdale

She looks Jewish

AviD

So what is this song about? the video is ambiguous.

@Adi thats racist

Adi

@AviD Ha?! :D

AviD

hehe

Adi

12:30 PM

@AviD I think the title is clear. Drank & Drugs

AviD

@Adi I was being sarcastic. did you SEE that video?

Adi

@AviD Jepp

AviD

It couldnt be more clear what it was about without actually being hardcore fetish porn

Rоry McCune

@AviD is that you back on the nuns again?

AviD

@RоryMcCune naw, this time its @Adi, and there are no nuns.

what in hell kind of story are you trying to build here

Rоry McCune

12:34 PM

@AviD it would appear to be you having done something with @Adi and no nuns that was less sexy that you'd imagined :)

Adi

@RоryMcCune nums nums nums nums

AviD

speed twister with negroes?

Rоry McCune

@AviD to quote @TerryChia O_o

AviD

hey I'm just reading the story you've set up here.

Rоry McCune

@AviD nah that 3rd one ain't pinned so it doesn't count..

pin stories is just pinned stuff

star stories are just flukes

AviD

12:37 PM

ohh! the story is just the pins?

I see. well then you need to pin some more stars!

Rоry McCune

@AviD well I can't control star order at all

yeah that's tricky 'cause it generally needs to be older things to get on the end of the pin list

speaking of pin walls hey @Adi next time you're on IRC with she who must not be pinged tell her to come back to the DMZ, I get better pin stories that way

AviD

DMZ party game: Pin the story on the starwall

oh cmon @RоryMcCune really? you make me sound racist. I prefered the nuns.

Rоry McCune

@AviD yeah I was thinking that possibly crosses a line, but you did say both those things :op

AviD

@RоryMcCune not rascistly

and, for that matter, not connected to each other

Rоry McCune

@AviD well what would be the fun of the pinwall if it had to be in-context!

Rоry McCune

1:03 PM

openssl.org/news/secadv_20150709.txt <-- new OpenSSL vuln in case anyone's not on the twitter

2

AviD

@RоryMcCune I try to avoid it during the day

it is SUCH a timesink, if youre not careful.

Rоry McCune

oh yeah

AviD

@RоryMcCune damn thats pretty cool

Rоry McCune

@AviD aye handy for MITM attackers for sure

AviD

on first glance, it does seem that it only applies to client authentication, not the server.

Rоry McCune

1:07 PM

@AviD sounds like for servers it would only be if they were doing client auth via certs

AviD

@RоryMcCune yeah that

only that

not the clientside authn of the server

openssl.org is swamped

Rоry McCune

@AviD well if you're MITM and the client uses OpenSSL (unlikely I guess as FFox/Chrome/IE don't) you'd be able to impersonate a CA and create valid certs

AviD

@RоryMcCune so did I misread?

it seemed that it was just for authenticating client certs (on the server)

trying to reopen and read it more thoroughly, but they getting DoSed

Rоry McCune

During certificate verification, OpenSSL (starting from version 1.0.1n and
1.0.2b) will attempt to find an alternative certificate chain if the first
attempt to build such a chain fails. An error in the implementation of this
logic can mean that an attacker could cause certain checks on untrusted
certificates to be bypassed, such as the CA flag, enabling them to use a valid
leaf certificate to act as a CA and "issue" an invalid certificate.

This issue will impact any application that verifies certificates including

the last bit seems to indicate that SSL clients are affected

AviD

ah yes

Rоry McCune

1:11 PM

but I'd guess only if they use OpenSSL, so more IoT or App stuff than browser user agents

AviD

I only caught the "...and SSL/TLS/DTLS servers using client authentication."

@RоryMcCune doesnt Firefox use openssl?

Rоry McCune

@AviD I thought they had their own SSL imp.

but that may be my memory playing up on me

AviD

@RоryMcCune so I'm wrong then

I really dont know, I was guessing

Rоry McCune

@AviD looks like FFox uses NSS en.wikipedia.org/wiki/Network_Security_Services

AviD

well, doesnt really matter anyway, its not like anyone even uses firefox anymore

right?

Well, nobody besides Stallman.

Rоry McCune

1:15 PM

@AviD and me :)

AviD

@RоryMcCune hello, nobody ;-)

Simon

pls

Terry Chia

@RоryMcCune Or many Python/Ruby/whatever apps.

Or the thousands of programs that statically link OpenSSL.

Rоry McCune

@TerryChia yeah "App Stuff" like I said :op

Terry Chia

Bad timing to drop a OpenSSL vuln. :P

The hot topic is the hackingteam thing now.

Majority of Android apps using TLS not effected by new OpenSSL vuln since they don't validate certificates properly anyway. #brokencrypto

Tweeted by WeldPond on July 9, 2015 at 1:15 PM

AviD

1:20 PM

@TerryChia hehehe

Rоry McCune

@TerryChia awww you ninja'd me , I literally had that URL on the clipboard...

AviD

nasty.

nasty, but true.

Terry Chia

You all might appreciate this

I think this is the first time I have an OpenSSL vuln drop when I'm awake.

AviD

statistically it was bound to happen

Rоry McCune

ma.ttias.be/openssl-cve-2015-1793-man-middle-attack <-- ahh doesn't affect several unixes

Terry Chia

1:23 PM

OpenSSL's sysadmin team is so shitty that they can't serve a text file without the server being overloaded.

Rоry McCune

due to them not having merged the vuln. code yet

Simon

Is the bug public yet?

Terry Chia

@Simon openssl.org/news/secadv_20150709.txt

AviD

@TerryChia probably goes through several layers of php.

Simon

Cheers.

Rоry McCune

1:24 PM

@Simon that last link I posted has a code diff in it for the patch, if you want details

AviD

is there a word for the opposite of rounding?

Terry Chia

@RоryMcCune Not sure if happy or facepalm.

AviD

referring to numbers

Simon

So, who's gonna post a question about the vuln to get mad rep?

Terry Chia

My repwhoring days are behind me.

Simon

1:27 PM

Yeah me too, cough.

Terry Chia

So, I'm guessing the Pwnie for Most Epic FAIL will go to HackingTeam this year. :P

Rоry McCune

@TerryChia you would think, destroying a multi-million Euro business through poor OpSec is pretty epic, fail-wise

AviD

wait, its only July.

Rоry McCune

@AviD and awards are at Defcon in August, ain't they?

AviD

@RоryMcCune still think OPM was a bigger fail.

Rоry McCune

1:30 PM

@AviD ooh good point, in impact terms losing details of all the dark secrets of every security cleared person in the US was pretty epic

AviD

the epicness of HT is more because they were ostensibly a "security" company

which as I've said before, isnt really

@RоryMcCune yeah, life/death trumps euros.

Terry Chia

@AviD OPM should be "Pwnie for Epic 0wnage"

AviD

also the opsec and infosec fails for opm were also pretty epic.

Terry Chia

Oh wait no, that one goes to the hacker.

Simon

What did they do to fail?

AviD

1:33 PM

@Simon OPM or HT?

raz

@AviD Yeah I gotta say OPM was a worse fail

Terry Chia

@Simon Were you living in a cave the past few months? :P

Simon

@TerryChia I swear I've only been away for like a damn week because I started this new job and it looks like I've missed everything.

@AviD HT

Adi

@RоryMcCune Haven't talked to her in a long long time

AviD

@Simon oh okay, that is this past week.

raz

1:34 PM

OPM stored information unencrypted because "They were old systems that didn't support encryption". Then they said that encryption wouldn't have helped because the hacker(s) stole user credentials that would have given them access anyway.

Terry Chia

@raz Have you seen the passwords HT uses?

AviD

start with gawdawful passwords, repeat in multiple systems. continue from there.

@TerryChia wanna fill in the rest?

Simon

o

AviD

> P4ssw0rd

Terry Chia

@AviD 400GB data dump with a couple of zero-days and a whole bunch of exploits in there. Nuff said.

raz

1:35 PM

@TerryChia They stored PII (going back 10 years) for millions of people unencrypted.

AviD

@TerryChia thats the content. @Simon was asking about the how.

Rоry McCune

@Adi ah, bummer, hope she's ok..

AviD

@raz on non-airgapped systems.

raz

^^

AviD

its actually more than just PII. there was information there that spouses didnt know.

all the spying stuff.

and more.

Simon

1:36 PM

and more

AviD

it was like the nightmare scenario from the first Mission Impossible movie.

Rоry McCune

@raz did they get your data (unless I'm mis-remembering you worked for the US.Gov at one point?)

raz

@AviD Ehhh kind of. Probably just psyche eval type shit

@RоryMcCune So far I'm supposedly good

If you believe them

Rоry McCune

@raz \o/, hopefully

AviD

@raz no. somebody published a list of the type of info they collected. ridiculous.

raz

1:38 PM

@AviD Linkage?

I highly doubt they stored the CIA's NOC list

AviD

@raz hmm, will try to look for it later

raz

That would DEFINITELY be an epic fail

AviD

@raz something like that, yes

not the operational data, but info on the people

Rоry McCune

realchriseng.tumblr.com/post/120903918276/…

^That was the one I saw which detailed stuff that could've been in the OPM hack

AviD

ah yeah, could have been that.

Rоry McCune

1:40 PM

there's quite a bit of stuff in there

20committee.com/2015/06/08/…

^was another one

AviD

> information that might make you susceptible to blackmail or coercion.

@RоryMcCune yeah that one was avery good breakdown.

raz

@AviD Ehhh that's probably just the financial stuff, polygraph synopsis and what not. If you have bad credit you can become a target. If the polygrapher's notes contain information your spouse doesn't know, you become a target. Not quite a NOC list.

AviD

6/ BI data includes your personal life, travels, full bio, details on finances and any "troubles" -- legal, private, sexual, you name it...

Tweeted by 20committee on June 6, 2015 at 12:26 PM

Rоry McCune

@raz What's a "NOC list"?

AviD

4/ A USG BI, which OPM handles a lot of for many different agencies, is NOT some sort of glorified credit check, it's much more than that...

Tweeted by 20committee on June 6, 2015 at 12:24 PM

raz

1:46 PM

Sexual... that's an exaggeration

AviD

@raz for some people ;-)

raz

@RоryMcCune Non-official Cover. Agents of a government that aren't supposed to be in places and if they're caught they're on their own. They supposedly have no record of working for any government, that kind of thing.

Rоry McCune

@raz Ah I C, thanks :)

raz

@AviD I'm not saying it's not a huge security breach, and OPM failed horribly. But it's kind of blown out of proportion as to how it actually affects an individual.

imo

Rоry McCune

@raz like the stuff that dude with the Japanese friends was going to steal off the ISIS mainframe until Cyril shot it..

raz

1:50 PM

@RоryMcCune Haha, yeah

The CIA Memorial Wall is for NOC agents who were killed in the line of duty.

AviD

@raz well... if you're undercover, this could possibly expose you, even if it doesnt detail your actual cover.

also, from a CI perspective, it does make much of their operations kinda difficult now.

raz

@AviD Specific Agencies aren't referenced in the background checks. Possibly the Agency that funded it, and the people who performed it. Really it just tells the Chinese that these people work for DoD in some capacity. Could be a janitor, security guard, HR rep from any of the 4 dozen agencies that are part of the CI community.

AviD

@raz is there a picture?

raz

Technically if you're undercover you have a different identity, so you're fine!

/sarcasm

@AviD I can draw you a stick figure?

AviD

heh

raz

2:11 PM

@AviD Damn, we killed chat

Simon

rip

Thomas Pornin

@RоryMcCune What are affected are OpenSSL instances that receive certificates. So basically clients in an SSL handshake; also servers if they request client certificates (which does not happen often in practice).

And the bug indicates quite clearly that OpenSSL's code is designed by a misanthropic monkey on acid.

3

Because it means that while they have a certificate chain validation code, they just thought it fit not to use it for validating another chain, and write a new one (with a bug). Which can be described only as sloppy.

Rоry McCune

@ThomasPornin yeah it doesn't sounds like a good bug to have especially as it's been introduced more recently when (you'd think) they would be paying more attention to code quality!

Thomas Pornin

@BlueBerry-vignesh4303 My name is the name of my father, and my father's father, and his father before him.

Jeff Ferland

@raz Official cover: diplomatic passport. Non-official cover: pretty much anything else.

raz

2:28 PM

@JeffFerland Sounds about right!

Iszi

@ThomasPornin You sound like a Liar.

Ohnana

haha porn bear

googled "porn bear" immediately realized why I shouldn't do that

7

/headdesk

Simon

@ThomasPornin Weirdos.

Journeyman Geek

lol

Adi

2:59 PM

@RоryMcCune I sincerely hope so too

Iszi

@Adi Who the heck are y'all talking about? @Aarthi?

Journeyman Geek

naw

Aarthi is good people.

I'd tell you who she who should not be pinged is, but I may summon her by accident.

Iszi

There's not a whole lotta females who have hung out here. It's been a long time since I've seen @BethLakshmi or @ZulyGonzalez. And Mrs. @RоryMcCune has only been on once or twice that I know of.

Simon

Maybe because you're a creep.

Iszi

@Simon Said the pot.

Simon

3:05 PM

da wat

Iszi

Ask your mom.

raz

3:28 PM

@AviD It's posts like these that will get closed, but shouldn't that Hacking SE will scoop up. I actually agree with you that it's on topic here.

-1

Q: Adding a binary to the firmware of a routing device

I've been playing around with a router d-link dwr-921 and found some vulnerabilities in the web interface. I still haven't managed to get shell access and now I'm thinking about modifying the firmware since I can access the administration panel. So far, I've downloaded the latest firmware from d...

network penetration-test ssh router firmware

Simon

4:59 PM

Look who posted another question in travel:

32

Q: Can I fly with a gold bar?

Can I fly with a Good Delivery gold bar? I'll have the certificate that I have been given with it. I have looked on Google and found nothing that suggests it's a prohibited item on an aircraft. It's below the weight I am allowed to carry in person. I'll be taking it to Moscow, flying from Heathr...

air-travel

This guy is an absolute donut.

raz

5:10 PM

Wasn't he a regular on the DMZ for a bit...

Rоry McCune

@Iszi I was talking about @kalina (aka @flyk) as we've not seen her around in quite a while now

I figure pinging her can't cause a problem now as worst case she'll turn up to berate me for pinging here which will in turn answer my question :)

schroeder

5:28 PM

@raz I'm coming into the middle of a conversation. I VTC that question. Do you say that it is on-topic here?

Iszi

@RоryMcCune Ah, right. Dunno why I totally forgot about @Kalina/@Flyk. She was fun.

raz

@schroeder Yes, "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem."

He clearly identifies that he wants to know how to determine the architecture, and it's for educational purposes.

schroeder

Right, right, ok. I get that. And I agree that the OP did significant work to understand the system. Still not sure it is on-topic.

raz

@schroeder Then you would agree with me that Hacking SE has its place.

schroeder

@raz Most certainly, as with reverse engineering

raz

5:40 PM

I believe it was Avid who said that anything on Hacking SE would be on-topic here. And I said I'd bring up questions that I thought would fit Hacking SE, but would get closed here.

schroeder

hmmmm - I don't agree with @Avid on that

With all due respect and deference to @Avid

raz

@schroeder Oh of course. We had just had the discussion before, and this was the first question I've seen that fits what I was trying to explain.

Rоry McCune

6:05 PM

twitter.com/harvsmithfield1 <<--WTH bots on twitter are weird

Rоry McCune

6:23 PM

I set up a GoFundMe to get @thenickde a CAT scan of his brain cancer here: http://lemonparty.org

Tweeted by rantyben on July 9, 2015 at 5:42 PM

raz

@RоryMcCune Someone's trying to get your attention

Rоry McCune

^^ahh the oldies are still the goodies

@raz yeah me a load of other rories on twitter

BTW that lemonparty.org link is VERY NSFW

do not click

even if you know what it is don't click

raz

...

Rоry McCune

you didn't click it did you

raz

Lemon Party

The Lemon Party of Canada (Parti Citron) is a frivolous Canadian party which has operated on a federal level, as well as provincially in Quebec. The party was officially registered on January 8, 1987, by then leader, Denis R. Patenaude and deregistered on November 14, 1998 for failing to have at least ten candidates stand for election. The party is headed by "Pope Terence the First", whose existence is unconfirmed. Their official agent is Mary-Gabrielle Blay II. Their 2004 national convention produced a platform of policies which were "placed in small green plastic boxes and sold to industrial...

They are Frivolous!

Rоry McCune

6:35 PM

yeah that site doesn't (I think) relate to the party

Stack Exchange

Going From Mobile Back To The Web

Arie Litovsky on July 9, 2015

Are you restless at your job, but looking for a challenge? Going into a completely different technology stack has its rewards. Find out how developers can move around teams and technology at Stack Exchange to maximize happiness.

raz

I wonder if I joined Stack Exchange if they'd let me give InfoSec the new profile. Then I'd quit.

David Freitag

7:01 PM

@AviD I could actually, the only thing that's on the front of the card is my name and the smart card.

@AviD Yes you can run them in a raid and recover them just like you would an HDD

@raz I bet their website is even more frivolous!

Rоry McCune

7:27 PM

hey @Simon have I got a spotify playlist for you... open.spotify.com/user/spotify_uk_/playlist/…

Simon

@RоryMcCune Boo, I need to sign in.

Rоry McCune

@Simon no pwned playlist for you then...

raz

7:54 PM

@RоryMcCune You should probably make him a Lemon Party Playlist

Iszi

In case anybody didn't already know the OPM breach was big...
http://www.npr.org/sections/thetwo-way/2015/07/09/421502905/opm-21-5-million-social-security-numbers-stolen-from-government-computers

Simon

8:22 PM

@raz pls

Thomas Pornin

I have received something which is either a quite creative and targeted scam, or something weird:

> I am an executive recruiter at Korn Ferry in the global technology
> sector. We have been retained by Dark Matter, a commercial cyber
> security startup in Abu Dhabi, deeply funded. We have multiple positions
> open for them, I was hoping you might know someone who might be
> interested in the Executive Director of Cryptography. They will fly the
> finalist candidates and their families business class to Abu Dhabi where
> they will also meet with the relocation specialist/school specialist.
> Highly paid compensation to encourage the move.

Somebody here wants to become Executive Director of Cryptography ?

schroeder

Actually, not a scam

I've been contacted by a lot of security companies in the Middle East looking for a wide range of talent

I actually started to pursue a position, but the wife vetoed ....

David Freitag

9:14 PM

@ThomasPornin I think the more important question there is Who wants to move to Abu Dhabi?

schroeder

@DavidFreitag raises hand

David Freitag

I'd love to see what the company car is

schroeder

@DavidFreitag wife casually reaches over to lower it for me

David Freitag

rofl

I have heard horror stories from friends in the engineering community that have had to work there.

Mostly things like having to stay inside a barbed-wire fence compound and not being allowed to leave until the job was done and the customers were satisfied.

@schroeder I can imagine how that conversation went. "So, you wouldn't mind living in Abu Dhabi would you?" wife laughs loudly "...Oh, you were being serious."

David Freitag

9:36 PM

Note to self echo 1 > /dev/sda1 is a bad idea.

David Freitag

10:37 PM

It's always nice to see lines like this buried within the documents you are reading.

> IMPORTANT: because of the use of inline functions, you have to use '-O' or some variation when you compile your program!

Transcript for