Root Access

Journeyman Geek

12:54 AM

@Hakase there's probably benchmarks that do that

bwDraco

1:43 AM

> zipping speed

7-Zip comes with an internal multithreaded benchmark.

Journeyman Geek

You'd need the processor on hand tho ;)

Bob

3:54 AM

Philosophically?!? Or technically? — Jeff Schaller 15 hours ago

Bob

4:46 AM

34

Q: What is a "bag of rats"?

I have seen the term "bag of rats" being used quite frequently (RPG.se search for bag of rats, for example), mainly, but not exclusively, in D&D. It seems to be considered a problem or exploit. What is it, where does it come from and how do you deal with it?

terminology

Journeyman Geek

5:21 AM

I wonder if it was inspired by rpg.stackexchange.com/questions/124864/…

rahuldottech

7:06 AM

LPT: If you oversleep, call in to work, tell them you've been sick all night and will need a little longer to get ready. Now you don't have to speed and will come across super dedicated for showing up at all.

Ave

IDK if that'd work in turkey

employers don't really care about employees

rahuldottech

@Ave elixi.re/i/3b8t.svg has embedded JS

Ave

thanks

rahuldottech

7:28 AM

@Ave also, see rahul.party/calendar.html

Ave

Can you get like uh

a svg that runs alert

rahuldottech

@Ave It's definitely possible, since there is no restriction on what JS an SVG can execute. JS isn't my strongest point, but I can give it a shot.

@Ave Okay, correction, I think it's possible

@Ave I made one!

Ave

alright

rahuldottech

@Ave elixi.re/i/l2pa.svg

Journeyman Geek

kinda odd topic but...

hilarious

6

Q: How do I fill out Google applications when their own reCAPTCHA is broken?

I am filling out a Google application: https://services.google.com/fb/forms/ytapiquotarequest/ At the bottom it says "reCAPTCHA V1 IS SHUTDOWN", so I do not know how to proceed. I tried entering ""reCAPTCHA V1 IS SHUTDOWN" and that did not work. Is there any way I can proceed now with this ...

captcha

rahuldottech

7:34 AM

@Ave Have fun with that, sigh...

Ave

thanks

Burgi

8:00 AM

morning

Burgi

8:21 AM

why do linux systems use different package managers? apt-get and yum for example?

Journeyman Geek

@Burgi tbh, a lot of NIH syndrome and different philosophies

Even with common package formats - RPM is supposed to be a standard - but say, SUSE and Mandriva had their own package managers with the same format

also YUM is obsolete

dnf is what the RHverse uses now, and its arguably a lot better

likewise apt > apt-get

slightly different but better

Burgi

its installed on our centos box?

Journeyman Geek

Well yum would redirect to dnf on newer centos boxen

Burgi

dnf doesn't appear to be a command

Bob

dnf: dnf not found

Journeyman Geek

8:35 AM

centos 6/7?

point being though, package managers can differ within a distro

djsmiley2k

Ah the joys of trying to get your head around yum D:

dnf.... did not finish? ;)

Burgi

8:51 AM

> CentOS Linux release 7.5.1804 (Core)

Journeyman Geek

Ah ya. Still on yum

djsmiley2k

9:05 AM

/me wibbles

Burgi

its not even the latest version of yum...

Ave

@Burgi different approaches to the same problem

some of them arguably handle it better than others

but even now I could design one better than any package managers out there

with integrations to other package managers (pip, npm etc) and ability to install without sudo etc etc etc

but that'd just cause this:

Fortunately, the charging one has been solved now that we've all standardized on mini-USB. Or is it micro-USB? Shit.

Journeyman Geek

Well if you can everything as a user sure

Ave

some of the package managers were done because of that reason

because they genuinely saw an opportunity to improve certain stuff, and they did improve it

but they just made everything trickier for users and packagers

djsmiley2k

9:21 AM

yup

source for everything! ;)

@Ave or lightning, thunderbolt, DP, miniDP, hdmi,usb3, usb3.1, usb3.2 aurrrrugh

djsmiley2k

9:36 AM

Sooooooooooooo windows 10, ignoring proxy server settings

Burgi

10:10 AM

i'm liking this html templating engine

panini

bertieb

11:02 AM

@djsmiley2k Ah yes, the working title for Duke Nukem Forever :P

(also: not sure if panini is the templating engine or if Burgi was hungry)

Burgi

both :D

having one of these for lunch: northernsoulmcr.com

Ave

hoh

just bought one of these

Burgi

do you work fulltime @Ave?

Ave

I am unemployed

my only proper source of income is patreon

which is... it pays for that server.

Journeyman Geek

heh, that's ... kinda roughly my home system XD

'well slightly newer processor, less HDD

Ave

11:10 AM

It's going to sound a little uhhh

but I only need like 10gb of space, lol

but I need a server that I won't need to upgrade anytime soon

and this is that.

Burgi

@Ave what do you do for your patreon supporters?

Ave

It's mostly for this one site I run that's an image host.

Burgi

ah ok

Ave

It needs okay hardware and a bunch of storage soo

djsmiley2k

hmmm

Burgi

11:14 AM

did you see that guy that has made an automated child porn detector for his image hosting service?

Ave

no, but I'm interested.

Can you link it?

@Ave (I mean let me just say this, a couple months ago we were surviving with a 10gb drive, nowadays we use ~100mb per day at least)

djsmiley2k

They arm, but the storage is cheaaaaaaaap

@Ave soyoustart.com/en/server-storage

Ave

arm isn't good enough for us :3

there's sort of a friendly rivalry going on in discord-oriented image hosts scene and speed is a big factor

biggest one (owo) is uh... they're setting up their own geographically distributed CDN and will ditch cloudflare completely

djsmiley2k

lol

sounds almost like the irc wars of yesteryear.

Bob

@Ave How much is that server?

Ave

11:21 AM

21eur

Bob

not bad

djsmiley2k

I would ask if you need a friendly sysadmin, but tbh you got this down

You and @rahuldottech give me confidence that some of the 'yoof of 2day' have brains

Bob

@Ave where/who's the host?

Ave

hetzner

Bob

ah

thought FSN1 sounded familiar :P

is it an auction server?

Ave

11:23 AM

yup

once I make the move we'll be all hetzner

rn our load balancer + firewall + routing server is on hetzner, the actual server's on online.net

Bob

@Ave Did you get it at € 20.17 or did it drop again? :P

Ave

I got it at 20.17

Bob

ah, nice

yea, they look like nice boxes

I'd just be concerned that they're missing OOB but at that price...

Ave

I honestly have no idea how the auction works.

also yeah, IDC about OOB, I actually enjoy messing with stuff and getting them working

Journeyman Geek

> there's sort of a friendly rivalry going on in discord-oriented image hosts scene and speed is a big factor

is that a thing?

Ave

11:26 AM

yes

unsurprisingly, the fight for speed actually killed a bunch hosts (most recently kuvien.io, leeks.io and nothing.domains)

Bob

@Ave price drops every X hours until someone buys it

though it looks like 20.17 is the lowest those ones will drop ("fixed price")

@Ave OOB is what makes messing with stuff safe :P

Ave

ah I see

Burgi

@Ave just found it

Bob

without OOB it's kinda scary to make too-big changes cause recovery is that much harder if you mess up

Journeyman Geek

hah

@Burgi I saw it on adafruit

@Ave speed is hard.

Ave

11:29 AM

@Burgi oh the yahoo thing

Bob

like, I routinely do updates that might break boot ... but worst case OOB in and fix things up / restore snapshot

Journeyman Geek

> biggest one (owo) is uh... they're setting up their own geographically distributed CDN and will ditch cloudflare completely

0_0

Bob

(rescue boot is halfway there, at least)

Ave

yahoo thing is quite problematic

Journeyman Geek

(CDNs are something SE dosen't even want to touch yet - they use fastly now... but...)

Bob

11:30 AM

> He called the police, who told him to print it out and bring it to them.

that's one way to get arrested

Journeyman Geek

yup

djsmiley2k

> He then contacted a larger image hosting service, which he declined to name, and found thousands more by running images uploaded to their platform through his system as well.

imgur?

Ave

let's just say that I used a bunch of booru APIs and compared performance of google safesearch api, microsoft cognitive services and yahoo's open source thing and uh... results were not good enough.

djsmiley2k

build ur own neural net? :/

Ave

of course I couldn't feed in actually illegal content.

djsmiley2k

11:31 AM

problem is, training images.

yah

so..... porn?

Ave

as I said

Journeyman Geek

which is illegal in many places

djsmiley2k

'It's ok, it's for my neural net!'

Bob

he trained against generic porn and checked for the specific ones manually, it looks like

Ave

it's illegal in turkey to host porn yeah

which is a thing

Journeyman Geek

11:31 AM

and you'd need to work out some way to train for the really bad stuff

shich someone needs to recognise as bad stuff

Ave

there are uh

djsmiley2k

@JourneymanGeek nod :/

Ave

hashlists, but they're incredibly expensive

djsmiley2k

@Ave ah, sux

Bob

@JourneymanGeek tbh human body shape and maybe skin tones will get you most of the way there

Ave

11:32 AM

because yelling "PROTECT CHILDREN" on your homepage and then asking for 2100eur/yr min is...

Bob

the goal being to filter many millions into a few thousands that people can manually check

Ave

yeah. apparently capitalism decided that we need to pay thousands of euros to protect children

and if we don't do that we risk getting shut down, raided or even arrested :3

thanks capitalism

Journeyman Geek

hm

Ave

oh hey wait

I can install OSes directly from hetzner's frontend

Ave

11:51 AM

neat, debian 9.4 is up

djsmiley2k

enjoy

EMBERS RISE by Miracle Of Sound (Dark Souls Song) (Symphonic Rock)

►

hum de dum

huh, since when did a / match . in grep o_O

in other words why is it applying it as a regex o_O

Burgi

12:12 PM

the delivreeroo guy got totally lost

djsmiley2k

lol

what u ordering?

if you say doughnuts, I set that up ^_^

Uber driver was watching TV, before fatal crash

damn uber, damn.

Burgi

grilled cheese sandwich

1 hour ago, by Burgi

having one of these for lunch: http://www.northernsoulmcr.com/

Journeyman Geek

arstechnica.com/science/2018/06/…

> Launch by centrifuge company raises piles of money. A stealthy Silicon Valley startup called SpinLaunch says it has raised a total of $40 million from a high-profile array of investors to get a space catapult system ready for launch by 2022, GeekWire reports. The company has been working on an electric-powered kinetic-energy launch system that starts by whipping the vehicle around on a centrifuge, then catapults it spaceward at hypersonic speeds.

Burgi

hopefully not melting the launcher in the process due to friction

Journeyman Geek

or just not falling apart

its crazy

That Brazilian Guy

12:49 PM

Who hosts a game at 9am

djsmiley2k

@JourneymanGeek but for bulk items such as 'oxygen' - it could work

holy cowpats

the boring company isn't about tunnels at all

Journeyman Geek

@djsmiley2k if it even works

@djsmiley2k 0_0

djsmiley2k

Elon is goin to launch us to Mars...

Journeyman Geek

@djsmiley2k I always figured it was for underground martian cities...

djsmiley2k

'Objects able to propel in a vaccum'

oh yah, me too @JourneymanGeek

but.... why just have it planet bound? Why not have it launching 'pods' ?

Journeyman Geek

12:52 PM

well he needs a few pieces of tech.

1) he needs to send stuff in a straight line very fast...

like the hyperloop

2) power storage

cough

on the other hand

conventional rockets are going to be cheaper

and the methane/lox designs are fairly low risk

Burgi

virgin orbital are launching from a 747 and they are cheaper than spacex

not sure on the payload size

Journeyman Geek

and range.

and don't forget, spacex wants to compete with commercial airliners too

Burgi

on sub-orbital?

Journeyman Geek

yup

Burgi

well virgin galactic recently returned to powered flight

Journeyman Geek

12:58 PM

hmm

didn't... er...

ATK and stratolaunch want to do the same thing?

Pegasus (rocket)

The Pegasus is an air-launched rocket developed by Orbital Sciences Corporation (now part of Northrop Grumman Innovation System after Northrop Grumman acquired Orbital ATK). Capable of carrying small payloads of up to 443 kilograms (977 lb) into low Earth orbit, Pegasus first flew in 1990 and remains active as of 2018. The vehicle consists of three solid propellant stages and an optional monopropellant fourth stage. Pegasus is released from its carrier aircraft at approximately 40,000 ft (12,000 m), and its first stage has wing and a tail to provide lift and attitude control while in the atmosphere...

not manned I guess

Hakase

@JourneymanGeek why? aren't uploaded benchmark results gonna be the same across different systems with some negligible deviation?

@JourneymanGeek I have it in the mobo socket, I think it's better to run benchmarks that way >.> unless you mean pain threshold benchmarking

Burgi

@JourneymanGeek i believe they might have priced themselves out of the market

they haven't flown since 2016

rahuldottech

@Bob Check out this image which will totally not execute any JS code: elixi.re/i/l2pa.svg

Burgi

@rahuldottech can you post the SVG code as a GIST?

rahuldottech

@Burgi Sure

Bob

1:08 PM

@rahuldottech It sure didn't! view-source:https://elixi.re/i/l2pa.svg

rahuldottech

@Burgi gist.github.com/rahuldottech/…

Bob

@rahuldottech (cc @Ave) really one way around it is to always render svg wrapped in a simple HTML page with an img tag

img disallows JS in SVG, at least in Gecko.

rahuldottech

@Bob Yes, I noticed. <embed>, on the other hand, doesn't

@Bob Yeah, but @Ave has an image-hosting service, and I'm sure that she'd rather that her server didn't host any malicious JS

Bob

@rahuldottech Mate. Why are you using embed in 2018?

djsmiley2k

rahuldottech

1:13 PM

@Bob I am not.

Bob

The other way you could do it is by providing the correct CSP.

Burgi

@Bob so he can hax0rz us with SVGs

Bob

Content-Security-Policy: script-src 'none';

That'd probably do it.

Ave

I'll block svgs

rahuldottech

@Bob Road from here

@Ave Don't. I've always hated that imgur doesn't allow hosting of SVGs. Just write a server-side script to remove everything between <script> tags

Ave

1:15 PM

okay

how to fix it then?

Bob

Lemme just remember which server I had my publicly accessible HTTP server on.

Ave

I can't think of a reliable way to do it

Bob

@Ave Gimme 10 mins.

djsmiley2k

if not jpeg

Hakase

what did papa do to get 1 month suspension :o

djsmiley2k

1:15 PM

{ grep file, clear out crap }

papa?

rahuldottech

@Hakase ...who?

Hakase

workplace.stackexchange.com/users/26028/paparazzo .

oh is it not cross-site?

I don't really know how suspensions on the site work

Ave

yeah cross-site can only be done by cms

Hakase

I've only gotten chat-banned for 30 minutes

rahuldottech

@Hakase I once asked to be banned for 24 hours because I had an exam and needed to focus. @JourneymanGeek said he wouldn't do that again, lol.

Hakase

1:17 PM

I wonder if it was super bad workplace advice or something

Burgi

@rahuldottech and you still refused

Hakase

:I I'd find a way to gain access in under 2 minutes

rahuldottech

@Burgi Oh, that's just because I'm an idiot

Hakase

better work on your self-control

djsmiley2k

and you'd be banned again @Hakase

which is always fun

Hakase

1:18 PM

reading access, not posting

rahuldottech

@Hakase I have done so, since

@Hakase incognito, transcript

Hakase

great job then!

rahuldottech

:)

Bob

Fixed! @rahuldottech @Ave

rahuldottech

@Bob PROVE IT! :P

Bob

1:20 PM

. try.vulpin.com/lxd/svg/80/foo.svg

djsmiley2k

does the image work tho?

Hakase

since when does chat support svgs oneboxed

djsmiley2k

(it's not sunday).

Bob

@djsmiley2k Sure, click the link

rahuldottech

@Hakase always has

@Bob That's for websites tho. @ave needs a way to strip JS from images on her server

Bob

1:21 PM

All you need is Content-Security-Policy script-src 'none' as a header.

Hakase

js stripper huh

Bob

Hm. Now I wonder if the image CSP works when hotlink-embedding.

Ave

we provide content hosting, so that'd probably not help a lot.

Bob

Well, the image is being served with the CSP.

nginx add_header Content-Security-Policy "script-src 'none'";

Hakase

maybe deny hotlinking for svgs identified as having js in them and redirect to an intermediate "are you sure?" page

Bob

1:23 PM

Doesn't matter who uploaded the image - the JS is still there but it won't be executed by any modern browser.

So that solves the direct link case.

For the embedded case, <img> should keep you safe too.

@rahuldottech @Ave The CSP on the SVG itself works even when the SVG is <img>'d or <embed>'d, at least on Firefox: try.vulpin.com/lxd/svg/80/html/bar.html

No CSP on the HTML page.

Script execution still ends up blocked by the CSP on the SVG only.

rahuldottech

@Bob Yep, checks out on chrome

Ave

wouldn't it also break js tho

Bob

So, yea, if you match .svg and add a CSP header (with nginx/apache) on all of them, you're serving safe data.

@Ave It would break JS on the page you set it on.

rahuldottech

@Ave that's the point, isn't it?

Bob

Assuming you never need to serve JS within an SVG, you're fine.

Ave

1:27 PM

I see

rahuldottech

@Bob Still a couple of cases that are problematic

The download-file, or re-upload file ones.

Bob

@rahuldottech How so?

Hm.

Well, this is all about securing the webserver and all webserver-direct accesses.

Ave

@rahuldottech not really

Bob

If you're talking about downloading the file, source included, then all bets are off.

@Ave What's your server-side language?

Ave

Python

Bob

1:29 PM

@Ave github.com/darylldoyle/svg-sanitizer

If you want to strip tags from the image stored on disk and potential user downloads.

Would also help protect pre-CSP browsers if you care about those.

Ave

ouch, php

Bob

Though arguably anyone using a pre-CSP browser doesn't care about security anyway.

Ave

We only officially support latest versions of firefox and chrome

Bob

Wait. That's PHP.

rahuldottech

@Ave That's... a weird stance for an image host

Bob

1:30 PM

I searched for Python -_______________-

rahuldottech

@Bob yes

Bob

GOOGLE. PLS.

Ave

@Bob I might port it if there's nothing

Bob

Y U DO DIS.

Ave

@rahuldottech why?

Bob

1:31 PM

@Ave The original DOMPurify is NodeJS, so port that if you want to port anything.

github.com/cure53/DOMPurify

Not even Node, just plain JS.

@Ave But if you go down this path it's quite a can of worms. The simple act of parsing XML with an unhardened parser opens you up to a few vulns, including a pretty bad DoS.

Anyway. CSP protects all modern in-browser users.

rahuldottech

@Ave Because your images don't have to be embedded in websites, they can also be fetched by desktop and apps

Ave

uhh

so that's a requirement with the frontend

and the JS we use there

other than that we just have strict tls requirements

Bob

Basically anyone using IE is screwed. But they are anyway.

Ave

yeah

I mean you can always use the api

Bob

@rahuldottech Eh. Most apps use Edge (UWP) or Chrome (Electron) if they include a browser at all.

rahuldottech

1:34 PM

@Ave Your website will still be hosting malicious code. And google will probably blacklist it...

Bob

Some legacy ones (Windows Desktop program with an old browser control) will use IE.

rahuldottech

@Bob They could just be fetching images and rendering them without a browser

Bob

But those are ... rare. And unlikely to be loading a SVG from @Ave's site.

I'd be a tad concerned what copying one of these SVGs into, say, MSWord might do, though.

@rahuldottech Using magic?

It's not like JavaScript runs magically.

You need a JS engine.

rahuldottech

@Bob Eh. For example, inkscape, which is an image editor, has a JS rendering engine for SVGs

Bob

If you're somehow rendering SVGs using a dedicated SVG library, it most likely does not include a JS engine.

That way lies madness.

@rahuldottech Madness, I tell you.

rahuldottech

1:37 PM

@Bob Still. It's best for @Ave to just strip <script> tags using server-side code. Shouldn't be more than a couple of lines

Bob

*shrug* If you want to toss it into beautifulsoup or some other (properly-configured) XML parser and strip script tags and pray there's no other injection method (IIRC SVGs support onclick-like events), go ahead.

But I still say the CSP is the way to go. Even if you do other things on top.

rahuldottech

@Bob Yeah, obviously

Bob

@rahuldottech I bet there's at least one way around that naive approach.

Ave

^

rahuldottech

@Bob SVGs can't execute code without an onload attribute, and a script which is within <script> tags. At least according to the standard

Bob

1:40 PM

@rahuldottech Look ma, no <script>: try.vulpin.com/lxd/svg/80/html/baz.svg

rahuldottech

> onload

Bob

@rahuldottech Lookit, no onload: try.vulpin.com/lxd/svg/80/html/qux.svg (wave your mouse over it)

rahuldottech

^

Bob

@rahuldottech You said and a <script>

Journeyman Geek

@Hakase suspensions on main sites are per site

rahuldottech

1:43 PM

@Bob okay, my bad. Still, if she removes all "on-xxx" attributes and anything between <script> tags, it should work

Journeyman Geek

chat suspensions are automatic on flags or kicks, and manual by mods, and are serverwise.

Bob

If you add an additional X-Content-Security-Policy: sandbox you'll even support IE10, actually. (cc @Ave)

Journeyman Geek

if you get around a suspension and get caught.... people will be ... less than charitable

Bob

@rahuldottech Maaaaaaaaaaaybe. I bet there'll be some funny encoding or escape sequence that'll work around on* filtering.

@rahuldottech This is why security is hard. And filtering is usually a fool's job.

That said, on* would probably cover most cases.

Ave

it'd take a lot of processing power to get this done securely

which'd make us slower

Journeyman Geek

1:45 PM

@rahuldottech We usually deny these XD

Bob

@Ave Might be worth benchmarking. XML processing is reasonably quick.

rahuldottech

@Ave well, IMO, do the header, and strip out all JS scripts and attributes

Just for added security where a user downloads an image

Ave

@Bob ehh any slowdown is an issue

people were angry at us bc big files took like 500msec of processing

Bob

@Ave You should totally switch away from Python then :D

@Ave Now that's just unreasonable.

Man, my upload time is an order of magnitude larger.

Ave

@Bob you'd be surprised

a couple people even moved away due to it

until we "fixed" it

now AV scans are done after file upload is done and link is sent back to user

@Bob python + uvloop + sanic is surprisingly fast, actually

rahuldottech

1:53 PM

@Ave also, stripping out JS means no blacklisting

Ave

or

I can just block svg

rahuldottech

I'm repeating myself

@Ave you could. But then you'd be just like every other image hosting website

@Ave if you must, convert the SVG to PNG or whatever

Ave

that defeats the whole point

I'll uh

consider doing SCP on backend code, on everything fetched

Bob

@Ave do you serve the files by code? do they go through a reverse proxy?

Transcript for