« first day (2135 days earlier)      last day (3178 days later) » 

12:02
Guys, if any of you are interested in guest authoring for Siyge, please let me know. I just don't know why but even after we amped up post quality, we're just not attracting a community yet :(
@Bob i'll ask you after lunch, been in meetings all morning
Hi Peeps; if I'm wanting to setup a new server from scratch, which can also act as a client with masked geolocation (IP, timezone setting etc) and... whatever the thingies are that identifies the particular circuit board etc, can anyone recommend me a good resource? I can do a bit of node, some apache, and a bunch of other bits and bobs, but all I've done so far server-wise is localhost stuff, and as far as masking it's mostly browser extensions...
@Nick Why does that site have US zip codes and an Indian phone number?
whatever the thingies are that identifies the particular circuit board etc, can anyone recommend me a good resource? << what?
You want to mask them?
@PeterDavidCarter-Poulsen A client for what?
12:14
@PeterDavidCarter-Poulsen if you're talking about web-based stuff, there's no such thing as "thingies that identify the particular circuit board etc" - webpages don't have access to that kind of information
@PeterDavidCarter-Poulsen If you asked that question on the main site it would get closed as "unclear what you are asking". Please try and explain in a way that we can understand what you are trying to achieve.
a webpage might be able to uniquely identify you if you have an unusual screen resolution or refresh rate or something like that, but a webpage can't just read the serial number off your processor
Ah, ok. I guess just a basic primer for setting up a server. And one for security when browsing. One that's good and provides a solid foundation.
@PeterDavidCarter-Poulsen there is no such thing as a basic primer for setting up a (generic) server running a (generic) operating system; you've got to get more specific than that
need to talk about use cases, software you want to run, operating system, supported hardware, etc.
drill down to the actual issue you are facing. what are you trying to do? hide from the government? do something illegal? just try to keep corporate data miners from identifying and tracking you?
people can't help you if they have no idea what you are actually doing
especially when your question is completely vague
hide from the government sounds fun
but no
12:18
Another dave
Morning nerds btw
;]
nevermind; I'll work it out myself, but there's some useful info in what you've said anyway
I guess you don't want to tell us ;p
I don't really know what to tell you, really
@Rahul2001: Sorry about that buddy mc budderson.
browser fingerprinting.... just something to be aware of.... that's arguably more powerful than websites being able to get your CPU serial number
12:20
I want to be able to serve a website, but I'm not sure the tech I want to use the second phase of it yet, so it would be hard to say which OS would be best, or whether it will be node based or etc etc
@PeterDavidCarter-Poulsen Makes it hard to answer your question doesn't it ...
who the heck just made clippy appear?
@PeterDavidCarter-Poulsen easter egg built into the chat code; blame balpha from StackExchange
If you saw clippy then it was you who made him appear :)
@Rahul2001: But you know, we have a room full of nerds.. and nerds ask the greatest questions.
12:22
!!/tell GuitarShoeDave rangry
@PeterDavidCarter-Poulsen okay, serving a website is usually something a server typically does, so that makes a lot of sense... the whole "I want my server to be a client" part was really weird
I just want a broad intro
@GuitarShoeDave And some of the dumbest as well.
12:22
@allquixotic I want to use the same machine that's the server as my client
and I also want other people to be able to use the server as if it's a client
but I want parts of it locked off
@PeterDavidCarter-Poulsen okay, that's getting a little more specific... so you want it to be your day-to-day web browsing desktop?
so they can't break the server
@PeterDavidCarter-Poulsen O.o you mean over remote desktop or so?
or are these local users?
@DavidPostill: Right on.. I agree, It was a dumb question, BUT, a lot of people have a misconception of some questions that may be asked which makes them good questions.Also the more people that can relate to a question just benefits the reach of the audience for a particular question.
@allquixotic yeah, I want them to be able to hack it, but not have access to anything vital
12:23
you can build a so-called "multi-tenant box" if all of the users will be physically co-located near the box
and I want that to be built in to the game I'm making
@GuitarShoeDave Just to be clear I wasn't referring to any particular question - more of a general observation.
@PeterDavidCarter-Poulsen okay... there are really only a small handful of technologies that are secure enough against people deliberately trying to hack a machine, so that they wouldn't be able to get into the core of the system and break it
@PeterDavidCarter-Poulsen "I want them to be able to hack it" are you creating a hacking challenge or something??
those technologies are certain OS virtualization container solutions, and certain hypervisor (virtualization) solutions
12:25
@allquixotic ah, ok...
sort of; it's a meta-game
personally I prefer OS virtualization, but many OS virtualization solutions are insecure
the next phase involves cyber-espionage
the only OS virtualization solution that has been very rigorously tested for security is Solaris Zones, which is built into SmartOS - smartos.org
@PeterDavidCarter-Poulsen lol... I have some experience in that
and I want the cyber-espionage to involve real hacking, but within legal frameworks
12:26
if you don't go that route, you could just set up VMs
@PeterDavidCarter-Poulsen Why don't you just get a VPS
yeah, I was thinking VMs
but you can break out of a... what do they call it, root jail or whatever
can't you?
VMs have a significantly higher overhead and you'll get lower density of VMs per box if you go that route
@PeterDavidCarter-Poulsen "jails" are just one particular implementation of OS virtualization.
@PeterDavidCarter-Poulsen rahul2001.com/tishack
there are certain implementations of containerization that are deliberately designed to be impenetrable
12:27
Something similar??
like I said, Zones are the most secure solution I know of.
clicks on link provided by someone who admits they've done cyber espionage, during a convo about hacking
what ever you do, don't go with LXC or LXD; those solutions are far too immature at this point to be secure
@PeterDavidCarter-Poulsen Purely educational wink, wink
@PeterDavidCarter-Poulsen If you read the link you will see that it is a challenge to hack not an admission of hacking.
12:30
@DavidPostill I shall take that under advisement...
@PeterDavidCarter-Poulsen For the record, it is disabled till august second
I really don't have time to discuss this right now as I have an important presentation to prepare for work, but if you catch up with @Bob or come back later I might be able to give you some more specific help; sounds interesting enough
@PeterDavidCarter-Poulsen "TAGORE INTERNATIONAL SCHOOL HACKING CHALLENGE"
also, look at guac-dev.org as a means of hosting RDP over the web
super useful for something like this
@GuitarShoeDave do you know php?
Bob
Bob
12:31
wait what's going on?
just got back
@Bob @PeterDavidCarter-Poulsen wants to create a hackable game and is discussing server options
Bob
Bob
ah
anything more specific, though? :P
it's a game about a murder investigation, sort of
there's evidence on the server and you've invited to actually hack it
@PeterDavidCarter-Poulsen Send me an invite once it is in beta mode... ;p
it's based on a true story
12:34
@DavidPostill that reminds me, I should probably remove my school's name for now
@Rahul2001 I'm sure you'll be able to find it... :P
@PeterDavidCarter-Poulsen I wanna try it anyways... it sounds fun
@GuitarShoeDave never been done before ;)
you're going to need a large cluster of similarly-configured servers if you intend to open it up to the general public and give each person their own clean instance to work with
@Rahul2001 at the moment there's not much there, and the CSS is messed up
12:35
@PeterDavidCarter-Poulsen: id flag your previous comments about it.. since the chats are publicly accessible (and crawled)
would suggest OS virtualization as you can probably do a few hundred of 'em per beefy box
But still a good idea.
Bob
Bob
@PeterDavidCarter-Poulsen Sounds a lot like a wargame (SmashTheStack, etc.)
@Psycogeek Coffee whisker I bought on Amazon had its switch malfunctioned. Normally when you hold, it's on and turns off when you release. Now it's stuck and constantly spins despite button released. That's the only coffee whisker I had which was better Chinese crap than several former whiskers I had. I am left with no energy source and all coffee will be mediocre without it. I am doomed without it...
Bob
Bob
@PeterDavidCarter-Poulsen overthewire.org/wargames
12:36
@PeterDavidCarter-Poulsen is it open source?
Bob
Bob
@PeterDavidCarter-Poulsen I think you're going about this the wrong way. Typically, the way these things are implemented, you don't need to give the users access to the full OS. They're inside a custom sandbox you design.
@Bob I gotta go, but be sure to promote SmartOS ;) j/k, but keep it in mind. Zones ftw. also LXD's swiss-cheese security and guac-dev.org
Bob
Bob
It's also much lighter load for your server.
!!rsauna
12:36
@Rahul2001 Yes and no. I have half-working code I've been messing with for part two that's open source. But the stuff I have working as a showcase isn't...
@Boris_yo ^
Bob
Bob
@allquixotic Yea, I'd be shying away from using VMs/containers/etc. with that much access.
though if you're good at guessing paths to type into the browser you can find most of the source code
it's not exactly obscured
@Bob I'd agree, but if you give them a little sandbox, it's invariably going to be pretty limited
Bob
Bob
@PeterDavidCarter-Poulsen These games typically revolve around trying to crack the security of a custom intentionally-flawed binary.
12:37
@PeterDavidCarter-Poulsen if you ever need help coding, ask me... I have holidays rn and am really bored...
Bob
Bob
So all you really need to do is give your players access to the binary and some tools.
although you could bundle virtualbox and have the hackme box on the user's local system :D
Bob
Bob
@allquixotic Limited is good, for a game. Especially something you start off with.
I have an EsXi server for anybody that wants to blow it up too.
Bob
Bob
@PeterDavidCarter-Poulsen can make it broader later.
12:38
Installed 2012 datacenter on it last night in a vm
Bob
Bob
I'd recommend playing one of the public wargames for a bit so you can get a feel for what they're typically like.
@Bob the meme command doesn't work anymore... delete it?
I'm thinking now I need a separate system, hooked up to a different line at a different location to my main system now... :/
from my personal local machine
Bob
Bob
As far as security, you can lock them down with SELinux and cgroups. Effectively what LXD does but without worrying about virtualising root, since you'd never let them elevate privileges.
@Rahul2001 Will do...
Bob
Bob
12:40
@Rahul2001 Just don't use it. Not worth the trouble of deleting.
5 hours ago, by Bob
@Rikai Resource usage is minimal, but it's annoying and clutters up the list
Bob
Bob
@Rahul2001 It's not a user-taught command. I'd need to delete the plugin on the server.
oh... ok
Bob
Bob
@PeterDavidCarter-Poulsen Oh, another way you can do it: make it pure JS within the browser.
@Bob I could do it with JS, but I feel like that wouldn't set me up a base for later that would be usable.
Bob
Bob
12:42
Something like Untrusted
I'd rather start out serving something with node and express and then work from there...
Bob
Bob
The advantage of JS is if the player decides to break it, they won't affect your server.
would it be possible to start up a server from there...
Bob
Bob
@PeterDavidCarter-Poulsen First, think about what kind of "hacking" you want players to do.
You need to have some fairly well-defined boundaries.
In Untrusted, players are expected to modify JS source within the web browser.
@Bob complete access to a virtual machine, except no root access, at least for starters
they should be able to examine everything in the file system
12:43
oh...
Bob
Bob
With SmashTheStack, players log in to a server over SSH and can run limited tools to break a given binary.
and use the browser, at the very least
and change system settings and stuff, to some degree
Bob
Bob
@PeterDavidCarter-Poulsen Think about what you want them to break into first.
they should have a full GUI, too
@PeterDavidCarter-Poulsen I would recommend you install a hackable cpanel-like system
Bob
Bob
12:44
@PeterDavidCarter-Poulsen IMO, that's a no-go. It's negligible benefit to an actual game, while effectively giving strangers full access to a server you're responsible for.
oh and some files it wants to be impossible to delete too
that's very important
otherwise they could break the game
like, removing important clues
Bob
Bob
If that's the way you want to go, then you should design your own pseudo-OS with limited functionality.
@PeterDavidCarter-Poulsen maybe a read-only cpanel-like system?
Bob
Bob
This doesn't sound very well thought out.
@Rahul2001 I'd like it to be a system users are likely to believe to be a 'real' system
Bob
Bob
12:46
You're starting from "I want them to have access to a real system."
IMO, you should be starting with "I want them to discover clues by breaking <X>."
@Bob... interesting...
Bob
Bob
You can't know what they actually need access to and what you need to secure until you know what (and how) they need to break.
@PeterDavidCarter-Poulsen try my challenge, that'll give you an idea of how most challenges work
I'll enable it if you want
Bob
Bob
You're trying to flesh out a world with no core, at the moment.
@Rahul2001 will do
Bob
Bob
12:48
I'd be iffy about a GUI in general - they tend to be rather hard to secure correctly (dbus is ... bleh) and very resource intensive compared to pure command-line. Of course, that'll limit the players you could have. So you need to decide on the difficulty too.
If it's supposed to be an easy game, is there much value in having a full server?
If it's supposed to be a hard game, wouldn't you expect players to be familiar with the command line?
If you're going down the path of "players need to break through barriers and encryption to discover clues hidden within (maybe steganography involved?)" - a kind of forensics game - consider what the barriers should be.
Are they just passworded programs with a weakness you want players to discover and exploit?
If so, your game could be completely user-mode (no root/system access whatsoever).
@DavidPostill The main company Zooeq Media is in the US. The tech blog Siyge and the Asia-Pacific sector of Zooeq is managed from India. Our guest authors are sometimes from Canada, UK and the US. None of this ofcourse matters, because no one actually reads anything more than the top 10 tech blogs.
Bob
Bob
If you want a scenario, it could be that you've managed to break into someone's computer (<story>no GUI, because that'd give you away!</story>) and need to extract data.
shrug dunno. Just a random mishmash of suggestions.
@Nick Except me :) When I first go to a new website I like to look around ...
Bob
Bob
@PeterDavidCarter-Poulsen Once you've decided what they need to break, you give them access to those parts - and those parts only. Secure the rest. Then you might add some fluff around for the sake of story... but that's after you have a plan for the core gameplay.
Do they need SSH access? Do you only give them access through a web browser?
Are they expected to use remote code execution exploits in a webapp to gain shell access on the server?
If so, rather than giving them a real shell you could make your (intentional) vulnerability drop them into a heavily restricted shell & user.
!!rwave
@Bob they might need SSH access... just a minute, I'm doing @Rahul2001's test thing
@Nick hi!
just setting up a few things first
@PeterDavidCarter-Poulsen let me enable it, wait a sec
Bob
Bob
@PeterDavidCarter-Poulsen Here's another you can try: smashthestack.org
Bob
Bob
I've done some SmashTheStack levels... that's the basis for much of what I suggested above.
@Bob I'll probably look at it a little bit later
Bob
Bob
And I suggested that because it's a model that works well in practice.
Fundamentally, what you want to do sounds like some kind of sandboxy wargame
@PeterDavidCarter-Poulsen Only the first level is ready, but try it anyways...
Bob
Bob
Not as linear as a traditional wargame, but still largely similar
12:58
tell me when you're done because that leaves my whole server vulnerable to attacks
@Rahul2001 Ok, will be ready in a little bit
I'll be ask quick as I can
@Rahul2001 That is not good. You should find a way to avoid this.
@DavidPostill I know, I'm working on a solution, which is why I asked @GuitarShoeDave if he knows PHP and can help me out...
@GuitarShoeDave Do you know php?
I need some help
@Rahul2001: not proficiently bud. I'm more of a full stack developer with php.
eh...
Does anyone in this room?
13:01
@Rahul2001 Yuck. Facebook in French :)
@DavidPostill My server is in france...
Bob
Bob
I'm a subscriber to /r/lolphp if that helps :P
@Rahul2001 That was easy. You are pawned :)
@DavidPostill well, duh... It's for school students
Where's the next level ;)
13:06
6 hours ago, by Burgi
@ThatBrazilianGuy @BenN they do give us beer in work and i bought loads when the weather was good because they had an amazing deal on
> they do give us beer in work
@DavidPostill didn't you read the message?
So you work for something called "the sex party" where they give you beer at work? Are they hiring?
Wait, I just remembered, they make you work with Joomla! That's why you have to be drunk!
xD
@deostroll I'm working on a solution... I'll tell you when its done
13:08
@Rahul2001 Ah. There is no second level.
...yet
I mean, there is, I still havent uploaded it tho and don't have my laptop rn
I HATE MY INTERNSHIP
I go on monday, they give me topic, i write a twenty page essay, and go back to submit it on wednesday and get a new topic and it all repeats again and again
There's no practice ever?
I think that's the central point of an internship
@Rahul2001 Quit.
Find a new one first, then quit.
Or, more seriously, ask at The Workplace or Academia, depending on your focus
@Rahul2001 The whole point of an internship is to get real "on the job training"
An internship is a job training for white collar and professional careers. Internships for professional careers are similar in some ways to apprenticeships for trade and vocational jobs, but the lack of standardisation and oversight leaves the term open to broad interpretation. Interns may be college or university students, high school students, or post-graduate adults. These positions may be paid or unpaid and are usually temporary. Generally, an internship consists of an exchange of services for experience between the student and an organization. Students can also use an internship to determine...
@Rahul2001 You think I like writing dumbed down articles every time my editor demands me to. And starting next week, I have to write one every day. Atleast you get a week.
Warning: file_get_contents(): remote host file access not supported, file://root/rpass/tispass.txt in /home/rahulcom/public_html/tishack/proxy.php on line 1
13:21
@Nick Well, if you have an editor, it looks like you work in the publishing industry and writing articles, as boring and dull as it might possibly be, is, at leat, part of the job.
I can't think of a position for @Rahul2001 where writing essays is part of his "job".
@Nick I get only a day
What exactly is the job you signed up for?
I have to write do research on sexting, secretion, cyber stalking, etc
@PeterDavidCarter-Poulsen You still haven't cracked it yet? :)
I don't usually use PHP at all :P
13:25
@PeterDavidCarter-Poulsen Hint: You don't need PHP. Just read the challenge very carefully.
NodeJS enough?
@Nick It was supposed to bea cyber security internship
@Rahul2001 I suppose "sexting" and "secretion" are somewhat related.
2
Yeah, but I was supposed to actually do stuff, not browse law articles and law papers...
i need a nap after that lunch
13:29
@Rahul2001 Well, office environments have always promoted unproductive R&D. If your job is directly or indirectly making PowerPoints for someone, you really need to reconsider what you're doing.
@Rahul2001 thats what happens on work experience
@Burgi No, you need a beer and then a nap ;p
@Burgi Hope our whiny discussion will carry you to slumber, then.
ha
oh noes! a wild mod appears!
13:32
@Burgi Did you have beer with lunch?
@ThatBrazilianGuy Just mind your own business. No sudden movements. You need a master ball to catch one of those.
For the non-alcoholics, that was a picture of orange soda with ice cream on top.
orange float?
Hmm. A "rude or abusive" flag was declined: reason "declined - rude, not offensive". If it is "rude" then surely it is "rude or abusive". Me confused :/
Something in this room?
13:39
0_0
@DavidPostill that seems.. unusual
If @burgi finds that image I posted ofensive I'll remove it... For the amazing price of a shipment of delirium tremens!
@DavidPostill no because i'm driving later, i'm only allow a small one :(
@JourneymanGeek This answer superuser.com/a/1087480/337631. Read my comment. I flagged the answer.
@ThatBrazilianGuy i'm more offend that you'd serve me a beer with that much froth! ;)
@Burgi lol
13:41
@DavidPostill hm. I typically don't do this buuuut, that seems offensive to me
@JourneymanGeek What, my comment?
I can't delete messages older than 3min even as room owner!
This whole room owner thing is a lie! I want my money back ;p
@DavidPostill his choice of words
@ThatBrazilianGuy congrats on the promotion
@DavidPostill closed question, edited
13:43
Exactly. That's why I was surprised my flag was declined.
@Burgi It's all the same, actually. I can... pin a star, edit the room topic, add/remove owners, read deleted messages only if I scroll back to them, and kick (but not ban, I think) other users.
But despite the promotion, there's no pay raise ;p
@ThatBrazilianGuy You can remove starred items from the wall as well (I've done that after complaints).
more responsibilty and stress for the same wage?
@Burgi Yeah. Just like in real life, yay \o/
we should unionise
13:48
I guess that now if a problem user starts making trouble while I'm online I'll feel obliged to take some sort of action, I suppose
well, I got the password part...
anyone actually seen such and such since the tv on the ceiling incident?
@Burgi tv-on-the-ceiling? huh?
linkplz?
i have too much on to find it. prepping for srs meeting
Jun 6 at 23:28, by Burgi
look, i really don't like you but i don't want you to kill yourself either by incompetence or otherwise
@Burgi they did say they weren't dead at some point after that
and that they were getting a proper way to mount it
13:51
ah
"Hi @PeterDavidCarter-Poulsen! You passed the first level! Unfortunately, the other levels aren't ready yet... Try again in a few days... :D"
@ThatBrazilianGuy You might find this usefull.
i didn't want to prod the beast while it was sleeping
@ThatBrazilianGuy also you can see deleted stuff as soon as it is
@ThatBrazilianGuy What are your normal UTC waking hours?
13:53
Yeah, and I can also set events and edit feeds
@PeterDavidCarter-Poulsen What's the link? I wanna try!
@ThatBrazilianGuy Thanks. Look like we overlap.
@DavidPostill that's vaguely the idea ;p
@DavidPostill Why do you ask?
@ThatBrazilianGuy rahul2001.com/tishack @Rahul2001 posted it. Should have got it quicker than I did
@PeterDavidCarter-Poulsen I searched the room history but couldn't find it
@ThatBrazilianGuy I like to know when other room owners are likely to be around. It helps if we need to support each other ...
See? More responsibility for the same pay ;p

« first day (2135 days earlier)      last day (3178 days later) »