Root Access

DavidPostill

16:00

!!s/deposits/withdrawals/

ChatBot John Cavil

@DavidPostill I don't have any withdrawals in my bank account from anyone named Nick... (source)

DavidPostill

→ 1 message moved to Trash

Bob

@allquixotic The PSU is surprisingly modern, and not much different from a 2017 one... apart from the efficiency curve but meh. He posted a manual a bit ago.

Paul Vargas

@ChatBotJohnCavil H e l l o !

Bob

@allquixotic StartCom was good until they sold it :(

allquixotic

16:03

@Bob yup

what's the likelihood that StartCom will ever be trusted again?

Bob

@allquixotic Yea a recent Chrome update made its TLS info absolute BS. Screwed with us at work too

allquixotic

is it hard to regain trust of GOOG / MSFT / MOZ / AAPL once you break it?

Bob

@allquixotic None at all.

No one has any confidence that they'll never pull this again

allquixotic

TBH they seemed kind of shady even when they weren't associated with WoSign

very casual, nongrammatical emails from Mr. Nigg from his personal email

what was his first name? Eddy? yeah. Eddy Nigg.

Bob

@CaffeineAddiction Auto-refresh only works in the very limited scenario of a simple webserver

e.g. I can't auto-refresh a certificate for my Mumble server (I don't control the host), my ffsync server (no web access) etc etc

allquixotic

16:05

honestly, I'd think someone who has authority to issue certs on a globally trusted CA server would be a little more... anonymous than this guy: twitter.com/eddy_nigg?lang=en

probably want to keep a quiet public life, similar to being a special agent for the government

he's opening himself up to compromise, either social engineering, corruption, or hacking

and corruption apparently happened, so yeah

Bob

@allquixotic btw, Gitter's officially part of GitHub now O_O

allquixotic

I saw that; it was kind of inevitable I think

Bob

I hope they don't bring back the paid tier for private rooms :(

allquixotic

we'd just have to move to a crypto thick client :/

Bob

@allquixotic Most of those are mobile-focused

suppose could do something with IRC, or XMPP

allquixotic

16:09

except that one we used for a little while

what was that called?

nearly half of RA had it at one point

Bob

uhh.

meowmi? I never used it

allquixotic

OH. Smellogram

no, not meowmi; Telegram

Bob

oh.

yea, don't particularly like that one :P

again, too mobile-focused

tied to phone number, bleh

allquixotic

the electron beam convinced us to try it

Bob

no proper desktop client, bleh

allquixotic

16:11

where did she go I wonder? she's either in love-love land with her gf or in la-la land with her technology

I need to skype her and find out

Bob

speaking of

user226528

You say Telegram has no proper desktop client? Are you kidding?

Bob

I think skype is the only major IM client that's desktop-first

@FleetCommand last time I checked it just routed through your phone

whoops, s/desktop/web/

allquixotic

the raw bits of skype get redirected unencrypted to NSA and GCHQ though, pretty sure, so don't say anything you wouldn't type in RA there :P

user226528

@bob It is phone-number-based but its client is decent.

Bob

16:12

@allquixotic eh, if you're making that assumption then the same applies to gitter :P

user226528

By the way is Yahoo! Messenger dead at last?

Bob

@FleetCommand anythign involving phone numbers is already enough for me to say no, but it was worse than that

user226528

Or has it gone mobile-oriented?

allquixotic

@FleetCommand Yahoo is valuated as a company in the negative, which means Marissa Meyer must pay you to use Yahoo Messenger ;-)

user226528

@allquixotic Marissa Mayer hates men. So, no, she wouldn't.

Bob

16:14

> The best thing about Telegram Desktop is that it automatically syncs messages from your phone with your computer using Telegram’s encrypted cloud. Just install it and log in to your account! All your messages, documents, photos and videos will be synced for you from the secure cloud.

uhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh

!!no

ChatBot John Cavil

Bob

@allquixotic I wonder if there's anything decent we can self-host

allquixotic

@Bob KeePass-based messaging ? :D :D :D :D

with ssh certs for download/sync

Bob

lol

even just leaving encryption aside

allquixotic

or we could exchange keys and use OTR and use Bot Overflow room as a medium for exchanging our encrypted OTR messages

Bob

16:16

having a searchable transcript and a good web UI visible from anywhere is pretty much necessary

and IRC fails at least one of those

allquixotic

"Don't mind us; just spamming random base64 data"

Bob

@allquixotic problem is, server-side transcripts of group chat is directly opposed to end-to-end encryption

and out of the two I'd choose the former

except in rather specific circumstances

(if that ever comes up... we can always exchange keys and even just send an encrypted email :P)

Andy K

@Nick how did you upset me matey?

allquixotic

@Bob isn't there a new gmail plugin for easy PGP?

Bob

@allquixotic hm. I just thought of a reasonably safe way to exchange pubkeys over the internet without a WoT :P

print it out as a QR code, and send a photo of it w/ handwriting (and preferably face) in normal chat

it'd take not-insignificant time to mitm that :P

or just do the same over a video stream

live editing of video isn't the most efficient thing :P

allquixotic

16:21

clever idea

well yea, and you can verify that it's live by having an interactive conversation immediately beforehand

ask a random question that you would expect them to know the answer to

like "What does Geek say when his fleet is beaten and he doesn't want his flagship to die?"

Bob

lol

allquixotic

we can't use that one now, but it'd be funny. "RUN A WAY!!!!"

3 x wildcard domain SSL certs by AlphaSSL intermediate with GlobalSign as the root CA (very reliable), 3 year duration each, $342

$38 per domain-year

not quite on par with StartSSL, but way cheaper than competition

Bob

ow

oh wait 3 years

yea I've just let my certs lapse so far

think mumble's probably fine self-signed... we're not talking anything sensitive and auth is by client cert anyway

allquixotic

I'm getting them from ssl2buy.com

@Bob I just hate the prompts and/or having to install a self-signed cert in the client

same with Quassel

Bob

owncloud can use let's encrypt

shit I need a cert for znc

uhh... don't want to have to domain-validate LE every 3 months

don't want to set up a webserver just for validation

@allquixotic tbh I could just turn off ssl

allquixotic

16:29

oh god... I hope the rest of my experience doesn't go like this

Bob

or you can accept and remember

@allquixotic ?

allquixotic

Server Error in '/' Application.

A potentially dangerous Request.Form value was detected from the client (objSignUp.Passwords="...this is a part of my password, which contains > and < characters - randomly generated").

Description: ASP.NET has detected data in the request that is potentially dangerous because it might include HTML markup or script. The data might represent an attempt to compromise the security of your application, such as a cross-site scripting attack. If this type of input is appropriate in your application, you can include code in a web page to explicitly allow it. For …

from ssl2buy.com

Nick

@AndyK I might have wired you some money meant for @allquixotic. Would you be a dear and send it to his account ;)

allquixotic

okay, it looks like the password I wanted to use is partially included later down in the backtrace

I'll just use a different one entirely

Andy K

Oh you were the M.Abu-CashKing ... You know what they said Finders keepers ;)))

Nick

16:32

lol

sure sure. Keep it :)

allquixotic

from their email, "Password: Same as entered on signup" -- thank god they didn't reproduce my password in plain text

Nick

@allquixotic probably doesn't need it anyway. Given that he's king of his domain.

Bob

@allquixotic ah, they forgot to turn off request filtering :P

Nick

@allquixotic Speaking of that, this is my favorite password phishing scam : tech.jecal22.com/beware-of-fake-google-sign-in-scam

Bob

It's incredibly stupid, kinda hard to disable, and part of ASP.NET.

I had the exact same problem with a password reset form I wrote... luckily we caught it in teting (w/ random passwords)

It's also very non-obvious that this even happens, unless you run into it

but yea that happens before the request ever reaches application code

the framework just tosses the request away... can't remember if it gets logged (!!!)

@allquixotic AlphaSSL is very... up-to-date :P

> Impacted by the recent Heartbleed Bug and need to reissue your SSL Certificate?

From their homepage

Andy K

16:36

bye

Bob

oh god quora... terribad answers, mostly just advertising quora.com/What-is-the-cheapest-Wildcard-SSL-provider-right-now

Burgi

you know when banks ask you for random letters out of your key thing? obviously it hashes every character separately but would they use the same hash/salt as the normal password?

allquixotic

@Bob you just had to say "Quora"

@Burgi "key thing"? like an RSA token?

Burgi

no

let me have a think and rephrase

allquixotic

./me gives @Burgi a think

Burgi

16:40

:)

allquixotic

one think, Sir

Nick

The only good thing about Quora is that celebs get invited to post answers there. If we had a more popular invite-to-answer feature we'd be so better than them. Infact, if you ever see a good quora post just migrate all the q&a to the appropriateSE.

Burgi

the passphrase on 3D Secure/Verified by Visa

Bob

@Burgi If you're talking about an RSA SecurID, those are basically TOTP (maybe a proprietary algo) wrapped in fancy hardware

@Burgi wha?

user226528

This is good if you want to laugh: quora.com/…

Bob

16:42

@FleetCommand I want to cry.

> application developed with C, C++ perform better and those applications are more robust

allquixotic

hmm, what's browser support for RSA 4096 certs look like today?

Bob

!!NO

ChatBot John Cavil

Bob

@allquixotic very good

"C" and "robust" do not belong in the same sentence

without a negative anyway

27

Q: 4096 bit RSA encryption keys vs 2048

Where do 4096 bit RSA keys for SSL certs currently stand in terms of things like CA support, browser support, etc? In the overall scheme of things is the increased security worth the risk of 4096 bit keys not having the widespread support and compatibility as 2048 bit keys do, not to mention the ...

38

Q: Are there any disadvantages to using a 4096-bit encrypted SSL certificate?

I was recently requesting a SSL cert via Godaddy and noticed this message: screenshot-with-shadow.png http://web.archive.org/web/20150911191355/http://img64.imageshack.us/img64/4526/screenshotwithshadow.png In the past I have always generated 2048-bit CSR requests, but this time it got me think...

ssl https certificate ssl-certificate

user226528

@Bob Did you look at the title?

Bob

16:46

> rsa 4096 removal tool free. Decrypt RSA-4096 . - Malware removal tips
www.securityspyware.com/remove-rsa-4096/
Dec 19, 2015 - RSA-4096 Let us start with explanation of term – ransomware . ... RSA-4096 can appear as a random extension to the browser you are using.

allquixotic

ummmm

Bob

@FleetCommand The title's not nearly as bad as the "answer"

allquixotic

@Bob is it normal for generating a 4096 bit RSA private key to take a fraction of a second?

Bob

@allquixotic ...no? where are you generating it?

and what command?

allquixotic

openssl req -new -newkey rsa:4096 -nodes -out star_domain_me.csr -keyout star_domain_me.key -subj "/C=US/ST=MyState/L=MyCity/O=My Name/CN=*.domain.me"

as root on my dedi after an apt update && apt full-upgrade on Ubu 16.04

Burgi

16:47

@Bob my bank asks me for random letters out of my passphrase (eg: 1st, 5th and 7th letters) when i pay for something on the net by CC

allquixotic

on the physical box, not in a container

Bob

@Burgi oh.

@allquixotic hm... what happens if you run it again?

allquixotic

OpenSSL 1.0.2g

Bob

maybe you were really really lucky and hit a prime right away? :P

wait. was it generating DH params that took me a while?

shit I forgot

allquixotic

@Bob whereas before it took a tiny fraction of a second (maybe 200ms), re-running it took 1 second

it has more dots and pluses in the graph thing

Bob

16:49

@allquixotic yea takes about a second on my machine (server, VM)

probably was dhparams that took forever

allquixotic

yeah I'm just generating a CSR

well, a CSR and a private key

user226528

@Bob If you wanted to cry for seeing that, this one could be fatal: en.wikipedia.org/wiki/…

Bob

> C++.NET is Microsoft's own and only dialect of C++ they have a compiler for.

whaaaaaaaaaaaaaaaa

is this guy high?!

@FleetCommand but yea other guy has a point, why are you claiming C isn't a language?

Burgi

@Nick @FleetCommand SO is more popular than quora

alexa.com/siteinfo/stackoverflow.com

alexa.com/siteinfo/quora.com

Bob

If you wanna rebut the first guy, Visual C++ is probably what he was talking about and is different from C++/CLI

user226528

16:52

@Bob It was pointing to the article about the letter C!

Bob

@FleetCommand lol. well reply and point that out! :P

user226528

@Bob I did. Read the very last line by Jeh.

user226528

Actually, I wrote [[C]] for a reason.

Bob

ah

<== not versed in wikimarkup

user226528

It should be [[C (programming language)|C]]

allquixotic

16:58

@Bob YouMean WikiMarkup? ;-)

user226528

I noticed that nobody knows what the hell Microsoft's Metro is. Some knuckleheads in the mainstream news have even invented "Metro Shell"!

user226528

Or "Metro UI".

Nick

Metro is actually Microsoft's design language. A response perhaps to Google's material design.

Burgi

metro came first

its part of the microsoft grand plan to unify their windows codebase

Bob

@Nick you have the order waaaaay off :P

metro was WP7, 2011. or win8, 2012. material design was 2014

Burgi

17:06

rather than having 3 or 4 different flavours of windows they almost have a single codebase they can remix for the device

Nick

IIRC, the first time goog's material design popped up in 2008 along with the early version of MeeGo. This was the time BumpTop3D popular was popular on desktops. Google bought that now and it's open source.

But I could be wrong about that first part,it does sound very unlikely.

Burgi

iirc xbox 360 used WinME

Nick

oh rlly?

never owned an xbox. So, I wouldn't know.

Burgi

arstechnica.co.uk/information-technology/2016/05/…

sorry Win2k

> The original Xbox operating system was a fork of Windows 2000

the upshot is that they can have a mobile dev write something that could be included in win10 desktop or xbox

or vice versa

makes the dev teams smaller and more efficent

user226528

@Burgi Stress on "part of". The other part was OneCore.

Burgi

17:13

thats in the article i linked

user226528

17:25

Question: Is ChatBot John Cavil really a bot? If yes, how comes it has SU edits?

Burgi

its a fracking cylon!

user226528

@Buri I don't watch Battlestart Galactica, so I don't know what you mean.

Burgi

it needed rep to be able to use chat

user226528

Oh!

Burgi

posting on the main site is too risky as votes can change but editing is a guaranteed +2

user226528

17:30

How about I Am A Bot? Is it a bot too?

Burgi

@FleetCommand ask @TOWMN

user226528

news.softpedia.com/news/…

user226528

Should I say "Oh, hell"?

user226528

Anyway, I expect we will soon have questions about it on SU.

Burgi

18:06

i'm glad i'm not paid per line of code

i've only changed 1 line since this morning but that doesn't show all the crazy debuging and trying different things throughout the day

bwDraco

18:19

@FleetCommand "I Am A Bot" is a secondary account operated by TOWMN. As far as I know, there is no bot on this account.

Cavil is a real bot operated by @allquixotic. For help using it, enter !!/help or !!/listcommands. The reputation is needed for the bot to access chat.

!!/help

CaffeineAddiction

@Bob Yes you can, if you have access to the domain name you can host port 80/443 on it temporarily via a cron job ... I have it working in Ubuntu 14 by spinning up a docker container hosting a simple web root ... refreshing the cert and then shutting down. Then the path of the cert can be sym-linked to for any service that needs it.

ChatBot John Cavil

@bwDraco Information on interacting with me can be found at this page

bwDraco

(Note that some functionality has been disabled since that page was written.)

music2myear

18:58

I'm guessing Google Drive just had a big hiccup

user226528

It did.

Burgi

19:29

so this landlady person is apparently the head of housing services

she never answers the phone nor responds to email

That Brazilian Guy

@Burgi Is she part of the Brazilian government?

Burgi

maybe?

Michael Frank

why you try and downgrade?! D:

Wait... wrong dates...

nvm.

woah woah woah, wtf happened to my avatar?

Oh, it's still there. I just can't see it.

That Brazilian Guy

19:46

14

A: How to use a real partition with Windows 7 installed, in a virtualbox vm?

The command you want is VBoxManage internalcommands createrawvmdk -filename Win7.vmdk -rawdisk /dev/sda -partitions 1 This will create a special VMDK virtual disk file (Win7.vmdk) which is actually a pointer to the host disk partition /dev/sda1. In theory, you can then use this as the disk fi...

In addition, even if it worked (which I doubt) you may seriously damage your Windows when running from both boot, and the VM. — Takkat Jul 26 '12 at 8:54

> seriously damage your Windows when running from both boot, and the VM

They don't mention how.

Burgi

does she look familiar?

That Brazilian Guy

@Burgi A little...

Burgi

how odd....

That Brazilian Guy

20:04

@Burgi You might want to remove it, as it's reverse-searchable.

bwDraco

20:17

> R M A
M
A

lol

reddit.com/r/pcmasterrace/comments/5zsh8s/literally_unusable/…

Burgi

20:33

@ThatBrazilianGuy ah was it? thats why i added it to imgur

nvm

That Brazilian Guy

@Burgi You know you performe a reverse search on images, right?

I was able to find her LinkedIn page.

Burgi

thats the evil woman...

i was hoping uploading to imgur would throw off the reverse search

DavidPostill

@Burgi What has she done that is so evil?

djsmiley2k

erm

google reverse image search actually looks at the image

not where it's hosted

Burgi

@DavidPostill not answered my calls or my emails

DavidPostill

20:37

@Burgi You have a problem with your new flat?

djsmiley2k

who?!

That Brazilian Guy

@Burgi Reverse search looks at the pixels. It works even if you change the file format, crop it, etc

Burgi

@djsmiley2k it might have compressed it our something to make it different enough

fair enough

djsmiley2k

so you've just told the 4LA who owns your housing..

Burgi

i can't trhink properly i haven't eaten

DavidPostill

20:38

@djsmiley2k Drone targeting ...

Burgi

brb

i didn't link her profile!

pokes @DavidPostill

djsmiley2k

u called that dev yet?

he turned up in a car boot?#

Burgi

yeah, he wrote it in a rush and its unique. not used anywhere else

djsmiley2k

well that's good, for him .D:

djsmiley2k

21:10

errrrrr

Burgi

21:56

can a room owner nuke that linked in profile?

DavidPostill

22:10

→ 1 message moved to Trash

@Burgi I've trashed it, so it's not completely nuked. I think that needs a mod.

@Burgi You want the photo trashed as well?

Bob

22:30

@CaffeineAddiction I ... just said I don't have access to the host of the mumble server. and ffsync already makes use of 80/443. I'm not about to go fiddling with reverse proxies, etc.. I even mentioned the possibility of having a webserver specifically for this, and even without the port conflict that's not something I'm particularly happy to do.

Ben N

@DavidPostill zap

DavidPostill

@BenN Erm, you zapped the trash? Thanks.

Ben N

Yep

Michael Frank

@JourneymanGeek You have one of these, right?

Ben N

Hmm, Chrome started showing chrome://newtab for the title of new tabs

Michael Frank

22:44

@BenN Does it for me as well.

Journeyman Geek

@Nick so. Official rule of dog here. We only discuss piracy as current news. Asking for links is bad

@MichaelFrank octane. It's green.

Michael Frank

Close, I guess.

bwDraco

@BenN It's not shown in Firefox, but is internally about:newtab.

Ben N

The source includes <title i18n-content="title"></title>; I feel that there should be content in that tag

Journeyman Geek

@Bob @allquixotic hmm. I think matrix.org is what the cool kids use now

Michael Frank

22:48

@bwDraco That would be because this is a Chrome "feature". :P

Journeyman Geek

github.com/Canop/miaou is nice too

Bob

23:04

@JourneymanGeek that was the one. I flubbed the name.

Burgi

23:15

@DavidPostill i dunno, i guess

i didn't expect you guys to stalk her! lol!

Bob

@JourneymanGeek Huh. Matrix + Riot looks nice (cc @allquixotic)

could be a good replacement for Gitter if/when we want

and being able to sync across multiple servers is also nice :P

We've all got our own servers... and we can keep it up in case one goes down :D

Burgi

also in other news my trip to Sicily might be in trouble...

Ben N

@Burgi What's up?

Burgi

we are going to visit mt etna

which exploded today

Ben N

Oh, that is an issue

Michael Frank

23:23

Huh...

Maybe you could go swimming instead!

Journeyman Geek

@Bob I need to check/upgrade my instance ;p

Bob

@JourneymanGeek Of matrix?

Journeyman Geek

yup

only that I'm still on the old ~~riot~~ vector client

DavidPostill

@Burgi You had better ask a mod then :)

Journeyman Geek

>_>

DavidPostill

23:32

@JourneymanGeek As per @Burgi's request, please zap the photo he posted ^^^

Journeyman Geek

@DavidPostill already done

@Bob workplace.meta.stackexchange.com/questions/4410/…

DavidPostill

@JourneymanGeek Ah. Thanks. I hadn't refreshed chat recently ...

Journeyman Geek

Oh, noticed that when I was scrolling through the chat with my morning ~~shot of milk~~ cup of coffee

Bob

@JourneymanGeek o.O

Am I supposed to know this guy?

Journeyman Geek

@Bob no, but it reminds me of mr goldbrick

Bob

23:38

lol

DavidPostill

@JourneymanGeek That's hilarious :)

Transcript for