Root Access

Journeyman Geek

07:00

actually.. it would be amusing if someone decided to use the same gravitar and name as someone else and stood. Not that I condone that sorta thing.

Bob

lol

Journeyman Geek

(AKA, do not blame me if you're stupid enough to try, and get hellbanned)

HackToHell

@JourneymanGeek What version of ubuntu do you use in your VPS ?

Journeyman Geek

11.04

Matthew Wong

what if i have a picture of a dog that looks like yours and put it as my gravitar?

Journeyman Geek

07:01

I'm not running mysql

@MatthewWong: and change your name to JurneymanGeek

HackToHell

but 11.04 has lost support

and i am nervous about upgrading

> Unless you mean 11.x -> 12.x?

The biggest issue is it usually screws with /etc/init.

Francisco

Journeyman Geek

@HackToHell: I figure eventually I can just copy wharever I am running on it, nuke the old VPS and build a new one

ya, 12.x uses upstart I think

which is the hawtness

HackToHell

hmm

ronalchn

@JourneymanGeek if he does that, we can see the difference in spelling

Journeyman Geek

@ronalchn: can you tell I am NOT very good at cheating?

Matthew Wong

07:06

@ronalchn if he was good at cheating he'd finish tier 4 on the second the contest was open.

Journeyman Geek

(as such I don't bother. I play fair, I play hard, and I type in ↑↓←→ABAB when no one's looking)

@MatthewWong: actually that would be too obvious one would think

too much skill, absolutely no finasse

ronalchn

@MatthewWong or he could have just set the dates on his [windows-8] posts in the future, by taking advantage of a mass assignment vulnerability: github.com/rails/rails/issues/5239 (maybe their PHP code is also vulnerable?)

Journeyman Geek

@ronalchn: joke would be on me

this whole site runs on .net and mssql

also i can't code

Matthew Wong

se runs on php? i thought it was asp.net?

Journeyman Geek

@MatthewWong: you think correctly

Load balancers, caching servers routers and DNS servers run on ubuntu or centos

everything else is all windows

Server Fault Blog: Stack Exchange’s Architecture in Bullet Points

Kyle Brandt on February 11, 2011

I thought as a break form the normal prose some of our readers might enjoy a short overview of the Stack Exchange Network (including Stack Overflow, Server Fault, and Super User) from a technical view:

95 Million Page Views a Month

800 HTTP requests a second

180 DNS requests a second

55 Megabits per second

1 Rack with Peak Internet in OR (Hosts our chat and Data Explorer)

2 Racks with Peer 1 in NY (Hosts the rest of the Stack Exchange Network)

12 Web Servers (Windows Server 2008 R2)

2 Database Servers (Windows Server 2008 R2 and SQL Server 2008 R2) …

Matthew Wong

07:11

@ronalchn so how was the user able to get the date as 3012?

ronalchn

If I selected the OS, servers would never run on windows

@MatthewWong follow the link to the issue

Journeyman Geek

@ronalchn: geek's first law

use whatever the hell you know how to use

unless you're trying to drive in a nail with a power drill

in this case both jeff and joel are windows guys

hence the site runs on windows

darn thing, admittedly is a lot more reliable than one would expect

nhinkle

pssst @KronoS msdn.microsoft.com/en-us/library/windowsphone/help/…

KronoS

@nhinkle @nhinkle that's windows phone

@nhinkle if you head over to Fake Programmers, I have a link to my app... I think

Matthew Wong

lol i didn't even see that

HackToHell

07:34

0

Q: Midnight Commander is showing some weird characters

I have no idea why this happens, how do i fix it ?

11.04

Journeyman Geek

the a with a hat?

using putty?

HackToHell

yeah

Journeyman Geek

andremiller.net/content/…

please stand by while a post an answer

HackToHell

aye!

Journeyman Geek

answered

HackToHell

07:39

Journeyman Geek

google.com/… I regret not searching for hatted a ;p

HackToHell

i could not get the correct search term

I need to improve my google-fu !

Journeyman Geek

lol

god, you have NO idea how much rep I get off google fu, and the deadly art of paraphrasing

Matthew Wong

i do the same

but mostly c&p

Journeyman Geek

C&P will get you in trouble

Matthew Wong

07:43

w/ credits?

Journeyman Geek

especially if you don't read it properly

less trouble

but paraphrase with credits = MAXIMUM EFFECT

don't copy, research ;p

Matthew Wong

i probably should've mentioned this sooner but when you used my url shortener i got your ip address. (don't worry its just in case of abuse. then i know who to ban)

*you = anyone who used it

HackToHell

i haz dynamic ip

Matthew Wong

then ill ban your whole /8 block

Bob

@MatthewWong eh, that's normal for any webserver

they all have access logs

I probably have the IP of most of the frequenters of this room somewhere in apache logs, from that stats site

Matthew Wong

07:48

@bob well yeah in the access logs but its in the database too

ronalchn

ip ban doesn't work with proxies

Bob

@ronalchn IP bans don't work, period.

A lot of people have dynamic IPs

or even shared

Matthew Wong

session bans?

Bob

that's the real issue with IP bans, they could be shared with or rotate to innocent people

ronalchn

you could try panopticlick.eff.org

@MatthewWong you can also try using supercookies

Matthew Wong

07:52

isn't that invasive?

Bob

both of which won't work on anyone scripting access

which is probably the main issue

you could try limiting it to X number of links per IP per Y time

with a resonably short time

say, an hour or a day

Matthew Wong

1 number of links per IP per 1 second

xD

instaban

ronalchn

well, if you do block them, you can try hellbanning them - url redirect only works from ips banned

Bob

still would be an issue with shared IPs, but no way around that

there's something seriously off about the Penopticlick thing

how the heck can my system fonts be unique on a fresh Win8 installation?

ronalchn

its explained easily

Bob

07:55

I have not installed anything that adds fonts

ronalchn

the font order differs

Bob

o.O

ronalchn

based on your filesystem inodes and stuff

Bob

uhh

sure that's not just how the fonts are enumerated in the registry?

because that's how any Windows application finds fonts

ronalchn

its in the paper panopticlick.eff.org/browser-uniqueness.pdf

6.4 Font Orders As An Unnecessary Source of Entropy
When implementing our fingerprinting code, we observed that Adobe Flash and
Sun's Java VM not only report complete lists of fonts installed on a system, but
return them in non-sorted order, perhaps due to a filesystem inode walk.

Bob

07:59

@ronalchn If Java/Flash do that, then they are doing it very very wrong

more likely that it's just random

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts

(alphabetically sorted) list of fonts

an 'inode walk' implies traversing the filesystem

maybe that's what you need to do on *nix, I dunno

but on Windows, if you're doing that to find a list of installed fonts, you're doing it wrong

ronalchn

well, the authors have tested it, and it must work

I can't comment on exactly how Java/Flash implementes it

I only read the paper

HackToHell

You cannot really do anything with that info

ronalchn

@HackToHell it's a way to fingerprint the browser

also, being a passive method of tracking, unlike cookies, it is undetectable

HackToHell

and do what ? the browser version is enough to scan for exploits

Matthew Wong

just wondering is it possible for a web page to load without a 200 header?

Bob

08:03

@HackToHell could be used for user tracking, in theory

but disable the living security holes that are Flash and Java and there's not much unique information

ronalchn

its not exploit scanning, it acts like an identification cookie

HackToHell

@Bob in theory only, GA is better :P

ronalchn

@Bob read about the other methods in the paper, there's also browser version number (I think it also sends build number), and others

Bob

@ronalchn unless you are using an experimental build, the version will not matter.

Consider how many millions are using any release version of a browser.

Heck, I'm using Firefox Elm of all things on Windows 8 and it's still only 1/179742.43

HackToHell

You can use flash cookies

Bob

08:05

@HackToHell ahem

1 min ago, by Bob

but disable the living security holes that are Flash and Java and there's not much unique information

Journeyman Geek

@MatthewWong oh, mine posting mine here? I want to check if you find them accurately ;p

my ISP uses a transparent proxy that mangles the hell out of em, last two octets would probably do

Matthew Wong

whats your url?

Journeyman Geek

it is superuser.com

HackToHell

ok ko

Matthew Wong

29.66

nhinkle

08:07

anybody who runs java applets willy nilly is just asking for trouble

Journeyman Geek

oh

nhinkle

anyhow, i know all your guys' IPs, so hah!

Journeyman Geek

looks like they fixed the annoying transparent proxy wierdness whoot

@nhinkle: mine is 127.0.0.1 ;p

Matthew Wong

mine is 199.58.84.1

nhinkle

mine is over 9000

HackToHell

08:08

i am gonna start metasploit and post my ip :P

@nhinkle ??

nhinkle

@MatthewWong no it's not

Matthew Wong

@nhinkle fffffff

HackToHell

lol do not mess with the mods @MatthewWong

nhinkle

it's obviously 123.45.67.89

ronalchn

do you see only current ip, or all ips used with account recently?

Bob

08:09

Mine is 74.125.237.99 (be quiet @nhinkle :P)

HackToHell

but @nhinkle cannot actually post it here

nhinkle

@ronalchn if i told you that i'd have to ~~kill~~ delete you

i wonder whose IPs you all actually are posting

Matthew Wong

@nhinkle 199.58.84.35 happy now?

Journeyman Geek

@nhinkle: My ISP had this.. thing which messed up IP address detection for ages

I actually used a bash script that got my router's control page via w3m, extracted the ip address from that, and sent it to my ddns provider using wget

Bob

@nhinkle reverse dns mine :P

Journeyman Geek

08:21

lol

HackToHell

1e100.net ??

Matthew Wong

~15 minutes later ~

Journeyman Geek

BOOM NOTHING HAPPENS

Bob

@HackToHell support.google.com/bin/answer.py?hl=en&answer=174717

HackToHell

0_O

nice

nhinkle

08:30

oh i forgot about 1e100

Journeyman Geek

itsokaytobesmart.com/post/35574961577/…

HackToHell

@JourneymanGeek Can you see what is the ipv6 interface in buyvm ?

Journeyman Geek

I don't recall doing that before

I have a lot

HackToHell

What's the command ?

Journeyman Geek

ifconfig

HackToHell

08:40

oh god

Is it inet6 ?

Bob

@HackToHell Mine (Ubuntu 11.04) defaults to venet0

Journeyman Geek

I THINK so

Bob

ipv4 is on venet0:0

Journeyman Geek

I don't have IPV6 at home at the moment

HackToHell

@Bob what about ipv6 ?

is it too venet0 ?

Bob

08:42

but then I'm on their US VPN, so I also have a venet0:1 for that

@HackToHell ipv6 is just venet0

that's just what ifconfig reports

HackToHell

I entered that, it didn't screw the upgrade :)

Bob

venet0    Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:127.0.0.2  P-t-P:127.0.0.2  Bcast:0.0.0.0  Mask:255.255.255.255
          inet6 addr: [REDACTED] Scope:Global

and a whole list of ipv6 addresses

Journeyman Geek

ya

Bob

it's so relieving to see No mail. on login :P

when testing/using cron scripts, mail means something failed

with a cron running every 5 minutes, over 200 mail messages! :(

Journeyman Geek

lol

HackToHell

08:54

@Bob I have a zillion, need to route messages to null

Oh no, I think I accidentally terminated my update of ubuntu

I accidentally killed the install window, how do I get it back on cmd ?

Journeyman Geek

er... fg ?

Bob

@HackToHell I route stdout to null

only stderr generates mail

Journeyman Geek

5

Q: how to bring a background job to foreground

in Linux/shell, how can I bring background jobs to foreground and vice versa?

linux shell

HackToHell

There are no jobs in when I run jobs

So how do i bring it back ! :'(

Journeyman Geek

how did you kill the job?

HackToHell

09:07

it asked for setting up Grub with a <ok> option in a screen like this i.imgur.com/QjVOQ.png but I could not hit the ok so i hit Ctrl+C

it uses whiptail

It was a message box so killing whiptail might fix the problem

Bob

ah, government account passwords.

must be between 6-8 characters

> not use an obvious combination e.g. AAAAAA, 11111a, 123456a, 1122a.

o.O

define 'obvious'

> your password is NOT case sensitive.

HackToHell

fuck, now it ask me to configure grub, I am reading it off parameters, what should I do about grub ?

how do i cancel grub installation

Journeyman Geek

what's it actually say ?

and what exactly are we doing? ;p

HackToHell

I am reading whiptails parameter as I cannot bring to my window

Bob

@HackToHell You do have a backup, right?

...right?

HackToHell

09:13

yeah, spent the last 2 hrs doing that

Not a whole backup but it has wp,sql,config files

So I need to reinstall everything

Matthew Wong

@Bob that reminds me. i hate it when banks limit your choice of passwords. ie. only letters and numbers.

Bob

> your password can contain the following special characters; !, @, #, $, %, ^, &, *.

would it kill them to allow more characters? :\

I dunno, on the keyboard alone there is ()_+-={}[]|\:";'<>,.?/`~

ronalchn

yes lol, it might cause SQL injection issues

especially if you use quote marks

Matthew Wong

then they're not using enough security

PDO ftw. (such a pain in the ass to convert mysql_* to pdo)

ronalchn

I've never used pdo, haven't done PHP for years

Bob

09:19

@ronalchn It's not hard to escape user input for SQL

Journeyman Geek

lol

I prefer length over varity

nothing like horsebatterystaple

Bob

@JourneymanGeek It's already limited to 8 chars

@JourneymanGeek correct horse battery staple

ronalchn

@Bob actually, it was a joke, anyways they would encrypt it first, so it's not a problem

Journeyman Geek

THAT sucks

Bob

@ronalchn oh yea. but then why the length limit?!

I get the feeling it's stored as plaintext

ronalchn

09:21

don't know

Bob

oh lawd

the onslaught of secret questions

ronalchn

btw, never use md5, sha???, or most other encryption methods

Matthew Wong

rsa

aes

ronalchn

use a powerful encryption algorithm such as bcrypt or preferable scrypt

Bob

@ronalchn and why not?

@MatthewWong that's encryption, not hashing

ronalchn

09:21

because passwords should take a long time to encrypt

Bob

for passwords, you want a one way hash

@ronalchn so increase the number of rounds

ronalchn

to avoid brute force attacks

Matthew Wong

oh @ronalchn said encrypting so.... :P

Bob

even better, limit the number of attempts

ronalchn

yeah, but I mean for passwords - it's even more important

Bob

09:22

if someone has access to yourdatabse, it's over anyway

ronalchn

bcrypt and scrypt increases encryption time, so they can't brute force the plaintext of your passwords, even if they have the encrypted form (access to DB)

this at least protects users who might use the same password on multiple sites

Bob

Again, just use more rounds

HackToHell

phew, updated successfully !

yay!

Bob

give it a thousand rounds of md5

easy, done

ronalchn

@Bob that actually makes it weaker, it increases the probability of a hash collision

Bob

09:24

also, md5 is more readily available

ronalchn

and means that many more possible inputs are accepted as the correct password

Bob

if they have access to the DB, that won't matter

all that matters is protecting the original password

ronalchn

but that's not necessarily the case

they might be brute forcing through your UI

Bob

even then, unless you find a loop of hashes, it does not matter if there's a hash collision midway through

@ronalchn Then your UI is broken.

Hashes are not the weak point.

Secure your database, secure your UI

ronalchn

You can't just rely on another part of your system to cover the shortcomings of another part

Bob

09:26

Don't worry about hte hash, just use something like a thousand rounds of md5

make sure everything else is secure

ronalchn

you should make every part of your system as strong as possible

Matthew Wong

block external access?

Bob

You can't rely on the hash to overcome the shortcomings of your UI/database, exactly

ronalchn

anyways, homebrew ways of combining hash functions are a big security risk

there are many problems that can come up

Bob

running a hash function multiple times is pretty standardised

ronalchn

09:27

and using scrypt/bcrypt makes implementation easier

because they are standardised, and stores the version and number of rounds as part of the encrypted output

this means if you change something (# of rounds), it won't easily break it

Bob

in any case, once again, don't worry about the hash. pick something reasonably secure and, more importantly, available in your environment (blowfish is often missing, I've found). And secure your DB/UI. Because if those are secure, they aren't gonna get to the hashes. If those are not secure, you have bigger worries.

if someone gets into your DB, you'd better worry about the other data, not just passwords

especially if you store any payment information

ronalchn

read codinghorror.com/blog/2007/09/…, "Do not invent your own "clever" password storage scheme"

Sathya

> what's with the 20+ notifications !?!? - every Super User mod today. (mod messages get delivered to all mod inboxes)

ronalchn

if you reapply a hash function, you are actually supposed to do other stuff, like re-appending the salt and password

to avoid hash collisions

Journeyman Geek

@Sathya: 20+ ? o0

ronalchn

09:32

@Bob, for more information on properly re-using a hash function, read en.wikipedia.org/wiki/Key_stretching

nhinkle

@JourneymanGeek the great sock busting of 2012

Journeyman Geek

@nhinkle: ... whoa

Bob

@ronalchn eh, good thing I'm not implementing such a function

nhinkle

i think the total was almost 30, in fact

ronalchn

@Bob most people don't do that, so the "clever" custom password algorithm fails

Journeyman Geek

09:33

falls over

@nhinkle: thats quite scary

nhinkle

So if you haven't been suspended yet, you're probably in the clear!

6

Journeyman Geek

lol

Bob

lol

Journeyman Geek

If I get suspended, I probably should shoot myself

(since I have MUCH more riding on my SU participation than just the contest as things are ;p)

Bob

@ronalchn most standard libraries probably support such a thing already

MD5 and SHA256/512 tend to be fairly common. Blowfish, not so much...

If you can use it, sure, fine, go ahead. If not, salt + increase number of rounds, probably use SHA512, and worry more about other aspects of your system

ronalchn

09:35

@Bob, the current gold standard for password encryption is either bcrypt or scrypt, I would say scrypt is a better standard

nhinkle

why do people make their own authentication systems. why.

Journeyman Geek

@nhinkle: NIH syndrome?

nhinkle

@JourneymanGeek NIH?

Journeyman Geek

Not invented here

Old master once say, smart dog not eat own dogfood. smart dog eat dogfood from own plate. Dogs are horrible at cooking

Matthew Wong

microsoft dogfood

Journeyman Geek

09:38

I entirely blame A-Team for that old master gag

Bob

huh, PHP 5.3.x implements the hash algorithms in case of lack of OS support. Great.

HackToHell

more lols ---> chat.stackexchange.com/rooms/201/ask-ubuntu-general-room

Journeyman Geek

lol

jokerdino

:D

Sathya

09:53

mod powers ftw!

nhinkle

gotta have some fun after having to slog through all those socks today

Journeyman Geek

lol

yeah, gotta be the worst part of being a mod, ya?

does this happen every contest, or was it especially bad this time?

nhinkle

the last contest either wasn't so bad or we didn't do a good job noticing

and i wasn't really around much for the one before that

jokerdino

woah, contests lead to socks?

Journeyman Geek

@jokerdino: least 4 suspensions on level 4

jokerdino

09:57

Must. find. all. of. them.

nhinkle

almost 30 overall. gotta catch 'em all!

jokerdino

Pokemon FTW

Journeyman Geek

(and looking at the math, that means I have roughly 15% probability of a level 4 prize. I think. Math is hard. That is why man invented computers (and let the women do the coding at first ;p)).

jokerdino

:>

HackToHell

)

nhinkle

09:59

@JourneymanGeek actually once upon a time, a "computer" was literally a person who computed numbers for other people

Journeyman Geek

>_>

nhinkle

your job could be "computer"

jokerdino

like calculator

Journeyman Geek

THIS IS NOT THE UNMATCHED PARENTHESIS YOU ARE LOOKING FOR!

Transcript for