« first day (1308 days earlier)      last day (3959 days later) » 

03:02
@MichaelHampton naw, the text on the display.
@Jacob Oh, that's an old old prank. That still works.
Non-tech people should not try to report on very technical news like heartbleed. This video literally hurt to watch: youtube.com/watch?v=NwzjLRKy21A
There's even an Android app that you can point to a printer and change its message.
@KevinSoviero I would have expected more from them. Specifically, TLS, not FSL/
Besides
> Heartbleed can reveal the contents of a server's memory, where the most sensitive of data is stored.
Well, I guess that's at least half right
03:06
I explained to an english professor in 3 minutes how it worked, and why it's bad.
Journalists just don't try
@Jacob You've heard of TYT?
@KevinSoviero Yeah
@Jacob Cool
Independant news that usually covers things fairly well.
03:08
@Jacob I don't want to get political here, but I agree.
I usually read my news. It's just faster, and TV hosts useually try to fill space with useless words.
@Jacob ugh, I know, right
@Jacob I'm a member and I listen to the first hour on the way to work, then I watch the second hour while eating dinner.
example :
The way he's weaving back and forth
Well gee
If you're doing speeds 30+ MPH/ 50+KPH over the prevailing limit you're going to have to dodge cars.
Watch the first 8 seconds of this video: youtube.com/watch?v=tSyc5iRcMAM
03:12
@KevinSoviero I just died.
Someone please tell them to stop doing tech news!
That is sad...
I would have wrecked them. Esp If I was in the 350
@Jacob They did get away. They got off the freeway and parked behind a building. Cops went right by.
@MichaelHampton I hate the crackdown on the low speed limits, but they deserve to be executed.
Bob
Bob
03:27
@KevinSoviero Please explain (can't watch it right now)
@Bob She says FoxFire browser.
Bob
Bob
...
@Bob ...?
Bob
Bob
facepalm
How do these people make it anywhere in life?
It's a story about OKcupid being upset with Mozilla over their CEO
Bob
Bob
03:29
They see a computer and suddenly can't read?
@MichaelHampton Seriously though, if I ever saw I street race I would end them.
@Jacob How's that?
@MichaelHampton Let's say running into an four ton vehicle might suck
Fucking criminals are stupid.
03:46
@MichaelHampton They should save their fucking for after the heist
 
1 hour later…
05:02
This is interesting:
The fact that it exists, I mean
It's interesting that what 20 years ago was only taught in graduate-level physics classes is now a commodity. Watered-down for sure, but the fact that it's a valuable commodity for the general public is interesting.
@tylerl That's neat. I want to watch these.
05:26
It should be safe to un-pin the Heartbleed notice now?
Don't say anything if you agree
Bob
Bob
05:52
@MarkHenderson I kinda want to see just how many stars it can get.
Hm. Apparently Tomcat is affected... shit...
Then again, our stuff is so old it probably doesn't matter.
06:09
@MarkHenderson make....it...stop..
06:22
G'day
The H********d stuff has slowed down quite a bit already.
06:35
@MichaelHampton How do they still have licenses after like 30 tickets?
morning, guys
06:56
-1
Q: A command-line/string-oriented alternative to VNC

user279667Sorry if this question is kind of vague, but I don't know where to ask. You see, I use a computer with Windows (8) and have a few ''slaves'' with Linux (Debian/Ubuntu). Normally I would use a VNC to access and work with the slaves, but my main issue is that using SVN to acess those slaves is wa...

I'm .... just completely in shock.
2
@MichaelHampton It is three AM.... Did I just read what I think I did?
@Jacob Yes, yes you did.
@MichaelHampton Oh my.
Bob
Bob
@MichaelHampton Wow.
07:26
oh god
You're looking for ssh. But you're also definitely at the wrong site. — Michael Hampton ♦ 33 mins ago
:)
07:48
@tylerl like most people asking
Still hacking away at this domain controller disaster...
Disaster? What happened @ewwhite
@RobM Oh... um
16 hours ago, by ewwhite
user image
@RobM A client cloned a DC
16 hours ago, by ewwhite
@84104 I called the client... and he cloned the domain controller in VMware to create a server for Spiceworks.
07:57
.. to install spiceworks on it
oh. fuck
that is important to emphasize
and I've been digging out of it.
In fact, let me refine my earlier curse: *fuck my old boots*.

Yes that covers it better, now.
mainly because it destroyed VMware
07:57
What on earth possessed them?
@RobM they didn't want to go through the process of building a new VMware Windows instance
thought they'd "try cloning"
I bet they wish differently now :-(
they called me a day or two ago to ask if cloning was okay
I said, "yeah, as long as you don't clone a domain controller"
...
and of course it's killed vcenter?
The biggest surprise was that VMware bound to the bad domain controller...
and wouldn't bind to the second DC
so backups became inaccessible
08:00
that's a worry in itself
Needed to hack into the SSO system to get into vSphere long enough to change the AD bindings
but SSO's passwords automatically expire after 1 year... (wish someone told me)
I wish I had more intelligent observations to offer at this point but I have a headache and can't brain too good. You have my sympathy for whatever that's worth. I can't believe they just cloned a DC right after being told not to :-(
I think they did it before asking me
and were asking retroactively...
oh, but the effect was Exchange not working this morning
oh. oh dear!
Was Exchange installed on the busted DC?
and I looked deeper and saw a Domain Controller named "Spiceworks"...
3
08:05
O_o
no, but Exchange Management Console didn't work anymore, and the client needed to add a bunch of users.
I thought it was a routine Exchange issue...
@ewwhite Sounds like you need some @MDMarra
I did everything right... this site had been stable. @mdmarra did the domain work here last year
You know what they say about nature seeing you create a foolproof situation and upgrading the firmware on all its fools.
08:10
you have more than one DC in the domain right? Can you force-remove the 'faulty' DC, including 'spiceworks', then create a new DC?
@RobM Yes. But the challenge was to get Exchange going, rebuild DHCP services...
the customer did not assign both DNS servers to many of his client computers...
(why?)
and then VMware was an awful mess with 5.1 SSO.
If its a recent version of Exchange then unless they've customised it to only look at one DC (why would you do that, but then why would you not assign both DNS servers on your clients, as you say) then it should be able to hop onto any working DC.
@RobM Spiceworks took over... duplicate SID
yep
so Exchange was still trying to bind to dc1
08:12
so taking DC1 and Spiceworks offline didn't fix Exchange?
@RobM had to demote spiceworks and eventually remove dc1
ah right
:-|
for the stars:
08:16
I think SF has done some good work with heartbleed, based mostly around the question @Jacob put up as a catchall
Emails from vendors and partners are trickling in, explaining what they did to remediate.
I do have clients calling to ask if they should change ALL THE PASSWORDS
there's a lot of misleading info in mainstream media. I was reading an article on the BBC website yesterday that was so wrong it would be funny, if it wasn't such a serious subject.
Still, I suppose we should be glad that the mainstream media are reporting it at all, so people like your clients are at least aware that something is happening.
Bob
Bob
@strugee That's a better explanation than mainstream media can make up.
@RobM The NPR article was terrible If a site has the padlock it's vulnerable.
@RobM link
08:21
@Bob Actually, it's pretty good.
Bob
Bob
@Jacob That's what I said, isn't it?
> Best-Selling Litter Boxes
@Jacob sounds like NPR and the BBC cribbed off each other then.
Bob
Bob
Uh, yea, Amazon? I don't even have a pet...
They've amended this article since I tweeted them complaining about it (not saying the two things are related!). Where it says "If an organisation employs OpenSSL, users see a padlock icon in their web browser - although this can also be triggered by rival products." they didn't originally mention 'rival products'.
nor did they say "users should check which services have fixed the flaw before changing passwords..."
Bob
Bob
Huh, looks like someone built a partial list of affected Android apps o.O
Bob
Bob
@Jacob That's websites, not phone apps.
@Bob I know...
 
2 hours later…
09:59
Woke up at 3:30AM this morning. QQ
bleh :-(
Annd I don't have shit to do today!
can't get back to sleep?
TV Show Of Choice marathon time?
10:11
hah
heh
Has anyone seen a self-enrollment service for AD?
Use case: Whole bunch of new users for a new network, and CBA to configure them manually.
10:50
CBA?
@RyanRies can't be arsed
Oh... heheh
Yeah, AD Certificate Services is great at auto-enrollment
You create the certificate template you want the users to have, give the users permissions to auto-enroll in it, then configure the enrollment policy via GPO, and done
@RyanRies Yeah, ADCS isn't the problem. I mean literally getting the users into AD.
@RyanRies Yeah
10:54
I see my error now, I saw the word 'enrollment' and my mind immediately went to certificates, sorry
@RyanRies I should have used a different word. I don't know what that word is, however.
Dan
Dan
Get back to work, bitches
Hey Dan.
Ooh. I've a question for you.
Dan
Dan
Married, sorry, else yeah for sure
If $personA joins the army, but is a) gay and b) not in the closet, and the army wants to mobilise them overseas, into a country where homosexuality is illegal, are they in a position to say "I don't wanna go, i'll get arrested/murdered/etc"?
10:55
I think your options are #1 - get the user accounts in some sort of format (like a CSV for instance,) and import them in bulk with Powershell or CSVDE, or if you want self-service provisioning you really probably need an identity management product like Forefront Identity Manager.
@RyanRies Fair enough. CSV should be easy enough.
Or at least delegate OUs in the directory to their managers and have their managers create their own teams' users
@RyanRies Ooh. That's a neat idea.
@RyanRies we hacked it up in perl and c# - perl frontend integrated with our intranet calling a webservice in c# that does the actual creation :)
@DennisKaarsemaker Yeah I would consider that as well... I love hacking stuff like that up in C# :)
I'm hearing a bird call outside my window that I've never heard before, neat.
It's really complex... like 5 seconds long
Oh and now it's accompanied by the dulcet tones of the garbage truck making its rounds at 6AM.
Dan
Dan
11:05
@TomO'Connor No, almost certainly not - but I don't know how that plays out in reality. If you're mobilising, you're working under UK law essentially
I can see it being a lot more complex if you're just being based/working somewhere - I expect the army would take a more pragmatic view at that point
@Dan UK law grants you protection from that kind of behavior in the workplace.. it's an interesting question..
@RyanRies This is why I'm installing VS2010 Ultimate ;)
Dan
Dan
@TomO'Connor It is, but it's very scenario dependant. Take Afghanistan as an example - any normal soldier over there is working outside of Afghan law (For all intents and purposes), they don't answer to Afghans and wouldn't ever find themselves wandering around outside of their armed remit
11:27
@Dan At the same time, at least for the US army, you're forbidden from having porn, alcohol, pork, or anything else that would violate the local laws. Kinda interesting to consider... "I can't go; I'm illegal in $country!"
I recall in the earlier gulf war the western forces made a lot out of banning things like public consumption of alcohol and things like that to avoid offending saudis, but this was out of courtesy rather than legal need.
Dan
Dan
@HopelessN00b Porn and alcohol is banned anyway, though, on deployment.
@Dan Pork isn't. :)
@TomO'Connor: You likely should bring it up the chain of command.
Dan
Dan
@HopelessN00b I don't think it's banned in Afghan though - I imagine they don't eat pork?
11:28
We don't have a DADT policy here, if you declare, you usually end up getting stashed in some ass end of nowhere
like I donno, school of transport, or the underwater basket weaving unit.
@Dan Oh, it's banned in Afghanistan. Or was. I know because you couldn't get SlimJims over there. Illegal. Contained pork.
You'd like to think that more places would be beyond that kinda petty nonsense by now
Dan
Dan
@HopelessN00b I don' tthink it's banned in Bastion, may be wrong though
@Dan Laws may have changed too... but at least near the start, pork products were outlawed by the Afghanis.
Dan
Dan
@HopelessN00b To be honest, in a military occupation context - I think it's generally accepted to follow local laws "to a point". Afghanistan has a lot of fucked up laws and I doubt anybody in the British army gives a crap ;)
11:32
@RobM US forces, at least, respect the local laws where they're deployed (or are supposed to). Sometimes that means you get stationed in Italy, can walk around in public with a drink, drink at 18 and what not... and sometimes it means you're stationed in a shithole where you can't get a beer.
Dan
Dan
@HopelessN00b Ah, but this is different to deployment
@Dan Yeah, but the politicos still want to play nice and pretend it isn't, which leads to a lot of the same rules.
Dan
Dan
To my knowledge, the UK doesn't have any peacetime bases in any country with a legal system vastly different to our own. Something like camp Bastion will be governed under the rules of conflict with the UN etc etc, whereas a base in Germany isn't.
I think the British army does too @HopelessN00b and in both cases I think they are right to do so. To a point... the example that @TomO'Connor mentioned being one where a local bout of homophobia shouldn't dictate how the troops should have to live being a case in point.
Especially on an active service deployment, not merely being garrisoned in a country.
Dan
Dan
Exactly - and bear in mind, soldiers would be asked not to engage in heterosexual relationships on tour anyway.
Right then, afternoon off and it's sunny - motorbike time. See ya later
11:38
ok have fun
Dan
Dan
I've had to pop back in, because I just got sent this and I know @TomO'Connor will love it:

http://hexus.net/tech/news/systems/68389-raspberry-pi-introduces-new-customisable-compute-module/
Bye
11:58
I don't know, I don't have access to OVH routetable. — MarcinM 3 hours ago
really?!
sigh
This is unusual... out of coffee by 7am.
12:26
12:37
hello alll
wow dead
@NathanC That's perfect.
@ColdT Nice.
@NathanC was on tweet wall, was impressed
12:51
oh bother!
It still works too
so how many people here that the three letter agency/agencies been using this for some time
@NathanC yeah.. which is even more surprising..
Probably on purpose though
@NathanC i suppose it's just a test and isolated as well
ahh definitely feels like a Friday today, suns out and stuck in the office
5 people out today...the plague must've got them
12:57
@NathanC you still have the wsus issue?
@Dan AWESOME!
@ColdT Technically yes, but I scrapped the WSUS/SCCM thing and just went with a standalone server
@NathanC if you managed to fix it, it would have been worth it
@ColdT Meh, I probably will when I have more time
took me 2-3 attempts to perfect it, but now running pretty smoothly
13:00
it was doomed from install basically
could you just not remove wsus and software update point and reinstall?
@ewwhite is your shit still broken?
@ColdT Tried that. Any time I'd install the Tools (and thus wsusutil.exe) and Schema folders would be missing
morning
13:17
heartbleed, who the fuck called it that?
all the sec guys are ripping their asses off, wtf? f morons. Since there usually nothing else for them to do.
@Basil Good morning Basil (in my best Austin Powers voice)
@TheCleaner Do try not to destroy this car, TheCleaner. It's very expensive.
lol
checkingthrillinitis (n.) - the feeling you get when you check your bank account online and see that the bonus discussed earlier this week in the Comms Room is in your account.
@mdmarra not as much.
All DCs in the environment have the same SID
DCs are a special case
I was re-reading all of your issues this morning while eating breakfast because I have nothing better to do in my life
When a DC is promoted, its machine SID is set to the domain SID
But you still cant clone the fuckers, as you've seen :)
13:33
'dat generation-id tho
@TheCleaner that is nice, I already forgot when I received any bonus last time.
I am not counting a saturday morning blowjob from my lady for that matter.
13:49
@mdmarra why did he clone it? Why did he think that was a good idea?
That environment had been stable and trouble free for a year.
Kind of surprised, for all the magic vSphere does, there isn't some big, red warning telling you that cloning DCs is a Bad Thing.
@jscott Well, it doesn't know it's a DC
And you can actually "clone" them in 2012 R2 because it resolves the USN rollbacks
still something I wouldn't ever do though
@ewwhite So for 5000$ i get Essentials plus, is only for one host?
@MDMarra demote, sysprep, clone, right? In that order?
essential plus is usually 3 ESXi host plus vcenter server
13:57
@BigHomie Or, ideally, have a template that was never a DC in the first place :)
@NathanC Only if you've configured it properly
@MDMarra lol yeah that's definitely the best option
Snapshot before demoting if not
@NathanC you cant just clone a DC in 2012 R2, you have to create a config file to define the clone provisioning rules and stick it somewhere in c:\windows\system32
@BigHomie never snap a DC
@ColdT oh so it is limited to 3 hosts.
yes for the essential plus, but you can purchase additional licenses i believe
@MDMarra Okay, I have to ask, why not?
13:59
@BigHomie USN rollback
USN rollback/database inconsistencies that it introduces
If you ever revert to the snapshot, you just fucked yourself... so don't have 'em in the first place.
If your backup software is doing a snap to quiesce, backing up, and merging the snap that's fine

« first day (1308 days earlier)      last day (3959 days later) »