The Comms Room

Chris S

17:01

In the last 3 months my site had 1 pageview from an IE6 browser, probably a red herring.

Also interesting, 55% Chrome, 28% Firefox, 8% Safari, and 6% IE.

WTF is a Camino 2.1.2?

Hrm, looks like some ancient Mac software

freiheit

@ChrisS Yeah, I remember using it at some point. I think it was basically the Mozilla/FF renderer with better OSX integration than anything but Safari had at the time. Quite thoroughly defunct now.

tombull89

ARS Technica Presents: Opening an Internet time capsule—Internet in a Box for Win95.

2

freiheit

@faker That's a question I've asked internally in the form of a change proposal for disabling SSLv3. With some supporting data bout our actual SSLv3 connections. (approx 0.1%, and looking at the user-agent strings, I'm not convinced very much is actually from browsers that don't support TLSv1)

faker

17:17

@freiheit for us it was easier. We only use SSL for logged in actions which only a small percentage of our users use anyway. We just turned it off.

ewwhite

Here's a good one... Client is procaccibrothers.com - Their internal AD domain is pbscorp.com

freiheit

@faker The data I gathered was from our single-signon server. We primarily only use SSL for logged-in actions, too, but as a university we have a lot of logged-in activity. In fact, a huge percentage of the activity on our main campus web cluster is going to the front page and then clicking the "login" button.

ewwhite

We're trying to get an SSL cert...

and the client doesn't own pbscorp.com

freiheit

@ewwhite whois says it's for sale!

ewwhite

yes, for $3k

freiheit

17:21

(but, seriously, why is it so hard to just use a fucking subdomain for your AD domain? ad.procaccibrothers.com, perhaps?)

ewwhite

I use ad.domainname.com

Nathan C

we're a .local ;.;

it'd be a royal pain in the ass to switch, so I'm stuck with it (was like that when I started...and when my boss started...)

cole

lol.local

we're actually a .com

corp.company.com

faker

we are .$companyname and I hate who did that

Ry Jones

@faker java programmer probably

Bob

17:34

@ChrisS got your image linking thing if you want it :P

faker

@RyJones it was a sysadmin consultant with very limited view into the future

company just got bought by $corp? Let's take .$company as the TLD in the new datacenter!

so now $corp migrates all their stuff into .$company

which is just as confusing as it sounds

Chris S

5

Q: Full resolution option for embedded pictures?

Maybe this has already been addressed. I searched around here but maybe I'm searching for the wrong keywords. I'd like to see a built in "click through" option that would automatically open an embedded picture that ends up on http://i.stack.imgur.com. Currently, high resolution pictures end up...

Bob

@ChrisS github.com/Elusive138/SEImageExpander/raw/master/…

Chris S

@Bob How do I know that doesn't random links to goatse?

Bob

@ChrisS oooh, good idea!

Chris S

17:39

=/

Bob

in all seriousness, either trust me or browse the source yourself

be pretty hard to hide a goatse in there

Chris S

well if we're being serious, I already installed it and do trust you that much

freiheit

@Bob It's hard to hide a random goatse, but that last line basically looks like shellshock. ;)

mossy

17:55

i work some with some serious nerds

Nathan C

4

Q: How to mitigate POODLE but keep SSLv3 support for old clients

How do I mitigate the POODLE attack, but still keep support for old clients such as IE6 on Windows XP or an e-mail client. I've noticed that google does this: https://www.ssllabs.com/ssltest/analyze.html?d=mail.google.com I'm using nginx and openssl. In addition I want to keep Forward Secrecy...

nginx ssl poodle

Not bad.

Chopper3

►

cole

This day is dragging

Bob

@freiheit hm, there's an idea.

now you have me wondering if there's any browser that dumps JS through bash :P

@ChrisS lemme know if it breaks; I didn't exactly put a lot of effort into testing it

incidentally, Firefox debugging tools and Greasemonkey apparently don't mix

Shane Madden

18:40

I don't get why people are throwing so many downvotes on these questions about mitigating POODLE.. can anyone enlighten me?

Chris S

I honestly don't understand it either...

ThoriumBR

it's because the poodle problem has been answered lots and lots of times...

Michael Hampton

@NathanC Fuck. Can we just let IE6 die already?

Shane Madden

Seems like a perfectly reasonable query but got an instant downvote: serverfault.com/questions/637872/…

Collected 9 downvotes pre-edit: serverfault.com/revisions/637605/1

Chris S

@MichaelHampton Is there a petition? Where do i signup?

Shane Madden

18:44

If it's a dupe, then close it as a dupe. Dupes aren't bad questions just because they're already answered..

Michael Hampton

@ShaneMadden That seems like a silly question, unless you were last on the Internet in 2000.

Shane Madden

@MichaelHampton How so?

Wesley

@cole So's my face.

cole

@Wesley well ok

lol

Chris S

@ShaneMadden No, it was even at +2/-2 when I edited it. It got to +2/-7 at one point, and now it's at +9/-9

Michael Hampton

18:46

@ShaneMadden It would be very difficult to run a web server and not be aware of TLS.

Shane Madden

@ChrisS Ahh yeah you're right.. also collected 3 close votes after the edit, heh.

Chris S

Well one of those close votes predated the edit... The other two were after.

Michael Hampton

@ChrisS modern.ie/en-us/ie6countdown

Wesley

@ShaneMadden That seems like a borderline LMGTFY question, so I would have probably moved along with no down vote at best, and down voted / VTC'd if I was feeling grumpy.

Chris S

@MichaelHampton screw China... I think the Great Firewall blocked my site anyway. =]

Michael Hampton

18:49

@ChrisS And India. Aside from those two countries there is no significant use of IE6.

Shane Madden

@ChrisS Looking at timeline, all 3 after - first two were minimal understanding then the off-topic

Chris S

Must have been right after I edited it then....

Wesley

That compound question: "Will this disable HTTPS on our website completely?" <-- That to me appears to be just downright silly.
"What clients rely on SSLv3 still, should be be concerned about supporting them?" That seems too broad, with the exception of mentioning IE 6. The real answer is "Depends." What apps rely on your SSL web app?
I dunno, that question just seemed like zero effort was put into it. The edit didn't even help it much.

I didn't even think there would be a debate on why that was down voted / VTC'd.

Shane Madden

@Wesley google.com/… ?

The straightest answer in there is a stackexchange site. And not this one.

Wesley

@ShaneMadden Okay well POODLE kinda screwed the results in the last few days. Now the returns blow.

Shane Madden

18:52

It requires understanding of the actual protocol versions to reason through that.

Michael Hampton

How much do we need to cater to people who are administering something they don't understand?

Wesley

@MichaelHampton Remember, pink-and-fluffy thoughts.

Shane Madden

@MichaelHampton Catering to them and allowing the questions are different things. People are downvoting and closing on the basis of "I think you should know that to have that job".

Michael Hampton

I neither downvoted nor closed it. :)

Shane Madden

@MichaelHampton Talking about the community as a whole, not you :)

Michael Hampton

18:56

The irony is, Ask Ubuntu came up with a much better Q&A for POODLE than I've seen anywhere on SF.

Wesley

@ShaneMadden So yes I was a down voter and VTCer on that. Reasoning: "You didn't do due diligence to make a question within the guidelines of this site."

It appeared to me to be one step above "Give to me codez."

Perhaps I need a refresher on what the purpose of ServerFault is. To me the appropriate question is not "Will disabling SSLv3 shut down all SSL/TLS apps" but rather "I've learned about SSL/TLS and realized it shouldn't cause problems to disable SSLv3 and leave TLS available, and yet I'm seeing XYZ errors, and ABC client troubles. This is not expected and I don't know why it's happened."

Roughly.

Shane Madden

@MichaelHampton Yup, which is why I'm scratching my head as to why people here other than one brand new user aren't trying to actually put together some good answers on that.. because it's too easy to read the vulnerability announcements then extrapolate what that means for specific software and deployments based on good working knowledge of the history and versions of socket encryption protocols..?

@Wesley Right, but I've worked with plenty of people I'd consider competent that would have a hard time making the leap from "people say I should turn off SSLv3?" to "let me learn about the versions of SSL and TLS" to "I need to do X to mitigate this in software Y"

Wesley

@ShaneMadden ¯\_(ツ)_/¯

I'm just a dick.

Ry Jones

@Wesley you need a belly rub

Wesley

I really do need to refresh myself on ServerFault's mission statement / whatever-it's-called-now

Shane Madden

19:08

@Wesley Heh, fair enough. Doesn't look like you're one of the close voters on what I'm looking at so you can still go VTC that if you want ;)

Wesley

I think I'm going off of five year old info and never bothered to really sink into the latest FAQ.

@RyJones I could use a 5 minute scalp massage right about now.

Ry Jones

amazon.com/Ultimate-Relaxation-Stimulating-Scalp-Massager/dp/…

@Wesley get one of those

Wesley

Orgasmatron.

This dog is priceless: youtube.com/watch?v=89bcFDlP5rw

TheCleaner

19:31

@MichaelHampton @ChrisS @Bob is the man! Thank you for the userscript!!!

Chris S

Yep - have to agree

BigHomie

TheCleaner

3

A: Full resolution option for embedded pictures?

As an interim measure, I've written a userscript that makes images link to their original/full sizes. You can install the current version from here. Currently tested on Firefox/Greasemonkey. It should work on Chrome, but I've lost track on the current way to install userscripts there.

Props and upvotes here ^

freiheit

19:47

@RyJones The problem with those is that I when I had one, a spider moved into the handle and it could never be used again. ever.

HopelessN00b

Say... any of the Windows folks around ever have to query hundreds of computers remotely to determine if they have a system reserved partition? Or... how would you go about that?

(Windows 7, so no easy Get-Partition cmdlet.)

Ry Jones

amazon.com/Art-Memory-Forensics-Detecting-Malware/dp/1118825098/…

at least the Kindle version is slightly cheaper than the print version

cole

@RyJones good read?

Ry Jones

@cole I'll let you know Monday

cole

@RyJones 5 stars on Amazon

Ry Jones

20:01

Andrew Case

@attrc, New Orleans

@Volatility Core developer, @Blackhatevents DFIR trainer, The Art Of Memory Forensics Co-Author, @BSidesNola Co-Organizer, interested in #dfir & #infosec

8.2k tweets, 11.3k followers, following 5.3k users

The author is active on twitter

HopelessN00b

So, the author's a twit? ... Twitterer?

faker

"You can’t identify gender with IP… DHCP prevents that. IP’s are recycled." - all righty, enough internet for today.

Nick

20:16

@faker wat

cole

wat

Nick

wat

cole

If gender could be identified by IP - mine would be in IPv6 - doesn't make sense to most, only the ones that are smart enough to get it.

Nick

dont get it

faker

I was reading a pornhub blogpost about differences in search behaviour (for science!) and that was in the comments

cole

20:18

@faker jesus.

HopelessN00b

Well, he's not wrong. Because IPs are dynamically assigned, and change, you can't identify the gender of a NIC by IP alone. You'd need to get the MAC and ask/query the manufacturer.

Wesley

@RyJones Holy cow you can read that in a weekend? I must just suck.

@faker Let's just take a step back and look at this:

"I was reading a pornhub blogpost"

I was reading a pornhub blogpost

READING ... PORNHUB

#thathappened

faker

I followed a link from Reddit -- I swear!

Wesley

You might be the first person on earth to notice that pornhub has a blog, @faker.

2

ThoriumBR

one of this days one guy comes to SF asking for porn... after that I don't doubt anything anymore...

Wesley

20:24

@ThoriumBR I can has porn?

ThoriumBR

*haz

one guy had his site redirect guests to a porn site, and a guy asks "send me the nudes"

@HopelessN00b this is a new theory on how mac address works. people seems obsessed with macs today. maybe they fear they will be identified as a man posing as girl on CoD?

@faker reddit.com/r/nsfw or something like that, I suppose...

HopelessN00b

Heh. There's a much easier way to identify men posing as women on CoD... the fact that no actual women play CoD.

faker

@ThoriumBR /r/dataisbeautiful actually

ThoriumBR

@faker cool, it's on the frontpage...

I don't think the proxy will like if I click on that link...

faker

see! I wasn't lying!

it's one of my favorite subreddits just after /r/devopsgonewild

freiheit

20:33

@HopelessN00b I'm sure that's not true, but none of them admit to being female because that's the fast path to being harassed...

HopelessN00b

@faker Huh. I don't know if data is beautiful, but it sure is depressing. And really racist. And a little bit sexist.

mossy

$200/month free VPS / storage \o/

what should i make

HopelessN00b

@freiheit Yeah, I imagine that's true. Don't play CoD myself... or generally congregate in places where the most used "word" is "niggerfag."

ThoriumBR

I couldn't even get my wife to play kinect sports with me... and ended up selling my xbox 360...

Wesley

@ThoriumBR Divorce her. It's the only solution.

ThoriumBR

20:38

no, I love her, she cooks amazingly well, and she cares a lot about me. she even lets me play Dota2 until 3am and does not get mad... this downside is negligible.

Wesley

@ThoriumBR I've got my mind in the gutter now because I legit read that first line as "she cocks amazingly well"

ewwhite

Yawn.

HopelessN00b

21:01

Heh, Obama had his credit card declined at an NY restaurant ... Gotta love credit card companies.

ewwhite

21:12

While cleaning up someone else mess... #sysadmin #fail #linux #unix #servers http://t.co/HP1XLg6gsW

Tweeted by nixcraft on October 17, 2014 at 8:03 PM

HopelessN00b

@ewwhite What's so bad about that, by the way? Other than being weird and unconventional?

Michael Hampton

@HopelessN00b It doesn't do what you might expect, for starters.

HopelessN00b

@MichaelHampton Well... what would you expect it to do?

...and is it actually bad/problematic... or just... kinda pointless?

Michael Hampton

@HopelessN00b It's pointless and very likely bad. You can use all of those "accounts" to log in, but they are all UID 0 so they are all logged in as root, regardless.

So, you can't tell who did what, which is usually what the point of that is.

HopelessN00b

Oh, they are UID 0? Yeah, that's bad.

Oh, duh... the screenshot even shows the UID. And home directory. Nevermind me... I must be sober again. I'll have to fix that right quick.

ewwhite

21:32

That stuff just makes me feel better about starting two more new exchange deployments.

I used to be a Linux admin, didn't I?

3

And I used to have rep points. And people would mark SF answers.

My crutch, mdmarra, is on vacation, so I have to do ugly AD stuff on my own.

Ry Jones

is a crutch like a beard?

ewwhite

Haha

ewwhite

22:03

can you fools see this?

hmmph

nope...

Iain

nope

ewwhite

My friend was grading a test...

Mark Henderson

@ewwhite 100% clearly

ewwhite

America

Ry Jones

@ewwhite 'Murica

Iain

22:07

@ewwhite hallelujah

Mark Henderson

I once did something similar on a maths test. I didnt know the answers, I didnt kno whow to get to the answers, so I wrote an essay in the answer space about how fucking stupid this test was because in real life you'd just hire a surveyor to do all this crap for you

Wesley

@MarkHenderson And then you died.

Iain

Amen

Wesley

22:38

Behold, the #devop in his natural habitat:

Ry Jones

23:04

cole

23:26

sup

Jacob

23:37

@RyJones hi

Ry Jones

@Jacob salut

cole

@RyJones you said Renton is shit - yes?

Jacob

@cole Yes

Ry Jones

@cole I did. Perhaps that's an overbroad brush to paint the city with, but I wouldn't live there

unless I had a job there, then I'd live there

cole

@RyJones @Jacob yeah most of the apartments are cheaper...but look....less appealing.

Jacob

23:42

@cole youngstownflats.com

cole

@Jacob how far are you from the office?

Jacob

@cole 2 miles.

cole

@Jacob oh not bad

Jacob

I'm the closest one here by far

cole

2br is a bit too pricey for us

Jacob

23:43

You can easily drive or take transit

@cole 2br?

cole

Yes, my girlfriend is coming with.

and our three cats.

Jacob

@cole It's not my place, but 1 br won't work?

Ry Jones

@Jacob Impressive, the rent on that 2BR apartment (that's smaller than my 2br/2ba) is over twice what I'm paying now

cole

we discussed and agreed that it would be better to get a 2br so i can have an office

Jacob

@RyJones Are you in seattle?

Ry Jones

23:45

@Jacob Nope, Kirkland

cole

@RyJones how bad is the commute from Kirkland?

Seattle still seems much cheaper than Boston

Jacob

@cole bad

Ry Jones

@cole 20 minutes

cole

@RyJones oh that's not bad.

Ry Jones

@Jacob you have no practical experience with this commute.

Jacob

23:46

@RyJones I've seen the traffic...

Alas

cole

Kirkland seems pretty much and very reasonable.

Jacob

I'll yield

cole

Well I used to commute to north of Boston, can't be that bad :)

Jacob

@cole You can find cheaper stuff in West Seattle (than what I linked you too, where I live)

Ry Jones

The counter commute (live in Seattle, work on the Eastside) would be fucking miserable and I would not do it

cole

23:47

@Jacob those apartments are quite pricey

Jacob

@cole New building nice perks

cole

They seem very nice

Ry Jones

I'm sure, once they toll the I90 bridge, the 520 bridge will suck and everything will even out

@cole: @Jacob gets gigabit internet living there.

cole

Well dang.

I'd rather pay much less and get a 2br lol.

seattle.craigslist.org/sno/apa/4718133980.html

Ry Jones

GIG A BIT

Jacob

23:48

@cole Yeah, I mean I'm the only resident so I turned the dinning area into my office

Ry Jones

do not live in snohomish county and expect a reasonable commute

cole

Hngg

Ry Jones

oh wait, that's miscategorized listing

it's nowhere near Snohomish

Jacob

@cole You could look at burien

cole

Overheard: "Your cells keep growing dude...they continuously grow dude:"

Jacob

23:49

Less nice though

Ry Jones

there's a great sushi joint near that apartment

cole

@RyJones South Kirkland - nice?

I think $1431 is reasonable for a 2br w/ W/D in unit

Ry Jones

@cole all of Kirkland is pretty nice. Kingsgate is a little declasse.

cole

It's interesting -

Most of the apartments I look at, even the "bad" ones aren't bad compared to Boston lol

Jacob

@cole Call mgmt at my building, they want those units occupied. Might give you a better price.

cole

23:51

@Jacob they'd have to cut the price down $600-$700/month lol

$1500 is our cap

Jacob

@RyJones TBH, you'd be in good company if you commute a long distance. Just note that parking is limited at the office

If you can take transit it is a good option

Ry Jones

@cole you're going to have a commute for a $1500 2br

cole

@RyJones that's fine.

My girlfriend doesn't have a career or anything. Mostly retail background so she doesn't make enough for us to spend $1700+ on an apartment

Jacob

@RyJones He could go to Everett, and live cheep

Ry Jones

@Jacob also true. Marysville is nice and an easy commute on a motorcycle

Jacob

23:53

@cole You should do pretty well out here...

@RyJones From EVT, I'd take the rail.

cole

I think overall it's going to be better for me

Jacob

I do that drive to get to the DC way too often.

cole

It's kind of a fresh start but I already know people out there

Ry Jones

Hell, I worked with people at Microsoft that commuted every day from Olympia. They lived

cole

I used to commute from Franklin, MA to Waltham, MA

Jacob

23:54

@cole I meant money wise :)

You should be able to afford what you want on one salary

cole

@Jacob yeah I wonder how the position will line up with what I currently make

that was my old commute

Ry Jones

@cole did you quit?

cole

@RyJones I haven't worked at NetApp in over two years

@Jacob I make almost $90K

Ry Jones

@cole no state income tax out here, don't forget that

cole

@RyJones interesting.

Jacob

23:56

@cole 90k should easily get you a 2br appt in the city

Ry Jones

@cole sales tax and property tax are higher, of course

cole

@Jacob I have debt :)

Ry Jones

@Jacob that's living on Broadway money

core of cap hill

cole

Which is my my apartment is only $725/month

Jacob

@cole That much?

cole

23:57

@Jacob student loans and surgery costs, yes

I paid for surgery out of pocket

Jacob

@cole Ouch

cole

After everything was said and done that was about $10K

Jacob

@cole That shouldn't be that bad?

cole

@Jacob it is.

I have credit card debt too, and student loans (~$48K)

Car payment

Jacob

@cole That should only be ~500/mth in payments

cole

23:59

@Jacob all my bills right now is about $3K

Jacob

@cole Dude

Transcript for