« first day (2891 days earlier)   

1:05 AM
@TomK. Didn't we explicitly say that cat calling is offensive and rude?
I just said it shouldn't be banned. That would be censorship.
@TomK. It's an example of an asshole who is an asshole in the name of (3rd wave) feminism. That kind of thing is not uncommon. Note that I specify 3rd wave because those kinds tend to get angry at nothing.
@TomK. The idea of 4th wave feminism isn't really well-established in feminist theory. I tend to think of it as having only 3 waves, with the 3rd wave ranging from the 90s to now. Hell, some people even claim there's a 5th wave...
@TomK. Each wave is a distinct movement. No one is condemning 1st/2nd wave feminism. It was those waves that gave women equal rights, not the 3rd.
 
1:29 AM
@RoryAlsop Yep, that's equality. Banning speech isn't! :P
 
1:43 AM
On-topic now, but why do so many people think that a TPM stores an encryption key while it is in-use, as if it removes the need for the key to exist in memory?
I just saw an answer claiming that a TPM can encrypt a filesystem and cache...
I give it 777 this so my php scripts can easily modify it. Maybe I only need 766. Don’t I? — codezombie 9 hours ago
[SCREAMS INTERNALLY]
 
 
2 hours later…
4:02 AM
And this is exactly why I am a blackhat.
(Long read with 5 parts, but very worth it)
tl;dr guy discovers super easy to exploit bug, gets in trouble with the government who claim that, if anyone ever exploits it, he will be at fault.
 
4:29 AM
> this is by far the best damn read I've ever had on TFTS and easily top 3 all-time IT stories. This had me to the edge of my seat since part 1, and while a bit technical, it's worded very friendly and I can feel the taste of nationwide meltdown in my mouth.
Have to agree.
 
 
5 hours later…
J.J
9:03 AM
@forest I shall read that now.
I put my work laptop in sleep and for some reason it's just closed everything & restarted itself.
I blame Windows, Windows, Windows.
 
9:31 AM
@forest jeez! That's...special
 
J.J
The actual events in this series took just under 3 years real time from start to finish.
Don't make us wait that long
Heheh.
 
9:49 AM
@J.J You read the whole thing? It's horrifying isn't it.
The sad thing is that that is not at all uncommon.
 
J.J
@forest Not yet.
 
ah
 
J.J
I briefly looked at the comments, I'm shifting between work & procrastination.
heh.
4 parts!?
You cannot expect that much reading of me, I have the same level of focus as a Squirrel.
 
5 parts, really
 
J.J
Good point, hah.
I'll have to save this for later, it's too early for me to concentrate on such a thing.
I have horrible focus in the mornings, that's why I usually spend them in here talking s*it with @forest :p
 
10:01 AM
@J.J It's actually pretty interesting. I found myself hooked.
Mostly because I wanted to know how bad the vuln was. :D
It's always amusing seeing how these pathetic companies focus on the bottom line.
 
J.J
10:15 AM
@forest Heh, I'll give it a read later.
I think I have to go to a customer site now.
sigh
 
J.J
10:26 AM
Saved!
Customer will do it themselves over the phone.
 
lol
Man I just got kicked from Tavern on the Meta for saying that killing albinos in the name of alternative medicine, or beating wives in the name of religion is wrong. O_o
This is exactly why I need to spend time to figure out how the damn chat API works.
 
J.J
FeelsBadMan.jpg
 
There's always that one community which is like that, with moderators who never explain what is problematic until they kick or suspend you, and finally ban you for politely asking for clarification. At least I'm not attached to that room.
 
J.J
Bad moderators are everywhere Forest.
 
J.J
10:37 AM
???
 
@JourneymanGeek Hey I wasn't saying anything bad about you!
You're not one of the obnoxious ones. :P
 
J.J
^^ Nor was I.
 
I can see the slippery slope though
 
J.J
Really?
 
I still have a grudge over the guy who posted the babyeating picture....
 
J.J
10:38 AM
I don't see any slippery slope for having the opinion that bad moderators are everywhere.
 
Baby eating picture? O_o
 
J.J
In my experience there are a lot of bad moderators all over the Internet.
 
@J.J If this were IRC, I'd shut down the room for a week. lol
Well, I would have 5 years ago at least.
 
J.J
O.o
Why? :thinking:
 
@J.J well, on SE - especially these days, mods (and ROs) have a lot of responsibility
 
J.J
10:39 AM
@JourneymanGeek Doesn't mean there aren't some bad mods, does it?
 
one very important thing with tavern on the meta is, we're literally trying to turn it (back) into a place that people feel more welcome on...
@J.J they don't last long
 
@JourneymanGeek What about you? Do you think calling out a moderator who is explicitly promoting wife beating is out of line?
@JourneymanGeek That just makes it easier to troll. lol
 
J.J
I never thought I would see those words Forest.
"explicitly promoting wife beating"
Imagine that..
 
Well that's Islam.SE for you...
 
@forest so... out of context....
 
10:41 AM
@JourneymanGeek True, but it's more fun to put it that way.
 
I'd question your goals there. If you're trying to generate drama over what's on topic...
people are going to get irate
especially with, well the recent twitter drama still in the air
 
I only try to generate drama when I'm annoyed.
 
and then you get kicked
@J.J the ro on question is someone who typically is a lot more patient than I am lol
 
That's why I still need to find out how to work the chat API. >_>
 
@forest there's no chat API
its basically a series of terrible hacks
 
10:43 AM
test
Oh god you're right.
 
(there's a few, reverse engineered libraries... but one of the popular bots literally is a JS userscript that runs on a browser)
 
ewww
I made an IRC spambot with just GNU Awk once. :P
Since IRC is so damn simple.
 
There's a fairly popular python one...
@forest two things.
Rate Limiting
 
J.J
@JourneymanGeek RO?
 
I sometimes hit that manually
 
10:45 AM
Well obviously an IRC bot is going to make concurrent connections.
 
@J.J room owner. Not a proper mod. Think of it as an IRC oper vs an admin...
 
J.J
coughs
 
ROs have limited powers in a room, Mods have real ultimate power (TM)
 
J.J
I don't know what those things are. I don't use IRC.
 
.... get off my lawn, what are you 17 18? ;p
 
J.J
10:46 AM
I see.
 
@JourneymanGeek If you're hitting it manually, you need to configure delays in your IRC client. Otherwise it's too easy to get kicked when you paste like 4 lines.
@J.J Think: a text chat protocol so simple that you could use telnet for it.
 
J.J
@JourneymanGeek I wish I was still 17.
 
@forest I THINK the rate limiting here scales, but I'm not sure
 
@JourneymanGeek It does.
 
J.J
@forest Oh I know what IRC is :D
 
10:46 AM
also its a sure way to get yourself suspended for like forever.
 
J.J
But, I don't know the terms like "oper"
 
I mean if I were to ever spam a place like this, I'd have to use a lot more than just 5 or 10 bots lmao. Not that I plan on doing that, of course.
 
J.J
:p
 
@J.J I tried not to say cinnabon ;p
 
@J.J IRCop, someone who's basically a god on IRC. They have access to OperServ which lets them kline (ban) people from the whole network, not just a single channel. There's op, ircop, and sysadmin. A regular op can only kick from their own channels.
 
10:47 AM
an operator basically has power over a room.
 
J.J
I see.
Kids nowadays, we use Discord :p
Heh.
 
a admin has power over a server, though practically those things are not actually managed by the server...
cause IRC is strange and the basic server has no high level moderation tools
 
The fun thing about spamming IRC is that you can highlight everyone's name, basically like @pinging every single person at once, instead of just one.
 
you literally run bots with admin level powers for everything
 
J.J
Damn that must be annoying. @forest
 
10:48 AM
#thatsthepoint
 
It can be. Some servers get more spam than others. Some rooms, too.
 
J.J
That's the one thing I hate about Discord.
PINGS.
I only like getting pings from certain people :p
 
and good chat steals and builds on IRC ;p
 
J.J
Discord is literally just fancy IRC.
 
I personally think matrix is the new IRC
 
J.J
10:49 AM
With voice channels.
 
I did that once to a room I got banned from cuz the op was a bigot, and flooded them with links to <insert horrible thing published by some Mexican cartel here> for a couple of weeks. Even got one person to vomit (supposedly).
And the crazy thing about IRC is there's really nothing you can do about it.
It's very, very open. All you need is a few hundred proxy that's not on DNSRBL.
 
J.J
@JourneymanGeek You don't have to use the voice channels, but the options are there.
 
@forest IRC was designed for a more innocent time
 
J.J
Think Skype + IRC + TeamSpeak.
That's Discord.
 
10:50 AM
actually hence needing all the *servs
 
@JourneymanGeek Nowadays channels can only lock themselves with +R so only registered folks can enter, which just means bots have to register.
I miss the days when you could trigger a netsplit and rename yourself to NickServ. :(
 
J.J
Too many old people here.
I need to leave and come back in a few years...
 
lol
 
J.J
:p
 
Rizon is a nice server. Lots of anime. Also XDCC.
 
J.J
10:52 AM
I only really use Discord for three reasons nowadays.
 
Some IRC servers have retarded admins though. Undernet doesn't use TLS between their servers because "IRC is public anyway". O_o
 
J.J
I've been considering ditching it actually.
 
J.J
Hmm?
 
Yet another person posting shit that needed to be redacted.
 
J.J
10:54 AM
Oh right, yeah that happens all the time.
I've not used the site in so long now lmao. I really only use chat.
 
heh
 
J.J
Look at the flat line on my profile.
I think I'm dead.
 
rip
 
J.J
Honestly, there just haven't been any interesting questions.
And, I lost motivation to post answers on questions I can answer.
I lost motivation after posting this - security.stackexchange.com/questions/183418/…
And I think I actually got a lot of things wrong in that answer which makes me sad because I thought it was good.
 
11:17 AM
Lol apparently me apologizing if I had triggered some people is "playing innocent". Gotta love corrupt moderation.
 
J.J
lmao
Stop playing innocent Forest!
You know what you did...
Yes.. That's why I'm apologising you moron. :p
 
lol
I (think) rene thought I was advocating for wife beating when I had called out a moderator on another site for promoting it. So apparently I'm playing innocent by saying that's not at all what I had meant. :P
I'm 80% sure I'll get kicked again for correcting the mod's incorrect understanding.
 
J.J
lmao.
 
IRC is much more forgiving since you can troll the living fuck out of a room and not worry about getting banned from the network. IRCops even tell room owners/moderators to just ban the person and forget about it. :D
 
J.J
Heh. I've never enjoyed trolling all that much :p
 
11:24 AM
Oh man you've been missing out. It's so cathartic.
 
J.J
It just doesn't bring me any excitement.
I don't get it. :p
 
There's nothing like seeing a mod abuse their power and responding by knocking them off the network or getting them banned themselves.
Since on IRC, if you send too many queries to a specific person, it fills up the server receive queue and instead of you getting kicked, the recipient of the flood of messages gets kicked. IRC is so archaic that apparently that's logical. :D
 
J.J
Hah, that's quite funny actually lmao. What are your thoughts on NCC Group, Forest?
 
I don't know much about them, but I know they're an established organization.
 
J.J
Hmm.
 
11:27 AM
I don't think I have strong feelings about them one way or another.
 
J.J
Because I am in talks with a recruiter right now for when I pass this OSCP.
 
Aren't they the ones who came up with .secure?
 
J.J
And the company he works for are in a direct partnership with NCC Group.
And... Well, I know they're reputable.
It looks like a fantastic place to start in InfoSec.
 
It could very well be. According to Wikipedia they bought Fox-IT (which is decent).
 
J.J
So basically this recruiter said, when I pass my OSCP then to contact him and he can refer me to NCC Group.
Which is exciting! But the more I think about how close I am to buying the PWK materials, the more nervous I get :p
 
11:30 AM
:P
 
J.J
I feel like you could probably sit the OSCP exam no problems Forest.
Well, I know you're not a pen tester but.
Anyway, my plan is to take the OSCP - then have a few months of no certifications so I can really get my teeth into Crypto!
Then back on the certification train with the OSCE.
 
I dunno, a lot of OSCP stuff deals with things I'm not familiar in.
Web exploitation and database exploitation, in particular.
 
J.J
Ah, I see.
Honestly, as much as I love the OSCP material I cannot wait until I have my certification break.
I have been wanting to sit down and really get into Crypto for the longest time ever, but because I don't have much experience in IT I really needed the certs to get me in the door.
So once I pass this OSCP I am going to for sure sink my teeth into Crypto.
I'm going to order Bruce Scheiners books: Applied Cryptography & Cryptography Engineering.
I've got a book called "Introduction to Mathematical Cryptography" I think I might sit Dan Boneh's OU Crypto course.
And I've got the Cristof Paar lectures too.
 
That's not a bad idea, though it is a bit dated.
The core ideas are still solid, but some specifics like antiquated modes of operation and no mention of true authenticated crypto makes it less useful for practical stuff.
 
J.J
Even if I never, ever, ever work in Crypto. It fascinates me so much.
Honestly, I don't think I'm academic enough/intelligent enough to work in Crypto even if I wanted to. But I really do want to learn it.
 
11:37 AM
It's extremely valuable to know how it works, even if you aren't going to become a cryptographer. It's valuable to infosec in general.
 
J.J
Yeah.
Not only that but not many people can truly say they understand it & it's just fascinating.
 
Indeed
 
J.J
It's so fascinating how numbers are so powerful. I'm really not an academic kid, I hated Maths, I hated English, I hated Science but I love computers, it, networking, security.
And even though Crypto is a pretty academic subject, something about it makes me so interested heh.
I really don't understand a lot of the math.
I really struggle with math a lot.
But, it doesn't stop me from trying to understand the math, I'm still trying to get my head around Padding Oracle Attacks, heh.
And I had to watch Cristof Paars lecture on DES a couple times.
 
@J.J I know a lot of people who joined them and they have very good things to say about them
 
It's better than a lot of alternatives.
 
J.J
11:45 AM
@RoryAlsop Hah, that's good to hear.
I thought so.
 
Google is also like that in that regard, very up to date on security.
I mean Google is fucked up, but at least they don't have huge government contracts for "intelligence" bullshit, not like some other big companies.
Or the ones who suck up all the good researchers and force them to keep quiet about their discoveries (cough Apple cough).
 
Happy belated birthday @Arminius !
 
 
8 hours later…
8:09 PM
@J.J You should post your virtual firewall story to r/TFTS.
 

« first day (2891 days earlier)