The DMZ

Terry Chia

12:30 AM

@RoryAlsop Shouldn't questions of those type be migrated here?

Scott Pack

2:20 AM

@RoryAlsop You fax the picture of the CC, right? I can't imagine how else it would be secure.

Stack Exchange

4:06 AM

Terry Chia

9:23 AM

Terry Chia

10:21 AM

Heh, my package from HakStore just came. Awesome.

Rory Alsop

11:02 AM

Pineapple?

Terry Chia

@RoryAlsop Yup, the pineapple and the lan tap. + a new usb wireless adapter.

Rory Alsop

So far I have seen no counter to your proposed 1st week topic for the competition so I think I'll make an executive decision and go with it. That will help people plan for the first week of Q&A :-)

Topic for week 1 - Social Engineering, People Management - the often-overlooked people-related side of security

Terry Chia

Great. Just to clarify, "post" refers to both questions and answers right?

Lucas Kauffman

@RoryAlsop we need to write an essay on that?

Terry Chia

@LucasKauffman Yeah, three thousand words. Due this time next week.

Font: Arial or Times New Roman size 12.

Rory Alsop

11:15 AM

@TerryChia yes

@TerryChia hahahahaha - no comic sans or you get negative points

2

Lucas Kauffman

I caught my father the other day writing an email to a client in comic sans, I told him I was very dissapointed

no in all seriousness

Rory Alsop

I was astonished when I learnt that comic sans is actually the most readable font for folks suffering from dyslexia

so there is a reason for it

Terry Chia

I actually like helvatica or calibri. Too bad my teachers have strict requirements when it comes to font.

Lucas Kauffman

11:29 AM

I prefer webdings

Rory Alsop

heh

Lucas Kauffman

11:58 AM

wait the topics every week are related to questions and tags on the site?

Terry Chia

@LucasKauffman we get to debate the weekly topic here.

Lucas Kauffman

yes

but what do we do with the topic?

and how can we earn "points" with it ?

Terry Chia

ask questions and answer related to that topic. i suppose they will track the questions and answers in the relevant tags?

Perhaps @RoryAlsop should include in the meta post exactly what tags will be considered.

Lucas Kauffman

that would indeed be good

Terry Chia

12:29 PM

I really need to find a local stores that sells good antennae. I can't afford to pay shipping from the US every time i need something.

Rory Alsop

@TerryChia yeah - I'll get a good look through the tags to do that

@LucasKauffman so, the level 1 stuff is to encourage new users and those under 2k, the level 2 and 3 will be on the particular topic each week

@TerryChia Aarthi and team can track all these things :-)

Lucas Kauffman

@RoryAlsop so can we post new questions and answers?

Scott Pack

I just use whatever font comes out of my TeX style.

These days Office defaults to Calibri, which is way easier on the eyes than Times New Roman.

Rory Alsop

@LucasKauffman absolutely, yes

I'm thinking I need to distil these points into the meta post, as I obviously haven't explained this fully :-)

Thomas Pornin

@ScottPack Garamond looks good. The default TeX/LaTeX font (Computer Modern Roman) is "technically perfect" but I find it too thin, especially for on-screen reading.

AviD

12:41 PM

oo, font preferences and fetishes. Sexy talk.

you guys wanna pull out a slide rule and compare each other's fonts and serifs?

Scott Pack

Sorry, I keep my slide rule at the office now. Don't have it with me.

@ThomasPornin I'm not sure I've tried to read it on a screen. I'll have to try that and see what happens.

Lucas Kauffman

mmmm time to create some questions and answers

Scott Pack

@AviD Did you hear about the ducklings in the park practicing their teenage girl faces?

Terry Chia

@LucasKauffman Remember to post it AFTER the competition starts.

AviD

@LucasKauffman No! wait till next week.

Scott Pack

12:43 PM

Shut up you guys!

AviD

@ScottPack lol

Terry Chia

@AviD ninja-ed

Lucas Kauffman

ofcourse I wait, I'm just going to put them in a txt so I can copy paste them

Scott Pack

There's a good lesson to be learned in premature posting.

Terry Chia

@ScottPack Any medication to fix that?

Rory Alsop

12:44 PM

folks - tags suitable for the 1st week topic are: people-management, social-engineering, professional-education, physical, career, ethics, user-education. Can we get a consensus on which we should state are involved? Just one would limit answers, so I'd prefer more than less

Scott Pack

@TerryChia I hear baseball works. I would have to defer to @M'vy as our resident expert.

AviD

@ScottPack premature posting usually goes along with the smaller fonts, but it can happen to anybody. Might be caused by stress.

Rory Alsop

<comms-room>

lol

Scott Pack

@RoryAlsop The first two are the obvious choices, I could see user-education working as well.

Terry Chia

@RoryAlsop people management, social-engineering, user-education are fine imo.

AviD

12:46 PM

@RoryAlsop very good. But it does look like 2 different subjects are conflated there, no?

people management|hacking

Terry Chia

professional-education, career not so much.

Scott Pack

I agree with @TerryChia's reiteration of my opinion. :)

Rory Alsop

if all present concur, then I think we have a reasonable consensus

@AviD yep - both relevant :-)

Hey @Isz - what say you to the above?

AviD

@RoryAlsop relevant, yes - but two very different topics. shouldnt we seperate them?

or are you seeing it as two sides of the same coin. -ish.

Rory Alsop

@AviD this ^

Iszi

12:51 PM

@RoryAlsop eh?

AviD

in that case, @Scott would be right about @TerryChia being right about @Scott being right.

Rory Alsop

how about professional education

@AviD I think you may be right there, about @Scottbeing right about @TerryChia being right about @Scott being right.

AviD

also ethics, probably should be removed too.

Terry Chia

@AviD right-ception

AviD

@RoryAlsop you're right.

Iszi

12:52 PM

Catching up. Social Engineering is a good topic to have. I don't think it quite gets enough coverage as it is.

AviD

what about physical?

Iszi

And, yes. Comic Sans needs to die in a fire...

AviD

it's not exactly social like the others, but it still feels like it should fit.

Terry Chia

@Iszi There is a time and place for it. Mostly in party invitations.

AviD

cuz it's not computers / technical.

Rory Alsop

12:53 PM

physical also doesn't get enough love, and is much more on the people end than all this IT security stuff

:-)

Scott Pack

I don't really buy Professional Education and Ethics as under the umbrella of Social Engineering/People Management.

Rory Alsop

agree on ethics probably coming out

Terry Chia

yeah. professional education and ethics probably doesn't fit.

Scott Pack

When I think of social engineering I tend to think of the user education component

AviD

@ScottPack it is under people management. part of careers.

Terry Chia

12:53 PM

damn, getting ninja-ed everywhere.

Scott Pack

Granted, security professionals may be in the user role there, but it's for them as a user more than them as a security professional.

@AviD Tiggers are wrong.

Rory Alsop

so, are we currently okay with social-engineering, people-management, physical and user-education

Iszi

@AviD I believe it's been long-debated as to whether or not physical is actually on topic here.

AviD

@Iszi some are, some arent.

Terry Chia

How does physical fit? I can't really see it.

Rory Alsop

12:55 PM

but should leave out ethics, career, and professional-education

@TerryChia fences, security guards, alarms

Iszi

@AviD Exactly. I'm a little concerned about bringing down the SNR by making it a highlighted topic.

Rory Alsop

CCTV

Iszi

@RoryAlsop Looks like a lot of people-centric stuff.

Scott Pack

@TerryChia What does all of our digital protections matter if the fire escape door into the DC is propped open?

Rory Alsop

@Iszi yep - topic for week one - peopley stuff

Iszi

12:55 PM

Might we want to change one or two out for more technical topics?

Scott Pack

@TerryChia A thorough pentest should include physical access as well.

AviD

@ScottPack some aspects of people-management, include having them work on their career, which necessitates professional-education.

Iszi

@RoryAlsop Oh, I thought that was for all four weeks.

Scott Pack

@AviD I'm sticking with my opinion of you being wrong.

Terry Chia

I mean. How does physical fit into the contest category?

Iszi

12:56 PM

My vote is social-engineering

Rory Alsop

no - sorry (I really am going to have to sort my wording in the meta post :-)

AviD

@ScottPack you'd be wrong about that.

Iszi

@TerryChia There are some physical security questions which are on-topic here.

Rory Alsop

for week 1 I am proposing that we measure these tags: social-engineering, people-management, physical and user-education

Scott Pack

@TerryChia One social engineering technique is getting someone to hold the door for you i fyou don't have an access badge.

Rory Alsop

12:57 PM

so it is a people week

AviD

@RoryAlsop thinks I'm wrong about you being wrong that I'm wrong.

Scott Pack

@AviD So's your face!

2

Iszi

@RoryAlsop Oh, we're hitting multiple tags every week?

Rory Alsop

for week two - well, what does everyone think? No rush :-)

@Iszi if appropriate, I don't see why not

Lucas Kauffman

physical security?

Rory Alsop

12:57 PM

in this week, yes, but for other weeks let's see what we decide@Iszi

@LucasKauffman yes

Iszi

@RoryAlsop Since there's a Wi-Fi Pineapple at the end of the rainbow, wi-fi and penetration-testing need to be in this month somewhere I think.

AviD

@Iszi one subject often has multiple tags.

Scott Pack

@LucasKauffman I do like that idea. I feel like we might need to pair it with something else just to make sure there's good enough coverage.

AviD

@ScottPack so youre saying, dont have physical this week, save it for its own week?

@ScottPack could pair it with all the space security questions.

Scott Pack

@AviD Some aspects of physical could fit into social engineering, so I think those would work here.

Iszi

12:59 PM

@AviD Oh, no. Please don't make it its own week.

Lucas Kauffman

@AviD I want the cavity tag

Iszi

@AviD You mean like "hacking a satellite"?

Rory Alsop

@LucasKauffman yeeeek

@Iszi and hacking Curiosity

Lucas Kauffman

how does one do the tag thingy again <.<

Scott Pack

@LucasKauffman You want a tag: after the first [ and before the word

AviD

1:00 PM

@Iszi yes. and I didnt suggest it, @scott and @Lucas did.

Iszi

@LucasKauffman [tag:tag-name]

Rory Alsop

like that

Lucas Kauffman

aaah

ty ^^

Scott Pack

What's awesome, is that it also autolinks off to that tag on sec.se

Even if the tag doesn't exist

AviD

@ScottPack we have a cavity tag...??

Terry Chia

1:00 PM

Chat flood.

Iszi

Hehe... 404

Scott Pack

I should go through and tag some of my select answers with hawtness

Rory Alsop

personally I think Physical fits with these other three to give us 4 reasonably associated tags for week one

Scott Pack

So we are getting physical this week?

AviD

@RoryAlsop I agree - dont think we have enough physical for a whole week.

Terry Chia

1:02 PM

I agree with the 4 tags @RoryAlsop mentioned.

Scott Pack

Iszi

I'm Iszi, and I approve those tags.

AviD

@TerryChia I agree with @terry about agreeing with @rory.

Terry Chia

@AviD I agree with the idea of @AviD agreeing with me agreeing with @RoryAlsop

This could go on forever.

Scott Pack

I agree with @Iszi about agreeing with @TerryChia about agreeing with @RoryAlsop, but I don't agree with anything that communist agitator @AviD says.

3

AviD

1:04 PM

@ScottPack Even if what I said was, I agree with @scott?

what're you, Captain Kirk?

Scott Pack

Take your strawman somewhere else.

Iszi

BRB Rebooting for updates.

Terry Chia

Damn, this has gone off topic fast.

Scott Pack

That one tends to do that to us.

Rory Alsop

it isn't any of topic#1, topic#2, topic#3 or topic#4

Scott Pack

1:05 PM

On the plus side, I think we came to a quorum.

@AviD Just for you big boy. (inlining so I don't spam out the screen again) i3.kym-cdn.com/entries/icons/original/000/001/569/…

5

AviD

@ScottPack no, I think you need 4 more people for a quorum.

Scott Pack

So say we all.

Rory Alsop

@AviD wouldn't that be an octum?

Scott Pack

@AviD Do be totally pedantic, Robert's defines a quorum as the minimum number of persons necessary to decide on a topic. It doesn't actually define how many that is. The specific number is left as an exercise to the reader.

AviD

@RoryAlsop hmm. for some reason, I had in my head that you need at least 10 for a quorum.

Rory Alsop

1:07 PM

yay - just got my Crypto yearling badge

Scott Pack

@AviD So unless we've formally declared, in our bylaws, what our number for a quorum is I was going with an incorrect, albeit common, use of the word meaning agreement.

Quorum

A quorum is the minimum number of members of a deliberative assembly (a body that uses parliamentary procedure, such as a legislature) necessary to conduct the business of that group. According to Robert's Rules of Order Newly Revised, Tenth Edition, the "requirement for a quorum is protection against totally unrepresentative action in the name of the body by an unduly small number of persons." The term quorum is from a Middle English wording of the commission formerly issued to justices of the peace, derived from Latin quorum, "of whom", genitive plural of qui = "who". As a result, quor...

AviD

@ScottPack no no, you are correct.

Scott Pack

@Iszi. For the love of god, don't click on that.

@AviD GGRRR!!!

AviD

I realized why - note the see also portion in en.wikipedia.org/wiki/Quorum#See_also.

Scott Pack

Oh, that. I'm an 'Mercin, I don't care bout such things.

Rory Alsop

1:09 PM

@ScottPack I always thought that was spelt with a 'k'

:-)

AviD

@ScottPack well, thats what happens when words are ambiguously overridden.

Rory Alsop

hiding the nawty bits: en.wikipedia.org/wiki/Merkin

Scott Pack

@RoryAlsop You just proved yourself an outsider by knowing how to spell.

Rory Alsop

heh

AviD

aaaaand we're back to topic#3 ;-)

Rory Alsop

1:11 PM

ooh - how to I inline that to protect folks from the NSFW nature of a pink Merkin

Iszi

@ScottPack Click on what?

Oh, right... Wiki

Scott Pack

yeah

Iszi

@RoryAlsop Dude, WTF?

2

Scott Pack

I'm just lookin' out for you, brah.

AviD

@Iszi the last wiki is okay for clicking.

Iszi

1:12 PM

@AviD Is it not Wednesday for anyone else?

Scott Pack

Wiki Wednesday?

Iszi

@ScottPack No, as in I'm-at-work-Wednesday

Terry Chia

This has gone SOOOOOOOO off track.

Scott Pack

You only work on Wednesday? And I thought being a state worker was nice.

Iszi

It's like the fracking Comms Room in here all of a sudden.

AviD

1:13 PM

@TerryChia welcome to the real DMZ.

Iszi

@RoryAlsop Inline what? You mean, just make it a link? Put any text before it.

AviD

and @ScottPack is going to blame it on me.

Terry Chia

@AviD Commie.

Rory Alsop

@Iszi ahh - thanks. Thought it was more complicated

Scott Pack

@AviD Pinko commie.

Rory Alsop

1:14 PM

@AviD pretty sure that was a meme for a while

Scott Pack

So while doing research for some of those memes I got to read about what we used to be like.

AviD

@RoryAlsop I thought @Iszi was the scapegoat?

Iszi

@ScottPack This should be interesting.

Scott Pack

I also came across a fair amount of drunken, spastic conversations.

Iszi

@AviD ...of questionable gender, no less.

AviD

1:15 PM

@ScottPack like this one?

yknow, mebbe it really is all my fault.

Iszi

@ScottPack New backronym: DMZ = Drunk Men Zone

Scott Pack

Mostly, except a little more disjointed because of the drunks.

Terry Chia

@Iszi Hey, I'm totally sober.

Scott Pack

I did see where I was badgering @RoryAlsop into trying some Blanton's. Were you ever able to find any?

Rory Alsop

@Iszi I haven't DMZ'ed while drunk in quite a while

2

@ScottPack no - I think I know a shop that will get me some though

Scott Pack

1:17 PM

I need to get me some more distillates.

AviD

I think Pwc doesnt let you work drunk.

not like EY.

Terry Chia

You guys are bad influences. I'm not technically at the legal age for drinking yet.

Scott Pack

@TerryChia I don't think Lucas is either.

Terry Chia

His 22 according to his bio.

Scott Pack

Kids today.

AviD

1:21 PM

@TerryChia you are, here.

ah, no, oops - another couple years.

Scott Pack

@AviD Depends on the country. We're one of those backwards places that sit at 21, I think most are 18.

So is Israel also silly about that?

Terry Chia

I'm 17. So 18 or 21 doesn't matter. Either way i'm too young.

AviD

@ScottPack actually I'm not sure. think it might be 19, yknow, just to be different.

Scott Pack

@AviD 18 and 3/4?

Terry Chia

Going to security conferences has been a real eye opener to how much people in the industry actually drinks.

AviD

1:23 PM

but its probably 18 or 21.

Scott Pack

@AviD I'll bet you guys are on a half timezone too aren't you?

Rory Alsop

@TerryChia Heh - so I have been drinking legally for more years than you have been alive. I like that :-)

AviD

@ScottPack heh, no.

Scott Pack

@RoryAlsop Gramps

2

Rory Alsop

ayup

that's me sitting on the back porch, sipping my soup through a straw]

Terry Chia

1:25 PM

Soup? Is that a new synonym for alcohol?

AviD

@RoryAlsop no big deal, so have I. I think.

they didnt used to enforce it very strongly here. I think thats changed since then.

@TerryChia heh, let's make this vegetable soup irish.

Scott Pack

I've had a beard longer than @Terry's been alive, but not legally drinking.

AviD

having a beard helps you drink illegally, they dont tend to ask your age with one.

@TerryChia dont take that as advice.

Rory Alsop

Grow ALL the beards

Scott Pack

/me is afraid of finding out what his chin actually looks like

Iszi

1:28 PM

@ScottPack Hasn't @RoryAlsop's age been a bit of a trope for some time also?

Terry Chia

@RoryAlsop How many beards can you grow at one go? I'm real curious.

Rory Alsop

Scott Pack

@Iszi I suspect he is the oldest member of the community. Well, besides Neal but I think we scared him off with all of our off-topic banter. :(

That is a creepy picture.

Rory Alsop

@TerryChia well, you saw the Merkin link... so that's two for a start :-)

actually in my case, I grow a really rubbish beard and end up looking like a scruffy pimp pirate

Scott Pack

Hence the soul patch?

Rory Alsop

1:31 PM

yep

Iszi

@RoryAlsop Image not found here.

Argh! Dunno how I ended up on TV Tropes, but... stepping away...

@RoryAlsop Fascinating. On my home PC, it just shows a link titled "user image".

Scott Pack

I got an image not found, but the link worked. I blame hotlinking

Rory Alsop

@Iszi how weird

Iszi

@ScottPack Oh hey, you're right. It did.

Rory Alsop

@ScottPack yeah - probably some mechanism doesn't like people to link to it from outside the domain

Scott Pack

1:36 PM

Oh, @RoryAlsop, did I tell you that Madilyn has been requesting to listen to Queen on the drive home from school? I'm rather proud of that one.

Terry Chia

I never really liked Queen.

Iszi

@ScottPack I'm not sure why, but I seem to regularly forget that some of my Internet peeps have kids too - and then, subsequently have a hard time picturing them as parents.

AviD

@Iszi several decades, in fact.

@RoryAlsop as opposed to a clean-shaven pimp pirate....?

Rory Alsop

@ScottPack excellent - that's solid drums, epic vocals and some game changing guitar right there. As long as you keep her grounded with some Metaltech, all will be well with the world :-)

@AviD well, duh - obviously :-)

Scott Pack

@RoryAlsop I'm trying to instil good musical morals. Metaltech is still a bit loud and raucous for her tastes so I'm keeping it in reserve.

Terry Chia

1:45 PM

@ScottPack punk rock. Nuff' said.

Rory Alsop

@ScottPack ahhhhh - morals

I remember them

Scott Pack

@TerryChia I'll probably introduce some Ramones and The Clash later. Grunge was the music my youth. So thanks to the punk of the time I developed an irrational aversion to the genre as a whole.

AviD

have a good night fellows - gotta go to a family bbq.

Iszi

@ScottPack Yeah, I think I'll wait a few years before my daughter hears "Do You Wanna Get Wasted?".

Rory Alsop

@AviD enjoy - eat all the animals

Terry Chia

1:49 PM

@ScottPack Hah, I'm more a fan of pop punk. blink182 and the likes.

Scott Pack

@AviD Enjoy your smoked pork!

Terry Chia

@AviD what rory said.

Rory Alsop

@ScottPack Ramones, Clash, Buzzcocks, Nirvana, Soundgarden, Faith No More - all good

who needs genres - those guys were all tapping into a particular feeling at that time

Scott Pack

@TerryChia Yeah, those guys. :) Them, Offspring, Greenday.... That was the punk of my formative years.

@RoryAlsop No doubt.

Rory Alsop

@ScottPack ahh - Offspring and Greenday. I had a cassette tape (you guys remember them, right) with Dookie and Smash

Scott Pack

1:50 PM

Well, as in the words, not the band.

Rory Alsop

@ScottPack She was a sweet thing wasn't she?

Gwen

bit mental, but not as much as Madonna or Gaga

Terry Chia

Happy Holidays, You Bastard is the perfect song for instilling good morals. Sarcasm intended.

Rory Alsop

@TerryChia I always liked 'Bad Habit' by Offspring as a happy driving song

Terry Chia

@RoryAlsop I still listen to Dookie regularly on my iphone.

Dammit by blink182 has got to be my favourite song.

Scott Pack

I think the last cassette I bought was Sabbath Bloody Sabbath.

@RoryAlsop Uncontested. The music was relatively empty, but fun.

Rory Alsop

1:52 PM

No topping that!

Terry Chia

I love Jimmy Eat World. Amazing band really.

Rory Alsop

well, we're playing a gig on Sat - the first Scottish Industrial Fest - the other bands are very industrial, us not so much - but we hope it'll be fun. I found out though that a guy from my school is in Cradle of Filth - a bit heavy for me, but that's pretty awesome!

@TerryChia yeah - I really like their influences from just about every genre

Terry Chia

@RoryAlsop Clarity has got to be one of the best albums of all times. I don't really like their 2 latest albums as much though.

Rory Alsop

Quick ontopic - Any ideas what happened on 30 July? - just had a look at the new user numbers and there was a big spike that day. 19 July had a good surge too.

Terry Chia

Perhaps this question?

84

A: "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?

If a malicious user starts attacking a website by guessing common username/password combinations like admin/admin, the attacker would know that the username is valid is it returns a message of "Password invalid" instead of "Username or password invalid". If an attacker knows the username is vali...

Transcript for