The DMZ

12:20 AM

@lynks BLUE ON BLACK?

oh well, I shouldn't have been using firefox. w3m ftw

12:32 AM

@Iszi You got a BSides coming your way.

1 hour later…

1:58 AM

evening gentlemen

Iszi

2:08 AM

@ScottPack Wah?

Go to securitybsides.com and search for your city

1 hour later…

Iszi

3:19 AM

@ScottPack Oh, spiffy! And it's free, eh? Can't beat that with a stick. Anyone we know coming?

(Currently, the Speakers page seems rather non-specific in that regard.)

The old wiki site seems to suggest that TOOOL is coming.

3:36 AM

In my experience BSides are notoriously last minute arranged. The CFP for CLE2012 closed 30 days before the event.

Same with yours it looks like.

9 hours later…

12:14 PM

@ScottPack Generally depends on who organises it. Often they aim to close the CfP earlier, but people wait until last minute and they end up extending the deadline.

Terry Chia

12:58 PM

Damn you USA! theverge.com/2013/1/11/3867924/…

That official response is really amusing though.

1:14 PM

@Polynomial Sure, all things change when you're dealing with something as nebulous as the BSides conferences.

Aaron Swartz killed himself :(

tech.mit.edu/V132/N61/swartz.html

@Polynomial The few that I've looked at haven't actually extended CFP, they were posted with close dates only a month earlier than the conference.

@ScottPack then again that's pretty much normal for a con

That sucks. The ones I've put in for had their CFP close about 4-5 months ahead.

Terry Chia

> If you do pursue a career in a science, technology, engineering or math-related field, the Force will be with us! Remember, the Death Star's power to destroy a planet, or even a whole star system, is insignificant next to the power of the Force.

> Even though the United States doesn't have anything that can do the Kessel Run in less than 12 parsecs, we've got two spacecraft leaving the Solar System and we're building a probe that will fly to the exterior layers of the Sun.

1 hour later…

2:40 PM

Bah, why is SmashTheStack always down? :[

@Polynomial erm...it keeps getting its stack smashed?

@RoryAlsop kekeke

@RoryAlsop Terrible. Just terrible.

@ScottPack Hey - its the weekend

and I was paying too much attention to this:

►

You people keep claiming that you speak English. I call shenanigans.

Terry Chia

2:54 PM

@RoryAlsop Aren't they a little young for you? ;)

@TerryChia That's the great thing about college girls. You keep getting older, but they stay the same age.

1 hour later…

4:00 PM

@ScottPack Hey, there's one schedule for Quebec City on May 31st. I'll have to look that up.

@Thomas It is more of a conference framework, do quality and structure may vary wildly, but it's worth supporting nonetheless.

The idea is that it's community run/organized which generally makes something feel a bit more approachable and congenial.

C. Ross

4:49 PM

Security folk: Any idea what this DHS Advisory for disabling Java is about?

Ah, found the details on CERT: TA13-010A

5:26 PM

For a banking site, I must choose a password that is exactly 7 or 8 alphanumeric characters.

5:44 PM

oh, they have optional 2fa. For a fee. And it also activates some kind of mobile access (I can't find any technical details), which makes me doubt it would improve security.

5:55 PM

It's just online banking, you don't need high security for that

Login to online banking doesn't matter that much. It protects your privacy, but isn't enough to transfer money. TANs are the main security mechanism

@CodesInChaos no, I can transfer money out of my account with this access

there's a limit on the amount if it's not a whitelisted beneficiary, but still...

6:11 PM

Currently my ban sends me an SMS containing the amount and target of the transfer and a token that's only valid for this transaction. Which I then enter on my PC.

27 mins ago, by Gilles

oh, they have optional 2fa. For a fee. And it also activates some kind of mobile access (I can't find any technical details), which makes me doubt it would improve security.

Before they introduced that, they had a paper list with 100 TANs

2 hours later…

8:14 PM

Does anyone know what the point is of this? facebook.com/photo.php?v=459812464076784 nsfw

@LucasKauffman Facebook? I never figured that out

the video

of self mutilation for their religion

taking it to the extreme where you cut open your own back

8:34 PM

@LucasKauffman ohhh dduuuudddee.. thats not cool.

you dont mark a link as nsfw unless it has boobs in it!

not gross internal organs!

@LucasKauffman Didnt @RoryAlsop just post a pic where he mutilated his own back, too...? ;-)

@Lucas Next thing you know they'll be pouring ink in the wounds.

Or committing ritualistic cannibalism. Crazy man. Crazy.

@ScottPack that was inspired. Loved it.

Which one? I also did a spoof of Gilbert and Sullivan yesterday.

Q: Should I be disabling Java?

@C.Ross There is now a Sec.SE question for it:

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely How serious is this "unspecified vulnerability"? Should all users be disabling Java until we know things have been patched?

@ThomasPornin the main problem with the tag synonym process, as I see it, is a lack of visiblity.

unless a mod is involved, it takes quite a bunch of votes, but nobody typically will see the call for a synonym in order to vote on it.

so, as was said - I recommend either a mod directly, or better yet a meta post.

8:41 PM

In that case, it was a request from somebody who wanted on SO (not SE) synonyms from sha-1 to sha1, and from sha-512 to sha512.

He asked me because I fulfilled the rep requirements for that.

The requirements are also set for SO levels, which mean that in practice only mods can reliably make a tag synonym.

@ScottPack dont think I got to gilbert and sullivan yet, I was talking about the modern major general logger.

@AviD That was it.

that was gilbert and sullivan...??

Wasn't it?

8:42 PM

@ScottPack reliably the key word.

@ScottPack might be, looking it up.

Yup.

huh. yeah, it was. Dint know that.

The Pirates of Penzance

The Pirates of Penzance; or, The Slave of Duty is a comic opera in two acts, with music by Arthur Sullivan and libretto by W. S. Gilbert. The opera's official premiere was at the Fifth Avenue Theatre in New York City on 31 December 1879, where the show was well received by both audiences and critics. Its London debut was on 3 April 1880, at the Opera Comique, where it ran for a very successful 363 performances, having already been playing successfully for over three months in New York. The story concerns Frederic, who, having completed his 21st year, is released from his appr...

Major-General's Song

I Am the Very Model of a Modern Major-General (often referred to as the Major-General's Song or Modern Major-General's Song) is a patter song from Gilbert and Sullivan's 1879 comic opera The Pirates of Penzance. It is perhaps the most famous song in Gilbert and Sullivan's operas. It is sung by Major-General Stanley at his first entrance, towards the end of Act I. The song satirises the idea of the "modern" educated British Army officer of the latter 19th century. It is one of the most difficult patter songs to perform, due to the fast pace and tongue-twisting nature of the lyrics. The s...

dammit, ninjad.

They don't onebox mobile

8:44 PM

ftfy

@AviD Remember to never travel with Marcus

Danke

should watch that again. havent seen it since I was a kid.

long before I knew anything about gilbert OR sullivan...

I never have, but I think we're going to this evening.

heh

8:45 PM

The girl has watched Grease nearly every day. Time for a change.

hehehe

btw, I dont remember this, but wiki does:

Someday I'll be the first to get a Ph. D in 'Undeclared'.

@ScottPack you meant that the other way around right? (and sorry for the laaaaate reaction...)

@Iszi It's 1. parameter tampering 2. elevation of privileges

parameter tampering is the vector, and pretty generic at that. elevation of privileges is the target, or purpose. a subset of authorization flaw, as @RoryMcCune mentioned.

@Iszi that is total cluelessness. Tell them to read the wikipedia entry for XSS and CSRF, and try to explain where the connection is.

@JeffFerland sure there is: Backdoor. Or Magic parameter.

@RoryM when do you focus on the vector, and when on the target? (naming is a form of focus...)

9:03 PM

@ThomasPornin I'll see if I can convince a mod. Do you think sha256 and sha512 should be folded into sha-2? Care to answer meta.stackoverflow.com/questions/136389/… ?

@AviD yeah, but mine didn't hurt, nor was it inspired by anything other than art :-)

@RoryAlsop and beer?

Beer was about 15 minutes after we finished the outlines :-)

10:00 PM

@AviD mebbe

1 hour later…