The DMZ - 2013-12-30 (page 1 of 2)

« first day (1110 days earlier) ← previous day next day → last day (3791 days later) »

12:00 AM

Man flu is a pejoratively used phrase that refers to the idea that men, when they have a cold, exaggerate and claim they have the flu. Whilst a commonly used phrase in the UK and Ireland, it is referred to in other cultures and there is a continuing discussion over the scientific basis for the phrase. Popular culture A web-based survey of readers of Nuts magazine in late 2006 stirred interest in this notion, which was criticised as unscientific and unreliable. It has been suggested that such exaggeration is possibly just as prevalent in women. This condition can only truly be called "ma...

wiki is wrong, man flu is real!

well, at least male scientist claim that to be true :)

there have tho been studies suggesting flu shots work better on women

independent.co.uk/life-style/health-and-families/health-news/…

Karthik Rangarajan

I can attest that men and women equally exaggerate and claim they have a flu based on my completely non scientific empirical studies.

2 hours later…

Karthik Rangarajan

1:44 AM

This has possibly been asked somewhere on SE, but I'll try my luck here - can anyone off the top of their head think of a tool that I can use to monitor all packets across my network, and save as pcap dump (or similar format)?

Can't Wireshark do that?

Karthik Rangarajan

I've never done actual network stuff before, and this is one of the things on my todo list. We've had a few people bruteforcing ldap and such, and want to come up with a way to figure out who did it after the fact.

we use ntop for network usage, so we have a machine that gets all packets.

@copy Wireshark was what I thought, but it needs to be something I can possibly script with.

Wireshark does have a CLI

If that's good enough for you

Karthik Rangarajan

tshark, yeah.

I've not done much research, thought I'd take the lazy way out and see if anyone has set up something similar :D

2:09 AM

@KarthikRangarajan snort?

Karthik Rangarajan

@TildalWave snort will only alert in case of attacks.

we want something that just monitors all the things.

@KarthikRangarajan wireshark then

Karthik Rangarajan

@TildalWave that's what it's looking like.

ah I see...

Karthik Rangarajan

I just need to figure out a way that I can automate the whole thing, delete pcap files based on date, and then somehow parse the whole thing into a GUI.,

Not at all ambitious, am I?

2:11 AM

wireshark.org/docs/wsug_html_chunked/ChCustCommandLine.html

would this do?

Karthik Rangarajan

@TildalWave yup, thanks, found this (and tshark) as well.

This would probably do in terms of raw capture.

now I just need to write a wrapper around it to do other things.

good luck :)

Karthik Rangarajan

though I am still blanking out on a web based GUI to review pcap dumps.

I'm a dev what do I know about using stuff?

Karthik Rangarajan

@TildalWave hahaha, a long running joke for me was that the only person who ever used the code I wrote was me.

the last few months in my previous job made that joke invalid

5 other people used it with varying degrees of success.

I've always sucked in writing UIs.

my Georgia Tech hackathon team went to a UI hackathon once. They had to create a whole new category to give us an award, because our UI looked like poop.

2:18 AM

When I think I'm gonna hate writing UIs I just ask the users what they'd like. They never agree on anything anyway.

Karthik Rangarajan

because he wasn't getting a result from his search term

The worst part of the last job was getting calls from my manager at 7.45 in the morning going "Well your code doesn't work!"

turns out the dataset didn't HAVE that search term

Almost told him "The problem exists between the keyboard and chair" but I stopped myself.

@KarthikRangarajan That's why I always display parsed query too in search results, some folks just can't believe there simply isn't something there

Karthik Rangarajan

this was my first real UI, and I wrote the whole thing without using stuff like Bootstrap

It was clunky and I have no idea how/why it worked, but it did.

well it's not so much a job of the frontend, the app has to send back the parsed query how it uses it internally to query the database, frontend just displays it (or not)

and it's crapload of work to display it in readable form too

Karthik Rangarajan

yeah, I was dealing with far too much data.

think an aggregation of twitter, dump sites, IRC data from a gazillion and one channels...

Oh, and for some reason, we weren't using an intelligent mechanism like Lucene for full text searching. Oh no, we used SQL Server for that.

Blew my mind when it was proposed, and any opinion I presented was ignored completely in favor of "its a Microsoft technology!"

2:31 AM

you'd be surprised how often I use spatial indexes for such data simply because they're by far the most optimized for range search performance in database engines that I have licences for

it sometimes takes a whole night to process indexes but once it's done it's lightspeed

Karthik Rangarajan

@TildalWave that was the argument our SQL Server guru made, and it was convincing when the dataset hadn't hit 50 million rows.

Though we didn't have a real server, we had a VM with 16GB of RAM, and unknown number of cores.

Well, they're really useful but tricky to program for if you're not used to a bit different approach that they require. For example, you'll have really slow write performance if you have the indexes active, so you'd want to first disable them on bulk transactions, then re-enable back

and querying is completely different too, but I worked with GIS a lot back in the days so I'm used to it

Karthik Rangarajan

ah yes, that was another problem - we had to have continuous writing capabilities.

it wasn't a very well thought out system.

it was more of a "let's sell this to the customer and then think of how to build it" problem.

huh I might be wrong, but I get the feeling I might have met @AviD (if he has ever consulted in the US that is)

You can have both but you either won't be able to include new updates in your queries, or they'll be really slow... if you can juggle your bottlenecks with some skill, nobody will notice really... there's always 99% of the time when users play solitaire that you can run such cron jobs

Karthik Rangarajan

well I hope they somehow solve that problem. I did try to improve it as much as I could before I left, but there's only so much you can do.

3:05 AM

@KarthikRangarajan

Karthik Rangarajan

3:30 AM

@Ethan?

nvm

sorry

2 hours later…

5:03 AM

The weak twin primes conjecture states that there are infinitely many pairs of primes. The strong twin primes conjecture states that every prime p has a twin prime (p+2), although (p+2) may not look prime at first. The tautological prime conjecture states that the tautological prime conjecture is true.

Karthik Rangarajan

5:15 AM

Watching the 1995 historical documentary, Hackers.

5:30 AM

I think everything I said here was right, but can I get a fact-check anyway?

0

A: NX bit: does it protect the stack?

By marking the stack as non-execute, you effectively prevent code inserted into the stack from running. You're not protecting the stack from modification; rather, you're causing a hard crash when the code attempts to jump to a position in the NX-marked stack. The workaround is to not attempt to ...

Low-level stuff isn't where I spend most of my time

2 hours later…

7:32 AM

@KarthikRangarajan except for mothers. Mothers are never sick in any way.

Karthik Rangarajan

@AviD and if they are, they pretend that they are okay

exactly.

Karthik Rangarajan

also, @AviD, I get the feeling we may have met before.

I worked with an Avi when I was an intern

for this guy you may now. Ariel Silverstone.

I thought so too! In Atlanta?

ha! I thought that was you!

Karthik Rangarajan

Yes! That travel company!

Hah, it is you!

Nice to find you on the Internet!

7:33 AM

hehe, small world.

@KarthikRangarajan Indeed. glad to see you didnt get stuck there. :-)

Karthik Rangarajan

heh, they invited me back after I graduated. I declined,

I have to tell you though, I learned a few things about code review from you when you were there, though it was supposed to be me doing a knowledge transfer.

heh, imagine that, an intern doing a knowledge transfer

@KarthikRangarajan ha, if you would have mentioned georgia tech sooner, I might have connected the dots.

Karthik Rangarajan

heh yeah, I figured it out only after I saw your LinkedIn profile.

@KarthikRangarajan hehe, never heard of that before.

Karthik Rangarajan

And I wasn't sure even then because I didn't see the company that I thought you worked for then.

7:36 AM

btw after "we" replaced you, that "position" got bigger. Much bigger.

Karthik Rangarajan

ah really? Did it get better?

@KarthikRangarajan yeah, I was freelancing / subcontractor.

@KarthikRangarajan well.... a little bit. It got a lot better, for a short while, but it didnt last.

Karthik Rangarajan

Ah that makes sense. I still don't understand why Ariel didn't go local and hire someone from Veracode or Fortify to do the job, but then, when was Ariel ever normal.

the code quality was too poor.

Karthik Rangarajan

I still remember the brazilian steak house where you drank beer and I drank water.

7:37 AM

@KarthikRangarajan umm, because they were more expensive? Even with travel expenses.

@KarthikRangarajan oh dammit, that was torture.

Karthik Rangarajan

Oh Veracode/Fortify was more expensive? Hm, I did not know that.

eventually we did start doing it mostly remote, so we saved on some expenses there too.

Karthik Rangarajan

Well I had put in some effort into cleaning up the workflow

and then, after repeatedly training numerous folk for this - it was about full time and a half, for a couple years - they moved it in house, somehow.

Karthik Rangarajan

though I heard later that Ariel was pissed that i had raised expectations for the SLA.

though the source I heard it from is highly unreliable.

Well all I remember about the internship was blasting through bad code, and the horrible time wasted at the brazilian steakhouse.

7:39 AM

@KarthikRangarajan yeah, we automated it a bit and formalized it a bunch, but then they had to keep getting exceptional approval. otherwise there still wouldnt be any new version.

Karthik Rangarajan

I graduated and went to Citrix. Lasted there for a very short time...they had absolutely no technical work for me.

And then the guy who used to do IR for Ariel asked me if I wanted to for this consulting company that got acquired by Dell.

@KarthikRangarajan who's that then?

whoa, penny just dropped. But I meant who is the guy?

Karthik Rangarajan

heh, don't think you met him. Rick.

@KarthikRangarajan actually, I think I did - at the Brazilian steakhouse.

Karthik Rangarajan

nah he wasn't there.

7:44 AM

okay, so I might be confused.

Karthik Rangarajan

He hated Ariel

was a long time ago....

Karthik Rangarajan

yup, a very long time ago.

@KarthikRangarajan seems he had that in common with many.

Karthik Rangarajan

hahaha, yes, he did.

7:45 AM

though some loved him - a couple of the guys went with him to Expedia.

Karthik Rangarajan

He called me once when I was working for the aforementioned company and went, in the typical Ariel way, "Karthik, I am big man now. I want to know about this virus. I know you work for this company. Find out what you can and let me know."

My response was "Ariel, here's the link to open a ticket. Thanks!"

haha, typical.

Karthik Rangarajan

Yeah, he was weird.

so it looks like Rick pulled in some other friends, SecureWorks and Security-Art supposedly had a big cooperation.

Karthik Rangarajan

They did?

There was something in the works but it never materialized.

or so I thought.

There were a couple of conversations with Youram and Ian Amit, but once Ian left I thought the conversation died.

7:50 AM

well, I was on the outside, so I have no idea how reliable my information is.

Karthik Rangarajan

wow every single one of my classmates/batchmates are getting married. I feel bad for them.

Ah, there you go.

@KarthikRangarajan heeeey, we love it here!

Karthik Rangarajan

@AviD well, I am speaking from the cynical point of view of someone who got out of a 7 year long relationship.

And was going to get married in about an year or so.

ah, you can empathize with @Simon then.

I'm sorry.

(sorry about what I said about @Simon....)

Karthik Rangarajan

hahahaha

yeah, I was wondering...but yeah, I am supposed to be all sad and mopey, but in my head, better now than 5 years down the line.

7:53 AM

yeah, I figure.

yknow, it is customary here, when someone gets divorced, to say to them "congratulations".

Karthik Rangarajan

The guy that came after you at the other company was pretty smart...but he was entirely too cocky for my taste.

Divorces suck though - you have to then start a new life from scratch, and its worse if you have kids.

I know a guy who's my age who's had two divorces now.

two.

and he married a third time.

Alright gotta go to work tomorrow, I'm going to try going to sleep.

@AviD nice finding you on the Internet after all this time, we should meet if you are at Defcon/BlackHat/$RandomConference in the USA.

@KarthikRangarajan dont remember which one that was, I trained a few of them.

@KarthikRangarajan absolutely!

Karthik Rangarajan

and this time, let's go to some place that's NOT a steakhouse, and where we can actually eat ;)

good morning gents, @simon

@KarthikRangarajan haha, yeah.

8:06 AM

aah I love it when I have to work during a holiday and then after an hour I can say "finished for the day"

user image

@LucasKauffman hmm, you've never actually been married, right....? ;-)

@AviD no not yet

maybe in a year or two

whoa, hold on there, I wasnt offering.

@AviD I wasn't going to ask you anyway

@AviD as you might have noticed I prefer boobies, (while it still could be that you have moobs, I prefer the female kind)

that's... disgusting.

and - no.

now go sit in the corner.

8:10 AM

@AviD I DON'T WANT TO

I HATE YOU

runs away

@AviD do you have holidays for xmass and new years eve? Or is that too christian to have official holidays?

nah, doesnt really exist in any formal way here.

many take a "sick day" (i.e. "hungover") on January 1st, and those of us working with overseas clients / colleagues have some more quiet time.

thats about it.

@AviD when do you celebrate new year then?

@LucasKauffman "celebrate"... what's to celebrate, I'm just another year closer to the grave!

or is it the same but nobody gets off regardless

besides, "New years" is such an arbitrary day... it's not like that day a whole year pops through.

8:15 AM

@AviD well I'm celebrating that!

@LucasKauffman haha, that I'm closer to the grave?

@AviD nope but it's an excuse to drink and party, and that's the most important part :p

Now you are also eyeing the moderator diamond....?

@AviD of course, that's why I want to get married, so that when you die within a few years I can have all of your moderator rights!

@LucasKauffman this, pretty much. On the other hand, we do have Rosh Hashana, the Jewish new year (usually around september or so), when everyone does have 2 1/2 days off...

@LucasKauffman since when do you need an excuse?

8:17 AM

@AviD fair point

2 hours later…

10:02 AM

@Simon as your nurse I declare you cannot be saved *injects with a poison* *turns off life support*

@Lucas - Scotland is special: we get the 1st and 2nd of January off as statutory public holidays. We also have whisky. The two may be somehow connected;-)

@kalina - is that just to make sure?

yes

I don't want him accidentally getting better

10:27 AM

@kalina this is @Simon we're talking about. I'm not sure the poison is necessary.

10:47 AM

I'd rather not take the chance

He might reappear when least expected

Anyone who's ever wanted to just drop LMGTFY or JFGI on an SO user might want to check out the newest tag over on Programming Puzzles & Code Golf...

Code-Trolling

@iszi - I like code trolling as a concept, but code golf mostly confuses me.

for the most part, both of those seem to me like focusing on the worst elements of coding.

Code golf is not good code, or smart code - it's crappy code, trying too damn hard to be clever. And you know what they say about writing code as clever as you can....

Having a site dedicated to code golf, is just playing with crap. Kind of like RateMyPoo.com.

And code golfers ostensibly shunning code trollers, is just like playing with more like. Like someone on RMP saying "Oh no, real ratemypooers only use a bucket, those trollers are using a toilet!"

</end scat talk for the week>

I really hope someone flags some of that.

11:05 AM

Hahahaaha

2 hours later…

1:33 PM

@AviD wow you're forming some strong opinion on something you just argued it doesn't matter

hehe

no, its not that I think it doesnt matter, I think code golfing is not where professional programmers should be.

e.g. if I see anything that looks like golf in a production system, I would fire the programmer, then rehire him and make him go sit with @Simon. Just for spite.

@AviD it's hard to have fun otherwise, if you have no life outside of binary, so you invent entertainment of your own... you know, this can be translated to pretty much any science there is, why would coders be any different?

@AviD So you'd rather be admin golfing with a code golfer than actually invite him/her for a game of golf? You see where I'm going?

anyway, I'm now mentally preparing for the pre-new year's shopping, it's not easy to decide what I'd like to get wasted on two days in advance

still, I'm a lot better off than this guy: theguardian.com/science/antarctica-live/video/2013/dec/30/…

1:59 PM

@TildalWave because the whole point of coding, is doing it right. And the whole point of code golf, as far as I can see it, is doing it just wrong enough.

@TildalWave actually, no clue.

@AviD you're a part of the problem :P

@TildalWave I assumed so...

So you know how when you're swamped, juggling several tasks and projects, all with a too-close deadline... and then all of a sudden one of the bigger projects has to wait for the client, so it's not your responsibility (at least not in that timeframe)?

Yeah, my day rocks.

I'm joking you know? I personally never really got the purpose of code golfing, it kinds reminds me of a cry for help

@TildalWave yeah, I can see that - programmers desperately trying to throw off the yoke of formality, and responsibility.

Like the Olympic gymnast, who just wants to swing around childlike, carefree, without having to live up to his coach's discipline....

like this:

2:49 PM

spiegel.de/international/world/…

After years of speculation that electronics can be accessed by intelligence agencies through a back door, an internal NSA catalog reveals that such methods already exist for numerous end-user devices.

3:25 PM

ohai guise!

OK I've seen Ali Ahmad added a community ad for 2014 for Cuckoo... but the image isn't 220x250 pix

So I made fast one that will be in the required size...

user image

how's this?

Sounds like a wiener!

the text is just from the Cuckoo website

Anyone uses it? I'm not helping promote some crap am I? LOL

Never heard of it.

I don't do malware analysis, though.

me neither, but I saw the ad placement so ...

4:27 PM

allo

I posted a quality question:

0

Q: What encryption is used on: NDN3h

I'm competing in a online decrypting challenge. The currently stuck on the 3th challenge. It gives you the code: NDN3h I've tried multiple decrpytors, but I can't get the right one. Im hoping someone here could help me. Regrards, Simon

5:09 PM

0

Q: How could disabling 'Hide File Extensions' in Windows make a system more secure?

I'm reading up on the Cryptolocker virus, and I came across this comment, it says: And one additional measure: disable the default "Hide extensions for known file types" check box in Explorer. I still consider this one of the stupidest moves MS ever made in Windows. The comment has 17 thumb...

hmm, I'm not sure what to make of the answer to that one. On the one hand, I agree with the answer in theory, but on the other hand, what user that didn't already turn off that stupid setting is going to have a clue what an extension even is

6:08 PM

1

Q: Stump the Chump with Auditd 02

As part of the continuing series of Linux system event auditing I need another spec to bang my head against. What I need is a brief spec indicating what you're trying to accomplish and anything you might think is relevant to your environment. I'll then do my best to build out a config to do it ...

discussion blog

Yay @Scott's philanthropy quest 2014 is here! Bring out your worst weapons :)

6:42 PM

@TildalWave Downvoted.

:P

actually, what the bleep is going on, I got 2 upvotes on some old answer today and it's not even the most upvoted one

7:01 PM

Crap on a cracker! When did inSSIDer stop being free?

And when did the Wikipedia fundraiser ads get so freaking huge?

@kalina pls b a poisonless nurse

1 hour later…

Karthik Rangarajan

8:12 PM

performing a full packet capture on a network 24/7 on a 50mbps network - good idea/bad idea?

@KarthikRangarajan Like adult diapers... Depends.

I presume you're talking about your home network?

Karthik Rangarajan

8:29 PM

@Iszi Nope. I am talking about an office.

@KarthikRangarajan Is consent to network and/or computer system monitoring part of the office's AUP?

Karthik Rangarajan

@Iszi Yes.

Legally we're allowed to do it. I am just wondering about the technical feasibility of doing it.

@KarthikRangarajan And by "full packet capture" do you mean to say full logging of all packets, or just monitoring and alerting?

Karthik Rangarajan

@Iszi full logging of packets.

Is the task I have written down.

However, my backup is setting up Snort for monitoring and alerting.

Completely unrelated question - is there a good website I can point users to where they can check for password strength? rumkin.com is fairly arbitrary and not very good.

@KarthikRangarajan You should not be pointing users to any website to check for password strength.

3

Passwords should only be entered into the system or application for which they're intended to be used.

@ScottPack Don't you run the IDS/IPS in your shop? Maybe help @KarthikRangarajan with regards to guidance on full packet capture and logging?

I don't personally have much experience, but I understand it probably takes some beefy hardware and even then it's hard to make sure that literally everything gets processed unless you want to introduce lag.

8:52 PM

@KarthikRangarajan It can be mathematically proven that no good "password strength checker" can actually exist.

Let alone as a Web site.

Moreover, training your users to enter their office password on Web sites may have... suboptimal side effects.

@KarthikRangarajan At full bandwidth, that's 540 GBytes per day. Heuristically it should be less -- but maybe not really less. Say, like 50 GB per day.

This can be stored, but searching it afterwards looks like a daunting task.

Karthik Rangarajan

@ThomasPornin that was my calculation, and that's why I asked if it is a good/bad idea.

It is a daunting task, and even if I remove packet captures or offload them to a different backup disk every night, searching through them is going to be a nightmare.

@Iszi yeah, I was going against my better judgement asking that question about password strength...I would personally never enter my password into any of those checkers, but there were some questions about it, so I was wondering if there was anything trusted/recommended.

@ThomasPornin re. the mathematical proof for password strength, thanks - based on my minimal research, I suspected that, but I couldn't be sure.

Thanks for helping me to not go against my better judgement @Iszi, @ThomasPornin! :)

@is do you remember the name of that site, along the lines of a password checker - "Is my password secure?" and no matter what you put in, it comes back right away with "NO! you just entered it in an untrusted site, you putz". Or something like that.

Karthik Rangarajan

hahaha I remember someone showing me that once.

9:14 PM

@AviD I think it got starred in here once.

@Iszi thats not saying much.

@Avi BTW I think you need at least three characters to ping.

hehe, oops. yes, 3 is the minimum. that was a typo.

Hah. I was Googling for that site and came across a question on our own.

9

Q: Is howsecureismypassword.net safe to use?

Is it safe to enter my real passwords to test them? I mean, are the entered passwords being recorded/transmitted to someone else?

@Iszi yeah, I went googling, found a lot of noteworthy crap, but not what I was looking for.

So. My teenage daughter just opened a Facebook account. Aside from the complete education re security and privacy, and the impending horrific waste of time - does anyone know of a facebook app that she can add, to grant me permission to see all her activity? (with her permission, of course).

other than MitM her browser, and echoing out her FB stream...

that actually wouldnt work with her anyway, she knows to check for the EV certificate, issuer, etc.

Karthik Rangarajan

9:24 PM

@AviD if it's a blanket app, it wouldn't be very hard to write one yourself...

Just ask for ALL THE PERMISSIONS.

@AviD ismytwitterpasswordsecure.com

4

@KarthikRangarajan yeah, I considered it, but I really dont want to get into learning the fb api, and besides I'm pretty lazy.

if there is nothing, I might consider it....

Karthik Rangarajan

@AviD gogostat.com/pg

That's what google tells me.

sometime

@TildalWave excellent.

Karthik Rangarajan

@TildalWave hah! That's going on my wiki page...

9:26 PM

no problem ;)

BTW I made NASA write a blog post today :)

so the day is good, me happy

@TildalWave Link?

@Iszi sdoisgo.blogspot.com/2013/12/…

@KarthikRangarajan that looks interesting. thanks.

Karthik Rangarajan

@TildalWave that's awesome. The only thing I've done today is make a dog poop.

@TildalWave "no"

9:27 PM

@KarthikRangarajan hehehe I don't wanna know, right?

Karthik Rangarajan

@TildalWave it involved putting him on a grassy surface and just standing and staring at him until he decided to poop.

It's hard taking care of injured living beings.

@TildalWave Right. And those bright lights dancing on the horizon are just swamp gas...

@KarthikRangarajan HOW DID YOU MAKE DOGPOOP???

@JeffFerland Hey Jeff, thanks for restoring control over your Twitter, those Russky posts didn't make much sense even with my rusty Cyrillic / Russian

@AviD WHY ARE YOU SO INTERESTED???

9:29 PM

@KarthikRangarajan oh, I see, that's a little different than the way I read it.

@Iszi cuz I've only ever made humanpoops.

Karthik Rangarajan

@AviD No, I did not manufacture dog poop, if that's what you're asking...

@TildalWave Yeah, I so rarely sign on there anymore... never even thought about the password being that old. Glad it didn't go to basically anything else I can think of.

@Iszi C'mon that's not even close. Gotta admit it's quite something to make NASA guys write about it. That's no swamp gas :P

hehe, okay, doh

Karthik Rangarajan

Though the dog did take a giant shit today. Must be all the cat food he ate.

9:30 PM

@AviD Smart kid

@AviD I'm not aware of anything like that, and I'm fairly sure that Facebook would cease & desist something like that if it did exist.

@JeffFerland yeah, I'm turning her into a proper ~~paranoid~~ security geek.

@JeffFerland really? it seems like a fantastic feature that should be built in.

like gmail has account delegating.

obviously with the user's permission...

@AviD facebook.com/help/156236274442491

Karthik Rangarajan

Didn't Facebook say something about parental monitoring of 13 yo Facebook users?

so who said anything about unauthorized access?

Karthik Rangarajan

@AviD One simple way to do it might be to set up Facebook on a spare mobile device as her.

I said spare because you never want to post something on her Facebook by mistake :P

9:43 PM

@KarthikRangarajan "mistake" ;-)

@KarthikRangarajan hmm, doesnt even need to be a mobile.... that is an interesting idea. I could easily setup a dedicated vm for this...

Karthik Rangarajan

"Daddy, why did you post on my Facebook wall saying you'll kill my boyfriend?" "Sorry honey, it was a mistake."

though it is a little more invasive than I was hoping for.

@KarthikRangarajan heh, first thing she did was share a post of mine saying basically that.

Karthik Rangarajan

@AviD yeah its not a nice option. Read only access would be much nicer.

user image

2

Karthik Rangarajan

but on the flipside, it helps you protect her against random stupid guys.

though I'm sure she can protect herself.

@AviD I saw that at a con once. I was wondering why, until I saw the guy walking around with his daughter.

9:48 PM

we actually had a facebook security expert come through here. Ex-cop, decided to go private to help with all the incidents of online abuse and etc. kind of a PI with a specific niche... He does a speaking tour, through the schools, for parents, etc. Brilliant.

Karthik Rangarajan

ah that's definitely nice of him. As long as he balances security versus usability.

i.e. he doesn't convince kids that Facebook is evil.

(even if it is)

0

A: What drove Neo to seek out knowledge of "The Matrix" and Morpheus?

Neo knows morpheus he is in the Dictionary morpheus is God of Dreams and trinity is Biblical figure and Neo is the one = GOD i think Neo is remaking the matrix as he see's fit so he can find Morpheus and trinity in the next version of the matrix as morpheus told him in Neo's room that the Oracle ...

Wait... WHAT?!

OK thanks to Physics.SE newsletter, I now know why I got two upvotes on some old answer re destroying hard disks

7

Q: Is aluminium magnetic?

From high school, I remember that Aluminium has 13 electrons and thus has an unpaired electron in the 3p shell. This should make Aluminium magnetic. However, the wiki page of Aluminium says its non-magnetic at one place(with a citation needed tag though) and at another place says it's paramagneti...

electromagnetism

Karthik Rangarajan

@Iszi hahahaha that was awesome. Aside from the fact that I got a headache reading a non punctuated blob of text.

Would this be on-topic here?

1

Q: Monitor BIOS activity

As I read today, Secret services are able to infect the BIOS of almost every computer using different methods. Is there a way to find out if this has happened on my Ubuntu notebook, for example monitoring the BIOS activity? Greetings

10:00 PM

@Seth Regarding that reply: You can't trust the checksum anymore if the Bios is infected

Hmm. I guess that would be true.

It's surely on topic on our site, but may have been answered before

Do you know of a dupe here?

Not specifically

:-/

10:08 PM

@Seth @copy security.stackexchange.com/questions/3786/…

Ah, that works. Thanks :)

@Iszi The last time I looked it was free for Windows and Android, but $15 for OSX. Is that not true anymore?

@KarthikRangarajan As @Iszi said I have a bit of experience with security monitoring, primarily around the data collection and IDS side. How may I service you today?

@TildalWave You'd be better off retweeting that instead of favoring it. More people will see that way.

10:25 PM

@KarthikRangarajan no, he totally comes at it from the kids side. Tries to expose them gently to the darker side of it.

hell, he managed to surprise me with some of his stories.

@AviD 1. I already have one 2. Well, duh 3. Meh, whatevs 4. And if you hurt me, I hurt you 5. No problem, I like to be early anyway 6. Sure 7. I don't like to lie so that's fine 8. I beg to differ 9. lulz, alright 10. Let's fuck.

@Simon 11. I can ban you permanently.

If it's not written on the t-shirt, I don't believe it.

Trust the T-Shirt!

#TtT

10:41 PM

@ScottPack see what?

I'm not sure what are we talking about?

10:54 PM

user image

Karthik Rangarajan

@ScottPack One of the tasks on my list (that keeps getting longer) is to set up some sort of a full packet capture on our network here. We have a 50 mbps network, so it might not be the best idea.

heh guess what this is ^

no trick photography, just tricky shadows

Karthik Rangarajan

however, we would like to at least know when there are scans/attacks/brute force password guessing stuff happening internally.

@TildalWave The tweet of me asking for people to submit specs. You favorited the tweet but didn't retweet it.

@KarthikRangarajan Is that 50 Mbps or MBps? One is easy, one is slightly trickier.

@ScottPack oh, I forgot ... I'll correct that in a sec

10:56 PM

@TildalWave DAMNIT SON!

Karthik Rangarajan

@ScottPack 50 Mbps.

@TildalWave Oh, we went to an Indian place instead of Slovenian. L'sigh.

Karthik Rangarajan

@ScottPack or wait...let me cehck.

@KarthikRangarajan A full packet capture on 50 Mbps is pretty easy.

Karthik Rangarajan

@ScottPack 50 Mbps

@ScottPack ah that's good to hear. any suggested methodology to do it?

(I can ask an actual question if it's easier to answer there versus here)

10:58 PM

sure, the capture is easy, its what you do with it that gets tricky.

@KarthikRangarajan Do you know how you're getting the feed yet?

@AviD Troof.

@ScottPack Where the bleep is it? I can't find it in the list...

(I had cider)

(plural)

@ScottPack I think that was kind of his intent...

« first day (1110 days earlier) ← previous day next day → last day (3791 days later) »

Transcript for

Dec '1330

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile