« first day (785 days earlier)      last day (4393 days later) » 

00:00
@ThomasPornin umm... which one now?
14
Q: Why are vulnerabilities and lack of security possible in computers?

user3533I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why doesn't the computer just do the things it is supposed to? Why do some people write malware, instead of programs with a constructive purpose beyond doing damage and violating the law? Does comp...

@ThomasPornin thats the one I was talking about before. Unimpressed.
As I said, I see only two points of any interest there, it's @Ninefingers and Harvard arch. and @Iszi's inexplicable love for all things Bedilia.
@AviD I'm unimpressed by all three
Not to say the bear answer was no good - it was a pretty decent answer for a doofus question.
security holes aren't always due to programming bugs, sometimes it's because someone did something that the designers hadn't thought of, and possibly wouldn't have classified as undesirable because they hadn't thought the consequences through
00:05
Personally, I don't find that Harvard architectures are that much relevant. But I also think that the NX bit is not very relevant either -- it just trains attackers to be a bit smarter.
Harvard architectures aren't a panacea because any time you have a VM running bytecode, that abstraction is broken
@ThomasPornin I didnt say it was relevant, important, or even answer the question. I said it was an interesting point.
@Gilles or a VM running anything.
 
1 hour later…
01:13
Chrome / Firefox need to segment cookies so when I visit a newspaper website my Facebook connection doesn't end up there.
01:50
oh wow
I just ordered something on a website. The total price of my order is listed three times: 49.43€, 52.43€, 0.00€.
49.43€ is the sum of the prices of the articles, except that I ordered 2 of one of them so it should be more
I can't seem to find out how much they charged my card
better watch my bank statement
@AviD Hey. I have an excuse. It's called a 9-year-old.
 
4 hours later…
05:52
Morning gents
 
3 hours later…
08:37
Is the meta site not rendering properly for anyone else?
Hmm nvm. It's fine now.
@LucasKauffman hahaha genius!
Ohh, any thoughts on Linode?
09:25
@LucasKauffman Fantastic.
@TerryChia No experience of those, but I use memset for their unlimited bandwidth option :)
They're also a Xen VPS host.
And their support is top notch, even for self support.
They can also image your vps to something they call memstore which is ridiculously cheap storage space.
Oh usual disclaimer I am not affiliated with them in any way. I'm just a paying customer.
I see, their pricing is quite competitive. Gonna add that into my consideration list.
Hardest thing to do: coming up with a nice domain name.
@TerryChia If you're prepared to configure everything yourself they're really reasonably priced. If you want fancy stuff, it's a bit more expensive :)
I took an image of my VPS, which is about 5GB in space, and I've had it in their memstore thing for 6 months. So for I have been billed exactly £1 for this privilege.
09:40
@Ninefingers Heh. I'm planning to configure and run a CentOS server on my own. Good way to keep my sysadmin skills sharp.
@Poly - so upset with myself. The call I just had from the 'Computer Maintenance Service' - I only managed to keep them on for 8 minutes
@TerryChia Ah - they do CentOS as a distribution. It's good practise, especially setting up MTAs etc. I run all my own email with SPF and everything :)
He started to get very upset when I began a discussion about how the virus he was describing couldn't have come from any of my Solaris boxes, and tried to insist that he could see I was on XP because of my (Computer ID).....
@Iszi hey, I can respect that. You don't think this tiggervatar has been with me since I was kid, do you?
@LucasKauffman SLAP. That was old before @TerryChia knew how to read.
admittedly, that's might not be saying much, but still.
One of the original internet memes going around when you needed to type text commands to retrieve your email.
@TerryChia I heard some very good things about them, but more for a personal/work remote desktop, not for production servers.
@AviD Yeah, the reviews on the web sounds good. I like that they have datecenters in the Asia Pacific region as well, although I'm not sure if that matters much.
09:46
@TerryChia I've got a linode for some scanning stuff. Seems to work fine, the dashboard is reasonably comprehensive and I've not had any problems with it..
if you want to do it all yourself, pick up an extra few skills along the way, and dont care about HA - consider building your own powerbox, and loading it up with VMs.
I'm looking at that strongly now, and it is looking good to me.
@AviD Heh. I don't have the time (or money) for that right now. :)
@TerryChia it doesnt have to be that expensive, and depending on how many VMs you want it might be cheaper in the long run.
aaaaand you get to build your own box :-)
@AviD Getting a VPS from linode or similar probably makes more sense for me right now. :) Plus I still got to add a new SSD and graphics card to my desktop.
@TerryChia Just a quick remark, never ever use providers that offers openvz virtualization
@TerryChia also you know that Amazon gives you a VPS for free for one year?
the micro instances
09:55
@LucasKauffman oo thats interesting. just one?
@LucasKauffman whats openvz?
@AviD It's a virtualization tech i think.
nevermind, I wiki'd.
@AviD openvz is a kernel virtualization technology, so you can install any OS, as long as it shares the same kernel
the good about openvz is that you don't need swap
in fact you can use all the unused memory as swap that the host as available
there is just one small catch, there are a lot of sellers that do not have a lot of free memory on their machines, meaning if you run out of memory, you can't swap --> bye bye vps
@AviD yea it's the linux micro instances
@LucasKauffman wait, huh?
so only partial virtualization? shared kernelspace?
sounds... dodgy.
@LucasKauffman "instances" or "instance"?
ah, yeah. Wikipedia seems to explain it pretty well.
not something I think I would want on a hosted server... possibly on my own managed machine.
@AviD not sure if it's instances or instance
10:01
@LucasKauffman More than one doesn't make much sense for their business model though. They want you to upgrade after all.
@AviD I've seen several implementations, for instance a debian machine which has KVM and OpenVZ installed, for Windows machines KVM is used and for all linux machines they used OpenVZ. The nice thing is they can sit next to eachother
@TerryChia Let's say you get 5 micro servers, after 1 year you have to pay
so that gives around 5 * 12.50 dollars
@LucasKauffman yeah, but your vm is sharing kernel with somebody else's vm. Not so cool.
@AviD It has a lot of limitations, because you can't alter the kernel in any way yourself
for instance OpenVPN won't work because you can't install TAP devices
since that requires you to reconfigure the kernel
there are different techs, OpenVZ is imo the most secure and most documented one
LXC is also very cool
but they found privilege escalation vulnerabilities :P
and a guest would be able to get root on the host
but LXC is not stable yet anyway
The cool thing about LXC is that overhead and surplus memory usage is very low
0
Q: Something strange with Scientific Linux repositories

gasko peter On 2013.02.05 I installed a SL 6.3/64bit minimal, then after install I tried to install a libreoffice-base package. This has been showed to me: I tried "yum clean metadata" and "yum clean all" but it didn't worked. The same message appeared to me for 2 days. Today, 2013.02.07 I didn't do an...

I'm torn. For 80% of the q, my finger was ready to migrate to SU. But then the last line does ask a security (-ish) question... though the answer is probably "No.".
thoughts?
@AviD I commented
10:18
@LucasKauffman You sound like tech support.
Ahh we finally got our migration options?
@LucasKauffman a bit too snarky on the newbies.
but he does have an actual (-ish) security question there: Does it relates to security? Did someone had a proxy between me and ftp.scientificlinux.org?
if it werent for that - it would have been closed already.
@AviD I was actually nice!
@LucasKauffman fake politeness? cmooon
I could have been snarky and gone all @ScottPack over him
we're not americans here.
10:21
I actually had a nice quote from an American friend of mine
she used to drink a gin tonic before work (waitress) so she could smile more and get more tips
@LucasKauffman if its a she, forgetting a few buttons would probably generate even more tips.
This country rocks.
@AviD Israel?
Just heard that some high schools here have started offering a new major: Cyber attacks.
I heard you guys were the bomb
no, you heard we have a bomb. and thats not true.
10:24
@AviD Did you guys find out Hamas started using computers :P?
(stop me if not appropriate/offending)
ignoring the gratuitous use of "cyber", I think that's just awesome.
@LucasKauffman hahaha, nooo, not at all.
@LucasKauffman and I remember a few years ago I had to help investigate some Hamas attacks on israeli websites.
still going on, all the time, but I'm not part of it :)
whups, kiddies home - back later.
I find Israel quite cool in that way they always do what they say
other countries go "well if you don't let us do this we might do that"
@LucasKauffman With the high standards @ScottPack set for this chat, it's pretty hard for anything anyone else says to be considered non-appropriate. :)
10:26
Israel has a more direct approach :P
@LucasKauffman with a great habit of neither confirming, nor denying anything... "Did you do XYZ?". "There's no proof we did XYZ"
10:48
@ColinCassidy ah isreal :D?
yea
We might have sent in apache helicopters to kill the fresh head of Hamas, we might have sent in a C130 to an African country to kill terrorist and blow up some jets.
@AviD very tempted to migrate it to SU - 3 close votes now...
@RoryAlsop You are a bit like caesar now, will you go thumb up or down
Oooh - I do like the new migrate options in the close dialogue! :-)
bbc.co.uk/news/technology-21371609 and they say that kids aren't motivated to learn anything
11:27
@ColinCassidy scary isn't it!
@RoryAlsop yes I'd better get my son up to speed soon :)
11:59
@RoryAlsop I'd be more happy he's interested in coding than playing games
12:10
@LucasKauffman but, to quote a famous belgian "it's all about the games"!
@LucasKauffman Wait, coding isn't a game?
@RoryMcCune what famous Belgian was that :P?
@LucasKauffman There's not that many. I'm thinking Poirot
@LucasKauffman Athene!
12:20
@RoryMcCune YOU KNOW ATHENE :D?
@LucasKauffman of
Athene the best paladin in world!
course
it doesn't come out quite right in text it's more all about the GAAAAMMMMESS
you play games @RoryMcCune?
also tanya :) :)
12:21
:o
@LucasKauffman not much any more mostly offline stuff. I looked at MMORPGs thought "I'd really like those" but I don't have time
@RoryMcCune yea I hate you need to take a subscription
@RoryMcCune You should really give GW2 a try. It requires surprisingly little time commitment for a MMO.
I'm really curious about The Elder Scrolls Online
It took me around 2 weeks to max out my level and get decent gear.
I haven touched the game in a month due to busy school work.
No subscriptions either.
12:23
I played DnD online for a while it was quite good, but not all that popular.
I do like to play league of legends at the moment
all though I don't want to know how many hours I've spent on the game
I have over 1700 played games and one game lasts 40 minutes on average :/
@LucasKauffman woah!
that's quite a time sink!
Reminds me of my dota days.
I had a friend who has around 7000 hours on WoW
12:30
It got real boring after a while though. My skills just weren't improving.
I've played 251 hours on warlock master of the arcane over the last 6 months or so and that's a lot for me
@TerryChia if you liked DoTa you should try league
@LucasKauffman Naw, bored of those type of games now. :)
13:02
@RoryMcCune You have a linode VPS right? You got a referral code I can use? About to grab a VPS from them. :)
13:20
@LucasKauffman it's called Plausible Deniability.
@TerryChia yeah my referral URL is apparently linode.com/?r=730a0c0ad71ad8b0fff574e51c61dea8f9f4de44
like with nuclear weapons - Israel does not have any. Right now.
I've not used it before so I'm not sure of the exact benefits..
@RoryMcCune You get $20 if I stay a customer for three months apparently. :)
@TerryChia w00 free linode for a month :)
13:22
@AviD That's what Saddam said
@LucasKauffman that's not what our in-depth research showed :)
@LucasKauffman ah, but he did (or did he?)
Israel definitely does not have any.
'Course, if it comes to that, Israel could acquire nuclear weapons within a short time.
@AviD I recall someone (might be you) saying that Israel has all the parts needed. Just gotta assemble them like some crazy lego project. :)
9 seconds.
@TerryChia heh, yeah, supposedly.
it's like what @LucasKauffman was saying, its never been admitted to anyone outside of that unit (and gov't, I assume).
@AviD I bet you have them lying in bunkers, IMO you'd be stupid not to have any
13:25
but whether its true or not, the threat of the rumor serves the same purpose.
@AviD that and the fact you actually do send out bombplanes and apaches :p
I wish I had an apache
to go to work with
@LucasKauffman right. The threat is "they probably have them, and if they do they're not afraid to use them (if needed)"
@AviD indeed
@LucasKauffman heh. Would make traffic less of a bitch.
@AviD indeed
Just need to convince facilities the investment to build a rooftop helipad is worth it
13:28
@LucasKauffman you could trade out those missile launchers for a mean coffee maker.
save the air-to-air ones, though - never know who else will have the same idea.
@AviD especially if they dare parking on my helipad
and if I don't get a raise I'll just hover in front of the partners window
@LucasKauffman If the copter is parked, wouldn't you technically need a air-to-ground missile?
Anybody here enjoys security-related moral quandaries?
@Adnan I don't know.. is it morally acceptable to enjoy them?
2
@TerryChia, damn! That's a good one
13:36
@TerryChia if it's standing still I just use the onboard cannon
My current university launched a new program to help students with previous degrees graduate faster by presenting a certificated result transcript from the previous university normalized to ECTS credits.
@Adnan that's immoral.
or at least, unethical.
Well, I've already studied 34 IT-related courses, most of them are programming and software engineering. It's pretty pointless for me to study them again
However, my previous university don't have a way to normalize to ECTS.
So I decided to find my way to the university's mail server and send an email from the student office to the current university.
It doesn't feel exactly right to do so
@Adnan I could see why.
Basically ethical people will always feel weird when they have to go outside the unethical rules.
It's a moral trap, ysee. We've always been trained to follow the rules, but what happens when the rules are wrong?
@AviD Then we send in an Apache helicopter
13:46
heh. exactly.
Nuke it from orbit.
Sweet, just got a VPS from linode. Time to spend the weekends configuring the server. :)
@AviD from a country that says it has no nukes, that's an interesting options :p
@ColinCassidy Watch out with your opinions, Mossad is watching :O
@LucasKauffman hey, I'm just re-iterating the party line...
14:01
@ColinCassidy hahaha, noooo, not me, I am not military, for that matter I believe in non-violence. Krav maga class notwithstanding.
Question for the Rories (and anyone else Edinburgh based) are either of you aware of dc44131.org/index.html
@ColinCassidy Yep - had seen that
@RoryAlsop know anything about them? worth turning up to?
It's Dave Stubley organising them, and it's early days - so not the biggest turnout
personally OWASP has more attraction...but then the DC4420 in London is pretty good to go along to
they have some excellent speakers
and some crazy talks
Ah I see, might be tempted to pop along if I get the time
and by time I mean permission from she-who-must-be-obeyed :)
14:22
I think we just need a greater number of hardcore hackers up this neck of the woods to make it really work
London has a high enough number that you can max out a pub with white, gray and black hats
@LucasKauffman I think I know the sysadmin for Brazzers
Anyone mind looking at this barebones iptables config for me? pastebin.com/WavGGAaF
Is it a good starting point? I can't really recall iptables syntax right now.
It's the suggested config from the linode security guide.
If only someone had written a blog post about this.....if only....
14:39
@ScottPack Hmm? Link please? :)
scottpack on August 30, 2011

This question on Security.SE made me think in a rather devious way. At first, I found it to be rather poorly worded, imprecise, and potentially not worth salvaging. After a couple of days I started to realize exactly how many times I’ve really been asked this question by well intentioned, and often, knowledgeable people. The real question should be, “Is there a recommended set of firewall rules that can be used as a standard config?” Or more plainly, I have a bunch of systems, so what rules should they all have no matter what services they provide. Now that is a question that …

Just skimming over your idea, without looking at syntax, it looks pretty reasonable.
@ScottPack Ahh thanks. :)
Hey man, that's why I wrote it. BECAUSE PEOPLE KEEP ASKING!
I'm definitely doing more than you're doing, but I at least tried to talk through the logic for all of it.
So you can make informed decisions about what to include and what not to.
15:02
@AviD Actually they have between 100 and 200 nuclear warheads. The locations of the underground uranium enrichment facilities are documented, as well as the timing; Israel has been a nuclear power for quite some time. Israel never acknowledged their existence officially because of the Treaty on Nuclear Proliferation.
@ScottPack really?
@LucasKauffman I think so.
It always made me wonder how their networks are planned
I don't think it's easy given the nescessary bandwidth
@ScottPack or is he a sysadmin in the sence of "Hi there busty lady, has your internet broken down?", girl: "Yes it has", sysadmin: "let's see if I can put my TP cable in that hole"
@LucasKauffman The guy that runs their servers
@ScottPack the guy who can get us all free access??
2
15:10
mmmm the ip of Brazzers seems to be owned by Ohio University
@LucasKauffman I've had a similar wish for a long time, but for a Harrier.
@Ninefingers Would they allow some traffic which looks shady but is not, provided I give them some prior notice ?
I'd like to do a survey on SSL usage; this implies connecting to lots of random IP, on port 443.
From the outside, it would look like a botnet trying to replicate, so I suppose it could trigger some IDS
@LucasKauffman The fuel costs would be high, though.
15:26
@LucasKauffman Silly boy. We both know that's not true.
15:43
hmmm how bad is it that someone is reading out the Credit Card number over the phone in an open plan office...
oops and expiry date
@ColinCassidy Happens on a daily basis, I'm sure - along with SSN, DOB, mother's maiden name, etc. It's a side-effect of certain businesses only being open during "business hours" and people who need to do business with those being too busy to leave their desks during that time. Is it a good thing? No. Unfortunately, for many, it just feels like too much work to avoid it.
@Iszi I'm reminded of the twitter bot the re-tweet images that people have posted of their credit card
@ColinCassidy The impact rating of that vulnerability would definitely be high. The acceptance of that risk then comes down to the perceived likelihood of exploitation.
Of course, this would be a risk taken on by the card-holder - not the business on the other end of the phone. The latter has no control and little to no influence of where the former chooses to be when they're conducting business over the phone.
I mean, sure they could insist that all credit transactions are handled via automated system either in person or online. But that will end up in having a bunch of disgruntled users - and businesses don't want that.
Also consider that, regardless of your venue, you're still speaking the information to a person who could be making their own copy of it.
true
I also suspect that a number of people are not necessarily aware that there is a risk in the first place. most people would assume that their work collegues are fair people.
once again the disgruntled employee is the largest risk
2
15:59
@ColinCassidy And that goes back to my point of "perceived likelihood of exploitation".
16:16
@ThomasPornin You think I care about fuel cost if I can afford to buy an Apache?
@LucasKauffman Well, you should. Fuel, ammunition and replacement parts tend to cost way more than the machine itself.
I can barely afford ammunition for my car.
@ThomasPornin fuel doesn't, replacement parts, ammo and mainetenance yes :P
@ThomasPornin Speaking from experience?
For that matter, ammunition is useless in an Apache to go to work. Ammunition is used to clear traffic jams, so it makes sense to have it on a terrestrial vehicle.
16:23
@ThomasPornin or shoot other helicopters of my helipad
@ThomasPornin and to have some weight in wage negotiations
wow, interesting conversation to come in the middle of
first line I read is ammunition for clearing traffic jams
@AJHenderson You must not come around here often, if that is what you call "interesting".
@AJHenderson Meh, it is pretty tame for this chat room.
though for a moment, with maintenance, fuel and ammo, I thought for a minute we might be playing oregon trail
but then there would be only ammo
@AJHenderson And dysentery
16:27
because honestly, who cares about disentary when you have 10,000 pounds of squirel
@Iszi - yeah, I don't often get to work from home
@AJHenderson I can trade you some horse mea... sorry beef :)
mmmm horse steak
with some Smoky BBQ Jack Daniels Sauce on the BBQ
@LucasKauffman dammit now I'm hungry
@LucasKauffman - hey, when you get a chance, I need access to the CTF chat
should be done
16:40
@LucasKauffman how are things going with that?
@lynks Ghost in the Shellcode
will be the first one
@LucasKauffman ahh great, my friend is doing that with a team, so we have a direct rival :P
its on the 15th iirc?
ye
15-17
I did the nullcon one recently
but it was utterly shit
plus their own site got pwned
can i get into the comms channel?
haha
you can
but I dont really know how
16:42
is it a room on sec.se?
yes
and the first challenge is to find it!
or wait until @Jeff is back :P
@LucasKauffman so far my 1337 h4x0r skills fail me. i searched for 'ctf' in 'all rooms'.
WHERE IS THE COMMITMENT ???? >:(
i also tried 'ghost' :P
i guess it's one of these new-fangled 'mod' channels that mere mortals cannot search for or join
@lynks I added you I think
16:47
teamwork :)
maybe the first CTF challenge should be getting in to the room ;)
oh
late to the party I see
17:04
not sure, but I think that we may have just gotten a spam post at security.stackexchange.com/questions/23828/… It's got a link without any info that looks like a link placement since the answer also seems somewhat odd, though passably related to the question (and wrong)
@AJHenderson boom
Voted to migrate to Super User (YAY! I can do that now!):
0
Q: Truecrypt: Encrypt 2 Windows systems on one hard drive

Malte BublitzI've got 2 Windows 7 Systems on one hard disk. Is it possible and if so how can I encrypt both with TrueCrypt, so I can enter the password used for the first System to boot this one, or the second one to boot the second system? There are no hidden volumes. The Partition layout: Partition 0: 10...

@Iszi - agreed on the yay for being able to vote to migrate
and seconded
17:25
I hate it when you're trying RCE exploit and it shuts the system down instead and it needs to be manually turned on again!
17:37
@Adnan you did something bad : / cause a kernel panic?
@lynks, uhhhmm. Wasn't me!
"it needs to be manually turned on again!" there must be something better in English to say instead of that.
@Adnan You need to stroke it gently while telling it naughty things?
18:03
WTF C#. Just learned that var doesn't infer the type anymore if you have a type called var and instead refers to that type.
@CodesInChaos Lesson: don't use reserved words?
I don't do that in real programs
but the issue is that var is no real keyword
I would have made var always infer the type, and those that are crazy enough to use a type called var should use @var to refer to it
18:31
@CodesInChaos could make a nice ioccc entry, or the C# equivalent
can't really think of a way to abuse it. You'd need some justification for creating a class called var
though the devious part is that that class can be in a different file
19:11
I'm still just bitter about the lack of covariant returns in C#
I curse their lacking nearly every day
including today
but yeah, I expect var will get better as it becomes a more mature feature of the language
Excuse people, am I missing anything in this The Guardian article?
though personally I try to avoid their usage as much as I can, but they are sometimes nice internally
It says "A small asteroid will pass closer to Earth next week than the TV satellites that ring the planet"
But then it says "projected to come as close as 17,100 miles (27,520km) from Earth"
a couple of lines later, "Television, weather and communications satellites fly about 500 miles (800km) higher."
shit!
I see it now!
yeah, geostationary orbit is really stupidly far out there
@Adnan yup geostat is about 35 million metres
19:18
I believe there is actually a good XKCD for it
but I can't remember which one
and there it is
so thats the cool thing about geostat, provided the centre of mass is at the right radius, the object will stay in place, which is how a space elevator would work - it wouldnt need anchoring in theory, it would just...hover...
@AJHenderson It was nearer when dinosaurs roamed the Earth.
you'd just need something really heavy on the far side of the geostat ring to counter balance it
19:22
space elevator has the problem that an object moving/up down needs to change its angular momentum a lot
@Lynks isn't there also an XKCD with cutting the cord for the space elevator?
@AJHenderson yep that one :P but if it was built correctly, the 'wire' would not be under any tension at ground level, so cutting it would have no effect.
well, depends if the elevator is in transit or if it is adjusting the counter balance on the other side
@AJHenderson sure, but the counter balance adjustment would be a continuous thing, and could be used to ensure minimum tension in the wire - ie 0 at ground level - at all times
or we could take the jules verne approach to space faring
19:27
@lynks Moreover, with the forces that the wire would endure, I doubt that mere shears could damage it.
@CodesInChaos It is a serious project, still under study and with funds ! (But not to send live humans to orbit, though)
19:39
we really ought to be aiming for Niven Rings anyway; 24.media.tumblr.com/tumblr_m5q77mEPKG1r117j9o1_500.jpg
@lynks - yeab, but then we have to discover homicidal aliens that want to shoot us in the face first, and that's just no fun

« first day (785 days earlier)      last day (4393 days later) »