The DMZ

Gilles

00:00

@ThomasPornin yeah, it does

actually here the permissions were r-s--x--x, i.e. a setuid executable

you can't attach to the program with ptrace afterwards, but you can start it under ptrace

oddly, with a setuid binary, you can't read /proc/$pid/maps or /proc/$pid/mem (without being root)

but hitting the program with PTRACE_PEEKTEXT or similar works

and you can find the interesting addresses with PTRACE_GETREGS

TildalWave

@AviD Add the link to the video in the comments, this is crazy fun. Now I wanna know if it'd be possible to land it on a peer with a dive jump :))

@AviD 55mph FTW!

Iszi

01:47

@AviD Protip: Don't wander around a government installation, even properly badged and authorized, wearing a hat, black military-style jacket, beard, and backpack. Especially don't do this in front of little old ladies who can't be bothered to ask you for your ID before calling security behind your back.

D3C4FF

03:09

pop quizz time!

I've rooted a SQL server(lol winXP), added myself as a local admin, enabled RDP via xp_cmdshell but i still can't seem to connect...

I get "The connection was lost due to a network error"

Google tells me that this is due to firewalling. Seems logical.

I've done netsh firewall add portopening TCP 3389 "Remote Desktop"

All seems good.

But i still can't connect.

Suggestions anyone/

Same error still

Jeff Ferland

03:42

YOLO Crypto

@yolocrypto

Crypto is hella YOLO!

10 tweets, 142 followers, following 5 users

Stack Exchange

04:17

So far Voyager 1 has 'left the Solar System' by passing through the termination shock three times, the heliopause twice, and once each through the heliosheath, heliosphere, heliodrome, auroral discontinuity, Heaviside layer, trans-Neptunian panic zone, magnetogap, US Census Bureau Solar System statistical boundary, Kuiper gauntlet, Oort void, and crystal sphere holding the fixed stars.

D3C4FF

04:29

Just out of sheer interest... how old are people here? I get the feeling most of you are a bit older than me (what with having kids and all...)

Terry Chia

@D3C4FF 18.

D3C4FF

Eyyy! sup @TerryChia

Thats fairly young. You still in highschool?

Terry Chia

@D3C4FF I'm in something called a polytechnic, not sure if they have those where you live. I am taking a diploma in infosec. :)

@RoryAlsop is practically ancient.

@ThomasPornin is ageless of course, being the Bear God and all.

D3C4FF

@TerryChia Yeah, i'm familiar with them but they call them TAFE in Aus...

something along the lines of 'trade' school.

Terry Chia

0

A: Authorising use of apps from a public store with no back end service

Your requirements appear to be quite contradictory. I am going to suggest a scheme which may or may not be feasible for you to implement. You decide. I suggest that the app you submit to the public app stores not contain any of the sensitive information. Instead, the application should provide a...

Anyone has a better scheme for his requirements?

TildalWave

05:22

Ah bloody hell, I was writing an answer to some question for at least 15 minutes and then OP deleted the question LOL. It wasn't even a bad question ("What is w2 token authentication?").

OK, back to bed! Cheerio!

Bailey Rowland

Hello

TildalWave

Wow hey @BaileyRowland IIRC it was you asking about W1/W2 authentication?

@BaileyRowland Hello ;) You know you're making me sit here in my P.J.s waiting for your answer? What can we help you with? :P

@BaileyRowland OK I'm off to bed, but in case it was you asking that question, here's a quick sum:

It's a windows authentication mode in WCF for members that are not a part of a domain and are authenticated by username and password (W2 mode, no token used, unidirectional authentication). That's in contrast to members that are a part of a domain and can be authenticated by a token provided by KDC for the service requested (W1 mode, with a service-specific KDC token).

W1 is also a bi-directional authentication, or multi-factor authentication, so in this sense more secure for both sides involved

Right... Narnia here I come.

Rory Alsop

07:25

@TildalWave youtube.com/user/Metaltechtheband

I'm lead guitar, and pyrotechnics :-)

@TildalWave see what you think of our Rammstein tribute...Hammstein (a demonstration of how the daftest words sound good in German over a heavy beat)

►

and glad you enjoy it :-)

@Iszi hahahaha - this includes playing Ingress at international airports, just so you know

@TerryChia cc @D3C4FF - what do you mean practically? I'm very nearly the Answer to Life, the Universe and Everything

AviD

08:01

@TildalWave umm, the link was from your answer...?

@Iszi haha, right, because only terrorists have a beard and carry backpacks.

LOOK OUT EVERYBODY, HE HAS A BEARD OF MASS DESTRUCTION!!

AviD

09:00

hmm, this is perturbing. I tried getting my son to make me sandwich, but even sudo make me sandwich didn't work. I am quite confused.

AviD

09:11

@ScottPack re Spring break - collegehumor.com/video/6879066/…

Rory Alsop

@avid - I love that xkcd. My technique for getting Hamish to make sandwiches is to point out that karma directly translates to improved pocket money rates.

AviD

hehe, so you bribe him?

I would need to get a second job, if I started that with my kids.

Bailey Rowland

09:36

is QOTW on yet?

Rory McCune

09:47

@D3C4FF could be an off-box firewall between you and it? If you have access to it I'd recommend a reverse connect shell (something like metasploit). In my experience outbound filtering is much less common than inbound :)

Rory Alsop

@BaileyRowland nope, but I am hoping to write one up asap :-)

Bailey Rowland

what do you have to do?

Rory Alsop

@AviD sort of, yes - not per event, but as he makes pack lunches for his sisters every day, he earns his keep :-)

@BaileyRowland make some time - all the QoTW posts are when folks have a wee bit of time to write one up. Not too challenging, but everyone is busy, so it's just a logistic question

Bailey Rowland

make some time?

I got nothing to do.

how to make one, what about?

Rory Alsop

@BaileyRowland okay - have you read the existing QoTW posts? security.blogoverflow.com

the style of the QoTW posts is quite simple and brief

topics are chosen from this post: meta.security.stackexchange.com/questions/1018/…

Bailey Rowland

09:56

Where do you post it?

I got a good one.

is it that link?

Rory Alsop

It's through the wordpress interface at blogoverflow - I'll need to find the link for registering as a contributor

hang on

Bailey Rowland

ok

hey @jrg How do you give good answers?

Rory Alsop

@BaileyRowland now that's a very meta question....

Bailey Rowland

That is a ALL SE sites question.

This is a crushed dream. discuss.area51.stackexchange.com/questions/9732/…

jrg

@BaileyRowland on Security.SE?

I don't.

Bailey Rowland

10:06

yeah. i know

jrg

on Ask Ubuntu? well, i do all sorts of tricks.

Bailey Rowland

Any tricks that work on gaming.SE?

jrg

screenshots

Rory Alsop

@jrg heh

jrg

pretty colors

Rory Alsop

10:08

good formatting

jrg

choosing your bounties wisely.

Bailey Rowland

You mean like this one....

15

A: What is this block in Minecraft's terrain.png?

Command Block That block is the Command Block, commonly used for server owners with server commands. It is possible to break with a wood pickaxe. It can't be normally crafted. Currently, it is not available in the creative mode inventory either. Item Frame The other block is an Item Frame. T...

jrg

EXACTLY.

Bailey Rowland

That is my best answer

It all depends... on the question?

jrg

get on a site that has people who upboat stuff.

Bailey Rowland

10:09

upboat

Rory Alsop

or a site where you know everything]

Bailey Rowland

I got it, minecraft has boats

jrg

@RoryAlsop difficult for almost all sites.

Bailey Rowland

true

i got all that from the MC wiki

jrg

unless you count the C# tag as its own site, and you are Jon Skeet.

Bailey Rowland

10:10

ha

jrg

knowing how to google, digest intel and regurgitate it is also important.

Bailey Rowland

rory? qotw?

yuck, spit and rinse methaphor

jrg

@BaileyRowland precisely.

/me leaves, will be back in like 72 hours. cya!

Bailey Rowland

also, I don't care, just credit me QOTW! Is HTML5 really safer then flash?

Rory Alsop

@BaileyRowland still waiting for an answer back - it has changed from when I started on QoTW. So which question were you planning on writing up?

@jrg ttfn

Bailey Rowland

10:14

I just posted it

Is HTML5 really safer then flash?

Rory Alsop

@BaileyRowland where have you posted it?

Bailey Rowland

here.

in the chat

I never got any links!

Rory Alsop

ahh - I think you have misunderstood the process:-) Read the meta post linked to above.

here it is again: meta.security.stackexchange.com/questions/1018/…

Bailey Rowland

but the answer was accepted?

Rory Alsop

???

what answer? What question? You need to point me in the right direction to know what you are talking about

Bailey Rowland

10:18

top one that link

do I post that question in meta?

or on the normal site?

0

A: Requests for Question of The Week blog posts

I recommend Safer with HTML5 or Flash? because it has a excellent question, can help other website designers and boost security.SE popularity!

posted/

@RoryAlsop Still here?

Rory Alsop

Ahh - your problem is that it is not really a very good question for this site. You will get subjective answers, and it might get a lot of votes to close

also, while nominating it for QoTW is fine, the chosen one each week wil be the one with the most upvotes

Flash is generally considered insecure - because it is ubiquitous it is heavily targeted, and it has some issues in terms of updating

but html 5 is also insecure in many situations

Bailey Rowland

I suck at everything.

Rory Alsop

@BaileyRowland :-)

Bailey Rowland

what?

that minecraft answer is different

i suck at questions

read ALL my questions you will see

see?

@RoryAlsop bump?

Rory Alsop

10:43

@BaileyRowland bump for what exactly?

@AviD and usual suspects, have drafted up a QoTW for publishing in 75 minutes. Any quick reviews welcome :-)

Bailey Rowland

I'm trying for one more good question

Rory Alsop

@BaileyRowland have tweaked the wording a little to try and help

Bailey Rowland

meh

just read my questions

Rory Alsop

@BaileyRowland what? why? I only see one here.

Bailey Rowland

from gaming.se

Rory Alsop

10:49

@BaileyRowland ... I'm not really that active over there. Still sub 1k rep

Bailey Rowland

trye

true

my highest is 505 .

Terry Chia

Well, just got my graphics card installed after a lot of cursing and swearing.

Downloading the drivers now, fingers-crossed everything works out fine.

Bailey Rowland

cool

Rory Alsop

@TerryChia which one did you go for in the end

Terry Chia

@RoryAlsop I went for the Powercolor HD7850 PCS+.

I wanted to go for the 7870, but they were out of stock. The 7850 is powerful enough for my needs.

Bailey Rowland

10:53

sooo

...

AviD

85.

I go grab a sandwich, and there are 85 new messages.

y'all need @Iszi to stew you up some nice STFU.

Rory Alsop

@AviD heh - how's temperatures there?

AviD

@RoryAlsop Hot, it's damn hot I tell you!

we're actually having a sandstorm today. Blows in from the Arabian desert. Very pleasant.

Rory Alsop

blizzards here :-)

AviD

►

Rory Alsop

11:06

Gooooooood Moooooooooooooooooooorning Vietnaaaaaaaammmmmmmmmmmmmm

AviD

Instead of hot and wet, we get hot and dry.

Think its about time I put an aircon unit in my office, I'll order one next week.

Actually, because of the lair-like aspects (ping @AntonyVennard), it does stay cool down here for most of the season, except for the really hottest days.

It would probably be pleasant here even with 30C outside, might be able to survive a bit more than that. something like a 10C difference, at least - except when the sun shifts direct in the window.

CodesInChaos

Tried to reverse a string in C#. Took me over half an hour to write something that looked like it could work. Then learned about the StringInfo class, and it became trivial.

But I still would consider reversing a string an easy interview question.

AviD

hehe, wanna write a method to sort an array?

Terry Chia

Yay! Successful!

Rory Alsop

@AviD shouldn't have built your lair in a volcano!

Terry Chia

11:17

Gonna go play a round of D3 with max settings soon. :)

Rory Alsop

@TerryChia D3 looks lovely on my gaming rig, and mine is only an overclocked GTX 560 Ti

Antony Vennard

@RoryAlsop Actually, as a missile launching facility, a volcano is a good place for a lair. See "You'll Only Live Twice".

Terry Chia

@RoryAlsop I'm hoping it will on mine as well. :) A 7850 card can easily max out the game on my single monitor.

Rory Alsop

@AntonyVennard yeah - but lava can burn, so you need to put up hazard signs anywhere guests may walk

Terry Chia

Hey, the 560 Ti is an awesome card still.

AviD

11:19

@TerryChia got the new card already?

@RoryAlsop especially around the sharks with lazer beams

Rory Alsop

►

Terry Chia

@AviD Yup, just stuck it into my system. Took way longer than I am proud of since it's my first time.

7

Antony Vennard

@RoryAlsop Guests walk? Doesn't this lair have its own miniature underground railway and/or car things in which lots of people wearing identical uniforms travel around doing unknown tasks?

Terry Chia

Damn, that came out wrong.

2

CodesInChaos

@AviD I just wanted to check how difficult it is to write it since people often claim it's an easy whiteboard question.

That may be true if you know the right API, but without it it's quite hard.

AviD

11:21

not "hard" hard, pretty simple, the kind of question that is good to see if the person is capable of writing code at all.

CodesInChaos

It took me more than half an hour, using MSDN and a compiler, and I'm still not sure if it works. It's only easy if you either disregard all corner cases, or you use a nice API like StringInfo.

It'd probably take me another hour or so to assemble enough test cases to trust the code

Rory Alsop

@Lucas and anyone into hacking competitions - I haven't seen this one before, but an email came through this morning: cyberlympics.org/Home.aspx

AviD

to reverse a string? What am I missing?

CodesInChaos

You're missing unicode

AviD

or rather, missing non-unicode.

but if you work at the character level, not byte-level, it rarely matters.

CodesInChaos

11:25

reversing an ASCII string is trivial. For unicode you need to deal with surrogates and combining marks

Try this one as a simple example "äo"

AviD

> Seeing as how the VP is such a VIP, shouldn't we keep the PC on the QT, because if it leaks to the VC we could wind up MIA and then we'd all be put on KP.

Gold. Been clicking through to other clips....

Rory Alsop

Ahh - it's been too long. Need to watch it again.

AviD

I did watch it about a year ago. Doesnt hold up as well as you would expect :-(

or perhaps its because I know almost all the dialogue (at least the funny bits) by heart

TildalWave

11:57

@RoryAlsop pyrotechnics? you have pyrotechnics? pyrotechnics suck! you know why they suck? cuz we didn't have them! i'm so effin jealous now!!! what's next? you're gonna tell me you had a foot switch as a trigger??? all i had was a service hole in the middle of a garage to fall into every now and then, if i got too excited :(

Rory Alsop

@TildalWave hahahahaha - for our bigger festival gigs this summer I have a pyro company on hand to do some bigger pyrotechnics (ie 30 foot flames, explosions and better quality guitar fire!)

TildalWave

@RoryAlsop Rammstein? Then you must've heard of Laibach! My neighbours :P

Rory Alsop

@TildalWave Yup, although I have to admit I first heard of them because of this:

rathergood.com/laibach

TildalWave

@RoryAlsop yes yes brag about it... go twist it deeper!!

2

Rory Alsop

@TildalWave I just want to do what Rammstein do with fire. Although I am going to see them headline on my birthday this year, so will see if I can lose eyebrows!

TildalWave

12:00

@AviD sorry I got confused ... I watched so many of them I forgot which one I put in my own link LOL

Laibach (band)

Laibach is a Slovenian and former Yugoslav avant-garde music group associated with industrial, martial, and neo-classical musical styles. Laibach was formed in 1980 in Trbovlje, Slovenia, at the time SFR Yugoslavia. The band represents the music wing of the Neue Slowenische Kunst (NSK) art collective, of which it was a founding member in 1984. The name "Laibach" is the German name for Slovenia's capital city, Ljubljana. History Laibach with Tomaž Hostnik (1980—1982) Laibach was formed on June 1, 1980 in Trbovlje, a mining-industry town, taking the name used during the World War II o...

these guys have their own virtual country.. .you can apply for their passport LOL

Rory Alsop

@TildalWave hahaha

TildalWave

I must say I'm cheap and like Rammstein kinda better, but Laibach was like a project, and a huge one, with tons of goodies and a few neat surprises... kinda like Quality Street

►

candy :)

Rory Alsop

@TildalWave that is not at all what I was expecting!

right QoTW 44 is published, I have a post scheduled for next Friday, and QoTW 45 the week after

TildalWave

@RoryAlsop hehe indeed. I see them as an anti-Yugoslav movement in rock and this was a nail in the coffin, they proved they can be liked by everyone

AviD

@TildalWave didnt wait for the whole thing, but that is a bit gospel-rock-ish. Didnt expect that to show up in a conversation with @Rory....

TildalWave

12:17

@AviD Man I had to, ya'know :) Variety ;)

AviD

@TildalWave Isn't that what SHE told you?

TildalWave

@AviD Anyway, should list their other works... ANY others would be a pretty big contrast to the one I linked here lol

@AviD indeed she did

AviD

Just noticed that OWASP published a release candidate for the new set of Top10 for 2013.

Nothing too drastic, mostly fixed some of the things that bothered me in the 2010 set.

Adnan

@AviD Damn it! I came here to say that!

AviD

hehe, it's all in the timing.

TildalWave

12:21

@Adnan imitation is the greatest form of flattery ... so you might want not to :)))

AviD

@TildalWave why, thats never stopped him before.

TildalWave

@AviD cheeky!

Adnan

@AviD Maybe you're the one who imitated me.

AviD

@Adnan Maybe you're the one who imitated me.

TildalWave

AviD

12:24

FTFY

Adnan

@AviD Solid logic

TildalWave

@AviD yeah... damn those blog servers that don't accept image linking! why do they think we're there? to read texts? pppffff

AviD

@TildalWave too many words. can you stick that in an image for me? Hopefully with a cat.

Rory McCune

@AviD @adnan if you're interested there's loads of "discussion" about it on the mailing list for the top ten...

Adnan

@AviD I don't like cats!

Rory McCune

12:27

I have a feeling it's going to end up being fairly political

AviD

@RoryMcCune hmm, I should go into that folder once in a while.

Adnan

@RoryMcCune What are the controversial issues?

AviD

usually too much noise for me, cant filter for the SNR. just avoid it unless I'm looking for something.

TildalWave

AviD

@Rory did you see codinghorror.com/blog/2013/03/why-ruby.html ?

Rory McCune

12:29

@Adnan well there's whether Application DoS gets onto the top 10 (it's not there at the moment) also the new A9 (don't use components with known vulns) is causing stress as it would be very hard to test for

@AviD yeah :) seems reasonable. building an OSS community on a propietary platform is tricky...

AviD

@RoryMcCune s/test/pentest/. So who cares.

Rory McCune

@AviD ah but a lot of vendor claim their products test for the OWASP top 10

AviD

@RoryMcCune app dos shouldnt be there, its not a flaw or an attack, its a result. It's usually done via injection (still A1, I think...)

Rory McCune

tricky to do if it can't be done

AviD

@RoryMcCune hahaa, exactly!

Rory McCune

12:30

also PCI compliance automatically rolls forward to 2013 when it comes out

AviD

not just vendors, consulting companies too (who only do pentest).

so you review it at a code level, or design level.

Rory McCune

@AviD well there's resource exhaustion attacks (hitting a heavy transaction repeatedly)

@AviD yeah but then you need to track every library you use and have a DB of vulns

AviD

@RoryMcCune aka Flooding. one subset of AppDoS, not quite the same... and not far different from "regular" DoS....

Rory McCune

can be done white box (DLL versions etc) but not really black box

AviD

@RoryMcCune shouldn't everybody anyway?

@RoryMcCune I agree 100%. and I'm not bothered by that.

Rory McCune

12:32

@AviD yeah but do you reckon they do.... how many old versions of OpenSSL do you think are in use....

Adnan

@RoryMcCune I see, that would cause some controversy

AviD

I seem to remember some really smart guy saying once, "Pentesting must die".

Rory McCune

@AviD not but black box testers/vendors are thus the politics....

@AviD oh hell yeah but I don't think they'll go softly into that dark night....

AviD

@RoryMcCune exactly, hence the problem - they need to fix that!

Stack Exchange

Stack Exchange Security Blog: QoTW #44: How to block or detect user setting up their own personal wifi AP in our LAN?

roryalsop on March 22, 2013

Nominated by Terry Chia, this question by User15580 should be of interest to anyone managing the security of network s.

The show the variety of aspects security covers in this sort of scenario:

Daniel posted the top answer, and it has nothing to do with IT, but instead focuses on the cause – if a user has installed an access point it is because they need something the existing network is not providing. This is always worth considering:

Polynomial and Thomas Pornin also highlighted the fact this is a user/managerial problem, rather than a technical one. …

AviD

12:33

hahaha, so?

Symantec complained when MS put some kernel level protections into the OS, protecting against many types of malware - including their broken model of AV. So? Just shows who is really a security company, and who holds Gibson as their spiritual leader.

@StackExchange @RoryMcCune well done! Kudos.

Terry Chia

> Ruby isn't cool any more. Yeah, you heard me. It's not cool to write Ruby code any more. All the cool people moved on to slinging Scala and Node.js years ago.

Words of wisdom.

Rory McCune

@AviD Oh yeah I remember that question.. I'm actually a fan of NAC, it gets a lot of hate but I think it can be a useful line of defence

AviD

you know he's using the word "cool" pejoratively, right?

Rory McCune

@AviD Oh yeah I remember that question.. I'm actually a fan of NAC, it gets a lot of hate but I think it can be a useful line of defence

Terry Chia

@AviD yes..

AviD

12:38

@RoryMcCune do you remember that question?

Rory McCune

@AviD on a flaky mobile phone connection :op

it keeps asking me to retry...

AviD

@TerryChia as in, the skiddies who don't know much about software engineering, development, or programming...

@RoryMcCune haha

Rory McCune

anyway I gotta go find out how badly my garage is going to try and gouge me for a repair...

AviD

oo, not fun. Leasing FTW.

Terry Chia

@AviD I got that. That's why I said they are words of wisdom. I freaking hate Node.js.

AviD

12:40

@TerryChia yeah, don't get @Polynomial started on Node.js...

He hates it almost more than I do.

Terry Chia

Hmm, I am getting 60FPS on D3 with everything maxed out. Lower performance than I expected.

Lucas Kauffman

hello there everyone

how are things going?

TildalWave

morning @LucasKauffman

Terry Chia

@LucasKauffman Hey. Awesome - just got a new graphics card in my system. :)

TildalWave

@TerryChia ouch you might wanna have that checked! :P

AviD

12:43

@TerryChia updated drivers? overclocked it? wide enough PCIe slot? how much memory? Can the monitor support more?

60fps is not bad, but not great.

TildalWave

I like them cool and quiet :)

morning @ThomasPornin!

Adnan

@LucasKauffman hello

@TerryChia What is it?

Terry Chia

D'oh, I had vsync on. No wonder.

Jumped to 120 FPS right after I turned it off.

@Adnan Powercolor HD 7850 PCS+.

AviD

@TerryChia brilliant. Something to keep in mind...

@TerryChia how much memory on board?

btw @TerryChia Gigabyte's Aivia Osmium mechanical keyboard

Terry Chia

@AviD 2GB.

AviD

12:49

@TerryChia good, good.

Terry Chia

@AviD Ah right, almost forgot. I had a chance to play with the Rosewill keyboards for a while. They are pretty nice.

Adnan

@TerryChia Have you tested it with anything yet?

Terry Chia

@Adnan Playing DIII right now. :)

I'll probably give Devil May Cry and Bioshock Infinity a go in a few days - they came with the card.

TildalWave

@AviD This one is with sound, freaking awesome! I posted in my answer those crackling sounds are probably just cavitation, you concur? youtube.com/watch?v=AzRmYud0HR4

Now all I have to do is move house and office next to the water, rob a bank for $100k and stop drinking coffee :)

AviD

@TildalWave I wouldnt know, though if I had to guess I would probably say its not a quiet engine. And, why should they bother?

Adnan

12:54

@TerryChia how much did it set you back?

Terry Chia

@Adnan About 205USD after conversion.

TildalWave

@AviD I just found it interesting, bcos you're usually not bothered by the sound of cavitation in a watercraft, but this one is nearly submerged most of the time... it's the beast's mating sound, like on a good streetbike but... different

Adnan

@TerryChia Wow! Very reasonable price

AviD

@TildalWave haha, that is a bit interesting, considering the ship is designed like a whale...

Thomas Pornin

@TildalWave Hello

Terry Chia

12:58

@Adnan It's a very mid-ranged card. Enough for my needs though.

AviD

Just hope none of the local orcas decide to take interest in you while you're underwater.

Especially not a sperm whale.

TildalWave

@AviD LOL not sure they can do 55mph tho so you'd be fine

Thomas Pornin

@AviD Notwithstanding your attempt at making double-entendre, it is highly improbable that any whale identifies that nifty submarine as an orca: these beast work with sound, not looks.

TildalWave

@AviD or... take matches with you and start lying

AviD

@TildalWave well I'm sure they mate while in motion...

TildalWave

13:02

@AviD that's what she said?

Thomas Pornin

@TildalWave orcas and dolphins top at about 35 mph -- which is still impressive (that's noticeably faster in water than Usain Bolt on land).

AviD

@ThomasPornin no double entendre intended, I was noting his ambiguity.

Which, by the way, referred to the sound it makes, anyway. So I claim it was scientifically appropriate, in context. ;-)

@TildalWave dont get it?

TildalWave

@ThomasPornin yeah wow that's fast!

Pinocchio

Pinocchio (IT: ; ; ) is a fictional character and the main protagonist of the 1883 children's novel The Adventures of Pinocchio, by Carlo Collodi, an Italian writer, and has since appeared in many adaptations of that story and others. Carved by a woodcarver named Geppetto in a small Italian village, he was created as a wooden puppet but dreamed of becoming a real boy. He has also been used as a character who is prone to telling lies and fabricating stories for various reasons. Fictional character biography Pinocchio is known for having a short nose that becomes longer when he is under...

AviD

@TildalWave ohhhh right, sorry

TildalWave

@AviD funny I got a nice answer badge on that answer and all it is is a bit of google-fu with commentary

I kinda hate it that there's more to questions/answers being popular than how well they're written/researched/ or indeed otherwise helpful. Panem et Circenses I guess

Saladin

13:12

hello people...:-)

i want to ask a question?

its related to your choice dynamuc and static code anslysis tools

Adnan

@Saladin Is that your question?

Saladin

yes

im on my mobile my spellings suck i appologize

Rory Alsop

so far it isn't a question...

Iszi

@TildalWave Reminds me of a tweet I saw the other day: "What will happen if Pinocchio says 'My nose is going to grow right now.'?"

TildalWave

@Iszi that means you'll be hearing a lie, at least down my turf... you'd usually say that in a humorous self-reflective way while avoiding a true reply for some reason, and it's kinda rhetorical so a bit strange to see it as a title to a tweet post

@Iszi unless that was a reply

@Iszi i.e. don't ask and I won't tell no lie

reminds me...

►

@RoryAlsop - no need to click :P

Xander

13:27

@TildalWave I think the tweet was trying to describe a paradox. If his nose isn't going to grow, it's a lie, and his nose will grow. If it's the truth, his nose won't grow, and it's a lie.

Thomas Pornin

@Xander "It does not compute"

TildalWave

@Xander Oh you've never been here then, we're a definition of a paradox :)

Adnan

Here's the thing, Pinocchio's nose grows when he lies, but lying != not telling the truth.

Iszi

@TildalWave Nevermind. @Xander already covered this.

Adnan

So saying my nose will grow now while knowing that his nose will not grow, that's a lie.

Saying "My nose will grow right now" while genuinely thinking that his nose will grow, even if his nose doesn't grow it won't be a lie.

TildalWave

13:29

@Iszi Frankly I've never seen it used in a paradoxical sense before, but yeah it makes sense. I also rarely tweet or read blogs TBH

Adnan

You've all been Adnaned!

TildalWave

hmmm.... is paradoxical sense an oxymoron?

@Iszi I imagine that was a security related tweet? Because we have something similar here but I can't remember in which answer... probably a @ThomasPornin one?

@Xander Good morning Sir! :) Nothing better than a quick paradox in the morning, huh? :))

ah uh oh I remember where I've seen it applied to security related logic... brb

Xander

@TildalWave Morning! Breakfast might be better...But that's about it. :-)

TildalWave

youtube.com/…

Transcript for