The DMZ

3:02 AM

nawrasyghgh!

3:17 AM

Anyone around?

@D3C4FF aye... all ok there? you were typing in cipher before

@TildalWave I was talking in headdesk before

@D3C4FF ah you might wanna get one of those ostrich pillows ;)

Okay. Hypothetically, a web app has a page where it expects a POST of {"AppToken": "123", "ID": "user", ExtrData: [{Key:"OtherID"}]

If i change otherID to something like <script>alert(1)</script>

it echoes it back on the page and executes

While its executing JS, i'm not sure if it constitutes a vuln, because how will a client send a structured POST request to the site like that?

@TildalWave I made one of those once. Super toasty. but a bit stuffy

@D3C4FF I don't get it, why wouldn't a client be able to do that? What's stopping him?

What's the handler doing with this POST?

3:28 AM

Why would a client try to XSS themselves?

A client can do it, but i can't see an attacker who isn't the client doing it?

I'm pretty sleep deprived, so i feel like i'm missing something obvious

@TildalWave It generates a token for a secure sign on session. Then echoes back the response on a page with no data other than the response (structured similar to the original request and containing the OtherID param)

@D3C4FF Well the question is what happens with this data on POST and where it's later used... I doubt there's much point in only displaying something new on page in a discrete manner only, that doesn't even require POST request

@TildalWave Ack. Yep. That's where i'm forgetting things... -_-

The page by itself isn't an issue, but whatever other part that pulls the request from the application might be.

@D3C4FF yup... and if it's script injectable, you should check for SQL injections also then

token forgeries, SQL injections, DoS,... all kinds of possibilities besides XSS, CSRF, that might actually be beyond the point there.... Have you run some fuzzer on it and tried crashing it?

You should also check for possible timing attack on token generation

@TildalWave Yeah i fuzzed the shit out of it

@TildalWave Checked for the usual suspects. As well as weak tokens etc

seems relatively solid

@D3C4FF where's that OtherID handled, have you confirmed it doesn't have any effect on server whatsoever?

3:41 AM

Dont have access to the actual implementation sadly, so i cant test it. Literally, i'm testing three pages.

@D3C4FF Have you tried overriding parent structure parameters in the ExtrData structure?

@TildalWave Yeah, it just rejects them as an 'invalid submission'

@D3C4FF Dunno then, if you don't get anything suspicious out of it with a fuzzer working on that OtherID, then it might be just passed along in app ... so you're left with how app handles template hooks and stuff like that... if at all,... but if it's recursive, you might get lucky triggering some other response than intended, have you figured it out in what lingua/webAPI it's written?

@TildalWave It looks like its using something called liferay

www.liferay.com

based on some of the errors i get from it

but thats a guess...the server doesn't do/demonstrate very much. All i know is its an win 2k8 R2 box.

Basically, what you're looking for is if it has some internal parser and if it's enabled on handling POST... if it is, then technically you could inject any parsed tag with params into that OtherID and make it do anything it's supposed to handle with those... also check for any server-side scripting that you could inject, tho that would work much the same as trying to fiddle with the parser

3:56 AM

@TildalWave But i don't have access to the box, the code or the resulting pages which may use this info. So i'm blind

> VM (Velocity Macro): Velocity is a scripting language that lets you mix logic with HTML.

liferay.com/documentation/liferay-portal/6.1/user-guide/-/ai/…

> FTL (FreeMarker Template Language): Freemarker is a templating language which could be considered a successor to Velocity, though it is not yet as popular.

these should both be disabled on handling POST requests

there's probably more, but I'll turn in for the night so you're on your own... try calling something simple in VM or FTL from within that OtherID and see if it's enabled

people.apache.org/~henning/velocity/html/ch07.html

Yeah it flips out a bit if i send it <br> #macro( d ) <tr><td></td></tr> #end
</br>

@D3C4FF well there you go... try printing some internal variable with macro... #[whatever]... or set your fuzzer to stun :)) I'm off, take care ;)

@TildalWave Cheers dudeski

catchya later :D

Stack Exchange

4:36 AM

If we get the doors open and plug up the dam on the Sirannon so the water rises a little, the pool will start draining into Moria. How do you think the Watcher would fare against a drenched Balrog?

6:04 AM

@Adnan I have only asked 1 question, so what does that say?

6:28 AM

@this.josh What?

watt = amp * volt

@Adnan I'm as confused as you are... :P

Damn it! I lost my nail clipper

My life is over!

@D3C4FF I came to expect less and less from life. I'm not even gonna ask for a clarification.

@Adnan Oh wait. The watt thing was a joke >_> ...... At least i think it was..... <_<

@D3C4FF I was wondering about the one before

6:40 AM

@Adnan Whats news with you?

@D3C4FF Woke up to see a gigantic bee buzzing in my room, our neighbour are mowing their lawn, lots of kids are playing in the near backyard. It wasn't a good morning.

aaaand I lost my nail clipper!

I joke because I lack the intellectual capacity to converse

3

@this.josh It says you have no questions you want to ask in here :-)

Morning all

@this.josh I think we all do.

@RoryAlsop Morning

Damn Rory that is way too close to the truth.

6:47 AM

Well I do know a couple of folks who would not ask the questions they need answered in here - information leakage is a serious issue for them

@D3C4FF Oh, not only that. Now I have to setup my new laptop.. it's gonna take ages to make it as cozy and comfy as the old one.

Okay, I'm all out of whining energy now.

@Adnan Sounds like a shit way to start the day...

Anybody knows a good way to dispose animal guts?

How is a laptop cozy and comfy?

Usually feed them to other animals.

@this.josh All the files and applications are under the same pixels on the screen. I don't have to look for something, it's just there. When I login, it'll automatically try to mount my TrueCrypt volume, prompt for the password then tell Firefox to get my profile folder from there. When I lock my computer, it'll automatically unmount the TrueCrypt volume.

The FoxyProxy settings for some sites to use my home connection while I'm at work

literally, tens of configurations.

6:55 AM

My Truecrypt volume never leaves me, it boots and will run with Windows, OS X, Linux, and BSD.

@Adnan Fire/bin/other animals

@this.josh Hmmm.. feed them to other animals. Interesting.

@D3C4FF I cannot just through in a trash bin, and fire is too messy and it'll attract too much attention. I guess I'll just leave them in the woods somewhere far, other animals will eat them.

Oh, or better, I'll bury them in the woods and let nature do its job.

What all in one place?

you should use a random scatter distribution with at least three suggested foci at one confidence interval

@this.josh Well, I don't have a lot, 3 rabbits and 1 squirrel.

Oh yeah, @Lucas . Apparently, it's not even legal to hunt small game with a .22 firearm.

7:19 AM

@Adnan if you hunt small game with anything larger than .22 there won't be much left :/

Gilles

7:30 AM

@AviD it's a random list of tips. It's better than most, but still a list of tips, and unmaintained. The wisdom should be split into multiple, more focused questions (many of which already exist on the site). I don't see a way to salvage it as a Q&A pair.

7:53 AM

@StackExchange I guess we need to start calling each other "mellon"...?

@RoryAlsop mellon

@Adnan stuff 'em into a sheep's stomach lining. Deep fry. Enjoy.

@Gilles well, thats why I didnt take action on it, especially at 1AM when I got back...

But I'm not sure I agree. It should be maintained, sure, but that doesnt really happen...

perhaps the best solution really is the modlock.

8:22 AM

@AviD that sounds crazy...oh, wait...

mellon

8:48 AM

@RoryAlsop coincidentally collegehumor.com/video/6882485/hardly-working-standing-desk

@RoryAlsop heh, Haggis FTW!!

I always wondered, does it taste as awesome as it sounds?

@AviD Ohh.. ewwww!! Haggis!

@AviD If I eat it with my eyes closed without knowing what it is, I have to be honest and say it's pretty tasty.

Anyone else attempting the Matasano Crypto Challenges? Appears to be quite good fun. :)

I was wondering are there any vegetarians present?

@LucasKauffman the normals ate them all.

reminds me of that show I watched yesterday

it was called Hannibal

pretty damn good

8:55 AM

@LucasKauffman Oh yeah! VERY good show!

Very classy. The use of gore isn't for shock value, it's just to support the story.

@Adnan there is a lot of gore though

still Dr. Lecter is my favorite villain ever

@LucasKauffman Same feeling here.

Antony Hopkins is still the best one though

@LucasKauffman I dont think Hannibal would eat vegetarians. He's a cannibal.

@LucasKauffman more than GoT?

Also. Did you ever see Cannibal! the Musical?

@LucasKauffman True, but I'd still say that I like this TV show more than the movies.

9:02 AM

@Adnan Even without Jodie Foster??

@AviD not the musical, it's different from GoT

@AviD Not a big fan of Mrs. Foster

Anybody using Kerberos Single-Sign-On?

I can't get it to work with Firefox

9:31 AM

@AviD Oh yes! The kids had haggis pizza last night. I'm sure there must be kosher haggis

@RoryAlsop sure, most of that stuff is kosher. Just not a common food here. Maybe I should get MarkW to cook me up some... :P

@AviD :-)

A: Advice on what to do after being hacked?

0

i have a huge problem! i downloaded a mod for minecraft and it...corrupted the files so it wouldn't open anything but luckily i still have SOME items that i can still refuge. what do i do! i can't even go on google earth that it's that bad! HELP!

@RoryAlsop Is haggis a lot different from blood sausage?

9:47 AM

@LucasKauffman yep. It is meat, not blood :-)

@RoryAlsop ah yea you use like the organs rather than blood

never had it wonder if I can get it here

@RoryAlsop closest we have to that is the East European kishkah

Kishka (food)

Kishka or kishke (; Belarusian кішка, kishka; ; Romanian chişcă Silesian krupńok; Yiddish kishke; Hebrew קישקע; Russian Кишка; Ukrainian кишка) refers to various types of sausage or stuffed intestine with a filling made from a combination of meat and meal, often a grain. The dish is popular across Eastern Europe as well as with immigrant communities from those areas. It is also eaten by Ashkenazi Jews who prepare their version according to kashrut dietary laws. The name itself is Slavic in origin, and literally means "gut" or "intestine." Description One Eastern European kishka type is k...

hmm. seems that has some in common with blood sausage, according to wiki... depending on the locale.

Okay, another question. Any way to make IE8 work with SOCKS5 proxy?

@Adnan it doesnt?

did you set the proxy details?

@AviD Yup, didn't work with SOCKS5

9:57 AM

oh. cant say I have experience with it, just expected that to work...

10:28 AM

@Adnan the question isn't why SOCKS5 isn't working with IE8, the question is why are you even using IE8?

@LucasKauffman hahahaha

@LucasKauffman Every single time I mention IE, I get the same question. I work in a corporate environment, I have to test certain things on all major browsers. It's not my choice that what I do should work on IE.

I can't go to my project manager and tell him "Hey, IE sucks, go tell our 100,000-employee client to change to IE, my app won't support IE"

@Adnan poor you :(

@Adnan no no, you're missing his point. It's not at all that IE sucks - it doesn't - the question is why you - or rather "they" - are still on version 8.

but yeah, corp managed machines still covers that :-(

10:48 AM

I'm so angry! I'm sure I'll take it on the next question I don't like!

@AviD we are also still on IE8, last year tho

yeah, I remember back when I was full-time corporate developer, I had to support IE5. Kept causing problems...

Luckily I managed to get management to agree to ignore those that were still using IE4 - on Win98... 'course I had a rather more limited subsection of direct users, so...

@LucasKauffman Yeah, that's really a big issue for me with SVG for example. It sucks!

@AviD Daaaamn! You're old.

@Adnan what? this was last year.

kidding! yeah, this was around 9 years ago...

@AviD IE4.. Win98.. last year..

@AviD Oh! You nearly gave me a heart attack

11:00 AM

lol, yeah still was pretty bad, but you know how they are....

I had a project once which was almost finished written in html5 and css3 with custom fonts

suddenly the client comes to me and says "Ow yea we work with IE6"

that made me cry a little.

@LucasKauffman Come here.. come to safety.

@Adnan for some reason that came over quite creepy

@LucasKauffman Hmm.. if you take out "come to safety" it woks very well with crying girls.

@LucasKauffman "for some reason"....?? Look at the first word on that line.

11:24 AM

@AviD "for"?

@Adnan @Adnan ;-)

...mellon

@RoryAlsop Mellogoth!

12:01 PM

@Poly That blog post by Nick is very interesting

Polynomial

@Adnan Yup. Really opened my eyes to the reality of deployment.

12:23 PM

@AviD those are similar to haggis, you're probably confusing them with quite similar looking blood sausages that might also contain some organs like liver, kidneys and spleen, so organs that in some way process blood, but those are called different... for example in my language, the Wiki post you link to says "kašnica" (would translate to meal sausage or something like that), and the blood sausage is "krvavica" (translates directly to blood sausage).

What a coincidence! Today I started the process of setting up Kerberos SSO, and 2 related questions popup.

@Adnan which one?

One of them is yours @Poly.

Gents

@AviD nickcraver.com/blog/2013/04/23/…

12:24 PM

@Adnan ah yeah. working at that level of scale really is different.

I'm glad we finally got a response other than, "SSL is haarrrdddddd!"

2

@TildalWave well... not quite haggisy enough. For one thing, its not fried... and for another, its mostly intestines (+ some other stuff). The wiki page was the one that said its similar to bloodsausage....

@AviD Well, if you check the last part, you'd see that their biggest problem has nothing to do with overhead. The biggest problem is the certs

@Adnan yeah, I know - scale isnt just traffic. It's the number (and layout) of domain names.

There are still ways to handle it reasonably. For example, we pay a yearly fee to our SSL signer. For that we get an unlimited number of single name server certs all handled through a self-service system.

So we can self-service sign anything so long as it's under ohio.edu. Number of total certs doesn't matter, number of subdomains doesn't matter...

12:29 PM

@ScottPack This is brilliant!

@Adnan Two additional nice features of our setup. 1) Extremely granular delegation rights based on subdomain. 2) Published API so you can have a local app do everything without having to use their system.

@ScottPack How much are you paying for something like that?

@TerryChia Reading my mind

@ScottPack Also, as far as you know, any downsides for adopting that in the StackExchang case?

@AviD Wiki is often wrong... problem with that page is they tried to stuff too many different things into a single page, and yes as you said it's not the same really... but we do have sausages quite similar to haggis too... actually, the closest is not a sausage at all but what we call a stuffed stomach... it can be also dried and made into delikatessen, but also eaten cooked and hot like haggis

@ScottPack Plus is that a service any company can purchase or is it because you guys are an educational institution?

12:39 PM

@Adnan heh heh - just gives me a mental picture of a happy, chilled out dude in black eyeliner :-)

2

hello guys sorry for being quick

can someone recommend me a vulnerable iso / test web-application for hacking exercise..

A: How to make a site vulnerable to SQLi?

11

Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web. A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.

i already used dvwa

anything else

@Saladin webgoat like my answer mentions as well.

hm

webgoat do i need vmware or there is a windows installation for it

12:50 PM

@Saladin owasp.org/index.php/WebGoat_Installation#Installing_to_Windows

ok thanks

let me check it

@Saladin Might wanna check out hackthissite.org for web app attacks as well.

ok thankyou i will do this to

too*

I liked google gruyere. Plus, it's cheese.

can i run gruyere on windows locally using xamp

?

12:57 PM

@TerryChia It's a US based educational thing. It's InCommon which is an Educase sponsored Internet2 venture.

@TerryChia Pricing is based on your Carnegie designation, so a combination of size + highest degree granted + research produced

@TerryChia It's pretty cheap. The most expensive package they have is 20k USD and it goes all the way down to $1.5k incommon.org/certificates/cert_fee.html

@Adnan For this specific organization..yes. StackExchange wouldn't qualify to be a customer. It does, however, demonstrate that such things exist and may be worth looking for in a signer.

@Saladin its online only. All you need is a browser.

@ScottPack So it could be possible to have something similar for an organization like StackExchange.

1:38 PM

@Adnan Not from our vendor, but there's no reason why another vendor couldn't do it.

All this talk of cheese makes me want fondu.

@ScottPack I want to join in

@ScottPack @Lucas Isn't that what you do your girlfriend on her birthday?

Or when she's mad at you

@Adnan nah I take her to the veggie restaurant then

@LucasKauffman Is that an innuendo?

@Adnan You do your girlfriend with fondu on her birthday? Missing words can change the meaning of sentences my friend. :P

1:47 PM

@TerryChia God damn it!!! "you do with your girlfriend"*

@LucasKauffman I imagine if anyone knows fondu it would be you.

@ScottPack but but but but he likes girls!

what has molten cheese got to do with girls?

That's what I'm wondering.

@LucasKauffman Maybe ask @Iszi?

1:51 PM

@ScottPack with what margin did you loose?

@LucasKauffman I've always perceived fondu as something girls eat/do when they have slumber parties.

@LucasKauffman The SF election, you mean?

@Adnan nah that's chocolate fondue

@ScottPack aye

@LucasKauffman opavote.org/results/1584042/0

didn't expect michael to get so much votes

1:52 PM

Looks like I came in 4th behind Ward.

I expected tom and you

@LucasKauffman I know. Both Tom and Michael tend to be rather...rude. I imagine it was mostly based on rep.

@ScottPack For some of them, I'm surprised they even got votes.

EC got 14 first place votes!

@ScottPack Tom is still sensible, michael is a bit more straightforward

1:53 PM

@LucasKauffman Is there any other kind?

@LucasKauffman Oh definitely. Tom takes more to be not nice. Michael pretty well starts there. :)

@Adnan cheese

Or oil.

foodnetwork.com/recipes/good-eats/fondue-vudu-recipe/index.html

Yummo

I like it with 4 cheeses and a bit of kirsch

@Lucas @Scott Okay, I've just read a bit more about it. I have a totally different view of fondue now.

1:56 PM

@LucasKauffman Oh, interesting. I can see that.

@Adnan Yeah, traditional fondu has been cheese and bread. Oil and chocolate are fairly recent.

@LucasKauffman Any particular cheeses?

@ScottPack Gruyere,Emmentaler,Cheddar and Fontina

@LucasKauffman Sounds amazing!

This is interesting: pwnie-express-dev.myshopify.com/blogs/pwnie/…

@LucasKauffman I like the sound of that.

This guy has no clue:

@LucasKauffman I'm not saying it's the same for every connection. What I am saying is the reason ebay may not have SSL on every page is because once the Symmetric Key is determined they will use it for a certain amount of time. From what was said in class at USU was that the more messages that are encrypted with the symmetric key the easier it is to break. In an ideal world the symmetric key should be thrown away after one encryption is what I was taught. So, I'm just think eBay may do it to protect that specific user's session. — Travis Pessetto 3 mins ago

2:03 PM

@LucasKauffman facepalm

> From what was said in class at USU was that the more messages that are encrypted with the symmetric key the easier it is to break.

What cipher has he been studying?

@TerryChia caesar

I hope

@LucasKauffman and I hope it's not the one Dan Brown talks about.

@Adnan hahaha! Digital Fortress is a funny book.

I don't know why I clicked this but nsfw (sort of) youtube.com/watch?v=y0A77rohcyg (Title: Turtle moaning while having sex)

@TerryChia Well, when I read it I was 13, I thought it was awesome.

Of course, now that I know better, I can see the comedy.

2:09 PM

@TerryChia Digital Fortress is a ridiculous book. I stopped reading Dan Brown completely after that.

@Adnan Well, I like Dan Brown's stuff. Totally unrealistic but decent enough as mindless entertainment.

@TerryChia I have television for that

@Xander Oh come on! Really? Now you read Paulo Coelho?

@TerryChia I'm all for mindless entertainment, but for me, suspension of disbelief only goes so far before I stop being entertained and start being annoyed instead. Dan Brown crosses that line for me.

@Xander I think it's a very okay book. Again, I've read it when I was very young, so I didn't know crypto stuff at all. Plus, it's a sci-fi book.

To be fair, I haven't read anything else by Dan Brown

2:15 PM

@Adnan Hmm...Never heard of Paulo Coelho, so I'd have to say no. :-) For me, when it comes to computer-y novels, I like Russinovich's...The writing could use a bit of polishing, but the material is good, and I enjoyed Suarez's Daemon. It also required the suspension of disbelief, but at a level that I found acceptable and entertaining.

you should read Freakonomics

@LucasKauffman Have it, haven't gotten around to reading it yet.

@Xander I had it as audiobook for a trip to amsterdam, it's pretty good

@LucasKauffman Cool. They have a podcast that I listen to occasionally, and it's quite good, so I imagine I'll enjoy the book as well.

2:29 PM

digital fortress was terrible, however I thought his fourth book...the one in the snow...was by far his best.

"deception point"

however dan brown is still terrible overall

@lynks I started that one, and never finished it. I would like to go back and read that one. Won't read any of the rest of his stuff though. I read The Da Vinci Code and Digital Fortress, and between the two of them, that was enough for me to give up on his writing.

@Xander i wouldn't bother going back for it personally.

@lynks LOL. Ok.

@Xander stick to the good stuff; niven, gibson, azimov, lovecraft

@lynks This gibson? attrition.org/errata/charlatan/steve_gibson ;)

2:37 PM

@TerryChia this one, silly

amazon.co.uk/William-Gibson/e/B000AP5DM0

@RoryAlsop hehe, just teasing him.

@TerryChia haha you know better than that.

@Xander heh never wanted to read his books but I did pretend for fun a few times that I did... turns out you can just make stuff up as you go and it comes out just as if you did, one of my mates was slightly offended when I told him at the end I never read it :)) I know... a bit mean of me, but was an interesting experiment

@lynks You know, I really haven't read a lot of science fiction, but I do love Azimov. I've read most of the foundation books, and one of these years (next year, probably) he's going to be one of the authors I focus on. I'll take a look at the others.

@TildalWave LOL.

@Xander for gibson; read his most famous work "Neuromancer", for niven "Ringworld", and for lovecraft... there are so many, but one of my favourites is "At the Mountains of Madness"

2:40 PM

@lynks ahhh - Lovecraft

@lynks All right then, I shall put them on the list.

Of my home library, just over 4400 books are sci-fi. The remaining 200-odd are other genres :-)

@Xander neuromancer and ringworld are doable in a day each.

I'm a bit of a sci-fi buff :-)

@RoryAlsop Wow! That's impressive!

2:41 PM

so I recommend it for anyone

(I did get about 2000 books in one tranche, from a library that was getting rid of them)

i just realised I've had "the beards - born with a beard" on repeat for the last few hours.

@Xander that was for The Da Vinci Code... of course all I knew about it was from other media spinning it as most fabulous... funny thing is this works for Carlos Castaneda's later works also, tho they're mostly still worth reading if you're in that age IMO

@D3C4FF how's your pen-test going?

@RoryAlsop That's a nice score!

@TildalWave That was the most disappointing thing about the Da Vinci Code. It wasn't a terrible book, but it was way over-hyped and sold as this "well researched historical novel" which it just wasn't. It was an engaging read though, I'll give it that.

@Xander I resisted all the brainwashing somehow, I think I was fairly deep in some projects that isolated me well enough from the rest of the world... it's sometimes quite scary what world you come back to after being away for quite some time

@Xander all 50's and 60's pulps. An excellent collection

2:56 PM

@TildalWave I've been away for quite some time now. All my senses of the outside world are routed via a length of ethernet cable.

@RoryAlsop Very cool. That sounds like it'd be a lot of fun. The only works I have from that era are Azimov's, and a bunch of Tom Swift novels that I used to love when I was growing up. Really good stuff.

Q: Can keys & logins be kept out of program memory?

3:39 PM

0

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will be stored there to perform encryption and logging in, and an attacker can physically read from RAM. Is t...

Here he goes again.

I'm pretty sure a dupe exist.

3:50 PM

@TerryChia I probably should have checked for a dupe

@lynks Maybe not a dupe exactly. I just recall reading an excellent answer on memory access by The Bear.

But eh, no shame in a little repwhoring!

@Xander Lots of Heinlein, Niven, Asimov, Silverberg, Dick, Sheckley, Simak, 'Doc' Smith, Vonnegut etc

@TerryChia yeah so do I...was it on something about DMA?

Q: Are passwords stored in memory safe?

@lynks Possibly..

170

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's allocated memory. But I also think this is somehow bypassable. So I wonder if it is really safe a...

passwords operating-systems memory

Boom.

Question isn't an exact dupe, but the answer fits perfectly.

@RoryAlsop Any particular favorites among them?

3:55 PM

@lynks well in this case, here's a quick update: noob.co.in/Adnan/of%20Sec.SE/StackExchange/earthquake

3

@TildalWave That's....... AWESOME!!!

@Xander All of Niven's stuff, including his work with Pournelle. Mote in God's Eye, Ringworld series, Footfall

Any Asimov, especially the I Robot series

@RoryAlsop Noted. Thanks!

Obviously Philip K Dick had some awesome stories - more and more of which end up as Hollywood blockbusters:-)

@RoryAlsop In that case, you'd probably also love stuff from Strugatsky brothers

4:01 PM

@TildalWave not heard of them...<goes off to google>

Arkady and Boris Strugatsky

The brothers Arkady (; August 28, 1925 – October 12, 1991) and Boris (; April 14, 1933 – November 19, 2012) Strugatsky (; alternate spellings: Strugatskiy, Strugatski, Strugatskii) were Soviet-Russian science fiction authors who collaborated on their fiction. Life and work The Strugatsky brothers ( or simply ) were born into a Jewish family. Their father Natan Zalmanovich Strugatsky was an art critic, their mother a teacher. Their early work was influenced by Ivan Yefremov. Later they went on to develop their own, unique style of writing. Their famous novel titled Piknik na o...

more recently I have bought all the Iain M Banks, Peter Hamilton, Alistair Reynolds, Neal Asher and Charles Stross books

Also getting into Alan Campbell and Neal Stephenson, and odd ones like Paolo Bacigalupi

@RoryAlsop Have you read Bank's Excession already? I didn't manage yet but wonder how's it like, seems quite interesting

@TildalWave Actually, no - I only finished reading the Hydrogen Sonata relatively recently, so hadn't got it yet. I do want to see if I can get a signed copy though. As I guess this will be his last book...

4:19 PM

@TildalWave Ooops - I tell a lie. No I have read excession - a long time ago. I was thinking of the new one, The Quarry

Q: How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

@RoryAlsop And? It's 2001-like much?

0

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a -out b But I already have a key pair in my ~/.ssh directory, so how do I use this instead of gener...

ssh openssl

Why is this marked as OT?

@TildalWave nah - not really, aside from the mysterious black impenetrable alien structures :-)

@RoryAlsop oh good, I'll move it higher up the pile of books to read then ;)

@TildalWave If you've read any of his Culture novels before, and enjoyed them, it is even darker and more complex

@RoryAlsop are we talking about The Quarry?

4:25 PM

@RoryAlsop yup that sounds like my type of reading, thanks :)

@lynks no, Excession

Oh, and read the Dan Simmons Hyperion trilogy - they are awesome

@RoryAlsop I shall order it :)

And China Mieville, if you like something a bit futureward, but a bit crooked

Q: Can an attacker physically read RAM without a bypass?

this guy doesnt quit

0

I have been shown that an attacker can read RAM by physically connecting to the RAM bus http://www.google.com/patents/US6745308 That patent seems to suggest that the memory controller must be bypassed before reading. Is that true, or can an attacker simply connect a circuit to grab the memory i...

hardware physical intrusion memory

@RoryAlsop having not read any of his culture books, will I be able to keep up with excession?

@lynks Oh yes, they are all readable standalone, and that one was his 3rd or 4th anyway.

Full list and broader info, and sad blog post, here: iain-banks.net

4:34 PM

@RoryAlsop very sad

@lynks Yeah - met him in November at a book event and he was mentioning that he was slowing down the book tours etc as he good older and didn't have as much energy, but this was such a sad announcement

Ladadadada

Excession is the only one I've read so far. Very enjoyable. Must get more.

@RoryAlsop that's sad news

@TildalWave I know! I have been reading his work since the Wasp Factory and Crow Road, and love his public speaking. Have seen him with Peter Hamilton and Ken Campbell and they are just wonderful to listen to.

4:50 PM

@RoryAlsop Excession ordered, I needed some holiday reading to balance out 'Secrets of Reverse Engineering'

@lynks hahaha.

@RoryAlsop I'm not kidding, I carried 'The Rootkit Arsenal' around with me all over Texas. Garnered some funny looks.

I am actually having real trouble at the moment - I really like physical books; the smell, the feel, the act of reading etc... but a Kindle is just so handy. I find myself buying my favourite books again in ebook format. It's going to be expensive. Have bought about 200 so far.

@lynks I took the Orange Book on honeymoon...

it still has Greek sand in the pages

Some say that was a bit odd - but y'know, sometimes you need to just sit on a beach reading. Even on honeymoon.

@TerryChia can you add me as a room owner in the ctf channel? I've registered 'secse' for the ebctf.

Yay, finally got my 3k pointless milestone on meta.so - it's been ages getting that last upvote :-)

4:56 PM

@RoryAlsop haha, I've always wanted to own the rainbow books, ever since watching hackers. I tend to learn from books written to teach, like the two above, and The Shellcoders Handbook, Security Engineering etc. Is it worth getting my hands on some rainbow books?

@lynks Well, they are seriously outdated, but the core concepts are solid - if you can find them cheap, go for it, otherwise I'd say they are more of a curiosity

@RoryAlsop like you, I have a library which I am very proud of, 3 large shelves of choice security literature (if it isn't good, it doesn't make the shelf). I'd mostly just be buying them for completeness.

@RoryAlsop I buy most of my books on Kindle these days. I still love physical books, and I still buy nearly all of my technical books in physical format, and there are a few other types of books that I'll still buy physical only, but I'm like you...The Kindle is just too handy to resist. It's also wonderful to travel with. I don't have nearly as many books as you do, but I have enough that shelving them and storing them and moving them has gotten to be a hassle.

5:32 PM

I still can't get used to reading on a kindle or tablet, I've been collecting comics since I was 10 and I really can't read them comfortably on a tablet

David

Morning gentlemen.

I think I might visit pripyat next year

@LucasKauffman Yeah, comics are definitely paper for me.

@David Howdy.

@RoryAlsop How does panda taste?

5:52 PM

@ScottPack is this another "Rory is so old, eating panda was still legal" joke :P?

4

It is all full now - need moar shelves

@ScottPack not ever tried

@LucasKauffman I just assume that if there exists something made of meat Rory has eaten it.

@RoryAlsop Drat.

@ScottPack reasonable assumption, but not 100% true

@ScottPack Terrible, apparently. slate.com/articles/health_and_science/explainer/2012/10/…

@RoryAlsop I was hoping delicious so that I could have a better followup to this

@packscott @ChrisAndreDale No pandas. I couldn't rent one, even in Vegas. They did offer a dude in a panda suit, but I want to be authentic.

Tweeted by jack_daniel on May 29, 2013 at 5:42 PM in reply to packscott

5:54 PM

@ScottPack hahahahahaahahaaha - Only Jack...

He seems like he would be a fun person to know.

Delightfully fun in a dry and laid back kind of way.

@ScottPack Met him at BSidesSF and then again at BSides London - always get the impression he is sarcastically bemused at all the fuss. He does seem very laid back. I didn't get a chance to go drinking with him, but reckon that would be pretty cool