The DMZ

Scott Pack

00:07

@TildalWave I don't mind answering your own questions. What I would prefer one does is ask it, and then wait some period of time before answering. I've waited an entire week before. To give someone else a chance.

@RoryAlsop Not much longer now, either.

D3C4FF

03:02

nawrasyghgh!

D3C4FF

03:17

Anyone around?

TildalWave

@D3C4FF aye... all ok there? you were typing in cipher before

D3C4FF

@TildalWave I was talking in headdesk before

TildalWave

@D3C4FF ah you might wanna get one of those ostrich pillows ;)

D3C4FF

Okay. Hypothetically, a web app has a page where it expects a POST of {"AppToken": "123", "ID": "user", ExtrData: [{Key:"OtherID"}]

If i change otherID to something like <script>alert(1)</script>

it echoes it back on the page and executes

While its executing JS, i'm not sure if it constitutes a vuln, because how will a client send a structured POST request to the site like that?

@TildalWave I made one of those once. Super toasty. but a bit stuffy

TildalWave

@D3C4FF I don't get it, why wouldn't a client be able to do that? What's stopping him?

What's the handler doing with this POST?

D3C4FF

03:28

Why would a client try to XSS themselves?

A client can do it, but i can't see an attacker who isn't the client doing it?

I'm pretty sleep deprived, so i feel like i'm missing something obvious

@TildalWave It generates a token for a secure sign on session. Then echoes back the response on a page with no data other than the response (structured similar to the original request and containing the OtherID param)

TildalWave

@D3C4FF Well the question is what happens with this data on POST and where it's later used... I doubt there's much point in only displaying something new on page in a discrete manner only, that doesn't even require POST request

D3C4FF

@TildalWave Ack. Yep. That's where i'm forgetting things... -_-

The page by itself isn't an issue, but whatever other part that pulls the request from the application might be.

TildalWave

@D3C4FF yup... and if it's script injectable, you should check for SQL injections also then

token forgeries, SQL injections, DoS,... all kinds of possibilities besides XSS, CSRF, that might actually be beyond the point there.... Have you run some fuzzer on it and tried crashing it?

You should also check for possible timing attack on token generation

D3C4FF

@TildalWave Yeah i fuzzed the shit out of it

@TildalWave Checked for the usual suspects. As well as weak tokens etc

seems relatively solid

TildalWave

@D3C4FF where's that OtherID handled, have you confirmed it doesn't have any effect on server whatsoever?

D3C4FF

03:41

Dont have access to the actual implementation sadly, so i cant test it. Literally, i'm testing three pages.

TildalWave

@D3C4FF Have you tried overriding parent structure parameters in the ExtrData structure?

D3C4FF

@TildalWave Yeah, it just rejects them as an 'invalid submission'

TildalWave

@D3C4FF Dunno then, if you don't get anything suspicious out of it with a fuzzer working on that OtherID, then it might be just passed along in app ... so you're left with how app handles template hooks and stuff like that... if at all,... but if it's recursive, you might get lucky triggering some other response than intended, have you figured it out in what lingua/webAPI it's written?

D3C4FF

@TildalWave It looks like its using something called liferay

www.liferay.com

based on some of the errors i get from it

but thats a guess...the server doesn't do/demonstrate very much. All i know is its an win 2k8 R2 box.

TildalWave

Basically, what you're looking for is if it has some internal parser and if it's enabled on handling POST... if it is, then technically you could inject any parsed tag with params into that OtherID and make it do anything it's supposed to handle with those... also check for any server-side scripting that you could inject, tho that would work much the same as trying to fiddle with the parser

D3C4FF

03:56

@TildalWave But i don't have access to the box, the code or the resulting pages which may use this info. So i'm blind

TildalWave

> VM (Velocity Macro): Velocity is a scripting language that lets you mix logic with HTML.

liferay.com/documentation/liferay-portal/6.1/user-guide/-/ai/…

> FTL (FreeMarker Template Language): Freemarker is a templating language which could be considered a successor to Velocity, though it is not yet as popular.

these should both be disabled on handling POST requests

there's probably more, but I'll turn in for the night so you're on your own... try calling something simple in VM or FTL from within that OtherID and see if it's enabled

people.apache.org/~henning/velocity/html/ch07.html

D3C4FF

Yeah it flips out a bit if i send it <br> #macro( d ) <tr><td></td></tr> #end
</br>

TildalWave

@D3C4FF well there you go... try printing some internal variable with macro... #[whatever]... or set your fuzzer to stun :)) I'm off, take care ;)

D3C4FF

@TildalWave Cheers dudeski

catchya later :D

Stack Exchange

04:36

If we get the doors open and plug up the dam on the Sirannon so the water rises a little, the pool will start draining into Moria. How do you think the Watcher would fare against a drenched Balrog?

this.josh

06:04

@Adnan I have only asked 1 question, so what does that say?

Adnan

06:28

@this.josh What?

this.josh

watt = amp * volt

D3C4FF

@Adnan I'm as confused as you are... :P

Adnan

Damn it! I lost my nail clipper

My life is over!

@D3C4FF I came to expect less and less from life. I'm not even gonna ask for a clarification.

D3C4FF

@Adnan Oh wait. The watt thing was a joke >_> ...... At least i think it was..... <_<

Adnan

@D3C4FF I was wondering about the one before

D3C4FF

06:40

@Adnan Whats news with you?

Adnan

@D3C4FF Woke up to see a gigantic bee buzzing in my room, our neighbour are mowing their lawn, lots of kids are playing in the near backyard. It wasn't a good morning.

aaaand I lost my nail clipper!

this.josh

I joke because I lack the intellectual capacity to converse

3

Rory Alsop

@this.josh It says you have no questions you want to ask in here :-)

Morning all

Adnan

@this.josh I think we all do.

@RoryAlsop Morning

this.josh

Damn Rory that is way too close to the truth.

Rory Alsop

06:47

Well I do know a couple of folks who would not ask the questions they need answered in here - information leakage is a serious issue for them

Adnan

@D3C4FF Oh, not only that. Now I have to setup my new laptop.. it's gonna take ages to make it as cozy and comfy as the old one.

Okay, I'm all out of whining energy now.

D3C4FF

@Adnan Sounds like a shit way to start the day...

Adnan

Anybody knows a good way to dispose animal guts?

this.josh

How is a laptop cozy and comfy?

Usually feed them to other animals.

Adnan

@this.josh All the files and applications are under the same pixels on the screen. I don't have to look for something, it's just there. When I login, it'll automatically try to mount my TrueCrypt volume, prompt for the password then tell Firefox to get my profile folder from there. When I lock my computer, it'll automatically unmount the TrueCrypt volume.

The FoxyProxy settings for some sites to use my home connection while I'm at work

literally, tens of configurations.

this.josh

06:55

My Truecrypt volume never leaves me, it boots and will run with Windows, OS X, Linux, and BSD.

D3C4FF

@Adnan Fire/bin/other animals

Adnan

@this.josh Hmmm.. feed them to other animals. Interesting.

@D3C4FF I cannot just through in a trash bin, and fire is too messy and it'll attract too much attention. I guess I'll just leave them in the woods somewhere far, other animals will eat them.

Oh, or better, I'll bury them in the woods and let nature do its job.

this.josh

What all in one place?

you should use a random scatter distribution with at least three suggested foci at one confidence interval

Adnan

@this.josh Well, I don't have a lot, 3 rabbits and 1 squirrel.

Oh yeah, @Lucas . Apparently, it's not even legal to hunt small game with a .22 firearm.

Lucas Kauffman

07:19

@Adnan if you hunt small game with anything larger than .22 there won't be much left :/

Gilles

07:30

@AviD it's a random list of tips. It's better than most, but still a list of tips, and unmaintained. The wisdom should be split into multiple, more focused questions (many of which already exist on the site). I don't see a way to salvage it as a Q&A pair.

AviD

07:53

@StackExchange I guess we need to start calling each other "mellon"...?

@RoryAlsop mellon

@Adnan stuff 'em into a sheep's stomach lining. Deep fry. Enjoy.

@Gilles well, thats why I didnt take action on it, especially at 1AM when I got back...

But I'm not sure I agree. It should be maintained, sure, but that doesnt really happen...

perhaps the best solution really is the modlock.

Rory Alsop

08:22

@AviD that sounds crazy...oh, wait...

mellon

AviD

08:48

@RoryAlsop coincidentally collegehumor.com/video/6882485/hardly-working-standing-desk

@RoryAlsop heh, Haggis FTW!!

I always wondered, does it taste as awesome as it sounds?

Adnan

@AviD Ohh.. ewwww!! Haggis!

@AviD If I eat it with my eyes closed without knowing what it is, I have to be honest and say it's pretty tasty.

Terry Chia

Anyone else attempting the Matasano Crypto Challenges? Appears to be quite good fun. :)

Lucas Kauffman

I was wondering are there any vegetarians present?

AviD

@LucasKauffman the normals ate them all.

Lucas Kauffman

reminds me of that show I watched yesterday

it was called Hannibal

pretty damn good

Adnan

08:55

@LucasKauffman Oh yeah! VERY good show!

Very classy. The use of gore isn't for shock value, it's just to support the story.

Lucas Kauffman

@Adnan there is a lot of gore though

still Dr. Lecter is my favorite villain ever

Adnan

@LucasKauffman Same feeling here.

Lucas Kauffman

Antony Hopkins is still the best one though

AviD

@LucasKauffman I dont think Hannibal would eat vegetarians. He's a cannibal.

@LucasKauffman more than GoT?

Also. Did you ever see Cannibal! the Musical?

Adnan

@LucasKauffman True, but I'd still say that I like this TV show more than the movies.

AviD

09:02

@Adnan Even without Jodie Foster??

Lucas Kauffman

@AviD not the musical, it's different from GoT

Adnan

@AviD Not a big fan of Mrs. Foster

Anybody using Kerberos Single-Sign-On?

I can't get it to work with Firefox

Rory Alsop

09:31

@AviD Oh yes! The kids had haggis pizza last night. I'm sure there must be kosher haggis

AviD

@RoryAlsop sure, most of that stuff is kosher. Just not a common food here. Maybe I should get MarkW to cook me up some... :P

Rory Alsop

@AviD :-)

Lucas Kauffman

0

A: Advice on what to do after being hacked?

i have a huge problem! i downloaded a mod for minecraft and it...corrupted the files so it wouldn't open anything but luckily i still have SOME items that i can still refuge. what do i do! i can't even go on google earth that it's that bad! HELP!

@RoryAlsop Is haggis a lot different from blood sausage?

Rory Alsop

09:47

@LucasKauffman yep. It is meat, not blood :-)

Lucas Kauffman

@RoryAlsop ah yea you use like the organs rather than blood

never had it wonder if I can get it here

AviD

@RoryAlsop closest we have to that is the East European kishkah

Kishka (food)

Kishka or kishke (; Belarusian кішка, kishka; ; Romanian chişcă Silesian krupńok; Yiddish kishke; Hebrew קישקע; Russian Кишка; Ukrainian кишка) refers to various types of sausage or stuffed intestine with a filling made from a combination of meat and meal, often a grain. The dish is popular across Eastern Europe as well as with immigrant communities from those areas. It is also eaten by Ashkenazi Jews who prepare their version according to kashrut dietary laws. The name itself is Slavic in origin, and literally means "gut" or "intestine." Description One Eastern European kishka type is k...

hmm. seems that has some in common with blood sausage, according to wiki... depending on the locale.

Adnan

Okay, another question. Any way to make IE8 work with SOCKS5 proxy?

AviD

@Adnan it doesnt?

did you set the proxy details?

Adnan

@AviD Yup, didn't work with SOCKS5

AviD

09:57

oh. cant say I have experience with it, just expected that to work...

Lucas Kauffman

10:28

@Adnan the question isn't why SOCKS5 isn't working with IE8, the question is why are you even using IE8?

Rory Alsop

@LucasKauffman hahahaha

Adnan

@LucasKauffman Every single time I mention IE, I get the same question. I work in a corporate environment, I have to test certain things on all major browsers. It's not my choice that what I do should work on IE.

I can't go to my project manager and tell him "Hey, IE sucks, go tell our 100,000-employee client to change to IE, my app won't support IE"

Lucas Kauffman

@Adnan poor you :(

AviD

@Adnan no no, you're missing his point. It's not at all that IE sucks - it doesn't - the question is why you - or rather "they" - are still on version 8.

but yeah, corp managed machines still covers that :-(

Adnan

10:48

I'm so angry! I'm sure I'll take it on the next question I don't like!

Lucas Kauffman

@AviD we are also still on IE8, last year tho

AviD

yeah, I remember back when I was full-time corporate developer, I had to support IE5. Kept causing problems...

Luckily I managed to get management to agree to ignore those that were still using IE4 - on Win98... 'course I had a rather more limited subsection of direct users, so...

Adnan

@LucasKauffman Yeah, that's really a big issue for me with SVG for example. It sucks!

@AviD Daaaamn! You're old.

AviD

@Adnan what? this was last year.

kidding! yeah, this was around 9 years ago...

Adnan

@AviD IE4.. Win98.. last year..

@AviD Oh! You nearly gave me a heart attack

AviD

11:00

lol, yeah still was pretty bad, but you know how they are....

Lucas Kauffman

I had a project once which was almost finished written in html5 and css3 with custom fonts

suddenly the client comes to me and says "Ow yea we work with IE6"

that made me cry a little.

Adnan

@LucasKauffman Come here.. come to safety.

Lucas Kauffman

@Adnan for some reason that came over quite creepy

Adnan

@LucasKauffman Hmm.. if you take out "come to safety" it woks very well with crying girls.

AviD

@LucasKauffman "for some reason"....?? Look at the first word on that line.

Adnan

11:24

@AviD "for"?

AviD

@Adnan @Adnan ;-)

Rory Alsop

...mellon

Adnan

@RoryAlsop Mellogoth!

Adnan

12:01

@Poly That blog post by Nick is very interesting

Polynomial

@Adnan Yup. Really opened my eyes to the reality of deployment.

TildalWave

12:23

@AviD those are similar to haggis, you're probably confusing them with quite similar looking blood sausages that might also contain some organs like liver, kidneys and spleen, so organs that in some way process blood, but those are called different... for example in my language, the Wiki post you link to says "kašnica" (would translate to meal sausage or something like that), and the blood sausage is "krvavica" (translates directly to blood sausage).

Adnan

What a coincidence! Today I started the process of setting up Kerberos SSO, and 2 related questions popup.

AviD

@Adnan which one?

Adnan

One of them is yours @Poly.

Scott Pack

Gents

Adnan

@AviD nickcraver.com/blog/2013/04/23/…

AviD

12:24

@Adnan ah yeah. working at that level of scale really is different.

Scott Pack

I'm glad we finally got a response other than, "SSL is haarrrdddddd!"

2

AviD

@TildalWave well... not quite haggisy enough. For one thing, its not fried... and for another, its mostly intestines (+ some other stuff). The wiki page was the one that said its similar to bloodsausage....

Adnan

@AviD Well, if you check the last part, you'd see that their biggest problem has nothing to do with overhead. The biggest problem is the certs

AviD

@Adnan yeah, I know - scale isnt just traffic. It's the number (and layout) of domain names.

Scott Pack

There are still ways to handle it reasonably. For example, we pay a yearly fee to our SSL signer. For that we get an unlimited number of single name server certs all handled through a self-service system.

So we can self-service sign anything so long as it's under ohio.edu. Number of total certs doesn't matter, number of subdomains doesn't matter...

Adnan

12:29

@ScottPack This is brilliant!

Scott Pack

@Adnan Two additional nice features of our setup. 1) Extremely granular delegation rights based on subdomain. 2) Published API so you can have a local app do everything without having to use their system.

Terry Chia

@ScottPack How much are you paying for something like that?

Adnan

@TerryChia Reading my mind

@ScottPack Also, as far as you know, any downsides for adopting that in the StackExchang case?

TildalWave

@AviD Wiki is often wrong... problem with that page is they tried to stuff too many different things into a single page, and yes as you said it's not the same really... but we do have sausages quite similar to haggis too... actually, the closest is not a sausage at all but what we call a stuffed stomach... it can be also dried and made into delikatessen, but also eaten cooked and hot like haggis

Terry Chia

@ScottPack Plus is that a service any company can purchase or is it because you guys are an educational institution?

Rory Alsop

12:39

@Adnan heh heh - just gives me a mental picture of a happy, chilled out dude in black eyeliner :-)

2

Saladin

hello guys sorry for being quick

can someone recommend me a vulnerable iso / test web-application for hacking exercise..

Terry Chia

11

A: How to make a site vulnerable to SQLi?

Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web. A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.

Saladin

i already used dvwa

anything else

Terry Chia

@Saladin webgoat like my answer mentions as well.

Saladin

hm

webgoat do i need vmware or there is a windows installation for it

Terry Chia

12:50

@Saladin owasp.org/index.php/WebGoat_Installation#Installing_to_Windows

Saladin

ok thanks

let me check it

Terry Chia

@Saladin Might wanna check out hackthissite.org for web app attacks as well.

Saladin

ok thankyou i will do this to

too*

AviD

I liked google gruyere. Plus, it's cheese.

Saladin

can i run gruyere on windows locally using xamp

?

Scott Pack

12:57

@TerryChia It's a US based educational thing. It's InCommon which is an Educase sponsored Internet2 venture.

@TerryChia Pricing is based on your Carnegie designation, so a combination of size + highest degree granted + research produced

@TerryChia It's pretty cheap. The most expensive package they have is 20k USD and it goes all the way down to $1.5k incommon.org/certificates/cert_fee.html

@Adnan For this specific organization..yes. StackExchange wouldn't qualify to be a customer. It does, however, demonstrate that such things exist and may be worth looking for in a signer.

AviD

@Saladin its online only. All you need is a browser.

Adnan

@ScottPack So it could be possible to have something similar for an organization like StackExchange.

Scott Pack

13:38

@Adnan Not from our vendor, but there's no reason why another vendor couldn't do it.

All this talk of cheese makes me want fondu.

Lucas Kauffman

@ScottPack I want to join in

Adnan

@ScottPack @Lucas Isn't that what you do your girlfriend on her birthday?

Or when she's mad at you

Lucas Kauffman

@Adnan nah I take her to the veggie restaurant then

Adnan

@LucasKauffman Is that an innuendo?

Terry Chia

@Adnan You do your girlfriend with fondu on her birthday? Missing words can change the meaning of sentences my friend. :P

Adnan

13:47

@TerryChia God damn it!!! "you do with your girlfriend"*

Scott Pack

@LucasKauffman I imagine if anyone knows fondu it would be you.

Adnan

@ScottPack but but but but he likes girls!

Lucas Kauffman

what has molten cheese got to do with girls?

Scott Pack

That's what I'm wondering.

Terry Chia

@LucasKauffman Maybe ask @Iszi?

Lucas Kauffman

13:51

@ScottPack with what margin did you loose?

Adnan

@LucasKauffman I've always perceived fondu as something girls eat/do when they have slumber parties.

Scott Pack

@LucasKauffman The SF election, you mean?

Lucas Kauffman

@Adnan nah that's chocolate fondue

@ScottPack aye

Scott Pack

@LucasKauffman opavote.org/results/1584042/0

Lucas Kauffman

didn't expect michael to get so much votes

Scott Pack

13:52

Looks like I came in 4th behind Ward.

Lucas Kauffman

I expected tom and you

Scott Pack

@LucasKauffman I know. Both Tom and Michael tend to be rather...rude. I imagine it was mostly based on rep.

Adnan

@ScottPack For some of them, I'm surprised they even got votes.

Scott Pack

EC got 14 first place votes!

Lucas Kauffman

@ScottPack Tom is still sensible, michael is a bit more straightforward

Adnan

13:53

@LucasKauffman Is there any other kind?

Scott Pack

@LucasKauffman Oh definitely. Tom takes more to be not nice. Michael pretty well starts there. :)

Lucas Kauffman

@Adnan cheese

Scott Pack

Or oil.

foodnetwork.com/recipes/good-eats/fondue-vudu-recipe/index.html

Yummo

Lucas Kauffman

I like it with 4 cheeses and a bit of kirsch

Adnan

@Lucas @Scott Okay, I've just read a bit more about it. I have a totally different view of fondue now.

Scott Pack

13:56

@LucasKauffman Oh, interesting. I can see that.

@Adnan Yeah, traditional fondu has been cheese and bread. Oil and chocolate are fairly recent.

@LucasKauffman Any particular cheeses?

Lucas Kauffman

@ScottPack Gruyere,Emmentaler,Cheddar and Fontina

Adnan

@LucasKauffman Sounds amazing!

Terry Chia

This is interesting: pwnie-express-dev.myshopify.com/blogs/pwnie/…

Scott Pack

@LucasKauffman I like the sound of that.

Lucas Kauffman

This guy has no clue:

@LucasKauffman I'm not saying it's the same for every connection. What I am saying is the reason ebay may not have SSL on every page is because once the Symmetric Key is determined they will use it for a certain amount of time. From what was said in class at USU was that the more messages that are encrypted with the symmetric key the easier it is to break. In an ideal world the symmetric key should be thrown away after one encryption is what I was taught. So, I'm just think eBay may do it to protect that specific user's session. — Travis Pessetto 3 mins ago

Terry Chia

14:03

@LucasKauffman facepalm

> From what was said in class at USU was that the more messages that are encrypted with the symmetric key the easier it is to break.

What cipher has he been studying?

Lucas Kauffman

@TerryChia caesar

I hope

Adnan

@LucasKauffman and I hope it's not the one Dan Brown talks about.

Terry Chia

@Adnan hahaha! Digital Fortress is a funny book.

Lucas Kauffman

I don't know why I clicked this but nsfw (sort of) youtube.com/watch?v=y0A77rohcyg (Title: Turtle moaning while having sex)

Adnan

@TerryChia Well, when I read it I was 13, I thought it was awesome.

Of course, now that I know better, I can see the comedy.

Xander

14:09

@TerryChia Digital Fortress is a ridiculous book. I stopped reading Dan Brown completely after that.

Terry Chia

@Adnan Well, I like Dan Brown's stuff. Totally unrealistic but decent enough as mindless entertainment.

Lucas Kauffman

@TerryChia I have television for that

Adnan

@Xander Oh come on! Really? Now you read Paulo Coelho?

Xander

@TerryChia I'm all for mindless entertainment, but for me, suspension of disbelief only goes so far before I stop being entertained and start being annoyed instead. Dan Brown crosses that line for me.

Adnan

@Xander I think it's a very okay book. Again, I've read it when I was very young, so I didn't know crypto stuff at all. Plus, it's a sci-fi book.

To be fair, I haven't read anything else by Dan Brown

Xander

14:15

@Adnan Hmm...Never heard of Paulo Coelho, so I'd have to say no. :-) For me, when it comes to computer-y novels, I like Russinovich's...The writing could use a bit of polishing, but the material is good, and I enjoyed Suarez's Daemon. It also required the suspension of disbelief, but at a level that I found acceptable and entertaining.

Lucas Kauffman

you should read Freakonomics

Xander

@LucasKauffman Have it, haven't gotten around to reading it yet.

Lucas Kauffman

@Xander I had it as audiobook for a trip to amsterdam, it's pretty good

Xander

@LucasKauffman Cool. They have a podcast that I listen to occasionally, and it's quite good, so I imagine I'll enjoy the book as well.

lynks

14:29

digital fortress was terrible, however I thought his fourth book...the one in the snow...was by far his best.

"deception point"

however dan brown is still terrible overall

Xander

@lynks I started that one, and never finished it. I would like to go back and read that one. Won't read any of the rest of his stuff though. I read The Da Vinci Code and Digital Fortress, and between the two of them, that was enough for me to give up on his writing.

lynks

@Xander i wouldn't bother going back for it personally.

Xander

@lynks LOL. Ok.

lynks

@Xander stick to the good stuff; niven, gibson, azimov, lovecraft

Terry Chia

@lynks This gibson? attrition.org/errata/charlatan/steve_gibson ;)

Rory Alsop

14:37

@TerryChia this one, silly

amazon.co.uk/William-Gibson/e/B000AP5DM0

Terry Chia

@RoryAlsop hehe, just teasing him.

lynks

@TerryChia haha you know better than that.

TildalWave

@Xander heh never wanted to read his books but I did pretend for fun a few times that I did... turns out you can just make stuff up as you go and it comes out just as if you did, one of my mates was slightly offended when I told him at the end I never read it :)) I know... a bit mean of me, but was an interesting experiment

Xander

@lynks You know, I really haven't read a lot of science fiction, but I do love Azimov. I've read most of the foundation books, and one of these years (next year, probably) he's going to be one of the authors I focus on. I'll take a look at the others.

@TildalWave LOL.

lynks

@Xander for gibson; read his most famous work "Neuromancer", for niven "Ringworld", and for lovecraft... there are so many, but one of my favourites is "At the Mountains of Madness"

Rory Alsop

14:40

@lynks ahhh - Lovecraft

Xander

@lynks All right then, I shall put them on the list.

Rory Alsop

Of my home library, just over 4400 books are sci-fi. The remaining 200-odd are other genres :-)

lynks

@Xander neuromancer and ringworld are doable in a day each.

Rory Alsop

I'm a bit of a sci-fi buff :-)

Xander

@RoryAlsop Wow! That's impressive!

Rory Alsop

14:41

so I recommend it for anyone

(I did get about 2000 books in one tranche, from a library that was getting rid of them)

lynks

i just realised I've had "the beards - born with a beard" on repeat for the last few hours.

TildalWave

@Xander that was for The Da Vinci Code... of course all I knew about it was from other media spinning it as most fabulous... funny thing is this works for Carlos Castaneda's later works also, tho they're mostly still worth reading if you're in that age IMO

@D3C4FF how's your pen-test going?

Xander

@RoryAlsop That's a nice score!

@TildalWave That was the most disappointing thing about the Da Vinci Code. It wasn't a terrible book, but it was way over-hyped and sold as this "well researched historical novel" which it just wasn't. It was an engaging read though, I'll give it that.

TildalWave

@Xander I resisted all the brainwashing somehow, I think I was fairly deep in some projects that isolated me well enough from the rest of the world... it's sometimes quite scary what world you come back to after being away for quite some time

Rory Alsop

@Xander all 50's and 60's pulps. An excellent collection

lynks

14:56

@TildalWave I've been away for quite some time now. All my senses of the outside world are routed via a length of ethernet cable.

Xander

@RoryAlsop Very cool. That sounds like it'd be a lot of fun. The only works I have from that era are Azimov's, and a bunch of Tom Swift novels that I used to love when I was growing up. Really good stuff.

Terry Chia

15:39

0

Q: Can keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will be stored there to perform encryption and logging in, and an attacker can physically read from RAM. Is t...

Here he goes again.

I'm pretty sure a dupe exist.

lynks

15:50

@TerryChia I probably should have checked for a dupe

Terry Chia

@lynks Maybe not a dupe exactly. I just recall reading an excellent answer on memory access by The Bear.

But eh, no shame in a little repwhoring!

Rory Alsop

@Xander Lots of Heinlein, Niven, Asimov, Silverberg, Dick, Sheckley, Simak, 'Doc' Smith, Vonnegut etc

lynks

@TerryChia yeah so do I...was it on something about DMA?

Terry Chia

@lynks Possibly..

170

Q: Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's allocated memory. But I also think this is somehow bypassable. So I wonder if it is really safe a...

passwords operating-systems memory

Boom.

Question isn't an exact dupe, but the answer fits perfectly.

Xander

@RoryAlsop Any particular favorites among them?

TildalWave

15:55

@lynks well in this case, here's a quick update: noob.co.in/Adnan/of%20Sec.SE/StackExchange/earthquake

3

Terry Chia

@TildalWave That's....... AWESOME!!!

Rory Alsop

@Xander All of Niven's stuff, including his work with Pournelle. Mote in God's Eye, Ringworld series, Footfall

Any Asimov, especially the I Robot series

Xander

@RoryAlsop Noted. Thanks!

Rory Alsop

Obviously Philip K Dick had some awesome stories - more and more of which end up as Hollywood blockbusters:-)

TildalWave

@RoryAlsop In that case, you'd probably also love stuff from Strugatsky brothers

Rory Alsop

16:01

@TildalWave not heard of them...<goes off to google>

TildalWave

Arkady and Boris Strugatsky

The brothers Arkady (; August 28, 1925 – October 12, 1991) and Boris (; April 14, 1933 – November 19, 2012) Strugatsky (; alternate spellings: Strugatskiy, Strugatski, Strugatskii) were Soviet-Russian science fiction authors who collaborated on their fiction. Life and work The Strugatsky brothers ( or simply ) were born into a Jewish family. Their father Natan Zalmanovich Strugatsky was an art critic, their mother a teacher. Their early work was influenced by Ivan Yefremov. Later they went on to develop their own, unique style of writing. Their famous novel titled Piknik na o...

Rory Alsop

more recently I have bought all the Iain M Banks, Peter Hamilton, Alistair Reynolds, Neal Asher and Charles Stross books

Also getting into Alan Campbell and Neal Stephenson, and odd ones like Paolo Bacigalupi

TildalWave

@RoryAlsop Have you read Bank's Excession already? I didn't manage yet but wonder how's it like, seems quite interesting

Rory Alsop

@TildalWave Actually, no - I only finished reading the Hydrogen Sonata relatively recently, so hadn't got it yet. I do want to see if I can get a signed copy though. As I guess this will be his last book...

Rory Alsop

16:19

@TildalWave Ooops - I tell a lie. No I have read excession - a long time ago. I was thinking of the new one, The Quarry

TildalWave

@RoryAlsop And? It's 2001-like much?

0

Q: How to use public key in ~/.ssh for asymmetrical encryption with OpenSSL

I want to do an asymmetrical file encryption: openssl genrsa -des3 -out private.key 4096 openssl rsa -in private.key -pubout -out public.key openssl rsautl -encrypt -pubin -inkey public.key -in a -out b But I already have a key pair in my ~/.ssh directory, so how do I use this instead of gener...

ssh openssl

Why is this marked as OT?

Rory Alsop

@TildalWave nah - not really, aside from the mysterious black impenetrable alien structures :-)

TildalWave

@RoryAlsop oh good, I'll move it higher up the pile of books to read then ;)

Rory Alsop

@TildalWave If you've read any of his Culture novels before, and enjoyed them, it is even darker and more complex

lynks

@RoryAlsop are we talking about The Quarry?

TildalWave

16:25

@RoryAlsop yup that sounds like my type of reading, thanks :)

Rory Alsop

@lynks no, Excession

Oh, and read the Dan Simmons Hyperion trilogy - they are awesome

lynks

@RoryAlsop I shall order it :)

Rory Alsop

And China Mieville, if you like something a bit futureward, but a bit crooked

lynks

this guy doesnt quit

0

Q: Can an attacker physically read RAM without a bypass?

I have been shown that an attacker can read RAM by physically connecting to the RAM bus http://www.google.com/patents/US6745308 That patent seems to suggest that the memory controller must be bypassed before reading. Is that true, or can an attacker simply connect a circuit to grab the memory i...

hardware physical intrusion memory

@RoryAlsop having not read any of his culture books, will I be able to keep up with excession?

Rory Alsop

@lynks Oh yes, they are all readable standalone, and that one was his 3rd or 4th anyway.

Full list and broader info, and sad blog post, here: iain-banks.net

lynks

16:34

@RoryAlsop very sad

Rory Alsop

@lynks Yeah - met him in November at a book event and he was mentioning that he was slowing down the book tours etc as he good older and didn't have as much energy, but this was such a sad announcement

Ladadadada

Excession is the only one I've read so far. Very enjoyable. Must get more.

TildalWave

@RoryAlsop that's sad news

Rory Alsop

@TildalWave I know! I have been reading his work since the Wasp Factory and Crow Road, and love his public speaking. Have seen him with Peter Hamilton and Ken Campbell and they are just wonderful to listen to.

lynks

16:50

@RoryAlsop Excession ordered, I needed some holiday reading to balance out 'Secrets of Reverse Engineering'

Rory Alsop

@lynks hahaha.

lynks

@RoryAlsop I'm not kidding, I carried 'The Rootkit Arsenal' around with me all over Texas. Garnered some funny looks.

Rory Alsop

I am actually having real trouble at the moment - I really like physical books; the smell, the feel, the act of reading etc... but a Kindle is just so handy. I find myself buying my favourite books again in ebook format. It's going to be expensive. Have bought about 200 so far.

@lynks I took the Orange Book on honeymoon...

it still has Greek sand in the pages

Some say that was a bit odd - but y'know, sometimes you need to just sit on a beach reading. Even on honeymoon.

lynks

@TerryChia can you add me as a room owner in the ctf channel? I've registered 'secse' for the ebctf.

Rory Alsop

Yay, finally got my 3k pointless milestone on meta.so - it's been ages getting that last upvote :-)

lynks

16:56

@RoryAlsop haha, I've always wanted to own the rainbow books, ever since watching hackers. I tend to learn from books written to teach, like the two above, and The Shellcoders Handbook, Security Engineering etc. Is it worth getting my hands on some rainbow books?

Rory Alsop

@lynks Well, they are seriously outdated, but the core concepts are solid - if you can find them cheap, go for it, otherwise I'd say they are more of a curiosity

lynks

@RoryAlsop like you, I have a library which I am very proud of, 3 large shelves of choice security literature (if it isn't good, it doesn't make the shelf). I'd mostly just be buying them for completeness.

Xander

@RoryAlsop I buy most of my books on Kindle these days. I still love physical books, and I still buy nearly all of my technical books in physical format, and there are a few other types of books that I'll still buy physical only, but I'm like you...The Kindle is just too handy to resist. It's also wonderful to travel with. I don't have nearly as many books as you do, but I have enough that shelving them and storing them and moving them has gotten to be a hassle.

Lucas Kauffman

17:32

I still can't get used to reading on a kindle or tablet, I've been collecting comics since I was 10 and I really can't read them comfortably on a tablet

David

Morning gentlemen.

Lucas Kauffman

I think I might visit pripyat next year

Xander

@LucasKauffman Yeah, comics are definitely paper for me.

@David Howdy.

Scott Pack

@RoryAlsop How does panda taste?

Rory Alsop

17:52

Lucas Kauffman

@ScottPack is this another "Rory is so old, eating panda was still legal" joke :P?

4

Rory Alsop

It is all full now - need moar shelves

@ScottPack not ever tried

Scott Pack

@LucasKauffman I just assume that if there exists something made of meat Rory has eaten it.

@RoryAlsop Drat.

Rory Alsop

@ScottPack reasonable assumption, but not 100% true

@ScottPack Terrible, apparently. slate.com/articles/health_and_science/explainer/2012/10/…

Scott Pack

@RoryAlsop I was hoping delicious so that I could have a better followup to this

@packscott @ChrisAndreDale No pandas. I couldn't rent one, even in Vegas. They did offer a dude in a panda suit, but I want to be authentic.

Tweeted by jack_daniel on May 29, 2013 at 5:42 PM in reply to packscott

Rory Alsop

17:54

@ScottPack hahahahahaahahaaha - Only Jack...

Scott Pack

He seems like he would be a fun person to know.

Delightfully fun in a dry and laid back kind of way.

Rory Alsop

@ScottPack Met him at BSidesSF and then again at BSides London - always get the impression he is sarcastically bemused at all the fuss. He does seem very laid back. I didn't get a chance to go drinking with him, but reckon that would be pretty cool

Scott Pack

Yeah.

Transcript for