The DMZ

Scott Pack

00:38

Xander

01:38

I don't think that's a drinking game. I think that's a recipe for "How to get alcohol poisoning."

Scott Pack

While this is only slightly related...I will occasionally say the word "Once" in a rather deep breathy voice just to annoy Katie.

Simon

02:32

@ScottPack Katie is such a lucky girl.

Do you think she realizes how lucky she is?

Scott Pack

Unlikely.

coding_corgi

02:48

Yo yo yo!

Anyone here know anything about botnets?

Scott Pack

That's....a rather broad question.

Rather akin to asking, "Anyone here know anything about fire?"

coding_corgi

@ScottPack ha ha, how does someone discover a botnet?

Scott Pack

Usually either accidentally or on purpose.

coding_corgi

@ScottPack i get that, but how? Do you see strange packets? Overflow of some kind?

Scott Pack

03:06

It would honestly depend pretty heavily on the intent and purpose of the person doing the discovery.

Some researchers do their damnedest to get something infected and then monitor the communications. Some may actually hire our botnet nodes

coding_corgi

@ScottPack ah, and when someone says I took over a botnet, they mean they just hacked into the C&C server?

@ScottPack cool.... and creepy...

Scott Pack

Were I to identify a botnet it would probably be by identifying an infected machine and doing network analysis.

@coding_corgi Usually it's more DNS sink holing. Figure out what the CNC is and take over it's DNS record somehow.

coding_corgi

@ScottPack DNS? WTF is that? Ive hear of it but...

Scott Pack

I somehow take your A record and point it at my DNS name.

coding_corgi

@ScottPack uhhhh, wah?

Scott Pack

03:11

Petition the registrar, wait for it to lapse and put in my registration first, etc.

coding_corgi

@ScottPack Thanks, so it's through DNS? Okay, ill go take over one now,

;D

I'm out

Hasta la vista!

Scott Pack

Bless. That'll be fun to see the results of.

Stack Exchange

06:22

I'm entering my 24th year of spending eight hours a day firing the Duck Hunt gun at the flying toasters. I'm sure I'll hit one soon.

TildalWave

06:41

4

Q: What are the purposes of these security policies?

I work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question. We must keep empty drawers locked When we leave work we must lock up writeable media We must lock any not...

Why is this question on the first page of the SuperCollider?

Slow day on SE?

AviD

07:22

@ScottPack Damn coders, dont even know DNS.

sorry to see I missed the @scottsnarkfest.

Terry Chia

07:42

@AviD Throw this over to network engineering? security.stackexchange.com/questions/37922/…

AviD

@TerryChia done.

Rory Alsop

07:57

Busy this morning @AviD? You seem to have the front page sewn up :-)

AviD

@RoryAlsop do I? oops. doing some tag clean up...

like eg policy.

gonna merge that with corporate-policy, but first I have to take out the ones that mean something else...

I still think moderators should be able to edit without a pagebump...

I think we need a Summer of Tag Cleanup project...

any takers?

maybe I'll meta it later...

Rory Alsop

08:14

I think it has been requested a few times - not sure why we don't get bump free cleanups

ManishEarth

08:55

@AviD Meta it. That's the standard procedure. Propose a preliminary list of tags to be burninated, and as the community comments, you can add/remove tags as necessary. After a while, ping a comm team member

AviD

@ManishEarth ah, no, what I'm talking about is a real spring cleaning. I dont have the list of tags, we need to walk through them all.

ManishEarth

@AviD Yeah, sure, so don't start with a preliminary list of tags

AviD

for example, we have 3 pages of single-use tags. most of them should be removed.

also dont need comm team, they get cleaned up when they're not in use.

ManishEarth

Oh, comm team is for mass burninations

AviD

there are also quite a few tags that are overused and misused.

ManishEarth

08:57

A quick query ought to get you a list of tags sorted by use

AviD

@ManishEarth no, for the most part we need to go one by one, at most we can dump a filtered tag as a synonym.

ManishEarth

muzak plays

Rory Alsop

Plinky inky pinky plink

AviD

@ManishEarth umm.... duh?

Rory Alsop

(That was Muzak)

ManishEarth

08:58

Oh :p

Didn't know they added pagination to that

AviD

But dont want to buy, sell, or manufacture anything.

(That was Cusak)

Rory Alsop

I like the way we get improvements just subtly and quietly added

Oh dear @avid

AviD

@RoryAlsop heehee

@ManishEarth wow, thats been around a LONG time.

ManishEarth

Not for /new

And it's still not there :P

AviD

ah, true. I click that seldom enough that /new isnt relevant...

also just because its been around for a while, doesnt mean its a good tag.

ManishEarth

09:01

It's actually a good way to find crap tags

new tags=crap

AviD

@ManishEarth not necessarily.... sure, they should be reviewed, especially if they are by relatively new users, but a lot of the new tags are good, or potentially good.

ManishEarth

Of course, but usually they're crap :P

AviD

even single-use tags arent necessarily bad. it's their potential that matters - single use from this month, might get used a lot more - single use from last year, unlikely.

yknow what.... COFFEE TIME.

think I'll go for the Kenyan today.

Lucas Kauffman

@AviD what does kenyan taste like?

Rory Alsop

I went for - a coffee whose flavour is perfectly hidden by the vanilla syrup. As usual

AviD

09:05

> sweet with honey, a vibrant wine-like acidity, with hints of fruit.

Rory Alsop

Although I have to admit I just ordered a tassimo for my wife. She appears to be taking over my caffeine addiction quite well

AviD

> deep fruit tones of currants and berries, an essence of grapefruit and a penetrating complexity of flavor that reveals itself slowly from first sip to last.

@RoryAlsop lol

@LucasKauffman its funny, I find these descriptions to be very hoity toity, like wine ~~snobs~~ sommelliers, but drinking it a lot of times it really does make sense.

it is a lot brighter than some other coffees, not quite honey but relatively in that direction. vaguely fruity/berry-ish. not as dark and heavy as say, columbian.

Lucas Kauffman

@AviD do you actually taste all those flavors?

AviD

@LucasKauffman well not as much as all that, but I definitely see difference between other coffees.

Rory Alsop

When I used to run a wine cellar, I just used to ask the customer what wines they liked, and then suggest wines they would probably also like. None of that snobby 'hint of badgers sett, with floaty Tarmac overtones' stuff

AviD

09:09

@RoryAlsop hehe

but yeah, even without being hoity toity, some people can really appreciate the differences, and the subtleties, of different wines.

Other people mock them.

Rory Alsop

Definitely

To both statements

I really do appreciate the differences in wine, whisky and cheese - but not much else works for me to that sort of level

AviD

the guy that runs the boutique I get my coffee from is a REAL freak.

Lucas Kauffman

@RoryAlsop did you ever drink a Saint Petrus ?

Terry Chia

@AviD Like @Adnan?

AviD

he has a 5000$ machine, and if its set to the wrong bean, soaks the grinds a few seconds too long or puts the water with the wrong pressure, he can really tell the difference.

It just tastes wrong to him.

Lucas Kauffman

09:12

@AviD wtf

Rory Alsop

Wow

AviD

tbf, if you drink whisky in a wine glass, or at the wrong temperature, or you didnt let the wine breath long enough - you would know from the taste, wouldnt you?

Lucas Kauffman

with wine definitely

Rory Alsop

Yep

TildalWave

actually, on second thought... see @RoryAlsop's reply below :))

Rory Alsop

09:14

Blasphemy!

Lucas Kauffman

@TildalWave coffee is when I'm working ^^

TildalWave

@RoryAlsop didn't put it right

AviD

@TildalWave hehe, really, in this room? cmooon son.

TildalWave

dunno... I'm sure there's been nice studies about it

Rory Alsop

As eating and drinking are essential, making them very enjoyable is quite a nice idea

TildalWave

09:16

@AviD he's right, it did read all wrong

Rory Alsop

Breathing is essential too - and it does make a difference breathing highland air, or city centre air...

AviD

@TildalWave its one part sensitivity to differences from perfection, from experience, and one part cognitive awareness and understanding of the process.

@RoryAlsop oh yes absolutely. unfortunately its too damn hot to open the windows here right now.

TildalWave

@RoryAlsop have you read some short story (would be in sci-fi stuff prolly) where the guy was interviewing God, asking him why he stays on our planet? Might have even been called Interview with God, but I honestly don't remember the title... anyway, God replied he just loves the concept of enjoying foods and drinks, and is something that even him, as a creator, hit him by surprise

Rory Alsop

Same here - it keeps getting up over 20 degrees. That's pretty hot when you have evolved to cope with scotland

@tildal - not sure. It rings bells but nothing concrete

Terry Chia

@TildalWave Ask on Scifi.SE. :P

TildalWave

09:19

@RoryAlsop It would be pretty old, maybe 20 years ago

AviD

@RoryAlsop lol... that would be beautiful here. We're talking over 30C now...

@TildalWave I think that was a George Carlin bit...

TildalWave

@TerryChia meh I could prolly find it if I was bothered to

AviD

►

a bit sacrilegious, if you're a Catholic....

TildalWave

@AviD doubt it, but yes he has some similar stuff

Adnan

09:33

@TerryChia Nobody is as freaky as I am.

For some reason, I'm not able to stop listening to this. It's so catchy

►

First time I heard it on Fox news.

Rory Alsop

Haven above, eh. Gotta love speelin mistooks

Any of you folks know how much the CEH exam costs. Building a cert and training plan for my team

Oh, nvm - found it

Lucas Kauffman

09:49

@RoryAlsop how much does the cert cost?

Terry Chia

10:00

@RoryAlsop CEH? Tsk! ;)

Rory Alsop

I know, it isn't one of the top list, but we might let one of our juniors sit it. Only $600 all in

Adnan

@RoryAlsop Please please please share!

I'd love to read something professionally crafted like that

(if possible to share, of course)

Rory Alsop

Mostly focusing on CRISC, CISM, CISSP, PRINCE2 as these are applicable certs across industry (remember I have a risk focus in this new role, not purely security)

Lucas Kauffman

@RoryAlsop 600 USD isn't a lot

Rory Alsop

Shareability - hmmm. Will see. Probably can share the very high level bit

Terry Chia

10:03

IIRC you actually have to refresh the CEH cert every few years now right? That's kinda retarded for an entry level cert.

Lucas Kauffman

@TerryChia it's the same with CCNA

well if you can call CCNA an entry exam

Rory Alsop

I wouldn't expect refresh - if they are good, let them think about CREST. If not focusing on pen testing then get them onto CISSP or CISM.

Lucas Kauffman

@RoryAlsop OSCP :p

Rory Alsop

Good point @lucas

Adnan

@RoryAlsop That's a damn reasonable price

Rory Alsop

10:05

It can be even less if done in bulk, and through certain approved providers

And taken fully online, rather than in person

Lucas Kauffman

also the certification?

Terry Chia

@LucasKauffman I wouldn't. :P

I'm probably going for the RHCE cert soon.

Lucas Kauffman

@TerryChia is that like LPIC for RHEL?

Terry Chia

@LucasKauffman Probably. The entry level cert from redhat is the RHCSA which I already got. RHCE is one level up.

Lucas Kauffman

I'm watching this guy who purposely injects himself with snake venom

Lucas Kauffman

10:25

Got to love vice magazine

Adnan

@LucasKauffman Why is he doing that?

Lucas Kauffman

@Adnan he thinks it makes him younger, immune to diseases, high and allows him to skateboard with the movement a snake makes

Adnan

@LucasKauffman Makes perfect sense

Terry Chia

@LucasKauffman Hey, maybe you stumbled on to @RoryAlsop's secret to eternal life!

Lucas Kauffman

@TerryChia who knows :p

Rory Alsop

11:04

Erm...

ManishEarth

> You've earned the "Nice Question" badge for Why aren't infinite-depth wildcard certificates allowed?. See your profile.

I don't need no stinkin' badges, I want an ANSWER!

Adnan

@ManishEarth You need The Bear.

Ladadadada

Funny thing about DNS wildcards, if you have *.example.com, www.foo.example.com will work, but if you also add foo.example.com, www.foo.example.com stops working.

ManishEarth

Huh

I never got that bit about www.

Adnan

@Poly Do external USB hubs behave differently from root hubs?

Polynomial

11:10

no, they're all identical.

Ladadadada

You would need to add *.foo.example.com to keep the old behaviour.

Adnan

@Polynomial Well then I'm pretty sure I'm correct.

ManishEarth

For example, I have *.iitb.ac.in set as my proxy ignore, however, www.iitb.ac.in still is pushed through the proxy (but a.b.iitb.ac.in is not)

Polynomial

keep in mind that root hubs are just the ones connected to (or inside) your chipset

Adnan

@Polynomial Yes, I'm aware of that.

Polynomial

11:11

how so? an external device could only sniff the traffic addressed to itself or a sub-device.

Adnan

@Polynomial Well, then I guess I'm wrong.

But what could explain the ability to do that mirroring thing? (we can absolutely exclude cheating by using some software)

Polynomial

mirroring thing?

ah, it could be that the two devices were designed to do that

and that they both explicitly set their own address

but that requires cooperation of the second device

otherwise you'd get sync error

Adnan

@Polynomial Only one of the devices was provided by demonstrator. The other USB stick was provided by a member of the evaluation committee.

Polynomial

that's... bizarre.

are we absolutely sure there was no driver software involved/

'cos that sounds highly fishy.

Adnan

@Polynomial and my whole understanding of USB was based on the presentation that guy gave.

Polynomial

11:18

@Adnan Actually, after looking into it a little more in detail, it appears you might be right. There's a bit of a gap in the spec over it.

essentially it looks like the control packets are broadcast

but the data packets aren't, by default at least

however there's nothing to stop a device from transmitting broadcast data packets

so I'd guess what was happening is one device would select itself as master, the host would send unicast data to that device, and the device would re-broadcast the data to the other (slave) device.

Adnan

@Polynomial Hmmm.. that would make sense. I'm currently trying to contact the guy to ask to give me the presentation. Hopefully there would be more info there

Polynomial

my understanding is that horizontal broadcast is perfectly acceptable and doesn't require special arbitration from the host

so you can do really fast data transfer between devices on the same host

I'm not a USB expert, but that's my understanding of it from reading the spec and some related articles.

and knowing how other asymmetric bus protocols work at the hardware level

Adnan

@Polynomial I tried to search about this for some time, I couldn't find anything. You're right, the specs are kind of vague in this area.

But then again, when have any kind of specs weren't vague?

ManishEarth

11:40

Hey, how much HDD space does Kali need?

Terry Chia

> A minimum of 8 GB disk space for the Kali Linux install.

docs.kali.org/installation/kali-linux-hard-disk-install

I usually load up 32GB VMs in case I want to install other tools/have some other stuff on it.

Polynomial

@ManishEarth Unless you're just using it as a quick test of the new stuff, I'd recommend sticking to BT5.

Kali is pretty unstable.

ManishEarth

@Polynomial ah, I see. I just wanted to test it

I also need a linux install, thought it would be a good idea :P

Terry Chia

@Polynomial Do you have any specific complaints as of now? Have not been keeping up with Kali's progress recently. (Been doing a little bit too much coding for my taste).

ManishEarth

Only for a week

Terry Chia

11:48

@ManishEarth Just load ubuntu/fedora if it doesn't need to be security specific. :P

ManishEarth

@TerryChia But I want to play!

Also, Ubuntu requires ~15 GB

Polynomial

@TerryChia full OS dies after upgrade, many issues with package management breaking things, can't customise menu (doing so makes it disappear)

Terry Chia

@ManishEarth What about this then? ponyos.org

@ManishEarth Go Arch Linux.

@Polynomial Ahh... That first one is a bummer.

Polynomial

@TerryChia X11 crashes sometimes, GDK3 gets corrupt config periodically due to some weird scripts they run in the background too

@ManishEarth Debian minimal?

ManishEarth

@TerryChia Was thinking of puppy linux too.

Terry Chia

11:50

> I mean, it has ponies *and* massive security
holes! What's not to like?

In all seriousness I accept the fact that the OS isn't meant to be
secure in any way and I have essentially wasted 24 hours of my life
horsing around with it.

Heh!

Lucas Kauffman

-1

Q: How easy is to track someone exploting a XSS vulnerability?

If one of the common uses of XSS is to steal cookies which will be sent to the attacker's server, isn't it so easy to identify the attacker? This is not like a SQLi for example which you can exploit using VPNs and proxy chains. In this case you have to provide a URL that you can control for retr...

xss

nc?

ManishEarth

Thing is, I'm behind a proxy, and I have this huge script I've written that manages proxy settings

But it only works on ubuntu-like entities

Terry Chia

@LucasKauffman Not a particularly good question, but doesn't deserved to be closed imo.

ManishEarth

(Debian minimal may work)

Lucas Kauffman

@ManishEarth GENTOO

or LFS

Terry Chia

11:51

@ManishEarth Ubuntu-like meaning debian based or...?

ManishEarth

@TerryChia Yeah

Lucas Kauffman

@ManishEarth whatabout Mint, it's debian/ubuntu based (you can choose) and it uses the MATE gui

ManishEarth

needz APT among other things

gentoo was another idea

oh right ive seen mint

Terry Chia

@LucasKauffman Yeah Mint is awesome as well.

Lucas Kauffman

@ManishEarth you don't want gentoo

Terry Chia

11:53

Really simple to use - nice intro to linux for the non-power users.

ManishEarth

(btw i'm not new to linux, just that my main laptop has conked and I'm trying to make do with an old XP)

Terry Chia

@ManishEarth You should be shot if you hang out here and have absolutely no Linux experience at all. :P

Lubuntu is really nice if you need something simple to setup and very lightweight.

Lucas Kauffman

@TerryChia since you are a RHEL engineer to be, do you use their desktop linux?

Terry Chia

I have my parents using it on a 8~ year old machine.

ManishEarth

@TerryChia lubuntu=LXDE? My friend was trying it

Terry Chia

11:56

@LucasKauffman Fedora? Naaah. I run Windows as my host. :( I play way too much games and I'm lazy to run a dual boot setup.

ManishEarth

I don't care about setup simplicity, I'm pretty experienced with making dual boots (I've dual booted ~300 Win+Ubuntu installs this year)

Lucas Kauffman

@TerryChia no redhat.com/products/enterprise-linux/desktop

Terry Chia

@ManishEarth Yup. Frankly ubuntu is the only linux distro that hasn't pissed me off with driver issues for desktop.

Lucas Kauffman

I tried Fedora, didn't like it

Terry Chia

@LucasKauffman Ohh nope. TBH I can't see myself recommending the RHEL-based distros for desktops.

ManishEarth

11:58

@TerryChia Yep. I could also install Chromium OS: The Internet is what I really need, but the crosh prompt is annoying. And I can't set it up in my room, there's no way to set static IPs during that period

Scott Pack

12:35

@AviD I was a little tipsy at that point. What can I say.

Scott Pack

12:45

I was using Fedora as a linux desktop. I never had any driver issues, though. I've never liked how Ubuntu's general theme is so much, "It's cool, we got this. You go facebook with your grandkids."

Hennes

13:10

Mutters.

Not knowing javascript is annoying when you are looking for <iframe src="javascript:alert('This is your alert.'"> </iframe> as a username.

Antony Vennard

@TerryChia I run Fedora on a daily basis. It's okay. I've got some DVD playback issues at the moment, but that's not Fedora's area (the packages to do it are from rpmfusion).

Scott Pack

The only real problems I had with Fedora were all around multi monitor with my old Geforce 7300.

AviD

13:33

So this is nice.

I just learned that network authentication is really not as complicated as everyone thinks.

Adnan

@AviD What does everyone think?

AviD

According to this .jsp file, all you have to do, is encode your domain name, your username, and preface is all with "NTLM" in the Authorization HTTP header. And you're done!

the cryptographic protocols are really just fluff, anyway.

Adnan

HOLY SHIT!!!

They killed everybody!! Everybody is dead!! How are they gonna continue the next season with this?!

ManishEarth

@Adnan Make new people

Adnan

@ManishEarth They might have as well killed the hottest one, Ygritte.

AviD

13:41

@ManishEarth she tried that, and they killed her too!

@Adnan yeah, isnt she though? :P

Hot redhead with a scottish accent.... reminds us of Amy Pond.

Adnan

@AviD Oh definitely. The most attractive female character in the whole series. IMO, of course.

AviD

@Adnan hahaha, you're limiting that statement to females only?? ;-)

you have a thing for Loras?

Terry Chia

@AviD HAH!

Adnan

@AviD Who's that?

Do you mean Loras?

AviD

Maybe Jon Snow...

@Adnan (yes. Shuddup.)

Adnan

13:46

@AviD God damn it! Now I'm sitting here Googling pics of Ygritte

AviD

I'm just disappointed that we never got to see that thing Jon Snow does to her with his tongue.

Rory Alsop

.... O....Kay...

Adnan

@AviD Why do you wanna see that?

AviD

@RoryAlsop ah, the alphabet trick? ;-)

Adnan

@AviD Best one.. 8

Rory Alsop

13:49

Dude, I'm trying to concentrate here...have been interviewing all day

:-)

Adnan

But what I really wanted to know is what Podrick did to the ladies in the brothel that they didn't take the money.

AviD

►

Adnan

WHAT DID PODRICK DO?!!!

AviD

@RoryAlsop haha, oyyy.... thats tough.

Adnan

Hmmm.. apparently I'm not the only one asking that question

facebook.com/GameOfThrones/posts/10151424518082734

I think I'll send an email to George Martin about it

Simon

13:54

Morning! Why do I sleep 7 hours when I can sleep longer than that?

Terry Chia

@Adnan Come on man, don't distract the guy any further. He has two more damn books to finish!

@Simon Because you wanted to talk with @ScottPack.

Simon

@TerryChia It might be it. However, now, I just realized that he doesn't share the love I have for him. I think it's time to let him go.

Adnan

@TerryChia Of course @Simon wanted to talk to me

Terry Chia

@Simon There ya go, @Adnan is waiting for you.

Adnan

@TerryChia but but but but.. I should know! I mean.. come on!

Simon

13:56

@Adnan Hello :)

Adnan

@Simon Heillo

Rory Alsop

Mellons

2

Adnan

@RoryAlsop Go back to handling interviews!

Soon we'll start talking about bewbies. You don't wanna hear that

Rory Alsop

Ach - I'm done now. Only 28 other impossible things to do before teatime

Adnan

But I know @Lucas does

Terry Chia

13:59

@Adnan A wild @LucasKauffman appears in 5.. 4.. 3..

@Adnan DAMMIT!

Adnan

@TerryChia Ahaaaa!!! IN YOUR FACE!

@TerryChia Holy shit! 1 second difference!

Transcript for