« first day (902 days earlier)      last day (3983 days later) » 
00:00 - 16:0016:00 - 00:00

12:46 AM
@TildalWave @RoryAlsop Speaking of subs....
 
@Adnan I've read a couple of hands-on reviews of that system recently...They've been very positive. It seems to be really impressive.
 
There was that time, me and my mates found a sub moored off the cost, so we brought our inflatable dhingies out, paddled a few KM out to them and boarded em like the pirates we are... Single pin tumbler lock guards submarine. Lulz ensue.
 
@RoryAlsop Long range shooting is all maths...It's just a matter of how much you want to automate it. :-)
 
@D3C4FF what the... ? what type? and what happened next?
 
@TildalWave I took sexy time photos of EVERYTHING
 
12:54 AM
@D3C4FF do show! pr0n time :))
 
@TildalWave Okay, gimme a mo' to find the passwords to that drive :P
 
@Xander 200 more, c'mon answer a few questions that don't seem off-topic, you'll be in the 3k territory in no time
 
@TildalWave LOL, soon, soon. I'm on-site with a customer this week, so a bit busier than usual, and out of my routine to boot.
 
@Xander Ah yes you mentioned something... Ohio yes?
 
@TildalWave Yup, Dayton, Ohio this week. Well, through tomorrow, anyway.
 
1:01 AM
@TildalWave @RoryAlsop
Sexytimes confirmed
 
1:16 AM
@D3C4FF you are kidding me, sub was powered and tubes loaded? wtf? what class is that? looks like some Dolphin class to me (diesel engines, hunter/killer with 6 front tubes, about 16 crew)?
 
1:28 AM
@TildalWave No no.. I'm not quite up to infiltrating live fleets.
This had been sitting around a LONG time :P
 
@JeffFerland That's strange sad to hear and somewhat encouraging somehow.
 
And i certainly hope those tubes were not loaded :P
 
@D3C4FF Is this in any way related to that "front fell off" incident? :))
 
@TildalWave Haha. Nope xD
 
@D3C4FF then why are they powered? or is that just a reflection from camera flash?
 
1:30 AM
@JeffFerland I'm most disappointed by who I lost to.
@Xander Where are you flying out of?
 
@ScottPack Dayton International. USAir has direct flights from DAY to CLT.
 
@TildalWave Reflections from the flash, they have high-vis strips everywhere so if it floods then using the torches you can still find your way to oxygen points
 
@Xander Ah, ok. Apparently I'm going to be in Columbus tomorrow. The wife's got an appointment at 10, then starting at noon we'll be looking at houses.
 
@D3C4FF well I get that but I can make out the tube numbers... I guess that was just reflection off the LEDs and they were simply marked with static displays
So which class was it? It could be Collins class, but those 6 tubes are slightly annoying me, and it also doesn't look as big, maybe some older version of it
 
@TildalWave Lol. Pre LED days baby!
@TildalWave Its a pretty big space. The small shot doesn't do it justice, but a person standing upright reaches about midway up the middle tubes.
 
1:44 AM
@D3C4FF yeah I get that, those tubes are pretty much same or really similar size in all of them and yes, you could fit a body in them with a bit of insistence LOL
Have you watched On The Beach? Not in any way related, besides there was a sub also, but just curious.
 
@TildalWave Yeah, fuckin' love that movie. We watched it the day before we boarded
Its a classic :P
 
@D3C4FF well the classic is this one: imdb.com/title/tt0053137 but yeah it's a pretty believable scenario, not much dumbing down in there
 
@TildalWave I'd like to check out a sub that's got VLS batteries
To get on board an Ohio class.
now THAT would be bad-ass
@TildalWave Oh shi-! I didn't realise it was a remake!
 
@D3C4FF well those are huge mothers you can probably play tennis in there
 
@TildalWave Yeah, it'd be awesome :D
 
1:54 AM
that's navy boys standing there in the "fifty" formation LOL
My fav ones are 688 (Los Angeles class) and Akula II
 
@TildalWave Damn. They need to work on their kerning.
3
 
@D3C4FF hehe I'm sure they adjust for that in their bunks :)
 
@TildalWave That's right. You plow through that water. Yeah.
 
@ScottPack You realize these mothers are so huge you can track them with satellites by the surface water displacement wake alone? I wouldn't want to think even what is their life expectancy in an all out war, probably minutes.
 
@D3C4FF Funny story. I just showed that to my wife. Seeing as how she works in publishing she was rather amused that that was your first reaction.
 
2:12 AM
@TildalWave hehe yup. my 6th gold badge tomorrow.
 
@ScottPack Yeah, a couple people in my family work in graphic design and what not, so it rubs off on me and i enjoy things like the kerning game:
type.method.ac/#
 
Thanks for reminding me of that! I totally meant to send it to her.
 
@TerryChia in that case, you can afford 33 votes on answers too then, looking forward to it... just avoid voting on @Adnan's answers, he's in mortal danger as it is once the bear finds the time to wipe the floor with his ass LOL
 
She's a sales rep for a yearbook company. That seems like something that may be fun to keep in her bag of tricks when training students.
 
@ScottPack Yeah for sure! :)
Alright! If off to the law courts i go! :D
 
2:27 AM
@D3C4FF I get a score of 86... no idea how good or bad that is?
 
86 = Pretty good! I can do about 90-95% if i take the time
 
@D3C4FF challenges are always the same?
 
@TildalWave Yeah, so you can 'learn'
I wish it was a bit more random
Anyway, i'll be back in a few hours or something
:D
 
 
1 hour later…
3:56 AM
Spoof calls for everybody!!!
0
A: Is it possible to make a phone call appear to come from another phone?

AdnanThe best solution is much simpler than what you're thinking about. I haven't tried many services, but I have accounts on two services and I'm 100% sure they have this feature (and I've used, it works!) Jumblo: Create an account and add some credit to it (10 Euros minimum excluding VAT), then in...

@D3C4FF Daaaamn!
Actually, call spoofing is a very important in pen. testing (at least I think it is), especially in the social engineering aspects. If you make the call appear as if it's from the boss' phone, will the IT guys reset and give you the new password?
 
4:13 AM
 
@Adnan hmmm well that made me delete my PSTN call forwarding code comments... but how do you account for the calls to appear to be coming from the closer cell as OP describes? Can any of those pose as a VoIP to cell switch? I honestly have no idea, just asking.
 
4:28 AM
@TildalWave You see, the identity of the caller isn't exactly "detected" by the receiver (or the receiver’s provider), but rather disclosed by the caller and/or the caller's provider. I think you already know that. What these VoIP services do is just make the call for you on their own by disclosing a false identity to the receiver's provider, then connecting you to that call.
So you're not really calling that person. The spoofing service calls the person for you, then you call the spoofing company and they connect the two calls for you
 
@Adnan Well I know all that, that's pretty basic stuff but I was thinking of this:
> Or could he have some way of tampering with the phones so that he could be making calls while 50 miles from me, yet those calls show up as being made on the mobile he gave me, AND cell site analysis shows the calls went via the cell sites near my home or workplace?
 
@TildalWave Well, this is just a possibility that the OP is suggesting. I don't know about that, but if I were an attacker, I wouldn't go with that much effort, I'd just use a spoofing service.
and I think that's what happened in his case.
 
I demand this gets upvoted.
Step 1: Find a nice plump goat. Step 2: Sacrifice said goat to the anonymous gods. Step 3: ??? Step 4: Profit — Terry Chia 4 mins ago
 
@Adnan I don't think your VoIP provider can switch to any cell at will. I dig that they probably have switches with all major providers out there, probably leased and provided by carriers themselves... whatever the "deal" there is between cell and VoIP providers... but I'm not sure if cell providers install VoIP switches on most of their "masts" as OP said (BTW how do you call those? cell towers? repeaters?) and the VoIP provider can somehow select the nearest one?
 
@TildalWave I don't see why the VoIP provider should care about all that. They just ask your provider to connect them to you, your provider does all the work of knowing your nearest cell tower.
@TildalWave and yeah, I think cell towers.
@TerryChia It could have been funnier, but it's alright.
 
4:40 AM
@Adnan Heh, the floor is all yours.
 
You can start HERE and contribute to the animal rights Stack Exchange community, then move onto HERE and contribute to the pets loving Stack Exchange community, and then we'll tell you about anonnews.org/forum, but only if you apease Gods of Stack Exchange first! — TildalWave 2 mins ago
made small corrections ;)
@TerryChia Poor goat! ☺
 
 
2 hours later…
6:38 AM
awww maaaaan, I just got un-serial-upvoted :-(
@RoryAlsop was it you?? damn sockpuppets...
actually did notice over the past few days somebody was upvoting all my questions...
 
@AviD Hmm I think that might have been me. I was upvoting all the old questions for the electorate badge. Must have triggered the script.
 
@TerryChia hahaha, you badgewhore
 
@AviD ... just wanted to point fingers at @TerryChia ... too late, he self-confessed :))
 
and here I thought I had a sexy stalker... turns out it was just @TerryChia
 
@AviD how do you know he/she is not sexy? :O
oh btw... while we're being funny:
 
6:43 AM
meh, he spends too much time asking stupid questions, instead of on his makeup. ;-)
 
I realize a lot of it must have been lost in translation, but where did basic reasoning disappear all of a sudden? You can't just throw a few of big words together and expect it to make any sense, no matter how much of vodka you had! When was the last time you threw a few LOGO pieces in the air, and they somehow magically assembled into a real castle? Please, for the love of God, sober up! You're not in the state to play Monopoly even, let alone ask coherent questions about securing a financial service! — TildalWave 4 mins ago
 
wait, are you suggesting that @TerryChia's gender is now in question...??? /cc @Iszi
@TildalWave lol, quite snarky there
*Lego, not LOGO.
LOGO was the little turtle "programming" language....
 
@AviD dunno, I've never personally established it beyond any doubt... tho whatever he/she turns up to be, I doubt he/she would like my methods
@AviD hehehe a freudian slip of a tongue there, oups
 
@AviD Dammit guys! I thought @Adnan and @Lucas has established that I like boobies?
 
@TildalWave ftfy
 
6:46 AM
@AviD I used to teach Logo back in the student years ;)
 
@TerryChia that doesnt necessarily restrict your gender...
 
@FiascoLabs I don't need patetic mystery advices I just want to know bast practics from the bank security specialist, that's all. Anyway I always have a time to encrypt a database with external hsm. — Denis 7 mins ago
Hmmmmm
 
@AviD cheers!
 
Alright, gotta step out for a bit. Stop doubting my gender dammit!
 
@TerryChia The lady doth protest too much, methinks. Now I'm really not sure.
@TerryChia commented and closed.
 
6:53 AM
@AviD damnit that's what I wanted to say!
> sooper-sekyoor for teh win!
 
@TerryChia Did someone say boobies?
also wtf at the 'Hello how do I secure a complete transaction system' question
 
@LucasKauffman truth is at this point we could just close it as dupe. we've seen it before so many times...
hmm, we should close them ALL as dupes of each other, and make anybody who is interested spend 10 minutes chasing the chain. so A closed as dupe of B -> B closed as dupe of C -> .... -> Y closed as dupe of Z -> Z closed as dupe of A.
 
True
the guy was being cocky as well
cocky and incompetent
 
@TildalWave how is it that [animalrights.se] wasnt merged with [pets.se] into some animals.se?
 
@AviD animalrights.Se, I thought SE didn't do legal stuff?
 
7:04 AM
I dunno, its an a51 proposal.
I dont think its the legals, I think its more about how to treat them. which shouts to me like its the other side of pets.se.
Though I cannot claim to give a damn either way.
 
Heya
 
@LucasKauffman while I totally agree with you, I think telling the guy - who obviously thinks that he's god's gift to compilers - that he's not fit to program his turtle out of a box, is not really productive...
 
@AviD I'll edit the comment
 
@LucasKauffman we have Ask Patents which is mainly legal, no?
@AviD no idea really, they are kinda different, but I can't see many vastly different questions on animal rights than the three that are already there as example questions
 
7:21 AM
@TildalWave thats a special case, its done together with the USPTO and its intent is not legal advice, but factual precedents.
@TildalWave it would be as different as parents.se and childhood.se. same topic, different viewpoint.
 
@AviD animals.se sounds pretty cool idea... not just pets, that's also relatively small set of questions we'd have to deal with in majority... but animals questions in general, that could be pretty interesting
 
@TildalWave right, does it really matter if you own the animal, or see it in the field?
well sure, different context, but still same family of questions.
 
@AviD Why would it? I'd say even "how does koala taste like" should be acceptable, unless it's better covered on some other SE website, like Seasoned Advice (which it isn't)
 
@TildalWave LOL
yeah, I think that actually might be the one sensible restriction, the animals being alive...
or at least being treated as a life-form, even if they are no longer alive, and not just raw materials that will soon be absorbed into my lifeform.
 
@AviD Ok, so no hunting, taxidermy, culinary questions,... yup, sounds reasonable... or maybe "animal welfare"?
 
7:29 AM
@TildalWave oo perfect. you should comment that there on both of them.
24 mins ago, by AviD
Though I cannot claim to give a damn either way.
maybe "animal care"
 
@AviD I will, but laters... I'm off now, need to run ;) t/c
 
7:43 AM
0
Q: How can user connect to Mysql DB with no access from remote host?

Jake konzI have some website which are in the CPanel that i know remote database connection is disable by default and i tested it before. I know many people have some of my database passwords but they cannot connect to it.should i be worried about it? I know they should not know that but CPanel don't let...

OT?
 
@LucasKauffman I see you just passed makerofthings for 11th spot!
 
@RoryMcCune I did?
cool ^^
must reach the top 10
 
nooooo, I've been trying to avoid falling out of the top 10 for ages
my plan at the moment is to get past hendrik to give me a one place buffer
so I should be able to do that before you catch me :)
 
@RoryMcCune :P
I've got 2k rep to cover
so you should be fine
unless I hit a massive rep train
 
@LucasKauffman S'only 10 days! ;)
Less if you can get accepted answers and bounties.
 
7:58 AM
@RoryMcCune yeah, well, I've been trying to avoid falling out of the top 2 rows for ages.
and before that, I was trying desperately to avoid falling out of the top row.
and before that, I wanted ... you know the rest.
hell, I still remember quite a few sweet months that I was #1.
 
@AviD To be an astronaut?
 
@AntonyVennard heh. not really, no. Fighter pilot, sure, but not really astronaut.
 
@AviD Ok okay. It was going to be one of the two, really.
 
lack of gravity would really mess with your burger.
 
Actually wait, knowing you, you could well have actually been a fighter pilot what with all the missile-dodging and all.
 
8:02 AM
@AviD well assuming I can get past hendrik, you're the next target :op (although that's a v.large gap so I'll need to be the train guy to bridge it!)
 
hehe
@AntonyVennard no, I used to wear glasses, which automatically disqualifies you for pilot school.
besides, need to commit to a bunch of extra years, and not to mention the ridiculous discipline...
 
@AviD Yeah, that sucks doesn't it? I wear glasses, so would likewise be disqualified. Was disgusted to find that out aged 5!
 
8:25 AM
Would you like it if a surgeon would ask another surgeon the "best practices" right before he would perform surgery on you? No. This is the same situation, if you have to ask it you aren't fit for the job. Does this mean you will never be able to do this? Of course not, but first you need to get the proper training and experience. Don't try to run if you can't walk :) — Lucas Kauffman 1 hour ago
Gold!
 
@Adnan @LucasKauffman oh much better now.
 
@TildalWave How did I miss your vodka comment?!
 
Still dont think you'd be able to penetrate his veil of cognitive dissonance, but at least you dont come off as being completely dissmissive.
 
Damn! When you guys go passive aggressive, go fu**ing passive aggressive!
Who the hell upvoted this?!
I think you're mostly looking at a performance penalty since you'll be parsing every HTML file instead of just shooting it out to each visitor. Size of penalty may be small. — BrianAdkins 10 hours ago
 
heh, just had a guy try to connect to me on LinkedIn. When asked, he claims to have met me at the OWASP meeting last week. Interestingly, I wasn't there, even though I arranged it...
 
8:34 AM
@AviD Come on.. with 500+ connections, everybody would think they get a job somewhere in your network.
 
@AJHenderson "then there is no more risk than having PHP files processed by PHP" - no more risk being the operative term here, that is you have just as much risk by having the PHP at all... not trivial at all, but obviously I get that it wasnt the point of the question... — AviD 19 secs ago
never miss a chance for PHP bashing.
@Adnan lol, it is possible, I do get all kinds of offers all the time - but thats not just about LinkedIn, I know personally every single one there (and worked with most).
that's why I dont just connect to anybody who's heard my name, or found me in a keyword search.
I just find it funny when somebody claims to have met me - I would know that I wasnt there!
 
@AviD You know, I do understand having a certain baseless opinion about a programming language, I have some of my own. We joke about it all time here, it's alright. But in that comment you're implying that PHP, per se, is insecure.
Do you think that's ethical?
I believe you should at least add "IMO" or something similar.
 
@Adnan well no, I'm not implying it, I'm stating it outright.
but no, it's not baseless, nor opinion only.
 
@AviD Alright, I'm not going that path again.
@AviD Why would they claim that? Just to expand their circles?
 
while it can be possible to build a relatively secure PHP application, fact is that (a) the near majority of them are *not, and (b) there are flaws galore in the php framework.
 
8:42 AM
@AviD Again, this is a completely ignorant statement (not by itself, but by shoving it in this context). But I'll do my best not to be dragged in this discussion again.
 
@Adnan heh. fair enough, at times it does seem like a religious argument, and only way to get out of that is to get in really deep.
@Adnan heh, too late ;-)
you're right, though, in this context it is completely uncalled for.
dammit, you convinced me to recant. just about that comment, not about my blatant heterosexuality.
 
@AviD was that sarcastic :p?
 
@LucasKauffman the bit about his heterosexuality? I'd guess so :op
3
 
@LucasKauffman no, really - I think the original comment was a bit too aggressively dismissive, even disrespectful - kind of like a "fackin' programmers" type comment. Now it's better.
 
8:50 AM
@AviD wasn't meant that way more as a 'get some training'
 
right, and your last part made that clear now.
 
 
1 hour later…
9:55 AM
0
Q: Random pages getting created on classic asp site

Chetana KestikarIn the file structure of my site, I see some randomly generated files like 'justinbieber.asp', 'justinbiebershoes.asp','guccishoes.asp' etc. I tried deleting them but they are generated again. Can anybody tell me the cause of this? Is my site hacked? How do I get rid of these files forever? Edit...

 
10:13 AM
mmm Hendrik deleted my comment, while I didn't think it was offensive
@AviD is it worth to making a meta question for that or not really?
as I don't want to release the drama-llama
 
10:25 AM
@LucasKauffman That depends on whether you really think the comment was wrongly deleted.
Personally, I wouldn't worry too much about comments. Actually, I think they're overused, but there you are.
For example, here's a comment on SO saying exactly what I said in my answer: stackoverflow.com/questions/4852548/…
 
So, I just shut down an open resolver on one of those disused machines in another data centre every organisation seems to have.
It has three IP addresses regularly requesting "ANY isc.org".
 
@Ladadadada You've just done the internet a great service :)
 
@LucasKauffman He deleted mine as well. :( I just pointed out that the OP was probably incompetent. Was that offensive?
 
Hey, does anyone know how reliably unique PHP session cookies are?
 
10:45 AM
@Ladadadada I personally always override it and do something like session_id(somePRNG());
 
@TerryChia I find their incompetence offensive.
@LucasKauffman meh, as @AntonyVennard said, its just a comment. who cares?
@Adnan but cmon, its not really a falw in PHP, right...? ;-)
kidding, not getting into that all over again
 
@Adnan Thanks, I knew that was out there somewhere. Good to know you've got the links at your fingertips. :-)
 
@AviD In this case, yes.
 
2 mins ago, by AviD
kidding, not getting into that all over again
 
The problem I'm investigating is what appears to be two different users accidentally getting the same PHP session ID.
What's more likely is that there's a bug in the code that determines these things and acts upon them.
 
10:55 AM
@Ladadadada Look down a bit, you'd find the C code to generate the values, then you'd know how likely it is.
 
any software, by any developer, can have a security flaw. the fact that one exists means nothing. It's how it's handled afterwards that matters, in addition to the density of flaws, and the WTFishness of them.
 
@AviD If you want to be really pedantic, it's a flaw with the particular PHP interpreter being used, not PHP itself. I recall reading a really amusing argument either on SO or Progammers about how the language and the (interpreter/implementation) are totally different things. :P
 
@Ladadadada But anyway, I'm checking my SVN store for you, I have the magic line somewhere.
 
@TerryChia sometimes its very true, sometimes its missing the point. "language" does not mean just the syntax.
 
@AviD This one is definitely a case of "missing the point". :P
 
10:57 AM
The lack of real entropy could easily be made worse by the fact that the website in question is load-balanced across dozens of VMs, all using NTP locally. Values like gettimeofday() and the PID are far more likely to be identical.
 
Although a little part of me dies whenever I look at or write PHP code. The language is just ugly.
 
@Ladad Found it session_start(); session_id(bin2hex(openssl_random_pseudo_bytes(24)));
 
@Adnan Thanks. I might throw that one at our devs. :-)
 
@Ladadadada Now you got me thinking, is 24 bytes too much?
 
@Adnan Probably. 16 bytes would render it pretty much unguessable.
But I don't see any particular harm in asking for 24.
 
11:09 AM
Guys, a little backing on this one please.
@BrianAdkins Incorrect! Anything outside <?php ?> (or its equivalent) isn't touched by PHP. The web server takes it from the disk and serves it to the browser. — Adnan 38 secs ago
the comment above it is wrong, and it has an upvote, I don't want people to be confused and think it's correct.
 
@Adnan +1 for you. But this is the first time I ever hear anyone mentioning a performance penalty related to parsing php files....
Seriously, is this a concern to anyone?
 
@TerryChia I don't think so.
 
The performance penalty for parsing/compiling would be under a millisecond on the boxes I manage, even for a whole lot of PHP in a file (with no includes). I wouldn't have bothered mentioning it for HTML files with no or very little PHP in them.
 
@Adnan I'm gonna start learning how to pick locks. Any recommendations for any particular types of locks to start with?
 
Actually, I think that <?php ?> tags have nothing to do with PHP itself. They're just a way to tell the webserver that when it sees them it needs to send what is inside them to the parser instead of spitting them verbatim .
@TerryChia Always start with the pin tumbler. They're cheap, easy to learn, and can be made more challenging by using different kinds of pins.
 
11:17 AM
@Adnan I think that sounds right. The PHP parser won't be looking at the files themselves. Just whatever the web server tells them to parse.
@Adnan Roger.
 
@TerryChia I recommend buying a practice pin tumbler lock so you can see what is going on.
 
@TerryChia well, if it was, they wouldnt be using PHP, now, would they? ;-)
 
@TerryChia Something like this ebay.com/itm/151056970372
 
@Adnan @TerryChia no, it doesnt work that way. the webserver has a mapping of filetypes / filehandlers. if the php engine is configured for .html files, it will always be processing the entire file. the webserver would not be looking at the contents at all.
 
@TerryChia I started by going to my local HackSpace's monthly lockpicking session. They brought a variety of locks and picks along and we got several hours to play with the lot.
 
11:22 AM
@AviD I see. But still, stuff outside <?php ?> aren't actually parsed by PHP, right?
 
basically, your comment there is wrong, and his is correct, but inaccurate. the penalty would be miniscule, if at all possible to be measured.
 
@AviD Hmm I see. So if the php engine is configured for html, how does the parser parse the html data?
@Adnan Aye, will pick one up soon.
 
@AviD I see. I'll remove it.
 
@Adnan well... to be accurate, the PHP engine would be parsing the entire file. it would (probably, did not actually review its internals) have to search contents for the <?php ?>, and if it doesnt find it it would shortcircuit the language interpretation and spit back out the html.
@TerryChia it doesnt really, it searches it for PHP code to interpret. BUT it does have to process the file.
 
@AviD Ahh alright. Time to add that to my knowledge pile.
 
11:25 AM
think of it this way: static files are handled directly by the webserver code. anything else, gets handed off to the PHP execution engine (I think that this is implemented differently depending on webserver), to be handled there.
so basically the webserver examines the filetype, and either throws it back on the user's connection, or makes a call to the PHP engine (either module, IPC, or whatever). the PHP engine then reads the file, and decides what to do with it - either interpret the code, and generate the response onto the connection, or just pass-through the contents onto the connection.
 
@AviD @TerryChia Time to break out our pitchforks and torches
 
Now, mind you, I did not actually study the execution internals of PHP, but this is my understanding. It is also how just about every other one would work.
 
I always find it funny when people call you sir on here
 
someone called me sir...??
 
@AviD Sir.
 
11:29 AM
@AviD they call you tiger
 
11:49 AM
@ScottPack Good luck with the house hunt!
 
@LucasKauffman It's all fun and games until they call you "friend" and they start asking you for sexy pics.
5
 
@LucasKauffman well, your mom does.
 
@Adnan Hello friend.
 
Mellon.
 
@ScottPack Unfortunately, my calendar's ended up pretty full today. I'd hoped we'd be wrapped up by now, and I'd get to have a leisurely day today, but alas, it has not come to be.
 
12:06 PM
That's nice. OVH have a tool to determine whether your IP addresses are open resolvers or not: ovh.co.uk/cgi-bin/tools/dns_security.cgi
 
@Ladadadada I've tried 3 IP address (totally different networks) and I'm getting the same error
> Problem detected: Given IP (x.x.x.x) is not in OVH ranges
 
12:27 PM
They will not allow that beyond their own network for legal reasons probably
 
Were the IP addresses you chose in an OVH range?
 
Oh god.
0
Q: Truecrypt Bruteforce, dictionary atack

Michael Saizi forgot my truecrypt password (yes i know its stupid), so i try to recover it doing a dictionary atack on my encrypted hdd, the thing is i know that my password is build out of six parts wich has about 3-30 differnet possibilities... have the same system for all passwords (easyer to remember) i ...

 
Their goal to help their own customers not be part of a DDoS.
 
@LucasKauffman Aha. That's probably why.
 
I don't like OVH
 
12:29 PM
@Ladadadada Got it! I still think they should just scan their own range automatically and inform their customers.
 
they force you to install their kernel
 
Don't you think so?
 
which is backdoored
and they also add their public key to your root account
 
I don't like OVH either, but we have a couple of boxes with them because they're cheap.
 
and if you remove it your machine goes into 'unscheduled maintenance'
@Ladadadada have a look at Hetzner instead
 
12:31 PM
@LucasKauffman We're mostly in EC2. If we migrate those functions it will probably be into EC2.
This was rather interesting. codeascraft.com/2013/06/04/…
Will be something I keep in mind if we ever get big enough to have big data.
 
@LucasKauffman What the hell are these prices?! Damn good! Do you use them?
Mind = blown
y i thought so already.. but i still need a tool, or inform about how to get the header file from the disk and creating my own rainbow table to find a collition ... — Michael Saiz 33 secs ago
 
12:48 PM
@Adnan I actually use an old account I have with a friend at leaseweb
which is super cheap colo
but a lot of my friends use hetzner
a lot of them migrated from OVH to hetzner
 
@Gilles I have an idea. I'll double rep-whore.
 
1:06 PM
@LucasKauffman I think I'll give them a spin.
Behold! Double rep-whoring!
0
Q: How can I spoof a phone call and make it appear to come from another phone?

Adnan[Hypothetical question. Created to preserve my answer on this qustion] I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get them to reveal some sensitiv...

@Gilles Why did you remove the first line? (I'm not asking in disapproval, I just want to know the reason from your mod point of view)
 
2:06 PM
@Gilles I have to say. I disagree completely on your assessment with the forensics bit. We would never bother going through all the trouble of tearing apart an iPad to grab a JTAG and inject a binary.
@Gilles We would use DFU mode, like what @RoryMcCune says, or use a piece of software to crack the passcode. It's a lot faster and less likely to damage the device.
@Xander Meh, it happens. I'm sitting in the OSU student union right now. It's pretty, but everything is freaking red and grey. Feels a little clashy.
@Xander I'm spending this time trying to do some data analysis before I meet with my advisor tomorrow.
 
2:28 PM
@ScottPack TBH for me the easiest way is usually grabbing a copy of the device backup. It gets backed up whenever connected to a device and iTunes loads, and the most you can do is require a password, you can't require a good password :)
 
@RoryMcCune Oh exactly. Having a backup is at least as good as having the original device. There have also been times where we've had the device, but for whatever reason couldn't change the code or get it.
I haven't had a chance to sit down and use it yet, but I've been told Lantern, from Katana, is really nice.
 
@ScottPack yeah then the DFU mode thing is the way to go, I keep hoping for a new DFU style exploit for more modern iOS devices...
 
We were pretty bent with EnCase v7 and what they did with the mobile device stuff.
We bought their Neutrino seutp for v6, and while it was pretty awesome the software sucked. Then v7 came out, they rolled that into the main software package...but not really.
 
@ScottPack ooh looks like that lantern thing has a free imager could be v.handy
 
@RoryMcCune Talking about iOS exploits, have you seen the recent buzz about the charger one?
 
2:34 PM
okay, explain something to me. Right now, e.g. NYC is not in EST, but in EDT, right?
so you change timezones twice a year?
I thought the whole timezone thing supports DST implicitly.
 
@TerryChia yeah I'll be v.interested to see the detail on that one and whether it's a practical attack on a locked device...
Ahh that free imager only supports the devices that have the DFU mode problem so really it'll just be a wrapper round the free stuff. still could come in handy I guess
 
@RoryMcCune From the talk description, I'm actually rather surprised that people consider it a big deal. I always thought people understood the risk USB chargers pose? Heck we even have a question about it here.
 
@RoryMcCune you guys are still UTC / GMT, even though its daylight saving? is that right?
 
@AviD Right now, yes.
@AviD The official timezone is usually called EST5EDT
 
@AviD GMT+1 at the moment
AKA BST
 
2:37 PM
@ScottPack oh damn now thats just confusing.
 
so yeah for the summer Greenwich isn't on Greenwich mean time
 
@RoryMcCune ohhh right okay.
 
@AviD What's funny is we spend less time in standard time than we do savings.
 
so here's whats confusing me. Somebody is trying to set a schedule with me, and he writes lets say "1pm EDT / 6pm UTC".
I'm not crazy, right? He has a mistake there.
cuz EDT is UTC-4.
 
Tardwrangler.
3
 
2:40 PM
@ScottPack the thing that really narks me about iOS forensics stuff is the way that companies try and hide the fact that they can't do locked / off acquisitions on anything more modern that an iPhone 4/iPad 1. It's usually there in the small print but very absent from marketing material
 
'course I made the same mistake, assuming I'm in UTC+2, but at least I was consistent - I referred to EST. so I was an hour off my own time that I intended, but the times I gave him made sense.
 
@RoryMcCune No doubt.
 
How did this discussion about iOS forensics originate again?
 
@RoryMcCune I pretty much only get called in to do the linuxy and android stuff. I'll have to see what we use to crack the passcodes.
@TerryChia The comments on this question
 
@ScottPack ahh I may have a question for you later this month. Have some work coming up looking at android security so may want to pick your brain :)
 
2:42 PM
@TerryChia The forensics examiners in the room disagree with the programmer on what constitutes professional behavior for forensics people. :)
@RoryMcCune You may pick whatever little there is!
 
@ScottPack Ah, obviously the forensics guy is right. Damn programmers....
 
damn timezones. on top of the quirky definitions, any given client will handle them differently. sometimes its implicit, sometimes explicit, sometimes not at all.
actually its daylight saving time thats causing the issues. Damn Ben Franklin.
 
GAA! I can't find in my own code where I'm doing specific calculations. NEED MOAR SUBS!
 
@AviD See, all our timezone problems will be solved if we just communicate in Unix time.
 
@AviD I despise DST!
@TerryChia Re-think that sentence.
 
2:45 PM
@Adnan you ever go through a manual time shift for a large corp with a big server farm?
 
3622
A: Why is subtracting these two times (in 1927) giving a strange result?

Jon SkeetIt's a time zone change on December 31st in Shanghai. See this page for details of 1927 in Shanghai. Basically at midnight at the end of 1927, the clocks went back 5 minutes and 52 seconds. So "1927-12-31 23:54:08" actually happened twice, and it looks like Java is parsing it as the later possib...

 
yknow, before all this automated stuff.
 
@AviD Nope, and I hope I don't have to.
 
I remember when they changed the time change dates a few years ago.
Every single goddamn Cisco device required a manual change
AH-HAH! No wonder I couldn't find that bit of code. It was in a different script!
What asshole build this?
 
3 mins ago, by Scott Pack
GAA! I can't find in my own code where I'm doing specific calculations. NEED MOAR SUBS!
 
2:47 PM
@ScottPack You, mellon?
 
Man. That @ScottPack is such a pigfarmer.
7
 
@Adnan not fun. nowadays it is (or should be) a hella more simple.
 
Goddammit I hate writing reports.
 
@TerryChia What are you writing reports about?
 
@Adnan Some crappy school module. What a waste of time.
 
2:48 PM
It's nice to see that everybody here is complaining about something. This is like sitting with my girlfriend x3
 
@Adnan Except none of us are complaining about your ahem performance.
 
@ScottPack I think @Gilles mentioned that yesterday.
 
 
1 hour later…
3:55 PM
Ahoy
 
@Simon boat programming?
 
00:00 - 16:0016:00 - 00:00

« first day (902 days earlier)      last day (3983 days later) »