The DMZ

Lucas Kauffman

01:35

@Iszi yea these are the taxes:

0 - 7900 euro - 25%; 7900 - 11.240 euro - 30%; 11.240 - 18.730 euro - 40%; 18.730 - 34.330 euro - 45%; 34.330 euro - 50%;

and you need to add another 13.07% for social security

Terry Chia

03:21

@LucasKauffman I see you have embraced ASCII art in an attempt to rep whore.

Lucas Kauffman

03:50

@TerryChia I might have.

@TerryChia you do not like my ascii art?

Terry Chia

@LucasKauffman Fine you stinking rep whore. +1

2

Lucas Kauffman

hahaha

Terry Chia

Have you checked out Gistbox Clipper btw? Really handy tool.

Lucas Kauffman

let me have a look

that's handy to keep track of code samples

@TerryChia hows the studying going?

Terry Chia

@LucasKauffman Yep! It works on SO so it's awesome.

@LucasKauffman Not too bad. I cleared all the easy stuff yesterday so I'll be starting on the harder stuff today.

Lucas Kauffman

04:00

It's cool they give you the opportunity to do it

Terry Chia

> "Our experience is, it all leads to more penetration, more paying subs and more health for HBO."

theverge.com/2013/8/8/4602764/…

That just sounds wrong.

Stack Exchange

04:16

Remember, meteors always hit the tallest object around.

Lucas Kauffman

09:39

urlybits.com/2013/06/russian-tampon-commercial

crazy russians

Terry Chia

09:54

@Svetlana ?? I don't get the downvote...

Polynomial

oh no, if we're going for crazy Russians, this takes the cake: telegraph.co.uk/finance/personalfinance/borrowing/creditcards/…

Terry Chia

Parameterized queries IS separating code from data....

Svetlana

Ahhh.. again with the fucking retaliation upvoting!!

@TerryChia I know you think it is, but that's not what it means in the context of the OP's question.

@TerryChia Just because parametrized queries means that the input of the user isn't part of the query, doesn't mean that separation of code from data = parametrized queries.

Terry Chia

@Svetlana So what do you think it means..?

I'm gonna go grab some food. brb.

lynks

@Polynomial hacking the planet.

Svetlana

10:02

@TerryChia First of all, this is about XSS. Separating code from data means that you don't shove layout and user input in your main logic. Making it easier for you to have a central code for encoding and escaping user input.

Think, MVC.

@Terry One example for this "technique" of centralizing security-related stuff is by making a single point for authenticating users. Making it less likely to fuck up the authentication process in certain pages.

Implementing that in PHP would be by using something like include auth.php

and it's not just what I think it means. That is what it means.

Just because the fridge is an electrical appliance, doesn't mean that whenever you hear the term 'electrical appliance' then it's referring to a fridge.

Terry Chia

10:17

@Svetlana I completely disagree with your interpretation. Read the quote, it has nothing to do with code design which I agree is a very good idea in any case.

Svetlana

@TerryChia I have read the quote several times. I still think you're wrong.

@Terry source of the quote cwe.mitre.org/data/definitions/116.html

Terry Chia

@Svetlana Yes.

> For example, stored procedures can enforce database query structure and reduce the likelihood of SQL injection.

Svetlana

@TerryChia Jesus Christ! Dude, I'm not saying parametrized queries aren't part of a separation strategy. They just have nothing to do with this question.

Terry Chia

You and I both know the issue at hand is an XSS one. Maybe the OP doesn't when he grabbed that quote from somewhere. Given the very unclear state of his question, I gave him a more general advice on what to do. I linked to both XSS and SQL injection cheat sheets from OWASP.

I think it's unfair that you downvoted when there isn't anything wrong with the answer.

Look, the other answer also mentioned parameterized queries. That's how I interpreted the quote.

Svetlana

@TerryChia Yes, I agree. It would be unfair to downvote you when there's nothing wrong with your answer. But there is, it doesn't address the question.

Terry Chia

10:22

If you feel differently, feel free to provide your own answer and let the OP decide.

Svetlana

@TerryChia Oh wait wait (check the message I'm to which I'm replying), you see.. stored procedures. They're different from parametrized queries. Actually, stored procedures are part of the separation strategy I talked about.

Also, just read one line above and see the title of the section

> Phase: Architecture and Design

and then you say:

> Read the quote, it has nothing to do with code design which I agree is a very good idea in any case.

@Terry Anyway, I don't want to upset you. Downvote taken back.

However, I still think you haven't addressed the question.

Terry Chia

@Svetlana I know they are different. But they are used (in most cases) to accomplish the same thing which is preventing SQL injection attacks. I'm also reading that Architecture and Design phase as "Choose a framework that helps you with this type of stuff; choose parameterized queries/stored procedures over dynamic SQL." I don't think it's about how you structure your code ala MVC and the like.

I also don't know how to provide a better answer given the generally crappy state of that question...

Svetlana

@TerryChia That, I fully agree on.

Terry Chia

Anyways, back to studying. :zzz:

Lucas Kauffman

10:39

@TerryChia nice army o.O

you've got more airplanes than we have

I can see the F-16s circling marina bay from my appartment

and the chinooks and apaches

with the flag

Svetlana

@LucasKauffman Is it some military show? Or just a normal day there?

lynks

I want to VtC, but superuser isnt right.

0

Q: Why google has so many IP addresses?

Why does google has so many IP addresses and how the dns-server knows which of them to use when I ask for www.google.com in the browser ? nslookup google.com Non-authoritative answer: Name: google.com Address: 212.179.180.113 Name: google.com Address: 212.179.180.95 Name: google.com Addre...

google ip

Lucas Kauffman

@Svetlana national day, it's the parade

@Svetlana it's really cool tbh

Svetlana

@lynks VTC with Codes' reason, and flag for mod migrate.

@LucasKauffman Sweet!

Lucas Kauffman

@Svetlana It's really cool to see the planes circling, they are supposed to do a paradrop as well, but it's getting quite dark atm. Hope they can do it still

@Svetlana ndp.org.sg live stream here

The planes are in a holding pattern flying circles to and from the sea

ah they are going to the stadium now

Svetlana

10:50

@LucasKauffman Awww.. everybody is so happy

but I don't see you there!

Lucas Kauffman

@Svetlana I wish I could be proud of my country like that :p

@Svetlana airplanes should by flying in right about now

Terry Chia

@LucasKauffman Huh, didn't know they have a freaking live stream now.

Lucas Kauffman

@TerryChia the irony :P

@Svetlana I'm the guy in red and white.

Svetlana

@LucasKauffman National pride is overrated. But why aren't you?

Lucas Kauffman

@Svetlana because it's a giant circus, our army has material but no funds to train with them, the last time we sent in active combatants was 10 years ago and only recently we started actually using our almost 40 year old F16 in combat

@Svetlana and all the corruption scandals we had in the past 20 years

here come the chinooks and apaches

AviD

10:56

Being proud of your country does not require you to not be ashamed of your government.

Svetlana

@AviD Was about to say it

AviD

In fact, I would say it's usually the opposite.

Svetlana

@LucasKauffman Actually, I really don't think that your country not sending soldiers to combat is a reason to feel less proud of it.

AviD

@Svetlana again, often its quite the opposite.

Lucas Kauffman

@Svetlana it's the reasons why we don't send them in

it's changing though our new defence minister is really good

AviD

10:59

@Svetlana the last time we sent soldiers in, it was fubared up beyond all recognition.

Svetlana

@LucasKauffman I don't know. I really think national pride has nothing to do with current politicians' actions.

@AviD When?

AviD

@Svetlana or the current system, broken as it is.

@Svetlana Lebanon, 2006.

Lucas Kauffman

@AviD You are Israel, you give the finger to the rest of your region <.<

AviD

@LucasKauffman heh, but meh.

2006 Lebanon War

|commander2=Hassan Nasrallah Imad Mughniyeh Nabih Berri Ali Qanso Khaled Hadadi Ahmed Jibril |strength2= Several hundreds (south of the Litani river) |casualties2=Hezbollah militia: 250 (Hezbollah claim) ≤500 (Lebanese officials' est.) 500 (UN officials' est.) 600-800 (IDF claim) Wounded: 1,500 (Lebanese officials' est.) Captured: 4 fighters Amal militia: 17 dead LCP militia: 12 dead PFLP-GC militia: 2 dead ---- IRGC: ~6–9 dead (Lebanese officials' est.) Lebanese Army and Police Forces: 43 dead |casualties3= Lebanese citizens (combatants included) and foreign civilians: Dead:* 1,191 (...

Svetlana

I really think there should be a close reason "This question is stupid. Neh neh nahaha"

6

Lucas Kauffman

11:02

bcrypt is actually the name of the home of magical dwarfs who takes in arbitrary inputs and spits out jumbled nonsense we humans call a hash. — Terry Chia 39 secs ago

hahahahaha

AviD

hehe. how come noone vtc'ed that?

Lucas Kauffman

the one thing we do well is producing weapons

AviD

@LucasKauffman and beer.

Lucas Kauffman

we still supply most of the firearms to the US army

Terry Chia

@LucasKauffman :P

AviD

11:03

and drugs, and prostitutes....

Terry Chia

@AviD What is a good close reason? There's so many to choose from...

Ah well, Too Broad it is.

AviD

closed as duplicate of the wikipedia page?

Terry Chia

@AviD See, we need that as a close reason.

AviD

some sites used to have it...

Svetlana

@AviD Oh yeah, that was a fucked up business. A ground assault was a miscalculated move.

Lucas Kauffman

11:05

@AviD I wish we were a bit more like Israel ==> "Ow you fucked us over, no worries let me send in a striketeam and let you magically appear in Israel where you can stand trial."

AviD

@LucasKauffman heh, I wish Israel were more like that Hollywood version of Israel ;-)

@Svetlana sure, but the problems only started there.

Lucas Kauffman

@AviD hollywood version :p? Adolf Eigman, Operation Entebbe,...

AviD

Bad implementation, based on a poor design, to fill improper requirements.

Svetlana

@AviD I would say yes.

Honestly, I think the ground assault was just for the show. There was no foreseen strategic advantage

AviD

and that doesnt even cover all the problems.

@Svetlana there was no foreseen thought, or planning.

it did lead to a whole slew of senior officers getting sh*tcanned, but didnt go far enough.

it was almost completely the politicians' screw ups, and noone there felt the heat.

Svetlana

11:10

Israel can easily be in a position of air supremacy. The strongest point for it is IAF. Hezbollah had no proper defence.

AviD

@Svetlana well, its not that simple.

Lucas Kauffman

@AviD it is, the problem is the russians might start supplying GAMs and then it would become a giant hell hole of international fubar :p

AviD

air+artillery was attempted in lebanon before (winter of 95-96). the problem is Hizballa is not a standard army, with tank columns, infantry lines, etc.

you cant airbomb a squad of 3 wandering the hilltops...

lynks

why do we not have migrate to crypto?

Terry Chia

@lynks beta site.

Lucas Kauffman

11:13

@AviD you can use drones

with hellfires

Svetlana

@AviD But that wasn't the issue in that case. The issue for Israel is missile caches and launchers, those things can be bombed.

lynks

@TerryChia :(

Lucas Kauffman

@Svetlana depends where they store it

AviD

@LucasKauffman the "not simple" being its hard to fight guerrillas with a regular army, let alone air force.

Lucas Kauffman

hezbollah had a nasty habbit of putting those things quite near to hospitals and schools iirc

AviD

11:14

@Svetlana cuz the US had such luck with that...

Svetlana

@LucasKauffman Awwwwwh.. mainstream media.

AviD

@LucasKauffman yes, that is a big part of it.

the other part is these are small vehicles, or handheld units. Easy to hide, easy to move, they pop out just long enough to shoot and they're gone.

Svetlana

@AviD Honestly, not as big as some would imagine.

AviD

@Svetlana THATS WHAT SHE SAID!!

Svetlana

@AviD This is the biggest part of the problem.

AviD

11:15

@Svetlana well, its both.

Svetlana

@AviD Of course, I'm just saying that mobility is their strongest point.

AviD

Even if intelligence could find the missiles, they are often hidden in a "safe" place, safe being in a place where Israel would not bomb, until they are ready to shoot.

@Svetlana mobility alone is not that big a deal. We've hit moving targets, even with artillery 30 KM away.

its the "not being able to shoot at them before they fire" part.

Svetlana

@AviD I probably didn't phrase it correctly. I meant all the factors involving engaging guerrilla fighters.

AviD

ah, sure.

and the hospitals/schools/etc is a natural part of that.

Svetlana

Now all I think about is giant guerrillas getting engaged.

@AviD Indeed

AviD

11:18

heh.

Svetlana

@lynks Awwwh! I didn't load your comment!

AviD

okay, I decided to close as Unclear.

as in, unclear what else you want besides the wiki page.

lynks

so who is behind the new zine "PoC || GTFO"?

Lucas Kauffman

@lynks my clients

:p

lynks

@LucasKauffman looks like it is a phrack offshoot

Svetlana

11:27

Apparently, there is a @Lucas @Simon style song called Svetlana youtube.com/…

By the way, is that Dutch?

Lucas Kauffman

@Svetlana german

@TerryChia do you also have such a funny accent :p?

Svetlana

@LucasKauffman YOU HAVEN'T MET HER YET?!

Lucas Kauffman

@Svetlana no :(

@Svetlana she be studying for RHCE

Svetlana

@Thomas Edited.

@LucasKauffman Excuses.

AviD

aww this is brilliant: wikiloopr.com

brought up by this:

11

Q: Do all Wikipedia articles lead to Philosophy?

Wikipedia trivia: if you take any article, click on the first link in the article text not in parenthesis or italics, and then repeat, you will eventually end up at "Philosophy". - Randall Munroe, XKCD (mouse-over text) I have tried this for several different articles and was surprised t...

internet

and of course:

Wikipedia trivia: if you take any article, click on the first link in the article text not in parentheses or italics, and then repeat, you will eventually end up at "Philosophy".

but that loopr site is fun.

Lucas Kauffman

11:34

@AviD there's a similar one for adolf hitler

AviD

hmm? all sites lead to philosophy, not hitler.

what youre thinking of is that all Internet discussions eventually wind up with nazi name calling.

That's Godwin's law

Svetlana

@AviD I'm trying to get the longest link

AviD

@Svetlana of course you are.

I think that has more to do with genetics.

Svetlana

Best I got is 15

AviD

total, or pre-loop?

Svetlana

11:39

@AviD Total

AviD

bah, Hawaii gives 27.

Svetlana

@AviD It gave me 15

AviD

the Philosophy loop itself is 15....

Simon

@@@

IT'S TOO EARLY TO BE PRODUCTIVE

Terry Chia

@LucasKauffman I don't know... :P

AviD

11:46

dya mean, like, in life, or in the week?

Terry Chia

@AviD Probably both. And neither.

Svetlana

@TerryChia Teach me more, master.

@Simon It's 8:00! It's the perfect time to be productive.

Simon

@Svetlana I'm usually productive at 10 P.M.

Lucas Kauffman

@TerryChia when you speak do you tend to make your vowels at the end of a word sound long

Simon

@LucasKauffman looooooooooooong

Lucas Kauffman

11:50

@TerryChia Like the big large fishlion is talking on the tv o.O

@TerryChia that fishlion is bad ass

now it's the ladies in swiming suits

Simon

I could write a song about it: "IT'S TOO DAMN EARLYYYYYY"

"TO BE PRODUCTIIIIIIIIIVE"

"DJ STEPHANIE"

"WHERE ARE YOU MY ANGEL?"

I'll stop here, it was only a preview.

Lucas Kauffman

@Simon you need help.

Simon

@LucasKauffman I just need to sleep 8 hours a night once in a while and it's been a while now.

It's funny how I need help when there's a transsexual around.

Terry Chia

@LucasKauffman Hmm, I don't think so. But then again, I'm not the best person to judge. :P

Simon

I refuse to say his name.

@TerryChia juuuuuuudge

Terry Chia

11:59

@Simon you need help.

Simon

I'm ok guys, I swear.

Lucas Kauffman

@Simon when is the last time you took your meds?

Simon

@LucasKauffman I don't take meds!

AviD

@Gilles my problem is that its a poorly asked question, but determining which hash was used definitely has security implications.

Terry Chia

@Simon That's the problem.

0

A: Top 10 dangerous mistakes in C programming?

The topmost dangerous mistake in C programming is using C. This is an unpopular assertion, but decades of experience back me up. C is a nice programming language in that it allows you to express operations in an "abstract machine" (that's how the C standard puts it) which will get translated eff...

I can't believe The Bear mentioned python and C# in the same sentence as node.js. :(

Lucas Kauffman

12:04

@TerryChia even perl :/

crazy bear is telling crazy stuff

Lucas Kauffman

12:56

@TerryChia after all this stuff about Mata Mata on tv I feel forced watching it

Svetlana

@Simon Simon Simonie

Simon

Yes?!?

Lucas Kauffman

@TerryChia they have the funny accent I was talking about :p

Svetlana

@Simon How are you?

Simon

@Svetlana gudu?

Svetlana

13:07

@Simon Ooooh... you're learning Verdana Garantena?

Simon

@Svetlana yh

Lucas Kauffman

@Svetlana durkadurka?

Svetlana

@LucasKauffman That's not even a word in any of the Garanteni languages

Lucas Kauffman

I tried looking it up

but interwebz refuses to help :(

Svetlana

@Lucas You should really learn one of the Garanteni languages.

I recommend Verdana Garantena because it is the rarest of them

Lucas Kauffman

13:20

@Svetlana but where can I learn this?

Svetlana

@LucasKauffman I guess the easiest way is to find a Garanteni girl in your area and start going out with her.

Lucas Kauffman

@Svetlana I doubt my gf would like that

Svetlana

@Lucas We have a referral-only .onion forum, you can meet Garanteni people all over the world.

Lucas Kauffman

@Svetlana ah cool is this a secret society thingy?

Svetlana

@LucasKauffman I feel so bad for deceiving you :(

I can't stretch the lie any longer

Lucas Kauffman

13:25

what :(?

Simon

#BBA13

Lucas Kauffman

@Svetlana what u do ? :(

Svetlana

@LucasKauffman I have no idea what Verdana Garantena is. @Lamia made it up and I just picked up from there.

Lucas Kauffman

LOL

u troll

Svetlana

@LucasKauffman I haven't agreed with her on anything. She's a great actress!

@Lucas The best part was when we started speaking it together

2 days ago, by Adnan

@Lamia Murkla vonta prilano?

@Simon What's wrong?

Lucas Kauffman

13:29

you bastard

@Svetlana did you plan to go for brucon?

Svetlana

@LucasKauffman Yes I did, but I changed my mind after I wasn't able to convince anybody to go with me.

Thomas Pornin

@Iszi: Get-ChildItem will return zero, one or several objects. When you get several, they are automatically wrapped into an array (Object[]). If you get one, then you have the object itself (e.g. a System.IO.FileInfo, not an array of one object). If you get zero, then value is $null, not an array of zero object.

Lucas Kauffman

@ThomasPornin Bear, why u believe node.js is good?

Thomas Pornin

@Iszi: you can normalize things by doing: "if ($val -eq $null) { $val = New-Object Object[] 0 } elseif (!($val -is [Array]) { $val = @($val) }"

There is probably a better way, but at least this will work (well, once formatted, tested, and the typos removed, because I have done none of this).

@LucasKauffman Node.js, like many other languages, offers simple management of character strings (with automatic memory management), checks on all array accesses, and strong types, which avoids the common pitfalls of C programming. In the context of the question, it is thus "good".

Lucas Kauffman

13:45

@ThomasPornin okay bear, I trust you.

Thomas Pornin

@LucasKauffman Really, there is no good programming language, only good programmers.

But some languages make it harder for an individual to be a "good programmer". C is such a language.

Lucas Kauffman

14:01

hahaha

@ScottPack just saw ur msg

Thomas Pornin

In other unrelated news, my RFC is published: tools.ietf.org/html/rfc6979

Terry Chia

@ThomasPornin Time to break out the champagne!

Lucas Kauffman

@ThomasPornin I think the university I worked for had a professor which did some research on the whole eliptic curve thingy

@ThomasPornin also: what Terry said :p

Simon

@Svetlana Bring Back Adnan 2013

Author's Address

Damn it, why isn't there any street name in there?

Thomas Pornin

@LucasKauffman Which university was that ?

@Simon My home address is not hard to find. Google better !

Lucas Kauffman

14:08

@ThomasPornin I think he teaches at Yasar

Simon

@ThomasPornin Great, see you this weekend!

Lucas Kauffman

It's a university in Turkey

but I think he also did some stuff in Australia before

Thomas Pornin

@Simon Tough luck; I will be out of town this weekend (and probably the next few weekends as well).

Simon

@ThomasPornin It's ok, I will be up North this weekend. However for the next few weekends, that sucks!

I guess I'm gonna have to come during the week.

Thomas Pornin

@LucasKauffman Probably Huseyin Hisil, then: hhisil.yasar.edu.tr

Svetlana

14:34

@Simon I'm afraid this will persist until the 7th of September.

@Lucas Are you going? (to BruCon)

Lucas Kauffman

@ThomasPornin can be, I know the assistants were talking about him but never met him in person

@Svetlana I might go for the ctf, haven't looked at the talks yet

we used to get a day off but now that has changed

Svetlana

@LucasKauffman Yeah, that's another reason for me as well

HamZa

14:58

Extract to a filesystem directory, not to a URL — Mark Baker 5 mins ago

Simon

@HamZa Haha.

HamZa

@Simon people these days facepalm

Svetlana

15:17

@HamZa But that's a good thing. Those people will grow into the developers who will create applications with vulnerabilities, which we will be paid to fix.

HamZa

Yeah well let's hope you just have to point out the vulnerabilities instead of diving in horrible code and fix it yourself.
Fix in this case means: rewrite almost everything

Svetlana

15:32

@Lucas I'm having some suspicions about the OSCP

I'm currently registering, but it's giving me an error because my street address has ö

What the hell! I replaced it with o

Lucas Kauffman

@Svetlana prepare to be frustrated

:p

lynks

15:54

still cracks me up every time

►

Transcript for