The DMZ

Terry Chia

02:14

@tylerl Ping @Simon.

@tylerl CentOS 4ever.

Scott Pack

02:28

@TerryChia Where "4ever" is defined as "RHEL - 6months".

Terry Chia

@ScottPack Hahahah!

But it's really a matter of preference.

Scott Pack

Full disclosure. I've already documented my stance on that aspect.

11

A: Is CentOS a good choice from a security perspective?

The short answer is this: No, CentOS 5.6 is inherently no more or less secure than any other modern supported operating system. The long answer is a bit more complicated. CentOS is the "Community" release of RedHat Enterprise Linux (RHEL). The differences between the two are fairly small so you ...

Terry Chia

I use CentOS/RHEL on my servers and Fedora on my desktop because it is what I'm used to.

Scott Pack

Same here.

Terry Chia

RHEL is definitely an excellent choice for servers though, if you can afford the RedHat support.

CentOS not so much.

Scott Pack

02:34

What do you mean by "not so much"?

Terry Chia

@ScottPack Because you can't get the support with CentOS. :P

Scott Pack

Oh, yeah.

CentOS would honestly be fine for everything I do. I use RHEL because we have, for all intents and purposes, unlimited licenses. I've never made use of support.

I'm not sure how often the admins do, but I feel as if it's not often.

Terry Chia

@ScottPack If your organization has a team of sysadmins handy, sure. But the support can be helpful for smaller organizations without that much manpower on hand.

Scott Pack

Definitely, although those are often the organizations that can't afford, or justify, the cost of support.

Terry Chia

@ScottPack How does RedHat price the support again? I can't recall.

Is it a per license thing?

tylerl

02:43

I started using Fedora at "Fedora Core" (before they had version numbers), but I have to say that RH's politics are mildly distracting. Lots of their decisions make little sense, but I can't overstress how much cleaner "yum" is for managing packages than "apt-get"

Scott Pack

@TerryChia No clue.

tylerl

I use Ubuntu on my desktop now because RH is so far out in left field that it's not worth even following. But everyone has Centos on their servers, so if you only learn Debian's style you're at a serious disadvantage

Terry Chia

@tylerl Any examples of the decisions that make little sense? I have not been into the Linux scene for that long.

Scott Pack

@tylerl I wish I could remember the reason behind the Unity interface. From what I recall it was purely a pissing match between the Ubuntu devs and the Gnome devs.

Terry Chia

@ScottPack Oh sure, there's that whole Mir vs Wayland thing as well.

Scott Pack

02:47

Admittedly, both of which are pretty self-righteous.

tylerl

@TerryChia look for how they manage network interfaces, for example, in /etc/sysconfig/networks-scripts. There are half a dozen levels of indirection. It works if you understand it, but complex network setups are very difficult to shoehorn into their paradigm. Deb/Ubu uses /etc/network/interfaces which is infinitely both simpler and more capable

@TerryChia As for political decisons, just look at what they did with mpg123 even after they had an explicit patent grant and even after the patents had expired.

Versus what they did with Jpeg for which they didn't have a patent license and which very much was a liability

Terry Chia

@tylerl Ahh. I have zero experience managing Debian/Ubuntu so I can't comment on that. I'm used to using network-scripts though...

@tylerl goes searching through Google

Scott Pack

I'd say the network management is more an indicator of what you learned on. I find the RHEL way much more understandable, but it's what I'm used to.

Actually getting a config in /etc/network/interfaces to work is always painful effort in my experience.

tylerl

@ScottPack I understand both. And I use both. But there are servers with very complex network arrangments that I can't make work properly with RHEL unless I do so with shell scripts

Terry Chia

@tylerl I'd argue that for very complex network arrangements, you will want to be scripting most of it anyway.

Scott Pack

02:56

Care to give me an example of what you mean by very complex? I think the most complicated I've had to do was a bonded interface

tylerl

@ScottPack Multiple purely-virtual networks within a single host used for routing traffic between VMs, but with no actual network interfaces attached

And then of course a separate network attached to the NIC, and firewalling, etc.

Scott Pack

Ah, I've never had to create interfaces that aren't somehow tied to a physical

tylerl

Particularly interesting when the IP addresses you're given to work with by the bandwidth provider aren't on the same network.

But anything is possible.

you just have to think about the rules you're creating and how the network stacks will react to them.

Terry Chia

@tylerl Man, that's nasty.

tylerl

@TerryChia You may enjoy taking an hour or so to read through the lartc guide. There are amazing things you can do with the iproute2 tools today. My projects don't even scratch the surface of what linux networking will do for you.

Scott Pack

03:03

Oh jesus, yeah. That documentation is a fucking brick.

Terry Chia

@tylerl Oh sure, but I'm not a network engineer. ;)

Scott Pack

My first thesis project was writing a real time packet scheduler. I spent a lot of time with the lartc

Terry Chia

I have enough things on my plate already. If only I can get the motivation to finish half of them.

tylerl

@ScottPack I've read the whole thing through 4 or 5 times in my days. Back in 2001 it was seriously sick voodoo.

Scott Pack

@tylerl Even in 2004 it felt an awful lot like fucking magic.

I'm glad I moved off of that project. The scheduler module code is nasty.

Terry Chia

03:08

1

Q: SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the attack was going on the WAN port was downloading at 30Mbit/sec. The uplink on the firewall is 1Gbit...

denial-of-service

Wait, so the dudes firewall is in front of his router?

Scott Pack

I don't see that anywhere in the question.

tylerl

@TerryChia Congratulations on locating the limit of your firewall device.

May be lower load if he doesn't do connection tracking

Scott Pack

Ah, yup, that'll do it.

> UTM Throughput (AV+IDP): 40 Mbps

And 40,000 max sessions

@TerryChia Looking at the specs of the device it's probably a SMB that doesn't have their own router.

This looks like it aims to take something like a business class DSL/DOCSIS and act as your gateway.

Terry Chia

Ok, enough network admin mumbo-jumbo. Back to working on my code. >.<

Scott Pack

Douchewaffle.

tylerl

03:22

@TerryChia what code?

Scott Pack

Probably his new boyfriend.

tylerl

@ScottPack Wow, AI?

Scott Pack

The important part is the A, the I is just a possibility.

tylerl

@ScottPack Meh. Probably just another Eliza clone. "Tell me more about where you want to stick it."

Scott Pack

FYI, @TerryChia. This is what he's talking about.

ELIZA

ELIZA is a computer program and an early example of primitive natural language processing. ELIZA operated by processing users' responses to scripts, the most famous of which was DOCTOR, a simulation of a Rogerian psychotherapist. Using almost no information about human thought or emotion, DOCTOR sometimes provided a startlingly human-like interaction. ELIZA was written at MIT by Joseph Weizenbaum between 1964 and 1966. When the "patient" exceeded the very small knowledge base, DOCTOR might provide a generic response, for example, responding to "My head hurts" with "Why do you say your h...

Terry Chia

03:28

@tylerl Just a personal project of mine. An encryption wrapper around Dropbox's API.

Anuj Kaithwas

hey, isn't googlestore.com owned anyhow by google?

tylerl

@ScottPack You gotta admit it's less funny when you have to explain the joke.

Scott Pack

@tylerl Yeah, but he's like 9 and a ferner. So....

Rory Alsop

09:29

@tylerl ubuntu is easy, but like @Gilles I'd prefer debian

rath

@tylerl not in this case. I loled hard

Lucas Kauffman

09:53

-1

Q: Required Guidence in Information Security

I'm a 18 years old guy . I'm very passionate about information security. This year I'm joining my graduation. I did some random silly things like defacing etc and I used to be a script kiddie .. But now I want to start from scratch and build up my career as a Security Researcher. SO could you gu...

penetration-test

close it pls :3

Adnan

13:07

You know, RyanAir is just like that girl next door. I mean, you're not really that into her. Just a bit below average at best. In bed, she doesn't know what she's doing. She's awkward, shy, and you don't really like hanging out with her.

But on a lonely Saturday night, you don't have enough money to go out. You just swing by her apartment and have some fun.

TildalWave

@Adnan clearly, you haven't flown with them yet :)

the only fun about it is disembarking

especially if you're any taller than 150 cm

Adnan

@TildalWave Exactly my point.

The trip is awful.

TildalWave

@Adnan yes... might I add I didn't have any room for my legs at all... I mean, I had to sit sideways

Adnan

You just enjoy the last bit - arriving to your destination.

@TildalWave And, unlike with the girl next door, I'm not ashamed to admit I've flown with them.

Terry Chia

@Adnan Is the girl next door really that bad? Why are you ashamed? ;)

Adnan

13:12

@TerryChia I don't want to go into the horrific details.

Terry Chia

@Adnan That doesn't sound at all like you.

Adnan

Let's just say she's the opposite of a RyanAir plane.

TildalWave

@Adnan I will most certainly never again, there's so many other carriers even on a tight budget. Lingus was probably best out of those, then Berlin Air, e.t.c. Ryan is by far last on my list

Lucas Kauffman

Swissport on mine

I think their clientel must only consist out of midgets

Adnan

@LucasKauffman RyanAir?

Lucas Kauffman

13:15

@Adnan Swissport is worse than Ryanair, I haven't had any bad experiences with RyanAir except slight discomfort during the flight

but I wouldn't book > 4 hours hauls with RyanAir

best flights I had so far was with LAN airlines and Cathay Pacific

I got drunk with my dad on our Cathay Pacific flight, their wine was just too good

TildalWave

I've newer been with Swissport. Swiss Airlines yes, but that's a whole different rank

Terry Chia

@LucasKauffman Cathay's service is great. My family always fly with them.

Lucas Kauffman

@TerryChia Singapore Airlines is also pretty good, but you have to be lucky not to be put on a Lufthansa flight. Lufthansa is very good as well, but well... they're German and they act German, great quality but friendliness is not always their priority :p

TildalWave

@LucasKauffman I can concur, have been flying them regularly. The beer onboard is pretty good tho, so you don't care so much :)

Lucas Kauffman

@TildalWave yea they have that Wolf something beer

it's pretty decent

TildalWave

13:24

@LucasKauffman Warsteiner

Adnan

Best airline I've experienced is TurkishAir... wow!

I thought, because they're Turkish, something is gonna stick out of the bottom of my seat.

TildalWave

Adnan

But, fortunately, nothing like that happened

Rory Alsop

Best ever in terms of service long haul - Royal Brunei. Generally good: Qantas and Singapore. Best business class: British Airways for Asia, Virgin Atlantic for the western hemisphere

TildalWave

@Adnan Neah they're in Star Alliance like Lufthansa, Swiss Air, even our Adria.

should be good

Lucas Kauffman

13:27

@RoryAlsop Business class

@RoryAlsop We don't get that anymore I think, unless you're lucky enough (clients actually put it in their contracts that we can only use economy)

@RoryAlsop Sometimes if you really need to work, they still allow business

Rory Alsop

@LucasKauffman We only ever got business for long haul (over 3 hours)

but premium economy can be good, and in any case, I made a habit of getting free upgrades :-)

Adnan

@TildalWave Indeed, Star Alliance have the best service.

Lucas Kauffman

@RoryAlsop Teach me how to do that :P

Rory Alsop

@LucasKauffman flirting

that's all you need

:-)

Lucas Kauffman

@RoryAlsop Really?

Rory Alsop

13:30

oh yes

It is one of my main hobbies :-)

Lucas Kauffman

@RoryAlsop so that's how you got in the mile high club

@RoryAlsop I should learn how to flirt properly

Rory Alsop

@LucasKauffman <grin>

Adnan

@LucasKauffman I can teach you

> Hello, you have good breasts. Now upgrade my ticket to premium

2

Terry Chia

@Adnan TEACH ME MORE MASTER!

Rory Alsop

@Adnan erm....right...

Adnan

13:47

Or, just be ridiculously attractive.

Flirting while being ridiculously attractive is extremely easy.

Lucas Kauffman

@Adnan smooth.

Adnan

I have a friend whose pickup line is " ".

Yup, that's it. Nothing.

Rory Alsop

@Adnan hahahaha - yeah, that's my technique

Adnan

It always works.

Terry Chia

@RoryAlsop ahem

Lucas Kauffman

13:51

@Adnan The worst one I saw was a guy taking an ice cube from his glass, throwing it on the ground and said, now we have broken the ice let's talk

Adnan

@LucasKauffman That's actually quite good, if he were ridiculously attractive.

The girl would think "He's ridiculously attractive and funny, oh my".

Now if someone unattractive, say @Terry, tries it. The girl would think "He's ugly, short, and uses lame pickup lines, ewww"

Terry Chia

@Adnan You hurt my feelings. I'm gonna sit in the bathtub and cry. T.T

Adnan

@TerryChia You can do the same to me.

Except that they don't have bathtubs in Finland.

Terry Chia

@Adnan You can lie on your bed eating ice cream.

Adnan

@TerryChia Oh, you mean try to drink some juice outside?

(you know, I'm homeless, and it's so cold in Finland that the juice becomes ice-cream)

Terry Chia

13:57

10 hours ago, by tylerl

@ScottPack You gotta admit it's less funny when you have to explain the joke.

Adnan

@TerryChia :(

TildalWave

So I made homemade pizza from scratch, looks really good. Thought you all should know that :P

Adnan

@TildalWave Does it taste good?

Oh oh oh.. I brought you guys a gift from Germany!

Here's a photo of what seems to be a bear attempting to fix a broken swastika.

You know, because we like bears.

Antony Vennard

14:14

@Adnan I think the bear is breaking the swastika in this case.

The sign says Berlin is no place for nazis.

Adnan

@AntonyVennard Okay, so this is a campaign to kick nazi bears out of Berlin.

Antony Vennard

@Adnan I think the bear represents Berlin, or perhaps a Berliner. But, that said, the sign does indicate nazis are not welcome, including bears who hold nazi views.

Adnan

@AntonyVennard Especially the one in the picture, attempting to reassemble Nazism.

TildalWave

14:40

@Adnan It did to me. I had fresh mushrooms (pine boletes) so depends on whether you like those I guess.

Thomas Pornin

16:57

@tylerl I use Ubuntu for my servers; I am happy with that. Never tried CentOS.

@Adnan The bear symbolizes Berlin. It is their coat of arms: en.wikipedia.org/wiki/Coat_of_arms_of_Berlin

Interestingly, the swastika is left-facing, i.e. the mirror image of the one used by Nazis.

This may be due to the German laws which actually forbid portrayal of right-facing swastikas (because of the Nazi reference, as it goes).

Tinned_Tuna

Heya, I'm wondering if anyone can lend me a quick hand

I'm trying to refresh my memory with block cipher attacks, so I'm running through the Heys tutorial

Does any one have any test vectors for the cipher in the tutorial, or know where some might be lurking?

Antony Vennard

17:15

@tylerl I've used both. My main server is Ubuntu, but I've also used CentOS. I don't really have an opinion as to which is better. I prefer red-hat based distros personally, but aside from slight path-and-naming differences, it's all Linux.

Thomas Pornin

@Tinned_Tuna The cipher is not fully specified; e.g. it has no key schedule, and the number of rounds is not given either.

For the purposes of the tutorial, if you want to experiment, I suggest that you implement the cipher yourself, twice.

Tinned_Tuna

I was just going with "no key schedule" i.e. just take 80 bits, and split them up into 5 16-bit chunks, and use each 16-bit chunk as a subkey

and the paper seems to imply 5 rounds?

Thomas Pornin

First a very basic, bit-by-bit implementation, which can be verified to match the description by visual inspection of the code,

Tinned_Tuna

i.e. the diagram only shows 5 rounds :-p

Thomas Pornin

then an optimized version which you compare to the previous, and you try to make fast and efficient

just to make sure that you got it right

Tinned_Tuna

17:17

yea

Thomas Pornin

Personally, my first crypto task ever was to implement linear cryptanalysis on DES reduced to its first 8 rounds

from Matsui's article

so I began by implementing DES (the complete DES)

Tinned_Tuna

haha

that's pretty hardcore :-)

Thomas Pornin

On 8 rounds, bias is about 2^(-10), so you need a million or so plaintext/ciphertext pairs, which justifies the implementation of a somewhat optimized DES

(it was in 1995, I only had Sparc stations up to 50 MHz)

Antony Vennard

@ThomasPornin I've been trying to follow Schneier's cryptanalysis course, but it's mostly just links to paper after paper. I might give this way a go.

Tinned_Tuna

I was just gonna say, that's reasonable, given today's hardware ;-)

Antony Vennard

17:19

Of course, being hit by a car recently did also set things back a bit, but y'know.

Thomas Pornin

@AntonyVennard Who got hit by a car ?

Tinned_Tuna

@ThomasPornin I presume @AntonyVennard did...

Antony Vennard

@ThomasPornin I did! I was riding a bike and a car driver decided to turn into me.

Tinned_Tuna

which, if that's the case, get well soon, @AntonyVennard

Thomas Pornin

@AntonyVennard Since you apparently survived, can we surmise that the car was defeated ?

Antony Vennard

17:21

@Tinned_Tuna I'm better now, my arm was broken but that's now healing.

Hence my absence all summer.

@ThomasPornin Yes. I took on a car!

Thomas Pornin

@AntonyVennard If you rip out its heart and eat it, you will claim its former strength !

Antony Vennard

@ThomasPornin Yeah. It was a bit oily though and the metal bits didn't go down well.

As I hit the car I somersaulted over it, with my bike following me to land on the other side. So I'm going to take that as I also danced on its corpse.

Only somersaulted sounds controlled... it really wasn't.

Adnan

@ThomasPornin Oh come on! I didn't actually think this was about nazi bears.

Thomas Pornin

@Adnan Yeah but you did not provide the pedantically correct reference, so my intervention was required.

Adnan

True

Rory McCune

20:36

@AntonyVennard not sure what @ThomasPornin reckons to them but I've heard some good things about the matasano Crypto challenges, been meaning to have a shot myself when I get some time matasano.com/articles/crypto-challenges

Thomas Pornin

@RoryMcCune I have no information on these challenges. Since they claim to base them on real-world experience, I expect these challenges to be depressing (as the Real World tends to be).

If I had time, I might try them, but time is a scarce resource.

Rory McCune

@ThomasPornin I follow Thomas Ptacek on Twitter sounds like a decent number of people have got through all the released levels apparently sometimes in very odd languages including one guy who did them in Excel!

@ThomasPornin I'm guessing they wouldn't be anything tricky to a proper crypto person but could be a useful learning tool for more general security types...

it's been too long since there's been a random @polynomial picture in here I think

3

Rory Alsop

21:02

Where is that from?

Simon

@RoryAlsop

I was there today, a subie meet.

AviD

@Simon is your camera broken?

oh right, you're one of those angsty hipster teenagers.

Simon

What? It's not my picture. Do you think I own a quadcopter?

AviD

@Simon well, somebody's camera is broken.

Simon

Nah, it's just someone who thinks he's a professional photograph because he used an instagram filter.

AviD

21:12

> Steps to break your phone's camera, and produce crappy pictures every time, guaranteed:

> Step 1: Install Instagram.

> You're done.

@Simon huh? Instagram does the exact opposite.

Rory McCune

21:33

@RoryAlsop 44con apparently..

AviD

21:46

@ScottPack then you don't listen to other people.

Especially @Gilles.

I would say there is a clear majority, probably even a plurality (if I knew the real non-hipster difference of definition), but it is far from unanimous.

@ThomasPornin Royal with cheese, of course. Shame on you.

oops, I see @ScottPack already got that.

oh crap, how far back am I reading the transcript?? I thought that was from this morning, sorry!!

Scott Pack

@AviD Does consensus mean unanimous? I thought it did mean majority. Or, perhaps, super majority.

Xander

@AviD She didn't say anything about unanimous agreement. She said a "consensus" which is general agreement, but needn't be unanimous.

AviD

@ScottPack sure, but 1 noisy @Gilles == dozens of regular users. So the consensus was not clear.

somebody needs to discuss this with @Gilles with a rubber hose. Then it will be clear.

2

Gilles

there certainly is a consensus that “information security” is better than “IT security”

I think it's barely better, but still better

well, except for being too long

AviD

sure, but if theyre doing the change, they want to get it right - and not have to redo it all over again in a few months.

Gilles

21:58

it's easier to ignore the “IT” part in “IT security”

plus you get to read it as “It Security”

AviD

@Gilles interesting. I think stephen king.

Thomas Pornin

@AviD There again, it depends on the movie version. I saw it both in French and in English (for once, the dubbing is good; I even find some parts better in French). In the French version, it is "Royal cheese".

AviD

@ThomasPornin Again, Shame on you.

Thomas Pornin

@AviD I am shameless.

AviD

Of course.

Lekensteyn

22:13

Hi, I am currently trying to fix-up Wireshark TLS 1.2 support. I noticed that Application Data (0x17) records with CBC-based cipher suites do not get decoded properly. Apparently there is a padding before the actual data, of length 8 bytes. Quickly scanning through RFC's, wiki and comparisons between SSLv3 (same cipher suite works), TLS 1.0, TLS 1.1 and TLS 1.2 did not help me further.

Any ideas? security.stackexchange.com/a/712/2630 does not ring a bell at me

Thomas Pornin

@Lekensteyn With TLS 1.1 and 1.2, with CBC encryption, each record begins with an explicit IV; in SSL 3.0 and TLS 1.0, the IV was implicit (last block from the previous record, or generated from the master secret for the first record).

See section 6.2.3.2 of RFC 4346 (TLS 1.1): tools.ietf.org/html/rfc4346#section-6.2.3.2

IV has length 8 if the block cipher uses 8-byte blocks (e.g. 3DES), 16 if the block cipher uses 16-byte blocks (e.g. AES),...

Lekensteyn

@ThomasPornin Thanks, I will have a look.

Lekensteyn

22:47

Just wow. A compiler issue/programming mistake again. memcpy instead of memmove

Scott Pack

23:22

@Gilles ahem That's what she said.

Transcript for