The DMZ

TildalWave

00:02

@ScottPack I believe he came to the site fairly regularly, tho he's not been here for the past 10 days or so... maybe he's skiing somewhere with bad WiFi coverage :)

Scott Pack

Yeah, shortly after being modenized he stopped hanging out with us here to spend his time on the site.

TildalWave

modenized :D

I don't remember ever seeing him in DMZ in nearly a year

oh, wait ... maybe when I just came here, a few times tops

yay my first gold badge on meta ... whatever those are good for, they don't even show on SE-wide flair, do they?

M'vy

01:02

nice one

Osman Ercelik

01:16

Hi everyone :D

M'vy

hi

Terry Chia

@TildalWave Useful as bragging point on mod elections though.

TildalWave

@TerryChia meh, if you need to brag, then you don't deserve it :P

Terry Chia

@TildalWave Who said anything about deserving it?

I just want unlimited chat powerz.

TildalWave

Why do you think that with deserve I meant something positive? :D

ManishEarth

01:27

Finally finished that blog post on that easy CTF I won

because I couldn't sleep. 7AM. Darn mosquitoes

TildalWave

@ManishEarth that's where you got that WinPhone from?

ManishEarth

@TildalWave nope

This was an arbitrary link that a friend pinged me with. I don't even know if I was allowed to take part, in retrospect it was probably for her college only.

TildalWave

@ManishEarth your blog doesn't have an upvote button!!

ManishEarth

This was near the end of Dec

The WinPhone I got for an MS hackathon last weekend. We made a note-taking app with fluid math support. Probably going to actually put it on the store :)

@TildalWave should it?

TildalWave

Who here is versed in space race espionage? I tried to answer some question on why would USAF launch from West Coast but I'm not sure I'm making a convincing case for it...

3

Q: Are there any benefits to launching from Vandenberg AFB instead of Cape Canaveral?

Launching from Cape Canaveral has many benefits, including launching over the ocean (in case something needs to be dropped off) and saving energy by being at a lower latitude than most of the United States. Like NASA, why doesn't the Air Force also have a launch complex in Florida instead of sout...

launch-site

I'm sure there's some other points about it, but I can't think of them now... it's a bit late here

M'vy

01:32

@TildalWave Well the only things I know of space are from Scott Manley KSP videos :S

TildalWave

@M'vy Ah that's why I ask here, because it's not so much about knowing of space technology or rocket launches at all. It's more to do with espionage and inferring data through observations alone. OK, and potentially trying to fiddle with comms.

M'vy

:P

TildalWave

I.e. why is it better to keep the early launch ground track over your own territory

M'vy

No technical reasons? like cheaper inclination changes?

TildalWave

that's kinda in scope of Information Security

M'vy

01:35

interesting yeah :P

TildalWave

@M'vy That we can handle, there's two answers already

M'vy

oh wait it's a beta site

isn't there a full site about space already?

TildalWave

01:46

@M'vy Nope, Space Exploration, Astronomy and Robotics are all in beta. There's Physics and Electrical Engineering tho that are full-blown sites

M'vy

ok

Ah finally my home partition is nearly saved

Not sure what I failed with my remote serv, but it won't start

TildalWave

02:07

bloody hell, my coffee mug got glued to the table lol

don't wanna spill it,... I guess I'll have to sprinkle some water around it, or is there a simpler way?

M'vy

Straw?

Thomas Pornin

03:03

@TildalWave If a north launch fails and the rocket falls back to Earth, you prefer it to happen from Vandenberg, because then the early flight path is over semi-desert; if you try the same from Florida, you will fly over densely populated East coast.

TildalWave

@ThomasPornin Yes, I shortly addressed that point, but I thought there might be some other points regarding espionage in particular. E.g. I didn't yet mention that some remote sensing satellites might run in "read only" mode over one part of the ground track and only communicate with the ground at other parts, so you'd want to try to tap into its comms over those areas that it goes in "write mode" too. Especially if line of sight comms are used, where you couldn't receive them if you were elsewhere.

OP is from the States so I assumed he'll realize what I meant with less densely populated areas and that there's the megalopolis under polar or retrograde orbits launched from the East Coast

@M'vy heh yeah it glued on another table than where I'd like to drink it, so that straw would have to be roughly 5 yards long :) anyway, I unglued it with a bit of persuasion... holding it with one hand and tapped on the side with another, didn't spill much LOL

M'vy

@TildalWave XD. Maybe you can start a kickstarter for a 5 yard straw :P

TildalWave

@M'vy yeah, capillary action ones... to prevent getting dizzy spells from all the "sucking" :D

Terry Chia

@M'vy @TildalWave No, you guys are wrong. A 5 yard straw is just targeting the symptoms. You need to attack the root cause.

A mug that won't stick to the table. Or a table that won't stick to the mug.

M'vy

@TerryChia Yeah but 5 yard straws are way cooler

Terry Chia

03:18

@M'vy Well, I'll give you that. :D

TildalWave

you can suck more, who wouldn't buy that?

Terry Chia

@Adnan?

@AviD?

TildalWave

hehe

Terry Chia

Wait no, they would totally buy that.

TildalWave

OK then what, teflon base mugs?

Terry Chia

03:22

You know... it might not be a good idea to discuss this potentially billion dollar idea in a public chatroom.

TildalWave

it's a crap idea, that base would soon scratch and it's not really easy to keep teflon glued to a ceramic base either

Terry Chia

@TildalWave Shhhhhhh! :)

Have you not heard of marketing? ;)

TildalWave

solution is actually a lot simpler ... don't make concave shaped mug base that'd glue to the table due to convective suction

M'vy

open bottom mug?

Terry Chia

@TildalWave I think I only understood 5 words in that sentence.

TildalWave

03:25

or at least drill a hole into its base or chip a part of it so there's no negative pressure area under it

Terry Chia

How about just eliminating the mugs altogether and go for coffee drips?

Thomas Pornin

@TildalWave What would be mightily cool is a table which keeps mugs in magnetic levitation a few cm above the table.

TildalWave

@TerryChia the bendy thingy sucks to the flat surface where you put it because its bottom is warmer when you poured your liquids in it than the surrounding atmosphere, and it eventually cooled down because you forgot to insert soft music CD in the player before trying to remove it from the sticky surface

Terry Chia

@ThomasPornin Loved your Gibson answer btw.

> I would say that the mixture of multiple font sizes, colours, frames, underline, bold text, underlined bold text (for God's sake !) is enough clue about the kind of site you've stumbled upon.

TildalWave

@ThomasPornin or a superconducting mug :)

but only for those that enjoy drinking liquid nitrogen

-2

A: Possible to prevent Juice Jacking by only connecting USB pins 1 & 4?

MyKey Technology mykeytech.com has a $10.00 cable that works with all phones and pads. There is more than pins 2 & 3 being disconnected to make the cable work.

nukes required

M'vy

03:40

should I launch from Cape Canaveral?

Hum, the painful reality of restoring backup to your server... your upload is ridiculous...

Terry Chia

@M'vy Sneakernet. :P

M'vy

hu?

Terry Chia

Sneakernet

Sneakernet is an informal term describing the transfer of electronic information, especially computer files, by physically moving removable media such as magnetic tape, floppy disks, compact discs, USB flash drives (thumb drives, USB stick), or external hard drives from one computer to another. This is usually in lieu of transferring the information over a computer network. The name is a tongue-in-cheek sound-alike to Ethernet, and refers to the use of someone wearing sneakers as the transport mechanism for the data. Sneakernet, whether called that or not, is often used as an academic...

M'vy

would require physical access

Terry Chia

Are there any difference in reliability/speed etc between consumer-grade 2.5" and 3.5" spinning disks?

Thomas Pornin

03:50

@TerryChia At some point in time, 3.5" disks were cheaper (for a given capacity) and often faster, but 2.5" disks were more resilient to shocks and produced less heat.

Terry Chia

@ThomasPornin Ah I see.

TildalWave

04:14

in consumer space, 2.5" were (are?) mostly targeting notebooks, so expect slower performance to keep them within the power and thermal envelope

in enterprise space tho, they were nearly all 2.5" anyway, even if they would be packed in 3.5" enclosures because they could spin faster at same thermal characteristics and lower access times

Terry Chia

I'm looking at possibly getting a 5.25" bay thingy that fits 4x2.5" HDDs.

TildalWave

@TerryChia I've seen some that can fit 6 of the slim profile ones, but the problem is that's a small area that'll generate a lot of heat with not much room to cool it down... so expect either many failures or a few bloody loud tiny fast spinning fans at the back side of the enclosure

Terry Chia

@TildalWave Looking at this one: thermaltake.com/products-model.aspx?id=C_00002043

TildalWave

When I say loud, I mean so loud I had to switch office once because of those annoying buzzers

Terry Chia

You could be right about the noise though...

TildalWave

04:21

@TerryChia yeah, avoid if you value silence

or use SSDs ;)

Terry Chia

Nah, I want capacity.

My desktop is still on spinny disks but it's still fast enough.

Bah, time to convince my dad (yes, i know..) to allow me to splurge money to build another machine for a NAS then...

M'vy

Ok going to sleep while stuff's downloading

see you

Terry Chia

05:02

There's a chance that closed questions will get deleted right?

Can a mod migrate Bear's answer? security.stackexchange.com/questions/49122/…

/cc @AviD, @RoryA.

Stack Exchange

Stay warm, little flappers, and find lots of plant eggs!

TildalWave

05:18

@TerryChia You just wanna have an answer scoring better than the big bear's for a while, don't you? :P Anyway, I think only low scoring closed questions that didn't receive an answer (or did, but they're downvoted themselves) get deleted automagically. But in this case, I guess they could be merged by mods, but expect an unpleasant death if you dared to accept your own answer LOL

Terry Chia

@TildalWave Nah, I already got a few better scoring answers.

TildalWave

@TerryChia beginner's luck

this is fun to watch: usdebtclock.org

Terry Chia

@TildalWave Nah, just earlier answers.

tylerl

05:36

@TildalWave It's a little bit silly, since the numbers are really only accurate to a handful of significant digits, but they're specified very precisely nonetheless.

And while it's a lot of datapoints, they're missing the most interesting one:

how much is the US Gov't making in interest payments it pays to itself for being both the first and second largest holders of US Gov't debt.

TildalWave

yeah I heard of this ... tried to reproduce it on my wallet but it didn't seem to have any effect short of me wasting some time on appreciating its smooth leathery surface

tylerl

06:41

I enjoy the fact that VTC: Belongs on Super User is exactly equivalent to calling the asker an idiot.

TildalWave

06:58

OK, you're confusing triboelectric effect of contact-induced charge separation between two previously charge-isolated bodies with bound charge electric polarisation of the same body here. Are we done reading the quack bible from the soup of alphabetti spaghetti now? — TildalWave 5 mins ago

enjoy it while it lasts :)

AviD

07:23

@TerryChia you mean merge.

boy, was a noisy night here, eh?

@TildalWave y'mean like what Sebulba does?

@TildalWave and thats another reason to always use coasters. Especially with coffee.

@TerryChia This sounds like the bicycle-hand-warming device (aka: gloves) symptoms. Coasters are so much simpler.

@TerryChia @Adnan doesnt need a straw for that...

8 hours ago, by AviD

heh, now that @TomLeek mentions it, the design does look suspiciously like those pop-under sites trying to get me to buy the ultimate guide to investing / pickups / etc. I guess that's where Mr. Gibson gets his marketing skillz from.

@TerryChia so get one big, slow one.

you dont need to care about speed, you would get SSD for that. Here you want mass storage, and the difference in performance between the fastest HDD and standard SSD, makes the difference between fast HDD and slow HDD look trivial.

so get a slow, quiet drive - e.g. WD's Green line. huge difference in noise between that and the standard Blue line (and especially the Black high performance). apparently also a difference in power draw, and thus heat too.

@TildalWave reminds me of that fullscreen rube goldberg image.

ah, here it is: blueballfixed.ytmnd.com

TildalWave

07:45

@AviD with my luck, I'd only get the mug to stick on the coaster that would stick to the table

AviD

@TildalWave well the coaster wouldnt stick to the table, and if it sticks to the mug, you'll only look silly drinking your delicious non-stick coffee.

TildalWave

@AviD Wanna bet? You haven't seen me serving drinks yet ... I'm a proper klutz ;)

AviD

@TildalWave is Thunderbolts the astronomy version of GRC?

Terry Chia

@AviD Well yeah, whatever.

AviD

@TerryChia How do you want to be an all-knowing moderator, when you don't even know the difference between merge and migrate??

This, right here, is the only reason I am.

Terry Chia

07:51

@AviD I just need to know the button to kick @Simon from chat.

AviD

no button, it's automated.

Terry Chia

@AviD See! Easy job!

TildalWave

@AviD It's the first time I've heard of it today, I wouldn't know. There's such quacks popping out of the deep end of dark backwaters every now and then, and they'd use big words and deep and calming voice narrators and have seriously lonely bikers buy their BS, maybe commit suicide so they can board an alien spaceship hiding in a comet, but no... nothing as serious as GRC

AviD

@TildalWave so, just like Scientology then.

Terry Chia

This song and the lyric video is hilarious!

►

TildalWave

07:57

@AviD yeah

selling pseudoscience as religion to those poor sods that don't realize that science doesn't require any belief whatsoever

AviD

@TildalWave weeelllll.....

what would you call axioms?

... upon which all the rest of science is built...

TildalWave

not dogmas if that's what you're trying to assert

AviD

no, not the same

but I would suggest the main difference between axioms and dogma is how you react to proof of its falsehood.

TildalWave

it's a supposition and it can be proven correct, or false

AviD

ecxactly

TildalWave

08:02

dogmas can't even be tested

AviD

okay, I would amend my statement to: how you react to the possibility of its falsehood.

TildalWave

well, they could be, but not within the belief system they're trying to represent

AviD

sometimes dogmas can be tested, sometimes axioms cannot.

exactly

if it is dogma, you dont even try to test it, the very concept of that is treated as treason.

TildalWave

@AviD axioms are meaningless if they can't be tested by the scientific method, they don't magically have hidden powers of the almighty truth encoded in them... you can't throw an axiom at someone and say "believe or die"

AviD

true all but the first part.

If you tested it, it no longer needs to be an axiom.

> A self-evident principle or one that is accepted as true without proof as the basis for argument; a postulate.

from wikipedia....

> No explicit view regarding the absolute truth of axioms is ever taken in the context of modern mathematics, as such a thing is considered to be an irrelevant and impossible contradiction in terms.

TildalWave

08:08

OK dunno, you're now confusing me to the point I'd almost rather go to bed with you than continue establishing difference between building blocks of science and religion

AviD

@TildalWave yessss!!! My plan worked!

TildalWave

No, it didn't. I'm sleepy and my head hurts :P

(TWSS)

AviD

@TildalWave It's about attitude. You can assume an axiom, based on logical reasoning but without scientific proof, neither for or against. Dogma is stated (always by a 3rd party) and you are never allowed to question it.

unless it's the excellent Kevin Smith movie.

> Dogma is a principle or set of principles laid down by an authority as incontrovertibly true

TildalWave

@AviD You want me to post a link to the YouTube video from the Hitchhiker's Guide to the Galaxy where the babel fish disproves the existence of God by his own postulate, QED, don't you?

►

there, you made me do it

kalina

08:31

morning

Rory Alsop

Morning

Rоry McCune

Morning

Rory Alsop

09:03

I love this answer, but I have to close the question:

2

A: I want to implement UART module in Xilinx with Encryption functionality so which algorithm i shuld choose RSA or AES

Since RSA and AES do very different things, neither of which being what you imagine it is, I would say that your question cannot be answered with anything remotely equivalent to the cold rationality of mathematics. As an analogy, in a different context, your question would be: "I have a car and I...

especially "...Except, of course, that RSA is cooler." :-)

AviD

whoa, didja all know that @GrahamLee nuked his account, too? /cc @RoryAlsop

Rory Alsop

@AviD Hmmm - wonder why.

AviD

gonna twitter at him?

to him?

on him?

whats the proper word for twatter

Terry Chia

@AviD The word is "tweet".

Rory Alsop

09:30

twoot?

AviD

@TerryChia at / to / on / for / what?

@RoryAlsop these kids with their newfangled web 2.0 social stuff.

any opposition to merging training (which we have in the past agreed was quite ambiguous) into user-education, and leaving it as a synonym?

or better to synonomize it with professional-education....

of the 4 q's there now, 2 are user-, 1 is professional-, and 1 is irrelevant.

Lucas Kauffman

@AviD go for it

Rory Alsop

I think professional education works best

but the numbers of questions are low, so whatever works :-)

AviD

@RoryAlsop thats the problem with training, innit - are you giving training, or getting it?

Rory Alsop

@AviD from the perspective of this site? Giving, definitely.

AviD

09:43

so that would be user-education, no?

Rory Alsop

damnit - you're right

AviD

though oddly enough - user-* has 39 q's, professional-* has 118.

...

>_<

then again, people tend to tag any question where they want to learn something as "professional education".

No, this tag doesnt mean you are getting an education, it is ABOUT the education. Dammit.

Lucas Kauffman

first time I'm on sick leave from work

Rory Alsop

10:04

@LucasKauffman I blame those Belgian beers :-)

Lucas Kauffman

@RoryAlsop If only

then I'd had some point were I was really happy before getting sick :p

Ladadadada

11:17

I'm finally beginning to grok cryptography and the trigger was this: twitter.com/corkami/status/425895957138399232/photo/1

AviD

@Ladadadada nice, you should onebox that.

Ladadadada

twitter.com/corkami/status/425895957138399232/photo/1

Hmmm...

AviD

no https...

:@

Ladadadada

twitter.com/corkami/status/425895957138399232/photo/1

t.co/nZGjHJrpI7

AviD

ftfy

or not...

Ladadadada

11:23

pic.twitter.com/nZGjHJrpI7

I give up. Onebox hates me.

AviD

cmon son, its not complicated ;-)

Ladadadada

Of course, the first thing I did was a grep of all our source code for ECB and CBC. And found a CBC-mode encryption that uses a static IV.

AviD

Stack Exchange

12:03

Stack Exchange Security Blog: QoTW #49: How can someone go off-web, and anonymise themselves after a life online?

roryalsop on January 27, 2014

Everything we do these days is online, whether through our own social media, purchases from online stores, tracking by google, Amazon etc., and the concept of gaining some sort of freedom is getting traction in the media, with the leaking of NSA snooping documents and other privacy concerns, so before Christmas I asked the deceptively simple question:

Which ended up being the most popular question I have ever asked on Stack Exchange, by a good margin.

Lucas Kauffman supplied the top rated answer – which goes into some detail on heuristics and data mining, which is likely to be the biggest problem for anyone trying to do this successfully: …

deed02392

12:43

you are the airrrrrrrrr I breathe, you are the Earth beneath

I was your, destinatioooooon

Terry Chia

@deed02392 Are you high?

deed02392

Yes, yes I am

on The DMZ

and life in general

you guys complete me

Terry Chia

@deed02392 Ok, definitely drunk.

deed02392

Yes

Drunk on the air conditioning fumes of this beautiful office I have the pleasure of spending 40 hours a week in

M'vy

@AviD :)

AviD

13:02

@deed02392 oh, you work half-time?

deed02392

@AviD no, I think you just over-work :/

AviD

likely.

Scott Pack

I suspect that if you consider 40 hours to be half-time it's probably time to go get a froofroo drink with an umbrella?

AviD

13:24

@ScottPack huh?

ahhh, ymean time for a vacation?

staycation! stay at work, but with mojitos!

Scott Pack

I haven't had a mojito in a very long time

AviD

my supermarket is selling mojito-flavored redbulls. I should really try that bing out.

Iszi

@AviD "Try that bing out"? Is it "Randomly Drop a Microsoft Product Name Day" or something - did I miss a memo?

AviD

@Iszi well, I figured since we all say "you could bing that sh*t", it made sense to expand it's usage.

That is, use "Bing" as a drop-in euphemism for "sh*t".

or, maybe it was a freudian slip.

thats what I get for multitasking.

Scott Pack

@AviD That sounds terrible.

AviD

13:37

@ScottPack sure it does, but still needs to be tried.

Scott Pack

I thought Bing was synonymous with hilarious?

Bing it On!

AviD

yeah, that too

Biiiinnngggg!

Scott Pack

Here we go!

deed02392

I can't believe how much of the Bing interface looks identical to Google's

I respect to some extent all it is is a search engine

but compare a Bing cached page to a Google one.

Iszi

@deed02392 Never tried the former. Rarely use the latter. What's up with it?

deed02392

13:44

nothing 'up' with it per se, but they are almost identical

check it out

Iszi

@deed02392 And there's something wrong with that? When two different tools endeavor to achieve the same function, isn't it ideal that the end results are the same?

deed02392

in fact even the results page is almost identical down to colour scheme

@Iszi no in this case it strikes me as plain uninventive

if not pure laziness

there are always lots of ways to offer the same function

I find it rather unlikely they couldn't have come up with something different

David Freitag

@TerryChia So, did you ever end up ordering one of those launchpad boards?

Terry Chia

@DavidFreitag Will get around to it soon. Still playing the emulator version on the CTF. :P

David Freitag

@TerryChia Hehe, alright.

Terry Chia

13:55

Also, I don't actually know what I'm going to be doing with them.

Iszi

@TerryChia Which one was this?

Terry Chia

8

Q: Does Gibson's fingerprinting service add much additional security?

I just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? To me it does not seem to add any security: it lets you know that you are being snooped on, but...

ssl web-browser

ManishEarth

Is it OK if I ask about every single Firefox security issue I come across here?

Already done two, and discussed one in chat

time to make sec.SE unwilling security consultants for FF :p

Really interesting answers, though :)

Recently been thinking of ways to make FF more secure for the stupid users. Ways to detect and soft warn about clickjacking, or other things. Not sure if it's possible

Terry Chia

Hmm, looks like I will be attending Blackhat Asia after all!

Iszi

@ManishEarth That reminds me of the code review of TrueCrypt I've heard about - I wonder if any such thing has been done for Firefox, or the Tor browser?

Terry Chia

14:08

@ManishEarth That works for me.

Iszi

@ManishEarth What do you mean you're not sure if it's possible? NoScript has that functionality already.

ManishEarth

14:22

@Iszi ...possible for me to do

Oh right, noscript does it

@Iszi as in?

Iszi

@ManishEarth istruecryptauditedyet.com <-- Is anyone doing that sort of thing for Firefox/Tor?

ManishEarth

no clue

will ask around on IRC though

I wonder how far we (SecSE community) would get if we did that :D

deed02392

I wish TC would hurry up and get UEFI support

AviD

@deed02392 ah, but the question you should be asking is, who copied who?

or rather, whom?

I dont think the answer will be the one you expect.

Rory Alsop

@Ladadadada @Polynomial did exactly this in his most recent talk at Securi-Tay. The audience gave a pretty good indrawn breath!

@ScottPack 40 hours is deliciously half time. I get a whole other working week to do useful stuff. Like Stack Exchange.

@AviD Tell me how they taste. I'd be up for that

Scott Pack

14:34

I'm of the opinion that anything involving Redbull is bound to be a terrible experience.

2

Rory Alsop

@ScottPack Redbull is actually my favourite way of imbibing caffeine

(I know, but I love the taste)

and I hate the taste of coffee

Irn Bru is better tasting, but I use it as a way to imbibe sugar

the small amount of caffeine in it is a nice side effect

Scott Pack

I've only had Redbull a couple of times but it always left a weird film in my mouth and the aftertaste reminded me of diesel fumes.

Altogether an uncomfortable experience.

AviD

So, as "overpriced" as my internet is, I decided to check to see if they can improve my package. Unfortunately, I have to keep paying the infrastructure provider the same amount (about 35USD), but they upgraded my to 100Mbps. So I switched ISP too while I'm at it, and lowered the price (now about 8.5USD) and got them to match the pipes' speed. And throw in some minutes on the phone, too.

Iszi

@AviD Wait... what? You have to pay the infrastructure provider and the ISP separately?

AviD

@Iszi yeah.... I know. :(

Iszi

14:39

And you have to pay the ISP extra to match the speed available from the infrastructure provider?

AviD

different set of monopolies.

Scott Pack

@Iszi We've been over this before. Unless our monopoly they have separate providers.

AviD

@Iszi well, the ISP usually charges a different price depending on your bandwidth.

Scott Pack

@Iszi Remember, the DOCSIS standard will support up to about 340Mbps/120Mbps. The actual speed you receive is dependent on how much you pay.

deed02392

docsis3 @ScottPack?

Scott Pack

14:43

@deed02392 Affirmative.

deed02392

doesn't seem like much when you've been on 120 Mb

Scott Pack

The European version has a higher downstream

deed02392

back down to 30 now as dad cuts bills

AviD

@Iszi cmon, I was subtly bragging about my 100mbps / 8.5 USD. Dont ruin this..

deed02392

imgur.com/a/bwIKM#6

wtf?

Iszi

14:45

@AviD Being that it's my country's currency you're using to brag, and we can't get any sort of nearly comparable deal here, I think I'll ruin it all I like.

deed02392

how did this not take phenomenal computing power

@ThomasPornin

AviD

hahaha

Iszi

@deed02392 FTFY

deed02392

no @Iszi this is the one I linked

Iszi

@deed02392 Ah, NoScript broke that.

deed02392

14:47

heh

good ol' no script

why haven't you allowed imgur

Iszi

@deed02392 Rarely have need to. I give it temporary permissions in the few cases I do.

deed02392

when I migrated from FF to chrome i decided noscript was more hassle than it was worth

Iszi

@deed02392 Translation: "I'm a pussy, and I want to get fucked."

deed02392

What?

Terry Chia

@deed02392 @Iszi is just engaging in a nerd pissing contest.

deed02392

14:51

I think I choose to ignore him

Iszi

@deed02392 That was me, implying that you're a weakling for not having the patience or nerve to be bothered with managing NoScript, and that therefore you also must enjoy the additional exposure to online threats that you endure due to a lack of sufficient protection.

ManishEarth

@deed02392 wut

deed02392

@ManishEarth IKR?

ManishEarth

Is that a joke, or real?

deed02392

It's in amongst a bunch of other serious images

imgur.com/a/bwIKM

Iszi

14:53

@ManishEarth I think the screenshot of the command line was intended to allow you to test it for yourself.

ManishEarth

But AES is encryption. If you can figure out a key to go from A to B, then you have broken it

@Iszi you need the exact pdfs though

deed02392

holy shit!

@ManishEarth Exactly why I called on @ThomasPornin to save my mind from imploding

ManishEarth

@deed02392 but you can load any extension into a script, right?

deed02392

@ManishEarth This looks like arbitrary JS execution based on doing nothing but loading a gif

ManishEarth

Or wait, that's a gif

CodesInChaos

14:55

perhaps point is that one file can be a valid gif and javascript at the same time

ManishEarth

gaaah

That seems reasonable though

CodesInChaos

@deed02392 There is a <script> tag, so it doesn't mean that an <img> tag executes javascript

deed02392

oh yeah @CodesInChaos

good spot

ManishEarth

Quite a lot of file formats can be tacked together to create a chimera

deed02392

I let my emotions get the better of me before i opened it

ManishEarth

14:56

Seen that in a CTF

deed02392

posted it*

what's the definition of chimera in this context @ManishEarth

ManishEarth

A file that is two types at once. Just made up the terminology :p

deed02392

haha fair enough

the second definition Google gave me confused it

but the first, I can see why you thought to try that word

AviD

@ManishEarth ala gifar

ManishEarth

gifar?

AviD

14:58

GIF + JAR

ManishEarth

ah

AviD

classic hack from a few years ago.

Transcript for