« first day (1425 days earlier)      last day (2416 days later) » 

5:05 AM
 
 
3 hours later…
8:10 AM
morning
 
8:58 AM
Mornin' All
 
9:26 AM
@RоryMcCune , @Tildal et al - Morning!
 
@RoryAlsop Mornin' Mr A . I'm on a job with one of your ex-irish colleagues today
 
@RоryMcCune Yay! Aidan?
say hi from me
 
9:42 AM
@RoryAlsop michelle
 
@RоryMcCune Ahhh. In that case, definitely say hi :-)
 
@RoryAlsop heh, will do
 
10:14 AM
'mornin
 
@Lighty mo'nin'
 
11:14 AM
... Those bad times when you realise that you need something more severe than an "error" log level. Perhaps "HAIR_ON_FIRE" would be suitable?
 
@Tinned_Tuna Perhaps a 'catastrophic' log level
 
@DavidFreitag "Meteorite" log level :-p
well, not quite that bad... but still :-/
 
"strong-force-destabilized" log level. For those times when the universe comes to a sudden, albeit fantastic, end.
 
"Quick, write the log to disk before it becomes energy/fundamental particle soup!"
 
"A hell, the laws of magnetism have been unravelled. Quick! The SSD!"
 
11:20 AM
log.electromagneticForceFailureCantLocateSSD(...)
though, tbf, if em fields stopped working as expected, I doubt SSDs would even work ;-)
 
Ah, hell. Just write the log out by blinking the HDD indicator light in morse code.
 
... I doubt anything would remain in a recognisable state, all told...
 
@Tinned_Tuna With no more strong force the nucleus of every atom in existence would fly apart. Everything would pretty much just evaporate into a cloud.
 
and without an electromagnetic force, I don't think photons could exist. Further, there'd be nothing keeping electrons "attached" to nuclei, and nothing keeping nuclei from getting arbitrarily close to one-another. Engage fusion all over the shop, but no release of photons?
(I am not a physicist, I'm just speculating)
 
I don't know enough physics to say, but I'm pretty sure that whole unravelling of magnetism comment I made was just complete BS :b
Although if one law of nature decided to stop working it would be the best time for some of the others to pack up
 
11:27 AM
haha :-)
 
12:25 PM
@DavidFreitag In fact, without electromagnetic forces, nothing would prevent gravitation from compressing the Earth into a ball of neutrons of about 120m in diameter (but Pauli's exclusion principle would then block it there -- no black hole).
Actually a huge number of electrons would probably escape so the final ball would also keep a substantial number of protons.
And we would not see it, because no photon.
 
Well, more importantly we wouldn't see it because there would be no us, but yeah.
 
Mmh, without electromagnetism there would be no black box radiation. Things gonna be tough.
 
Oh man, I am loving this new radio system on Google Music. Classical Sunrise is my new morning favorite.
 
 
1 hour later…
1:34 PM
C++ guys, I'd like to demonstrate buffer overflows to a group of people. Where can I find an example of short C++ code that has an exploitable buffer overflow vulnerability. (assuming no special security features activated on the system, and it can exploited to get a shell)
 
raz
1
Q: Exploiting buffer overflow leads to segfault

tsusankaI am trying to exploit simple stack overflow vulnerability. I have a basic code in c: #include <cstring> int main( int argc, char** argv ) { char buffer[500]; strcpy(buffer, argv[1]); return 0; } compiled using -fno-stack-protector. I've already figured out the buffer l...

That has a nice little code snippet, I'd use Metasploit to generate a payload that can pop a reverse shell
The problem he's having I'm fairly certain is that he's trying to execute non-executable memory.
 
@Adnan Disable all memory-safety exploit mitigations on a box, call a function that copies input into a fixed size buffer, profit. See also, insecure.org/stf/smashstack.html
 
raz
@Tinned_Tuna You want me to click a link with the word insecure in it?
 
@raz yes, please :-)
 
@Tinned_Tuna Thanks for the summary. I started reading Smashing The Stack a few hours ago
 
1:38 PM
"Smashing The Stack For Fun And Profit" -- Aleph One
 
raz
@Tinned_Tuna Well now that you've asked nicely.
 
@Adnan that's a reasonable intro, but it's very old now. There's an update to it in the face of ASLR, W^X, etc. somewhere
 
@raz Oh my. What a coincidence! Thanks for the link
 
@raz That's probable. Even in 32-bit mode, the Linux kernel can use the "NX" bit to mark pages as non-executable. This is activated when the PAE format of MMU tables is used.
 
raz
@ThomasPornin It seems the most likely issue
 
1:40 PM
@Tinned_Tuna The goal of my demo is to start them with something very basic. That's why I won't have any security features enabled (exploit mitigation stuff)
 
raz
I was trying to think of another reason why nop's wouldn't execute. Outside of stack cookies, I couldn't think of anything
@Adnan Sounds like a good start. Metasploit allows for easy shellcode generation. You can tell it to ignore certain characters (i.e. 0x00, 0x0a, 0x0d). Then the students can copy and paste the given shellcode into a C array. Fairly straight forward to use.
There are lots of reverse shell options too.
 
@raz Yup. Now I'm trying to find a good shellcode that will pop a shell for me on the same machine (exploiting a local process running as root that only accepts local connections, you know priv. esc.)
I think the best way would be to execute some code that would add a user to sudoers, or reset the root password
 
@Adnan Can't you just use Aleph One's shell code?
 
or something like that
 
1:46 PM
should drop you to /bin/sh with the same privs as the exploited process?
 
#include <stdio.h>

void main() {
   char *name[2];

   name[0] = "/bin/sh";
   name[1] = NULL;
   execve(name[0], name, NULL);
}
Yeah, looks perfect for me
Does what I want it to do
 
@Adnan Aleph One even provides the translation to hex bytes that you need, even stripping NULL bytes, iirc?
 
@Tinned_Tuna Yeah, it's a bit down there
\xeb\x2a\x5e\x89\x76\...
 
@Adnan sorted... right?
 
@Tinned_Tuna Indeed
Looks like I got everything ready
 
1:50 PM
@Adnan now you need to go work out which mitigation technics you need to disable on the demo machine and what compiler flags you need, right?
 
@Tinned_Tuna Already got that ready
Thanks, @Tinned_Tuna and @raz
 
@Adnan then you're onto a winner, enjoy :-)
/me goes back to writing sinful Java
 
raz
@Adnan No problem
Exploitation is fun!
 
2:14 PM
@RоryMcCune Did you see there is a poker.stackexchange.com
also, best question title today:
0
Q: Weird gelatinous substance in highland bog

LiamI recently went walking in the highlands in Snowdonia, Wales and we came across this: Can anyone explain what it is? My guess was some kind of fungus but I'm not positive. The ground was very water logged and boggy. It looked a lot like frog spawn, but it's autumn here and we wouldn't see fro...

 
2:28 PM
2 seperate documents
both related to each other
design opinions?
 
Windows/10
 
@Lighty Security folks ain't got world wide renown for their design skills ;-)
 
1st document is a report on a company and my work there (defined by colours and logo), 2nd is my grading documents and such (school colours and logo)
 
raz
I like the margins on the second one better
 
In fact, we're often sharply citicised for them... :-(
 
raz
2:30 PM
Everything is too indented in the first one.
 
Personally, I like all the blue in the first one.
 
pssst, is @Simon colourblind? don't wanna offend the poor guy...
 
wat
It's purple then, is it?
 
oh, for me, the first one is red
yes, thats purple then xD
my bad :3
 
Cool. Purple is always a winner.
 
2:36 PM
@raz That was an impressive editing job. That post was making my head hurt just trying to read it.
 
raz
Haha, which one?
The smartcard one?
 
Are there any Python donuts in da house?
 
raz
@Simon I'm half a Python donut
 
@raz Yup.
 
raz
@Xander yeah that took me longer than I expected to edit. And then I flagged it to be migrated to SO
 
2:39 PM
@raz Cool. Any experience with developing networking tools? Is it a nice language to develop a wireshark-like tool?
 
raz
@Simon Just use Scapy
 
@raz I actually want to develop it.
 
raz
I've used it as a foundation for wireshark/packet sending stuff
I mean Python has libraries for the socket library.
It's object oriented, easy to program in.
I'd choose Python over most scripting languages, but it was my first scripting language. So i'm a bit biased.
 
I'll check that out, thanks.
Analyzing frames programmatically would be a nice challenge imo.
 
@Lighty If I were you, I'd probably not post that kind of stuff publicly
 
2:46 PM
^ This man states a good point
 
raz
@Simon Yeah if you're just doing it for fun. If you want some real dirty learning you could write a kernel module :D Bind to an interface, just write raw data out any which way you wanted.
 
@raz Oh lawd, that sounds awfully out of my league.
 
raz
hahaha
 
The main purpose would be to learn more about the TCP/IP protocol in a fun way.
And I haven't done much Python so that would help too.
 
raz
@Simon Python is a much easier way to go about it.
 
2:50 PM
@Adnan which stuff?
 
^ Not sure if srs.
 
@Lighty Names of companies where you did some stuff, linked to your actual name.
I assume you did some practical training with them, no?
 
 
1 hour later…
4:05 PM
@Adnan yes, i was an intern for 8 months as part of my study (school)
wich is completely public information :P
 
raz
@Lighty A lot of information is technically public information. Doesn't mean you shouldn't be careful about disclosing it.
 
@raz Public, as in, it's information that can be found online without me saying it ;3
 
/me whips up some fraudulent docs from "Stageverslag"
in the name of @light
derp, @Lighty
 
if publish my report here, now that would be a bad idea, concidering my report falls under "Exam Documents" needed by law to pass my exams
:3
 
concidering
 
raz
4:16 PM
@Simon Con-cidering?
cons cidering?
Escaped cons make cider? Who'd have thought?
 
Crazy. @Lighty knows a lot more than we do.
 
 
1 hour later…
raz
5:32 PM
@Xander To clarify your comments here; Chrome doesn't just ask for the password for security measures. It asks Windows to prompt for it so that Windows can decrypt the passphrase, and return it to Chrome for form use.
 
Well, there it is. I'll being playing with security again!
 
raz
@JeffFerland There what is?
 
5:57 PM
@raz I think that confuses, rather than clarifies the issue.
@raz You do not need to enter your Windows password for Chrome to be able to auto-fill a password field in a form. Your comment makes it sound like you do.
@JeffFerland Nice! At Facebook still?
 
@Xander Shhh ;)
 
@JeffFerland I was going to, but, you do have it on your profile already, so I didn't see much point. :-)
 
@Xander Silly goose, I'm switching!
/subtle
 
6:15 PM
@JeffFerland YOU DONUT. HOW AM I GONNA GET MY JOB AS A JANITOR AT FB NOW?
 
@JeffFerland LOL! Ah, gotcha. What can I say. I'm not always the most perceptive ever.
@JeffFerland And by the way, congrats!
 
oh goodie, they told me which languages they're gonna teach us coming 10-20 weeks at school
C# and .NET
 
@Lighty And why are you "oh goodie"ing?
 
because i have no clue if i'm going to be raped or not
so please tell me if this is going to be painfull
 
6:30 PM
No, C# is a good language to learn.
 
@Lighty It depends on you.
C#/.NET is a reasonable language.
But, there again, so is Java. And some people react badly to Java.
 
@ThomasPornin i kinda master PHP, and master JavaScript, and weblanguages like CSS and HTML
 
@Lighty That's nice. But here we are talking about programming languages.
7
 
LOL
 
raz
@Xander Ah I see what you're saying now
 
6:33 PM
I meant, the basic understandings on coding
as in, type stuff, get result
a feel for it ya know?
 
@Lighty Precisely. You have never encountered a compiled language yet.
 
raz
@Lighty I'm not sure that's a good analogy. Compiled languages are quite different than scripting.
 
Experimentally, this is one of the trickiest points in teaching programming.
People who started with scripting languages have a very hard time understanding the concept of compilation.
I have seen it with people who were really good at doing Perl or Python.
They just couldn't grasp compilation.
 
Would I be wrong to say that it's easier to go from a compiled language to a scripting one than the other way around?
 
raz
@ThomasPornin I feel like a programmer should start with a compiled language, and then move on into scripting.
 
6:35 PM
@raz Yup.
 
well, for the languages, we will be moved to another location, a completely different school with other teachers
because people say our teachers dont know shit bout programming
im really glad we will get good grade teachers now
 
@Simon More generically, it is easier to go from "least magic" to "most magic" languages.
 
raz
@Simon I feel like some core concepts in scripting don't back port well into compiled languages.
 
@raz eval()
typically.
 
raz
@ThomasPornin Hahaha, now you're talking about black magic.
 
6:37 PM
@ThomasPornin That's just awful.
 
36
Q: What properties of a programming language make compilation impossible?

PrinceYannQuestion: "Certain properties of a programming language may require that the only way to get the code written in it be executed is by interpretation. In other words, compilation to a native machine code of a traditional CPU is not possible. What are these properties?" Compilers: Principles and ...

 
I hope anyone who considers using eval will read the first comment in PHP's documentation.
Which is don't use the damn thing.
 
raz
@Gilles That's a nice answer
I just remember in my engineering class. They decided to teach MatLab first, and then C. And some people had a difficult time with the transition. Both with syntax changes, and the concepts. But then again MatLab introduces its own weirdness with matrices and all.
 
I kind of miss Java.
 
@Simon Send her a text then
 
6:43 PM
@Lighty Why can't Java be a man? Are you homophobic?
 
Because people claim most languages don't age like fine wine
but like women, as milk
grabs popcorn
 
raz
@Lighty I honestly have no effing idea what you're talking about.
 
that was a rather sexist comment
 
@raz I gave up and decided to ignore it.
 
but since we're all men here, that doesnt spark interested fights );
 
raz
6:45 PM
@Simon Sounds like my first time....
 
@raz LULZ
 
@Simon wow you know PHP has to be bad when it makes you miss Java :op
 
@RоryMcCune Oh come on, I find Java's syntax lovely.
 
@Simon .... so how are those hallucinogenic drugs working out for you?
 
@RоryMcCune Pretty good, I just finished rewriting Facebook in a Java applet.
 
6:50 PM
@Simon nice..
here's a song for you
 
It starts in mono.
It almost killed me.
 
yeah sorry old music is old
2
 
raz
@Simon It's a great language for learning algorithm implementation. If you're trying to understand the efficiency of different types of lists, trees, tree traversal, etc Java is fantastic.
 
@raz And also the fact that JVM makes it the most secure language ever! (lol)
 
raz
@Simon JVM more like BoreVM amiright?
 
6:57 PM
Damn right.
 
@RоryMcCune I'd rather hear a good old song a million times than a crap new one once tho. And this is where, on average, old trumps new by a few orders of magnitude. So The Beatles are still just fine, keep them coming and flag whatever @Simon posts as spam/offensive :)
 
@TildalWave Keep trying to convince us that you're not a huge One Direction fan, maybe one day it'll work.
 
I'm more of a fan of Other Direction
 
@TildalWave the thing that gets me is that @Simon lives in the land of one of the greatest bands on earth and he's never been to see them live!
 
Also, how are One Direction new? Abusing C/A/G/D chords is as old as @RoryAlsop's first date
2
@RоryMcCune Neil Young & Crazy Horse?
 
7:14 PM
I probably should've starred that opinion with (IMHO)
 
Oh yes, I've seen them live 2 times (once with Jello Biafra)
 
@TildalWave lucky man, I've only seen them live once they came to Glasgow last year
 
Oh that one with Jello Biafra must have been in late 90's .. great gig close by in Austria. A few years before they were even in my city but on their own. Also had fantastic time. And lots of popping of course. Crazy times. Oy! :)
 
in slightly different musical times I'm off to see Jack White next week
should be interesting, my brother-in-law is a big fan so I said I'd go along
 
@RоryMcCune nice. I'm off to see Slash in a couple of weeks
 
7:26 PM
@RoryAlsop ooh that'll be a good one, where's he playing?
 
@RоryMcCune The Hydro
 
@RoryAlsop ahh that's where I'm off to see Jack White, seems like the hot venue these days
it's huge!
 
@RоryMcCune It's pretty good. NIN rocked the pace
 
I went to see Still Game there and was in row JJ, could hardly see the stage..
 
@RоryMcCune hahahaha
that's where the MTV EMA's were this weekend. Pics looked awesome
Slash and Biffy did a tribute for Ozzy
 
7:30 PM
damnit now I wanna go to some concert too I jsut realized it's been a while
@RoryAlsop When's the next Metaltech pan-Euro tour?
 
@TildalWave Who knows...two bands have asked if we could come and be their tour support round Europe...
In principle, yes - but timing is everything (and seeing where I can take my holidays...)
 
@RoryAlsop if you ski then we should be able to oblige in about a month :)
 
@TildalWave heh - more of a snowboarder, but yes, I ski too
 
well or that ... snow either case, or at least sand dunes
snow is better tho, I don't think there's sand dune skiing resorts yet :)
 
 
1 hour later…
8:43 PM
@RоryMcCune They look like they're about to die.
 
@Simon and they're still rocking harder than most people in here (excepting @RoryAlsop and probably @TildalWave) :)
 
9:33 PM
evening gents
 
@LucasKauffman Evening.
 
@Xander How are you tonight?
 
Well, still daytime here, so I'm still working, and busy week this week, but can't complain. Better busy than not. You?
 
10:23 PM
Evening all
 
@RoryAlsop Evening.
 

« first day (1425 days earlier)      last day (2416 days later) »