The DMZ

Thomas Pornin

12:13 AM

@TildalWave I think there is something like tag-only edit not counting as real edits.

Thomas Pornin

12:41 AM

@Polynomial badassoftheweek.com/norsereligion.html

Polynomial

@ThomasPornin That guy's chain of thought sounds almost identical to mine.

"Hmm, I don't really know what I believe, other than not believing in any of the obvious mainstream religions. I wonder which one is the most badass..."

David Freitag

> Sure, the Rainbow Bridge is a little fruity, but that's just how it goes sometimes.

halirutan

Hi. Does someone has an opinion about masterpasswordapp.com

?

I don't want my passwords to be stored in some cloud or in some manager I have to sync.

This was the first hit I found on google and it seems opensource and free. I searched the site here and the only relevant questions seems to be this

5

Q: Is it a good idea to have a "master" password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to choose one of them according to how much I trust the application and how sensitive it is. I usually...

But the links that were given in one of the answers lead to software that seems to manage your passwords (store them) and that costs something.

Polynomial

12:56 AM

"He drowns the entire Egyptian army in a huge flood, he lays waste to entire cities just for refusing to recognize him, and he was the dude responsible for helping Samson waste like ten million Philistines using only a donkey brain and his raging boner."

3

laughed my ass off at that part

David Freitag

4:51 AM

49

A: Guess the twins

hehehe

Gilles

5:33 AM

0

A: Password or passphrase strength tester

You seem to be under the delusion that password strength checkers actually exist. That's wrong: it is impossible to check the strength of a password, only the strength of a password generation method. A password strength checker can only test how long it would take to a particular cracker to fin...

CodesInChaos

9:10 AM

@halirutan Why? Encrypted passwords in the cloud is still more secure than password derivation.

Stack Exchange

TildalWave

11:19 AM

chalkias161

1 2

encryption malware windows android antimalware authentication opensource

Apparently, the user is "informed". I mean, he has the badge that say so, so it must be ...

Problem is, that the system will probably remove my downvotes as "targeted votes" (5 of them), and the user doesn't even lose any rep since he has none. I just hope he doesn't actually gain rep on "undownvotes"

CodesInChaos

@TildalWave Pure competence.

VtC on the questions. Downvoted two answers. Didn't downvote the skype question because I'm too lazy to read the question and thus can't be sure the answer is useless.

TildalWave

@CodesInChaos In a nutshell, he suggests changing the password and activating Google's 2-Step Verification on a compromised phone that's the only client.

i.e. he's invoking rootkit's lol procedure

raz

12:13 PM

@TildalWave security.stackexchange.com/questions/72513/…

That's a terrible analogy

lol

TildalWave

Why?

raz

Force feeding babies!? Do you want baby veal or something?

TildalWave

I take it you don't have children then :)

raz

I guess that's foie gras... not veal

halirutan

@CodesInChaos The idea was I don't always have internet access and that the (re-)generation of passwds would still work.

raz

12:15 PM

I don't have children.

TildalWave

Or pets ... doesn't matter. Sometimes you need them to take a pill or something.

or just also eat something else than donuts, ain't that right @Simon?

raz

There's food other than donuts?

TildalWave

sure, liquid donuts, donut ice cream, grilled donuts,...

donut burgers :)

raz

12:31 PM

mmmmmm donut burgers

Simon

1:08 PM

@TildalWave That's a sin.

raz

1:27 PM

Can someone else make sense of this question enough to edit?

0

Q: Is openssl supports TLS privacy

is that openssl supports TLS privacy method of authentication as mentioned at Rfc 5216 2.1.4. Privacy For client: basically client has to respond with client hello for the client hello request which is from server comes along with tls finish, client server ...

ssl openssl peap

Simon

Sometimes, you just gotta let it go.

THAT'S A LOST CASE HE MAKES NO SENSE BURN BURN BURN.

raz

WE DON'T NEED NO WATER LET THE MOTHERFFERUR BURN

Simon

And I didn't spell "cause" properly. Maybe I should join him.

Actually, I guess both make sense.

DGUHDSIFHSDFUHA WAT

Thomas Pornin

@raz I understand his problem but it is unanswerable as it is, because it does not depend on OpenSSL, but on the application that uses OpenSSL to do some EAP-TLS authentication.

And that must be supported on both client and server as well.

He does not even tell whether he is on the client or server side (or both)

Simon

He's a donut.

raz

1:37 PM

@ThomasPornin Yeah that's what's confusing to me.

Simon

In Egypt we actually have a name for this kind of invitation "boat owner invitation". This comes from a story where two boat owners meet in the middle of the sea and they shout to one another each inviting the other to come over. Of course both of them know it is impossible, yet they have to do it because it is being polite. — mosaad Nov 4 at 11:57

This is da lulz

raz

I don't get it

Simon

Of course you don't know what hospitality is, American.

BOOOOOOOOOOOOOOOOOOOOOOOOOOOOOM

Tinned_Tuna

@Simon or at least faking hospitality, all the while hustling your guests out the door and getting angry that they didn't take their shoes off before entering your precious, pristine abode.

Simon

@Tinned_Tuna Hey, I get mad at that too.

Tinned_Tuna

1:46 PM

@Simon it is the worst thing ever. Hoover, polish, etc. in time for guests. Guests arrive, don't take muddy boots off. ENGAGE THE RAGE

Simon

No sane individual keeps his shoes indoors.

@Tinned_Tuna Oh god.

raz

UNLEASH THE FURY

Tinned_Tuna

At that point I have to resort to the most aggressive techniques known to the British public. I don't offer them a cup of tea, and if they ask, I leave their tea to brew for about 5 seconds, whilst mine gets the full treatment.

Simon

@Tinned_Tuna That'll teach them.

Honestly, even when someone says "you can keep your shoes on", I take them off.

Tinned_Tuna

To be honest, if I went round to someone's house and they couldn't make tea properly, I'd probably never go round again.

Simon

1:50 PM

@Tinned_Tuna Silly Brits.

Tinned_Tuna

I think you'll find my reaction to be completely reasonable.

Simon

Well, I can actually relate to that. If someone's igloo isn't built properly, I no longer want to be his friend.

raz

@Tinned_Tuna What's tea?

I think I just dump tea into harbors... isn't that what you do with tea?

Simon

I'm actually becoming a teafag.

I go to David's Tea almost every week now, sigh.

Tinned_Tuna

@raz goddam it, where's that tax you owe?

raz

1:58 PM

@Tinned_Tuna You got nothin' on me man

Tinned_Tuna

@raz but how will I fund my continuing colonialism and various brutalities? Not to mention my lavish palaces...

Simon

Maple syrup, that's how.

raz

@Tinned_Tuna The Falkland Islands?

Rоry McCune

2:29 PM

Afternoon all

raz

Hello Rory

Rоry McCune

hey @raz hows tricks?

raz

tricks or treats?

Thomas Pornin

2:51 PM

@Polynomial If you are into Norse badassness then you should enjoy that book:

amazon.com/Farthest-North-Fritjof-Nansen/dp/1461067154

Simon

Ew. Reading books is for cultivated people.

Thomas Pornin

It is the actual account from Fritjof Nansen, who held for a few years the world record of the human who went closest to the North pole.

Polynomial

@ThomasPornin Will take a look. Btw, that link you posted last night was epic. Laughed my ass off for a good half hour.

Thomas Pornin

The book begins by Nansen going in a boat with a dozen other Norwegians, intent of getting blocked in the see ice and drifting for three years, from East Siberia to Atlantic.

Simon

Sea you donut.

Thomas Pornin

2:54 PM

Then at one time he gets bored, and decides to hike the 800 last miles to the North pole with just another guy, two sledges and thirty dogs.

He knows that he won't be able to get back to the boat (because of the drift) so he honestly plans to hike back 2000 miles then use a kayak to cross the Ocean and get back to Norway.

Simon

This dude is either suicidal or trusts himself like nobody's business.

Thomas Pornin

He also knows that he does not bring enough food for his dogs so he will have to kill some dogs to feed the others.

Simon

@ThomasPornin Damn, I kind of wanna read it now.

Thomas Pornin

Then he shoots every single seal, walrus or polar bear that he encounters, just to eat their meat.

And then they have to spend the winter on a desolate island, living off their hoard of bear&seal meat.

They congratulate themselves on eating what is, in their mind, the best food ever: pancakes made out of fish flour mixed with seal blood (cooked over a fire powered by the seal fat).

Polynomial

Bad ass.

amazon.co.uk/Farthest-North-Voyage-Exploration-1893-96/dp/…

appears this is the only UK english version that isn't abridged or an OCR'ed copy

Simon

3:01 PM

Too expensive, bro.

Polynomial

used (read once) in perfect condition for £7

Thomas Pornin

@Polynomial Mmh. Turns out I just read the abridged version.

Or at least an abridged version of an "official" French translation (made by another explorer a few years after publication).

Polynomial

bought it.

got the last copy at that price :P

raz

I just ordered this book for fun

amazon.com/gp/product/143026196X/…

I like reading real books, not a fan of e-readers.

Polynomial

I like both.

ebooks are great for when you don't expect to need to pass the time

just carry a lightweight device and boom, there's 1000 books to pick from

Rоry McCune

3:04 PM

@Polynomial also searchability

raz

I've also heard you can get the entire Sherlock Holmes series for a dollar. Which is kinda awesome.

Polynomial

or when traveling in general

I like real physical books for reference.

Rоry McCune

@raz you can get a lot of that IIRC for free from Project Gutenberg

Polynomial

like I have all the Windows Internals ones, Malware Analyst's Cookbook, etc.

CodesInChaos

@Simon Another gem from that thread:

> "Wouldn't blue be a better fit to your eyes?" -- which means you are looking like an anorexic scarecrow with a drug problem

raz

3:05 PM

@RоryMcCune Project Gutenberg?

Rоry McCune

@raz gutenberg.org/ebooks/search/?query=sherlock+holmes

@raz they create e-books of anything that's out of copyright

raz

oh that's nifty

Rоry McCune

my missus loves it 'cause she's a big fan of older books

raz

@RоryMcCune I'll have to keep that in mind. My sister likes the ebooks.

Xander

@RоryMcCune Back in the days before e-books, I used to print out entire Dickens novels off of the Gutenberg website. While I enjoyed reading the "free" books, looking back I don't really know what I was thinking. Probably would have been cheaper (and less hassle) to buy the actual books. In the e-book era, it's massively more useful.

Rоry McCune

3:14 PM

@Xander indeed, I've printed out some eBooks and it's barely worth it (apart from the convenience factor) over buying the pBook

Simon

@CodesInChaos Bahaha, nice.

Simon

3:27 PM

How is this security-related?

0

Q: What can I track with an RF receiver

I found this video on Hak5 that shows how one can easily (and legally) track aircraft using a cheap USB RF receiver. It's possible because aircraft broadcast their position via ADS-B What else is trackable using an RF receiver? Boats? Busses in some cities? Is anyone aware of other "things" th...

monitoring

Rory Alsop

@Simon I've already closed it

(you donut :-)

Simon

@RoryAlsop Thanks boi.

@RoryAlsop I posted it before you closed it you donut.

Rory Alsop

@ThomasPornin he's a wonderful nutjob

Rоry McCune

@RoryAlsop nonono you've been subverted by @Simon 's terrible spelling

Rory Alsop

@Simon I know that too, boi

Simon

3:33 PM

@RоryMcCune Ma spelin is flhaless

@RoryAlsop Oh you donut.

Rory Alsop

@Tinned_Tuna I do not ever make tea. It's leaves in water. Why would anyone drink that?

4

Simon

Do people still receive SE swag during mod elections?

raz

@Simon SE has swag?

Simon

@raz Let's face it, tea is the reason why you guys want to separate.

Rоry McCune

2

^yeah it's like that

Simon

3:36 PM

@raz Yes, like t-shirts and pens.

@RоryMcCune dat punch

raz

@Simon I like tshirts. TshirtHell is my favorite site.

Simon

@raz Imagine getting a free SE t-shirt

We could walk in the streets and show to the world how nerdy we are.

That was quite a weird spelling mistake.

Rоry McCune

@Simon hey hey I'm a great fan of my Sec.SE T-Shirt, worn it at many a conference

raz

@Simon I already have nerdy tshirts, what's one more?

Simon

@RоryMcCune Did you feel all the sex get out of your body?

@raz True, true.

raz

3:44 PM

I own this shirt

@raz Are you single?

Nope

Phew.

And this one

And 17 others that I can't put on this chat lol

Simon

You can if @Lighty isn't around.

raz

3:47 PM

What's Lighty have to do with anything?

Simon

He's the only one who flags chat posts.

raz

ah

One of my favorites

Rory Alsop

@Polynomial I've unfortunately taken to buying the hardback and ebook versions of most sci fi books I buy

Which meant last night I got books and my kindle signed by Peter Hamilton :-)

Polynomial

@RoryAlsop I'm guessing you have enough space to dedicate some of your house to be called "a library".

Rory Alsop

@RоryMcCune me too

Polynomial

3:52 PM

I have a shelf with a few books. That's my limit.

Rory Alsop

@Polynomial oh yes - my studio/computer room has one wall of guitars, and one of books, maybe a couple of thousand

Polynomial

lucky.

Simon

@RoryAlsop Can we get a picture of that?

Rory Alsop

@Simon yes

lemme find one online

As I'm not at home right now

Tinned_Tuna

@RoryAlsop how can you be so cultured, yet so savage?

4

Rory Alsop

3:54 PM

@Tinned_Tuna I'm not cultured

Simon

^ lol

Tinned_Tuna

doesn't drink tea, what madness is this? :-p

Rory Alsop

@Tinned_Tuna it's unnatural

I prefer Irn Bru, Red Bull, Coke and other natural caffeine sources

Rоry McCune

@RoryAlsop I don't know you drink G&T and veuve clicquot

Rory Alsop

@RоryMcCune that's because they taste good. I also drink Absinthe, whisky and vodka

(not all at once)

actually, probably would all at once, just to see what it tastes like

^ possibly an indicator I'm not cultured

raz

3:59 PM

@RoryAlsop I think you're doing it wrong.

Rory Alsop

@RоryMcCune I only had a Nicolas Feuillatte last night after I got home

sadly doesn't compare to a bottle of V.C.

Simon

I had water.

raz

Weyerbacher Pariah (Golden sour ale), Weyerbacher Cassiopeia (Old strong ale)

ManishEarth

Hey, anyone free here?

Want to discuss bug bounty programe

More accurately, lack of bounty programs :p

Xander

4:19 PM

@ManishEarth What about the lack of bounty programs?

ManishEarth

@Xander so we at Servo are thinking about inviting people to look for security bugs

TildalWave

I was either going to lose as off topic or too broad. You can track anything that transmits a signal, so you could have unlimited answers - at the end of the day, though, this has nothing to do with security. — Rory Alsop ♦ 49 mins ago

@RoryAlsop Not sure if spelling or grammar ^

ManishEarth

There are a bunch we know of, and the choice of Rust eliminates a lot, but there's still a shitload of stuff that could possibly be memory unsafe

However, being a smallish research project, we don't really have the budget for a bounty program. And I don't think we can easily tap into Mozilla's bounty program.

TildalWave

BTW - compromising emanations is about security. But the question is way too broad.

ManishEarth

Especially since stuff like Firefox has sec people working on it (so there is some form of guarantee that there won't be many sec bugs, so not much of a drain on the bounty program), while we haven't looked too much into that

@Xander so we were thinking of inviting people to look for sec bugs, however the only thing we can realistically provide are stickers and t shirts, and some recognition. Given that we haven't done a proper sec audit (and won't for a while), it makes sense a bit since there will be lots of easy sec bugs.

However, with little or no reward, how do you invite people to look for security bugs?

/cc @TildalWave

@TildalWave agreed

Tinned_Tuna

4:25 PM

@ManishEarth we have that issue too, no budget for a real bug bounty, but we've got it on the road map for when we have funds to ring-fence

ManishEarth

I can certainly say that looking for sec bugs in Mozilla Servo would be a rather fun experience. (a) because there's low hanging fruit, and (b) because it's in Rust, so you have to get creative for the memory safety stuff

TildalWave

bug hunts can be fun too you know? so make it fun, then even donuts will seem like a fair reward

ManishEarth

@TildalWave yeah! ideas?

Rory Alsop

@TildalWave ahh - no. It's a dodgy 'c' key on this keyboard

TildalWave

@ManishEarth oh dunno, you're sent a kissagram / singagram / or otherwise being treated like a deity for each bug you submit?

Rory Alsop

4:31 PM

@TildalWave this question isn't about compromising emanations though

> Is anyone aware of other "things" that broadcast their position by radio that the public may freely track?

ManishEarth

@TildalWave pahahaha

TildalWave

@RoryAlsop you can freely track even spy satellites, just don't publish their exact position and you'll be fine ;)

Rory Alsop

@TildalWave hahahahaha :-)

Lighty

@Simon meanie

Simon

8D

Xander

4:49 PM

Well, one risk you run is that you'll end up a repeat of the Yahoo! debacle. I think you can probably avoid that by being up-front that all reporters will get is swag, and that this is because you have no budget for a bug bounty but want to give them a token of your appreciation.

I think the bigger risk is that without a financial reward, the quality of the folks looking at your stuff is not going to be as high, and there won't be as many of even the amateur folks.

Simon

What is @Avid is the donut doing nowadays?

Xander

@ManishEarth Which you've clearly thought of. In my experience, you really can't.

ManishEarth

@Xander Yeah, there was a meeting at the work week yesterday and Yahoo came up when we were discussing it.

Xander

@ManishEarth You promote the fact that you want people to look for sec bugs, and offer swag, and if it doesn't cost you much to do that it might end up bring in a few more bugs here and there, but I wouldn't expect a lot of return.

ManishEarth

hm

@Xander any ideas for making them "fun" as Tildal says?

Mozilla has budgeting for events, perhaps we can tap into that. Not sure how it works. I'm only a volunteer.

(also not sure if an event would work for this)

raz

4:54 PM

@ManishEarth Sorry I missed the conversation. but what are we analyzing?

I'll do almost anything for a free tshirt.

Simon

lulz

Xander

@ManishEarth An event might be tough because of the logistics involved with getting reporters to the event. One way to make it fun (and it's just a thought, don't know how well it work work) would be to turn it into a contest or series of contests, maybe with prizes.

@ManishEarth I don't know if your budget constraints actually limit you to zero, but if not, giving away things like a iPad or a Nexus 7 pre-loaded with Kali NetHunter to top-reporters might get people motivativated to compete against each other and win something nice.

ManishEarth

@raz Want to look for sec bugs in Servo?

@Xander That's interesting. Probably above constraints, but interesting

@Xander agreed. Contests sound fun

raz

@ManishEarth Servo as in...

ManishEarth

@raz Mozilla Servo

github.com/servo/servo

Servo (layout engine)

Servo is an experimental web browser layout engine being developed by Mozilla Research, with Samsung porting it to Android and ARM processors. The prototype seeks to create a highly parallel environment, in which many components (such as rendering, layout, HTML parsing, image decoding, etc.) are handled by fine-grained, isolated tasks. The project has a symbiotic relationship with the Rust programming language, in which it is being developed. There are currently no plans to integrate Servo into any existing Mozilla products, such as Firefox. Servo is named after Tom Servo, a robot from the television...

mozilla.org/en-US/research/projects

►

raz

5:05 PM

sure that sounds like fun

Not sure when I have time to do it, but it sounds like fun.

Simon

Nerdy diagram alert

raz

Your face is a nerdy diagram alert

@ManishEarth Do I get a free tshirt?

Simon

@raz My face is amazing.

raz

@Simon That's a biased statement. Can't trust it.

ManishEarth

@raz We actually haven't decided on the details yet, but probably

raz

5:09 PM

@ManishEarth Do you need my info for some kind of distro list?

ManishEarth

@raz as in?

Simon

@raz My IBC video can be used as proof.

raz

@ManishEarth Contact info

@Simon Photoshopped

Simon

Ffs.

raz

:D

I'm persistent like an implant, mofo

Simon

5:11 PM

You're persistent like a hobo who wants some change.

raz

Change?

ManishEarth

@raz (a) I'm a volunteer. While I'm a core team member, I won't know much about this and don't want to make any officialesque statements. (b) Nothings decided yet -- I suggest you wait a bit -- feel free to look for security bugs or other wise contribute, but at the moment we're discussing how to get people involved i nsec bugs. (c) Mozilla usually asks for contact details after you've won a bounty, not before :p

Simon

urbandictionary.com/…

raz

@ManishEarth I just meant about being contacted for participating.

But yeah whatever

ManishEarth

@raz Oh, okay. It's open source, you can jump in whenever :p

If we hold a contest, I'll be sure to leave a note in the DMZ.

raz

5:15 PM

Sounds like @Simon's mom amiright!?

ManishEarth

pahaha

Simon

@raz You

DONUT.

raz

@ManishEarth Sounds Good

ManishEarth

Right now the plan is to come up with a plan, write a wiki page, and list all known security bugs

raz

@Simon I'm going to take your mom out to dinner, and never call her again.

ManishEarth

5:16 PM

eg we don't yet support iframe CORS -- we jsut open the iframe DOM to the outside

raz

@ManishEarth Ah, plans to come up with plans.

Solid

ManishEarth

@raz yep :D

Simon

@raz My dad will murder you.

Also, he's stronger than your dad.

raz

Haters gonna hate hate hate hate hate

Xander

@raz Shake it off.

raz

5:33 PM

I could have been gettin' down to this sick beat....

Simon

7:12 PM

Dem downvotes

-29

A: Should I raise concerns about a co-worker possibly leaving?

You have done the right thing by talking to your manager. At this points it is out of your hands and there is nothing more you can or should do. This is now between Joe and the company's management. If your manager has decided to not elevate it, there is probably good reasons for that. If he has ...

Xander

8:59 PM

@Simon Weird, it looks like it's getting so many downvotes specifically because the OP likes it better than the other answers.

Xander

9:43 PM

Yay! 1/5 of the way to my Epic badge. It only took 4 years to get this far.

Thomas Pornin

11:00 PM

@Xander But you got most of that 1/5 in the last two months.

Xander

@ThomasPornin This is true. I'm not sure I can keep it up though, so the overall average is probably a better measure.

Thomas Pornin

@Xander It becomes easier over time; readership has increased, and your existing answers keep on accumulating rep.

Xander

@ThomasPornin That is a good point.

TildalWave

11:16 PM

@Simon That's just mean. So the answer at one point had, say, 15 downvotes, and 15 other people thought it needs more? Whatever for? They get off on it or something?

And why are they still keeping it there? It's clear that the community rejected it. What purpose does it serve by staying on the site?

Xander

@TildalWave It's not because the answer is that bad, (it might deserve downvotes, but not that many) it's because the OP liked the answer. That's what's causing them to downvote it into oblivion.

TildalWave

It really only says bad things about that site to me. I never really wanted to be on a site on which people at workplace discuss workplace related issues with other people that aren't in that same workplace.

@Xander Yeah, lots of petty voting there then

"You can ask questions here but you're not allowed to like answers to your own question that the rest of us disagree because we disagreed with your question" ... geeeeeeeez

Xander

@TildalWave Yeah. I avoid that site in general, because I think it's mostly opinion based. It's a lot better fit for a discussion forum than a Q&A site.

TildalWave

11:35 PM

I think that all sites here attract a certain percentage of a very specific type of people that need them for cathartic reasons, like places where they can express their opinion and enjoy certain level of support from the community, even though that's absolutely not what Q&A's are here for. On some sites, those types are tolerable. On others, I just can't stand them even if in relatively small numbers. Workplace SE is definitely one of the latter. It has a pungent "support group" bouquet.

And mind, that doesn't even say anything about its overall quality, of which I think a lot better than it might sound. I've read some fantastic threads there and I'm grateful I have. It's just that some other threads on it completely ruin that for me.

BTW this might be of interest to some (it's not just space related):

►

It's a playlist actually, some videos have fantastic talks ... from recent MIT AeroAstro: Centennial Symposium

Transcript for