> Watch Obama talk about North Korea's cyberattack on Sony

it's now live ...

ugh, do we have any proof they did it?

@Ohnana Does it matter ? As long as North Korea does not deny.

@ThomasPornin I mean, if the president of the country is going to be accusing countries of stuff we can't prove...

LOOOOL Obama: I've got a long list of movies I'll be watching. Someone in the background: Will this be one of them?

@Ohnana Oh yeah, that would be quite unheard of.

Anyway, if I were Kim Jong-Un, I would jump on the occasion to pose as "the guy who defeated the USA".

But you're not Kim Jong-Un, you donut.

@Simon Can you prove it ?

on the internet no one knows you're a donut

@ThomasPornin Yes, you're a skinny donut with glasses, I've listened to one of your talks.

Terrorism is about spreading terror. Whoever did it in that case was successful (a lot more than Ben Laden, even).

Or I should say watched

whatevs

@ThomasPornin Ben? :D

@Simon Ah, well, if it was in a video on the Internet then it is true and proven.

@ThomasPornin There's no doubt it was you, stop being a sour donut.

@Noordung Sorry, a frenchism. The arab word is pronounced something like "ibn"; English write "bin" but French write "ben".

I love sour cream doughnuts

@ThomasPornin Oh lawd, I always typed it "ben", lulz.

Silly us.

@Simon you dough who is nutty you

isn't "ibn" son of?

@RоryMcCune That's weird, I would have spelled that "do who is nutty you".

@Noordung More "of the house of"

ah yes probably that

Ah, it seems that Pyongyang officially denied being behind the attacks (but they still officially applaud to it).

damn I'm losing lots of rep on space today due to rep cap

@Noordung I thought space was infinite?

@ThomasPornin I should get in this game and issue a press release announcing that I officially take no position on the culpability of the North Korean regime.

@Simon yes but Stack Exchange compresses it into a tight donut

Silly them.

@ThomasPornin I don't know about that. Whoever did this got a movie pulled. And I blame Sony more than anyone for that...Once there were issues with the release, they needed to pull it completely in order to collect insurance on it. Bin Laden on the other hand, caused enough grief that upon us the lasting gift that is the TSA has been bestowed.

@TomLeek You're more than welcome to revert my edit :)

2 whole lines of text? I can't read all that.

Free flag.

that's a super subjective question. might want to point him to /r/netsec to get some brainstorming going on

or point him to solving the halting problem for the lulz

/r/netsec?

reddit community. post article, chatter aimlessly and the like

I just posted a question and not sure what tags to use, can someone help me out? security.stackexchange.com/q/76468/20208

@Malachi I think that may be a dupe

@RoryAlsop oh yeah?

@Malachi trying to identify which one

@Simon MC Canadian Stereotype:

brilliant

Oh yes! Totally forgot about that one.

@Ohnana I have never really gotten the appeal of reddit.

@raz tons of easy-to-digest information, and an opportunity to interact with other humans. all most people need in an internet site

@Ohnana But I interact with humans here... right?

@raz oh.... did no-one tell you?

we're all bots :)

@RоryMcCune No...

Not you

Not you!!

NOT YOU MAN!!!

@raz ha! you didn't really think that @Simon was a real person... all that "Donut" thing, pure markov chains!

although Bear-Bot is quite advanced

model 1 (a.k.a. @RoryAlsop ) is showing his age now

keeps repeating himself

It all makes sense

All of the stereotypical chat clients are here...

How could I have let myself get entranced by this illusion!?

How else could the bears have so much rep... wiki bots of terrible proportion.

#yolo

@RоryMcCune That explains the achy feeling I've had in my XML parser the past few days...

yeah sorry @Simon @DavidFreitag and the rest, looks like the experiments over

we'll probably get scrubbed quite soon now

PHP error on line 3

@Simon Which is odd because the first fifteen lines are comments...

CONGRATULATIONS @raz You have bee playin Sec.SE sim for 4 months.... you're final score is 3361, please enjoy some of the other games in our line of sims

@DavidFreitag BROKEN PIPE

@Simon That... sounds painful.

@RоryMcCune But what's my overall rank!?

Hello. I have a question but I'm too afraid to ask because it'll get closed: what makes a certificate trusted?

@oldmud0 Well that's a complicated question

I mean, I don't have a choice: I have to trust a CA because if I don't, I can't use site X.

@oldmud0 Yeah that's an @ThomasPornin or @TomLeek question.

I'm sure a question addressing it has already been asked somewhere on InfoSec.

@oldmud0 so trust is determined by the program you're using. Browser people or OS vendors essentially make that choice for you

Anyone can go to some shady, obscure CA, say they're "Moajng" from "Stackholm, Sveden", get a certificate, and start launching mitm attacks on a network.

@RоryMcCune But you can choose to ignore them. And why should we trust VeriSign anyway?

@oldmud0 Actually, not a bad question. Very entry-level, but certain questions of that type aren't bad.

@oldmud0 you can of course change that choice by removing CAs from the program and then handling the trust decision on a case by case basis but that's a but painful..

@oldmud0 yep absolutely that's why the CA model sucks for a lot of risks

Not sure if it's a dupe of other "How does SSL work" questions.

@RоryMcCune When you think about it. "What makes a certificate trusted?" is a very existential information security question.

there can be as many "Mojangs" on the internet as CAs

@raz indeed trust is a tricky one it's very contextual

@oldmud0 that said in Theory, browser manufs will kick CAs off the list if they are lax at checking this stuff and that has happened in the past

so it requires a decent attacker to actually pull off these days... nation state is a definite, as a lot of them will have a "tame" CA

Is there any other way to use SSL/TLS without going through a handful of companies, like in SSH or PGP?

is actually why certificate pinning in mobile makes a lot of sense...

@oldmud0 at the moment for the general Internet... not that I'm aware of. The services you connect to use that set-up so if you want to use those services, then you kind of have to play along. For your own stuff self-signed is just fine tho'

as long as you understand how to manage that

@oldmud0 there are suggestions for replacements e.g. en.wikipedia.org/wiki/Convergence_%28SSL%29

Does anyone here have any experience with using Linq?

I'm trying to use a global DataContext with its own wrapper class, but I keep getting empty DataSet's from it.

The MSDN pages on the subject are very sparse.

@DavidFreitag wrong chat?

@oldmud0 Well if @AviD were around i'm sure he would know the answer.

@oldmud0 we have an ... interesting mix of people who wander in here, so with the right one you may get someone, @AviD would be a good choice

I just don't know how much database work he's done.

On a side note, I absolutely detest my school's wireless network. All students are obligated to use the "guest" Wi-Fi, which only works intermittently since there are so many devices connected and the subnet is essentially full all the time. Not to mention the firewall, which blocks about 75% of sites as well as all ports except 80 and 443. Recently, CONNECT got blocked so I'm not allowed to SSH through.

@oldmud0 that's not as bad as our network.

The school decided to use the wireless networks as a pseudo-realtime tracking feature, and because of that we have one AP per 100' or so.

They have each AP setup on the same frequency and the broadcast power turned down low enough that they only broadcast about 100'. The result is good internet for the first person to connect. Everyone else is effectively jammed.

@oldmud0 Also, Corkscrew might be of use to you. agroman.net/corkscrew

@DavidFreitag Wow, and they didn't consider using a system that triangulates your position based on signal strength? That's terrible. What's worse is that Windows accounts for teachers don't get any more privileges than student accounts. In other words, teachers can't install anything on their own laptops.

@oldmud0 Heh, teachers don't even get laptops where I go, just the workstation in their office

All told, there are probably over a hundred pretty nice Cisco APs being wasted.

Indeed, the internet situation in school everywhere in the US is atrocious, and ITs cannot quite understand the problem because it's only discussed among students. Right now, my school is funding lots of money for shiny e-boards and routers and "server expansions" (network space is still rationed in 900 MB chunks, though) and faster throughput and volatile thin clients (locked to 800x600 resolution, though)

@oldmud0 We used to have roaming profiles. Not sure what happened to those...

Now everyone is just encouraged to keep a flash drive with them.

oh well, internet's not a big problem since we're always kept busy with other stuff

Nevermind @AviD and all, I figured out my problem. (I was just being dumb)

and I'm trying to manage a programming club, but my biggest gripe is how the network configuration doesn't allow for code collaboration without a middleman running in a port other than port 80 or port 443. Not to mention that none of the (productive) members want to learn how to use or even install Git. Basically softwarerecs.stackexchange.com/questions/10580/… is what I'm talking about now.

@oldmud0 Yeah pretty much any firewall as part of an educational system is going to be completely locked down. I am part of a computer repair and share club where I go, out network is on its own vlan.

@RоryMcCune did you see the house that Notch bought - the most expensive one in Beverly Hills. It looks pretty impressive

@RoryAlsop I can't believe that a Swedish indie developer that coded such a simple game in Java made it this far into success in only a few years. Wow.

@oldmud0 He kinda sold his two-owner-company for $3billion, so that's $1.5billion for him.

plus whatever he already had.

and that's on top of the many million folks who each paid a tenner for it

@RоryMcCune did you see my new ironic hat?

Funny because of my hatred of Apple tablets

and the hassle I had to go through to make my work one cope with Stack Exchange

and yay - managed to get 7th network-wide

imagine if they gave hats for real jobs

I really hope that softwarerecs doesn't get shut down

Because if it does, then I have nowhere to go if I want to find obscure software.

@oldmud0 encourage all your friends and colleagues to use it as well then

@oldmud0 why would it be shut down?

@RoryAlsop sorry, my friends aren't avid users of SE :/

57% answer ratio

you can't compare different se sites tit for tat

@oldmud0 it islikely to have an odd Q/A ratio

it could definitely also use more regular visitors tho, so the community might wanna work on increasing that answer ratio ... but so far it looks fine to me stats-wise

@RoryAlsop That's something SE staff can say to justify why softwarerecs doesn't "fit" the Stack Exchange model.

@oldmud0 (SR mod here) It is a problem

I think SR is good at moderation of bad questions and answers (which are the problems with recommendation questions), but not so good at producing useful answers

Ideally, we'd have the moderation style of SR, with the competent audience of the relevant site (sec.se for security-related tools, SO for libraries, etc.)

but I doubt that we'll achieve that

@Gilles so it's the chicken and the egg problem ... you wanna have good answer ratio to keep loyal members there to research and answer questions without answers (which is usually not as rewarding rep-wise)

Paradoxically, for me, SR will be a successful experiment if it closes! That is, if it closes because it's being folded back into the other sites

@Noordung I don't think that's really a problem

The problem is that for any specialty, we have a low volume

@RoryAlsop yarrr it was awesome (mmmm candy room)

If someone is looking for a nessus plugin, who'd answer them on SR?

But SF and Sec.se, which is where the experts hang out, would close the question just because it's a software recommendation

It's still a relatively young beta ... we all have unanswered questions hanging there since the early days. How's your answer ratio now, in the last few quarters?

@Gilles; That's the case on SU too

and by the nature of SR, we're likely to have unanswered questions

/me needs to do some testing and clear that backlog ><