The DMZ

1:02 PM

@Gilles I cannot think of a plausible scenario where a web browser would respond to a HeartbeatRequest message.

Why?

Has it ever been with browsers that the server keeps sending a keep-alive message to the client?

@TildalWave Not doable for PDFs. But probably doable for long pages. File an issue on github, I'll look into it when I get the time :)

CodesInChaos

@Adnan Could be useful in a chat. Server wants to know if the client is still online and sends a heartbeat to check.

Adnan

@CodesInChaos I can see that happening on top HTTP on top of TLS on top of TCP. But to be built-in with TLS? I don't know, doesn't sound right to me.

CodesInChaos

@Gilles In principle both sides are affected, but OpenSSL is far more common on the server.

Chrome and FF use NSS, IE uses SChannel

Scott Pack

@Adnan I'm tellin ya man, he's a contact whore.

Adnan

1:09 PM

@CodesInChaos Hmmm.. It'd be really interesting to test a fake server that asks a client like wget for a heartbeat message.

I don't think it'd be difficult to write one in C++, no?

Just something that spits out server hello after that sends that heartbeat message 18 03 02 00 03 01 40 00.

Heeey, @Terry wanna do it?

Terry Chia

@Adnan yawn maybe tomorrow if I get really bored. :P

Adnan

@TerryChia You're yawning on the DMZ. Of course you're bored!

Scott Pack

@RоryMcCune Nah, I'm not too worried. All my stuff is still running 0.98.

TildalWave

@ManishEarth Issue? It's not an issue man, I love the extension! Just an idea :) So, even for PDFs that are opened within Chrome, those context menus can't be extended?

Terry Chia

@TildalWave A GitHub issue can be used for feature requests you know... :P

TildalWave

1:23 PM

@TerryChia I take issues with GitHub terminology then, bang hard on your keyboard if you disagree :P

AJ Henderson

hmm, always fun when I log on in the morning and see 20 questions with a new word

Thomas Pornin

@AJHenderson It is a new fashion

AJ Henderson

anyone know of a good place to get a 1.0.1g build of OpenSSL for Windows

the normal version I use only has 1.0.1f builds up so far

Thomas Pornin

Well, not exactly new, but from 2010 or so, when you find a bug, you write a Web site for it.

Gilles

@Adnan the point is that a client application might support it even if the author never thought about it, just because it's using the right library functions and they respond to the heartbeat request automatically

Thomas Pornin

1:26 PM

@Gilles I don't really see why there is so much buzz around this particular bug

After all, it is only a buffer overflow. It has happened in the past.

AJ Henderson

@ThomasPornin were there actually any meaningful details after the announcement became an advertisement?

I stopped reading when they started promoting

Gilles

@ThomasPornin because it's very easy to exploit?

Thomas Pornin

@AJHenderson This page has details: blog.existentialize.com/…

Adnan

@Gilles and that's the essence of what we do. Using things in ways that aren't how they're supposed to be used. I agree.

Thomas Pornin

It is a read overflow; the client gets to read up to 64 kB of data (for each try)

The data is whatever lies in RAM after the dynamically allocated block

In lab conditions you can extract a lot of data that way, but you have to do some trial-and-error with other connections in order to arrange for the juicy data to be at the right place.

Iszi

1:29 PM

Holy crap. We've got nine Heartbleed questions already?

Adnan

@ThomasPornin In my case, that was passwords; cookies; and a couple of "secret" URLs.

Terry Chia

@RoryAlsop @AviD Can we kill heartbeat please?

We don't need individual tags for each vuln.

Thomas Pornin

The real question is: what is the probability of an attacker being aware of the attack, and having applied it to your site, before you fixed it ?

AJ Henderson

@TerryChia might make sense to keep it for now and kill it in a few days

Thomas Pornin

(Btw I learned of the attack this morning, and Ubuntu was already pushing the patch, so my server is safe.)

AJ Henderson

1:31 PM

would hopefully reduce dupes

Terry Chia

@ThomasPornin OpenSSL is still vulnerable. That says a lot.

AJ Henderson

@TerryChia look at the bright side, no conspiracy questions yet

Terry Chia

@AJHenderson Hey, should I go ask one?

Thomas Pornin

@TerryChia Anybody who got a look at OpenSSL's source code knows that there must be an awful lot of holes still lurking in it.

Terry Chia

I'm sure that will get me plenty of rep.

Thomas Pornin

1:32 PM

And yet they keep adding features.

Terry Chia

@ThomasPornin Oh no, I meant the website.

AJ Henderson

haha

Terry Chia

The very definition of ironic.

AJ Henderson

/cry

Thomas Pornin

@TerryChia Ah, they already had trouble with their hosting previously. They got hacked a few months ago. I am not sure they really care.

Usually, that kind of bug is my cue to repeat that C is a powerful and dangerous tool and that you really should not use it. Then I get a dozen downvotes from people who still fail to get the clue.

3

CodesInChaos

1:38 PM

The problem with "don't use c" is that there aren't really good alternatives for libraries.

You can bind a c library from pretty much any language.

Terry Chia

Ooooh, python has another fun memory corruption bug.

TildalWave

what happened with this one: security.stackexchange.com/questions/55113/…

wanted to close as off-topic as the 5-th reviewer to vote so and it locked it

bug?

Braiam

> Post Migrated Away to superuser.com by Adnan, scuzzy-delta, Xander, AJ Henderson, TildalWave

TildalWave

oh,... nvm, its migrated to SU but took some time to do that

didn't see that take longer than a few seconds before LOL

CodesInChaos

@ThomasPornin So which language should we use for an OpenSSL replacement?

Thomas Pornin

1:43 PM

@CodesInChaos Ideally we should use a language which can compile to portable C. Treat it as a kind of assembler.

At one time I had written a Java-to-C translator for that.

It took Java bytecode and produced C code, to be compiled and linked with a specific runtime (with its own GC and standard library).

I did that to fit a complex Java server (a PKI with SSL server, indeed, and a lot of X.509-related code) into a HSM which understood only basic C (with not even a full stdlib).

It worked well; it is still deployed.

And its SSL server is, by definition, free of buffer overruns, since all its array accesses are bounds-checked.

Terry Chia

@ThomasPornin Nice, I'm assuming the code isn't released?

Thomas Pornin

@TerryChia Unfortunately no.

CodesInChaos

having more than one independent GC in a process is a pain

relocating GCs are annoying as well since it hard to wipe memory.

so I don't know if any GC based language is appropriate for such code

Thomas Pornin

@CodesInChaos It really depends on how you can segment memory allocations. Remember: here, you are comparing with a C-based traditional library, in which all allocations and releases must be explicit.

As for the memory wiping, I find it kind of overrated. Yet it will be done "naturally" with a mark-compact GC (Jonkers' algorithm).

That is, a relocating GC may actually help a lot if you want to "wipe memory".

CodesInChaos

I like forward secrecy, so wiping is important

Thomas Pornin

1:54 PM

@CodesInChaos However, it must be all-encompassing.

deed02392

@ThomasPornin That's a great idea

Thomas Pornin

You like forward secrecy because the SSL tunnel was used to exchange confidential data, and that data appeared in the RAM of both client and server. If wiping is important then everything should be wiped.

Cryptography keys are just the tip of the iceberg (an awfully overplayed analogy, but accurate).

Therefore, if you want wiping then it should be general, applied systematically by whatever system you use for dynamic memory allocation.

CodesInChaos

that would certainly be nice

Thomas Pornin

GC don't actively prevent that. What makes general wiping not-done in general is that it adversely impacts performance, especially in the presence of virtual memory.

The real enemy, here, is swap space. That is the first thing you should deactivate.

Once there is no swap, automatically zeroing released blocks becomes more bearable.

Ah, meeting time...

CodesInChaos

The problem with that is that the application developer has only limited control over that.

There are some memory locking functions

but they don't fit with high level languages like C#

So I generally treat wiping as a "best effort" issue which I don't guarantee

Terry Chia

2:03 PM

12

Q: How to get pornographic movies for scientific research purposes?

Recently, I have being planning to design an automatic pornographic movie detector with the machine learning knowledge that I just acquired. I am now in the stage of planning how to perform the system evaluation. The intuition is to just test the algorithms with some pornographic movies and some...

Right.... "Scientific research".

Adnan

@TerryChia Just head over to PornHub. That site pays producers for content. The content there is 100% legally free.

I don't know, sounds like a weird question by someone who has a feet fetish (check the OP's profile). he should now better.

ManishEarth

2:48 PM

@TildalWave :P Yeah, but GitHub issues is an easier way for me to keep track ;)

Uh, I haven't played much with context menus. Will have to try

Thomas Pornin

3:25 PM

@CodesInChaos Also, they tend to require privileges to run.

My current opinion on the subject is that virtual memory is an idea which used to be good, but only used to.

For a server, you never want to hit swap space anyway, especially when some of your applicative code uses a GC (be it Java, C#, Python, PHP...)

So just deactivate swap altogether.

This won't prevent paging (removal of code pages, since they can be reloaded on demand from disk) but will allow actual data to be in RAM and stay in RAM.

David Freitag

3:50 PM

Maaaaan. Coworkers are so nosey.

CodesInChaos

The big problem without virtual memory is that you either get over-commit or you don't benefit from copy-on-write.

You should avoid swapping, but usually it's still better than a hard out-of-memory condition.

Xander

@DavidFreitag That is factually incorrect. I am a coworker, and I am not nosy.

David Freitag

@Xander My presumptions were purely based on experience.

Ladadadada

So this guy redacted the password in the plaintext side of a hexdump but forgot to redact the hex side of the hexdump. Whoops.

So just in case the graveness of #Heartbleed hasn't been realised by some yet, Yahoo is leaking user credentials http://t.co/G1v1UBgyiH

Tweeted by WarrenGuy on April 8, 2014 at 12:29 PM

Xander

@Ladadadada Awesome.

Terry Chia

4:03 PM

@Ladadadada Hey, be grateful Yahoo even has TLS.

Xander

@Ladadadada Ah, it's not the full hex. There's a bunch that isn't in the screenshot at all.

Ladadadada

@Xander Yeah, the left side of the hex is cropped off.

Adnan

4:24 PM

I'm trying to test Heartbleed impact on the client, and I need some help. Isn't the TLS server_hello simply just '0E'?

Pfffttt... never mind.

Ugghhh.. didn't read the exploit code correct. I should probably just keep learning Python.

and I should probably learn SSL as well

Lekensteyn

Hey Adnan, I am also working on a client test

I am testing against 1.0.1f and curl

Adnan

@Lekensteyn I'm testing against 1.0.1f and wget

I guess it should be the same

Lekensteyn

The ServerHello is done-ish (the cipher selection needs to be refined), now I need to make a valid cert

Adnan

@Lekensteyn Is the cert even needed? Looking at the server exploit (and the heartbeat RFC), it seems to me that you can send the HeartbeatMessage right after the Server Hello

I'm still confused about the whole thing, so if I'm not making any sense to you, it's probably my fault.

Lekensteyn

@Adnan I looked at tools.ietf.org/html/rfc5246#page-36, the certificate is needed for the server on the web

For the client exploit, all it needs to do is sent a Hello, wait for ServerHello + Certificate (that concludes the handshake)

then the heartbeat can be sent,

I read it somewhere in rfc 6520, let me get a quote

https://tools.ietf.org/html/rfc6520#page-4 " However, a HeartbeatRequest message SHOULD NOT be sent during
handshakes. If a handshake is initiated while a HeartbeatRequest is
still in flight, the sending peer MUST stop the DTLS retransmission
timer for it. The receiving peer SHOULD discard the message
silently, if it arrives during the handshake. In case of DTLS,
HeartbeatRequest messages from older epochs SHOULD be discarded."

So, the first goal is to complete the handshake, then it may do whatever it wants

Adnan

4:36 PM

@Lekensteyn Oho. You're indeed correct.

@Lekensteyn What language are you using?

Lekensteyn

python, I'll push something to git for you

Thomas Pornin

@CodesInChaos Just for nitpicking, copy-on-write has two benefits: not allocating memory for pages which need not be duplicated, and not spending time on actually copying the pages. Without a virtually infinite space to expand in (swap space), the former no longer holds, but the latter benefit is still there.

Lekensteyn

@Adnan See github.com/Lekensteyn/pacemaker/blob/master/pacemaker.py

Thomas Pornin

I do agree, though, that, right now, the software ecosystem is "in between"

Software becomes less tolerant on swapping (GC-based languages are to blame for that, I guess)

But software has not yet learned to live without swap at all.

Since smartphones don't have swap space, we may hope for a more complete transition in the midterm future.

Adnan

@Lekensteyn Thanks a lot. Maybe @Thomas can take a look as well.

Lekensteyn

4:46 PM

I peered in the OpenSSL source and the client is very likely affected

but all PoCs seem to target servers only

Adnan

@ThomasPornin If you please could read a few lines up. Summary: @Lekensteyn is trying to create a malicious server to exploit the Heartbleed vuln. in clients. He seems to have got about 70% of the thing and he's now trying to cause the server to return a valid cert in order to finish the handshake and then send the HeartbeatMessage to the client.

Lekensteyn

If I got it right, all I need to do now is craft a certificate and include it (I just pushed the ServerHelloDone)

The cipher is hard-coded to RSA-3DES-EDE-CBC-SHA which does not need a ServerKeyExchange according to 7.4.3 of rfc 5246 (TLS 1.2)

Adnan

@Lekensteyn I'm pretty sure that you don't really need a cert if you use anonymous DH. IIRC, with anonymous DH, you can use NULL as the certificate.

Perhaps @Thomas or @Codes can verify

That could be a way to get the exploit up and running with less effort

Lekensteyn

@Adnan I think you are right, but then I need to force curl (or wget) to accept that cipher. Will look at it, thanks.

CodesInChaos

Since many clients don't support anon DH that's not a useful approach. I'd rather go with a self signed cert and tell the client to accept it.

Lekensteyn

4:57 PM

You can get one from startssl.com for free, the certficate is not really important. Right now I test with LD_LIBRARY_PATH=oldlibs/ curl -k https://localhost:1300 --ciphers NULL and that almost works

Adnan

@CodesInChaos While I completely agree it's better not to use ADH to test for real-world cases, I think if it's possible to easily get cURL to accept it, then it can be a way to just test the possibility.

Thomas Pornin

@Adnan You don't need a certificate for the DH_anon cipher suites, but almost no client will support such cipher suites out of the box, because they are "insecure".

Thomas Pornin

5:22 PM

@Lekensteyn I fear this won't work. If the client waits for the end of the handshake, then, in particular, the client will wait for proper Finished messages.

This means that you will have to do the crypto.

You cannot, as a server, send a Finished that the client will accept if you don't complete the key exchange and compute the keys and hash all the handshake messages.

Your best bet would be to modify an existing SSL library, in order to inject your extra messages.

Or you can bite the bullet and implement your own SSL, right from scratch. Very pedagogical. If you master SSL, you will never be unemployed.

Lekensteyn

@ThomasPornin I dropped the manual handshake already, I am now building on top of python ssl module

Jeff Ferland

6:13 PM

@AviD What post?

look at me a day late to the party

Adnan

@JeffFerland Naah, we were just bitching about how badly Facebook handles flags.

David Freitag

Well that's interesting.

If anyone who has Visual Studio 2012 that used to run smooth as butter that suddenly lags 3-4 seconds after each edit of any file, delete or rename these two registry entries:

> HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\11.0_Config
HKEY_CURRENT_USER\Software\Microsoft\VisualStudio\11.0

You will have to pretty much reconfigure it as if it were new, but the infuriating lag goes away.

Adnan

@DavidFreitag What about when you have VS2012 that used to run as smooth as butter, but then suddenly it started losing debug symbols and forcing me to rebuld the whole solution each time I change one line? If I run without a rebuild, then I cannot set breakpoints. The breakpoint will turn white with red outline and show an error about out of sync binaries.

David Freitag

@Adnan Try caching your symbols

Adnan

@DavidFreitag Explain more, please.

David Freitag

6:24 PM

Tools -> Debugging -> Symbols Click the "..." button and add a new folder. I use ./Documents/VS2012/SymbolCache

Then while debugging hit "Load all symbols"

You only need to do that once, but basically it caches the symbols for the project currently running in the debugger

Adnan

@DavidFreitag But but but but I want it to be like before :(

David Freitag

Oh and make sure "Microsoft Symbol Servers" is unchecked

@Adnan What do you mean?

Adnan

@DavidFreitag It used to work normally without playing with the debug settings. Same project. Same VS installation. Same machine

Suddenly, it started going insane.

David Freitag

@Adnan try clearing your temp directories with CCleaner or the like.

Adnan

Already tried. I also reinstalled VS2012

David Freitag

6:27 PM

How many projects are being loaded by the solution?

Adnan

@DavidFreitag About 12. The same number since I started working on it.

It works perfectly for the whole team (about 20 people). I'm the only one who has this issue.

David Freitag

@Adnan Try renaming those registry entries. You will have to reset your theme and any windows/toolbars you had setup. If it doesn't work you can always try restoring the old entries

Adnan

@DavidFreitag I'll give it a shot.

David Freitag

@Adnan Also try clearing your temp with either Disk Cleanup or CCleaner with a reboot

There are a bunch of weird errors where VS chokes on either something in the massive temporary library it creates or something that got misconfigured in those two keys

Jeff Ferland

@Adnan Then there's how badly some people flag things.

One ugly numbers game

Adnan

6:32 PM

yesterday, by Adnan

and then and then and then one big page makes a post asking its member to mass-report another page. One hour.. the other page is gone.

Which completely sucks.

One dude who has an almost-porn page has about 50k likes told his subscribers to flag my 500-like page.

It was immediately deleted

I had to go through hell to get it back.

and then, it was deleted as soon as it got back.

I gave up and removed it.

Jeff Ferland

7:15 PM

@Adnan I'll check with the integrity team on that. You remember anything about the page so I can identify it?

tylerl

8:02 PM

Melissa: Hey Tyler, we just got some disturbing news from a client regarding a possible security hole. can i forward you her note to get your opinion?
me: does it say "heartbleed" anywhere in the note?
Melissa: yes. I believe so.

Jacob

@tylerl It's bad?

tylerl

@Jacob openssl bug. all the major distros pushed out a fix last night, though.

Jacob

@tylerl Oh I know, I've been awake the entire time working on it. I was guessing your opinion.

tylerl

@Jacob information disclosure. Bad enough to fix. Could be weaponized by someone with enough skill.

Rory Alsop

Almost makes one glad to be a corporate that doesn't generally like open source...

almost

0

Q: On topic or not? Heartbleed - List of vulnerable websites

I am seeing reports on Twitter and elsewhere that folks have confirmed they can see random usernames and passwords as they "attack" various high-profile websites including Yahoo and LastPass. This is a forum for information security professionals, and as such, I think it would be helpful to have...

discussion

I'm thinking no - but happy to have others weigh in

Jacob

8:10 PM

@RoryAlsop Doesn't seem useful.

Xander

@RoryAlsop I think definitely no.

tylerl

@RoryAlsop yeah..no. It'e easy enough to check for yourself for any given site.

Rory Alsop

exactly

thanks - I am trying to avoid being the big bad moderator :-)

On the other hand, how could anyone raise an 'offensive' flag on Tom's post:

23

A: Why did Java (JRE) vulnerabilities peak in 2012-2013?

I think this is a "trend effect" which is also the drive under everything about fashion (in the "clothing" sense). Please allow the local Frenchman to talk about fashion. Fashion is a deeply self-contradictory social behaviour. People who follow fashions seek both: to gain acceptance in a give...

and another bear question. @ThomasPornin - this has been flagged as better over on Crypto. What do you reckon?:

1

Q: Is there an equation to calculate the number of instances of a series of characters exist in a given key space?

If I'm using 16-18 character-length passwords with 94 different possible values-per-character (lower alphas, upper alphas, numbers, and special characters), is there an equation I can use to calculate how many times a series of the same value will be presented? What I'm trying to find out is w...

passwords brute-force password-policy

Rоry McCune

@RoryAlsop apart from all the "appliances" supplied by propietary vendors which inevtiably use openSSL or similar :)

The only likely saving grace is that I'll bet that most aren't modern enough for openssl1.0.1 to be a problem ...

Rory Alsop

8:27 PM

Heh. Appliances.

And I did say 'generally'

AviD

8:45 PM

@JeffFerland just in general.

So, I spent a vacation day in bouncy town. And no, that is not a euphemism.

tylerl

9:00 PM

offered $2000 to get a web service written by the end of the day.

Challenge Accepted

Stack Exchange

Blog - Stack Exchange: Changes and guidelines for the Protected Question status

Shog9 on April 08, 2014

Protected status is an often-overlooked feature of Stack Exchange. It’s based loosely on Wikipedia’s semi-protection, and like that tool is meant to be a reaction to persistent abuse from anonymous or unproven participants: when a page attracts a lot of noise or vandalism from outside the community, Protecting it reduces the amount of clean-up needed later on.

Protected questions are not answerable by folks who haven’t earned at least 10 reputation from activity on the site where the question resides. This effectively means you need to have posted an answer somewhere else that’s attracted an up-vote or a question that’s earned two. …

FEichinger

@StackExchange ... sigh Oh, look, actually no new changes that mess up half the sites' workflow!

Thomas Pornin

@RoryAlsop Well, that's pretty basic enumeration. Not really worth it on crypto. The general case formula is interesting for mathematics, but not for security or crypto once you have ascertained that the space reduction will be negligible.

@RoryAlsop Well, I can understand that an asocial fashion-victim geek may take offence at being called an asocial fashion-victim geek.

Lekensteyn

9:15 PM

WOW

I just found out that my efforts on abusing the OpenSSL bug on clients were too much

Xander

@ThomasPornin But that's a personal problem, not a valid complaint.

Lekensteyn

Just sending the unencrypted heartbeat right after the serverhello works too.

Anonymous

well

Anonymous

Windows XP is gone for good :D

Rory Alsop

@Xander - yeah, I declined the flag

Thomas Pornin

9:21 PM

@PatoSáinz Oh, no, not at all !

Anonymous

@ThomasPornin remaining systems will be 0day'd to death

Thomas Pornin

Windows XP is not gone. It just became a walking corpse.

Rory Alsop

@thomas OK, I'll leave it

Thomas Pornin

Besides, the UK government paid Microsoft to get one extra year worth of security updates.

So these security updates will exist.

It may become somewhat difficult for Microsoft to give the security fixes only to big paying customers.

Anonymous

I don't see the corps that are dumb enough to sitll be using XP to also torrent the NL/DE/UKGov fixes

Xander

9:24 PM

@ThomasPornin Seriously? Ok, I know large organizations (and especially governments) move slowly, but Windows 7 has been out for 5 YEARS!!!

Thomas Pornin

@PatoSáinz No, but they will have leverage over Microsoft.

Once the fixes exist, it costs exactly zero to give them away to everybody.

Rory Alsop

@Xander - I know a few organisations still running NT

As well as old tandem and VAX systems, Xenix etc

Xander

@RoryAlsop NT Workstation? Server I can see, but XP was a desktop operating system.

Rory Alsop

In fact I know of one with vista

Not the one I currently work at, thankfully

Replacing 100,000 desktops or more is not easy

And that's excluding a variety of different patching schemes

Xander

@RoryAlsop Yes, this I do understand. But still, Vista has been out for nearly 8 years now, and Windows 7 for 5. How many of those 100,000 desktops are approaching 8 years old? I realize that transitioning OSes takes years for large organizations. But if they haven't switched off of XP by now, it isn't just because it's hard.

Thomas Pornin

9:31 PM

@Xander Where I work, they switched to XP two months ago.

AviD

@Xander it's because them damn neckbeards don't like having extra work, and also because they like having something to complain about.

Thomas Pornin

An important point is that, contrary to home users, big corporations rarely keep the OS that comes with the hardware.

Xander

@AviD Yes. This.

Thomas Pornin

They buy the hardware, then install their "standard OS and configuration".

AviD

@ThomasPornin Last month I was in a meeting with a very large bank, about their ATMs. And how being on XP SP2 is such a vulnerability.

Xander

9:32 PM

@ThomasPornin Yes, they rip apart the OS installers and the app installers and they build custom images. They have people whose jobs it is to do this all day long. I've worked with them before.

Rоry McCune

michael-p-davis.com/…

AviD

Their response? "Yes, you convinced us! You're right, we will upgrade to XP SP3 right away!".

headdesk

Rоry McCune

just in case people needed explicit instructions on how to attack things with heartbleed..

Thomas Pornin

A big part of being a big organization is to always build your own problems from scratch.

2

Rоry McCune

@AviD XP Embedded or normal?

AviD

9:33 PM

@RоryMcCune normal, why would they consider embedded?

Rоry McCune

@AviD for ATMs? Lower attack surface, is still in support till 2016 :)

Xander

@RоryMcCune Thanks! Been meaning to look for some such thing.

AviD

Bigger problem is that their ATMs are sourced from a very large and common provider (internationally). Which means many many more banks around the world have the same stupid issue.

@RоryMcCune no, I mean of course that makes sense, but so why would they bother?

Xander

@ThomasPornin Did I read that correctly? Did you switch to XP for your desktop OS two months ago?

Rоry McCune

@AviD Yeah the ATM network will be totally airgapped from anything that could attack them...

Thomas Pornin

9:35 PM

@Xander Ah no, sorry. They switched from XP to Windows 7.

Rоry McCune

not like marketing guys need access to upload adverts to the ATM fleet...

AviD

@Xander haha, my mouth was agape from that.

Thomas Pornin

And this allowed a stupendous upgrade to a brand new Web browser: IE 9 !

Xander

@ThomasPornin Ah, ok. And this is not unusual. My wife's 3000 seat company is the same way. They're in the process of switching now. But not because it wasn't possible to switch before...Because they're incompetent.

@ThomasPornin Uhh...Yay? :-)

Thomas Pornin

@Xander Well, 2 years ago I had IE 7, and Gmail was bugging me with how outdated it was.

Some time last year I got IE 8, and Gmail was still complaining.

Now I just got IE 9, and Gmail still won't shut up.

I expect that when I am upgraded to IE 10 in the distant future, Gmail still won't be happy.

Xander

9:38 PM

@ThomasPornin LOL. You can't win.

AviD

@ThomasPornin umm... Gmail says that about any version. It's a cross-sell, irrelevant of updatedness.

tylerl

@ThomasPornin Is it because you're consistently 3 to 5 years behind?

Xander

@RoryAlsop When I was in consulting one of the last customers I visited (in August of 2012) was a 100,000-120,000 seat company who had managed to upgrade to Windows 7, even then. So it is at least possible.

Rory Alsop

@Xander - sure, but sometimes there are very good reasons why it is not a priority.

AviD

> Dont fix it if it aint broke

> "Better" don't pay the bills

Rory Alsop

9:46 PM

Ayup

AviD

oh - and dont forget: "We have this critical business application that depends on XP! We cannot change it at all!"

Of course, "critical business application" usually turns out to be Photoshop.

Thomas Pornin

@AviD I daily live with applications which indeed have trouble migrating from XP to 7.

In fact I am the unofficial "bug tracker": when people have a problem they don't understand, they come to see me.

I then run a Network Monitor, observe a couple of SSL handshake, and diagnose.

Because all problems in computers ultimately boil down to a SSL handshake.

3

In this case, the XP->7 transition tends to expose all the situations where applications were very poorly designed, and they got away with it on XP only through sheer luck.

Xander

@RoryAlsop I don't accept reality as an alternative to my opinion. :-P

4

@AviD In the case of my wife's company, it was custom Office automation applications that were designed specifically for XP and Office 2003.

tylerl

Of all my clients who have been hacked and sent out millions of spam messages, I have had no fewer than 70 this year who wanted to resolve the issue by changing their server IP (since obviously the old one was blocked).

AviD

10:11 PM

those of you who have watched the latest episode of GoT - no spoilers - just how gory is it? Want to know if eating while watching it is likely to be counterproductive.

and no spoilers!

TildalWave

@AviD just watching it, it's relatively OK till the middle that I managed to get through, but skip the "previously" part since it's more or less all the major killings in all the gruesome ways

AviD

hehe, yeah started watching that, and then it occurred to me...

TildalWave

there is some nudity tho

AviD

that's not contrary to eating

tylerl

@AviD I've tried three times to read the books. :(

TildalWave

10:15 PM

@AviD no, not if it's aesthetic nudity it isn't :)

AviD

everything except "bad naked" is okay.

TildalWave

it's pretty good nudity™

pcurry

Yes, the PGN software is relevant to my interests.

I've heard there are several good newsletters to which one might subscribe, which might discuss PGN in greater variety and detail, potentially with screenshots.

FEichinger

@Xander See, this is something I can't wrap my head around. Who on Earth designs software that is inherently not compatible with new iterations of an OS? (Aside from Microsoft messing up compatibility in all sorts of ways, but you still do need to make quite an effort to build something that won't ever work on Vista+)

I can get behind "This software isn't certified for these versions, so we can't use it, because insurance/etc." - sure, fine, happens. Should've been solved years ago, but I can see why that's a thing.

Compatibility issues with Windows? Not so much.

tylerl

B: Hey buddy, somebody told me my IP address is hacked. Can you check?
Me: IP addresses don't get hacked. Computers do.
B: OK, so we're fine then. Thanks!
Me: ....

TildalWave

10:22 PM

@tylerl ROFLMAO

you really seem to have a lot of funny customers :)

Gilles

heartbleed.com has a bad cert at the moment...

Xander

@FEichinger As an aside, whatever anyone may say, Microsoft is the king of compatibility blogs.msdn.com/b/oldnewthing/archive/2005/08/24/455557.aspx.

At least, backwards compatibility. Compatibility with competitors...Ehh, not so much.

FEichinger

@Xander Oh, in theory, sure. But in practice the average user won't work it out.

Gilles

better

FEichinger

They support a lot of backwards-compatibility. It's just not nearly as accessible as it should be.

Xander

10:27 PM

@FEichinger Actually, the average user does work it out well enough, which is why Microsoft has had a near monopoly on desktop OSes for the last couple of decades.

TildalWave

> CN = *.cloudfront.net
O = Amazon.com Inc.

FEichinger

@Xander Until Vista came along.

Lekensteyn

So far, it seems that clients are not really vulnerable as servers: github.com/Lekensteyn/pacemaker

Rory Alsop

@AviD Just watched Hanna - awesome film. Check it out if you haven't already.

Gilles

@Lekensteyn did you try with application protocols other than HTTP?

Xander

10:30 PM

@FEichinger No, period. Including and since Vista.

Lekensteyn

@Gilles No, I didn't, I'll try now

Xander

@RoryAlsop Yeah, that's great fun. Very good movie.

FEichinger

@Xander Vista has obscured compatibility options and introduced an awful lot of problems that required all sorts of workarounds. Sure, Microsoft hit a lucky spot because it was the one time direct compatibility to such an extent wasn't all that relevant, but it's biting everyone in the arse right now.

Your average software works, sure. But even among the things that weren't designed specifically for XP, there's a lot of stuff that just doesn't work with Vista, or needs X steps of workarounds first.

Xander

@FEichinger Ah, yes, I see what you are saying, and yes, compatibility is not as good as it has been in the past. That is true. I misunderstood.

Lekensteyn

@Gilles openssl s_client has the same issue, I have not tried with other applications. The application protocol should not matter as it terminates right after the ServerHello. Maybe it acts differently with long running applications (daemons, mail clients if any uses openssl)?

Gilles

10:36 PM

@Lekensteyn if the application establishes multiple SSL connections, I'd expect to see more interesting dumps

e.g. a mail client, but you typically wouldn't connect to an untrusted site in the same process

AviD

@RoryAlsop wots that?

ah yeah, actually heard about it recently.

Rory Alsop

@AviD imdb.com/title/tt0993842

Eric Bana plays you in it...

AviD

haha, me??

lemme guess, he lives in a bunker....

Rory Alsop

@AviD I could see him being you - kind of superb assassin type raising children with awesome martial arts skills

and bunker - yeah, kind of

AviD

I guess I could do worse than Eric Bana, for the casting as me in the movie of my life.

back when I had hair, I was told I looked like Keanu Reeves. I've learned to be more expressive since then.

Rory Alsop

10:43 PM

Dunno if your kids look like Soirse Ronan

imdb.com/name/nm1519680/?ref_=tt_cl_t1

AviD

hehe nope

not blondes

okay, you convinced me, I will watch that.

Rory Alsop

@AviD imdb.com/video/imdb/vi3969948441

check out the trailer

AviD

willdo

Rory Alsop

TRight - I really should get to bed. The mojitos have been drunk, the film has ended, and I have a music convention to go to all day tomorrow :-)
Night all

Transcript for