The DMZ

Simon

01:12

MRW when no one cares when Logic crashes: :(

David Freitag

@Simon I too hate it when my logic analyzer software crashes. Although I have to admit it still has yet to crash but when it does I'll be sad.

Simon

Just do the pls dance if that happens.

David Freitag

I can't stop smiling every time I look at that cat

It's so damn cute

David Freitag

01:48

Teamviewer has bidirectional clipboards YAAAAAAAAAASSS

Thomas Pornin

@Simon I heard about it being the most interesting moment of the whole debate, which says a lot.

Simon

@ThomasPornin It was playing in the background again but yes, I gotta say that it didn't catch my attention much.

David Freitag

Headhunterz - Dragonborn (Official Videoclip)

►

cc: @Simon

Simon

pls dovid

chat.stackexchange.com/…

David Freitag

02:03

@Simon I didn't send it to you thinking you'd never heard it.

Simon

o

David Freitag

It's in the mix I'm listening to and I thought I'd share.

Thomas Pornin

@Simon Oh my, the polls are now predicting that the Bloc could obtain one seat !

Simon

@ThomasPornin I bet even Duceppe doesn't believe it.

Thomas Pornin

@Simon Apparently some guy called Louis Plamondon is leading in a district south of Trois-Rivières.

But hey, that's just polls, and polls are known to be chronically inaccurate.

Simon

02:08

@ThomasPornin Really? I would have expected it to be somewhere much more up North.

@DavidFreitag But yes dovid, good track.

David Freitag

@Simon Hermhardstyleione ftw... youtube.com/watch?v=jMLrTiGnuw8&ab_channel=Hermione

David Freitag

02:45

David Freitag

05:48

23

A: Create output twice the length of the code

Shakespeare, 768 Yeah, Shakespeare's not much of a golfing language. Outputs 1,536 spaces. Rosencrantz and Guildenstern: A Series of Tedious Events. Rosencrantz, a count of extraordinary determination. Guildenstern, a spacy character. Act I: The Long Conversation Scene I: A Tortured Friendsh...

@ThomasPornin Should write a TLS implementation in Shakespeare.

M'vy

06:50

Morning!

Rоry McCune

07:32

mornin

@Simon done :)

@kalina so you would care if @Simon found you attractive or not?

M'vy

07:48

@RоryMcCune waaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaat?

Did I missed something :))

kalina

I'm not answering any questions

the general public doesn't need to know what I think, I'm just some kind of dance artist.

since when is that a valid qualification for discussing anything serious

M'vy

hehe. Fair enough :)

Stephane

'morning

kalina

08:14

now look what you did

you killed chat with your mornings

I hope you're all happy at how much destruction you caused

M'vy

hum

Rоry McCune

@M'vy it's this weird soap opera style love triangle between @kalina @Simon and @Iszi

it's all very odd

kalina

I think you all underestimate the satisfaction I would get from your suffering

Rоry McCune

@kalina :D

M'vy

Ohhh @Iszi is part of that now ?

I've been out of internet for 1 work day and look what you've all done!

Rоry McCune

08:22

@M'vy yeah I didn't know this it went back a while but apparently @Simon is the lovechild of @kalina and @Iszi and has an oedipus complex about the whole thing

M'vy

Wow. We probably should hire a transcript curator.

Rоry McCune

@M'vy and/or someone to pitch it to Daytime TV companies as a soap opera

M'vy

"Next time on the DMZ..."

kalina

08:37

@RоryMcCune I think this is more wishful thinking on the part of the boys

Rоry McCune

I'd say it was unlikely that @Simon would want something like that but then.. it is @Simon

kalina

08:54

yeah there's no way to continue this conversation without the massive potential of weirding me out

Rоry McCune

@kalina it is a weird direction for conversation to be sure.

Colin Cassidy

morning all, I see that Securi-tay has grown into a two day conference now...

Rоry McCune

Instead lets talk about the weather

and Securi-Tay!

@ColinCassidy I saw that, is it Friday/Saturday now?

M'vy

@RоryMcCune wouldn't that be on-topic?

Rоry McCune

@M'vy well kind of

Colin Cassidy

08:56

@RоryMcCune Looks like it, awaiting CFP, I might push a version of switches get stitches

Rоry McCune

@ColinCassidy ohh cool, that'd be good to see

@ColinCassidy so are you over in Spain for your hardware lab opening that I saw on twitter

Colin Cassidy

@RоryMcCune with more emphasis on what we did/how to start rather than results

kalina

oh guys, there has been another shooting in an American school

Rоry McCune

@ColinCassidy yeah that'd be an interesting talk for potential researchers like the Abertay crew

Colin Cassidy

@RоryMcCune No I'm working in Germany, no such luxuries for me, but by all means head over yourself. I hear the weathers nice :)

kalina

08:57

this must also be down to video games rather than easy access to guns

Rоry McCune

@ColinCassidy heh, not really my field, I just thought it was a nice location for a lab..

@ColinCassidy I'm thinking I'll submit a talk on Docker, as I've been looking at it a bit this year

Colin Cassidy

@RоryMcCune yeah our EU hardware guys are spanish, so it makes sense to locate the lab there, plus it's much cheaper to buy an office there

M'vy

@kalina I'm pretty sure I can get that line from TV news tonight

kalina

oh, 11 year old boy shoots 8 year old girl over a puppy

that must also be because of grand theft auto

obviously ignoring the fact GTA is rated 18 and thus the parents are negligent

because that would be inconvenient and detract from the point

M'vy

@kalina seriously ? Eeeeek...

kalina

09:06

now I've played GTA

Colin Cassidy

@RоryMcCune found anything interesting with Docker, or will I have to wait for your talk?

kalina

but I've never stabbed anybody, shot anybody, run anybody down in the street, shouted abuse to people, etc

oh actually

I've done most of those things

never shot anybody

hah, safe harbor has been ruled invalid

teaches Facebook and Google right for not doing what the EU wanted

now their entire businesses are illegal unless they host in the EU

Colin Cassidy

@kalina and slaps the wrists of NSA/GCHQ

kalina

@ColinCassidy and provides backup for Microsoft in their court case

Colin Cassidy

@kalina indeed, it'll be interesting to see if the US courts take a different approach as a result of this, or just carry on regardless

kalina

09:13

it's all a facade anyway, to convince the public that the governments of the world even acknowledge their existence

M'vy

Ah ah. I'm beginning to really like jQuery for userscripts purposes. :))

kalina

ew

Rоry McCune

@ColinCassidy nah it's wouldn't likely be a research/vuln talk, more a What the heck is docker and it's security implications and likely pitfalls, with some bit on how it can be used in security as well

kalina

I think murderers should be tortured to death, I think that's a fitting punishment for taking somebody else's life

M'vy

@kalina I would make them parse HTML with regexp, but they probably won't get the concept of torture behind this.

kalina

09:19

oh I was thinking nailing screws through fleshy appendages and then heating them up

but you could parse html with regex if you want

or electrifying them

but then I believe that if you violate somebody is a way that cannot be revoked (murder, rape) that you lose all of your rights and cease being protected under human rights

M'vy

That's arguable

kalina

I'd like to see you argue against it without bursting into flames

since I would view disagreeing as either indifference or accepting it as acceptable

in fact

indifference is the same as accepting, since you don't care enough to do anything about it

summer time appears to have gained a second wind

what with it being 26 degrees here today for no obvious reason

CodesInChaos

Murdering murderers sounds like a great plan.

kalina

@CodesInChaos I agree, or storing them in a dark hole until they die of starvation

CodesInChaos

Do that recursively and you'll quickly approach world peace.

M'vy

09:27

@kalina Perspectives

kalina

@CodesInChaos oh you're being sarcastic

M'vy

And going one way or the other has big consequences and shape different future as well.

kalina

I need to eject from the conversation before I made a wildly generic statement and insult everybody in here

disk 1 of 2079

M'vy

:))

Rоry McCune

@kalina hey look, someone 3D printed the save icon!

kalina

09:36

pls, I've seen a floppy disk before

...on wikipedia

M'vy

@kalina I feel a bit frustrated to have been given matter to think and then denied discussion. But I guess it's for the best.

kalina

@M'vy I'm not denying you the possibility to continue discussing, I am avoiding pushing my very strong and completely immutable opinion on the matter out onto you guys

M'vy

@kalina yeah well. I won't debate alone though :)) I can do that with my notebooks.

But it's ok. Debating on the internet is probably wrong anyway

kalina

especially when it's briefly infused super hatred caused by reading the news

it's hard being a creature of fire, when you get angry it's always your own stuff that burns first

M'vy

@kalina yeah, well... I can't afford to get angry, or I have already lost the debate.

kalina

09:49

I can't wait for World War 3

Arperum

@kalina Reading the news is the worst.

kalina

definitely

surface 4 announcement today apparently

Rоry McCune

@kalina and apparently some HoloLens News!

I really would like to see the HoloLens work like it does in their promo videos

but I have a feeling it'll be a while before the tech matches the promise

@M'vy remember " anger is a weapon only to one's opponent."

kalina

10:06

today I am calming myself down in the midst of my most recent news reading by attempting to create super cinematic soundtrack style music

Arperum

kalina

by re-creating the theme tune to Back to the Future

M'vy

@kalina yeah :)

kalina

or maybe Stargate SG1

or a bastardized hybrid of the two

Back to the Stargate

M'vy

@kalina or Star to the Future

kalina

10:15

so much potential

might just make some electro and call it 1.21 gigawatts

Rоry McCune

Lets Push Things Forward - The Streets

►

kalina

so when I built this pc I did something I don't usually do and connected up the HDD light

now I have this light on my case that flashes 24/7

M'vy

11:03

Hum. I went for lunch and not a single line in here?

RoraΖ

11:25

the DMZ has lines?

Simon

@RоryMcCune Cheers.

5 of those 6 chat notifications are not addressed to me.

lulz

M'vy

What did you expect?

Simon

Yeah you're right.

I LIED IT WAS 4 OUT OF 6 I'M SO SORRY

M'vy

Does it change anything?

Simon

Only the fact that I'm a filthy liar.

M'vy

11:36

What was the previous status again?

:)

Simon

#yolo lord

RoraΖ

12:00

I wish we could provide a reason for re-opening a question.

M'vy

Which question?

Oh you mean, you want a "reopen reason list" like the close votes?

Simon

@ThomasPornin What's the technique to generate MD5 collisions, do you append a specific set of characters to a file and compute it until you get it or is it just a bunch of random characters?

Oh and if anybody knows this, feel free to answer.

kalina

look at @Simon suddenly wanting to become leet

Simon

pls, leet is so 2005.

kalina

oh, it's no longer 2005?

silly me

all your 2005 are belong to me

RoraΖ

12:14

@M'vy Yeah sometimes it'd be nice to throw out why I'd like to reopen a question. Rather than hoping that other people figure it out.

Thomas Pornin

12:25

@Simon The normal technique only impacts two blocks. MD5 processes data by blocks of 512 bits (64 bytes).

What you need is to make two files that are identical except for these two blocks

You need to be able to put arbitrary bytes in these two blocks, but you can choose which two blocks you will play with (the two blocks must be successive).

Then it is up to you to leverage the difference in the block bits into the behavioural alteration that you seek.

E.g. a PDF file that displays two distinct pages based on the bits in these two blocks.

TildalWave

or a torrent file that corrupts all subsequent downloads (but succeeds at file integrity check)

Thomas Pornin

If that's your thing.

TildalWave

not my thing but I've been asked before about the possibility of it

Thomas Pornin

I don't know enough of the internals of bittorrent to know how much damage a MD5 collision can make. The point is that making a collision is easy.

What is substantially harder is making a collision with two files of distinct lengths.

Simon

@ThomasPornin Ok makes sense, thanks.

Quite less straight-forward than I expected.

TildalWave

12:33

with, say, movie torrents you only need to corrupt a single block, usually the one containing file header info ... it could still be reconstructed but most downloaders won't have a clue how to do that

Simon

But this is only going to corrupt the download, right?

TildalWave

right, but that's sometimes the point

Simon

The point of this is only to spread corruption to ruin the file, right?

M'vy

Low quality queue: why can't I just downvote ?

TildalWave

setup a couple of strong peers that share corrupt blocks of a torrent file and anyone that downloads those blocks from you will have huge problems playing it ... there's some tricks within the way that torrents queue transfers that you could abuse in custom written clients to make sure that's more than just randomly successful

Thomas Pornin

12:38

@TildalWave You may run here in some difficulties because you are actually talking of second preimages

I.e. you notice an existing file for download (that you did not choose), and you want to produce another file with the same MD5

We do not know how to compute second-preimages for MD5.

TildalWave

well besides brute-force

Simon

Also, if the goal is to modify a file (e.g. PDF like you said earlier), the hard part must be to insert bytes and not corrupt the file I assume?

kalina

13:01

looks at chat

leaves again

Simon

babai

Thomas Pornin

@Simon PDF is a format "with holes". It is full of cross-references and it is easy to embed bytes that are mostly ignored.

Simon

@ThomasPornin I see so it is very dependent on the actual file interpreter.

I feel like I should experiment this on a boring Saturday night.

Terry Chia

13:23

@ThomasPornin Which is why you can do things like make a PDF that's also a JPEG image as well as a ZIP file containing other PDFs.

Simon

lulz

Terry Chia

The concept is very nicely described in a few POC || GTFO issues.

Sebastian Nagel

hey guys . can s1 help me out with this question ?

Q : I have a Eliptic Curve with the the equation y^2 mod P = x^3 + ax + b mod P
where P = 263 . The max. Order of my Group Elements ( equal to the points on the curve) is 124. What kind of conclusion can I make with this kind of information?

My first thought was that the group formed by the EC isn't cyclic .

Thanks in advance :-)

Simon

The first obvious conclusion is that whoever made this question up is a nurd.

I cannot help you further, unfortunately.

RoraΖ

@SebastianNagel Unfortunately I'm not too up on my number theory and linear algebra

Sebastian Nagel

13:30

Think it's a pretty rookie question

@Simon

anyway no worries :-)

Simon

@SebastianNagel It just concluded my second theory: you're a nurd too.

RoraΖ

@SebastianNagel Maybe for Mathematicians, but I like playing with EM fields more than Groups

Sebastian Nagel

@Simon My Profile Picture isn't a robot

M'vy

What should we be looking for? mathematical property? cryptographic implication?

Sebastian Nagel

@RoraΖ yessss

cryptographic implication

@M'vy I'm wondering about the context between the order of an element from an elliptic curve and the cryptographics implication

@Simon didnt want to be rude btw ;-)

kalina

13:39

"Named not after actual fictitious Smurfs, like Papa Smurf, Vanity or Smurfette - but after made-up fictitious Smurfs."

Simon

@SebastianNagel Oh son, if only you knew the kind of stuff that was said about me in here.

kalina

@SebastianNagel sometimes they're so crude in here that even I blush

(without the need for blusher)

Simon

13:52

4

Q: ROT47 Implementation

ROT13 ("rotate by 13 places", sometimes hyphenated ROT-13) is a simple letter substitution cipher that replaces a letter with the letter 13 letters after it in the alphabet. ROT13 is a special case of the Caesar cipher, developed in ancient Rome. ROT47 is a derivative of ROT13 which, in a...

ROTFORTY-SEVEN?!?!?

kalina

@Simon numbers and common symbols silly

Simon

@kalina I know, it makes it ROT13 so much better!

I will use this as my main hashing algorithm!

Rory Alsop

Afternoon all

Simon

Morning you donut.

Rory Alsop

Discovered weregeek today. And was wondering if Alina was a nom de plume @kalina

weregeek.com/2007/04/06

Simon

13:58

"nom de plume"?

Stop stealing our language you silly English-speaking donuts.

Rory Alsop

And Yankee Rose in the car while I wait for my physio appointment. This afternoon is good

@Simon - that's Roundellos

:-)

Simon

@RoryAlsop Lovely, any specific body part getting treated?

2

@RoryAlsop @@@

Physio would be good for my back every now and then.

Iszi

@RoryAlsop Damn. Mis-read that as "psycho appointment". That would have explained so much.

Rory Alsop

Hahaha - appointment with a psycho, @Iszi?

Lower back, @Simon

Simon

@RoryAlsop Neat, I'm jelly.

RoraΖ

14:04

@kalina Tell that to base64

@Simon I just go to the gym so that my muscle's don't get weak. Then I won't accidentally stress something and require physio

Simon

@RoraΖ Definitely should be doing that.

Also considering that I'm paying for a gym subscription monthly, I really should be doing it.

me_irl: "IMA GO TO DA GYM"

Never went.

RoraΖ

Generally when i'm paying for something I like to you know... use it.

Simon

Generally, me too

RoraΖ

Kinda like @Simon's mom

Simon

o ffs

RoraΖ

14:08

hahaha

Simon

I'm glad that you didn't say that before I said my line.

That would have been reaaaally bad.

RoraΖ

@Simon But yeah, there was an entire year that I didn't go to the gym but was paying for it. Both physically and financially.

@Simon s/bad/hilarious

Simon

@RoraΖ I've started to do push-ups/sit-ups at home at least.

Iszi

Anyone else watching the Microsoft event?

Simon

soz I don't watch malware-spreading events.

Iszi

14:12

(Well, I'm not watching the actual event - stream isn't loading - but I'm keeping an eye on Verge's live blog.)

RoraΖ

0

Q: What does a switch dop against a packet sniffing attack?

I have heard that using switches in my network helps prevent against a packet sniffing attack but how does it help prevent the attack? My email is [email protected]. Please answer me there because I can't keep this page open.

encryption

hahahaha

shadessmithcyberpatriot

More like shadeymcshaderson

Simon

For fucks sake.

I'm editing it out, hang on.

Iszi

Holy crap. Apparently Microsoft still believes in Silverlight - event streaming requires Flash or Silverlight.

RoraΖ

@Iszi Both terrible technologies

Simon

@Iszi Ouch.

OOh, look, am I crazy or it repeats "the attack?" twice in there?

security.stackexchange.com/posts/102026/revisions

Oh nevermind, it was my resolution hiding the new text.

Nevermind#2, it was me being a dumb bitch.

Rоry McCune

14:25

@TerryChia @JourneymanGeek infosecurity-magazine.com/news/uks-crest-exports-pen-testing/… <-- might be of interest .

Simon

Roro, I saw you star my message.

Rоry McCune

@Iszi I'm watching the engadget live stream

Terry Chia

@RоryMcCune Saw.

Rоry McCune

$3k for the hololens devkit

Terry Chia

IIRC there's also that thing about converting OSCP to the CREST cert?

Rоry McCune

14:26

I can hear my bank balance drain from here when Marion gets a chance to get one

Iszi

@RоryMcCune Microsoft's stream seems smooth enough, though a little behind the live blog I was watching. microsoft.com/october2015event/en-us/live-event

Rоry McCune

@TerryChia yeah I think it's not a full conversion (there's still some test to take) but it bypasses the practical..

Thomas Pornin

@SebastianNagel EC is a cyclic group. However, the generator you chose does not generate the complete curve, only a subgroup thereof.

Terry Chia

@RоryMcCune My first step will be probably taking OSCP after I'm done with army and all that.

Rоry McCune

@TerryChia sounds like a plan.. how much longer you got to go?

Iszi

14:28

@RоryMcCune Is it just me, or is it a bit odd that she's wearing a Band and a watch?

Terry Chia

@RоryMcCune 1 yr 1 month.

Thomas Pornin

@SebastianNagel A curve in a field of size q (here q = 263) contains q + 1 - t points, where t is no more than the square root of q.

Rоry McCune

@Iszi heh, mistake there...

Iszi

Argh. She uses the short "a" for the middle of "data". Ew.

Rоry McCune

@TerryChia so out for Xmas 2016..

Terry Chia

14:28

@RоryMcCune Aye.

Thomas Pornin

So here your curve must have between 264-34 and 264+34 points.

Simon

@TerryChia Are you a better soldier yet?

Thomas Pornin

There cannot be only 124 points.

Terry Chia

Interesting thing is I may have a job offer so that may keep me occupied.

Thomas Pornin

The number of points is a multiple of 124 that falls between 230 and 296, so the curve necessarily has order 248.

That's the answer expected by your instructor.

For bonus points, enumerate all combinations of values 'a' and 'b', count the points for each such curve, and list all curves that indeed have exactly 248 points. This is a nice programming exercise.

M'vy

14:31

And this is how I know that I know nothing about EC

Simon

^

Thomas Pornin

Even without whipping out the big guns (Schoof's algorithm...) that would be a matter of a few dozens of millions of operations to enumerate all curves and count all points, so that's highly doable within a few seconds of computation (or minutes if you use a slow language).

Mmh, minor fix: an elliptic curve is not necessarily cyclic. However, chances are that this one is.

Simon

@ThomasPornin I was hesitating to say that, I didn't want to humiliate you, you know.

coughs

Rоry McCune

@TerryChia cool!

aaand the missus has already decided she wants to save up for a HoloLens Dev kit

Iszi

@RоryMcCune The devices guy is doing the same thing - Band + watch. Is that the new thing?

Rоry McCune

14:41

@Iszi weird, well the band one battery life was/is pretty bad

so I guess that might be why

although you think they'd lose the watch

of course unless it's an unannounced MS SmartWatch project...

Simon

What's the name of the band?

Is it a MS one?

Iszi

@RоryMcCune No, I'm pretty sure these are your regular non-smart watches.

Rоry McCune

@Simon the Band is the MS Band

Simon

AH I didn't even know they announced this.

Clean design.

Iszi

Only 32 GB on-board? Seems a bit lame. Good thing they're expandable.

Switching to USB-C? Ugh. Guess it had to happen sometime. Guess it's time to put away MicroUSB.

WTF is up with liquid cooling in tablets and phones anyway? When did that start happening?

Simon

14:45

Sounds like a recipe for disaster.

I didn't think you'd want to liquid cool something portable.

kalina

@RoraΖ tell what to what?

what the what

wat

@base64 @RoraΖ thinks you should know that @Simon is silly

???

Simon

pls, @base64 didn't have to know this.

kalina

@RoraΖ insisted

I don't get it either

Iszi

Don't like the guy demoing Continuum - comes off as a car salesman.

Or one of those "as seen on TV" guys.

kalina

rip continuum :(

Iszi

14:50

Like Microsoft resurrected Billie Mays or something.

kalina

who?

Simon

IS IT VINCE FROM SLAP CHOP?

kalina

Terry Tibbs obv

Iszi

Billy Mays

William Darrell "Billy" Mays, Jr. (July 20, 1958 – June 28, 2009) was an American television direct-response advertisement salesperson most notable for promoting OxiClean, Orange Glo, Kaboom, and other cleaning, home-based, and maintenance products on the Home Shopping Network, and through his company, Mays Promotions, Inc. He and his business partner, Anthony Sullivan, were also featured on PitchMen, a TV series that documented their work. His distinctive beard and impassioned sales pitches made him a recognized television presence in the United States and Canada. == Early lifeEdit == Mays was...

Holy crap - six years since he died already?! #FeelingOld

Simon

#metoo

kalina

14:52

1 min ago, by Iszi

Like Microsoft resurrected Billie Mays or something.

"resurrected"

Simon

???

kalina

"resurrected"

Iszi

@kalina Yes. I was aware he was dead - didn't realize it had been so long.

kalina

right #learningToRead

Simon

He said "already".

kalina

14:53

the effect of being rekt only works if you haven't just been inb4'd

Simon

I WANTED TO PITCH IN ANYWAY

kalina

if you've just been inb4'd all of the rekt is diverted to you

Simon

No it isn't.

kalina

so... rekt

yes it is

Simon

That's not how the law of rekt works at all.

kalina

14:54

well you can keep your own laws of rekt and in kalina's bubblegum land we'll use my rules

and since I live in my own land your rules are irrelevant

Simon

That sounds like a sucky land.

kalina

pls everything tastes like bubblegum

Simon

That must be annoying after a week.

kalina

everything is bouncy, there's no such thing as miserable walking

Simon

Everything is Tigger ovid?

kalina

14:55

everything, but without the tigger or the avid

Simon

o

kalina

which makes it 10x better

Simon

I keep getting déjà vus today, ffs.

kalina

well stop taking flash then

Transcript for