« first day (1558 days earlier)      last day (3314 days later) » 

1:06 AM
@TerryChia yes yes, you are the very model of a modern major hipster.
 
jrg
2:03 AM
@TerryChia I have to agree with @AviD
 
 
2 hours later…
4:06 AM
 
Adi
4:48 AM
A very interesting question
1
Q: Is Clickjacking a real security vulnerability?

NathanAs I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over the HTML elements of my site. Send out phishing emails to get users to click on the link that goe...

Once I started writing the answer, I couldn't really stop. There's too much to cover
 
 
2 hours later…
Adi
6:39 AM
@jrg Yaaay! I'm in that pic as well!
I'm now famous!!
Waait, is InfoSec TS @Terry's twitter sockpuppet?
 
6:56 AM
@Adi Does that mean I'm @Flyk?
sets @Adi on fire
 
 
1 hour later…
Adi
8:18 AM
@TerryChia Don't talk to me! I'm famous now!
 
8:32 AM
heya
 
morning, famous folks!
 
Morning All
 
8:49 AM
@Adi hardly a wall of text, is it
 
8:59 AM
@Flyk that's it - putting him down about his length ;-)
poor lad
 
9:13 AM
here's a question for the room. If you run this command ' ping 193.239.211.036' what address will you ping?
 
my guess would be 193.239.211.036 - but we get no command line here so can't test
Or am I just being dim
ooh - from my phone I get a final octet of 030
interesting
why does that happen?
 
@RoryAlsop it goes weird if you put a leading 0 and assumes that bit is octal
so octal 036 == dec 30
got it from ma.ttias.be/silly-little-ip-tricks which has some other fun notes about using hex and pure integers
 
ahh - I thought I must just be missing a clever trick.
too slow to figure it out
 
yeah it's one of those weird things that most people don't know and don't take account of
I don't think I knew the octal one before
knew about the integer one for bypassing filters before
 
9:35 AM
@RоryMcCune oo yeah there are a lot of ways to obscure an address, IP or otherwise
 
@RоryMcCune Why do programmers always mix up Halloween and Christmas? Because Oct 31 = Dec 25.
 
@CodesInChaos indeed
 
@RоryMcCune but did you know that multiples of the integer also work?
 
@AviD I did not, how would that look?
 
that link also doesnt mention that hex can be used in place of any octet, not just for the full address.
@RоryMcCune hang on, I have the formula here somwhere....
ah yknow what, you can just use ha.ckers.org/xsscalc.html - near the bottom is an ip calculator, note the dword level
actually I'm not sure what kind of browser support today for higher dwords...
 
9:52 AM
@AviD ahh I C
 
@RоryMcCune its basically xoring it with a full set of bits
@RоryMcCune oh this is interesting. that calc page gives a js alert that the dword needs to be 0 or 1, but it still does the conversion. Ping at least has taken dword=5....
 
@AviD how odd!
 
I'm sure it will go higher. basically the network stack looks only at the LSBs and ignores everything else, which is the extra dwords
 
@AviD interestingly, linux ping doesn't like the dword 5 version
 
interesting
 
9:57 AM
actually linux ping doesn't like the integer version at all
 
@RоryMcCune whut, even without any dword games?
that is super weird.
linux ping is broken!
 
@AviD ah no I suck, it was DWORD 1 it didn't like
it's fine with DWORD 0
 
oh
 
so it does basic int
but not anything DWORDy
 
still weird. curious how browsers will take it?
 
9:59 AM
does everyone call these things RAT Trojans now:
0
Q: Can a R.A.T. trojan horse hide itself, so its activity doesn't appear in task manager process ?

Steve...so when someone is controlling your computer, even if you open Task manager, you won't see any suspicious activity.

Isn't the T for Trojan anyway?
edited, as it annoyed me ;-P
 
10:19 AM
somebody fix that first answer
it doesn't have six characters worth of errors and I can't change it
 
10:30 AM
@Flyk I got back here late - looks like you fixed it already :-)
 
well I had no choice, he said "plain site" instead of sight and "send" instead of "secondly"
I just could not continue with my day until that was no longer the case
I made my paying customer wait with the line "I can't just yet, somebody is wrong on the internet"
2
which got a giggle out of him
your bassline will sound 10x better once this guy's spelling has been corrected
I promise
this guy has a funky thing I've never seen before
it's possibly the most incredible thing I've ever seen in my life
it's like a jacket that vibrates according to an input signal
used for monitoring bass at low volumes
I find this incredible and I want to buy one NOW
but I'm also hoping they come out with a product aimed at women... ;)
 
10:45 AM
@Flyk something a bit more fashionable, yeah good point
 
yes, fashionable is what I was going for
 
hahahahahaha - sure
@Flyk Actually, I'm pretty certain that product exists, but can't google for it here at work...
 
"This bassline is deep, pulsing, and energetic. 100% tested."
 
satisfaction guaranteed. But if not, rewind and play it again :-)
 
tsk, musicy types... always on about their throbbing.... basslines
 
10:50 AM
@Flyk - you've been busy: bbc.co.uk/newsbeat/32013708
 
@RoryAlsop gotta get in there before the less appealing individuals in society take advantage of the situation
 
@Flyk Kinky.
 
@TerryChia you should be nice to me, I elevated you to global fame
 
@Flyk That was a compliment.
 
I was merely advising you of the situation
 
10:54 AM
Actually, I should put thy tweet in my resume.
That*
Achievements - Discovered Infosec Taylor Swift before it was cool.
 
Infosec Taylor Swift was cool before the account was created.
 
@TerryChia hey careful there you may end up taking @AviD 's DMZ Hipster crown
 
technically, by definition, everybody in here is a hipster as you were all into information security before it became cool
granted, it's probably never going to get "cool"
but the point still stands
 
@Flyk true...but rory.porn just gives all the wrong messages
 
@RoryAlsop whereas taylorswift.porn doesn't?
you realize I'm actually going to fill that site with pictures of kittens, yes?
that's basically porn to me
kittens that look like hitler
 
10:58 AM
lol - perfect. But doesn't that go against the terms of service for a site in that tld
 
surely the TOS just says pornographic content
those kittens are naked
people all over the world have their mood aroused by pictures of kittens
because they just make everybody so happy
stop being a bad influence on me, I need to not be here!
 
Now we have influenced you, go, and spread the bad influence further :-)
 
@Flyk you could do a kitten based bassline!
 
Are those kittens 18?
 
11:17 AM
@CodesInChaos And remember the fashion these days would be to shave them?
(I'm guessing, obviously)
dammit - I killed chat
that's chat, not 'le chat'
 
Just for fun: Get hired as "Code Ninja". Don't show up the first day. When they say "We didn't see you at the office today." Say "Exactly."
@kgardnr @codinghorror or get hired as a rockstar, arrive late, drunk and stone, puke on your boss's desk, smash your computer n shout YEAH!
 
heh - I like
 
11:34 AM
@RoryAlsop I didn't know Sphynx cats are the fashion these days.
 
@CodesInChaos Well done for keeping the conversation clean :-)
 
@RоryMcCune meow-wow-wow-wubwubwub-wow-wow-wow-meeeeeeeeeeeow-wow-wow-wubwubwubwubwubwubwubw‌​ubwubwub... woof! ?
 
@Flyk good good but I'm not too sure about the woof
could we try it with more of a wolf/tiger motif
 
@Flyk More Cat Bell!
I just looked down the BSides topics page - do you see their explanation of topics?
Attribution - the blame game
Proving where an attack is in fact not very easy; we know this as an industry. Evidence and a deep understanding of the events is required to properly determine the who, whens or whats. This evidence gathering needs to be complete and needs to be done on a large range of the infrastructure and more importantly can or do you trust the evidence collected. So how should we address attribution?

Making a difference
What is actually going to make systems significantly more secure? More of the same doesn't seem to be working.
OpSec not so sexy?
 
"code ninja" :P
 
11:49 AM
how dare they? :-)
 
@RoryAlsop that's crazy talk!
 
exactly
are you pitching a talk, Rory?
I might under the Making a difference topic
@RоryMcCune hahaha - just saw the wolf/tiger line
 
well I'm glad that's over
damn, I'm too unprofessional
time to go home
 
@Flyk does the client like their Meowub?
 
@RoryAlsop I'm actually not at the moment, haven't thought of anything that would really fit...
+ I'm already doing AppsecEU in may
 
11:59 AM
@RоryMcCune oh - of course
because I'm in HR I'm always a bit reticent about sending a paper for a broadly techy conference, but there's reasonable crossover at BSides
;-P
 
@RoryAlsop yeah you should be able to get something that'd fit well!
 
12:12 PM
@RоryMcCune How about a talk on why rewriting the Linux Kernel in Node.JS will make Linux webscale and free from memory corruption bugs.
2
 
@TerryChia oh my god
 
@TerryChia Sure - I could write all the hipster buzzwords. Just let me fire up my Markov box
 
@TerryChia yeah the down-side to that approach is they might actually accept the talk and then I'd need to try and give it!
 
@RоryMcCune lol
 
@RоryMcCune "down-side"?
 
12:14 PM
unless I take the approach of one talk I went to at Brucon about APT, where the speaker said "apparently APT doesn't exist, so instead I'm going to talk about german beer purity laws"
and then he did
for the full 40 minute slot
 
@RоryMcCune lawl. that's actually interesting too
 
@RоryMcCune Genius!
 
@TerryChia yeah don't think the conf. organisers were too happy, they were not in on the gag
 
what did he mean by apt in that context
 
@Ohnana just the usual buzzwordy Advanced Persistent Threat thing
 
12:16 PM
4
Q: What's the bandwidth of Bifrost Bridge?

S SWhen Bifrost Bridge transports anything, lots of information gets transferred from one realm to another. So, I can talk about bandwidth. What's the bandwidth of Bifrost Bridge. It's certainly doesn't look infinite because its radius is finite. Only finite number of people can stand there. Q: H...

 
@TerryChia how do you convert people to information, though
unless he's taking a very loose interpretation of "information"
also hang on does Flyk really run SwiftOnsecurity?
 
bonjour, i am jacques from france
 
@Ohnana yes*
*may not be 100% accurate
9
 
@RoryAlsop wtf
(╯°□°)╯︵ ┻━┻)
 
@Ohnana well in @Simon's case, the result would be indistinguishable from random.
 
12:28 PM
@TerryChia it depends the protocol used by the bridge
 
@Ohnana of course*
 
@RoryAlsop heh. I need to adopt that.
 
@AviD pls have some respect for jacques from france
 
@RоryMcCune ┻━┻ ︵ヽ(`Д´)ノ︵ ┻━┻
 
@Simon oh I respect Jacques.
Your mom’s so pedantic God handed down the 10 Commandments and she was like “um actually” and got turned into a lizard
 
12:29 PM
hahahaha
 
My poor mom.
 
@Simon bonjour
 
I've almost migrated everything at work from Windows 7 to Xubuntu. I am a happy man.
 
@AviD yeah, I've pinned it so we can just * stuff as needed and refer people to the pinboard :)
 
@RоryMcCune lol excellent
 
12:31 PM
@Simon noice
 
@Ohnana Yep and kudos to my boss for letting me do it. I'm the only one running Linux here.
 
@Simon nice! I'm required to use linux here -- my GNU boner was amazing the first day here
 
@Simon thats not true. There are at least a few dozen all over the world that run linux on their desktop.
 
@RоryMcCune excellent :-)
 
@Ohnana Wow, that's pretty awesome!
My ultimate boner would be to run OS X but y'know, this is good enough.
@AviD I TYPED "here" YOU DONUT.
 
12:36 PM
@Simon my boss hated windows with a passion, and I handle malware samples all the time -- the tools i need are on Linux. So i am too
that sentence felt soooo good to type
 
@Ohnana when are you growing your neckbeard? ;-P
 
@RoryAlsop soon
although i have chin/neck fuzzies rn
 
I am done for the day
for scheduled work anyway
hands up all of those who only worked 3 1/2 hours today
 
raz
Wait you have a job?
 
nope
well, yes
but nope
I did assist somebody with mixing and mastering their track this morning
 
12:39 PM
@Ohnana Oh, I see. My bosses hate Windows too but they got a bunch of software dependent to the platform so they gotta stick with it.
 
@Flyk Yeay - me. And then another 2 so far, and probably another 5 this afternoon :-)
 
Personally, I'd rather have to load a W7 VM every now and then.
 
@RoryAlsop lol
I like this engineering and remixing side of things
 
@Simon i do that for a proprietary tool we use to determine if PII is involved
 
@Flyk optional task - sneakily edit it a cat's meow to all tracks you work on for other people this month
 
12:40 PM
instant monies without having to travel all night is a win
 
it may or may not be a breach of TOS but whatever
 
@RoryAlsop I don't have any other non-weekend schedules this month :(
yet*
 
(also I work around a "premium feature" restriction too because fuck y'all)
 
@RoryAlsop find a meow that could be used as a short upriser and I will
or in reverse
hmmm
not even sure what a meow sounds like in reverse
 
@Flyk woem, obviously
 
12:42 PM
"how did you come up with that sound... it's AMAZING"
"oh, it's just a cat meowing backwards"
 
hahahaha
 
"..."
 
It seems to sound a bit like "Weeem"
 
@Simon yes, here in OUR world.
 
how odd
 
12:43 PM
@AviD 87fysd78ftsdfsd
 
@Simon really? have you tried it, it is a steaming pile of crap
probably still better than linux though
 
I do have to say I feel bad taking that much money off somebody for that little work
 
@AviD You suck at everything.
 
like anything I guess they're paying for the expertise, though
 
@AviD in terms of ui, it wins. In terms of functionality, it's like using a banana as a hammer
 
12:44 PM
so this thing he turned up with
it's called a "subpac"
 
@Ohnana How so?
 
@Flyk yes. you know the story about Henry Ford and the piece of chalk....
 
it's like a jacket that vibrates
@AviD no
I so want one
 
@Flyk My lead singer did a wee remix for a very large international act and they asked how much he wanted. He said, "nah - it's for a mate", and their guy said "no, it's your job; don't do it for free. would you like £500 or £1k?" - very cool guy
 
@Simon to change configuration options you have to type obscure commands on the cli
 
12:46 PM
@Ohnana Ah, I never had to do that.
 
and that's coming from someone who can recite tar options without peeking at the man page
 
@RoryAlsop yeah, exactly
 
executables get loaded as disk images -- what the fuck is that
 
@Flyk I'm sure you could 'alter' it so that when you are on stage dropping the bass it kicks in 'exactly' where you want it
 
it's like, I just opened up his project, changed a few sounds, redid all the levels and mixed it down, exported it, gave it a quick master because he wanted to play it this weekend at some club he's playing at
it's not even a proper master, just enough to get it loud so he can play it
gave him both of the files and off he went
 
12:47 PM
@Ohnana Yeah I gotta say that is weird but you get used to it and it's not annoying, actually.
 
and got paid enough to buy a subpac and have money left
 
@Flyk but if that's your skillset/experience and he can't do it himself, then it is worth money
 
Eject the thing when you're done with it, delete the exec, done.
 
well he says the reason he has the subpac is because he's partially deaf
 
@Simon but it's not a disk image
it is not even in the vicinity of a disk image
 
12:48 PM
@Ohnana SSSSSSHHHH
 
but it seemed so useful that I think everybody should have one
 
You're overthinking it.
 
also the entire process for installing things on OSX makes my eyes bleed
 
you know the feel of bass in a club?
like waves, washing over you
wearing one of these things is just like that
 
@Flyk want
 
12:49 PM
story supposedly goes something like this:
One of Ford's factory machines was making a terrible noise. he hired a consultant to fix it. The guy came listened to the machine for a few minutes, then drew on on of the pipes with a piece of chalk, told them to replace that one.
Send Ford a bill for 10,000$. Mr. Ford refused to pay that much, and demanded a breakdown.
The consultant sent back:
Time: 95$
Chalk: 5$
Knowing where to make the mark: 9,900$
meh, I pretty much butchered that
 
@AviD meaning still got through
@RoryAlsop yeah but I know how much people usually get as a payout from their first tunes
 
@Simon see your car turned up on Imgur
 
it just makes me feel a little guilty being part of the reason he might not make money on a track
or a loss, in some cases
 
@RоryMcCune A FORD?
 
definitely going to charge many numbers if I were to ever engineer or remix tracks for artists I know are good for it, though
 
12:53 PM
YOU THINK I'M DRIVING A FORD?
 
@Simon well it's got your numberplate on it...
 
@Simon psh, you're too hipster to drive something as sensible as a ford
 
@Flyk WHY WOULD I DRIVE AN AMERICAN CAR?
 
@RоryMcCune yeah, but it has more wheels than he's used to. And an engine. and doors.
 
@RоryMcCune That, it does :D
 
12:54 PM
@Simon I suppose yours are actually built in America
I should backronym "psh" into something super offensive
 
@Flyk That sounds awesome. I know I like a vary different set of genres to you, but the kick and bass are equally as important...
 
the low end is important everywhere
also sounds like writing tracks that provide back massages
 
@Flyk or if you get your modified subpac, more intimate massages...
 
seriously, though
 
actually, that must be a thing
 
12:57 PM
@Simon you should have got a subpac instead of your TB3
 
I can't believe otherwise
 
it would have been money better spent
@RoryAlsop rez trance vibrator is as close as I've got
which is a USB peripheral for a playstation 2 that vibrates in time with the music from compatible games
before anybody asks
 
hahahaha
 
@Flyk fun
 
@Ohnana difficult to actually play it... great for adding a multiplayer aspect to the game, though...
"you just play and I'll just... sit... here..."
 

« first day (1558 days earlier)      last day (3314 days later) »