cardsagainstsecurity.com

@ScottPack what does this do, other than ask for my name?

It's an online version of Cards Against Humanity with allegedly infosec themed cards.

In case no one shared it earlier: BIND 9.9, BIND 9.10. Patch now. lists.isc.org/pipermail/bind-users/2015-July/095347.html

I guess they're really in a bind

So, was it all just a dream?

@ScottPack and XSS vulns

allegedly

^could be interesting

How's it possible I get this amount of rep from a stupid question like this security.stackexchange.com/questions/95029/…

because llamas

^seen on the BBC today

@RоryMcCune hahahahahahahaha

Exciting name for a film

@RoryAlsop see now you'll have to upgrade :op

"Rory presses a button, suddenly the laptop explodes into a ball of fire and the evil spirit Steve Balmer is released"

@RоryMcCune I'm sure I will eventually feel happy upgrading my gaming machine to Win 10. But definitely not in any short time frame. And none of my other machines run Windows (except work, and those will get upgraded on corporate schedule...)

ie - not to Win 10 in the next 5 years

"Rory immediately morphes into Dr Mayhem, taking his electrifying guitar to battle the evil spirit"

@RoryAlsop yeah there's a years window on the free upgrade for 7/8/8.1 machines so no rush from that perspective

@LucasKauffman RAAAAAAARRRR! - zap

Steve Balmer now grows 10x larger as he already was and Rory summons his Llama Zord

@LucasKauffman Eat his hands, Lucas!!!

I mean Caaaarrrrrrl

laaaaaaasseeeer eeeeeeeyeeeeees NOM NOM NOM NOM

edited to have the correct video

Okay - I think I do finally understand how all that voting worked, but it still surprised me. In trying to understand why people voted the way they did, I'm less sure. Perhaps the joke noms were not treated as such, or maybe non-regulars thought it might be fun to vote on one, or perhaps people ignored the fact they were a joke and just went with the person they wanted to anyway

@RoryAlsop people voting the person and not the nomination is the only thing that made sense to me....

But even there, two of my votes didn't end up anywhere near the final 2 people though, so I wonder how far from the rest of you guys my thinking was.

@RoryAlsop at lease one of mine didn't either..

ARGHHHHHHHHHHHHHHHHH. Damned builders. They're relentlessly trying to PIERCE MY SKULL with the sound of their DRILL.

@CodesInChaos ugh yeah I had the experience when we were getting our garage conversion done.. it was unpleasant :o/

@CodesInChaos You need....to be somewhere else (waves hand mysteriously like Obi Wan)

@RоryMcCune What's wrong with XP? :)

@TildalWave no security updates? :op

well unless you're a large customer who pays for extended support of course

@RоryMcCune yeah but that means there's no more 0-days for it, by the power of definition LOL

@TildalWave heh, yeah now it's just forever-days they have to worry about

@RоryMcCune correction, they don't have to worry about

it says so in the end of support notification

yeah if you're running XP tho' could be a bit of a concern...

@RoryAlsop I'm still wondering how I lost to @Simon.

That's the first thing I'd do, change all browser signatures to say I'm using XP

Or ME

With Netscape :))

@TildalWave Navigator 4.76 FTW

@RоryMcCune I believe I may still have that on one of my boxen, running under an early SoftWindows

@RoryAlsop I think the last thing I had/have that would have it potentially is a SPARC

This one is an Indigo :-)

heh I worked a lot on those back in the days and then Indigo 2 (or squared I think)

were really good machines actually

we did spatial indexing on them, mostly with ArcInfo

you'd set it to calculate some index for the whole country's worth of data overnight and then hope you got everything right in the morning

I don't remember not one Indigo ever blowing up, which wasn't quite the case with NetBurst (how convenient name LOL)

room topic changed to The DMZ: All Hail our new canadian mod overlords (who will surely provide doughnuts) [doughnuts] [food] [libations] [rory] [security]

@TildalWave For I while I had an Indigo, 2 Indigo 2's, 2 Personal Iris's and an O2, which I then sort of swapped for an Octane. I loved that kit

nothing ever blew up, although the Iris's got very hot - I used them as warm benches eventually

their distributed.net performance was sooo slow

@RoryAlsop Iris were those desktop units?

I think I remember that logo on some we used

tower units :-)

hmmm doesn't wanna open

ah OK it did now

I don't remember those

I think this is where I remember that Iris logo from

but there were also some desktop units

heh heh

@TildalWave Ah - I had one of those too, yes

@TildalWave I never had any Indy's, but they were rather good

oh yeah we had some of these... I didn't work on them tho, some guys in the rooms you had to go through 3 different sets of doors to get to used these... I never asked what for, could be just solitaire LOL

I think they did registers, lots of sensitive info to work with, so the need for physical security too

and these days it's just all rack mounted Macbook pros...

reallyy? Why would you do that?

All that wasted space for cases, screens etc

@RoryAlsop yeah the only thing could be that they're testing stuff and would periodically pull out the screens to look at them.. going by the blog it came from simbimbo.wordpress.com/2015/07/24/… he used to have a similar setup with Mac Minis

@RоryMcCune and of course it is relatively easy, and maybe even cheap

(although I'm not sure about that)

@RoryAlsop heh, well from the blog he hand made a custom rack for these things.. I'd guess $company_with_lots_of_cash said to an engineer "hey could you do x" and said "sure" and then went had fun :)

@RoryAlsop I can see a company that does iOS development going for that.

But Mac Minis are usually the more popular choice.

heh

I have an SGI octane.

@JourneymanGeek they're nice aren't they

I kinda forgot the password, and need to see if I can break in at some point

damn thing still powers up tho

@RoryAlsop: lovely, completely impractical thing ;p

I've wondered if I should mod it into a modern syste, (or hell, a mini cluster) but it feels wrong

(also I don't have the space/time at the moment)

@JourneymanGeek they look so nice, but as with most computers, need to be in the attic :-)

I don't have an attic;p

garage?

I have it under my desk, threw a cloth over it, and put my feet on it ._.

pffft

(and my parents are pretty much 'If you buy anything you need to throw something out. Which is annoying ;p)

@JourneymanGeek yeah I was very happy to move into my new office space as now I have room to spare, so can horde more computer bits :)

lol

Its more a matter of "Yes, I actually do need two screens"

(actually 2x27 sounds perfect. I'm using 24 and 27 at the moment ;p)

@RоryMcCune I like that misspelling - it suggests they all rush at intruders...

@JourneymanGeek no no no - you have that wrong. It should be, "Yes, I actually do need 3 screens!"

@JourneymanGeek I have two 27"'s but have them attached to different base systems (one for my work laptop, one for my home desktop). What I would really like is a high-res portrait monitor for reading docs on.

I have a 27 inch 4K, and a 24 inch full HD

I'd like to swap out the 24 incher for something large and IPS

@RoryAlsop well in previous storage incarnations they could all fall on you if you opened a cupboard too quickly...

@RоryMcCune that makes all the difference - it's the documents

(and my old eyes)

another 4K monitor would be a bit nuts, so full HD or QHD

@RoryAlsop yeah. I have a feeling that may top my X-mas present list :)

^makes much more sense for most reading

than these silly widescreen movie watching monitors

@ChrisDale cheers Chris. I believe he is wrong too :-)

I think they should let hackoverflow go ahead, just to see how they deal with the inevitable flood of awful questions

@TerryChia It's my speech, I'm telling ya.

@RоryMcCune reading and coding!

@Simon sure it's not the Sec.SE canadian mafia?

And I know I'm late to the game, but congrats @schroeder

So, now that the election is over, I guess The DMZ will go back to its casual form of activeness?

@Simon are you suggesting that the DMZ'ers are filthy casuals?

@RоryMcCune Naaaaah.

@RоryMcCune Some of them are, yes.

@Simon of course not, it was just some people sitting in a tim hortons discussing things that may have related to votes

:op

@RоryMcCune I'm not even sure if there are many Timmies that far in the West.

We'd have to ask the new mod but he's a DMZ casual so yeah.

@Simon I was going to say "TBF he is on holiday" but that didn't stop @RoryAlsop ...

@RоryMcCune He's a nurd anyway, vacation means that he's testing out new technologies.

@Simon speaking of which, got Win 10 Enterprise installing on my home kit at the moment

will be interesting to see how it is

@RоryMcCune From 8.1 to 10 or 7 to 10?

@Simon these two are 8.1 --> 10

I have a potential 7--> 10 with my works laptop, but that one I'm going to wait a while as problems would be seriously inconvenient

@RоryMcCune Good move.

interesting to see the different install speeds. My laptop is pretty nippy usually and fine for stuff I use it for, but it's taking a lot longer to install than the desktop

@RоryMcCune It's been going on for how long?

@Simon so my desktop is done, laptop is at 64%

about 15 mins so far

Oh that's not too bad.

only gotcha is don't take the "express settings"

And knowing Windows, it will go from 70 to 100% in a second.

or you'll end up sending a ton of data to MS

@Simon or 2 days, then stop, then bluescreen :-)

Ew.

@RoryAlsop lulz

@RоryMcCune it sounds like defaults are terrible across the board for this. Normally aren't they okay at taking your old settings and asking you to confirm?

@RoryAlsop I think they've added a load of "social" style functionality to this version, so a lot of it's new

and they're defaulting to "share everything"

which may be fine for some, but I just went through and nopped the whole lot

what's a little... disturbing is that this is Win 10 Enterprise!!

I'm very surprised to see an enterprise desktop OS asking about sharing stuff onto the Internet.

To native English speakers: What does "capture" mean?

In the following sentence

> I didn't quite capture what you said.

Does it mean "understand"?

As a non native speaker: In this context, yes.

@AviD, I need your help for validating an amusing theory

Quite similar to "I didn't quite get what you said."

@Adi yeah

As a native english speaker: yes, but it can mean two different things

@Amelia How so?

In the literal sense, someone didn't write down/type what you said, but in the sense I assume it means, it's "I didn't quite get that"

I received an email from a client that contained a lot of "capture" usage in different ways

> Let's capture all the details

Capture could mean to capture data, or to receive

> Let me check if everybody captured all the details

@ThomasPornin Yes.

@Adi there it means to document or note down

@AviD, would your votes for the moderator election be, by any chance, for schroeder, Xander and Terry, in that order ?

@RoryAlsop I'm a mere geordie, I cannae speak so succinctly

@AviD YOU DIDN'T VOTE FOR ME?

@@@@@@@@@@@@@@@@@

@Codes @Rory @Amelia Thanks

@ThomasPornin Checking if SE shuffled the votes securely?

@CodesInChaos Yep.

I've been speaking English for close to a decade and a half and this week was the first time I see such usage for "capture"

My votes were Lucas Kaufmann, schröder and Xander

@Amelia You suck.

@ThomasPornin if it is useful, mine were Xander, Scott and Iszi

Wait, actually I can;t remember

@RoryAlsop AND YOU DIDN'T VOTE FOR ME TOO ?!?!

WHO THE HELL VOTED FOR ME?

My candidate algorithms are 1) in voting order 2) in userid order 3) Fisher-Yates shuffle of one of the above using .net's System.Random.

@Amelia You can check here security.stackexchange.com/election/3?tab=election

you did

@ThomasPornin oh yay! the bear needs MEEE!!

Wait, I didn't even vote that, derp

@RoryAlsop I chose @AviD because my data is incomplete

@ThomasPornin oh pls. Voting is confidential. And, no.

If I were SE, I'd simply sort the votes as strings. Simple, deterministic output that doesn't leak anything.

@AviD Ok, the theory is not confirmed. This is a relief.

Hahaha, ovid voted for me and doesn't want people to know.

@Simon PLS

ALL HAIL THE LLAMA

@ThomasPornin I missed the transcript. What was your theory?

@AviD I have not explained it yet...

Also, you can review the OpenSTV data

GUISE I PROVED @ThomasPornin's THEORY WAS WRONG

@AviD lol

@AviD Technically you helped @ThomasPornin disprove his own theory.

@AviD Well, you were the data element and I chose you because you happened to be lazy

hahaha

@ThomasPornin the benefits of laziness

but what does that have anything to do with it?

wat

I was trying to see if the order of entries in the OpenSTV data matched the chronological order of votes

And he voted in the last minutes?

I get a partial information on the chronological order of votes through the badges

Would that be why he's lazy?

but the badges are awarded in batches, so the first votes are all together

But @AviD voted much later, and thus was alone in his badge batch

Thus making for a much clearer data element

@ThomasPornin that's odd. I was one of the first voters.

is this like a card trick?

o

am I a card?

AM I THE QUEEN OF HEARTS?

Or am I just the Joker in the pack.

@AviD The site claims that you got the caucus badge only on July 26th

oh true. voting opened on weekend I think, I only showed up on Sunday.

@CodesInChaos In the OpenSTV format, you are supposed to group all identical votes together. SE does not do things like that; each voter gets his own line.

Since they don't group, I thought that maybe they don't shuffle either.

But apparently they do change the order.

This is what I get running Meek STV, Droop Threshold: gist.github.com/ameliaikeda/4cfb85d15cc95e987dca

The guilty is @JeffAtwood, who "performed an ad-hoc query in SQL Management Studio to get the voting results"

Guilty of not making it predictable?

Seems to have been automated since then.

That's some good guilt.

@CodesInChaos I suppose.

So there is a chance that one of their competent programmers added secure shuffling.

o woops

@CodesInChaos But only a chance...

The problem is that there are so many ways to shuffle badly.

@Simon I did :)

@RоryMcCune Aw, you're the real Roro <3

The other Roro is a filthy casual.

Fisher-Yates using System.Random. Or OrderBy(random()) either in C# or on the sql server.

@Simon All Rories are the real Rories! (Rory's 3rd law)

@RoryAlsop Even that dude who pretended to be a Rory briefly?

@CodesInChaos They should not shuffle; as you say, they should sort, and probably group.

@Simon no - he's not a Rory

@RoryAlsop Good, that guy is a weirdo.

@Simon lol

ovid pls

room topic changed to The DMZ: All Hail our new canadian mod overlords (who will surely provide donuts) [donuts] [food] [libations] [rory] [security]

damn donuts keep misspelling donuts. They wanna poison us with fat people food.

Lern too spel, ovid.

rekt

@AviD mod..... abuse......

I do hope our new mod will explain to the old, unreformed mod, the error of his ways :op

The new mod is a donut himself, he won't explain anything.

Is adding deliberate spelling mistakes to the room tags and topic a good enough reason for a suspension?

@CodesInChaos Maybe you should ask the owner of SE, who actually is American.

I wonder what he'll say.

Well, Jeff's distinguishing characteristics are being opinionated and being wrong.

It's an interesting question for sure

BTW windows 8.1 --> 10 largely successful on two machines

the nvidia 760 on my desktop I think needs an updated driver that it's not getting automatically

How much are they bothering the user with those "get an MS account" prompts?

but apart from that and a hacky app called expandrive not completely working, all seems ok

@CodesInChaos well in both cases these were existing machines with local accounts and it's win 10 enterprise

@CodesInChaos If you do decide to get an MS account, make sure that your password is not longer than 16 characters!

so not too much so far

but you need to not take "express settings" on 1st start-up, unless you enjoy sending a lot of data to american corps

And I too now have shiny Win 10 goodness.

@RоryMcCune And to this I say: +++++++++++++1

The express settings were just scary.

@Xander yeah it was a surprise to see those defaults on Win 10 Enterprise

I'm sure that in large corps there will be group policies to address it, but small co's could easily end up inadvertantly sending stuff they didn't mean to.

@RоryMcCune Ah, I haven't seen the Enterprise setup. I only have that on my corp laptop, and that was a corp image that was all pre-configured. I've just now seen it setting up my Surface Pro.

lolsurface

@Xander we've got a MAPS license and it appears that unlike win8 where that gave us pro. stuff, this time round we get enterprise.. which is nice

@RоryMcCune Yup, for sure.