kippo's logs have a feature where they record the timing of the keystrokes, so it's like watching over someone's shoulder as they type, including backspaces, etc.
When you're writing a report, what person do you write it as?
First person singular: I discovered a vulnerability in HP Power Manager...
First person plural: We discovered a vulnerability in HP Power Manager...
Third person singular, by name: Bob discovered a vulnerability in HP Power Manag...
Because I'm jelly that you lads are no longer appreciative of my yolos, plses and donuts. Back then they would award me thousands if not MILLIONS of stars.
@MarkBuffalo In the original description, the four words were selected randomly, uniformly and independently, in a list of 2048 words, leading to 44 bits of entropy.
@MarkBuffalo yes, if you know that the person's password is made up of 4 dictionary words and nothing else. it will take you a really goddamn long time though.
If this is an offline dictionary attack and you have a hash of the password with a simple hash (even "salted"), then a good GPU will let you try a few billions of passwords per second, and you shall be done within an hour or two.
If the password hashing function is more reasonable and constrain you to 100 trials per second and per machine, and you command 80 machines, then you are up for 30 years of computation (on average).
@Ohnana Back before we had "opinion-based" as a close reason, there was "subjective and argumentative"... hence, "S&A"... add Freud and you have "S&M".
(This is the reason why Rio Tinto wants to convert bauxite to aluminium in Greenland: they would have to bring the mineral there, and the metal back, but the electricity would be really cheap)
Ok seriously, there's some issue that has been going on for a while on Ubuntu Desktop 14.04: Chrome ends up freezing/using a ton of CPU when Workstation is running a VM.
@Simon Remote clown execution attack. Detects VM running, attempts to log VM access and redirect it to a AOL-JSON server for authenticatory authing. The result is then hashed and verified against bcrypt by the NSA, and logged into xVMScore
If it determines your donut consumption is too high, you're listed as a critical threat to resources at Tom Hortons.
Angry bird spider pig....I see this chat is full of the usual intellectually stimulating debate....but still, that is an impressive angry bird pig spider! :D
@Ohnana Ok I they must not have included the whole quote from JC, because what they have quoted there doesn't seem like anything more than plain ignorance.
“As far as I was concerned, men who want to be women were only really to be found on the internet or in the seedier bits of Bangkok. They were called ladyboys, and in my mind they were nothing more than the punchline in a stag night anecdote.”
I knew something was wrong with me for being from the internet.
...wait, how does he know they're found on the internet?
Well, he did say one semi-agreeable bit regarding the amount of people with some kind of "gender issue" in Great Britain. I mean, if the whole conversation is in the context of people seriously wanting to be (or actually being) transgender, ~1% of the population seems pretty high. Now, if he's broadening "gender issues" to include the whole LGBTQABCXYZ community, then that's a bit more believable.
@Iszi the thing is, we don't know if our tallies of trans people are correct. gender identity is something that changes with culture, and before it was hell to get any kind of treatment or acknowledgement.
I also kinda agree with him on the kid thing. Some kid decides that they want to be another gender at the age of 3? Yeah, ok, support them, but do they really know what that means?
3 is awfully young, but there are specific diagnostic criteria a kid has to meet before they even think of diagnosing with GID. it's more stringent than the adult criteria.
@ThomasPornin Actually, I do remember reading that one, and while I grok a fair bit of it, the maths is over my head. Good reporting style though - hadn't realised that was first majesty singular :-)
I rank choice of gender identity up along with voting, drinking, driving, smoking, firearm ownership, etc. It's really hard to imagine letting kids act on their decisions about it before around 14 years old, at least. But it's definitely different from the aforementioned others in that early action can have a substantial positive influence for certain cases as well.
@RoryAlsop In fact, using "we" even when there is a single author is meant to allow anonymous submissions (for peer-reviewed conferences and journals). By using "we" systematically, you do not disclose information about the number of authors.
Once you throw out the logical assumption that "nature knows best" though (i.e.: a person's naturally-born gender is always a "safe" route to go with) I guess all bets are off as to figuring out what's really right for any given case - until you have the benefit of 20/20 hindsight.
@DavidFreitag That's just the point we're both really getting at though. If you accept that a person's gender identity is independent of the reproductive organs they're born with, then external physical inspection (or even internal, with current science) does you no good and offers no guidance.
tbh, the only thing i've heard as a physical proof is being happier on another sex hormone. but that requires to to try it out and enjoy it enough to continue
@Iszi Part of the issue is that "independent" is not the right term either. The tyranny of the majority posits that for most people, genetics, phenotype, gender identity, social role and sexual interest all match.
@Ohnana As is the use of "being happier" as a metric is in general. There's just too many factors affecting a person's life, and changing in it, during any given period for one to be certain of which factors are independently acting to improve it.
@Ohnana Point remains: Usually those who are willing to go on medication to "be happy" are going to be trying several things in addition to it, and likely around the same time. So it can be tricky to isolate which factors are really causing one's happiness.
Has anyone done the OSCP for fun...trying to work out if $800 is worth splurging, knowing fine well that my chances of passing the exam are slim to none
@TheJulyPlot That seems more a cert meant to demonstrate existing skills that you've been actively using for awhile. Unlike some of the other stuff out there. (Looking at you, CompTIA & EC-Council.) Haven't taken it myself though.
Closest thing I've done is IACRB's CPT. I still consider that one fairly laughable as it was a relatively easy pass after a boot camp - no "real" skill/experience needed.
@MarkBuffalo Yessir. @TheJulyPlot I believe @Iszi is correct. It's geared towards professionals in the field, not noobs like me. If you are already working in IT....give it a shot.
@JonathanMusso yeah im already in the field, not pen testing though, I have about 5 years worth of messing about with backtrack/kali and a few uni modules under my belt but thats about it. Thinking of doing it just to broaden my skill set and have a bit of fun with it, without the pressure of needing to pass the exam....that $800 is off putting though.
@TheJulyPlot It's costly yes. You have much more experience than I. I have none. HA! If it's something you want to save for I think you will be more than capable.
@JonathanMusso have you done any of the SANS xmas challenges? I attempted this years and was hopeless....this is really my motivation, cause ive done reasonable in recent years, but haven't used the skills in so long ive forget the moderate amount skill I had.
@JonathanMusso They are worth checking out, the good thing is there are full write ups online, to guide you though, which helps. I've heard that lot of the oscp is about privilege escalation, so may be a good idea to have a look online about how to go about that.
When you're writing a report, what person do you write it as?
First person singular: I discovered a vulnerability in HP Power Manager...
First person plural: We discovered a vulnerability in HP Power Manager...
Third person singular, by name: Bob discovered a vulnerability in HP Power Manag...
