The DMZ

AviD

00:38

@RоryMcCune you get any good news?

I didnt :-(

Henry WH Hack

@AviD no tigger

Mark Buffalo

01:48

@HenryWHHack wtf

why are you doing that?

Did someone here tell you to do that?

don't do that...

TildalWave

02:07

To the VTCers... why on earth would this belong on Stack Overflow? It's off-topic there as well. — Mark Buffalo 9 mins ago

@MarkBuffalo FWIW I VTC-ed as unclear, can't help it if 3 people before thought it belongs on SO and it was auto-migrated (even tho it clearly should be)

I maintain this position:

OK, an unclear question doesn't become any clearer if it's migrated elsewhere. So they shouldn't be and any issues with them (besides the off-topic part) should ideally be resolved before we migrate it. Anything else is just rude to the migration target site. TL;DR is not to use off-topic close reason with auto-migration option to dump bad questions and defer the problem elsewhere. — TildalWave Feb 26 at 17:38

but the system repeatedly disagrees with me even when it doesn't know what it's doing :(

Mark Buffalo

lulz

This guy doesn't know how to add a simple button to do something on one of his apps though

TildalWave

I never really got it why would it give me all the VTC options if it's clearly gonna select one of them based on previous votes

Mark Buffalo

The guy is essentially asking us how to make an application for him

TildalWave

well, a batch file really

Mark Buffalo

securityaffairs.co/wordpress/44899/hacking/…

rofl

TildalWave

02:34

@RoryAlsop Looks like our unnamed meteor shower already has a name:

> The February Mu Virginids (FMV) were discovered by Damir Šegon and colleagues from the Croatian Meteor Network using their data and that of SonotaCo. These meteors are active from February 15 through March 4 with maximum activity occurring on February 26. The current radiant position lies near 16:28 (247) -01, which places it southern Ophuichus, close to the 4th magnitude star known as Lambda Ophiuchi. Rates are expected to be less than 1 per hour no matter your location.

> These meteors are best seen near 0500 LST when the radiant lies highest above the horizon. At 62 km/sec. the February Mu Virginids would produce mostly swift meteors. As seen from the mid-northern hemisphere (45N) one would expect to see approximately 3 sporadic meteors per hour during the last hour before dawn as seen from rural observing sites. Evening rates would be near 2 per hour.

looks like we get most of the bigger ones from the Antapex radiant which is kinda neat if not novel even

debris in the wake :)

kinda shame it's not new moon and better weather here, seems to me these would have a good chance of hitting the Moon when they'd actually be visible

Henry WH Hack

anyone in here?

TildalWave

no, I'm just an astro bot having a conversation with myself :P

Henry WH Hack

@TildalWave ok I am an AI

TildalWave

yeah that explains the immaturity :P

Henry WH Hack

02:50

@TildalWave do you know anything about programming

TildalWave

can't wait for the technological singularity so you can finally fiddle with yourself huh?

Henry WH Hack

I have a very important programming question to ask.

TildalWave

shoot

Henry WH Hack

ask it

@TildalWave How does a compiler work?

TildalWave

it takes programmer's gobbledygook and transforms it into machine code

for better or worse

usually the latter

Compiler

A compiler is a computer program (or a set of programs) that transforms source code written in a programming language (the source language) into another computer language (the target language), with the latter often having a binary form known as object code. The most common reason for converting source code is to create an executable program. The name "compiler" is primarily used for programs that translate source code from a high-level programming language to a lower level language (e.g., assembly language or machine code). If the compiled program can run on a computer whose CPU or operating system...

Henry WH Hack

02:59

@TildalWave next questions I was planning to learn python but by watching a few videos I got to know some basic html so I am stuck between python and html which to start with?

Thomas Pornin

@HenryWHHack Python is a programming language. HTML is not a programming language.

TildalWave

probably both if you're gonna also want to deal with presentation layer

Henry WH Hack

good idea both

but I know more html than python

thank you

TildalWave

you'll want to learn about HTTP methods too w3.org/Protocols/rfc2616/rfc2616-sec9.html

Henry WH Hack

khanademy codeacdemy

I can build my own site with the help of these sites!

I am out of here

out of here

going

now

print ("Hello, world!")

Journeyman Geek

03:49

@MarkBuffalo boingboing.net/2016/02/29/pasta-made-from-insects-sellin.html

Mark Buffalo

04:00

@JourneymanGeek Chicory-swillers

Journeyman Geek

bug munchers

Mark Buffalo

I suppose it's high in protein

Henry WH Hack

sudo su

TildalWave

> ... they can replace meat for vegetarians

I don't think they quite get what vegetarianism is

that does not include eating crickets

Thomas Pornin

@TildalWave There are many kinds of vegetarians.

Henry WH Hack

04:14

12:13 do you people sleep?

Thomas Pornin

@HenryWHHack No.

Henry WH Hack

me too I am a computer geek!

TildalWave

@ThomasPornin yes, but those that eat dead animal protein kinda don't fit

Thomas Pornin

I am not. I just do not sleep.

@TildalWave Some people claim to be vegetarians by simply not eating meat from mammals. To them, fish and chicken are fair game.

I totally agree that a strict definition of vegetarianism would exclude eating insects.

TildalWave

I guess with such loose definitions anything goes

then why even say they're "vegetarians" when all they are is "eaters"

Thomas Pornin

04:17

But I also predict that there will be numerous people ready to eat such things and still claim that they are "vegetarians".

Anyway I don't see the problem with eating insects. That's like seafood without the sea.

I understand that the entire animal would have a crunchiness that not everybody would be comfortable with.

But turned into pasta...

TildalWave

I don't see a problem with it either and I've eaten fried grasshoppers and they're pretty good, tho I don't like that there's parts of their wings left which are like cartilage and not nice at all

and legs I guess

any case there's bits that kinda stick between teeth

Henry WH Hack

anybody know the arris router password of the day?

Thomas Pornin

@TildalWave Bugs provide a good ROI

To obtain 1 kg of cow protein you need to produce between 5 and 10 kb of vegetal proteins.

For 1 kg of insect protein that value lowers to about 1.4 kg

TildalWave

yeah it's one of future food sources for sure

Thomas Pornin

It's a possibility at least

It may avoid the need to use the traditional method (which is an extermination war).

TildalWave

04:24

we should just mind not to fuck up the waters completely and we'll be fine for a while

doesn't look good tho, oceanic acidity is on the rise and increase in CO2 won't do anything good for it either

Thomas Pornin

Oceanic acidity is on the rise because there is more CO2 in the atmosphere.

Whether consequences will be bad or good for mankind remains to be seen.

TildalWave

yes and temperature rise

Thomas Pornin

And we will see it anyway.

TildalWave

it's a cascade effect and we're already in it so it'll only get much worse before it can get better... if

Thomas Pornin

@TildalWave "Worse" is arbitrary. It depends on a set of moral values.

TildalWave

04:29

everyone is consumed with the discussion about global warming but that's really not an issue nearly as much as oceanic acidity

Thomas Pornin

If you put as your highest priority the availability of food for humans, then global warming and oceanic acidity are not necessarily a bad thing.

TildalWave

@ThomasPornin I meant worse as in mass extinction event

Thomas Pornin

@TildalWave Again, this is arbitrary.

TildalWave

yeah sure, it happened before

Thomas Pornin

... and we, as mammals, benefitted from the last one.

TildalWave

04:30

and if it didn't we wouldn't be here

or, we'd be some large reptilians :)

keyboards would be different

Thomas Pornin

@TildalWave I agree, it would have been way cooler than being hairless chimpanzees.

The current fashion is to worship biodiversity. But it is, at best, simplistic.

If you want more food, uniform industrialized production is the way to go.

TildalWave

oh I wouldn't say that biodiversity is simplistic, the environment has largely been friendly and stable so most of it can be found within a very narrow group, but it's still fairly complex

I mean, there is definitely a lot of diversity within the range that is supported by the environment

still...

that won't last, it never has and we're certainly not at the Kardashev scale to preserve it artificially

so far we've only graduated in massive fuckups

Thomas Pornin

I am personally an optimist and I believe that mankind will pull through any subsequent hardships as it did for all previous ones.

I just hope that it will do so in a different manner this time.

I.e. not by killing each other.

TildalWave

oh I don't doubt that, but it won't be 10 billion people that go through that narrow path forward

about 1 billion maybe

(most likely not any specific group, just lots of random episodes decimating all of us)

Thomas Pornin

War, famine and pestilence. The usual.

TildalWave

04:43

indeed

wars will substantially change tho

famine and pestilence not so much

Thomas Pornin

On these optimistic considerations, I will now leave. I have world domination plans to meditate.

TildalWave

haha fair enough, you take care ;)

Mark Buffalo

@ThomasPornin agreed... although, sometimes I can be pessimistic. depends on my mood, really

Journeyman Geek

05:53

@TildalWave bugeaters

TildalWave

debuggers :)

M'vy

08:03

heya

Adi

Hei

Rory Alsop

08:14

Morning

Lighty

Morge

Adi

Man, I'm super excited for today!

It's gonna be a very decisive day in the US elections. It will give very good indication on who's gonna snatch the nominations

Lighty

@Adi It is?

This is gunna be güd

Rоry McCune

08:34

@AviD nope, no Rome for me this year :(

Mornin' All

Arperum

Morning!

Lighty

Mornin

Matthew

Morning

Rоry McCune

08:53

Mornin' @ColinCassidy

Adi

Rory "The Combo Breaker" McCune

Colin Cassidy

Morning all

Rоry McCune

@Adi c-c-c-c-combo breaker... BTW looks like if you're at AppSecEU this year you'll be the only DMZ'er

Adi

@RоryMcCune Oh.. poop! :(

Rоry McCune

@Adi yeah me and avid didn't get accepted

and I don't think I can afford the time/money to make it otherwise this year

AviD

08:56

@RоryMcCune aww shucks :-(

Adi

Well, it's understandable why Ovid wouldn't be accepted

AviD

so you not gonna go anyway?

Adi

But why you? :(

AviD

@Adi 'course, its an antisemitic thing

;-)

Adi

:D

Rоry McCune

08:57

@Adi Dunno, I guess Docker/My talk on Docker wasn't considered a good fit?

I'll have a better idea when I see what was accepted

Adi

@AviD I guess that explains why I wasn't accepted either

AviD

@RоryMcCune I think I might try to go anyway

Rоry McCune

I'd have thought the topic was good, but they may have had another, better docker based submission

AviD

its not like if I did get accepted they would be paying for my travel...

Rоry McCune

@AviD cool. Don't think I can, I'm light on holidays this year already

AviD

08:58

@RоryMcCune thats bullcrap. its a perfect fit.

Rоry McCune

@AviD yeah and as an active chapter leader you should get in for free...

AviD

they even have a devops track!

@RоryMcCune exactly ;-)

Rоry McCune

@AviD well it's possible that they have had a better docker based submission, I know some of the docker people do conf. talks so may be one of them has submitted...

AviD

so just flights, hotels, food... only a couple grand :-(

@RоryMcCune meh

Rоry McCune

anyway AFAIK they're publishing the schedule today, so will find out then...

Adi

08:59

@AviD Whaaa?!

AviD

maybe docker isnt hipster enough?

Adi

Shouldn't be more 500-600

AviD

@Adi thats just the flights

Adi

Yeesus!

AviD

yeah

Rоry McCune

09:00

@AviD that's possible, perhaps someone thought they more needed a uni-kernel/systemd-nspawn talk

AviD

lolwat

Rоry McCune

@AviD unikernels are weird and nspawn is the systemd version of containers

that redhat want to make happen instead of docker

AviD

o_O

@RоryMcCune ah now I see

Rоry McCune

@AviD there's a load of politics between redhat and docker it seems

'cause docker doesn't fit with the "one systemd to rule them all" model of redhat

Adi

@RоryMcCune How are you liking your Seek Thermal?

Rоry McCune

09:02

@Adi I started having another play with it yesterday and I think I can make it useful for this task, I just need to be a bit more patient and look for larger temp diffs.

so I think it doesn't work too well for smaller temp diffs, so if I run it when it's colder, it'll work better...

Adi

I ordered one yesterday and I'll return the C2 tomorrow

diagprov

@AviD mirage.io

Adi

I reconsidered the whole thing. The FLIR C2 is a lot more expensive for little benefit over the Seek

Rоry McCune

@Adi one thing to watch is what way round your usb port is on your phone

AviD

@diagprov o_O

Adi

09:04

@RоryMcCune Yeah, I made sure mine faces the correct direction for the Seek

Rоry McCune

@Adi coolio, yeah mine does too but I noticed from the reviews that some don't...

diagprov

The idea is this: if I am running a DNS server, 99% of what my generic OS can do is pretty much a waste so to reduce attack surface let's make a DNS server out of a kernel.

Rоry McCune

@diagprov then shove it in a container for further isolation and bingo!

AviD

Oi @Xander! @Ohnana! What do you have to say for yourselves??

0

Q: Question moved on SO when i'm asking only about security risks

First i hope that my question isn't off topic here, i'm sorry if it's the case but i don't know where i should ask if it's not here. I'm asking a question about security risks and what i should do when adding a particular fonctionnality, yet my post has been moved to SO without any comments of w...

support

@TildalWave too, but you're probably just a victim of the herd...

diagprov

To summarize the disadvantages (joyent.com/blog/unikernels-are-unfit-for-production), 1) I can re-implement TLS in Scheme and I won't be vulnerable to the latest big-name bug, but there may be other bugs, 2) I've replaced the OS-Userspace boundary with VMX-VM boundary and 3) debug dat.

Rоry McCune

09:10

@AviD his original question wasn't brilliantly worded, but I understand what he was asking and it was a security not coding question

AviD

@RоryMcCune not even remotely coding

I dont object to the VtC, I am bothered by the migration

Rоry McCune

it's about allowing a user to "ping" arbitrary hosts/ports from the server's point of view as a connectivity test

@AviD it could've been salvaged

AviD

@RоryMcCune well, its back here now, so have at you

Rоry McCune

@AviD security.stackexchange.com/questions/116057/…

what about that?

Seem to be asking the same question and seems like a reasonable question to ask.

AviD

solid!

nevermind

Rоry McCune

09:30

and answered :)

Lighty

hmm

what is it with these repetitive questions

"Is telegram secure?", I see alot of these... "Is XXXXX Secure?"

AviD

@Lighty youre a repetitive question

Lighty

@AviD * you're

AviD

@Lighty youre an ass

Lighty

@AviD I have an ass

AviD

09:34

and, you're wrong - my spelling was correct, I dropped punctuation. Do you want to start correcting my capitals too? or uncorrect my proper usage?

42

Q: "Is (x) Secure" Question Anti-Pattern

A common problem that I see with questions is that they ask something like "Is (x) secure", which to me is an unanswerable question, the same way as asking "is the city north", it has no meaning in an absolute sense and requires context In order for a question to make sense the asker needs to pr...

discussion featured asking-questions

Lighty

@AviD I wanna correct your mood by giving you some coffee with a shot-glass of some dutch liquor

AviD

oo should go for coffee

Lighty

see?

Barry Carlyon

Someone mention booze?

Lighty

Now I wish I had a bottle of Baileys for in the afternoon xd

AviD

09:39

hey @Adi, since you're loving the US politics....

Last Week Tonight with John Oliver: Donald Trump (HBO)

►

deed02392

lol @MarkBuffalo you trolll

Adi

@AviD Yeah, I saw it. Generally good, but I disagree with the Drumpf thing

Fuck childish shit of that sort

AviD

@Adi still think thats funny

Lighty

10:07

I haz question, because I'm confused, bear with me here.

the new raspberry pi 3, has a new "64-bit" processor, alright?

but the websites say "Processor: 64-bit quad thingies ARM processor"

I thought ARM was alot different than x64

someone enLIGHTen me?

Rоry McCune

@Lighty x86-64 is a common name given to Intel/AMD chips which are 64-bit, other chips can also be 64-bit, but that doesn't make them x86-64 (en.wikipedia.org/wiki/X86-64 )

Lighty

Alright, so question is, since its labled as a "new 64-bit processor", the new Pi, does it make it capable of running x64 architexture stuff, for example, would anyone dump WIndows 95 on a RasPi 3, or run a nintendo 64 emu, such things

Arperum

@Lighty You're aware that win95 is not a 64-bit OS?

Lighty

@Arperum facepalms Forgot about that one, my bad

I think I was looking for something like XP SP2 or something then

Having a bad case of extended monday here xd

Rоry McCune

@Lighty no for ARM chips you need an OS compiled for ARM chips, or you need an emulator. Emulation slows things down a lot so you can only run older stuff typically. Nintendo 64 might be a possibility I guess, and I know that arcade emulators are a common use for Raspi2's

diagprov

10:20

@Lighty In really simple terms, you have two instruction sets at play here (x86 versus ARM) and THEN the bitness of the instruction set - usually in terms of register size.

It is entirely possible to have a 16-bit x86 processor; the first ones were.

Lighty

@RоryMcCune True, I run "RetroPi", a pre-compiled OS for the RPi 1 and 2 that has EMulationStation in it, alot of arcade emulators and such, but the N64 was hard to emulate because of the n64's ROM and processor architexture, thats why the question of the new RPi 3, since it's "x64", thus more or fully capable of emulating it

diagprov

So, this is about the new "ARM 64-bit", which is the ARM instruction set made 64-bits wide, roughly speaking, ignoring details of various kinds.

x86-64 is alternatively called x86_64, EM64T (Intel), AMD64, x64 and so on, just to keep everything really clear.

Lighty

ALright, lesson learned today, you have processor names/types, and then bitstructure

diagprov

@Lighty Yeah. It gets a bit more insane than that but basically yes.

Lighty

@diagprov I kinda hate it they didn't teach me this in class, would've loved to know this when I was doing my C# exams

deed02392

10:28

was 95 16 bit?

diagprov

@deed02392 Nope, 32-bit. However, it did have the ability to use VM86 to run DOS stuff.

deed02392

right, it had 'real' DOS mode right?

diagprov

@deed02392 Yes, I think it could also reboot into full DOS if needs be.

deed02392

that rings a bell! via the safe boot options?

diagprov

@deed02392 Yep and the DOS startup floppy you could make.

deed02392

10:30

or at least, you could create a DOS bootable floppy with teh built in format tool

ahh nostalgia

diagprov

@Lighty en.wikipedia.org/wiki/IA-32#Operating_modes explains some of the fun with x86. Not everything can cope with protected mode, so there is "VM86" where the processor kinda pretends to be in real mode.

Oh yeah and just for fun IA-32 = x86 in 32 bit mode, but IA-64 = Intel Itanium, not related to x86_64 but also 64-bits :)

and just while we're on the topic, even modern x86 processors contain a decades-old hack called the A20-line. If enabled the processor can address more than 2^20 memory, however by default it doesn't and you have to turn it on, otherwise you're stuck addressing a maximum of 1MB. wiki.osdev.org/A20_Line

but if you thought x86 was insane, ARM limits you to intermediate values of 12-bits wide.

So you can't do mov r0, 4096 for example.

Rory Alsop

11:00

Looks like Deep Web is about to go to commit...

area51.stackexchange.com/proposals/87978/…

AviD

proposed questions there look mostly like 101 or wikipedia q's, maaaybe some actual lmgtfy in there.

"what IS this deep web?"

"I've heard about derpweb in the media, how can I get on it?"

"is it even legal?"

"Does donald trump agree for me to use this?"

Rory Alsop

Yeah - exactly

I am baffled as to what we could have on an SE site on deepweb

AviD

I really really hope that to access deepweb.se you need to connect via the deepweb

it shoudl not be accessible on the regular web at all

M'vy

11:18

@RoryAlsop indexing ?

diagprov

and then

M'vy

so that in few month there's no more deep web

Rоry McCune

@AviD good call it Stackexchange.onion should be a thing...

diagprov

There is already tor.stackexchange.com

Rоry McCune

wait, so they're going to have Tor.SE and Deepweb.SE....

WTH

that's just clown-shoes

diagprov

11:23

@RоryMcCune ah yes, but we've heard about the deep dark web thing...

is it the deep web, or the dark web? Is the deep web dark? Is the dark web deep?

You see how confusing it is.

Matthew

11:38

Who turned out the lights?

2

Rоry McCune

?

Matthew

@RоryMcCune Exactly

SEJPM

@HenryWHHack @ThomasPornin only sleeps for a few moths in winter.

Adi

@diagprov That thing hasn't been killed yet?

More than two years in beta and it's a failure

What are they waiting for?

I mean, with such excellent posts that are on the front page for more than 12 hours

0

Q: crack before buy

if I crack a game before buying it just to test is that tor protect me 100% such as font problems just to be safe, I'll buy sorry after I speak French I 'm just a little shy , I want just testing the game , I already hack games on google but not tor and I do not want to have problems.

security help

Terry Chia

12:01

@Adi It's been 2 years already? wow.

It felt not too long ago where you were going on and on about how stupid that one was. :P

Adi

I know, right?! Remember when we were wishing that all of the people in the proposal die a slow and painful death?

and by we I mean me

Mark Buffalo

@deed02392 This is a tactic to drive traffic to a good question d:

Matthew

12:14

2

Q: Safe email validation

I have been using this RFC822-compliant regular expression for email validation. Pen testers on HackerOne have used the following horrendous email addresses which satisfy the regex: '/**/OR/**/1=1/**/--/**/@a.a [email protected]&a=////etc/passwd [email protected]&&a=a %00%[email protected] Are those email addresses valid? Ho...

email data-validation

In my close queue. I'm undecided

I quite like the examples of neat regex bypassing "email addresses", and think they're kind of useful to have here, but the actual question is probably programming...

Adi

@Matthew I've let this one slide

M'vy

@Matthew ahah

Adi

The question can be considered about RFC822-compliance in general, and the answer approach it from that point of view

AviD

@RоryMcCune area51.stackexchange.com/proposals/87978/deep-web/93884#93884

there are actually questions there about the difference and realationship between derpweb and tor

and yes, I have taken to calling it derpweb.

Matthew

@Adi Maybe a slight edit to lose the programming angle. Not sure who VTCed it, but currently sitting at 1 close vote. I VTLOed it

Adi

12:28

@Matthew Yeah, I don't think it's gonna get closed

Nobody VTCes outside the queue

Rоry McCune

AviD

@RоryMcCune ooh look who follows the same twatters as me

Rоry McCune

@AviD I got that one from Mark Wickenden

Mark Buffalo

12:53

@RоryMcCune lol

@RоryMcCune Reminds me of @kalina. I would totally expect her to do that

M'vy

Not really no

Simon

rekt

Transcript for