The DMZ

Simon

00:31

@RoryAlsop HEEEEEYYYYYY

I STILL DIDN'T GET MY SWAG DON'T DO THAT

Lucas Kauffman

Gilles

00:44

@LucasKauffman ain't nobody got time to read a book

I'll ask a question on Stack Overflow instead: “how i copy & paste from stackoverflow???”

Henry WH Hack

how do you upload photos here? anyone?

Mark Buffalo

@LucasKauffman lol

I love how the animal is a sloth

Henry WH Hack

sloth?

Xander

01:14

@RoryAlsop @AviD @schroeder @JeffFerland This user needs either a) a timeout or b) nuking. security.stackexchange.com/users/103440/user103440

Henry WH Hack

I did not do anything!

Thomas Pornin

01:54

@LucasKauffman Hello ! Weren't you supposed to send me something to review ?

Henry WH Hack

I am answering a question I can't tell if I am doing a good job?

<h1>Firewalls</h1>
A firewall is a software or hardware system that is placed between an insecure network and a secure network to control what goes in and out of your system based on a set of rules it blocks/deny unauthorized/malious traffic from entering your system and allow the good traffic you can also control what ports you want open or close in your firewall and configure the rules
<h1>Antivirus</h1>
An antivirus is a program used for preventing,stoping and removing viruses it works in three was there are real time protections,signature based and  heuristics

Rory Alsop

07:20

@Simon they do take 6-8 weeks. This was 8 weeks.

@HenryWHHack no. This post has spelling and grammar problems, and is not as "correct" as a couple of good answers already there. Please don't add another post that doesn't add anything new.

Rory Alsop

09:09

@Simon (not really doing it to annoy you ;-)

Lucas Kauffman

09:55

@ThomasPornin they only published the homework now, still need to do it :(

silverpenguin

10:09

omgerhd a llama

diagprov

11:15

@RoryAlsop They've got better swag these days.

Rory Alsop

11:36

@silverpenguin nah - that's Carl

THE llama

@diagprov the t-shirt is really nice. I'm wearing it all day today :-)

Llamas with Hats

►

NSFW

NSFL, possibly

NSFK, definitely

silverpenguin

@RoryAlsop this CTF game is hard im such a noob D:

SEJPM

@silverpenguin "If it were easy, everyone would do it."

silverpenguin

@SEJPM i know that haha! just thought I would have gotten atleast 1 flag by now

SEJPM

@silverpenguin well you've got another 1.5 days?

silverpenguin

@SEJPM something like that yes, though i fear if i continue at this pace the only thing i can do is be the SE teams cheer manatee

SEJPM

11:48

@silverpenguin not a role that should be underestimated

silverpenguin

I am captain negative haha! :P

SEJPM

@silverpenguin capneg?

silverpenguin

yup :< im sure i will get it ... just need to think D: i need some THC and a subway

SEJPM

@silverpenguin is there at least some fun crypto involved?

silverpenguin

@SEJPM about 3 bits of crypto have not even looked at that yet, slightly afraid of it

SEJPM

11:53

@silverpenguin are the tasks available openly?

silverpenguin

@SEJPM thebostonkey.party

have a look i think you have to register but its a couple of seconds

SEJPM

@silverpenguin with the "the"

silverpenguin

nope sorry

without the

SEJPM

lol, the certificate for ctf.bostonkey.party is valid from third march 2016 until first march 2016

silverpenguin

12:23

lol xD what

Rory Alsop

12:33

Maybe that's significant...

silverpenguin

12:45

its like i have found all the bits of a puzzle but i cant see how they go together .... frustrating haha

just found out i cant type faster than i can copy and paste :/ ffs

kalina

did you just xD

silverpenguin

13:04

@kalina whats wrong with that D:

kalina

it's not a real emoticon

Simon

@RoryAlsop :(((((((

kalina

whats yoru problem

Mark Buffalo

hello

kalina

o/

right I'll guess I'll sleep for a few hours before doing it all again

nn

Mark Buffalo

13:32

night

SEJPM

@MarkBuffalo what is the (current) canonical time?

Mark Buffalo

14:00

It's 9 AM

give it 'til monday

maybe monday evening

maybe longer

SEJPM

@MarkBuffalo oh, you mean our current / next question?

Mark Buffalo

ya

SEJPM

14:19

I was bored a bit so I added an euphemism answer to the secse memes

it's community wiki, so go ahead and improve it if you don't like something

Stu W

hi

Mark Buffalo

16:06

@SEJPM security.stackexchange.com/a/116564/87119

Does it look like he missed the point?

don't downvote, he has good points about identity protection services

kalina

16:47

downvoted

Mark Buffalo

yeah, he completely missed the entire point

kalina

do you even know what the point is?

the point is there isn't a single kalina star in the star list

this is greatly disappointing

Mark Buffalo

:8(

kalina

that's a strange nose

Mark Buffalo

WILDEBEEST NOSE

kalina

16:50

wild beast, huh?

sit

SIT

points at floor

Mark Buffalo

>|:=8|

Stoic wildebeest

kalina

disobedience must be punished

sets fire to @MarkBuffalo

Mark Buffalo

runs around in a frenzied state of panic

silverpenguin

17:49

i just ate way way to much KFC

hello new friends! (clearly i am fat and alone)

Mark Buffalo

fatty

We don't like fatties in here. [jiggles fat rolls]

silverpenguin

yup as fat as a manatee ... joke everyone knows tall people dont get fat

we just get taller

though i feel like i could rest my moobs on my desk if i wanted to

boob desk slapping sound

need more one peice T__T

Mark Buffalo

freak

Yeah, being tall, I can carry weight well... but it's time to take care of my health some more. d:

silverpenguin

18:09

@MarkBuffalo is that code for i am very very old and if i eat one more chicken nugget my wife will leave me?

Mark Buffalo

ha, she doesn't care

SEJPM

21:12

What a sad day in terms of traffic for the DMZ :(

Rоry McCune

@SEJPM Weekends are often quiet...

Mark Buffalo

21:51

very quiet, in fact

TildalWave

22:10

@AviD you around? Can you please check if these two are the same user security.stackexchange.com/users/103372/tod97 and security.stackexchange.com/users/103510/r00t (very similar questions, both new members,...)

@MarkBuffalo I was enjoying that :)

SEJPM

@TildalWave WHO ARE YOU TO ENJOY SILENCE IN THE DMZ!?

TildalWave

I'm The Man That Enjoys Silence in the DMZ, it's in my name, so I'm literally entitled to it :P

don't make me call Little Bobby Tables :)

SEJPM

@TildalWave ?

TildalWave

Her daughter is named Help I'm trapped in a driver's license factory.

Mark Buffalo

@TildalWave I hate this

sanitizing inputs is not valid anymore :'-(

Rory Alsop

22:21

@MarkBuffalo it's still valid. There are just other things you need to do that are more important now

TildalWave

@MarkBuffalo dude, don't be the last Smurf, it's meant to be humorous :P

Mark Buffalo

@RoryAlsop How? I mean, this is for SQL

PreparedStatements + no string concatenation = nice stuff

Rory Alsop

Add in input sanitisation and output validation to those two and you're golden

Mark Buffalo

Sanitizing a space before/after a text input field is ok because it's supposed to clear useless characters, but you aren't gonna drop tables through the input box using bobby tables if there's appropriate PreparedStatements, etc. Not unless you can overflow the buffalos, or find another weird exploit.

TildalWave

frankly, while I realize the difference, I still call that sanitization

Mark Buffalo

22:23

I do this: input validation -> prepared statements -> output sanitation

TildalWave

just for the simplicity sake

Mark Buffalo

validation = null / length / whitelist / regex

Rory Alsop

@MarkBuffalo yeah - that way round

I blame prosecco

Mark Buffalo

@TildalWave I know, it's definitely funny... but people keep quoting this xkcd and trying to say we should just strip apostrophes

TildalWave

erm, yeah, sanitation ... sanitization is ... something else

Mark Buffalo

22:25

they strip apostrophes, I input \u0027 and laugh as I bathe in the tears of insecure software developers

TildalWave

@MarkBuffalo man, Randall is funny, but he's not exactly a role model is he?

Mark Buffalo

@TildalWave Who is Randall?

TildalWave

unless you wanna be funny, in which case he's totally appropriate

Rory Alsop

Hahahahaha

TildalWave

@MarkBuffalo the guy behind XKCD

Mark Buffalo

22:26

I think the xkcd guy is pretty smart

TildalWave

Randall Munroe

Randall Patrick Munroe (born October 17, 1984) is an American cartoonist, author, and the creator of the webcomic xkcd. He and the webcomic have developed a cult following, and after leaving NASA, he became a professional webcomic artist. == Early life == Munroe was born in Easton, Pennsylvania, and raised as a Quaker. He was a fan of the funny pages in newspapers from an early age, starting off with Calvin and Hobbes. After graduating from the Chesterfield County Mathematics and Science High School at Clover Hill, a Renaissance Program, he graduated from Christopher Newport University in 2006...

Mark Buffalo

that xkcd was valid at the time, though

but now, no.

This is a good example of how fast infosec is changing

What's a good idea yesterday is a bad idea tomorrow

It's an ETERNAL STRUGGLE

TildalWave

@MarkBuffalo yes, he is, but he's also frequently wrong in his comics ... but that's OK, because they're just effing comics and they're too concise type humor to be correct in them

Rory Alsop

It's not a bad idea, that xkcd - it's still good. There is just more to it now

TildalWave

he's also often badly wrong in What If XKCDs that are article length, and that's OK too because he doesn't actually build rockets

Rory Alsop

22:28

But they do the important thing - getting people to think

Mark Buffalo

input sanitation is actually still valid if you do it right. problem is, it's hard to do right

Rory Alsop

Yep

SEJPM

@MarkBuffalo so let somebody else do it?

Mark Buffalo

You need unicode regex range validation to ensure you can only get ascii+symbols

silverpenguin

lol just googled quakers didnt know what they were before other than oats

now i know i am the opposite

Mark Buffalo

22:28

but the problem comes when you have Irish names. O'malley, etc. you'll have to account for those. It's much easier to just use prepared statements

TildalWave

in XKCDs, he's just a popular science aforista

I find them rather entertaining TBH

Mark Buffalo

ya

sometimes I am wrong in my posts because I mix up concepts.. this is why I love this website. someone will correct my wrong use of terminology, concepts, etc

It's a wonderful place to learn

silverpenguin

@MarkBuffalo prepared statments are the way forward but I have seen legacy code used with more recent prepared statments... things go wrong

Mark Buffalo

I suspect Randall has the same issue

SEJPM

@MarkBuffalo kalzumeus.com/2010/06/17/…

Mark Buffalo

22:30

@silverpenguin string concatenation, right?

silverpenguin

@MarkBuffalo more like it just breaks the statements lol xD

SQL injecting from the database

the enemy is behind the walls

Mark Buffalo

@SEJPM yeah, and then language. I worked on a multi-language search engine recently. what a challenge

@silverpenguin enemy is the employee?

silverpenguin

@MarkBuffalo yup, except just an idiot lol

SEJPM

@MarkBuffalo there was a really funny story about a person who actually broke some database system because of his / her name, I'm trying to find it now

Mark Buffalo

SEJPM

22:32

@MarkBuffalo hax

Mark Buffalo

@SEJPM yeah, I've encountered this a lot. Irish people, lol

silverpenguin

silly china...ocean is way bigger

Mark Buffalo

Irish are natural-born hackers

AviD

no Irish are natural born

hola

SEJPM

imagine your last name to be "null", does that sound like fun?

silverpenguin

22:34

if ($name != null)

Mark Buffalo

ya but "null" and null are different

silverpenguin

doesnt have to be in PHP

LOL

Mark Buffalo

if someone actually went if "$name != "null"), then roflage

silverpenguin

i havent coded PHP in weeks T_T and i already feel it slipping away from me

Mark Buffalo

I rarely ever do

silverpenguin

22:36

what code PHP ?

Mark Buffalo

fortunately, concepts are usually portable

Yes

Just recently, I learned OO PHP and a lot more procedural PHP

silverpenguin

PHP is my bread and butter sadly... I like it but as i said before I have dreams of being a pen tester but apprently im shit at it

Mark Buffalo

because... because... I felt like it?

AviD

@silverpenguin PHP never slips away, it haunts you for life.

Mark Buffalo

@AviD True. Look at @Simon. He can't escape the stigma... lol

silverpenguin

22:37

@AviD I know T_T you learn it when your 15 and your doing it for life

SEJPM

3726

Q: How do I correctly pass the string "Null" (an employee's proper surname) to a SOAP web service from ActionScript 3?

We have an employee whose last name is Null. Our employee lookup application is killed when that last name is used as the search term (which happens to be quite often now). The error received (thanks Fiddler!) is: <soapenv:Fault> <faultcode>soapenv:Server.userException</faultcode> <fault...

AviD

Flash + ColdFusion == WTF

Mark Buffalo

@SEJPM ....rooooooooooofl

The parser thinks it's actually a null value

@AviD Yeah, that's interesting

TildalWave

@MarkBuffalo $ween = mysql_escape_string($Simon);

who said PHP can't be fun? :)

Mark Buffalo

4

TildalWave

22:46

hahaha

AviD

@MarkBuffalo I actually had the displeasure of having to write the backend for a flash front end. SOOO many WTFs, its like they subscribe to PHP's philosophy.

Mark Buffalo

@AviD Yeah, I've done it too. :/

@AviD yo, check your thing message thing on the thing site

AviD

pffft

Mark Buffalo

imgur.com/gallery/qKoaw

AviD

lol

that 2nd one looks like the result of the ol' glue in shampoo bottle prank

Mark Buffalo

22:56

lol

@AviD Lol, one thing

cries in a corner

AviD

ALL 5!!

Mark Buffalo

YOU HAVE TO SCROLL DOWN

AviD

I TOOK ALL 5 THAT IT ASKED

Mark Buffalo

if you scroll down there's like a billion

but FINE

AviD

ohhh okay

I dont know, never went looking before

Mark Buffalo

22:59

ya a lot of people get hit by that

this gallery is priceless

silverpenguin

it kind of hurts me

seeing these images

Transcript for