The DMZ

silverpenguin

17:01

in

Simon

out

silverpenguin

PHP |:<

I have not programmed a real application in weeks im dying inside im too inexperienced to not program for this long

AviD

@silverpenguin so, just PHP then?

Jeff Ferland

My life has primarily become recruiting. Writing python code to do massive deletions from S3 is my happy place of relaxation this week.

... and dammit, deleting your backups is SCARY

silverpenguin

@AviD PHP(most experienced), JAVA, Android, python, bash. I have used many more languages but not that much

Simon

17:08

@JeffFerland Do you need a janitor that can code?

Jeff Ferland

@Simon Yes

Simon

o

I was not expecting this answer, I don't know how to proceed.

2

Jeff Ferland

Resume

Simon

Nah, I'm fine, thanks though.

Jeff Ferland

... but I'm hiring, and working here is nice... and dammit I'm hiring in a tapped-out field

silverpenguin

17:12

@JeffFerland I DO CODE pay me

Simon

@silverpenguin What an introduction.

silverpenguin

@Simon i am a man-atee who gets to the point, no time wasting

Simon

I can see that.

silverpenguin

@JeffFerland about that money

Mark Buffalo

@silverpenguin I did this in PHP, but PHP has too many gotchas

It's too easy to make mistakes

It's unclean and difficult to reliably debug

silverpenguin

17:16

@MarkBuffalo true, though i take things from other languages to improve my PHP common use things like try catches and such

Mark Buffalo

ASP.NET is far younger, and more powerful.

palpatines

Simon

try catch in PHP? Ain't nobody got time fo dat.

silverpenguin

@Simon whats wrong with that! its useful especially when working with PDO

Simon

pls my masterclass does all this.

silverpenguin

though obviously i syntax check all of my code using a coda plugin before running for the silly mistakes

@Simon my code i do is so boring and generic I want a complicated PHP task, ya know my brain knowledge feels outdated :(

Rоry McCune

17:19

@Simon lol, bluff called

Simon

RORO IT WAS AN HONEST MISTAKE

Rоry McCune

@Simon pls you got offered an SV job

Simon

I have been invited to send my CV to apply on a SV Job.

That's very different.

Rоry McCune

@Simon gotta start somewhere

Mark Buffalo

@Matthew Sad

silverpenguin

17:20

@MarkBuffalo you know my feelings? :<

Jeff Ferland

@silverpenguin It's good

silverpenguin

@MarkBuffalo i need to get out of this place before its too late

@JeffFerland what country? :D $_$

Jeff Ferland

@silverpenguin USA or Ukraine

silverpenguin

I am in neither of those places

back to the job pages

Jeff Ferland

@silverpenguin Which one are you in?

silverpenguin

17:22

@JeffFerland i am in england

would anyone else agree that tokyo japan is the best place in the world?

Jeff Ferland

I've never been, but it's on my list.

silverpenguin

@JeffFerland go, go now. its amazing e_e

Jeff Ferland

@silverpenguin Next week's trip is Athens.

silverpenguin

@JeffFerland I would go this soon again but i am going to rio in april

@JeffFerland i wana go to athens... i love greek mythology so interesting

0

Q: How to do a formal security proof model

i am needing to do a security proof model of bitcoin, but i have no idea where to start any advice would be great !, tutorials or research papers showing a clean and understandable security proof model would be ideal Thanks

threat-modeling

to broad?

Mark Buffalo

This pizza is incredible

NIKI'S in Detroit

silverpenguin

17:29

@MarkBuffalo you evil evil evil man

Mark Buffalo

@silverpenguin replied to the wrong dude, sorry. Meant to reply to Matthew

silverpenguin

@MarkBuffalo I guessed :P but even still you are evil you know i love pizza T_T

Mark Buffalo

One of our devs is taking another position fter ten years here

We're throwing him a party. We do that

silverpenguin

@MarkBuffalo so....there is a job going?

Mark Buffalo

We have a really good culture here, and good managers

silverpenguin

17:33

sold, train me up obi-wan

Mark Buffalo

No, this is in an area I'm not top familiar with, and I don't want it anyway lol

@silverpenguin What languages can you use?

Rory Alsop

For those Brits in here - who else is going to IISP Congress/CRESTCon tomorrow in London?

Mark Buffalo

@RoryAlsop See you there.

silverpenguin

@MarkBuffalo I can use any language if someone gives me a week of solid work but at the moment I can use (order of skill / experience) PHP, JAVA, android, Python, bash... though learning a language is easy peasy, just need a reason to use it

Im one of those people who cant learn something untill practically needed .... one of my down falls, made up by my aptitude

Mark Buffalo

Java

Rоry McCune

17:36

@RoryAlsop 'fraid I'm not getting along to that one guv :(

Mark Buffalo

Ok, so can you use sql?

silverpenguin

MySQL

Mark Buffalo

How do you prevent sql injections in java?

kalina

@MarkBuffalo foreword?

Mark Buffalo

@kalina pls you're the most skilled hacker in the room

silverpenguin

17:38

@MarkBuffalo to clarify, SQL connecting through the java app and not a back end API ?

Mark Buffalo

@silverpenguin yeah so in the code

kalina

@MarkBuffalo well I suppose I could just talk but I was hoping for some fun before the penetration testing began

Mark Buffalo

@kalina You can have plenty of fun

@silverpenguin Are you American?

silverpenguin

@MarkBuffalo I would saniatise the input (strip slashing) and prepare the statement before using the external variables. more detailed answer wanted?

@MarkBuffalo No i am english, but if i could get a job in the states i would move with a drop of the hat

Mark Buffalo

Why would you strip slashing before the prepared statement?

silverpenguin

17:40

all i need is a sponser (an offeR)

Mark Buffalo

And what's your definition of santizing?

Just stripping slashes?

silverpenguin

@MarkBuffalo Strip slashing as soon as possible is the best option to try and reduce the risk, I would strip slash at the start of a function no questions asked. my definition of santising is ensuring the correct encoding as well as stripping slashes keeping the format of the input to your desired format

Rory Alsop

@kalina erm.....

LOL in airport lounge - mildly embarrassing

silverpenguin

sanatising can encoding, slashes and in PHP with undefined types can even be a sneak boleen

Mark Buffalo

@RoryAlsop I burst into laughter earlier in front of my manager lol

silverpenguin

17:43

boolean

Mark Buffalo

Well I don't think stripping slashes is the answer

silverpenguin

@MarkBuffalo not the only answer

Mark Buffalo

But you're putting more thought into it than most

And have a decent amont of things down.

And so, let's see...

What do you consider input validation?

Rоry McCune

@MarkBuffalo letting it know that it's good input really and a worthwhile addition to the database

Mark Buffalo

Yup

But more deeply d:

Rоry McCune

17:45

@MarkBuffalo dude I don't think people here want to know about your "more Deeply d" :op

Mark Buffalo

@RоryMcCune I disagree. I like to go deep into things to discover hidden secrets, and more important things

silverpenguin

input validation im going to shorten it down: checking that is the format your require, though input validation can really spread from the requirments, doesnt have to be just about a naughty hack to blow up the system. can also be just unwanted formats strings, ints what ever it be. I would probably use some kind of regex to start with, throw in some type checking. it would really depend on the scenrio

Mark Buffalo

And so do others!

silverpenguin

@MarkBuffalo its such a large question I couldnt just specify my thoughts on it for one general scenrio

@MarkBuffalo unless the question is still java DB

which i now think you meant

Mark Buffalo

@silverpenguin null, length, format, white listing if necessary

Though regex can act as a whitelist

silverpenguin

17:48

@MarkBuffalo if anyone let a null in i would slap them

Mark Buffalo

Any DB you're connecting to via Java

silverpenguin

@MarkBuffalo also though having your DB set up correct also helps, though as being a team you would have to assume the other person is an idiot

but you can ensure nulls are not allowed in your table

Mark Buffalo

I'm talking about validating input before it even goes into the database

silverpenguin

@MarkBuffalo I know but I was simply adding. :)

Rоry McCune

@MarkBuffalo I think you missed the gag :op

silverpenguin

17:51

lets assume it was a credit card

Mark Buffalo

What if your database input requires slashes? Not very scalable or future proof

@RоryMcCune No, I think you did ;)

silverpenguin

I would check the black list for all cards which are fake / tester cards, run it through a check to ensure it validates as an actual card of defined type

Mark Buffalo

I'd let them all through. Am I insane?

silverpenguin

and if slashes were required I would encode them to an acceptable format to be stored in the database and converted back for readability

Mark Buffalo

Why encode before storing? Why not encode on output?

silverpenguin

17:54

@MarkBuffalo encoding before storing means you dont fudge up your database queries later, you dont have to worry just about incoming data but anything stored in the database, so you would also sanatise when the datacomes out also, just incase

Rory Alsop

Jeeeez - just gone through the blog dashboard to do my regular spam clean up. So. Much. Spam...

silverpenguin

dangers come from within as well as out

Mark Buffalo

If you encode on input, you have to build more complex queries around that input... so it's not future proof. It's not easy to work with, things break easily... your new programmers won't know how to handle that without being told

Rory Alsop

And all correctly identified by the anti spam software onsite - brilliant!

Mark Buffalo

Violation of data integrity too

It's better to encode your output. It's safer, simpler, and more efficient

@RoryAlsop ewww

silverpenguin

17:55

@MarkBuffalo but surely encoding special characters before putting them is the database is better? creating a resuable function to handle all validation inputs allows fo scalability and updating

Mark Buffalo

You could do that, but it's a lot of extra work for no benefit

I let everything go in as long as it matches the formatting

silverpenguin

@MarkBuffalo and lets face it no ones code is perfect, encoding and handling all specials characters mitigates some risk of character encoding exploits?

Mark Buffalo

Input validation first. Output sanitation when displaying

kalina

that moment when you're like EUGH Y U NO WORK and then you make a bunch of changes going in one direction, press play and automation resets a bunch of values and suddenly it's like :O that sounds good

#winning

silverpenguin

@MarkBuffalo I do agree with your point entirely though, it is interesting to get someone elses perspective

Ohnana

17:58

output sanitation fixes the case where your attacker has figured out a way to bypass input validation

eg, direct DB connection

bypassing output sanitization involves confusing the filter, which is easier said than done

silverpenguin

@Ohnana yea I know, but I had at one point when people with ' in there name really annoyed the statments

Ohnana

and if you're using standard libraries for sanitization, you can safely peg that as a non-issue

@silverpenguin ah, yeah that's a good use case for input validation

Mark Buffalo

I don't believe in input sanitation. Only validation

Ohnana

if you do both then it gets really hard to break :)

Mark Buffalo

@silverpenguin Ireland!

silverpenguin

18:00

@MarkBuffalo D: ? what where

are we blaming them?

Mark Buffalo

@Ohnana if you use input sanitation, your customers suffer. Your employees suffer. You have to train people to search for edge cases in the database

@silverpenguin Irish names have this issue often

diagprov

Paddy O'DropTables.

Ohnana

@MarkBuffalo i mean dealing with special characters so the database doesn't take a shit

Mark Buffalo

@diagprov bahahahahahahahahahahahahahahahahahaha

I'm dying

Ohnana

not sanitization but validating the string to make sure it doesn't break stuff

silverpenguin

18:02

@Ohnana this is why i sanatise inputs, and if i create a function which does this i might as well reuse

Mark Buffalo

@Ohnana ya, that would be validation

Ohnana

@MarkBuffalo if you read with your eyeballs, you'll see the words "input validation" in my messages

Mark Buffalo

@silverpenguin Sanitizing inputs is changing inputs before it goes into the database, leading to integrity issues

Ohnana

(ʘ_ʘ)

Mark Buffalo

@Ohnana ya

Sanitizing = removing something from the input

Only do this on trailing and ending spaces if needes

CodesInChaos

18:03

Mutilating is a better name

Mark Buffalo

Agreed

diagprov

@MarkBuffalo It wouldn't actually work, sadly, but y'know.

Rory Alsop

@MarkBuffalo - yay. I've only lost 3% to recap. I must be brilliant...oh...wait... :-(

Mark Buffalo

Mutilating input is wrong. Stop input mutilation!

@RoryAlsop But you are. I'm just psychotic with rep

silverpenguin

@MarkBuffalo I think i might be sounding like im over complication my sanitisation to much :P I would only be handling fearsome special characters. Ok i see your point now, your saying: if ($string == safe): ok else: satatise... well yea of course ... I thought you were saying if($string == safe): ok else: NOPE

I have been completely misunderstanding your point i think

CodesInChaos

18:05

Apply proper encoding as close as possible to use. Preferably this should happen automatically as part of a sane API (e.g. parameterized queries for SQL)

silverpenguin

brb gotta drive

Mark Buffalo

@silverpenguin over complication leads to insecurity

CodesInChaos

And in most cases invalid input should be rejected, not mutilated.

Thomas Pornin

@RoryAlsop You are 32% epic.

Mark Buffalo

@CodesInChaos What happens with nvarchar, etc? Multiple language input

CodesInChaos

18:07

@MarkBuffalo hm?

Rory Alsop

@ThomasPornin In time I'll reach 100% :-)

Rep Zen

Once I am at 100% the only change will be a new little badge... Ooooooo

Mark Buffalo

@CodesInChaos Character encoding

CodesInChaos

@MarkBuffalo Where is the problem? UTF-8 or if that doesn't work, UTF-16.

Thomas Pornin

@RoryAlsop It is the journey that makes it worth.

CodesInChaos

If the input is not valid unicode, reject.

Thomas Pornin

18:10

@CodesInChaos What ? I thought replacing bytes with '?' was completely fine. Microsoft does it.

CodesInChaos

There are a few acceptable transformations on input, most of them canonicalization of equivalent inputs.

Mark Buffalo

@CodesInChaos I consider format to check for this encoding, so yes

Thomas Pornin

@CodesInChaos These transformations are still a problem, though, because you never know which one a given system will perform or not.

Mark Buffalo

@ThomasPornin Agreed

It's too much to check for

There's always a simpler, more secure way of doing something...

silverpenguin

I have returned home!

Mark Buffalo

18:23

my ability to copy and paste have been... disabled

interesting.

TildalWave

@kalina say woot?

silverpenguin

Interesting points being made, as a developer i am not a stickler for how i do things if good alternative is provided (unlike some developers i know)

CodesInChaos

@ThomasPornin Yes, but I'm not willing to store integers as strings, just to preserve leading zeros, plus signs or thousands separators.

Mark Buffalo

@CodesInChaos validation catches this

CodesInChaos

@MarkBuffalo Of course you could reject them, but I think normalizing them is usually the better approach.

TildalWave

18:26

Cockta

Cockta is a soft drink from Slovenia. Its main ingredient comes from the dog rose hip. The other ingredients come from 11 different herbs, lemon and orange. It contains neither caffeine nor orthophosphoric acid. == History == === Origins === The origins of the Cockta drink begin in the early 1950s. It was then that the management of the company Slovenijavino came up with the idea of producing an original refreshing Slovenian beverage which would be able to compete against similar drinks from abroad. The chemical engineer Marcus "Potatinator" Daman, an employee of the Slovenijavino resea...

silverpenguin

I love a good technical discussion makes me feel good and tingly

Mark Buffalo

hmm, that post migrated to reverse-engineering

time to make it less vague

kalina

@TildalWave or cock, for short

Thomas Pornin

@CodesInChaos I was more thinking about Unicode normalization forms. For integers, you would reject the input values that you do not recognize; for strings, this means that some values are all acceptable but may be considered equal to each other, or not.

Equality status may even change when you update your JVM or .NET framework and a new Unicode standard version thus gets automatically imported.

TildalWave

@kalina no, not for short :P

CodesInChaos

18:30

string.Equals is an ordinal comparison in .NET and conversion to FormC as been specifies as not changing between unicode versions.

Ohnana

i have to say, smashing code is a lot more fun than making it

silverpenguin

@Ohnana thats why me want to be h4xx0r

CodesInChaos

Of course casing or unicode aware equality comparisons have those issues.

Ohnana

developing would probably give me a mental breakdown at all the stupid

Rory Alsop

@TildalWave potatinator

silverpenguin

18:33

@Ohnana its killing me inside at my current job. :( its the programming is not a challange. Im not learning and i like learning

diagprov

@Ohnana guaranteed.

Ohnana

@silverpenguin eeesh that sucks

silverpenguin

@Ohnana you dont even know.. im even made to write system scripts in php. Just saying.

Ohnana

@silverpenguin aaaaaaaaaAAAAAAAAAHHHHHHHHHHHHHHHHHH

dammit markup y u ruin my jokes

silverpenguin

Kill meh pls

TildalWave

18:36

@RoryAlsop haha yes it's been a long-running joke here that coke is made out of spud peels

Iszi

Mental Health Facilities, Divorce Lawyers, Oncologists <- Partial list of things few people you know will be able to provide referrals to, because everybody hopes to never need one.

Ohnana

damn

everything okay @Iszi ?

Iszi

Right now, I'm on 2/3.

The third was just an addition to the list I came up with off the top of my head.

Odds are, my wife's going to #1 this weekend if not sooner.

And I'm still not 100% sure whether I'm done needing #2.

Ohnana

well that's a shit sandwich

i guess it's good that you don't need #3

Iszi

Heh. So far. I've got this thing going on with my ear that Google says might need it. But that could just be what I get for using Google as a doctor.

Ohnana

18:42

yeah, see a real doctor silly

Iszi

I'd put Funeral Homes on the list too. But that has the unique property of being an inevitable necessity.

Thomas Pornin

@CodesInChaos Casing matters in X.509: DN are suppose to be case-insensitive.

There are RFC that define exact casing rules, imported from some older Unicode version (3.2, I think).

CodesInChaos

Casing and unicode is full of horrors.

Thomas Pornin

Of course, certificate processing software will usually use the language framework for Unicode casing, and will thus not match the RFC rules.

CodesInChaos

Amplified by Microsoft being dumb and using locale dependent operations by default for most but not all string operations in .NET.

Thomas Pornin

18:49

They were so intent on copying Java that they imported all dumb Java design decisions as well...

and added their own on top of that, for good measure.

CodesInChaos

Including the famous billion-dollar-mistake.

silverpenguin

well my internet is going at a thrilling 8megabits a second... how thrilling

games are going to suck

RoraΖ

19:07

I think this guy needs to rethink his network configuration

0

Q: Site to Site secure connection using SSL/SSH/TLS

I want to setup a any site to any site secure connection over the internet. I have 120+ sites that I want to enable for any to any connectivity. I don't want to use IPsec because that is point to point and I don't want to setup 120!/(2!*118!) connections for a full mesh network. Is there a way to...

tls

Mark Buffalo

5

A: Suspicious .js attachment

This is a Drive-by Download Exploit Attempt Pro-tip: when looking at any kind of obfuscated code for any language, follow this simple rule: Anyone who obfuscates code is either an idiot, a hacker, or both. In either case, you do not want this code running unless your job is to create malware...

@silverpenguin

I updated it because the previous answer was terribly low quality, and I'm scared the RE guys are gonna crap on me :(

TildalWave

@RoraΖ off-topic, spuriously inserting "secure" into it doesn't make it on-topic here

Rоry McCune

I see UK banks are getting a bit desperate for testers "Penetration Tester x 4 - Major Bank, internal role. London. Up £90,000 + Benefits + Bonuses"

albeit that's London

TildalWave

would "x 4" mean they require four of them, or is that some code?

Rоry McCune

@TildalWave that's looking for 4 testers

at the same time, in London

TildalWave

19:16

is that even safe? :)

Rоry McCune

I guess some of the banks are now using consultants so much that some bright spark worked out that hiring permies would save some cash

although not much cash with those kind of salaries

Mark Buffalo

@RоryMcCune Is that good in London?

TildalWave

well they do say "Up £90,000" which I'd presume stands for "up to", not "upwards of"

Rоry McCune

@MarkBuffalo anywhere else in the UK that would be a pretty good wage for a delivery role

Iszi

Wow. This type of answer really needs some sort of extra warning on the link to its revision history - or maybe just the revision history needs to be nuked.

Rоry McCune

19:19

However London is now apparently the most expensive city in the world

so perhaps not

Iszi

Maybe there needs to be a policy that users who get deleted for disciplinary reasons have all of their content completely wiped from existence unless it's been upvoted/accepted.

TildalWave

@Iszi I think there actually is

Iszi

@TildalWave I mean totally wiped - no rev history or anything.

Ohnana

@Iszi fill in the <10kers?

silverpenguin

@MarkBuffalo the RE?

Mark Buffalo

19:22

@silverpenguin Yeah, it got moved to Reverse Engineering

Iszi

@Ohnana A question of questionable SE-appropriateness was responded to with commentary towards the genitalia of the asker's mother.

TildalWave

@Iszi that probably won't happen, there's still a point in displaying nuked contents to privileged members ... like, I'd sometimes intentionally read those to feel better about myself :)

Ohnana

@Iszi haha i saw that this morning

we had a good laugh

Mark Buffalo

I laughed for anywhere from 8 to 14 minutes

lost track of time

TildalWave

see? It does good

Mark Buffalo

19:23

3

Q: Suspicious .js attachment

I received an email today with the following attachment, and I was hoping to see if anyone could help me understand what it was: //} Expose support vars for convenience support = Sizzle.support = {}; var tDPsXdcAz = ["iK"+"ou"+"D"+("appreciated","projection","layman","pKDO"), "gU"+"As"+("ceremon...

untagged

Iszi

@TildalWave There's sometimes that. But this is not that.

Mark Buffalo

Never seen that obfuscation method O:

silverpenguin

@MarkBuffalo im sure you will be safe! whyt would they crap on you!! im still trying to read through this JS code though xD i should put it into formatting to read it better

TildalWave

@Iszi yeah dunno, if it's resolved as offensive, it should display only with a warning and requiring to hit a link to display full contents, like it's done with spam

Mark Buffalo

I think I will try and reverse engineer the executable later

silverpenguin

19:25

@MarkBuffalo keep me in the loop i am really interested in this stuff... can you video it?

Iszi

@TildalWave If it's resolved as offensive, and the user screws up enough to be delete-worthy, I don't see the point in keeping the rev history.

TildalWave

@Iszi well, what can I say, it's SE ... mods have been requested to even not nuke users posting such contents but to suspend them so "the system" knows how to keep track and respond accordingly ... which of course only creates overhead (suspending takes time) and isn't done

Iszi

Dahell? Suspending takes longer than nuking?

TildalWave

maybe they'll even hire someone that can do flowcharts one day

@Iszi yes, a lot longer... often resulting in pointless arguments being exchanged and custom written mod messages being sent

you do that as prescribed a couple of times, then you give up

it only ends up in you being repeatedly offended for trying to prevent everyone else being offended by it

and if the person protests about the duration of the suspension, some random CM will step in and unsuspend the user so you can be offended more

silverpenguin

@MarkBuffalo hey you did forensic thingies. if a computer had embedded storage and no USB drives how would you back it up to do forensic analysis? (obviously wanting to mitigate the possibility of traps deleting content securely)

Ohnana

19:33

@silverpenguin if there's a way to mount the computer as a storage medium, there's a way to make a forensic image

of course, that's the hard bit lol

Mark Buffalo

^

silverpenguin

@Ohnana good this was my theory

Mark Buffalo

This is how I recover files on my android/etc devices

Ohnana

yeah just have one box that's your work area, and try to mount the computer like a hard drive

Mark Buffalo

The storage device is embedded... I just plug it in, mount it as a drive, and scan that drive.

Or image it, actually.

Sometimes I do not need to image it (personal stuff)

silverpenguin

19:35

@MarkBuffalo I have just been considering how to build a forensic proof machine

Mark Buffalo

Man, almost nobody uses Reverse-Engineering :<

@silverpenguin Thermite?

silverpenguin

@MarkBuffalo but still useable!!!

Mark Buffalo

You can't 100% account for anything... if I can gain unauthorized access to your machine, I can remotely image it

;-D

Ohnana

simple concept, make a storage medium that can't be a storage medium

alternately, use a live disk for everything

silverpenguin

@Ohnana thats what they tried to do with Iphones wasnt it?

Ohnana

19:36

and pop the memory out when you're done

Mark Buffalo

@Ohnana cold boot / ram forensics

There you go.

Ohnana

ya i know about that

do i look like an amateur

Mark Buffalo

But see, if you use a live disk, and those are usually not updated... for example, glibc is still afflicting many live cd images...

and there's an exploit....

I can watch you do something, and record it on my end

If you're going to such extreme lengths to hide yourself and stay private, intercepting your shipment of monitors/monitor cables allows me to implant a device that emits the contents of your monitor screen over the radio >:-o

silverpenguin

@MarkBuffalo I know of these things... im just thinking of standard taking the machine kind of thing

Ohnana

@MarkBuffalo if you pulled that off in a lab environment i'd be impressed

Mark Buffalo

19:38

Or if I spike your 8P8C cables with radio-emitting relay cables.

Ohnana

>:|

Mark Buffalo

@Ohnana It isn't that hard... it's kind of dumb... radio/bluetooth/whatever

silverpenguin

@MarkBuffalo I was just trying to think if there was anyway if someone the physical machine and wanted to do a forensics of it right there and then with backups... without blowing it up to shit... what kind of machine could stop this... you would need all of the hardware embedded and 0 usb ports... but you want usb ports... so how would i protect them?

Mark Buffalo

@silverpenguin Full-disk encryption with a gigantic password helps

But there are a lot of ways around that

TildalWave

@silverpenguin encase it in a block of ice-nine?

silverpenguin

19:41

@MarkBuffalo :P yea i know that one im thinking stopping the actual backup from happening

Mark Buffalo

Fortunately, there is a way to detect it. Keep your computer attached to a device that's battery-operated. When your computer case is opened, it will log the chassis opening entry

I've actually... never mind

Ohnana

@MarkBuffalo i've had something like that on one of my computers

it was a work computer

Mark Buffalo

@Ohnana I've had it triggered while not at home

:|

Multiple times

Ohnana

:|

Iszi

@silverpenguin See Law #3

Mark Buffalo

19:49

@Iszi I prefer more technical, in-depth explanations as to why those laws are true or not

Thank you for the link

Iszi

I still find the current title of that rather amusing: "TEN THINGS THAT WILL NEVER CHANGE (Which have changed at least once.)"

Simon

@Iszi "Law #5: Weak passwords trump strong security."

Trump really is everywhere these days.

Iszi

Heh.

Mark Buffalo

YOU DONALD TRUMPED MY STRONG SECURITY

Ohnana

@Iszi what's changed? that all looks pretty timeless to me

Mark Buffalo

19:52

wow

Iszi

Yeah, I can totally imagine this:

Good Guy - How the hell did you get in? I used AES131072 encryption!

Bad Guy - Yeah, but your password was "god".

Mark Buffalo

so the house I wanted went on pending status... a day after getting the down payment.

and.... what happens.......

Iszi

@Ohnana Exactly. I think it's mainly just the commentary that's been tweaked. But they still call the current one "Version 2.0".

Mark Buffalo

the bid was rejected. it's now for sale again. and I dumped the entire down payment on the little remaining amount of debt. lol.

Ohnana

@MarkBuffalo can you explain that for someone who's only rented?

Mark Buffalo

19:54

Well, the house was taken off the various listing sites

because there was an active, pending bid that was about to be accepted

...I've never seen that happen, but it pissed me off seeing it off the list

Ohnana

can't you just bid on it?

Mark Buffalo

the bid appears to have been rejected... or it didn't go through for various reasons. there may be something wrong with the house

yes, I can... but I don't have the money to bid on it

I spent it on my debt

Ohnana

ohhhhh well that's a good use for your money at least

Mark Buffalo

Yep.

Ohnana

now you'll be debt free in a different house

Mark Buffalo

19:56

I get the lowest rate possible no matter my credit score, so I don't have to worry about debt... but I do anyway.

Iszi

@MarkBuffalo Is that a VA thing?

Mark Buffalo

actually, the other person's bid was rejected. I can get the down payment again next week.

@Iszi No, Native American thing

In some cases, 1-2% APR (WTF), and $0 down.

Iszi

@MarkBuffalo Huh.

Mark Buffalo

I prefer to put money down because... I don't feel right about it.

Iszi

@MarkBuffalo I never feel bad about not making a down payment on something. They'll be getting more than enough from me over the life of the loan anyway. Literally, when you consider "enough" to be the actual cost of the thing you're paying for.

Mark Buffalo

19:58

portal.hud.gov/hudportal/HUD?src=/program_offices/…

Iszi

I suppose the only way I feel bad about not making a down payment is that it misses an opportunity to avoid paying interest.

Transcript for