@schroeder I also agree with this 100%. And I really want to try to bring this mindset to my net position

To paraphrase the good pastor, anyone who thinks that you can't advance with stunt hacking is squarely in the wrong.

@RoryAlsop just the one slight caveat: there was no moment where I was able to say "I did not learn this on my last job/in college".

And focused messing around counts. :P

virus.wikidot.com/morris

A lot of interesting information on a (very old) famous worm.

Specifically how its self-replication-limiting code failed and caused so much damage.

slashdot.org/story/18/12/13/1729249/…

HAHAHA

Well shit, apparently I've been here for a year already.

Just got my yearling badge.

Happy year-day @forest

So I decided I'll memorize a few cryptographic primitives for "preppy" reasons. I think I've settled on RSA and RC4. Now I just have to find a suitable PRF (hash)...

My daughter actually gave me the idea. :D

So I gotta find something that's easy enough for her to memorize too.

So I'm thinking SHA-1 or SHA-2 for the hash, but maybe I could go with DJB's stuff (so I could get away with only memorizing BLAKE/BLAKE2 and Salsa20, since they use the same core algorithm internally).

The biggest problem though is with RSA. In order to create a key with pen and paper, I'd have to get a big prime number. Miller-Rabin is not that hard to do, but searching for a prime among 512-bit integers can take hundreds of M-R rounds, or more...

ow..

head hurts

@TomK. what happened

alcohol

holy crap: youtu.be/2S_TXaGYD8E

I don't know (8

I wouldn't really be able to concentrate I guess

does anyone know a multi-user project management tool that is designed for infosec projects?

looking in your direction @RoryAlsop

@TomK. that's a good question. I don't think I have ever been anywhere that used one specifically for infosec. But then it shouldn't really matter, as security should be built in to every project anyway :-)

I have seen Jira, Basecamp, Asana, even Trello

well, "should" and "is" are really two different things :P

I did some googling but I did not find something that really caught my attention

I thought maybe you guys used something at RBS for sensitive projects that is a bit more tailored towards the needs of a - let's say - "high profile" infosec project

if I find something neat I'll let you know

@TomK. Interestingly, security improvement programmes at most large financial services organisations are run the way you would any programme

If you have sensitive things, you obviously manage data classification and access to that project, but there is nothing that needs to be different

Security, privacy, data protection etc should just be BAU for financial services

@RoryAlsop kind of disappointing but on the other hand also understandable

Well, there really isn't a requirement to do it a different way. Good programme management is good programme management

PRINCE2 doesn't suggest doing anything different. Security is one set of non-functional and functional requirements

Yup. I still think I have a few machines on openbsd

@J.J doas is their equivalent of sudo.

Check its manpage.

If you're on an older OBSD box, they still have sudo.

What is it you want to do? Tell if you can run as root?

man.openbsd.org/doas.1

Also see man.openbsd.org/doas.conf.5

You'll get used to doing it.

It's a lot harder if you have to RE some custom kernel module or some shit.

But usually it's just about looking for crappy configuration.

I haven't done either lol

I don't really do binary exploitation all that much :P

Though I'm trying to get more into Linux kernel intrinsics.

Probably. I just don't like it. :P

@J.J You play with a fuzzer yet?

aah

It's an OBSD box?

Do you need to get root?

What version of OpenBSD?

And did you look for the usual suspects (enumerate suid binaries, etc)?

And you managed to see what commands your user can run privileged with doas?

Nothing in doas.conf(5)?

You mean it didn't show anything?