« first day (3231 days earlier)      last day (22 days later) » 

8:24 AM
Good morning, hackers and hackresses!
Say, would it be enough for a server to support TLS 1.3, and for TLS 1.2 to only support TLS_ECDHE_RSA_WITH_AES_*_GCM_SHA* and TLS_DHE_RSA_WITH_AES_*_GCM_SHA*?
The only browsers that refuse to work with this setup are IE11 on Windows Phone 8.1 prior an update and Safari 6-8.
I honestly don't even care about IE11 on Windows Phone 8.1 or Safari 6. If you are on iOS 6, you are on an obsolete OS and that's not my problem
 
8:53 AM
@RoryAlsop Both XYY and XXY chromosomes happen in about 1 : 1000 births. Deformities in the hands and upper extremities happen in about 2.7 : 1000 births. When I say "Humans have 2 hands, with 5 fingers each", this is considered a normal and accurate representation of facts. When I say "Humans can have one of two genders, male and female", it is considered highly toxic and exclusionary.
But enough said about this topic. I don't want the DMZ to devolve into endless discussions about gender and the likes
 
@MechMK1 there is not only the case of XXY and XYY chromosomes that can change what constitutes your gender indentity. To deny somebody else the freedom of expressing their identity is just not comprehensible to me
 
@TomK. I never did so. You are free to express your identity, and you have my full support in doing so. My problem constitutes other people dictating to me how I see them. And if I can't agree on a common ground, then me refusing to interact is considered "hateful". No, I'm not hateful. I don't hate these people. I just don't agree with them.
 
9:09 AM
In my opinion your statement makes absolutely no sense
 
9:22 AM
@MechMK1 btw, regarding this: you should definitely only support sha-2 as an HMAC, and can also support CBC mode if you use an Encrypt then Mac extension - which I believe should be available by now
 
9:42 AM
@TomK. Very mature indeed.
 
10:12 AM
@MechMK1 Yo! It's been a lot quieter around here with you gone for the past few days. Where ya been hiding?
 
@ConorMancone Just had two wisdom teeth removed, and I really wasn't feeling up to par
But I'm doing better now. I can chew again, so I can finally eat something other than cold scrambled eggs and cold soup
 
10:36 AM
I really dislike your tone on essentially windows nt framework and web standards. Which is very common in this google era. The fact is some problems the most optimal solution was discovered fairly quickly and in the 90s. The idea that because something is dated has no effect on its utility, it could still be the plain and simple solution, and people still yet again aren't getting that simple concept. Also web standards too. Like tcp, it solved a concrete finite problem back in the 80s, of a server/client bidirectional lossless logical connection. But then google ignores it, and re-invents... — marshal craft 9 mins ago
The wheel, with quick, and waists everybodys time and makes no effort to work with standards, or to reach any kind of concensus with hardware oems, software, etc. Instead hoping it can throw some 1998 intel Pentium 4s it dug out of nyc garbage dump, throw them in windows driven pcs, let uefi browser script do everything (thanks intel, Microsoft, everybody else for agreeing on uefi for google) so that google can craft out a pathetic market nest. And again lets remember that google would never of been possible if it weren't for windows, Microsoft and standards. — marshal craft 4 mins ago
What is this guy on about?
His recent track record seems less than stellar as well
 
11:27 AM
@TomK. I support SHA256 and SHA384. Why would I want to support CBC-Mode though? It is slower than GCM (with AES-NI, at least) and is not known for its security.
 
12:19 PM
@MechMK1 That's quite the rant. Doesn't sound like someone that it's worth getting into an argument with. There are enough fun discussion to be had, so in my experience there are plenty of times when the best option is to just ignore
 
@ConorMancone You're probably right
 
The internet is filled with crazy people. Then again sometimes arguing with them can be an entertaining and informative experience on its own, so do whatever you want :)
This is what we call terrible security. I genuinely wonder how many sites like this exist on the internet...
 
Wow, let me read that
Also, here are some more mini photos if you are interested :D
https://imgur.com/a/8Ny2rEt
3 of mine, one from my gf
 
(painting)
How long have you been doing that?
They look great.
My biggest desire in life is to one day have a skill that doesn't involve a keyboard
 
12:34 PM
I've been doing that since june this year
So 4 months now. I never did anything creative before
 
Wow, that's pretty crazy. I don't think I could ever manage that well, but if I did I feel like it would take a few years of practice.
 
No, please don't think that
I am not "special" or "talented" in any way. All I did was watch some YouTube videos on how to do it
I also "painted" some Space Marines before, which were much smaller models. I just painted them blue, but it helped me get a feeling for the brush and the paint
 
I think I just figured out where schroeder got his name from?
Michael Schroeder is an American computer scientist. His areas of research include computer security, distributed systems and operating systems and he is perhaps best known as the co-inventor of the Needham–Schroeder protocol. In 2001 he co-founded the Microsoft Research Silicon Valley lab and was the Assistant Managing Director until the lab was disbanded in 2014. == Early life and career == Schroeder was born in 1945 in Richland, Washington. He did his undergraduate work at Washington State University and went to graduate school at MIT, obtaining his PhD in 1972. Starting in 1976 he has been...
 
My favourite line regarding starting is: "When you first start painting, get yourself these three washes: Nuln Oil, Agrax Earthshade and Seraphim Sepia. They are literally liquid skill in a bottle and make everything look better."
@ConorMancone [Mysterious saxophone music plays in the background]
But if you're interested in starting miniature painting, I can give you some "low skill, high impact"-types of advice that'll help you avoid the mistakes I made. Even if it's just stuff like "Always pull your brush, never push it"
 
@MechMK1 Although Michael Shcroeder is still alive... /hmmmm
 
12:43 PM
I like to call him schröder just because :D
 
@MechMK1 My 11 year old is actually getting into painting lego mini figures, but unfortunately with a 6 month old floating around I'm a long way from having spare time.
 
@ConorMancone That's completely understandable
And painting lego minis is great. Ever considered buying miniatures to build and paint? Something visually more interesting than a lego mini?
 
@MechMK1 That's a good idea, not sure why it never occurred to me. I'll suggest it.
 
Is s/he into anything specific? Swordsmen, superheroes, robots, etc.?
Also many miniatures need to be assembled first, which likely needs a sharp hobby knife. Parental guidance is advised. (Possible father-child time incoming :D)
Like for example, a model like this looks impressive, has 5 parts to glue together, and isn't otherworldly expensive.
 
12:59 PM
@MechMK1 star wars, lol! He's obsessed. He paints star wars lego minifigures to match specific people from the various star wars tv shows. I'm sure he could find more items of interest though
 
I'm 100% confident that there are more than enough star wars miniatures
For example, there's a miniature game called "Star Wars: Legion", which has minis that look like this:
Most miniatures come in sprues though, which means that you'll need a flat-sided cutter and a hobby knife to assemble them
And the many cuts in my thumb can attest that the hobby knife is very, very sharp
 
1:27 PM
Huh, I really didn't think they would have star wars mini figures. I'm not sure why I thought that... may have to just get him a bunch of those for Christmas (he has some experience with hobby knives and hasn't sliced himself open yet
 
It's just a matter of time, trust me. But teaching him how to use a hobby knife is a good thing
You will likely also need to spray the miniature. Get yourself a can of black aerosol primer. If you just paint directly on the plastic, the colour will not stick well
 
hey
I'm unbanned
 
Welcome back
Mature as always :D
 
1:57 PM
3
Q: Suspicious connections coming from Firefox (possible malware)

botnet437I was playing around with Wireshark when I noticed something very suspicious: every time I open Firefox (official build from Ubuntu repos), it immediately connects to a server with an apparently random name like d2ddoduugvun08.cloudfront.net and sends some encrypted data. I couldn't find anythin...

 
You two are hilarious. That name reminds me of this
Boaty McBoatface is the lead boat of the Autosub Long-Range class of autonomous underwater vehicles (AUVs). It is used for scientific research and is carried on the research vessel RRS Sir David Attenborough. Boaty McBoatface is owned by the Natural Environment Research Council (NERC) and operated by the British Antarctic Survey (BAS). Because of its complexity and its extended range, NERC is classing it as an autosub long range autonomous vehicle. == Naming == The name Boaty McBoatface was originally proposed in a March 2016 online poll to name the ship that would eventually be named RRS Sir David...
 
Yeah, the original was funny, but the derivatives are just so boring. Memes are about creative repurposing, not just mindless repetition
I really love the creative uses of Loss. It was a meme that got so much creative use. People would rearrange books in a bookcase, write music, etc...
But recently, people just post memes titled "lol it's loss" and just in-your-face post the meme
 
2:37 PM
3 major VPN providers compromised back in 2018
 
unbanned again
oh hey Benoit!
 
Oh hey Tom! Why were you banned?
 
I was trying to make a point <:
It's not that important really
how are you? long time no see
 
@BenoitEsnard I have never been too keen on the "VPN hype". PR campaigns like "Use our product to stay safe from evil hackers" is far from technical reality and that alone disqualifies them
Imagine you'd sponsor me to talk about engine degreasers. I know nothing about that sort of thing, so how can you expect me to make a good judgement about which degreasers work well, which don't, and what kind of benefits degreasing your engine gives?
Then why would I listen to people who make skateboarding videos to sell me VPN software. How on earth would they know what it really does, what problems it's supposed to solve, etc.?
 
2:53 PM
@TomK. I'm fine, what about you?
Going to London in the next few days! :D
@MechMK1 Haha, in France a lot of Youtubers are sponsored by VPN providers, and tbh it's really funny
Every single one of their videos is sponsored, so that really sounds like a joke now
 
I'm pretty okay. Job is pretty crazy right now, that's why I don't really have time for SE
or CtFs for that matter
 
@BenoitEsnard Yes, many YouTubers I watch are sponsored by NordVPN too, and it disgusts me how that company tries to scare people into buying their stuff
 
I need a shortcut for "VTC -> Off topic -> Questions that ask to break the security of a specific system are off topic unless..."
 
@ConorMancone [insert greasemonkey meme]
 
@TomK. Crazy job == job security! Although crazy job for too long == crazy person...
 
2:57 PM
"You like the internet, right? Well that means that EVIL HACKERS IU GONNA STEAL UR DATAS!!!!!! unless you buy NordVPN"
 
@MechMK1 just btw, I find it quite interesting, that you think it's immature if I do not call you by your chosen name, but do not want to use people's preferred pronouns ;)
@ConorMancone Yeah, sure. But I knew that when I got into info sec. So that's not really a relief <:
 
@TomK. Are you still going on about this?
 
Am I forbidden to say that I find things interesting? ;)
 
@TomK. Actually having second (last?) interview for what would be my first official info security job. Trying to transition more fully into security instead of engineering. So tell me know if my personal life will disappear, because I got 5 kids and no time for that!
 
or in other words: why wouldn't I? you didn't stop being you, did you?
 
3:01 PM
You are free to express yourself in any way you like. I just expressed my amusement that this issue touches you so deeply
 
@MechMK1 I don't think I read that the way you meant it... (I'm pretty sure I should just give up being human now)...
 
@ConorMancone Info Sec can be nice though, especially if you can do remote work or choose your schedule
@ConorMancone Don't worry about it :D
 
@ConorMancone well, it only does, if you let it. If that sounds kinda cliché ... it is true though. you have to work on your "work-life balance" because there's always more to do
 
@TomK. It's true though. And in the end you hear people "I wish I spent more time with my family" and never "I wish I had spent more time in the office"
 
@TomK. Indeed. Trying to gauge the expect work-life balance from a potential employer is high on my list during the interview process.
 
3:04 PM
@MechMK1 It touches you so deeply, that you refuse to call people by the pronoun that they wish to be called by. I just got banned twice for calling you another name. And you did not find it funny (;
 
@MechMK1 depends on the family...
 
@TomK. Not by my hand though. I couldn't have cared less
@ConorMancone true
 
not the point of my argument
which you are evading for 5 minutes now
 
@TomK. You implied that it somehow annoyed me. It didn't
Can you maybe state your point more clearly?
 
@MechMK1 Out of curiosity, which country are you from?
@TomK. Yeah, same for me. Hopefully it will get better soon. :)
 
3:09 PM
@BenoitEsnard Austria, why?
 
@MechMK1 I wasn't sure how much countries nordvpn were targeting with their ad campaign
 
Unfortunately the automated system removed it from chat. I drew a comparison, that calling someone something that this person does not want to be called can be at least annoying and maybe even hurtful. To make this more clear, I called you another name - analogous to a pronoun you would not prefer. And as I speculated you were annoyed, calling it immature.
 
@TomK. You are mistaken. Me calling you immature is not me being annoyed, it's me being amused by your, well, imaturity
@BenoitEsnard I don't think it's too far-fetched to assume they target at least the US market (given how many US YouTubers they sponsor) and the EU
 
Okay, Klaus.
@BenoitEsnard you still in webdeveloping?
 
@TomK. Yes! Still using PHP. :D
 
3:13 PM
jeez, didn't you want to change at some point? <:
or are you waiting for that point in time, where PHP is the new COBOL?
 
PHP is still very interesting to use imo
 
COBOL is the new COBOL and will probably be for the next decades to come
 
I don't feel as efficient in the other languages as I am with PHP yet
 
you probably will never be, right? you are doing PHP for years now, aren't you?
urgh... gotta go
bye
 
@BenoitEsnard I'd take PHP over javascript on the backend any day. Backend javascript has got to be the worst idea anyone ever had. Although, these days its more ES6+ or Typescript, which is much more reasonable. But whoever looked at ES2015 javascript and said, "man, I wish I could use this for my backend too!" was just crazy
 
3:17 PM
@TomK. Yeah, it's gonna be hard. :P But not having to look-up the documentation every 5 minutes should be enough
 
@BenoitEsnard Same with me an C#. It's my go-to for most programming problems, unless I can solve it with a bash one-liner
 
@ConorMancone Back-end JS has its uses imo (chat servers for example), but if your backend has different goals, like rendering full webpages, something is wrong to me
 
for i in a b c d e f; do ./run-some-script.sh --with "some args" -h "$i" -o "${outdir}/${i}-report.txt"
 
@MechMK1 Haha, of course
 
I mean, I get that some people just love to write beautiful python scripts that are maintainable and put them on GitHub and yada yada yada
But 99% of the time I just want to get shit done
 
3:21 PM
Each languages has pros & cons anyway, you just need to know them, mix them with your own experience & judgement, and use the right tool which fits your needs
 
Absolutely. But my job is more to break and less to build, so I can get away with writing crude code that just needs to work once
0
A: How do you perform SQL injection on a login form that checks for email address format?

Mr. ToxicManIt depends on the confidence of the issue reported by burp, when the confidence is certain, a complete payload for you to reproduce it is provided, usually a sleep command. If the confidence of burp is 'tentative' that usually means the original command and the same command with a ' return diffe...

Am I wrong or does this not answer the question?
 
I don't understand why the question is voted to close, this feels quite generic to me
 
The question is fine by me too.
> ...unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.
Which in my opinion this question does.
Anyways, I'm off to paint more minis. I am seriously considering just yeeting one of the two and getting a different model
Have a good day
 
Have a good day too!
I've answered the question, but imo the question in the title isn't the real problem
Hey @HamZa! :D
 
@BenoitEsnard hey, how you doin?
 
3:36 PM
I'm fine, what about you?
 
okay-ish
too busy lately
a few weeks back i was in Melun for work
visited paris to meet a friend, and in the weekend i went to Rennes to meet 2 other friends. Occasionally also visit St-Malo, quite nice there!
 
Because of work? Or personal stuff?
 
mostly work
and personal since i want to improve my work environment
been trying to come up with ideas/tools/blogposts lately
 
I still have to start my own blog... I'll be procrastinating a few more years I guess
That's a lof of different French cities! :o
 
that's what i did too
but my friend suggested me to pick up any platform and just write, so i did
now i'm using git pages, works good
and i've been writing down random ideas in Todoist every now and then, since apparently i forget them too often :P
 
3:41 PM
I'm planning on using GitHub pages, but I still need to find a good domain :P
 
@BenoitEsnard i had the same problem, so i just opted for "last name (first letter)+ first name"
besnard.me <- done!
now go write :P
 
Haha, that's ugly :P
I've already listed the articles I want to write about though
That's already half of the work right?
 
right
 

« first day (3231 days earlier)      last day (22 days later) »