The DMZ - 2019-12-20 (page 1 of 2)

« first day (3291 days earlier) ← previous day next day → last day (1600 days later) »

1:37 AM

@Fermiparadox Do you mean Stackexchange? "Sufficient" depends on what your goal is. The IP address contains geographic information, which may be useful in some cases. If all you want is matches then you don't even need IP hashes - you can just record connections and hide IP info all together. I'm not sure what their goal is so I can't say

5 hours later…

6:49 AM

@ConorMancone Yes, I meant SE. About connections like voting each other you are right, they can get it through other means. My guess is they use the IP to identify multiple accounts of the same user, when said accounts display no connections (voting) between them. Geographic info can be provided by the system.

Is there a word in Info Sec for: "providing the user only what he needs in order to reduce risk"?

1 hour later…

Anonymous

8:04 AM

Morning.

Anonymous

I'm having a fucking nightmare right now.

Anonymous

FFS.

Anonymous

0

Q: Why do buses not require passengers to wear seatbelts?

Lately I have been wondering why in the UK public buses do not require that the passengers wear a seat belt? In-fact, in the UK it's my understanding that no public buses actually have seat belts. I also have the same understanding of private coaches. While most private coaches do come with seat ...

united-kingdom traffic

Anonymous

8:33 AM

Wow it's quiet this morning... Too quiet.

9:26 AM

YOOOO WHAT'S UP!??!?

@Fermiparadox Not really, because there's only 2^32 IP addresses in theory, and much less in practice (private blocks, etc...)

So about 31.78 bits of randomness

If it's not salted, you can just make one database

And you can get even better results if you can make some educated guesses about a user's origin

E.g. if a user speaks japanese, try the japanese IP ranges first

Anonymous

When I say nightmare what I mean is, stupid devs doing stupid things.

Anonymous

You know like... Uploading an excel file to a dev environment with the passwords to the prod environment and then making it publicly listable.

Anonymous

Shit like that...

Anonymous

Well, exactly that.

Anonymous

Exactly fucking that.

Anonymous

9:33 AM

FUCKINGFWFWDFWDFWEQFWQEF

Anonymous

God dammit.

Anonymous

Sorry, I got a little upset thinking about it. But yes, what a nightmare.

That's a paddlin'

Anonymous

In lighter news I had 2 hours sleep and I feel fucking great. In other lighter news, I'm going to start my OSCE in February, I think

Anonymous

Need to pass it before I hit 20 years (old) so I best crack on with that.

Anonymous

9:42 AM

Is there anyone who's particularly versed with Jekyll here, by the way? I'm trying to figure out how to do something but what I want specifically doesn't seem to be on the Internet.

Anonymous

Nevermind.

Anonymous

10:15 AM

"I'm just so sick of backing down that I might just spill it all and if I do you won't be coming back without a deep scar in your soul" <333333333333

10:42 AM

@MechMK1 yes, a person with the know-how can get a lot of info even with limited info visible to him. But this change can limit the risk. Now i m not much of an infosec guy, but if i understand correctly.. IPs can be replaced by hash (+salt) plus additional info on general geographic location. Sure, the SE as a website can see the IP, user-agent and other fingerprinting data, but wouldn't that limit the personal information available to a mod only to what he truly needs to do his job?

@Fermiparadox Yes, but here is what I was trying to say

1.) The purpose of offering this feature is so that mods can see when one physical user with two logical accounts has the same IP address

2.) As a result of 1.), you can't add a salt. It would mean that two identical IPs would hash to different hashes, meaning a mod can't tell if two users had the same IP address

3.) Space of IP addresses was limited. I could tell you the sha512 hash of my IP is

FE52E75FFE6EA863C37038A669B151E4C2124E0D9D4C909652DB9643724F1B2AE7FFFBEB0487ACF40EA7F17DC32301AF326B5FA6C9579C662353A67567FFB4FA

On the surface, this looks safe. Until you realize that this data only has 31.78 bits of entropy. Meaning that I could create a long table of hashes for all public IPv4 addresses

Anonymous

11:16 AM

@MechMK1 You want to hear a developers excuse for making a terrible password and uploading the file with the password in it to the Internet?

Anonymous

"The system is currently in testing, this will be changed when the system is launched" you know, it's almost as if he's never heard of a SSDLC. Secure Software Development Life Cycle.

You don't even need to start with SDLC

Just say "The password to a production system is considered highly confidential. How highly confidential data is processed can be found in policy X section Y. Uploading the file to be visible in public violates this policy.

Anonymous

11:37 AM

It's just ridiculous man.

Anonymous

There is no excuse for uploading passwords to the fucking Internet.

Anonymous

No matter what state the system is in, it's about habit building.

Anonymous

Doing it once means you'll do it again.

Anonymous

Man, I forgot how much I love Dire Straits.

Anonymous

You get a shiver in the dark its raining in the park :D

11:53 AM

> Doing it once means you'll do it again. That means you're a liability, Matt. And you know our company doesn't need liabilities.

JJ says as he quietly cocks his silenced Welrod. Matt knew what was coming for him, and he knew fighting it was useless. They would find him. JJ would find him.

A silenced puff was heard in the office. People knew better than to look up.

Journeyman Geek

12:20 PM

0_0

AT LEAST Matt was done in with a ~~classic~~ antique

@MechMK1 and SE has a pretty liberal policy on proxies

and... sometimes...*cough*

I need to check if that info is publicly available :D

@JourneymanGeek Proxies should be allowed IMHO

Speaking of proxies, I just found out chrome extensions are not allowed to rewrite the Host: header in Chrome. I had to set up burp to do it for me

Journeyman Geek

@MechMK1 more or less, your IP isn't a proof of anything :D

@JourneymanGeek It should never be. My IP could be your IP tomorrow

Journeyman Geek

@MechMK1 pretty much

Which makes me question why mods need to see IPs at lal

all*

Journeyman Geek

12:35 PM

@MechMK1 oh... there was this one case

We had a troll with really poor technical skills

We used to knock out his account the moment he started messing around cause the MO and IP were almost always the same.

Kinda went on a few years until...

the poor chap decided to mess with lounge c++

MO?

Journeyman Geek

.... We haven't seen him since

... that latin word

I'm a bit confused

Journeyman Geek

modus operandi!

Ah okay

Journeyman Geek

12:37 PM

He would ask kinda meh questions, get 20 rep, get into chat, start helpvampiring, then suddenly escalate to cussing us out

What a strange individual

Journeyman Geek

Had like 20 accounts

Most of which never hit 20 rep

and often got nuked :D

Isn't that like 2 upvotes?

Journeyman Geek

he asked questions so...

took a little longer

Man, I don't know if I should be glad he's gone or feel sorry for the chap

Journeyman Geek

12:39 PM

.... Both

One can have sympathy for someone so sad he spends his time at home trying to make life miserable for others

and failing

and yet, which they would find something more fulfilling in life

Anonymous

What the hell did I come back to?

Journeyman Geek

Murder, classic firearms, and old trolls

To summarize: Nothing has changed

Man HTTPS over SSH over VPN is so slow

Journeyman Geek

12:58 PM

0_0

One would suspect so :D

But man, just think about the security :DDD

Journeyman Geek

Old master once say, the best security is airgapping your PC. Then putting it in a shredder. Then encasing the shredder and shreddings in concrete, then dropping it in the sea, then blowing up the planet.

But that turns availability to 0, thus reducing its value to 0 as well.

Journeyman Geek

But perfect security!

But availability is part of security.

Journeyman Geek

1:02 PM

But there would be no one left for the system to be available to

@J.J I had a system once that was a brand new addition and "just" in testing. After poking around for a day the boss approved and immediately sent an email to the entire office sending them the URL and instructing them to start using it immediately.

Me: Uh, I thought we were just in testing. I was hoping to do a few more things before we officially called it "live". Fortunately I believe in securing test environments as well as production environments, because if I had a list of "must happen before going live" I never would have had a chance to do it.

Your boss sounds like an enemy implant :D

Which is my long way of giving another reason why the attitude of "don't worry, we'll fix this before we go live" is a terrible idea. 90% of the time you are too rushed or forget and it never happens.

I'm really sad that "End of the Endless Night" is such an amazing album name and the album itself is just mediocre

@ConorMancone Or you actually have a strict procedure what must happen before going live

@MechMK1 :) I've learned a lot from him, good and bad. I've learned a ton about managing people and running a team/business. I've also learned a lot about how tech projects and security actually goes for 90% of businesses out there.

1:09 PM

Imagine an album who's theme is things that are too horrible to be even imaginable. And "End of the Endless Night" is a metaphor for things that are not supposed to happen or even be possible

As a result, frequent data breaches just make sense to me - I'm surprised it doesn't happen more often

@ConorMancone It does happen more often. The companies just don't notice or admit it

@MechMK1 That would be the answer in places that have a practical emphasis on security

@ConorMancone As long as those guidelines are reasonable

One of our customers has a guideline that every internal app before going live must be pentested

@JourneymanGeek So perfect availability!

Journeyman Geek

1:10 PM

EXACTLY!

Related note, I used to be part of the group "People for the voluntary extinction of the human race" but I have since decided that their methods aren't effective enough. As a result I started a new club, "People for the involuntary extinction of the human race". It sounds like your friend may want to join...

I'm Chaotic Neutral, can I join?

To be honest, how can you not be chaotic? :D

Anonymous

@ConorMancone As do I.

Anonymous

Man, I want it to be April already.

The concert?

1:21 PM

@MechMK1 100% lawful good. The trouble is that people aren't, so nuking everything is the only way to make sure the rules are properly followed. /Perfect logic

Anonymous

Yes.

Anonymous

I am so fucking excited.

Anonymous

I am just listening to all of their songs on repeat.

Oh my, that reminds me of such a horrible joke that i can't publicly say in the DMZ :D

Anonymous

Say it.

Anonymous

1:23 PM

Journeyman has gone.

Anonymous

:)

Anonymous

lol

So yeah, if I am silent for 30 minutes now you know why :D

Anonymous

HAHAHA

Anonymous

Man, I want to make my blog cooler.

1:24 PM

Apparently my real life goal is to become a super villain. Learned something new about myself today...

I'm not a super villian, I just want to see everything burn to the ground for the fun of it

Which is the path nature takes, I am just accelerating it

Calm down--there were lots of arthropods living on your skin already. These ones are just bigger.

Anonymous

Okay I've decided.

Anonymous

February I start OSCE.

I wish you good luck for that!

Anonymous

I am very nervous.

Anonymous

1:27 PM

(That I will fail miserably)

Anonymous

But, I gotta' do it.

And you can and will do it

Anonymous

I hear it is ridiculously hard.

Anonymous

But, I'm going to try and do it in 30 days.

It's funny, judging by the song names, "Embodiment of [the] Scarlet Devil" could be a horror game as well

Anonymous

1:32 PM

My favourite song title is "I swear this song is about eating out my best friends p__blank__" you fill in the blank.

Anonymous

:D

"Apparations Stalk the Night", "Septette for a Dead Princess", ...

@MechMK1 Ah, classic. He has so many great ones.

@J.J From which Touhou game is that? :D

Anonymous

It's a LoFi song by Cozyboy :p

1:33 PM

Is that from one of the newer games?

I don't know why I'm being such a troll today

Probably the slow internet

Anonymous

I am sorry, I have no idea what you're talking about.

Anonymous

lmfao.

Anonymous

It's just one of my favourite song titles cus it disgusts people.

In all honesty, I dislike Hong Meiling as a character, but the fight against her in Touhou 6 is sooo good

I loved the colours

Anonymous

The same reason why A Little Piece of Heaven by A7X is one of my favourite songs, it disgusts people.

Anonymous

1:34 PM

I mean, it really disgusts people.

Let's Play Touhou 6 EoSD: Stage 3 - Hong Meiling

at 2:32

And damn he plays bad

I bed he plays E A S Y M O D E

Anonymous

I can't watch it right now.

Anonymous

:p

I love games that drop you into a world with a really complex (possibly alternate) history, and nobody talks about it or explains it, because why would they? It's normal to them. And as a player you have to put the pieces together from what you say or hear or read

Anonymous

Yeah, I quite enjoy that as well.

Anonymous

1:47 PM

Did you ever play the Myst games?

Anonymous

I loved those games for that very reason!

Anonymous

They were all mystery based, everything was a mystery, the world, the universe, the characters, the storyline, everything.

Sadly not, those were a bit before my time

Anonymous

But I'm younger than you...?

Anonymous

:D

1:48 PM

Yes, but I doubt you played them as a kid, did you?

Anonymous

Yes, as a kid.

Anonymous

From about 8-9 :D

How old is myst?

Anonymous

The oldest one is very old.

And getting into older games that you have not played as a kid is difficult, at least for me

I tried playing the original Hitman, and it was awful

Anonymous

1:49 PM

The original was 1993.

I wasn't even born back then :D

Anonymous

Heh.

Anonymous

Exile was my favourite one, Myst III.

Anonymous

That came out in 2001.

Damn I'm literally headbanging to the orchestral version of the OST of Touhou 10.8

Which was like the DLC for 10.5

Anonymous

1:51 PM

I've made lots of nice UX changes on my tech-blog today.

Anonymous

I'm really happy with it, but there's a few features I want which I simply cannot find a solution for.

10.5 was actually my first touhou game. I still have such fond memories of it, even if I am genuinely terrible at fighting games

But the funniest thing is that every character has their own story

Anonymous

And the only way to use custom plugins when hosting via GH-Pages is to build it locally then upload to GH but then you lose the ability to easily use markdown.

And Hong Meiling's DLC story is that all her fights are a dream, because she's asleep on the job as a guard AGAIN

And she literally dreams about winning every fight she had until then :D

@J.J I remember working through the original with a friend back in the day. Good ol' DOS, still one of my favorites...

Never played any of the others

Anonymous

1:53 PM

Oh man, Myst III was awesome!

Anonymous

Spooky as a child too, very spooky.

It's funny, I never played any MS-DOS games

Only at a friend's house

I also didn't know what MS-DOS was. I just remember the logo of it

And I always associated it with games

Anonymous

GTA Vice City was my all time favourite game growing up.

It took me so long to understand what it actually was

GTA IV was my first GTA game :D

Anonymous

Anyone who says SA is better is a liar or never played Vice City.

Anonymous

1:55 PM

:O

Yes really

Anonymous

GTA IV story was so sad :(

Anonymous

The ending :'(

My parents never allowed me to play any GTA game because they were "too violent"

Anonymous

Oh, my dad didn't care lmfao.

Anonymous

1:56 PM

I played Vice City since I was like 3 or 4.

Anonymous

My first game was one of the original Tony Hawk games.

Anonymous

Then Vice City and then one of the original Tomb Raiders.

My first game ever was Super Mario Bros Deluxe, which was a re-release of the original NES game but for the GBC

It was amazing

Anonymous

Oh man, I remember the original Tomb Raider when Lara had pyramid tits LUL

I loved every second of it

Shortly after, I got Pokemon Yellow

Anonymous

1:57 PM

I miss those Tomb Raider games.

Anonymous

I had an N64.

Anonymous

But I played on the PS1 before I played the N64.

I never had an N64, but I played some N64 games at a friends house

It's funny. Some games required a dedicated "save pak" or something like that

Anonymous

And I still have my Gameboy SP Advanced blue

Anonymous

They sell for about £50 right now actually :D

Anonymous

1:58 PM

But I don't have the charger anymore.

Anyways, what we did was we just didn't turn the console off for weeks :D

I remember coming to his place after school to play Gex :D

Man I miss being a kid and having no responsibilities whatsoever

Anonymous

I do not miss being a kid at all.

I would even live with the bullying again

I was lucky that my father just genuinely didn't give a fuck about me most of the time

Anonymous

Nevermind.

Anonymous

OH MY

Anonymous

2:02 PM

I JUST THOUGHT OF A GREAT IDEA FOR MY SITE

Anonymous

HAVE A NO CONTROL MP3 EMBED THAT JUST BLASTS METAL ON REPEAT

Anonymous

:dDDDDDD

Sadly, doesn't work in chrome

Chrome allows you to mute tabs

Anonymous

Yeah, but then they have to mute them in the first place :D

Anonymous

I'm acting like my site get's lots of traffic, I've not checked the Google analytics in a while but it does not.

2:04 PM

But if you want to be an asshole, let it play after like 30 seconds and begin quietly, then slowly increment the volume

Anonymous

I kinda' get about writing blog posts because I always feel like nobody reads them anywyas.

I just have my sound off 100% of the time :p

I just have my playlist on repeat

Pokemon is still my all time favorite games. I'm going to have to get a switch soon so I can play sword and shield. I've played just about every other one (Generation 6 is my favorite)

Anonymous

I just realised, my blog has no sitemap.

Anonymous

2:05 PM

No wonder why I don't get much traffic...

Smooth Jazz -> Psytrance -> Black Metal -> Classic Rock -> Dubstep -> ...

Anonymous

I will fight until the worlllllllllllllllllllld goes coooooooold

Anonymous

:D

Dark bell sounds are low-key pretty dope and I'm sad they're not used more often in metal

Anonymous

Why is so SEO shit so much work?

2:09 PM

Because ohhh need more blast beats and more breakdowns we're not brütal enough

Anonymous

I feel like the only way to achieve good SEO is to pay for listing.

Anonymous

Genuinely.

The key is to not give a fuck who visits your website

Anonymous

Well, that is certainly one way of seeing it.

Anonymous

But then what am I writing blog posts for?

2:10 PM

The readers of the future who stumble upon your blog by accident

Or because you linked them

@MechMK1 Oh man, that's totally related to something that just happened. My Dad is a bit checked out, but sent the kids a Christmas card. He started with the classic, "Dear [list of children's names]". Unfortunately he forgot the three year old and called the 5 year old by the wrong name.

Man, it's been cracking me up all morning

Anonymous

It is genuinely so hard to find my blog @MechMK1 that will never happen.

Anonymous

Unless you Google my handle, you never find it. Even if you Google a very specific post of mine.

@ConorMancone I'm surprized he didn't say "Dear whomever it may concern"

Anonymous

A million articles come before it with their fucking buzzword bingo

2:12 PM

@MechMK1 lol! He's not a terrible dad, he's just not good at it either.

@J.J With SEO, the only winning move is not to play

@ConorMancone Mine was genuinely terrible

Anonymous

lol

@MechMK1 100% true. 90% of SEO places are scams

@MechMK1 That is unfortunate, sorry!

Can you imagine the feeling of being forced up a mountain the absolute heat, with nothing to drink because "someone" who said they need nothing to drink drank the wole water?

@MechMK1 The tallest "mountain" around here is the highway overpass, so I'm going to go with no

2:13 PM

We have the Alps :D

Yeah, we literally don't even have hills.

We have very tall mountains

Anonymous

I gotta make up for what I've done cus I was all up in a piece of heaven while you burned in hell no peace foreverrrrrrrrrr

And those are very hot in summer

You need lots to drink

Anonymous

Cus I really always knew that my little crime would be cold thats whY i got a heater for your thighs and I know, I know its not your time but bye bye

Anonymous

2:14 PM

This song brings me great joy.

Man, I think I should change the topic

Anonymous

Let's talk about necrophilia! :DDDDDDD

Anonymous

(joke)

New topic: why can't the RabbitMQ cluster in my Kubernetes cluster be reached by my servers...

I think Necrophilia is pretty gross

Anonymous

2:15 PM

Yeah it is.

@ConorMancone DNS

Anonymous

That's why I like this song, it makes me people feel grossed out.

It's all in a VPC

Anonymous

But it's actually a very heartfelt song.

user image

2:15 PM

All by IP

Anonymous

A very heartfelt song indeed.

Firewalls then

@MechMK1 I've done exactly that before, just not over DNS

tcpdump everything

It's probably a kernel bug

I think it's something about my Kubernetes configuration, which I'm still a bit new with.

Anonymous

2:16 PM

I am sorry, I know nothing about Kubernetes.

Same

Anonymous

I know so little I cannot even pronounce it.

I'm not sure if I have my service setup properly. In the past I've set up an Ingress to route traffic to the service, but this time it is for internal traffic only, so no ingress, and I can't seem to communicate with the service

Anonymous

Is it Koober nuts?

Anonymous

Koober naughts?

2:17 PM

Koober-neets

Hmm... maybe I should just setup an ingress for external communication and see if that works anyway?

Anonymous

Koober netes?

Don't ask me how to pronounce it, I have no idea...

Anonymous

lmfao.

Q-Berts

Anonymous

2:18 PM

I am nearly at 600 commits on my tech-blog.

Anonymous

That is a yikes.

I just have my website where I basically say fuck Stack Exchange :D

Anonymous

I know, I like your site.

Anonymous

I want to implement a terminal on my site.

Anonymous

I see some people with it, it's super cool.

2:19 PM

like uni.xkcd.com ?

Anonymous

Yes :D

Anonymous

I'd like to implement some kind of interesting challenges as well, but then we are talking about recreating Linux in JS.

Anonymous

Which is too complicated.

Anonymous

But it'd be cool to have a terminal where you can priv-esc.

Oh no the Grandmas are angry because I sold one

Is there a way to be nice to my grandma?

Anonymous

2:22 PM

I am now just flagging the shit out of everything on InfoSec.Se.

Anonymous

I don't even care about my declined ratio, I just want my third gold badge.

Anonymous

Not that I even use the damn site.

Anonymous

Not posted an answer in FOREVER.

Answer not worthy a 500 rep bounty? That's a flaggin'

Anonymous

lmfao.

Anonymous

2:24 PM

I got so bored of this site.

Anonymous

I mean, most employers don't seem to value it much.

Anonymous

You spend lots of time learning & answering some really obscure shit and it feels rather pointless.

Most don't give a fuck

I certainly don't give a fuck

Anonymous

Yeah, it's just... Meh.

Anonymous

I don't see sites like StackExchange lasting much longer in the future.

Anonymous

2:25 PM

StackOverflow sure.

I'd love if a candidate came here and said to look at this Sec.SE profile

Anonymous

All the others? Meh

Anonymous

I don't see it.

I'd just edit all his posts for nothing

And left

Anonymous

Well I did actually used to send my profile to employers when I contributed.

Anonymous

2:26 PM

Now I don't bother.

"Yes, we looked at your profile and also the transcript of the DMZ. You seem to have very...unorthodox views regarding the Jews. I assume it is clear we cannot hire you."

3

Anonymous

If its one thing I learned Mech

Anonymous

Its that I could not give a FUCKK

Anonymous

What someone thinks avout what I think

Never reveal your power level :D

Anonymous

2:27 PM

I'll say whatever the fuck I want.

Anonymous

Its my life

Anonymous

My speech

Anonymous

If you dont like it

I would if I wouldn't live in fucking Austria

Anonymous

I mean, I live in the UK, speech is pretty restricted here.

2:28 PM

Same here, just in a different way

Anonymous

I just don't care. As I said, they're my words. I'll say what I want and I'll also take responsibility for it.

Oi mate, ya got a loicense for that opinion?

Anonymous

If I lose a few jobs because I say "controversial" things that's the price I'm willing to pay.

Anonymous

:D I've felt this way for a good 2 years now.

> Yes sir, my second name is literally "N-Word", with hyphen.

Anonymous

2:29 PM

When I realised that not saying whatever you want doesn't do you any favours anyways.

Anonymous

^ and i really believe that.

> My father was a strange man who grew up in a strange culture.

Anonymous

Also, I don't do this whole "offended" thing.

I'm offended that you don't feel offended at things

Anonymous

"I'm offended!" - "are you? Well, if you don't mind, fuck off and go be offended somewhere else"

2:31 PM

You are literally Hitler, you know?

Anonymous

:DDDDD

"I'm offended" basically means you can't keep your emotions in check, so you ask the world to do it for you.

Anonymous

Yes, or that you think you deserve special treatment.

Anonymous

Which nobody does

Nobody does, I grew up in a working class family. We ain't deserving shit

Anonymous

2:33 PM

Agreed

Anonymous

Oh lovely

Anonymous

my work is being fucking fingered by packtets right now

Anonymous

nice

What?

Anonymous

No idea what is happening, I am just looking at the graphs on the guy next to me screen.

Anonymous

2:38 PM

I feel so bad for the blue teamers.

Anonymous

They deal with some shit...

Reminds me of when we first had to work with wireshark

Suddenly, everything black and red

The guy "What does it mean?!"
Other guy "Oh no, you've been hacked!"

Anonymous

Hhahahahahahhaah

« first day (3291 days earlier) ← previous day next day → last day (1600 days later) »

Transcript for

Dec '1920

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile