The DMZ - 2019-09-25

« first day (3205 days earlier) ← previous day next day → last day (1696 days later) »

7:53 AM

Today I learned Java has a scripting API called JavaScript. It has nothing to do with JavaScript.

docs.oracle.com/en/java/javase/11/scripting/…

I am deeply convinced that the people who chose names like "JavaScript" or "Java Scripting" are just trolling on a professional level. There is no way that anyone could have looked at this, pass the smile test, and say "Yup, that's a great idea!".

@MechMK1 oh, no no no.. it has something to do with actual JavaScript...

> The Nashorn engine is the default ECMAScript (JavaScript) engine bundled with the Java SE Development Kit (JDK). The Nashorn engine was developed fully in Java by Oracle as part of an OpenJDK project, Project Nashorn.

Although Nashorn is the default ECMAScript engine used by the Java Scripting API (cut)

Seriously??

So all the years people were saying "Java and JavaScript have nothing to do with each other" is now obsolete?

@MechMK1 No, it just means that you can use JavaScript as the scripting language parsed by the Java Scripting API. but you can also use other languages.

It just seems weird to me

There is a purpose, this is so that you could say:

> I'm using JavaScript for scripting with JavaScript

8:07 AM

Yo dawg, we heard you like JavaScript

I mean, you wouldn't waste a good opportunity to confuse whoever you are speaking to....

1 hour later…

9:28 AM

0

Q: which version of reaver tool will work for wpa2 hack?

which version of reaver tool should i use for WPA2 hacking when WPS is enable, the current version of reaver in kali-linux is not working.

lol

2 hours later…

11:53 AM

I find it so weird when some company offers some form of automated scanner and it results in a false positive, everyone cries "They just want you to buy their stuff!"

As if false positives **never** happened with any automated scanner **ever**.

My favourite was Rapid7 AppSpider detecting an SQL Injection in an SQL Editor :D

> I mean, it's not wrong, but...

12:10 PM

@MechMK1 Amateur. I once saw a warning for an "attempted unrecognized access" to a Microsoft Account being reported on the account security page.

@Derpy And?

@MechMK1 searching for the IP reported it as owned by Microsoft.

breddy gud job migrosofd

FUCK! I clicked cancel for the update and now it forces me to reboot WHY?!?!??!?!?!?

After multiple calls to their help service and being escalated to higher sources.... it seems that sometime their own internal update mechanism trigger the account protection alerts

very breddy gud job

Anyways, gotta reboot

see ya in a minute

12:37 PM

back. Only took me 24 minutes

12:51 PM

@MechMK1 Now that I know you run windows I'm not sure if I can talk with you anymore, sorry :/

Pet peeve: When people pronounce /usr as "user".

@ConorMancone Company computer, no choice there sadly

How else are you supposed to pronounce it?

You-Ess-Arr, of course

@MechMK1 Yeah, I figured. That's the only allowed excuse, although I think it would literally be a deal-breaker for me personally.

@ConorMancone If I told you my server runs Ubuntu you'd /mute me

12:54 PM

@MechMK1 :) Any linux variant beats windows.

Because /usr stands for "Unix System Resources", not "User"

lol, you're literally blowing my mind here

Windows Server is the worst I have ever had to work with and I hate it with a burning passion

I feel like I should have known that...

@MechMK1 SharePoint.

12:55 PM

I am not allowed to voice my opinions on SharePoint. Migrosofd has me on NDA

@ConorMancone The fact that that directory contains no user data whatsoever could have been a hint :D

I ditched windows back in 04. Tried mac for a few years before switching to linux-only (bounced back and forth between Suse and Kubuntu)

But worry not, these days packages place shit wherever they plese anyways

@MechMK1 These things always make sense in retrospect!

@MechMK1 Yes, that's literally the source of my confusion.

Yes. Fun fact: /etc literally means "et cetera"

That's my story and I'm sticking to it - everyone always installs their binaries in /usr/bin!

aka the place where the user puts there stuff!

12:57 PM

@MechMK1 Wasn't that supposed to be "Enterprise Trash Catalog"?

/usr/bin is for binaries installed by packages. /usr/local/bin for stuff you compiled yourself

I always wanted one of these guys printed on a poster, but never got around to it

zazzle.com/linux_directory_large_poster-228475552785340169

(linked to the first one I found - this is not me claiming it is 100% correct)

But for example, NEVER TRUST /lib, EVER

You might think it's for libraries, but you're mistaken

Programs put literally any shit they want there

@ConorMancone Still better than one old teacher of my, claiming DOS meant DOCUMENT Operating System... because it was the first OS to have documents.

Like byobu, which puts small bash scripts there, which generate various bits of infos

@Derpy Damn...

My only hard and fast rule is: Non-FHS applications always go to /opt

E.g. TeamSpeak 3, Steam, etc...

"/bin was originally designed to store configuration files for the bind-server" is my favourite kind of misinformation.

And I know I will hurt some people's feelings, and I know maybe it might get me banned from SE, but I just have to say the truth: /root should be /home/root and everybody knows it.

Bourgeoise uid 0, thinking they're somthing better than us common /home folks...

1:08 PM

@MechMK1 Seriously, what makes root so special that their home directory goes somewhere else?

I don't know, and I don't like it

Especially since I casually call / "the root of the FS"

1:21 PM

0

Q: Is this private network authentication system secure?

I am building an authentication system to be used within a company's private network. I do not administer this network, and I know very little about the setup, but my basic understanding is you must be on a local machine or VPN in to access it. The system/services consists of: An OAuth server ...

web-application appsec csrf oauth jwt

>I am building a company-wide authentication system

>I am an absolute beginner when it comes to security

This cannot end well.

> Hi, I'm Matt, and this is Jackass.

Unfortunately lots of security systems are designed by beginners. He at least acknowledges that he is a beginner, and is somewhere reasonable to ask for help, so that puts him light years ahead of most.

I don't say that to suggest that this company has made a good choice, but rather to point out how terrible most companies do...

1:36 PM

@ConorMancone Yes, but in the best case he goes to the guy who ordered him to do that and say "Look, I don't have the necessary expertise to do this task. This is a critical piece of infrastructure and any subtle flaw can leave us wide open for attack. We should go for a professional solution rather than an in-house system with this"

Absolutely. Unfortunately that's never how it goes

I don't want to know the dark secrets of some companies

Not stuff like "We sold chemical weapons to oppressive regimes", because that's obvious anyways. I want the juicy bits, like "Our core business software was developed by two interns in 1999 in a framework that was already obsolete by then. We have no source code and no idea how any of it works."

Did you ever hear about Toyotas fiasco? It's my favorite programming horror story. I think I shared an article about it here a few weeks back...

Yes, I remember

Global variables, right?

Global variables and endless spaghetti code! Oh yeah, Forest was horrified, lol

I've had to take a peek into people's old legacy code a few times in my life, and it is always terrible.

1:47 PM

Me too

The biggest mystery in life is how anything actually works

I am deeply convinced that it's actually tech priests who pray to the machine spirits.

Because if something on my PC doesn't work, it really doesn't work

Kernel Panic, failure to boot, no recovery available, etc...

Journeyman Geek

@MechMK1 actually more of an aura

and fear. They need to learn fear.

I always say I angered my machine spirit somehow and thus need to calm it somehow

All I know for sure is that computer spirits are not appeased by increasing the voltage... you'd think a food sacrifice would work for them, but they don't seem to like it

Journeyman Geek

1:51 PM

@ConorMancone funny that...

my old PC wanted a new heatsink...

damned thing went from about 50 dgrees ambient, to 100+ degrees cause the old heatsink with new paste wasn't installed properly...

to...

39...

With a cheap heatsink I got off aliexpress

and this is better temperatures than it was new ;p

lol, go figure.

The 5 Stages of fixing your PC:

- No, there's no way that there's another hardware problem. I'm sure it was just an isolated incident.
- This stupid piece of garbage PC! I swear I will throw it out of the darn windows!
- Please, please work! I beg you! All I want is to play videogames. I swear I'll upgrade the RAM next month when I get my money.
- It doesn't work. I'm doomed. I don't even know how to make a PC run. I am worse than geeksquad.
- All I had to do was to powercycle the machine.

Journeyman Geek

@MechMK1 I like hardware problems

and I upgraded the ram too

@JourneymanGeek Try fixing my girlfriend's laptop then

Journeyman Geek

@MechMK1 ... oddly enough

1:55 PM

When it was brand new, it would play DBD @ 60fps

While recording with OBS

Journeyman Geek

one of my co-workers brought in a laptop saying it wouldn't install windows.

I handed it back to him fixed... he's convinced I did magic

Also I've fixed stuff by turning up

Half a year later, it would slow down to 15 FPS and the GPU would heat to 85°C

I tried to clean it with compressed air, nothing

Journeyman Geek

ah

I reinstalled the OS: Nothing

Journeyman Geek

redoing the heat sink stuff on a laptop is unfun

since they use pads

1:57 PM

Laptops are basically unservicable

They are designed to be

Journeyman Geek

eh, thinkpads are better than most

If it doesn't work, yeet it out, buy a new one. Just like your phone

Yes, that's why our company only uses ThinkPads

Journeyman Geek

Eurocom's boxen are basically desktops

and are maintainable too

work has HPs

they're not bad.

If Microsoft could, they would stop delivering updates to laptops 2 years after the model came out

Journeyman Geek

easy to upgrade but not as insanely servicsable as a thinkpad

@MechMK1 naw

MS sells OSes not hardware

1:58 PM

I'm sure OEMs would love that feature though

Journeyman Geek

my other PC is from 7 years ago ;p

At least on an old laptop I can still install linux and use it that way

Journeyman Geek

@MechMK1 oh I also have a 2006 laptop

that runs debian (no 32 bit ubuntu) and haiku 32 bit

I have Theseus Gaming PC

2

A: Can we define a single immutant state of a device (modern computers at least) to derive a key from?

The question that you have to ask yourself is, why do you want to use encryption? In security, all measures are means to counter a specific threat. You did not state your threat, so it will be difficult to know what you are trying to protect yourself against. You did however mention video...

> Theseus was the mythical king and founder-hero of Athens. A little known fact about him was that he was also a passionate gamer, and loved building his own gaming PC. In fact, he was so passionate about it, that he always wanted to most powerful, up-to-date hardware.

> First he upgraded his graphics card from a ψτω ΗΠ to a ψτω ΘΠ, then his CPU, hard drive, motherboard, case, PSU and more.

@JourneymanGeek I don't have any 32-bit systems anymore

It's funny, I had to help a friend of mine once who wanted to build a gaming PC

Journeyman Geek

@MechMK1 I didn't expect it to run ;p

2:03 PM

I said "It's easy, the only scary part is installing the CPU"

Journeyman Geek

@MechMK1 oh

"Why?"

Journeyman Geek

technically I started with a dell 530 that I pulled from a dumpster....

"Because it'll feel and sound like you're breaking it and using way more force than necessary"

Journeyman Geek

then swapped the case, other stuff, video card, nother video card....

2:04 PM

I don't know what my first PC was. I was 5 years old back then

Journeyman Geek

which is in my current PC... ;p

Nice

Journeyman Geek

@MechMK1 oh I got the seller to install it for me.

I had no knowledge of hardware back then. I could barely read :D

But apparently one of my first feats I managed to do as a kid was swapping disks in a PS1

Journeyman Geek

XT clone, IPC 486 DX2... PII 233, PIV of some flavour, another PIV, a core 2 duo, dell 530 from a dumpster, core i7 3770, core i9 9900K

IPC is now a real estate company

2:07 PM

Nokia also used to make ammo :D

And tanks too, I think

Also tractors and rubber boots

My current build is a GTX 1080, and my gf has an RTX 2080

Which I can literally only afford because I have no car

2:34 PM

@ConorMancone Also, existentialcomics is amazing :D

existentialcomics.com/comic/45

My favourite so far

3 hours later…

5:47 PM

@MechMK1 Don't tell anyone, but everything I know about philosophy comes from that comic

« first day (3205 days earlier) ← previous day next day → last day (1696 days later) »

Transcript for

Sep '1925

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile