« first day (3350 days earlier)      last day (49 days later) » 

9:07 AM
@ConorMancone Well, the correct term is indeed "national socialists", because they were members of the NSDAP, the "National-Sozialistische Deutsche Arbeiter-Partei" ("National-Socialist German Workers Party"). The term "Nazi" was a german abbreviation of the word "National", but was only used in conjunction with "Nazi-Sozi".
To say that "Nazi" is right and "National Socialist" is wrong is just historically incorrect.
A historically accurate discourse should allow that we describe the groups in the ways they described themselves.
You would also write "The Communist Party of the Soviet Union" and not "the commies"
Sure, you could use commonly used names such as "The Japanese during WWII" instead of "The Imperial Japanese Army", but to insist that the former is somehow "more correct" or that you are a fascism-sympathizer if you use the latter is just weird
There seems to be this weird idea that if you talk in any other way than derogatory of the germans during WWII, you are somehow a nazi.
As per the question: The Wehrmacht did indeed use the Lorenz machine. I don't know why he believed that they didn't.
The Lorenz was indeed better than the Enigma, but was much bigger and heavier, than the comparatively portable Enigma, which limited its use.
If some commander was stationary enough, upgrade to a Lorenz was indeed feasible.
@RoryAlsop Why did you delete that question, by the way? It seems on-topic enough for me.
 
9:32 AM
Hey guys, long time no see. I have a quick question. When I review the Openssl heartbleed bug event, I read these from Wikipedia:

""TLS implementations other than OpenSSL, such as GnuTLS, Mozilla's Network Security Services, and the Windows platform implementation of TLS""
So I would like to know a bit about history
Why all these main stream softwares uses OpenSSL(I am not sure about this but I guess many popular software use OpenSSL)? Why not using GnuTLS or NSS or the Windows platform implementation of TLS for example?
 
@Rick I'm in a meeting right now, but I'll happily answer in a few minutes
 
OK thanks. Take your time :)
 
10:16 AM
@MechMK1 We destroyed his account as abusive - the question went as a by product of that.
 
@RoryAlsop I see. The question itself seemed fine to me though. I mean, "Why was this encryption thing used instead of this one in this historic context?" is on-topic in my opinion
 
@MechMK1 "Why" makes questions usually off topic here. We did discuss moving it to History.SE
 
Eh, I would disagree that "Why" are inherently off-topic, but I agree that this question was borderline
 
But then the OP got abusive, so initially we suspended, then destroyed when we looked into the account further
 
Yeah, that was kind of uncalled for, but then again people need to be at least 14 to use SE and even with 14 one can expect a person to be somewhat reasonable
 
10:39 AM
@Rick Are you still here?
 
Yes
:P
 
Alright, so regarding heartbleed
The full paragraph you cited is as follows:
> TLS implementations other than OpenSSL, such as GnuTLS, Mozilla's Network Security Services, and the Windows platform implementation of TLS, were not affected because the defect existed in the OpenSSL's implementation of TLS rather than in the protocol itself.
 
That's right
 
And your question was why does everybody use OpenSSL instead of others, such as GnuTLS, etc...
 
Ya
 
10:41 AM
OpenSSL is already very old. It started in 1998
GnuTLS began in 2003
 
Ah OK GnuTsl begin in 2003
 
Why not use the Windows implementation? because it was windows only
 
I guess so\
 
So unless you knew 100% that you never ever want to support Android, iOS, MacOS or Linux, you don't want to use such a platform binding
Most modern web servers (Apache, nginx, etc..) all run on Linux as well
Mozilla NSS actually originated from some old Netscape code
 
But these large companies can develop their own TLS implementations. For example, Google, that should not be a big deal for Google.
 
And make it closed sourced
 
But why?????
Why would you ever want to make crypto code closed source!?
 
Yes I read Wikipedia and after that heartbleed event, serveral other implemtnations comes up
Maybe safer? Since Google have enough experts who can do that work.
As you see, openssl, open source and also results in such a disaster.
Hmmm. I just feel a bit surprised that Openssl dominates this area. I mean, for example, as you mentioned, GnuTLS began in 2003. Do any well-known softwares use GnuTLS ?
Ah that link you provided is helpful. I read the introduction of that page
 
@MechMK1 Did you read his very final comment at the very bottom of his deleted answer? I wasn't clear, but that is what really wrapped everything together - not so much his insistence on using "National Socialists"
 
@Rick No no no no no, you have it all wrong
the problem isn't that OpenSSL being open souce lead to this disaster
On the very contrary
The fact that it was open-source lead to the bug being fixed!
Who knows who already knew about this bug waaay before then. Nobody knows
Perhaps agencies like the NSA already abused Hearbleed for years and nobody knew?
The reason why heartbleed existed is because OpenSSL has very critical code, that very few people are able to write correctly. As such, very few people actually bother contributing to OpenSSL, as compared to other open-source projects (e.g. firefox)
As a result, less eyes look at the code. Also the code quality was notoriously bad in OpenSSL because so few people who really focus on high-quality code bothered working on OpenSSL
This lead to the creation of LibreSSL, which aimed at creating a more stable SSL library
I don't know if that project went anywhere major though. Several packages pledged to support libressl (nginx does, or at least did at some point, as far as I know)
@Rick Yes, VLC supports GnuTLS, but I'm not sure if it supports OpenSSL too
@ConorMancone Some people are just like that. I regularly get called all kinds of names when getting into political arguments. You just have to grow a thick skin on the internet.
 
11:05 AM
@MechMK1 That is definitely a true story. I learned quite a lot from that exchange. I'm now embarrassed to admit that I didn't know that Nazi was short for "National Socialists". I am still curious about the dude's claim of that being a derogatory term
 
@ConorMancone Modern National Socialists consider the term "Nazi" akin to how Communists consider the term "Commie"
 
Obviously Nazi is pretty much only used negatively today, but presumably "Nazi" was simply their name back then?
 
@ConorMancone It was used somewhat commonly to refer to the members of the NSDAP, but the term "Die National-Sozialisten" ("the national-socialists") was used in more formal contexts
It's a bit similar to how democrats in the US are referred to as "the dems". It can be used negatively, but not necessarily so.
 
Hmm. I get your point. Open source, easy for hackers to find bugs. Because they can read the source. Also, easy for others to fix it. Close source, more difficult for bad guys to find bugs. No source code is provided. And the public can't take a eye on it.
 
@Rick Exactly. And with crypto code, it's much better to have lots of experts having their eyes on stuff than to try to hide it away
Just look at todays encryption algorithms. Every single one that we use, AES, Twofish, Serpent, Poly1305, etc... area ALL extensively studied by cryptographers world-wide
 
11:10 AM
> Heartbleed is a security bug in the OpenSSL cryptography library, which is a widely used implementation of the Transport Layer Security (TLS) protocol. "It was introduced into the software in 2012 and publicly disclosed in April 2014."
But this from Wikipedia really surprised me.
 
Every single company - literally every single one - that claimed to use a "custom encryption format unknown to hackers" has had their algorithm cracked and is being laughed at by cryptographers
@Rick Why?
 
2 years...
 
Yes, but what exactly surprizes you?
 
It was after 2 years when the heartbleed bug was found.
 
I understand what you are trying to say, but why exactly does it surprize you that it took two years?
 
11:14 AM
@Rick that's isn't really a long period of time. There are severe security bugs that took 10+ years to find
 
Because I read some articles and I know that an hacker may steal sensitive information with this bug. Like password
 
Yes, but that is all about what they can do with it, not the nature of the bug.
Do you understand how Heartbleed works?
 
@MechMK1 Technically no. I just read some text description and image illustration
But OpenSSL is open source. Everyone can read the source code. I expect experts should discover that problem in a short time. Maybe 2 months? A few weeks
 
@Rick I'll elaborate why this is not the case
Heartbleed is the result of a missing check in the TLS Heartbeat extension
The Heartbeat extension allows a client to keep up an already established TLS session, even when no data is transmitted, by repeatedly sending "Server, are you still there? If so, send BIRD (4 letters)" and the server would reply with "BIRD"
As you can tell from this description, this is the solution to a problem that not very many people had
In fact, heartbeat was disabled by default on basically any major server software using OpenSSL
This means that very few people actually gave a damn about Heartbeat. It was a niche solution to a niche problem.
Those few people who actually care to test OpenSSL and verify how correctly it operates will test the things that actually matter. Certificate verification, key exchanges, etc...
Those are things that matter to the vast majority of users, and thus bugs there would greatly compromise the security of millions of users.
So yeah, it did take years to find heartbleed. Not because the vulnerability wasn't severe enough, but because it wasn't affecting that many people.
 
Objection, sir.
> The defect spread with the release of OpenSSL version 1.0.1 on March 14, 2012. Heartbeat support was enabled by default, causing affected versions to be vulnerable
 
11:23 AM
@Rick Heartbeat "support"
That doesn't mean that the extension itself was enabled
It just means that these versions could do heartbeat
 
Ok let me check
 
What was the other ssh library that turned out to have a severe vulnerability as well? It was more recent, although the library in question was also much less popular....
 
@ConorMancone Really? There was another one?
@Rick The problem with heartbleed was that it was perfectly stealthy
Meaning you had no indicator whatsoever whether or not you have been exploited
 
Do you mean that "the server can be attacked but with no trace", mentioned by some articles I saw online?
 
Exactly. So administrators who had vulnerable OpenSSL versions on their hands couldn't know if they had been attacked or not
 
11:33 AM
I am searching on the Net to see whether heartbeat extension is enabled by default...
Because if it's not enabled by default, like you said, then it's not really a big deal...
 
@MechMK1 found it - libssh. It's not as commonly used as openssh
 
@ConorMancone Damn, that's hardcore :D
Anyways, I'm off for lunch. See ya
 
Bye
Thank you
:D
Have a nice lunch
 
12:33 PM
I'm back my lads
 
12:53 PM
=.= I haven't had my dinner yet
 
 
2 hours later…
3:00 PM
As much as I love testssl.sh, I hate that it doesn't run on windows
Or rather, I hate Windows for not running testssl.sh
Holy shit I am going insane
AAAAAAAAaaaaaaa
              aaaa
                  aɐ
                    ɐ
                    ɐ
                  ₐᵃ
                 ₐᵃ
                 ᵃ🇦
                   🇦
                    🇦🇦🇦
                      🇦🇦🇦🇦
 
3:27 PM
Me, one hour ago: I would like to check if TLS is configured correctly
Me, now: I need to download the kernel headers for this VM running in a VM running in a VM.
 
@MechMK1 lol, sounds very exciting! Who knew checking TLS was such a pain!
Sounds like me learning Kubernetes over the past year or two
 
@ConorMancone I honestly don't want to exist anymore. The screams of agony echo through the DMZ
No more, I beg you
YES
I fucking did it
I am a God amongst Men. Legions tremble before me.
 
@MechMK1 That's always the fun part :)
 
Holy shit I feel like I am learning things about OS virtualization that I did not want to learn
 
3:32 PM
:D
 
You now qualify for a €100/month raise
Tell your boss I said so
 
> You listen up, there's this guy in this online chat and he said I am qualified for more money.
 
3:44 PM
Sounds legit.
 
Fucking finally
I wish I could tell you what kind of ciphers this thing uses
All I say is that this supports SSLv2
 
 
1 hour later…
4:48 PM
I would guess RC4, DES and NULL.
 

« first day (3350 days earlier)      last day (49 days later) »