« first day (3359 days earlier)      last day (31 days later) » 

8:11 AM
I've contacted the vendor, fairly trivial bugs but.
A CVE is a CVE!
8:55 AM
Vendor just asked me what tools I used to find the bugs, I was like "my brain..." :D
9:46 AM
"I could tell you but then I would need to wipe your memory, and then kill you"
I hope I get a CVE out of this.
This product is really terrible.
I get the feeling that they won't want any kind of public disclosure.
Although I will say, I am not entirely sure how I go about getting a CVE, hopefully the vendor can help me with that.
10:15 AM
@J.J This reminds me of a meme
I wonder what the most elaborate proof possible is in this case.
@ConorMancone PHP being PHP again, eh?
Also of interest:
Q: How to help people who may suffer from Paranoia?

MechMK1I am a very active member of the Information Security Stack Exchange site. Every now and then, I come across people who I believe may suffer from paranoia. They believe that "someone" is out to get them, and use techno-babble to make themselves sound legitimate. Here is an example post: How t...

Q: Why do Germans dislike Trump so much and consider him so dangerous?

FizzFrom Pew surveys, Trump seems quite unpopular in (continental) Europe; in 2019 he seems to poll lowest in Germany even among that group: Also, a more recent (dpa) poll focused on Germans' opinions: Germans were asked who was more dangerous: North Korea's leader Kim Jong Un, Chinese Preside...

You know what upsets me? That every time Trump is mentioned, you keep hearing "He's literally like Hitler", which is demonstrably untrue.
And I don't even like Trump. He's absolutely incompetent and the least trustworthy politician I have ever seen.
But this Trump-bashing is such a pointless circlejerk.
Is this the state of political discourse in the US?
If people want to criticize Trump over his behavior or policies, that's perfectly reasonable. But please do so over actual policies, not over hypotheticals or just blatant "But he's dangerous!"
I recall when he got elected and people were like "He's a fascist! He'll put every single one of us into concentration camps!" and years later they are still shouting the exact same thing
For example, in regards to the California Water Crisis, Trump criticized California State Officials of denying California farmers access to water, in order "to protect a certain kind of three-inch fish".
Saying "I oppose Trump's position on this topic, because it shows ignorance towards environmental topics and a general lack of understanding of environmental protection" is different than "Orange Man BAAAAAAD!!!!"
And you know what, Trump is an idiot, but he also did some good things. Like for example, he had a big influence on the peace discussions between North and South Korea, according to both Moon Jae-in and Kim Jong-un
You can't tell me that this isn't a positive thing
10:52 AM
@MechMK1 I'm blaming this one on CentOS. I need libcurl to have HTTP2 support and had no problem when managing the server directly. However, I'm moving everything to kubernetes. The base dockerfile I picked for PHP was built on CentOS and I was having a terrible time getting the dependencies properly installed
I switched to the official PHP docker file and it turns out it came with HTTP2 support built in to libcurl, so now I'm wondering why I didn't just do that in the first place (it's also debian based so I'm having much less trouble setting the rest up)
@MechMK1 That is literally the state of political discourse in the US
@ConorMancone I don't have any experience with CentOS, so I'll just say you're right and CentOS is shit
I've said this before and I'll say this again, because I think it summarizes the state of political discourse in the US: in the presidential debates last time they literally argued about who had the biggest penis
@ConorMancone This is so sad. Alexa, play Despacito
/game over
@ConorMancone That at least explains why Hillary didn't win.
10:54 AM
It's all downhill from here
@MechMK1 What are you talking about? She has a bigger penis than all the other candidates
My favorite quote ever (although not actually said by Betty White)
@ConorMancone It's true though
Reminds me of some Cyanide and Happiness comic
Let me find it
So ever since I switched to Ubuntu 18 I noticed something new. To login as the mysql root user I have to actually be logged in as a root account on the machine itself. What's up with that? I was super confused the first time I discovered this and basically only logged in by accident (because I figured I had forgotten the password and logged in as root to reset the mysql root password)
I realize that's a terribly broad question, but that's why I'm here and not asking on the main site :p
@ConorMancone hm
I have a theory but let me check
mysql     2260  0.1  1.5 1445912 249252 ?      Ssl  Feb18  12:06 /usr/sbin/mysq d
geek     32386  0.0  0.0  12940   892 pts/0    S+   11:07   0:00 grep --color=auto mysql
ERROR 1045 (28000): Access denied for user 'geek'@'localhost' (using password: NO)
I have a suspicion too...
select User,plugin from user;
| User             | plugin                |
| root             | auth_socket           |
| mysql.session    | mysql_native_password |
| mysql.sys        | mysql_native_password |
| debian-sys-maint | mysql_native_password |
| mygrations       | mysql_native_password |
I'm guessing this is a result of the auth_socket plugin and that the setup process changed in ubuntu 18
11:10 AM
I am brainfarting over switching to mysql
Oh wait, I think ubuntu 18 was the first time I didn't get prompted for a root password during installation. I wonder if it creates the root user with the auth_socket now instead of asking for a password and I just didn't notice
I was going to say user permissions
that confirms it
Oh yeah, that's it. The auth_socket plugin restricts you to having a matching username, does not require a password, and also implicitly disallows remote login
Shouldn't that be spelled "migrations"?
Or is the "my" because "MySQL"?
11:13 AM
@MechMK1 That was me playing around with my python migrations project. The "my" is because in python: s/^(.)i/\1y/
Ah, I get it
Although works for Mysql too...
Damn I like your RegEx now
It's written so well
11:38 AM
A: index.html integrity

MechMK1Is it possible? Yes, in theory, it is possible to define a checksum for the index page of a website. If browser vendors wanted to support such a thing, it could definitely be done. Similar mechanisms for SRI and CSP already exist. However... It doesn't make any sense. /index.html pages used to...

Man, I feel bad for this guy
Super dumb question: How would an adult take a certified IQ test these days?
Something like the WAIS-IV or such
2 hours later…
1:17 PM
@MechMK1 Why do you feel bad for him?
@ConorMancone Because he is so convinced of his idea
But it's just not a good idea
You just described all of human history :)
I responded to your comment on my answer, but I'm bringing it here because I'm now super confused
You can buy amazon gift cards on ebay but they cost more than the face value
How in the world does that make sense? Who buys those and why?
@ConorMancone That is a good question. I honestly don't know
But the scam is as follows:
I scam you and say you need to pay X amount of money in gift cards
And the gift cards are often stuff like paysafe cards, amazon gift cards, paypal gift cards, and quite surprizingly, steam gift cards
So if I am the scammer and I am a real epic gamer, then 50€ of Steam Gift cards are just as valuable to me as 50€ cash
As for why they are more expensive than face value, that's a good question
I suppose it could have to do with foreign currency?
@MechMK1 Oh yeah, I suppose all those things are useful in-and-of themselves. I had the idea stuck in my head that the end-goal was cash, and not for direct use.
I mean, you could turn it into cash, but then ask yourself, what do you do with that cash?
You buy stuff
And if the stuff you buy is on amazon, then a gift-card is actually more anonymous than cash
1:32 PM
@MechMK1 I'm amused that it never even occurred to me that someone might be perfectly happy just using the gift cards and not converting them to cash/bank account
@ConorMancone That's why I said if my goal is to buy stuff, 50€ gift cards are as good as 50€ cash
Gift cards are just there to be a scam anyways
1:46 PM
@MechMK1 (going back in time). Indeed, it amuses me that the top answer, a top comment on the question, and the top comment on the top answer both basically received lots of upvotes for the "Trump is Hitler" comparison. It's even more hilarious because Trump isn't even right wing.
There was a question that hit the HNQ about whether a picture with Trump was real, because he was playing golf with a bunch of left-wing people
This entire alarmism is bullshit
Everyone seems to forget that Trump could have just as easily ran as a left-wing candidate. Historically he's been very bi-partisan and probably even left-leaning
I genuinely don't understand why he decided to run as a Republican
he admitted himself that he considers himself more democrat than republican
And yet now he's an ultra-right wing Hitler clone?
This world is so crazy I wouldn't believe it if it wasn't true
To quote him "Economy seems to do better during democractic presidents. It shouldn't be like that, but it seems to be"
@ConorMancone You know why? Because everything is Hitler these days
You disagree with modern neo-liberalism, you're hitler
1:49 PM
@MechMK1 You're hitler for saying that.
You want your wife to stay at home and take care of the kids? Hitler
You have the slightest notion of national pride and identity? Hitler
You dislike someone who is part of the LGBT community? Hitler
You prefer your white child to date someone else who is white? Hitler
@MechMK1 That also means he's bad at economics. The legislature has more control over the economy than the president, and even then there is a big lag between changes in regulation and changes in the economy. Attributing improvements in the economy to the president in office at the time is a fallacious argument from the get-go.
None of these things, literally none of them, have anything even remotely to do with Hitler
@ConorMancone You don't really expect Trump to care about the truth or validity of any of his statements?
@MechMK1 No, but it bugs me because it is a very common political argument over here
@ConorMancone You could either go all in and challenge their beliefs, or you can just let them speak
Are you ready for the problem with all of democracy?
People have such good lives, they don't care at all about politics. Not in the slightest bit.
1:52 PM
@MechMK1 Democracy is a terrible idea. I said it and meant it. I'm now Hitler
(I exaggerate slightly, but continue)
@ConorMancone It's not that Democracy is a bad idea. Democracy can work, but it requires large amounts of the population to care
And they just don't
I asked a few people in my neighborhood who they voted for, and why
@MechMK1 The term you're looking for there is a "Republic"
Some wouldn't tell me, and that's fine
Ironically the US is supposed to be a republic, not a democracy
anyway, not trying to interrupt you
But you wanna know what I got as answers? I voted for that party because: "My dad always voted for that party", "I attended a rally and they seemed like nice people", "They bought me a beer", "That guy is so handsome" and, my personal favourite, "I just like the color of their party"
1:55 PM
That's not actually the reasons people gave, right?
It is
I actually wouldn't have guess it was that bad. I'm used to people who at least have actual reasons, even if I disagree or think they are bad...
Then again my "sampling" may not be a good representation of most...
"My dad always voted for that party" at least has some sliver of reasoning
Given that if you are part of a working class family, then your parents are probably also working class and vote for a party that supports the working class
But "that guy is so handsome"...i mean, holy fucking shit
You know what, I'd actually want Hitler to come back and start WWIII, just so people would shut the fuck up and stop comparing everything they don't like to Hitler.
@MechMK1 Welcome to the long, never ending line of people who shake their first at the world around them while they watch it fall apart at the seams.
I've been in that club for a while. I officially designate you a member
Arise, sir MechMK1!
You know, I had quite a wild ride, politically
I used to be very left-wing, very liberal
2:00 PM
Now tell me why php isn't talking in my new Docker image...
@MechMK1 You were born in Europe, comes with the territory
@ConorMancone DNS
@MechMK1 That's actually a great answer (although not the case here)
Yeah, I used to be of this opinion that we should let everyone do their thing
Very naive, but I mean what did I know when I was 16? Fucking nothing
Then the refugee crisis started, and our country changed
More and more immigrants were on the street. You could hear reports daily, how immigrants attacked people, raped women, etc...
I thought to myself "That's not right. We need to do something"
But the more these reports came, the more people started to defend immigrants, and called those people demanding action or at least concequences to those involved, racists
A 15 year old kid dropkicked a 60 year old women in the back, after she had told him to clean his room
What punishment did he get? None. In fact, he got special protection so he wouldn't feel "unsafe"
You would wish that 60 year old had gotten some protection
Then was the famous NYE in germany, where immigrants sexually harassed hundreds of women
What did the media do? They blamed the women
Videos came up of immigrants kicking a woman in the back down the stairs of a subway station for no apparent reason
Public outrage ensured, but nothing happened. No, that's not true. Politics denounced those who were upset as bigoted neo-nazis
It was at this time that I started to become more right-wing
Funny, how this "scare" tactic "speak up and you're right-wing" turned people right-wing
I got more involved with politics, especially with the identitarian movements in Europe
And if I had to label myself, I'd use the term Identitarian
2:08 PM
@MechMK1 The wiki article about identiatrians basically calls them rascist, xenophobic, nazis. So... about what you'd expect...
@ConorMancone Do you want to know the principles of the identitarian movement of Austria?
They're "native" and "open to the world"
It's funny because the idea that, "People with completely different cultural backgrounds may not fit well into eachother's country" really shouldn't be that controversial, but saying that is the quickest way to get yourself labeled as a racist nazi.
They say "Nativism means for us, that the mountains, forests and lakes of our home are as much a part of us as the ringing of the chuch bells every sunday, the traditional processions with their music and the unique dialects, beautiful clothing and ancient traditions. If we give up our home, then we give up ourselves. It also means for us, that we orient ourselves to the everyday life. We have enough of bold projects and modern ideologies, which brought our home to the edge of ruin.
If my entire family just got up and moved to Saudi Arabia it would be a complete disaster. It would be a terrible fit for my family and my neighbors. And that's fine.
we disavow that the "higher ups" make up fantasies like multi-culturalism behind locked doors, which we then have to live out for them"
2:13 PM
They are welcome to run their country however they want
@ConorMancone Yes, absolutely.
So, how do you think about the Identitarian take on Nativism?
A little bit too over the top :) but very relate-able.
The second big principle is being open to the world: "Just as important for us is being open to the world. We're open towards new ideas and developments and we engage ourselves for Freedom of Expression, Demonstration and the Press as basis of a functioning Democracy. Were everyone is of the exact same opinion, there is mostly being lied, says an old proverb. As such, we deny every form of racism.
We recognize other cultures as different and see the many facets of humanity as valuable in and of itself. We don't want one world culture and no one world state, in which every person thinks and lives the same, but instead the preservation of originality and uniqueness - of individuals, as much as peoples as a whole."
Now, having read this, do you consider that these two ideals are "racist", "xenophobic" or "basically nazis"?
Perhaps "authenticity" is better than "originality".
2:30 PM
That one especially is very well put. Of course you can't expect wikipedia to label such a movement as anything other than racist nazis.
Yeah, basically anything that opposes globalist monoculture must be racist
They also demand being able to debate without fear: "It has to stop, that people lose their job or are threatened, just because they express their opinion! We need to be able to debate fearlessly over the future of our home"
Or their views on family: "We Austrians are dying out, because we don't have enough children. We demand more child- and family-friendly politics, so that our people can still exist in the future"
@MechMK1 That's both important and ironic. After all the fears of a population explosion, a shrinking population is actually one of the biggest issues that most of the modern world is facing
and it will only get worse in the future
/doing my part
@ConorMancone Yeah, actually true
So I guess, since you didn't already call my employer and demanded me being fired, you're a nazi now
Welcome to the club, my friend
Though, it's not a very exclusive club as you can guess
2:43 PM
It's one of the fastest growing clubs in the world!
I'm pretty sure my kubernetes issue is very mundane, but to verify I'm waiting for docker to build my image locally
Then I will test it out locally
and if that works I'll push it up to the kubernetes cluster to see if my changes identify the problem
unfortunately that takes 10 minutes to build/push/update/deploy
That makes debugging this a very slow process...
aka: SLLOOOOWWWWWW day at work
Man, I wish I knew more about Docker to be able to help
Works locally!
Like "Yeah, it's actually super easy, barely an inconvenience. All you need to do is call docker with the --fix-all-bugs flag"
I don't actually think that docker or kubernetes are the issue
Oh my god, I actually have a report where the customer fixed nothing except an information disclosure about the web server running
2:46 PM
I like docker a lot, and I've found kubernetes to be very helpful. The latter though definitely has a crazy learning curve
Docker was pretty straight forward to learn though
Sounds about right
Guys, this was a meme. Not actual security advice!
You forgot the other part of the math: that was the easy part to fix. The other ones were too hard
Yeah, I can't discuss what the other vulns are (given that they are still there)
But damn...
My deployment pipeline ran in exactly the time it took me to get caffeine. My life is now complete
@MechMK1 How about some CVSS scores then? How bad was it?!
@ConorMancone The system has assimilated you successfully
@ConorMancone Sorry, can't give any infos on this
2:57 PM
And I have now confirmed that nothing is wrong with Kubernetes at all. Something in the very core of my application is just broken with this new server configuration, and causing it to fail to log its errors and instead hang
Not the best failure mode...
@ConorMancone Time for a MVCE that just logs errors and does nothing
@MechMK1 It's because I have the logging system send it off to an external logging service, but for testing I also use the testing server as the external logging service. Therefore when things really break it effectively starts an infinite loop of doom.
I just pointed the error logs elsewhere and now I know exactly what the issue is (I forgot a dependency).
I mean, not that you forgot that, but that you found it
This isn't the first time that I have ran into the issue where my self-referential logs cause problems, but it happens so rarely that I've never gotten around to fixing it
Just write it into an issue tracker and forget about it
3:04 PM
@MechMK1 Hilarious because it's true
// TODO: #561830
// Logging doesn't function if the application has an error
3:23 PM
Am I using the correct terminology at the start of this answer? security.stackexchange.com/a/226473/129883
I'm kind of drawing a blank on what that should be called
(Also, shameless self-promotion :D)
@FireQuacker Seems fine to me
Okay, thanks
I'm still annoyed. I've never found an actual XSS in the wild. All I ever seem to find are ways to do silly things with contact forms.
Like, it's injecting something, but it's still just email
@FireQuacker You mean, on some production websites?
Or during a pentest?
Well, I was counting this answer :P
But I did find one in a production website and reported it
Well, that's good. I found some XSS too, but it's always a bet
3:58 PM
@MechMK1 I like that meme.
5 hours later…
8:52 PM
Man, the comments here will probably get cleaned up soon but they are hilarious.
I've haven't seen so much "other-side bashing" in a while
Q: Why did Berlin freeze the rent prices as opposed to letting the market set the price?

AlexeiThis EuroNews article tells us about the Berlin freezing of rent prices: Berlin is freezing the rents of 1.5 million apartments for the next five years starting this Sunday in a controversial move to control the exploding costs that have forced many to move outside Germany's capital cit...

Some quotes just because
> Free market fails constantly, regularly and spectacularly. Governments have to correct those failures with interventions, otherwise poor people suffer. Americans appear to believe that poor people are not people and thus not worthy of any help, such sentiment is not common in Europe.
> an additional point is what failure are you punishing. Should people born to poor families, who have been malnourished during their childhood, denied access to healthcare and a higher education, be punished for failing to be born in a rich family with enough money to properly feed them, provide all medical treatment available and pay for college? I think in the US the general opinion is that the answer is yes
> Right-wingers are not known for paying attention to history. (Unless it's the history of a left-wing plan going wrong, in which case they can conveniently generalize it to show that all left-wing plans will go wrong)
> Here is a general rule of thumb for interpreting right-wing comments: whatever the right accuses the left of doing, the right is doing. However, the converse is usually not true.
I'm glad I'm not one of those idiotic, poor-hating, right-wingers. They must all be Nazis
I usually say that nobody pays attention to history... so the right does wrong as always, left does wrong as always...
the far-right AND the far-left are equally dangerous... the middle ground is better, even if it usually does not achieve anything, it's better than atrocities achieved by the far sides...

« first day (3359 days earlier)      last day (31 days later) »