The DMZ - 2020-04-10

« first day (3403 days earlier) ← previous day next day → last day (1491 days later) »

12:18 AM

At (currently) -11 votes, this is one of the lowest voted answers I have ever seen. It's terrible too. So terrible I can't help but wonder if it's a troll, although I suspect not.

-11

A: Secure way to encrypt (not hash) passwords?

Create your own Encryption System. It's as easy as just replacing some letters with others. Like the Enigma Machine. Only you (Or a manual you will make) would know the encryption and decryption procedure. If you would like to make it more complex, you always can, with encryption basing on certa...

(well, lowest except every post ever from Sarah - was that her name? - on meta)

@MechMK1 Inciting people to violence: definitely jail. Shouting nuclear launch codes in a crowded theater: Also jail. However, those are about it when it comes to reasons to jail people based on things they say.

7 hours later…

7:29 AM

@ConorMancone I highly doubt it is a troll, and if so, he is incredibly good for fooling me. I think it's just an amateur, seduced by the idea that a secret algorithm is somehow better than a public and proven algorithm.

@ConorMancone I know it sounds terrible, but I think that inciting violence should be covered by freedom of speech. If I would say "You know what, we should kill all people with green eyes!" (I can say that, I have green eyes), then any sane person would tell me that I am fucking stupid

And those who did follow through and attempted to kill any person with green eyes acted so out of their own mind. They themselves made the decision to be violent. And that is the actual crime: The violence. Not my proposal to do so.

As for nuclear launch codes, I assume that they count as top secret data, and of course leaking top secret data to the public is it's own crime already.

8:31 AM

I hate being under NDA. I have so many cool vulns to talk about and I can't (⇀ᨓ↼)

9:20 AM

@MechMK1 Inciting to violence (at least in the US) is actually very specific and one of those things that is often misunderstood. Telling your twitter followers "We should kill people with blue eyes" or even "Someone needs to kill the president" should actually be perfectly fine. In the US the current "test" to decide if speech may incite violence is imminent lawless action

Shamelessly plugging my own question here:

1

Q: What are the dangers of not setting the HSTS header on every response?

A web application only sets the HSTS header in responses to requests to /assets/*. Any other response does not include the HSTS header. While it does seem insecure at first, any browser opening the index page will quickly follow up loading all the assets, which then results in the HSTS header be...

@ConorMancone Yes, the Brandenburg test

The idea being that you aren't just making general statements suggesting violence, but actively encouraging someone to be violent right now with the expectation that it will actually happen (that's probably a terrible summary)

although obviously you're familiar

I do agree that in some situations, law enforcement action is required, but it depends on the circumstances.

As Count Dankula used in his example: "I'm going to kill you", said via XBox Live, by a 12 year old, to a 12 year old, after getting owned in CoD, is not the same as "I'm going to kill you", sent via text message, by a 37 year old man, who was just released from prison for domestic violence, sent to his 34 year old ex, after she had reported him for domestic violence

Personally I think a properly constrained rule in this area makes sense. If the only reason why someone hurt someone else is because you told them too, then clearly you are also responsible for the crime.

One is banter, one is probably a bit more

9:23 AM

Indeed

@ConorMancone I think it depends on the situation. How much influence did I have on the other person? Did we know each other? Did I have authority over the other person? Did that person have any risk of harm should they refuse?

It's very much an open debate

@MechMK1 Absolutely. That's just the reality of almost every law we have. Although this one is clearly a lot more fuzzy than some.

To take the above example, a random SJW tweeting "omg how long until someone finally assassinates Trump!?" is not the same as a cult leader, telling a member to carry out an assassination

To some extent that is what the court system is for

I want to be a cult leader :(

Yes, in an ideal world, the court system would make good judgements

9:28 AM

lol - yeah - that is not the world we are ever going to live in.

@ConorMancone I can help with that:

store.steampowered.com/bundle/10931/…

@ConorMancone Law enforcement is the same. There was a story where a coroner was confused because he saw small-caliber entry wounds in a body, and no exit wounds, yet he couldn't find any bullets. Turns out, way after the suspect was released (as the suspect did not own any firearms), that those wounds were actually stab wounds from an ice pick

Also: play.google.com/store/apps/details?id=com.playdigious.cultist

This sentence includes possibly the best combination ever of all the best things: "a Lovecraftian card game of apocalypse and yearning."

@ConorMancone It is an amazing game, and I can highly recommend it to you

I might have to get the google play app - "card games" are kinda my style there

It is soooooo good

> "Oh no"
> "What happened?"
> "I summoned a thing"
> "A thing?"
> "Yes, and it escaped. Through the roof. It is now on a rampant killing spree"
> "That doesn't sound good"
> "Indeed. Especially since all traces will lead back to me"

9:33 AM

lol!

I'll have to find time this weekend to try it out

I normally play ~30 minutes of race for the galaxy at night in bed while I'm winding down. That game isn't exactly amazing, but somehow it became my primary "wind down" game for the night

My tip for you, and that is not a spoiler, is don't worry about defeat. See it as a way to learn how to play

@ConorMancone I play Hill Climb Racing 2 on my phone when I am bored :D

There is another lovecraftian game I've played where the odds of success are very low. I doubt I win even 1 out of every 10.

It's entertaining, but not my favorite game ever

play.google.com/store/apps/…

I'll have to check that out, thanks for the recommendation

It's not that Cultist Simulator has "low" chances of success

The success rather comes from the risks you are willing to take, and your ability to plan ahead

Many players struggle in the beginning to keep their costs and their health up, but once you figured out a way, you can keep yourself alive easily

Plus, the game had an "easy" mode. When you end the game in any way - victory, defeat, or anything in-between, you can pick one of three "legacies", which are how your next game will be

And if you are defeated, you are guaranteed "The Physician", which is a very easy legacy, as it only has upsides and no downsides

4 hours later…

1:23 PM

Poor Troy Hunt: troyhunt.com/…

"Against stupidity the very gods themselves contend in vain" - Friedrich Schiller

I respect him for trying to curb the spread of misinformation, but it's always going to be an uphill battle.

Yeah, seriously. People make up things to be scared of faster than anyone can refute them (which is usually impossible anyway)

Oh man, there was a crowd fundraising scam I remember that was kind of the "one" that convinced the platform in question that they needed to more actively police scams

I don't even remember what fundraising platform it was

but the device in question was a special "snorkel" that you held in your mouth and would actively filter out oxygen from the water. It let you stay underwater as long as you wanted (or as long as the batteries lasted, which was 1+ hours) without snorkel equipment

Like what they have in Star Wars episode 1?

Complete and total scam, but wow it raised a ton of money. It attracted ridiculous attention from every corner of the internet, filled with people pointing out how it was completely impossible

@FireQuacker Yes, exactly that

I think that the more people argued about how it was impossible, the more people signed up to get one

Did anybody get one of the devices and drown?

Oh no, it was obviously never finished. The company claimed to have a working prototype an had one or two videos of people using it, but never released one for other people to use

Finally the funding period ended and they had a crap ton of money lined up, but turns out at the last minute that the fundraising platform decided it was a scam, returned everyone's money, and deleted the fundraising page

Scammers almost walked away with hundreds of thousands (maybe a million?) dollars

Ah yes, it was Triton on indiegogo

2:02 PM

@ConorMancone They had to claim to have a working prototype, because they showed it in a video

Of course, the video was a simple compressed gas tube

Triton artificial gill: BUSTED!

@MechMK1 Yeah, they had a few videos. I remember the very first one had someone swimming around in a pool, but it only showed them swimming for like ~20 seconds, aka short enough to easily hold your breath. Plus the person was clearly not breathing at a normal rate, based on bubble generation.

So then they released a second video with a dude sitting on the bottom of a pool (literally) for an hour with nothing in his mouth but the Triton.

And so everyone pointed out how easy it is to put an oxygen tank behind you (because the person "sat" still and motionless the entire time) with a hidden hose running into the snorkel device.

The back and forth was ridiculous, and I'm convinced that all it really did was to bring publicity and help them sell more

2:26 PM

Though I question the sanity of people. "Here's a video of a device that doesn't work. It's obviously a scam, as it is physically impossible for this to work." - "Oh golly! I should give those people my hard earned money!"

I have no pity for the people who see crowdfunding platforms as a store for "revolutionary" devices

For example, there was a kickstarter campaign for a light powered by gravity. It worked by lifting a heavy weight up, and it would slowly sink to the bottom over the course of I believe half an hour

Then it would need to be lifted up again.

Why would you do this? To bring light to places that have no electricity, and light is usually generated via unclean means (e.g. kerosene lamps)

The concept makes sense, the application makes sense, it doesn't violate the laws of thermodynamics and it has a clear use-case. Gets a go from me

@MechMK1 Yes, except I just don't need it :) I liked that revolutionary "2 liter water bottle filled with water and stuck through hole in ceiling" lighting method. One of those "life hacks" that seems like a terrible idea in all but very limited circumstances. Sounds like a cheap sky light, except most likely without proper water proofing...

3:01 PM

@MechMK1 Reminds me of that energy storage mechanism they were considering (or maybe actually did) in Switzerland. The idea was to replace batteries with literal stacks of concrete blocks. IIRC, it was supposed to be better than batteries because batteries lose something over time.

Here's a link to the company who was doing it: energyvault.com

There is a very similar (and in-use) idea that amounts to running a hydroelectric dam, but without filling it via river. Instead when you have extra electricity you pump water up to the top of the dam, and when you need it you just let water fall through and run your generators. There are actually a couple of these setup (often in abandoned mines) in the world, IIRC.

I wouldn't be surprised if they are more cost effective, long term, than the gigantic Li-ion batteries Tesla is using

Although the batteries have effectively zero "turn on" time, which is an advantage on its own

@FireQuacker Yeah, also busted by thunderf00t

It was such a scam

Those energy storage dams are amazing

But the towers are bs

Aww, it sounded so cool...

Guess I should have done a little more checking on that

Energy Vault -BUSTED!

3:46 PM

Those energy-storing dams are useful. The efficiency aren't stellar, but the costs are very low, and you will be using "wasted" energy anyway. Imagine having lots and lots of solar panels generating MWs of power during the day when everyone is working and not using that much power. You run a pump, send lots of water upstream, fill the dam with the free (as free beer) energy coming from the sun. Later energy demand goes up, you reverse course and send water downstream and generate power.

Same with wind power, that you cannot predict. But every time the wind blows, you send water upstream.

I saw a case where a company filled an electric cargo train with heavy rocks and send it uphill when it generated more power than needed, and sent the train downhill when it needed more power.

4:00 PM

@ThoriumBR Efficiency, according to wikipedia, is between 70% and 80%, which isn't that bad

4:32 PM

@ThoriumBR The energy may be free but the solar panels, transformers, pumps, generators, and everything else is not :p

@MechMK1 Pumps and hydroelectric generators do pretty well, IIRC. I'm sure that the total loses between the photovoltaic panels, pumps, generators, etc... can add up over time, but that's going to be true for literally any generator, and is certainly true for a gigantic bank of Li-ion batteries. I bet this beats Li-ion for efficiency (at least, that would be my guess)

@ConorMancone Phew, that's outside the realm of my expertise

@MechMK1 That's fine, because I'm pretty much just talking out of my ass anyway. I wouldn't call any of that more than "a slightly educated guess". I have enough of a physics background so that I can make it sound convincing. Unfortunately my wife knows me too well and calls me out for my B.S. on a regular basis.

@ConorMancone Luckily, everybody knows when I talk about anything other than videogames or guns, I usually spout utter nonsense - security included

You'd have to be a madman to follow my advice

And yet acting like a madman is one way to at least end up somewhere interesting....

4:47 PM

@ConorMancone Ah yes, the higher you rise, the more you see

You'll understand what I mean in due time

:) Thank you wise one!

lol, me and wise

The weather is so fucked. A couple of days ago it was snowing, now it feels like summer

5:24 PM

the energy is free, not the infrastructure... it's a kind of energy storage that does not degrade like batteries, does not catch fire...

Also, good cover song:

The Proclaimers - I'm Gonna Be (cover)

6:24 PM

security.stackexchange.com/posts/229571/…

Oh boy

2 hours later…

8:10 PM

@MechMK1 I'm a little surprised. Still only two answers. You may survive this without getting pinged all the time!

(So I'll just randomly ping you in here)

@FireQuacker Mission fucking accomplished :D

« first day (3403 days earlier) ← previous day next day → last day (1491 days later) »

Transcript for

Apr '2010

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile