The DMZ

5:34 AM

Would it be a good idea to do chmod -R g= o= /home/my_username? I'm not sharing my PC with anyone but even if I was, it probably wouldn't be a problem, right? (assuming I'm not manually sharing files)

I'm mainly worried about some things like daemons but they should have their own users & groups anyway so it probably wouldn't affect one not initiated by me.

reed

7:53 AM

@JohnZhau, does that mean that no one will be able to read any of your files? If a daemon needs to read a config file from your home folder, they won't be able too, I guess. I'm not sure if by default there are daemons that need to do that, anyway

@ConorMancone the right answer to that question was: create an API, not a language. An API is supposed to give you restricted access to specific features, a language is supposed to be a flexible way to do everything (which is dangerous, and the OP definitely doesn't need)

Conor Mancone

9:54 AM

Good point. Personally though, why would I want to learn a new language that is just a 1-1 mapping to SQL SELECT statements, when I already have SQL select statements?

reed

@ConorMancone, for the same reason you learn another programming language, another framework, another standard. They all suck, and somebody thinks they should implement a better replacement, which in the end will still suck (and so on). There's a well known xkcd for that, you definitely know it

Conor Mancone

10:10 AM

@reed Indeed, although I can't really complain because I'm kinda the king of making new frameworks...

reed

I really tend to hate "frameworks". There's too many of them. Hard to choose. And you are trusting somebody else's way of doing things. And unless you really spend A LOT of time digging into the framework, you won't learn anything useful, just "abstractions"

Conor Mancone

Frameworks have been a necessity for me. However, I have strong opinions about how they should work so I've always been more inclined to make my own. It has actually been successful for me, and I have learned a ton that way, so :shrug:

reed

yeah, if you make your own, technically, it's not a real "framework" (until you decide to release it and let other people use it)

everybody makes their own frameworks, after all, it's part of programming

Conor Mancone

I recently saw a question on workplace about "Company has a custom framework and I am having a hard time figuring it out" and I was like, "Are you at a company I used to work at??" Except of course that happens all the time

Conor Mancone

11:39 AM

1

Q: Rewording "Whitelist" and "Blacklist" tags

Given the recent move away from the loaded meanings of "white" and "black", and that organisations are moving away from the terms "whitelist" and "blacklist", should we do the same in our tags? All we would need to do is to create a tag alias. Would it cause confusion? Do we want to wait until th...

reed

12:10 PM

Whaaaaaaat?!?!

reed

12:23 PM

There's also the "problem" of black hats, black holes, blackouts, black magic...

John Zhau

I've never even made connections between black things and racism. The only reason I've had thoughts of such connection is because of things like this...

Conor Mancone

1

Q: PHP Blind XXE Exploitation: Invalid URI in Entity

When attempting to exploit blind XXE as explained in this article, I got an error in my apache logs: PHP Warning: DOMDocument::loadXML(): Invalid URI: http://192.168.6.1/82a3ccab632c in Entity The DTD file: <!ENTITY % payload SYSTEM "file:///etc/hostname"> <!ENTITY % remote "<!ENTITY % send ...

php xxe

XML is stupid. Who wants an markup language that is also a programming language?

XML needs to die

reed

@ConorMancone, because we need features! I'm surprised that JavaScript isn't allowed in emails yet.

Conor Mancone

We should be able to run javascript in JSON (which, of course, will automatically execute when you deserialize the JSON), and then we should allow javascript to run Flash! YES!!! Best. Features. Ever!

meagar

12:56 PM

See for example, YAML

ThoriumBR

2:04 PM

xml is strange.

paj28

3:10 PM

What mobile app platforms are there? Is it just iOS and Android?

I'm designing a scoping questionnaire for clients to get a pen test quote

Thinking of adding a question "Does the app use SSL pinning" as that adds 1/2 day at least to the test

Conor Mancone

Is a half a day all it takes you to remove SSL pinning?

paj28

A bit optimistic... but if the lab was well set up then probably

You certainly can't remove FB's pinning in 1/2 day, although I think they now have a mode for pen testers

Any ideas for other questions welcome!

Conor Mancone

All my questions are very broad and would require teaching me everything, so that's okay :) I tried to pentest an app (just trying to setup a proxy to intercept the HTTPS traffic - no SSL pinning) and I gave up after half a day. Clearly though if it's something you do regularly...

reed

isn't disabling SSL pinning going to be "cheating"?

paj28

For back-end vulns then no, you can expect a hacker to disable pinning and attack the back-end

For front-end vulns then yes, it's no good disabling pinning then reporting "No SSL pinning" :)

Interesting approach to disabling pinning (not tried it yet) github.com/PortSwigger/brida

reed

3:20 PM

ah, ok, now I get it

paj28

3:31 PM

Also, how should I structure the questionnaire

Typically I've listed it by service

Web app test, Build review, Wifi review, code review, etc.

But maybe it should be by asset

e.g. Web application, Server]

and under web application, they get a choice of application testing or code review

Fire Quacker

4:08 PM

Suppose you have the power to expunge the marketing for one infosec product. Your choices are:
- Privacy VPNs
- Darknet monitoring and removal services
- Enhanced validation certificates
- ___________________ (fill in the blank)
Which do you choose?

paj28

Can I have "any product or service which doesn't deliver its claims" as the blank?

Fire Quacker

Too broad

If you did that, it would cover the other three already

paj28

4:25 PM

Ok, then I'll go for Intrusion Prevention System

Conor Mancone

@FireQuacker Oh man, that's a tough one

Fire Quacker

@paj28 I guess I get annoyed more by ads targeted at naive consumers... Do you see a lot of overhyping of IPS?

paj28

My exposure to this is a bit out of date, but a few years ago

Yes, not just overhyping, but risk analysts basing decisions on the overhype

Conor Mancone

@FireQuacker I think I can agree with that. If a corporation gets duped into buying useless IPS software, then that's their issue. When I see ads all over the internet about how VPNs fix everything, protect you from hackers, and somehow solve all malware, it makes me gag

ThoriumBR

4:40 PM

private VPN's are mostly useless to protect anyone against the threats they are "solving"... I watch some channels on youtube that are sponsored by nord vpn and I laugh at the pitches

reed

@FireQuacker I choose "Security Suites / Antivirus software" bloated with FUD and "dark patterns" (= those stupid practices involving manipulations of the UX, like a big red button saying "I accept" and a barely visible small gray button with the alternative choice they would not want you to make)

ThoriumBR

"hackers are after your financial data! use NordVPN and be protected!"
as if a vpn could protect against a keylogger, a weaponized freeware, or a phishing site...

Fire Quacker

@reed Hey, if you want to use the free antivirus, that's the cost...

Fire Quacker

4:56 PM

I was partially inspired by somebody on another forum. The forum got DDoS'd, so one user posted a screenshot from his darknet tool, and was like, "Oh wow, there's thousands of usernames and passwords, including the admin's email address, the forum must have been hacked!!" Of course, the screenshot also said "exploit.in" (a data dump from several years ago), but that didn't stop the tool from having a button to request the data to be removed.

A) That sort of monitoring is free on Have I Been Pwned, B) the data had nothing in particular to do with the forum, and C) ...requesting data to be removed from the darknet? Okay...

Conor Mancone

@ThoriumBR Yes, that is one of the ones in particular that I have seen, although many of them have the same garbage. I think it is because internet privacy has become such a hot topic, and they can pretend to help with that (even though they don't)

paj28

5:33 PM

Security vendors have an uncanny ability to understand what users desire and what security pain they feel, and to offer products that claim to solve those problems - even when it's impossible on a technical to solve such problems using their approach (e.g IPS can only detect X% of attacks, not block everything)

MechMK1

6:45 PM

0

A: Rewording "Whitelist" and "Blacklist" tags

I'm against that change, because frankly, I think it doesn't improve anything. I think it's virtue signalling at best, showing "we're doing something" without actually doing anything substantial or impactful. If you have a look at the systemic problems that black people in the US and elsewhere fa...

@paj28 Because people rather hear "Buy our product to solve your problem!" than "Your problem is extremely difficult and most likely impossible to solve completely. Any solution one might offer will only mitigate a subset of your problems and in all likelyhood may create a whole set of problems of its own, such as a false sense of security, higher maintainance requirements, etc..."

paj28

8:01 PM

@MechMK1 - Yep, exactly!

MechMK1

Fleetwood Mac - Little Lies (Official Music Video)

►

^- Basically

paj28

"little"

MechMK1

8:23 PM

I mean, it's what business people want.

They want to check boxes that cover their asses

Doesn't matter if we had a data breach. I have an audit report that tells me we are state-of-the-art and so it's not my fault

I just played a mobile game and got an advertisement that suggested if I played the game in question I could win real cash.

I feel like advertising real-life gambling to children is...probably illegal?

reed

9:04 PM

advertising and typical marketing practices need to die

MechMK1

@reed I mean, there's advertising and there's advertising

If I go to the grocery store, I don't mind if they inform me that there's a sale on strawberries. It doesn't seem unethical to advertise products from a grocery strore at the grocery store.

However, once advertising is detached from an intent to purchase, things look different...

reed

I know some video games actually use addictive mechanisms to make players buy stuff (loot boxes, etc.).

those mechanisms are actually the same you would find in slot machines

it works because "random rewards" are going to be addictive, and encourage compulsive behaviors

MechMK1

Oh yes, absolutely. Video games are designed in absolutely disgusting ways. Loot boxes especially are just the worst

First of all, when you are told you "get" a lootbox as a reward, you don't actually get anything. A loot box by itself is worthless. Quite literally.

What you get is an opputunity to purchase something for a fixed price, but with unknown value.

Imagine if a grocery store operated that way. You'd buy a 20 € grocery bag and you'd get random ingredients. Maybe you get 7€ worth of stuff, maybe 16€, maybe 25€. And who knows what exactly you'd get.

I hate loot boxes and aggressive monetization schemes with a burning passion. Especially when they are crammed into pay-to-play games.

reed

9:32 PM

I'm wondering if the black color has negative connotations in most cultures, including among black people, or not. After all it's still the color of night, darkness, etc. Black represents the evil side in the Tao symbol as well

MechMK1

@reed I think your association with night and darkness is quite important. We are far more vulnerable in the dark than we are in the light, which gives predatory animals power over us.

Fear of the dark is quite a rational fear, at least it used to be for thousands of years.

So in a very primal sense, black can be seen as the colour that represents disempowerment.

And to think of, even today we consider nighttime to be "more dangerous" than daytime. Imagine being alone, walking home down a road with someone walking towards you. At night time, many people would consider this to be a threatening scenario, while probably less so at day time.

reed

9:49 PM

in western cultures anyway, I'm pretty sure black isn't perceived as "bad" because of black people. It's probably related to darkness as I said.

so even if black wasn't universally considered the "evil" color, I'm not sure if we should replace it in words like blacklist, black mass, black magic, etc.

it might not be universal, but it's not racist either, in other words

MechMK1

I don't consider the words "Black Hat" to be related to black people in any way. Like, not at all. I think that this whole discussion about what words to remove in order to not possibly offend some people is...quite ludicrous.

Imagine you were a minority wherever you are right now. Perhaps you even are a minority, I don't know.

Imagine feeling your "other-ness" every day, how people see you as different. Imagine the worst possible things that could happen to you. Being excluded from social groups because of your other-ness; being always "randomly" selected for security searches; just generally living a double standard.

Now imagine all of this, and the only response the majority has given you is to replace a word with a different word, and removing some marketing mascot from a bottle of syrup.

Conor Mancone

10:10 PM

Even after all of these recent attempts to rename things with "black" in it, I still never connected the dots to black/whitelist until now. Those make plenty of sense from my astronomy background - filters and what not - black blocks light, "white" lets it through

MechMK1

I just find it all soo ridiculous

And I am still mad that they bastardized our anthem

Conor Mancone

I'm really not trying to be difficult here, but trying to understand the application. Should we go British and figure out how to drop "cracker" from our lexicon and replace it with "biscuit"?

For the unfamiliar: en.m.wikipedia.org/wiki/Cracker_(term)

MechMK1

No, it's not racist when it's against white people, you know?

Also completely off-topic, but if you need to teach someone one math formula, let it be 1-(1-p)^n={0.5, 0.75, 0.9, 0.95, 0.99}

It probably has a fancy name, but I like to call it the "MMORPG formula", because it shows up in MMORPGs all the time.

It works like this: Substitute p with the chance of an event occuring (e.g. an enemy dropping a specific item), e.g. a 0.5% chance to drop a rare sword. So you end up with 1-(1-0.005)^n

Now on the right side, select which percentage you want to have (e.g. 50%, so 0.5)

And you will see, the real solution is about 138. So you need to do the thing 138 times before you have a 50% chance for that event to happen

For a 75% chance, you need 276 tries

And for a 95% chance, you need just shy of 600 tries

And it makes sense on an intuitive level too. If you had 1000 people farming together with you, then after 600 tries, 95% of them would have the item at least once.

This formula saved my ass countless times :D

You can do it the other way too. If you insert a particular value for n, you see how high your chances are of that event happening at least once with those n tries

So in the previous example with a chance of 0.5%, after 300 tries, my chance of getting it at least once are 77%

Transcript for