« first day (3695 days earlier)      last day (40 days later) » 

2:13 AM
Yikes....
Which is a completely inadequate response, but there really isn't anything else to say....
This world is a broken place and has been for as long as people have been around
 
 
8 hours later…
10:06 AM
@ConorMancone This is just so fucked up
 
@MechMK1 That's people for you. From the very beginning
As a result, I used to be part of the "Voluntary human extinction" movement. Sadly, I found their plans were not ambitious enough, so I founded "Mad scientists for the involuntary extinction of the human race". We haven't made much progress though because we need a new name that has a catchy acronym.
 
@ConorMancone I think "eco terrorist" is a good way
 
@MechMK1 That is too "1990s". Need something more modern
 
yesterday I was watching a documentary about the first nuke test, and the question if detonating it would burn the entire atmosphere
 
@ConorMancone The 90's were the last time I felt genuine happiness
 
10:21 AM
as there was no such test yet, they weren't sure, and did some math and found that the security factor of the test was 1.6, and anything bellow 1 would indeed ignite the atmosphere
imagine that.. the security factor for a test that could ignite the atmosphere were an order of magnitude or two less than the cables on an elevator
and some people are afraid of elevators...
 
@ThoriumBR Well, people could die if the cables snapped
 
That isn't what would make me afraid of elevators...
 
@MechMK1 that's a good point...
 
Sorry, I promise I'm not trying to be depressing today...
 
10:24 AM
Worst elevator deaths are always in china
Like that one disabled guy in an automatic wheelchair
He tried to get to the elevator, but the door closed before he could get in
 
@ThoriumBR The first time - and last time - that people had to legitimately worry about literally destroying the world
 
Apparently, this made him angry, and so he bumped continuously against the door
The door gave in and he fell down the elevator shaft
As far as I recall, nobody else was killed in the incident
The other one was like in a horror movie
Elevator is stuck between floors, someone is inside
Emergency personnel tries to get inside to grab whoever is inside
Elevator gives in, cuts the guys head off
What an awful way to die
 
I thought that only happened in movies...
 
Apparently, also in china
There was also another video of an "automatic garage", which are quite common in china
Because you know, lots of cars
 
your timing there cracked me up a lot more than it should have :)
 
10:28 AM
Morbid humor is the best humor
So the way these garages work is that you place your car on a conveyor belt, and the car is then automatically transported into the garage, where it's stored away
 
I am banging my head against the wall now... our government is stupid! in the middle of the pandemic, government cut fiscal benefits for the import of substances for making the vaccine...
and we had an ENTIRE STATE with no hospital oxygen because it's a isolated state, the US offered us a cargo plane to ship oxygen, and the health ministry is studying the proposal for *10 DAYS*
 
the offer was "we have this plane stationed at Sao Paulo, take it and fly oxygen there. it's a huuuge cargo boeing, take it and fly"
 
There's even the video here in case you want to see
I guess that means she didn't die
Otherwise, dailymail has huge balls
Kids and cellphones, amirite?
 
@MechMK1 this isn't a bad way to die... you die in an instant, no pain, no despair, no dread... but starving on the elevator is a terrible way to die.
nobody cares about you, nobody misses you, nobody asks where you are and if you are well, and you get weaker and weaker, you give up screaming
 
10:33 AM
@ThoriumBR China is fucked up
Like, that isn't even the most fucked up
 
things that kill in a second are the good ways to die... things that kill in a week are the terrible
 
The mass of videos of people intentionally rolling over toddlers are where china really shows its face
 
@MechMK1 I remember reading about that :vomit:
 
Would you like to know why chinese people run over toddlers?
It's because of their "healthcare" system, and I am using that term in the loosest way possible
 
@MechMK1 Please enlighten us.
 
10:36 AM
Running over toddler heads is a form of healthcare?
 
Basically, if you call an ambulance, you are responsible for that person's medical expenses, if they can't pay.
And lots of people in china can't pay for healthcare
You think it's bad in the US? You have no idea how it's in china
So if you have a car accident involving a little child, it is cheaper to run it over again and again to ensure it's dead, than to call an ambulance
That's also why if chinese people see someone laying on the street with injuries, they just walk past them
Because if they called an ambulance, their entire livelihood is potentially gone
 
That's about what I remembered. In the case of someone's death you might be required to make a payment, but it will be much less than the cost of healthcare or life-long support of the person's needs if they are disabled. Apparently people like to then bribe judges into ruling it an accident so there are no criminal charges
 
@ConorMancone Exactly, you don't need to pay if it was an accident
"Toddler ran in front of my car, had no chance to stop in time, how unfortunate. Please disregard this security camera video of me driving over it several times"
 
Until not long ago, I thought China was a normal country, not really normal, but not too different from other civilized countries anyway. Then I learned that it's not even a democracy, because you can't found your own party. SAY WHAT?!?! If it wasn't for their economy, we would be ignoring it like a third world country, or bombing it like the middle east
 
Yeah, I heard about a person help an elder woman to get into a bus, the elder one still missed a step and sued (and won) against her kind helper. It made the news. Now, nobody wants to help others in mainland China.
 
10:39 AM
@reed China is playing the economy game
@A.Hersean The system is designed to kill people, literally
@reed Everybody is economically dependent on China, and China knows.
It even happens here in Austria
 
@reed They also have concentration education camps for Uyghurs (instead of Jews).
But everything is fine.
 
@A.Hersean Prisoners are also all organ donors
When someone wealthy needs an organ, some prisoner will have an accident
Organs are readily available then
 
The Uyghurs are sterilized as soon as they get in those camps.
 
A friend of mine works for a small company, and one of their their largest customer is a chinese company. One day they called and demanded that they must not label Taiwan as an independent country on their website
What did the company do? Of course they obeyed immediately
@A.Hersean You can do anything you want, as long as you have the money
 
yeah, it it wasn't for that (economical reasons, and maybe nuclear weapons), we would be treating it much differently. But instead, our politicians talk with China, strike deals, negotiate, shake hands.
 
10:44 AM
What I find so fucked up is that so many modern liberals have such a boner for China
"Look how amazing and socialist this country is"
THEY'RE LITERALLY MURDERING TODDLERS!
 
I really never heard about this thing about toddlers
 
It's not a story the newspapers like to bring, because oh gee, can't make china look bad
 
I laugh when people talk about going back in time to kill Hitler, when there are his spiritual inheritors next door.
+1 Godwin point for me!
 
Reminds me of a line from Rick and Morty:
"You're worse than Hitler, because Hitler at least care about Germany or something"
The people who own the companies who make endless money off chinese slave labour are the same people who own the media companies, who tell people how amazing china is
Also, wanna see how socialist and caring your big tech companies are?
 
I think the problem isn't the owners, it's the stock holders. These people have way too much money, keep on buying stocks, keep making money, and buy other stocks. So the NWO maybe already exists, in a way, if you consider that some people have way too much power in lots of different areas
 
10:52 AM
Yeah yeah, the "globalists"
 
That's the principle of capitalism.
 
Let's call them that
 
BTW, the answers to this question have been bothering me for years, and I finally decided to add an answer to this very old question. This is shameless self-promotion, but would you guys mind reading my answer and upvoting/downvoting as you see fit? The current answers all miss the big picture, so I'd like to have a proper answer on it...
0
A: Is XSS a server-side or client-side vulnerability?

Conor Mancone tl/dr: If the server is building the HTML then the server needs to protect against XSS. If the client is building the HTML then the client needs to protect against XSS. With changes in the way web applications are built this question deserves a re-visit, since the answer is more than just a ma...

 
Anyone who genuinely advocates for unregulated free-market capitalism is either inhuman, delusional or retarded.
@ConorMancone Stored XSS and Reflected XSS are a server-side vulnerability. DOM XSS is a client-side vulnerability.
 
@MechMK1 If people were better then free-market capitalism would be perfectly fine. Then again, if people were better, communism would be find too
@MechMK1 I would still say the same thing. It depends on who is doing the rendering :) If a React app is generating literally 100% of the HTML on the page, then the server needs to send "raw", unescaped data to the client application.
 
10:57 AM
@ConorMancone To quote Bill Nye, the spectrum guy: "If things were any other way, things would be different."
@ConorMancone Yeah, no idea about react
 
What's wrong with communism? I mean, isn't science, engineering, and technology in general already based on communist theories? For example, by killing a process when it's wasting too much RAM, if other more important processes need it. Isn't that communism?
 
Can think of a few things...
Daily reminder that the communist death toll is magnitudes higher than that of national socialism, yet people have no problem openly advocating for communism
Also inb4 "it wasn't real communism"
 
But those are communist regimes, not communist theories, I guess
 
The third reich wasn't real national socialism then
 
If every attempt to implement the standard fails badly, then you have to wonder if the issue is the standard.
 
11:00 AM
Truly, yeah
 
Although the issue isn't the standard - the issue is human nature.
 
I have to admit I don't know the difference between socialism and communism, hmm.
so maybe what I mean is socialism
 
Communism in theory: "We're all equal"
Communism in practice:
 
@ConorMancone That's an issue with the standard - it doesn't take in account human nature
 
lol, I've never seen that before. What in the world is that???
 
11:02 AM
@ConorMancone A huge Mao statue
Also let me quickly make the DMZ inaccessible for every chinse citizen ever
 
Huge is an understatement. I actually knew it was Mao right away, and I was trying to decide if it is because I recognized him, or from the context, or because he is literally the only person in the world that people would build a gigantic "golden" statue for
 
动态网自由门天安门天安门法轮功李洪志Free Tibet 六四天安门事件The Tiananmen Square protests of 1989 天安门大屠杀The Tiananmen Square Massacre 反右派斗争The Anti-Rightist Struggle 大跃进政策The Great Leap Forward 文化大革命The Great Proletarian Cultural Revolution 人权Human Rights 民运Democratization 自由Freedom 独立Independence 多党制Multi-party system 台湾台湾Taiwan Formosa 中华民国Republic of China 西藏土伯特唐古特Tibet 达赖喇嘛Dalai Lama 法轮功Falun Dafa 新疆维吾尔自治区The Xinjiang Uyghur Autonomous Region
There we go <3
You see, I really love this copy pasta, because people don't understand why it exists
 
I have to go google that thing now
 
It's every word the chinese government has banned
 
It's right up there with the fact that they still have his body on display....
(google the giant statue) :)
 
11:05 AM
@ConorMancone Apparently, it was removed again
 
I'm still stuck on the fact that it exists
 
Cost only half a million USD to make
 
Wow, that's legitimately cheap
 
Things are cheap if you don't need to pay your workers ;)
 
So we could say communism has bugs
 
11:07 AM
Also, have you heard of the term 996?
 
@MechMK1 Reminds me of the RSA shirt, which is such a classic. I'll have to remember this one :)
 
@MechMK1 veeery cheap indeed! here our government published the expenses on grocery, and the president's office spent $3M USD in condensed milk last year
 
@ConorMancone Reminds me of a clip in some video game, where china didn't have its own servers yet
 
but it looks like everything has bugs. Maybe we should run our governments in virtual machines and test them before deploying them
 
A guy noticed that the enemy team had two chinese players
 
11:08 AM
@reed If only.
 
So he posted "Tianmen Square 1989" in the all chat
They promptly both disconnected
Like, immediately
 
I wish that every law passed came with guidelines for measuring success and was then checked after a suitable length of time. Laws that didn't pass "make the bar" would automatically be revoked.
 
I saw someone doing the same on youtube... posting "taboo words" on an unrelated video to see how long the comment would stand before being censored
 
@MechMK1 Boo to both the chinese government and the dude who won by cheating :)
 
Also, if you want to see a bit more of china
 
Have a video from someone who is censored in the US
Xu Xuaodong is a legend
He even did an interview with count afaik
Also last sunday, a 70 year old woman was arrested in germany by 6 police officers, handcuffed too
For the heinous crime of not wearing a mask during a walk
 
today police busted a group that falsified records and let anyone buy firearms. one guy had 20 firearms and 30 criminal convictions. one conviction would ban him for purchasing guns. he was 10 guns short of one gun per conviction. poor guy, so close to the objective...
 
ok, I read the differences between socialism and communism, and I realized that when I say "communism" often I actually mean "socialism". However socialism seems too lax for what I have in mind, and communism too strict
 
@MechMK1 I believe those acts are to set the tone, and make people understand that the situation is serious
it's the "let's set an example" kind of thing
 
11:26 AM
@ThoriumBR I want to ask one of the involved policemen if they felt proud for handcuffing a 70-year-old
 
I believe some will...
 
Also, germany is building concentration detainment camps for "people who refuse to follow COVID guidelines"
Keep forgetting what the chat shorthand for strikeout is
 
that's paying for something you have control over... detainment camp for being from certain group is waaay different
being punished for breaking a stupid law is something you can avoid most of the cases, a concentration camp is not even on the same ballpark
@MechMK1 I keep googling those shorthands all the time
 
Here the most infamous episode was in March/April last year, when a runner/jogger was treated like a terrorist on live TV, followed by an helicopter, with journalists shouting like "Look, look, he's running over there, quick, follow him", and the police saying stuff like "we have alerted the marine forces, etc.". It looked like a movie, and it was just for a runner on the beach. All this of course became viral for its nonsense
It was the period when everybody had to stay at home, and this poor man was running on the beach
 
Just in case you want to see
@reed I'm surprized they didn't nuke him just to be sure
I would have at least alerted the air force
 
11:32 AM
I believe this is the "cops wanting to be soldiers" effect
without people on the streets misdoing things, they got bored, and a guy running became the most action the cops had in weeks
 
@ThoriumBR Gee, almost as if decades of very little police accountability has lead to policemen acting as if they were above the law
 
as if there was a law...
a funny Brazilian story: a drug worked for the water treatment plant. his manager had him sent to a drug abuse clinic to treat his addiction, but he ran away. twice. and got back to work. things started to disappear on the depot, and he was the suspect. he stole a company motorcycle and sold to buy drugs, got busted and fired.
workers rights court fined the company, and they had to re-hire him and pay him for firing a drug addict for stealing company property, not showing for work and doing a mess when he did.
now imagine you have a company here, how motivated would you be to hiring anyone without a 100% clean drug test?
you drink? no way, you may end up an alcoholic, stealing from the counter, and I have to keep you forever
 
In our courts there is always a sign that reads "The law is the same for everybody". It's funny, because it's true, the law is actually the same... it's just the interpretation that is different, LOL
 
J.J
Good afternoon.
 
@reed good point
 
 
4 hours later…
4:01 PM
Anyone got experience with GIAC GWAPT?
Can you recommend it or not?
 
J.J
4:20 PM
@MechMK1 I have not done it myself. But, I have a colleague who did it and they loved it. Said it was incredible.
Not sure in which way you're paying for it. That was bought as part of our training budget because it isn't a cheap course by any means.
So if you're paying for this yourself, something like eLearnSecurity might be a better option.
:)
 
4:42 PM
I'd like to ask a question, but I'm afraid it won't be good enough for this site. The question is: how likely are VM-related exploits in the wild? I have to say that I'm not even sure what "in the wild" means exactly.
 
J.J
Probably a little too vague to be asked, but I think you could find a way to get it in if you worked on the title and I for sure would be interested in the answers.
 
I guess "exploited in the wild" means that it is "exploited in a way that is not meant to be secret", that is, in other words, everybody can potentially get infected (even by just visiting a website). But I'm not sure this is a good definition
 
exploiting a vm by browsing a site is a stretch
the attacker would need to exploit the browser, get a shell, elevate privileges, and exploit the vm interface to reach the hipervisor, and exploit it to reach the host
not impossible, but not a walk in the park
 
Not long ago I believed that zero-days weren't likely to be exploited that way (in the wild), but I keep on seeing news that report otherwise. So basically, "keep your software up to date" is not enough (anymore) since zero-days in browsers seem to be exploited "in the wild"
so I suppose, if that is true for browsers, popular apps, etc., why not also for VMs?
 
it's the same... 0-days exist from games to firmware, so VM's are included
browsers are used by everyone, and there's only 3 major ones, so it's more likely to an exploit affect a lot of people
 
4:48 PM
hmm, right, so the attacker would need a chain of zero-days, which seems less likely, you mean
 
with browsers auto-updating, even the versions are more or less the same across the internet
@reed yes... to reach the VM, the attacker would need to breach all the layers above it
and as usually VMs are not used by end users, but by servers, don't expect an attack chain on a VM starting with "user clicks on this link"
 
Call me crazy or paranoid, but I'm actually afraid of browsing the dark web because I believe it's a bad place full of bad people on both sides of the law: criminals and cops. And I believe those people have zero-days. So I don't go in dark places, I prefer to turn the lights on
@ThoriumBR, yeah, makes sense
 
whonix is a good option for that
haven't used it, but reviews that I've read put whonix on a good light, and the foundations are good in theory
and don't worry too much about 0-days, unless you are a special criminal, special journalist, special crypto trader, or work on high-tech stuff
0-days are not cheap, and burning a 0-day on a random guy on a random darknet forum is stupid
2
 
@ThoriumBR That's what I used to think too, before I started reading the news. In the last year or so, I've seen lots of news titles reporting "zero-days used in the wild". Whatever that meant. However I'm not experienced enough to understand how serious those attacks were
I think they are not used "at random", for stupid opportunistic attacks, but they are probably part of watering hole attacks... so lots of people end up being infected in the wild, while the true targets are more specific
Plus, another thing I'm afraid of, is that more and more people own bitcoins nowadays. So infecting a large number of people, just to find the few interesting machines where to stole bitcoins from, might be a reasonable kind of attack
 
it is... but an attacker targetting bitcoin wallets will probably run a file scanner on the victim searching for wallets, not starting a shell on every one and installing additional malware
and if you have a sizable amount of BTC, keep the wallet offline
 
 
1 hour later…
6:09 PM
@J.J Company pays for it
So cost isn't that much of a factor for me
 
@reed if it helps, I agree with everything ThoriumBR said above.
The recent solarwinds hack is a great example of that. The attackers gained access to about 15,000 different enterprises, but even out of those they only broke into ~150. Specifically government and high-value industry.
Of course, that's on the extreme end
That was an extremely valuable zero-day and the attackers really went out of their way to use it for as long as possible before discovery
I can guarantee that there was someone high-up choosing each target by hand
 
The average user doesn't need to worry about 0-days
Also I just dropped some shrooms
Gonna shitpost on SE in an hour or so
 
Now granted, not every zero day will be quite that "expensive", but the general principle applies. For instance, Google is fairly on top of detecting zero days being exploited "in the wild", and their rapid update cycle means that if you have auto updates turned on the period of time where you might be vulnerable is very low - even lower if someone is trying to hack "the entire internet" with it
(since that will cause a lot of noise and get them caught quickly)
@MechMK1 Sounds fun :)
Is it possible that you get nailed by a zero day? Sure, and probably a bit more likely if you are in the "wild and dangerous" parts of the internet
However, your risk of getting hit by a zero day is much, much lower than your risk of (say) downloading a movie via torrent and finding out afterwards that there was an embedded virus
 
 
1 hour later…
7:26 PM
@ConorMancone Had that recently
A movie I downloaded was actually a .exe file
 
@MechMK1 That's not at all obvious... :)
 
7:46 PM
Enough people will fall for it
 
That is the goal after all. You don't need everyone, just enough people to make it worth the effort
And more on point, you'll probably get enough people for it to be worth the effort, especially compared to the effort of finding, weaponizing, and anonymously making use of a browser (or other) zero day!
 
8:02 PM
Here's a good website to practice hacking skills on:
Nabbed from the edit history of this question:
4
Q: Recovery of bitcoin "stuck in limbo"

AdaI made a bitcoin investment with a company online. The first return sent back to me was fine but the second has issues. They sent me an email like the first time stating that the money was sent but I never received it. I sent them an email to complain, they responded saying that they were investi...

 
8:31 PM
@ConorMancone is this serious? a page from a company with loren ipsun all over the place and someone still put money on it?
 
9:06 PM
I have to say those mushrooms were very disappointing
Probably had them in the fridge for too long
 
@MechMK1, do you listen to techno music? Or electronic music, trance music, etc.?
 
@reed Until right now, I just had my playlist on random and played some videogames
 
That's the first thing that comes to mind when I hear someone talk about psychedelic stuff. I think of rave parties.
I've never been to a real rave party, but I've been to several parties (in night clubs) where they played electronic music (techno, progressive, trance)
 
@reed Nah, mushrooms for me are ususally just some UT2004 with my friend
ALso yeah, psytrance is nice
 
 
2 hours later…
11:09 PM
psytrance is good... I listen to psytrance when I need to concentrate
dark psytrance is even better
 
@ThoriumBR I'd gladly take recommendations
 
11:57 PM
@ThoriumBR I wouldn't doubt it for that reason. There is a theory that scammers try to make their scams obvious so that only the most gullible people even reach out in the first place. It basically let's the people that are most likely to fall for it "self select" into the scam
 

« first day (3695 days earlier)      last day (40 days later) »