« first day (3779 days earlier)      last day (53 days later) » 

7:52 AM
@nobody He only surpassed the little one. He's still "only" at 34.5% of the combined bears.
 
8:09 AM
@A.Hersean Even surpassing the little one is an achievement to be proud of for any human. I do not believe its even possible for a human to have more rep than the combined bears.
 
Ok, i feel left out, who, or what, are the bears?
 
32
A: The Memes of Information Security

Rory AlsopMeme: Bears Originator: @ThomasPornin, @ScottPack, @AviD Cultural Height: July 2011 Background: Our highest rep user, cryptographer Thomas Pornin created a couple of distinct accounts with bear avatars. Being a rather prominent and respected member of the community, this has earned him som...

 
huh, interesting
and wow.
 
lol
@djsmiley2kStaysInside Its a bit like dog jokes for me
also
 
he's written a ssl lib?
wow, ok, prob deffo knows his stuff then :D
As opposed to someone who just chases bounties ;)
 
8:18 AM
@djsmiley2kStaysInside He also figured out the CRIME attack before it was released to the public
579
A: CRIME - How to beat the BEAST successor?

Thomas PorninThis attack is supposed to be presented 10 days from now, but my guess is that they use compression. SSL/TLS optionally supports data compression. In the ClientHello message, the client states the list of compression algorithms that it knows of, and the server responds, in the ServerHello, with ...

And POODLE too.
 
I fear you guys are too clever for me :D
I like to feel inteligent :D
 
No not us, just that one bear
 
8:30 AM
You want to learn cybersecurity? Just read his top answers. Combined, they are worth more than any infosec course I've ever attended.
 
Add forest's answers to that, and you've covered almost every area of infosec
 
@djsmiley2kStaysInside Oh, he's not anything like a certain user we love to complain about
 
welp, i'll stick around and maybe learn a few things
not sure I'll ever be a info sec expert, it all gets a bit too low level for me
 
He actually seems pretty down to earth and has his head screwed on the right way
 
Absolutely loving the fact I have 3 monitors at home now tho :D
 
8:36 AM
@djsmiley2kStaysInside lol. Other than my degree, I'm not exactly a security person
 
@JourneymanGeek You have a degree in infosec?
 
@nobody one of my majors is in "Computer Forensics and Information Security Management"
 
8:55 AM
Hey, anyone here have experience with yum or RHEL?
 
Does 10 years old XP count?
 
Yes
How can I list outstanding security updates?
 
There are security updates on RHEL?
 
One would hope so
I tried yum updateinfo security all but that prints way too much irrelevant stuff
 
I wouldn't count on their completeness. Same with Debian.
 
8:58 AM
@MechMK1 should be dnf now
 
My point is, with yum list updates, we got some security-relevant updates, and now the customer claims that those are false positives
 
@MechMK1 as in they are updated or they don't need to?
 
@JourneymanGeek Kind of both
It's weird
I've been thrust into this with little to no info
I'll check if dnf is installed
 
@MechMK1 for extra fun on newer versions yum is an alias for dnf
@MechMK1 actually I'm getting things our of order...
what version is it?
 
dnf isn't installed on that system
RHEL 7
I think
 
9:01 AM
ah ok
 
My rule of thumb is that if it's REHL/CentOS/Debian stable, it's in practice outdated even if all security updates are applied.
 
Yeah, RHEL 7.7
 
I'm talking slightly out my ass and its not default .
@A.Hersean Yes and no
 
Backporting security updates is a broken model that does not work.
 
Its 'stable' and 'concervative'
 
9:02 AM
@A.Hersean I agree, but that doesn't really help me solve the problem at hand
 
and sometimes updating to the latest might not be desirable
I've worked in linux shops where you literally had to have specific versions of software for specific things to work
often outdated
 
It helps in the sense that you could write "outdated" in your report without bothering with the details. But yeah, sorry that I can't help more.
@JourneymanGeek I know the reason why backports are useful. That's the same reason some are still sticking with PHP 5.5.
 
Seems yum check-updates --security does the trick
 
@A.Hersean not even backports
 
s/backports/outdated software/
 
9:07 AM
Yeah, backports are useful, but in the end, it just leads to shitty software
Shitty software that is built on top of outdated buggy software
 
Well yes, but the point of everything is making work possible. There's nothing more secure than embedding your computer in 6 feet of concrete and sinking it :D
 
I saw a talk (in french) a few years back on the job of one of the security maintainers of Debian. Best case, they can backport 50% of security patchs. That's only for main pieces of software. Usually libs and dependencies don't have that that level of security fixes, while their impact can be huge. That's due to the simple fact that it takes a lot of manpower to backport patchs, and neither Debian nor Redhat have enough of it.
 
My problem is the following: Imagine your software relies on version 7.2.1 of something - that's literally the only version you support.

Now a critical bug in 7.2.1 is found that can only be fixed by updating to 7.2.2. No backport possible. What do you do?
 
@MechMK1 in the real world?
 
The fact that a software only supports 7.2.1 of something usually shows that it's shitty software made with a broken interface
 
9:11 AM
You don't
 
@JourneymanGeek yeah, "get pwn't" basically
 
@MechMK1 I write a non-compliance or a vulnerability in my report. It's their job to fix it. If I also have to give advice, it would be to update their software to the most recent version, redesign their architecture to work with it, and most importantly redesign their process to be able to keep all of their software updated (distribution of updates) so that the same issue does not occur again in the future.
 
@A.Hersean If I could, I would
It's complicated
 
If it's your job to fix the issue, you can ask for the resources (manpower, time, money) to fix it. If you can't have those resources, document that you are not given what's needed to perform your job. If it's not your job to fix the issue, I have trouble to see how it's complicated for you.
 
Seems no security patches are outstanding. At least that's something to put in the report
 
9:28 AM
yeah my windows XP has no security patches outstanding either ;)
4
The joys of office politics
 
 
2 hours later…
11:48 AM
Pet Peeve of mine: The fact that in the beginning of the movie Iron Man, terrorists capture Tony Stark and force him to build a missile for them. For all they know, Tony is simply the CEO of Stark Enterprises.
That's like kidnapping Tim Cook and telling him to build you an iPhone.
 
12:21 PM
well he built the reactor in his chest...?
or did that happen after
 
none of marvel's movies make any sense anyways
 
The only one you need to watch is antman anyway
 
I enjoyed em :O
 
why that one in particular?
 
it's pretty damn funny.
Also Lois.
is awesome
 
12:26 PM
@nobody lol
I think @djsmiley2kStaysInside Miiiight know
I officially worked on that one
 
oooooo WHAT :O
 
@djsmiley2kStaysInside I'm pretty sure I shared the screenshot of the credits before :D
 
@JourneymanGeek lol
I really don't have the patience to watch hour long movies
 
Maybe you did, but I'm dumb
:D
 
I just read their summaries on wikipedia so I know what people are talking about
 
12:27 PM
If you work for a VFX studio - there's too many people to credit them all
So what they do is they credit people in rotation
In british studios they also sell you swag, which on hindsight is a brilliant con
 
Hmmmm
i wonder if my company can put credits on the outsides of supermarkets :D
 
12:48 PM
@djsmiley2kStaysInside No, the doctor built it for him. Tony was unconscious for that
So up to that point, Tony may as well have been a regular suit, who could have said "Look, I just own the company. I'm not actually the one building the weapons, okay? My engineers do that."
 
1:22 PM
@MechMK1 Wouldn't they just kill him, if he told them he was no use for them?
 
@nobody He's still the CEO of a major corporation. Blackmail is still possible
But the plot should be "We need you to get us weapons"
 
True, I guess no one puts in that much thought when writing the plots
 
Wasn't Howard Stark known as an inventor when he started the company?
Maybe people figured Tony took after him
 
1:55 PM
I'll have to watch again
but pretty sure it's well known that Tony created the Arc Reactors
 
@djsmiley2kStaysInside Yeah, he did, but not the initial car battery magnet thingy
@FireQuacker Isn't that kind of a leap? I mean, that's like kidnapping Edsel Ford and asking him to build you a car.
 
that Stark Industries is famous for...
same way what'shisface Dyson created Dyson hoovers vaccumes
 
Wouldn't it make way more sense to kidnap one of his no-name engineers?
Like, way more likely to have hands-on experience with it and way less likely to be heavily guarded?
But I guess movie's got to movie, so don't question it
 
I think the Arc reactors were considered a toy until Tony invented the one to replace the car battery thing
 
Dyson did design the cyclonic suction thing I guess
 
1:59 PM
someone once kidnapped the CEO of Hineiken... tho I guess they didn't demand him to make beer...
 
Did that one montage at the start say anything about Tony inventing stuff when he was in high school and college?
I remember he was shown on the cover of magazines, but that may have been for his celebrity personality
@MechMK1 If you ask on movies.se, somebody is bound to give you an in-universe explanation, with screen caps to prove it
 
-2
Q: question vulnerability

Marco Polois there someone that is able to help me to do this exercise for one client on vulnerability please? It's an e-mail from customer. The following came from one of our customers: “Dear Team, I have successfully scanned my code with your server. The following has been identified by your product as a...

Why the hell does this guy think we will do his work for him?
 
2:19 PM
> Please provide your reply email to the customer. Remark:
> - Answer should be only text (Word or PDF)
> - Not more than 1-page long.
I'm with Schroeder. I think it's homework
 
ok when I wrote my comment, there was no code in the question. So it looked pretty weird before that
 
Also note that the "customer" is asking for clarification on scanning service, supposedly provided by the OP. If the OP wrote a scanning service, then the OP should know what a SQL injection is.
 
Yes
That was what I was wondering about
makes sense as homework though
 
Homework questions should be framed as "This is what I tried, this is how I got stuck. What am I doing wrong?" and not "Can you tell me what the correct answer looks like?"
 
It's fun when they take the scenario from the question and pretend that it's real life
 
2:42 PM
@MechMK1 But then they would have to work at least a bit. It's easier to ask someone else to do it for you, especially when you skipped the lesson and are totally at loss. /s
 
@A.Hersean Yeah I get that
40
Q: Misguided use of offensive figures in student presentations

nablaI recently had an experience while overseeing student presentations in a course I am teaching. While the concrete situation could be handled without much ado due to some special circumstances, I thought the general problem interesting enough to ask for opinions here. The case is the following: In...

Based and redpilled
 
I didn't read schroeder's comment neither yours. You can forget my previous statement.
 
@A.Hersean I didn't know you were allowed to tell people that ;)
There were so many instances in my life where I could have used that
 
3:04 PM
Most of the time, publicly recognizing your small mistakes or awkward social behavior and telling others to move on is enough for them to forget it in a few days. This works by removing the potential emotional anchor your interlocutor could have unconsciously attached to the memory.
So indeed, I just allowed you to tell people that.
 
3:35 PM
@FireQuacker I don't think they even did that
I think they literally copied the question, verbatim
 
I wouldn't mind if they faked it better. But if they won't even put the work in to do that, then ... well, then they'd just quit early and ask someone else to do it for them ...
 
3:51 PM
yep - I've found the code and the "email text" verbatim
 
Yeah, copying questions is quite poor
You can't even say it makes sense when you don't understand what's being asked, because why ask us when you could ask the professor?
 
J--
4:05 PM
Evening.
 
*late morning
 
 
2 hours later…
6:02 PM
@MechMK1 how is your Portuguese? the Austrian embassy in Brasilia-Brazil is searching for people with Portuguese and German knowledge to help around the embassy... ah, and they need basic computing knowledge, so it may be a problem...
 
6:24 PM
@ThoriumBR Meu português é muito pobre. Eu também não sei nada sobre computadores.
 
haha... I guessed..
 
Desculpe
 
Ich nein sprechen Deutsch, und ich habe keine europäische Staatsbürgerschaft...
and google translate is only useful for online iterations
 
well this is annoying
xfce4's background setting utility, won't search subdir's for images
so i either need a dir that has symlinks to all my photos... or use something else to set the background I guess :S
 
I use xfce and I don't remember setting the background...
I don't even know what is on my background...
oh, it's a dark blue color, coincidentally the exact same shade as the background of this room footer... haha...
xfconf-query --channel xfce4-desktop --property /backdrop/screen0/monitor0/image-path --set /usr/share/backgrounds/xfce/xfce-blue.jpg
and xfconf-query --channel xfce4-desktop --list to list your monitors, yours may be another one...
 
6:42 PM
:D
yeah
so you can choose a folder, to load random images from - great
cept..... all my photos are in subdirectories
 
mkdir backgrounds; cd backgrounds ; for f in $(find /where/my/pics/are -type f -print) ; do ln -s $f ; done
 
that'd work, ty @ThoriumBR
 
my pleasure
 
I was jhust being really lazy ;)
oh lordy hahah
it's breaking already :D
tim@MushaV3 ~ $ find /backups/googlePhotos/photos/ -type f -print | wc -l
111358
it won't lin kthat many, as many have duplicate names, but still hahaha
 
wow... it will take a while for the background selector tool to draw them all
 
6:49 PM
yeah lol, I might need to think up a slightly better solution....
 
you'd better change them using a script
 
I'm going to let it finish doing the symlinks and see what it thinks....
At a old old job, we had over 1million mp3s in a single dir on ntfs.
 
I had one for changing wallpaper on cinnamon, but now I don't run cinnamon anymore (corporate-mandated RH linux)
 
It'd break in a multitude of interesting ways
yeah, years ago I had one for setting the root window, might of been on xfce4 at the time, I can't remember.
 
6:55 PM
"By a truly unbelievable coincidence, I was recently out for a walk when I saw a small package fall off a truck ahead of me. As I got closer, the dull enterprise typeface slowly came into focus: Cellebrit"
BWEAHAHHAAHA
 
Read all of it
 
"we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned"
omfg
hahaha
Beautiful.
 
Can't wait to get my aesthetic files
 
hahaha...
I am wondering what are the chances of a security researcher accidentally stumbling upon a Cellebrite pack falling from a truck right in front of him...
more likely it's a cover story to protect the one who have the kit and leaked it to the researcher
 
@ThoriumBR The chances are definitely practically zero
 
7:35 PM
hmm
thunar is like 'nope'
 
7:46 PM
maybe if I had 2000 random photos
> find /backups/googlePhotos/photos/ -type f | shuf -zn 5 | xargs -0 -n1 -I {} ln -s {}
xargs: argument line too long
clearly doing it wrong hahaha
 
8:18 PM
> tim@MushaV3 ~/backgrounds $ find /backups/googlePhotos/photos/ -type f | shuf -n 5 | xargs -0 ln -s
tim@MushaV3 ~/backgrounds $ ll
total 4
lrwxrwxrwx 1 tim tim 309 Apr 21 21:17 'FB_IMG_1603787791424.jpg'$'\n' -> '/backups/googlePhotos/photos/2020/06/VID_20200605_121034278 (2).mp4'$'\n''/backups/googlePhotos/photos/2018/07/IMG-20180709-WA0000.jpg'$'\n''/backups/googlePhotos/photos/2020/04/IMG-20200416-WA0000.jpg'$'\n''/backups/googlePhotos/photos/2019/04/20190428_125316.jpg'$'\n''/backups/googlePhotos/photos/2020/10/FB_IMG_1603787791424.jpg'$'\n'
nope :|
 

« first day (3779 days earlier)      last day (53 days later) »