@JsupportsPalestine What happened there?

@ISupportTheBoycott For a minute, I thought you were J, back from the dead.

Noap.

Though I'll miss his classy and awesome avatar. =(

Not sure where I can find that one...

Which one?

The smiley face?

That snaazy BDS avatar

good stuff

lol

Worst article ever

techrepublic.com/google-amp/article/…

Basically, a company that decided to ignore the old "Never roll your own" rule, threw in some Quantum FUD, and are claiming that they know what they are doing because they are from the NSA. You can't make this stuff up!

HNQ again

Phrenology? I prefer the more modern term "Critical Face Theory"

I feel like I could literally ask "How is Babby formed?" and it'd hit HNQ

Did you know Terraria crashes when you want to take a picture of the entire world?

Am I the only one who thinks 2fa is almost useless, or much less useful than what they tell me? If I'm the only one, why?

@reed Well, why do you think it's useless?

I agree that some forms of 2FA are useless, but that's usually because the second factor is easily compromised, or it's not a second factor at all.

I don't know, my idea is that it's only useful to protect from: 1) phishing; 2) shoulder surfing; 3) weak reused passwords. And none of those are part of my threat model, except only phishing might still be possible if I'm tired or in a hurry and might not notice I'm in a wrong website, but I would consider that a rare event (never happened so far)

Well, yes. And I can tell you from experience, phishing works

on top of that, I consider 2fa a pain because if you lose the factor (or maybe it depends on your phone which has no signal, or is broken, or you can't find it, etc.) then it's going to be real pain

@reed May I give you one plausible scenario in which 2FA would work and not be a pain?

yes but the question maybe is more like: does phishing work on me? I don't know. I would be surprised. But that doesn't mean you should try pentesting me now, lol

So, imagine a company which uses Yubikeys as their second factor. A Yubikey Nano, to be specific. Barely big enough to stick out of a USB-A port.

Authenticating with Windows requires both the password and the Yubikey, and authenticating with any internal service uses Windows authentication, together with a tap on the Yubikey.

So it is indeed 2FA

Now imagine an attacker sending phishing mails to people inside the company. There are many plausible scenarios, but let's go for one that works EXTREMELY well: COVID Vaccination

"ACME Corp. is pleased to announce that we offer COVID-19 vaccinations for all employees. Yada yada yada. Please click the link below to register for vaccination."

I'm confident you will find at least some people who will click that link. It would redirect you to a page that has the same look and feel as the homepage of ACME Corp, asking you to authenticate with your employee login.

And I will assure you, you will find a decent amount of employees who will happily enter their domain credentials.

Of course, they'll be met with a message that registrations are temporarily halted due to unexpected demand, but they should try again in the future

In that case, you would still be safe, because you require 2FA for everything.

@MechMK1 I dare you to try ;)

I will ask on medical sciences on the first of april

What? I have to wait a year?

Patience is a virtue.

And you want to lead a virtuous life, don't you?

Of course. That's why I'm trying to become a hacker

@MechMK1, yes, 2FA is definitely useful for phishing, and phishing is definitely a threat in many scenarios for still a large number of people, unfortunately. So you are right, in a big company some employees will definitely cause damage. Yet in my situation (basically a tech-literate freelance), I don't consider phishing a serous risk

I'm a hacker because the only alternative would be game design. And here's the thing: The game-dev industry doesn't have unions

so that's maybe why my personal perception is so different from the common perception (which includes complex scenarios like the one you mentioned, companies, etc.)

@reed Triumphant pride precipitates a dizzying fall...

that's definitely why my personal perception is different

besides, I don't even know if something like a Yubikey actually prevents phishing, now that I think of it. Can't the phishing site also steal the Yubikey code?

maybe I'm confused because there are several kinds of what we call 2fa

I download lots of random things from the internet so the main threat for me is my computer being compromised. At which point I guess 2FA is useless

So I don't use 2fa (well I don't even use a password manager)

I basically don't follow any of the security advice I give to others

@nobody, you are insane, LOL

unless you just download movies, pictures, and maybe documents, files

if by "random things" you mean software, then you are insane though ;)

I am not running a webshell on my server, I'm crowdsourcing my CPU instructions.

@reed Well I try to be a little bit careful with software, but basically you can convince me to download anything from github :)

Yes I am crazy, no doubt about that

@MechMK1 But you tell your CPU how to interpret those instructions too, so its fine.

Just see it positively :D

@nobody, then maybe your computer has been compromised already, and we are chatting with the hacker who is pretending to be you, or a bot that is pretending to be you

Pretending to be nobody?

nobody is that insane

Nobody would want to do that

if nobody was hacked, then it wouldn't be a problem

In fact, it'd be really nice if nobody was hacked

Problem is nobody is an absolute idiot, so nobody will be hacked.

And yet a lot of other people will be hacked too

nobody is a paradox

Good thing nobody can tell me what to do

nobody knows what we are talking about

As soon as we get into this kind of jokes, I feel like nobody is enjoying our humor :D

nobody is going to get tired of this humor, so nobody is going to change their username to nothing, so nothing will change because nobody will do anything

correct me if I'm wrong, but the only thing that makes something like a Yubikey secure against phishing is that in some way it checks the domain, so it won't enter the code on the wrong site

Well, it depends what kind of authentication mechanism you use

Yubikeys can do FIDO2, or some kind of OTP

Also smartcards with certificates

I think for windows authentication, they do the certificate stuff, so you can manage it via Active Directory

FIDO2 validates the domain, as far as I know. If you register with example.com, then you will not be able to authenticate with evil.com with that private key

but then wouldn't a good password manager provide the same security? If the password manager with autocomplete won't let you enter the auth info on the wrong URL, then phishing is prevented

What are people going to do if autocomplete fails?

They'll manually copy/paste the data from their password manager

You see, people have been trained for decades to believe that computers "sometimes just don't work", and that they need to try arbitrary workarounds.

hmm, that's a good point for security-illiterate people, yes

With a password manager, that workaround is pretty simple. In fact, Keepass even has a combination for that: Ctrl + V

Aww, no html here

It'll automatically type {username}{tab}{password}{enter}

THE DMZ HAS CRASHED. PLEASE ENTER LOG IN AGAIN TO CONFIRM YOU WANT TO

Whereas a YubiKey with FIDO2 won't allow you any workaround. "This site is not recognized. I cannot provide any authentication data."

ahersean

hunter2

nopassword

wait, why can I see it in clear text?

let me email plaintextoffenders.com

What are you talking about?

I just see ******

THE DMZ HAS CRASHED AGAIN. PLEASE ENTER YOUR REAL PASSWORD THIS TIME

********

*H_*AAERSWus/KjnaXMzY9Eu3cWAU{gj

I type sudo rm -rf / --no-preserve-root in my terminal, and it outputs my password

Just copy it from there

What really?

Let me try

I get : "type: command not found"

I wonder what that command would really do, without sudo, but I'm not going to try, nor open a VM just to try it

it might not even do anything, but I'm not sure

@reed it works, I can confirm

@nobody, what do you mean it works?

oh, wait

@reed I mean you have to reinstall your OS

How is the answer to this question not obvious?

"Because the people who want to be vaccinated will already get vaccinated voluntarily - and the people who don't want to be vaccinated will not enjoy the government to force unwanted medical treatment onto them."

I didn't notice you had included the "sudo" in front of it. I had read it without it. In any case, I was wondering what would happen without sudo, it might remove only some dirs, or it might not remove anything, not sure. But I hadn't noticed you had actually included sudo

@reed You can try a VM

I would say the system will still boot

I'm starting a VM to try

but the contents of your home dir may be gone

@MechMK1 boot into what?

I forgot this one was so slow to start

@nobody Well, your OS

If you try to rm as non-root

without sudo it will definitely boot. With sudo, I don't think so, it would remove the /boot dir as well... I guess

All the utilities are gone

You won't delete any system files

Yeah, with sudo you'll probably delete the bootloader config

So like, you just have the kernel left (maybe), what you gonna do with that

So grub will have a problem

You'll also delete vmlinuz, which I think makes the system unbootable

to sum up: you will remove everything, except the rootkit you didn't know you had installed

You'll probably remove that too :D

@reed So I'm safe? cuz I know its installed

What I would find much more interesting is what you can still do on the OS as it is running

Not a lot, I would assume

Your shell would still be in memory, so all builtins would still work

Actually, you can see how fucky Linux becomes when your OS runs full

Bash tab autocompletion stops working, for instance :D

Why? No idea

@MechMK1 there is autocompletion as well?

Wow autocomplete works so damn slow in wsl that it is easier to type out the whole thing

Without sudo, on ubuntu 21.04, the main user's homedir is mostly cleaned up, but not deleted. The VM still works fine. Rebooted without issue. At next boot I get the 1st boot configuration popup.

Hm... that video didn't have --no-preserve-root

@A.Hersean It's not deleted because for directory deletion, you need execute rights in the parent directory

but the command was not "cd /; rm -rf /"

now I'm going to do something completely useless to demonstrate the obvious, get ready

why are we all wasting our time doing rm -rf, again?

oh right, it's friday

Because it's friday and none of us want to work?

I'm just here to shitpost

that's true, I feel like doing nothing. I should sleep actually

I'll play some Escape from Tarkov afterwards

God I am so bad at this game

But it doesn't matter

It's so much fun

Isn't that just yet another online FPS?

In my time we had only CS 1.6 and it was enough

here's what I did. I created a simple bash script, just #!/bin/bash and then one line "rm -rf ~/"

then uploaded it to Virustotal. Result: nothing found.

Obvious conclusion: antivirus software won't help against unknown threats

I was not ready for such obviousness

I think nobody was ready for it, though

also because an unknown threat might not be a threat. Who says it's wrong to upload data to a server in Russia? It might just be what I want to do

DENY ALL by default

Say, maybe you often forget what you do, what you type, and even your passwords. Solution: run a keylogger and log everything you type, then upload it on the cloud in China or Russia (it's cheaper)

@A.Hersean It's quite different. It's more about looting than straight up combat, and when you die, your gear is just gone too. So you don't want to just jump headfirst into combat.

now I might want to try something else... is the latest huge data leak on HIBP already? I need to check

Besides, you have a "curse in russian" button

Like, which other game has that?

@JohnnyApplesauce Hi

@MechMK1 Life, perhaps

I want to ask a question about a text code injection attempt that I've seen personally a lot but haven't seen anything about online. I want to paste the code verbatim. Is this frowned upon?

@JohnnyApplesauce Post the code on pastebin and link it here

Nope, nothing is frowned upon here

Except TLAs

I think that gives it nicer formatting than posting it directly

Yeah, fuck the ATF

you can paste whatever you want, only make sure whatever you paste doesn't contain any <script> tags or it will be executed here

GCHQ is cool though because it's 4 letters

Ha, the GCHQ found a loophole in our hate utility

@reed <script>getReedsCookies();</script>

But MI6 is still a TLA

No, because 6 isn't a letter

I think the DGSE is happy to be less known than the GCHQ

@MechMK1 TCA

TLA is a TLA

Actually, how about we make a rule for our room, anything posted in script tags has to be executed in the browser console, by everyone currently in the room?

>xss by peer pressure

<script> order_sixty_six(); </script>

That's a new one

CIRO is unhappy though, because it would like to be as cool as the CIA, but is has too many letters

@A.Hersean I feel like DGSE should refer to doges somehow

@A.Hersean Why do you know all these acronyms offhand? Are you an agent?!

is it even possible to get cookies on most websites? Aren't they http-only? Stealing cookies is lame, it's better to ride the session and do what you need to do right away

@nobody I could answer that, but then I would have to kill you

Some are

But I know many sites which don't set that

@reed Hah, that was just the function's name, designed to trick you. See, you got phished :)

@A.Hersean Killing nobody is fine

Oh, OK, I can answer then

I'm not an agent

First Nobody blinds, then Nobody kills. Man, Greek myth is rough.

Nobody is at fault

I actually ate cookies last night. Some with apple, some with nuts and chocolate, but none of them contained text strings

I imagine Polyphemus' brothers chatting with each other. The dialog in my head goes like this:

> Cyclops 1: I heard that Poly's got his eye on a new dame

shake your sexy nobody on the dancefloor

> Cyclops 2: Yeah, he's blinded with love

> Polyphemus [from a distance]: "My brothers! Nobody has blinded me!"

@JourneymanGeek Flagged that as offensive, you can't go about calling me at fault for no reason!!!

> Cyclops 2 [shouting over his shoulder]: Sure thing Polyphemus, sure thing.

Weird, nobody flagged anything

> [The cyclopses laugh]

So nobody is a meme now?

Polyphemus: "I can't see anything anymore! Nobody deleted my entire file system with rm!"

Nobody Knows

I'd say at least nobody knows my fucked up sense of humor, but I think it's common knowledge at this point.

Nobody cares :D

At least that :D

(In the Blues Brother's rythm)

Also I found out tying a noose is really easy

I'm doing that to my headphone cables now

Try falling from you chair to see if it works

@MechMK1 ummm

@JourneymanGeek On the Internet, nobody knows you're a dog

don't do that

we need your brain

I meant actually to make the cables shorter so it's easier to keep in my pocket

I can't hang myself with those, silly - I have no attachment point at the ceiling that can hold my weight

ok so I just read that the RockYou2021 "database" isn't a data leak. It's just a word list

It can barely hold the fucking ceiling lamp

or in any case it's something old. Nothing new on HIBP

@reed Because rockyou isn't in business anymore in 2021 :D

on the music subject: in 2002 I had a gf fan of avril lavrigne and she would listen to her all the time... she was 19 at the time, so it was typical... I was more on linkin park, so... today I found out something interesting about the clip for "I'm with you": she sang it accelerated so when they put the clip on normal speed, everything else looks slow-motion except her. I watched the clip again and thinking the clip is almost 20 years old it looks very cool!

and no, I'm still not a fan of avril

@ThoriumBR man linkin park was the good shit

but the clip is cool

After going through half a decade of abusive relationships, some of the songs make way more sense

or rather, half a decade of an abusive relationship

those were the years when MTV still had music (the M in MTV), at least here in my country

sometimes her lips seems out of sync, but if we think she was singing 50% faster than normal, she was good!

I never got into MTV. Literally just constant ringtone ads with music interruption occasionally

@ThoriumBR I'm into my hard rock, but randomly, i saw on some tv show once, J Lo doing that, so it seems to be quite common

I usually listen to music and not watch clips that much, so I wouldn't have noticed

I really don't remember the last music video I've watched

Music is just music for me, not visual

Album cover is not only ugly, it's also unreadable

in my case, was that from avril

The only visual component for me are album covers, which should get the "vibe" of the music across

my 2nd gf would be proud... or embarrassed... "what? listen to avril on your 40's? You should have done that on your 20's, with The Calling like I asked..."

I'd never tried entering my address on HIBP. I mostly didn't care. My passwords are all different anyway, and if I don't know exactly which service got breached or which password to change, it's not very handy

it turns out my 4 main addresses are not part of any breaches. Cool

my password reedBanana123 is secure then

I mean, compare these two:

Wow, great watermark...

hahaha

I also liked Linkin Park. One of my favorite was Papercut

well, is

An album cover would only ever make me not touch an album. It wouldn't make me want to listen to it

There we go. It's one of those "watermarks when hotlinking" shits

Speaking of linking park, I really like the cover of the one Castle of Glass is from

It's pretty

the first evanescence album was great too

Gummy human

Also, I think xkcd is right when it comes to unpopular opinions

@JohnnyApplesauce Oh you meant about posting on the site, not in chat. On site you should include any code in code blocks

It's much easier to hate what everyone else loves than it is to love what everyone else hates.

@MechMK1 Yeah right, like star wars (in the past atleast)

I once watched a video where two guys were talking

Can't be easy to be a fan of the sequels

Given how much flak they get

I mean, imagine being someone who unironically likes Rey

Apparently one of them had previously made a video where he argued that "canon" (as in canonicity, not "the canon of great literature" or biblical canon) doesn't exist

@JohnnyApplesauce The concept of canon? Or for Star Wars specifically?

The concept, but I'm getting to that

And I couldn't help but get the impression that he didn't start with this idea, but rather because he hated the Disney Star Wars movies so much that he rejected the notion of canon just so he can justify saying "I like Star Wars" and not adding "except the Disney movies"

If stories are open to the reader's interpretation, why shouldn't "canon" be open as well?

@JohnnyApplesauce, I wrote a comment to your question, you can find info on Google if you search for the right strings

looks like it's not malicious though

it might mean that "you got new voicemail" or something

I can think of many better ways for them to say that...

@FireQuacker Because you have to face the wrath of the fans

I think it depends on the works. Some works, which may be subject to an unreliable narrator, may naturally blur the lines between what is canonical, and what is not.

Whereas other works don't do that, and they may be pretty straightforward.

Unreliable narrators should be used more often

@FireQuacker Funny thing, the other guy tried to walk him back

I think, "canon" as a concept should only be used when there is some benefit to it

For example, a game which has multiple endings may require one ending to be "canonical" as the beginning of the sequel

by trying to appeal to his other premises that might cause him reject the notion of Death of the Author

So it makes sense to say "canonically, this happened"

I think the idea of canon is only as useful as what we get out of the idea. Same with genres of something. Nothing in music makes something belong to a genre inherently. Genres are arbitrary constructs.

The reason we talk about genres is because they're useful tools. When I say "I like metal", you will get a pretty good rough understanding of what kind of music I like, even if 10 people who like metal all like different kinds of metal

Same with canon. if you want to discuss what is canonical in a work, you do that for a specific purpose. And if that is useful to you, then the idea of canon is useful to you. Nobody would argue about what is canon in, say, Tetris, because it's a useless question. No answer would actually mean anything.

An L tetromino canonically fell first.

Until Lucas decided to change it to a J in one of the many edits.

I believe that the question about whether or not something is canonical is only relevant if it allows me to understand the work in question, or a different work that references the work in question.

For example, in Hotline Miami, there is a scene where character A kills character B. Later, character B is shown to kill character A. This contradiction can be explained by an unreliable narrator. Given that both character are alive in a later date in the series, it makes sense to assume that "canonically, none of them died"

I think friday gets its name from the fact that it's the day that fries your brain

Possibly

Well, not gonna lie, fried brains are very tasty

Brains are mostly fat after all

in Neuromancer, the author said that "Case never saw Molly again" so he deliberately killed any possibility of a sequel, so any sequel that involved Molly and Case wouldn't be canon

and that's sad...

From a certain point of view

and on Mass Effect 2, if you manage to kill your entire crew, Shepard won't survive the last jump back to Normandy and fall to death, so there's no Mass Effect 3, and that ending cannot be canon.

and I still don't know if linking the fire or letting it fade is the canon ending on Dark Souls

I heard both sides and both seems plausible, so maybe both are?

@ThoriumBR Crichton brought back Ian Malcom for The Lost World and Sir Arthur Conan Doyle brought back Sherlock Holmes

... and marvel...

Really, the fans want to see their favorite characters again and again

Why does there have to be such continuity?

but uncle ben is still dead

Marvel is the definition of anticanon

Or of unreliable narator

I liked how the reboot on xmen was done... that awful jean gray was erased by a timeline disruption... and the next movie fell back to an awful movie....

The Three Stooges died in several of their shorts, but would anybody care if they had the same character in the next one?

@ThoriumBR Who cares about Jean Gray? MOAR QUICKSILVER PLS

yeah, quicksilver was amazing...

I only think he was a little OP on that movie

@ThoriumBR Um, what does OP stand for in this case?

and jean was OP (over powered) in a not interesting way...

Ahh TIL a new acronym

he was kinda faster than light itself and jean could stop him without blinking... what?

and looks like someone ran away with the script of Captain Marvel and lost some pages during the run, and changed a couple things...

or someone found some pages that someone lost and filled the blanks... it would be fun if both movies were unveiled at the same weekend... it would be hilarious.