The DMZ

@TildalWave Once you know what it is, the words are pretty scary. Makes you want to go take a shower in disinfectant just after thinking about it.

@tylerl yeah :(

@TildalWave related:

@tylerl there's no "pointless existence" on that graph :)

"world economic crisis", "eaten alive", or "findus lasagna" aren't on it either

tho for eaten alive that flash eating bacteria kinda counts ... but I was thinking more in a sense of being eaten by a bear / shark /...

12:32 AM

@TildalWave hahahaa - findus lasagne

@Simon Cloud Hacking?

@RoryAlsop Please no, you might start something.

@Simon too late: thecloudhack.com

I answered 2 questions today, I'm on fire.

@TildalWave NOOOOOOO

> We want to see innovative and creative applications harnessing the power of the cloud and Windows Azure.

Yeah...

Cause that's what innovative people use.

Hahaha

2:54 AM

Well. I'm married with a pre-schooler, homeless, and living in a hotel. My mid-30s are looking up!

Homeless?

What happened?

We sold our house this morning, moved out this afternoon, and aren't buying until tomorrow morning.

Rough life.

Yeah. Trying to do both closings on the same day wasn't reasonable.

<eh

2:59 AM

Give it a week, you'll be a happy man.

Bigger or smaller house?

Even better, is it in Kansas city?

About the same by square footage, but two bedrooms bigger. The wife's sales territory is such that her closest client was about an hour drive away, so we're moving up to Columbus to make her drive time more bearable.

Q: How often should I reset my salt?

3:42 AM

This just happened:

0

I'm thinking of implementing a salt recycling scheme on my user credentials database. The motivation behind this decision is that even if the attacker manages to get his hands on the database and has enough time to crack a password or two, by the time he does the salt will have been reset and hi...

See? These are the app developers of the future.

Guess what you have to look forward to

I actually wanted to link it to you but you weren't here. You found it fast enough.

Consider it job security for those of us who work in the security-cleanup field.

dban

@tylerl I'm backing you up in the comments section buddy.

You don't need help at all but I'm still getting involved.

►

3:50 AM

The last sentence of your answer is very important.

GN8 all.

Sweet dreams.

Liam

5:15 AM

Anyone here going to Def Con?

Gilles

7:33 AM

@tylerl This comes out of left field. Could be worse though, at least what he proposes doesn't reduce security beyond the intrinsic risk in making things more complex

@TildalWave Nah, I like it.

Gilles

8:01 AM

Oh, XKCD time is finished! “The end” at frame 3094. geekwagon.net/projects/xkcd1190

blog.xkcd.com/2013/07/29/1190-time

Stack Exchange

Oh, definitely not; they don't have Amazon Prime.

IT KNOWS!

Q: Is this HIPAA-protected health information?

9:09 AM

0

We're developing an online events calendar for a senior assisted-living facility.They want to record, in the system, the names of facility residents who attend each event. There would be no other information recorded except for the resident's name. Would this alone cause our system to have to com...

hipaa

this ot?

borderline, but enough that it's ok

11:56 AM

You don't want missile control software writen in PHP + JavaScript. — user61852 18 hours ago

From a pentester POV, I most definitely do.

12:07 PM

@TerryChia Actually, I don't want missile control software written in Java either

@TerryChia I went for food, which is like 800m from here, now I need a fresh t-shirt because I'm soaked xD

More so, looking at all of the answers there, I don't want missile control software to be written by anyone who makes that kind of mistakes, in ANY language.

It's moist hot, very different from european hot

@LucasKauffman Where are you?

@Adnan Singapore

12:10 PM

@LucasKauffman :O :O :O

That's.... brave of you

"Launch missiles." => "java.exe has stopped working"

@Adnan It's pretty sweet country though, lots of nice food, there's a pool downstairs with a jacuzzi and the girls are pretty good looking too

@Adnan Obviously. Mission control software needs to be written using Node.js.

@LucasKauffman Yeah, I heard so many nice things about Singapore. I really respect that country for what they did in the past 50 years.. great people!

But I hate the weather.

@Adnan best part is you get a folder on the airplane "Drug traffickers will be killed!"

@LucasKauffman THEY DON'T HAVE GUM!!!

12:13 PM

@Adnan I accidently brought a package inside the country :O

the fines are 1000 SGD :/

so I just threw it in the bin

@TerryChia Oh yeah, speaking of which, I really respect your country.

I've been reading incredible things.

and I did a good deed by buying a pen from a girl for her studies.

@TerryChia I think I wouldn't think twice if they gave me the choice of working over here

Like how it was one of the shittiest countries in the area about 1960s and then it became pretty much the golden standard for Asia.

and something about something called the White Ministry

Which sounds racist, but it's not

@Adnan there's another drawback though... the worst part even

@Adnan the beer and whisky is too damn expensive :<

but they do have 633ml bottles

@LucasKauffman Not a bad price for uniting gazillions of races and religions.

@Lucas How much is a decent pint?

12:17 PM

@Adnan in a shop you pay about 5.50 SGD for a pint bottle

so that's about 3.2 euro

@LucasKauffman Pretty much like here

and at home you pay like 7 euros for 24 beers

@Adnan mmm maybe we're just cheap :p

@TerryChia you're working during the week right?

@Lucas Have you met Terry yet, btw?

@Adnan no not yet :p

We need some gender verification there as well

12:20 PM

puts on rubber glove no problem

I've already been verified by Marion and RoryM

How about @HamZa?

@Adnan hamza is in singapore :o?

I thought he was indian?

@Adnan hey there :)

@LucasKauffman There are many Indians in Singapore. What's your point?

in PHP on Stack Overflow Chat, 2 days ago, by HamZa

@Mr.Alien @dragon112 I've got arabic blood, dutch and indonesian. I'm the mixed human being :D

12:22 PM

@Adnan that chances are higher he lives in India :p?

ah no Hamza lives in holland

@LucasKauffman You and your logical arguments!

there are also people speaking a weird form of english

@Adnan also something I found funny was that we have like food stands saying "Chinese food" here they have food stands saying "Western food"

lol C++ room is closed and there is a huge fuse about it ...

what's the close reason?

@Adnan !!! Have you seen all the rep I have?

I answered 2 questions yesterday.

12:33 PM

@Simon living on the edge ey.

Damn right.

@Adnan There are some awesome things about this country, and some really shitty ones.

@LucasKauffman Yeah, pretty busy this period. You are staying for quite a while right? I'll need to find the time.

yea until 22 august

@LucasKauffman Dude, just keep it in your bag. I smuggle gum from Malaysia all the time.

:O

12:36 PM

@LucasKauffman Some troller messed with a mod

@TerryChia death to gum smugglers :P?

What's the point of making gum illegal, to keep streets clean or what?

Even if that's the case, it's such a drastic way to do it.

@Simon exactly that

I bet you can pick up all the girls at the bar when you're chewing gum, they're like "omgawd what a bad boi"

@LucasKauffman What kind of "Western food"?

12:44 PM

@Adnan not sure they were closed today

@Simon HOLY SHIT! 542!!

I know right!!!

@TerryChia But still, it sounds great to me. The progress in such a short time is fantastic. Yes there's a long way to go, but it's very nice they're actually going in the right direction

I just heard someone make an assumption that banks use up-to-date systems and use proper security procedures and defense in depth... pfffffft

Who's responsible for this +1?!?

12:47 PM

@Simon Well, it was a good answer. You can't blame me

@@@@ Thank you @@@@

NOW WHO'S THE SECOND LOVELY MAN?

@Simon I'd +1 it, but I already did, so I +1 the second answer I saw :p

:) thanks!

@Simon This is getting out of control!

@Adnan Woohoo!

12:49 PM

what's all this about?

I really admire my rep-trainability

@Polynomial Who's the moron?

@Adnan not as much moron as ill-informed.

@Polynomial We're happy for Simon, he's making good progress here.

moron?

I quickly corrected him, reminding him that most banks still have AS/400 gear lying around, and AIX boxes that haven't been patched since the '90s.

12:50 PM

@Polynomial Well, true.

@LucasKauffman this: chat.stackexchange.com/transcript/message/10565654#10565654

@Polynomial AS/400 is a bit older than the 90's :p but true

@LucasKauffman hence the conjunctive "and".

Oh god, AS/400 is actually the first language I learned.

Needless to say I hated it.

AS/400 isn't a language.

it's a platform.

12:51 PM

Whatever, the platform.

like... unix.

No idea what the language is.

@Polynomial but not Unix :p

AS/400 Control Language

The AS/400 Control Language (CL) is a scripting language for the IBM AS/400 midrange platform bearing a resemblance to the IBM Job Control Language and consisting of an ever expanding set of command objects (*CMD) used to invoke traditional AS/400 programs and/or get help on what those programs do. CL can also be used to create CL programs (congruent to shell scripts) where there are additional commands that provide program-like functionality (GOTO, IF/ELSE, variable declaration, file input, etc.) The vast majority of AS/400 commands were written by IBM developers to perform system level...

but not unix :P

ahh, CL.

yeah that was shitty.

12:52 PM

Yup, that's what I was doing.

I AM OUT OF CONTROL!!!

cobol is also an option.

@LucasKauffman COBOL is never an option.

@Polynomial the only language in the world which needs a license from IBM to get a socket

:/

could be worse - could be a language like J# that technically requires a license to even write any code in it.

since the Sun / Microsoft debacle about 6 years ago.

@symcbean I respectfully disagree. Some attacks are pretty difficult to secure against just through code reviews but SQL injection isn't one of them. Just ensure that every single database call is parameterized and you will be fine. — Terry Chia 3 mins ago

Back me up here. Or maul me if I am wrong.

1:00 PM

@Polynomial hahahaha - very true. Some also have VAX boxes still in use!

@Polynomial COBOL is an option - it is one of my languages :-)

@RoryAlsop I mentioned DEC / VAX to him too :P

had to learn it back in my EY days, as a number of clients had vast amounts of COBOL code on mainframes and AS/400's

also, someone just posted a hi-res photo of his new house key on Facebook. I am very sorely tempted to cut my own copy.

@TerryChia Both of you seem to be correct. You're just being correct about two different things.

even better, the photo is sat next to some spare change on the table, so I can calculate the scale of the image and get it perfect

1:01 PM

@Terry I agree with both of you

s/photo/key/

@Adnan I agree with his point about relying solely on code reviews being silly. But the point is moot in the case of the OP since he is asking about SQL injections.

Anyway, I kinda facepalmed when the OP mentioned his code base was too large to do a code review.....

Most likely he has some horribly designed app with database calls strewn across a fifty different files.

@TerryChia That's usually the case. Sad.

Of course, it's PHP's fault.

@Adnan PHP has a lot of faults but badly designed apps really aren't one of them. :P

It is possible, albeit a pain in the nuts, to write well structured PHP apps. :P

@TerryChia Nope. Disagree.

@TerryChia Whaaaa?! Haven't you been reading our conversation last night?

1:15 PM

@Adnan Sadly nope. Point me to a starting point.

19 hours ago, by Adnan

When you write a = "SELECT * FROM table WHERE id = " + request.GET['id']

19 hours ago, by Adnan

In Python, it automatically converts it to a prepared statement with parametrized queries

19 hours ago, by Adnan

and if you combine Python and Perl, they even automatically setup your server and install all the patches

@Adnan add ruby and it starts writing it's own code

Crazy languages

@Adnan There are ORM's for PHP goddammit!

@LucasKauffman Idiot! You're confusing it with Node.js

1:18 PM

@LucasKauffman It still pains me I have to write Java for this particular project instead of Ruby.... I could probably get done with the stupid CRUD crap in a day with Ruby and scaffolds.

@TerryChia tried having a look at spring?

@LucasKauffman Nope. But I already got all of my database calls abstracted away with Hibernate anyway.

Java isn't so bad really. I just like complaining.

1:48 PM

> Giving a Stevejob is an intricate process. This form of prostitution requires you to charge your partner a large initial fee for what seems to be a series of reliably delivered sex acts. Nevertheless, after about six months, you refuse to perform until an additional fee is paid for what promises to be even better sex. While getting Stevejobs can be costly, some continue to pay for them due to the promise of being virus-free.

cracked.com/blog/…

WTF did I just read?....

so here where the magic happen

@JohnTheRipper :-)

2:03 PM

so no magic today?

@JohnTheRipper What the hell are you doing here instead of cracking that list of one hundred thousand unsalted MD5 hashes I sent your way?????

4

@terry i have gpu array of 4 cards

oh you mean the name :-D

@JohnTheRipper There is no Magic, only spectacular Science.

@thomas oh you are the bear everybody talk about

@Adnan Someone downvoted my XSS answer!!!

2:16 PM

@Simon Natural. It's a shitty answer

Poor Adnan, he's bipolar.

I wish I could see who did it.

I'd call his ass out.

@Simon Nah, it's alright. It's not a bad answer, but the OP or other members can have a different opinion.

Then leave a damn comment and explain why at least.

@Simon I think it might be because you are Canadian. ;)

Is it?

2:23 PM

@Simon Man, I can't find that Youtube clip.

@Simon Well, the quality sucks but here it is. :P

►

Dayum, I don't even remember that scene.

@Simon It's waaaaaaay back in the second season.

The Slap Bet one.

Xander

@Simon They probably didn't show it in the Canadian version. To protect your delicate Canadian feelings.

@Xander Naaaaah.

I'm looking forward to the last season. I wonder how they are gonna stretch a two day wedding for an entire season's worth of material.

2:30 PM

I don't like the mom.

@Simon Why? I think she's pretty suited for the role.

She should be waaaaaay prettier.

My first reaction was: "WE'VE BEEN WAITING ALL THIS TIME FOR HER?"

@Simon Which mom?

I even bolded the word when I said it.

@Simon True. The daughter is waaay hotter. :P

2:32 PM

@Adnan HIMYM

@Adnan Your mom.

@Simon Who's the actress?

I don't really remember what was going on

@Adnan No idea.

@Adnan imdb.com/name/nm2129662

By the way I watched Dexter, it was a way better episode.

2:33 PM

How is everyone today?

@Simon Indeed

@Griffin Waiting for you. How are you?

@Adnan <3 I feel so honored. I am fine.

i though you people actually talk about security here

only tv show memes

@JohnTheRipper Nobody made that claim!

@JohnTheRipper Security is waaaaaay down the list of relevant topics.

2:41 PM

@JohnTheRipper People always talk about what comes through their heads.

Here, at least, people might have security-related thoughts. But not necessarily 100% of the time.

@ThomasPornin That's a revelation.

@AviD Today I had my first problem with Israeli customs/postal service.

Some guy is selling some army surplus stuff (mainly MREs and medical supplies), and I bought some alcohol prep pads (they were cheap and I needed some.

The authorities stopped the postage and sent me a letter asking me to reveal the supplier's information. I have no idea what to do

@Adnan Is there something illegal in there or what?

@Simon Not according to the supplier. I have no idea about the actual situation

@Simon I just don't want a Hermes on my ass

Weird.

3:09 PM

@Adnan Sounds like a tricky situation, a friend of mine had the same issue. The guy he bought MREs from was being watched by some obscure government agency, my friend gave up his address and like a year and a half later his MREs finally showed up.

@DavidFreitag But it's a bit of a strange situation. As far as I know, military surplus stuff are legally sold and resold.

Hmm.. well I think the issue here could probably be exporting the goods

@Adnan This almost sounds like a story I heard of a guy who wanted to get a PB&J sandwich late at night.

@Adnan It's not about the goods, it's more or less about who you are getting them from. If someone thinks they can leverage information from you, then they will.

3:27 PM

@DavidFreitag But what I don't understand is why would they care? It's not illegal to resell military surplus

@Adnan Maybe the guy has some past issues with the law. Not to be paranoid, what make you think the "authorities" have your stuff?

Either way, a story like that would be difficult to make up.

@DavidFreitag Shhh! Don't spoil it for everyone else!

I thought enough time went by.

@DavidFreitag Not for the people who will be catching up on the log later.

Sometimes, i'm a bit thick.

3:33 PM

@DavidFreitag I got a letter from customs here asking me for that information.

@Adnan Weird. I have been watching Burn Notice lately, so anything like that is going to become some paranoid conspiracy for me.

Also, @Adnan if you like the playlist i put up yesterday, you should check this one out. Kalmah is so freaking good.

►

@DavidFreitag Good good. More Finnish bands

@Iszi GOD DAMN IT!

@Adnan Yeah, i'm not sure what's up with Finland and melodic metal, they just... do it right.

@DavidFreitag It's the folk base. Finnish folklore music's heptatonic tones and melodic modes that are capable of sustaining their core nature when introduced into different genres.

This seems to be perfected with metal music

If you want more, you can ask @RoryA

3:52 PM

Perhaps. I just found this freaking hysterical T-shirt, i'm totally buying one. shirt.woot.com/offers/casual-friday

I think our last resort will be Tor hidden services.

@Poly Arrgghh! 12 seconds!

4:10 PM

@Adnan mwhaha

answer-ninja!

A: Downloading files using Tor

-2

Yes you can download files or whatever using tor browser and your identity will remain hidden, Because you have TOR button by default in tor browser bundle. More Info: https://lists.torproject.org/pipermail/tor-talk/2010-June/011611.html

Oh god.

4:39 PM

Hop on dat rep train.

I don't think there's a rep train going on right now.

I was just discussing that VPN question with my friend. He said something I found interesting.

Go on.

> If such thing was possible, then you can just setup a shell company that "provides VPN access". Then simply use your normal Internet connection for illegal activities. When the authorities come to arrest you, just tell them I'm a VPN provider and I don't keep logs.

Yeah, it's something i've been pondering myself.

Like setting up a server farm in some country that doesn't abide by the rest of the world's laws, then provide a VPN service for all teh illegal activites.

4:46 PM

I assume that those companies are required to keep logs though.

Otherwise, no idea why nobody would have done this before.

Required by whom?

Government/law enforcers

Case in point, use a locale that doesn't care about such laws.

If the government blocks the site, use a proxy.

There are some issues with the plan though, you know, like being collectively DOSsed by a few governments.

I assume that somewhere in Asia would be appropriate.

@DavidFreitag Your connection is still coming from somewhere.

4:49 PM

Yeah, so they can tell people are connected to the VPN, but they can't tell what they are doing while they use it.

whats all the sudden interest in anonymizing VPNs?

Dunno, it's been on my mind lately. It just keeps being brought up.

It was a question posted yesterday, quite interesting too.

@DavidFreitag They can simple cut your access

@Adnan Even if you use a proxy?

4:58 PM

You can tell if someone is using encryption just by watching the traffic patterns. And from there you can make a good guess as to whether they're using a VPN. So that's information that the government already has.

But simply using a VPN isn't illegal. Even if the government can see you are using a VPN, if they can't get logs all they can prove is that you connected to it, right?

@DavidFreitag Using a VPN is illegal in some countries.

@tylerl Hm, that could pose a potential problem then i suppose.

6:05 PM

-10

A: Did NASA nuke Jupiter?

Certainly. Judging by the size of the crater (see image below, at the right, below the equator), it was a 1.21 Gigaton device. However, Jupiter is made of softer matter than earth, so it could have been smaller. NASA claimed that the attack was in response to Jupiterian suport of the Martian in...

For a LOL moment, before it's deleted :)

I honestly wish I could protect that answer.

I couldn't help but up-vote

@TildalWave I like it

Me too.

Damnit! How can you like that "answer" more than my second comment?? :P

6:20 PM

Because he started it :P

@Griffin yeah... award trolls LOL. 11 downvotes before, and now two upvotes since I posted it here :P

We need to protect his answer. It's just too fucking funny

@Griffin hehehe maybe... but it has 4 votes to delete so far, so I wouldn't bet on it

and there's 10,000,000,000,000,000,000 videos on YouTube that cover the case he's making better... moving images and fancy new age music and all

It's gone now... deleted... but I've saved you a printscreen :)

Sad.

@Simon Don't worry, there'll be more... I'll keep you updated, if that's fine with you :))

6:34 PM

Sure.

7:13 PM

@TildalWave Shouldn't that be on Skeptics?

@Iszi Possibly, but we had a discussion in meta and the consensus was that it can be debunked on Space Exploration just as well. It's borderline, because it is about the end-of-life of a space exploration mission as well.

@Iszi why was astronomy.se doing so bad it was closed after a year in beta?

@TildalWave I dunno. Was I on that one? Maybe it's people like me that killed it, then.

The funny things is that the black spot on jupiter there in that picture is probably the size of earth

@Iszi dunno... were you? LOL

@DavidFreitag it's the shadow of Europa ;)

@TildalWave hah, either way, jupiter is something like 1300 times larger than earth which puts that spot somewhere in the neighborhood of being earth-sized.

You know it's going to be a long month when a hello world program for a framework you are about to adopt is 100+ lines long.

2

7:30 PM

@DavidFreitag according to image description and my calculations, it's radius is roughly 2200 km... Earth's radius is over 6300 km... but please keep in mind I'm not always as geeky as I sound now :P

Don't lie, you are.

Still, 2200km is a pretty huge blast radius.

@Simon well if Simon says, who's to argue :P

Simon says don't argue.

@DavidFreitag It gets funnier, because OP in that thread said the spot on the right is supposedly caused by the blast :)

7:34 PM

@TildalWave I know, that was the point of noting the size of the spot =]

Atmosphere of Jupiter

The atmosphere of Jupiter is the largest planetary atmosphere in the Solar System. It is mostly made of molecular hydrogen and helium in roughly solar proportions; other chemical compounds are present only in small amounts and include methane, ammonia, hydrogen sulfide and water. Although water is thought to reside deep in the atmosphere, its directly measured concentration is very low. The oxygen, nitrogen, sulfur, and noble gas abundances in Jupiter's atmosphere exceed solar values by a factor of about three. The atmosphere of Jupiter lacks a clear lower boundary and gradually transiti...

There's a part on the Great Red Spot

> the spot is large enough to contain two or three planets the size of Earth

I can only imagine what it would be like to be in the storm.

Flag this please: security.stackexchange.com/questions/39878/…

@Simon you can flag it too... you mean vote to close?

Yeah.

It's the same damn question he posted earlier.

Except he's getting specific now.

7:43 PM

200 squared.

@Simon I'm not sure even that's the case... he's just repeating the exact same question like in the last paragraph of the previous one

True.

@ThomasPornin Me too! (not)

@ThomasPornin 40,000?

Yeah, he's that great.

@Simon I'm pretty sure he has a lot more rep than that

7:45 PM

@TildalWave Of course.

and then there's the bear #2...

@TildalWave Actually I just reach 200 daily rep for the 200th time.

However, do you know how his journey started? At the very beginning, when he was hired by a company, one of his conditions was to make at least 20 employees upvote his answers every day.

@ThomasPornin Oh, that's the reason! I didn't get it... but you probably got used to it already :P

@Simon I'm still waiting for my wages then LOL

Idc if they cover the case better his is funny as fuck

7:48 PM

and I wouldn't mind paid vacation either