« first day (965 days earlier)      last day (4220 days later) » 

16:00
Nah, we stayed inside. There were labs and such that were known to be disused, so we used them to conduct experiments with various chemicals and bunsen burners and such. All unsupervised.
oh and my old favourite - death rattle. you had to get them to sit on a whoopie cushion, and a member of staff had to hear it.
that one only got pulled off once
oh man I would've loved uninhibited lab access
could've made TNT. so easy
or mercury fulminate
For the most part, the staff at the academy didn't care about what we did. The administration operated under the assumption that if nobody knew they were there, nobody would act out.
@Polynomial Careful, the NSA is reading this.
16:01
@TerryChia Fuck the NSA.
@DavidFreitag fairynuff
@Polynomial So THAT'S what you are into....
@TerryChia Hot LEA-on-LEA action!
They gave us laptops and free reign of the school during the day. We made our fair share of explosives and otherwise highly flammable experiments.
I burned a hole through the floor the day i found out how to make thermite.
@DavidFreitag hey don't knock them, I love that show!
but yeah TNT is easy. just get some benzene and methyl chloride, and aluminium chloride powder, and mix together to make toluene. then you just need a 50/50 mix of nitric acid and sulphuric acid to make nitrating mixture - add it to the toluene and you get nitrotoluene. distil the nitrotoluene out and add more concentrated nitrating mixture, at very carefully temperature controlled ~30C (you'll need a heat bath and an ice bath)
when you're done, you'll have a mixture of trinitrotoluene (TNT) and dinitrotoluene (DNT)
just keep in mind that the nitration is exothermic, so you'll need that ice bath at the ready, and an accurate thermometer ;]
16:06
Yeah, we favored things that were silent.
We knew we were being watched by the administration from cameras that were abundantly visible. I think they even left labs empty to entice us to conduct experiments.
mercury fulminate is slightly more sensitive to produce, but easier. it's just VERY loud when used
a colleague threw mercury fulminate bangers at the wall next to me a few weeks back, as a joke, and my ears were ringing all day
they're like those stupid little white poppy things you throw at the floor, except MUCH more sensitive, and MUCH more powerful
We made piezoelectric crystals one time. That was fun. We hooked some softball sized crystals up to a headphone port with an amplifier, under a microscope you could see waves of sound forming on the surface of the crystal as it deformed and reshaped itself.
oooh, piezos are fun.
I built a polyphonic piezo thingy a while back
We took the smaller pieces of crystal and bonded wires to them using conductive adhesive, then ground one side flat and made contact microphones for windows.
8 piezos, an Arduino, a couple of PWM generator ICs, and a computer.
used the computer to translate incoming audio into frequencies and volumes via FFT
16:10
We used them as early-detection systems for approaching staff. There are a few occasions where we got into trouble for making unstable flammable compounds
so the 8 highest frequency bands would be played
was funny as hell to play metal out of it and just get horrible distorted 8-bit nosie :P
FFT's are always a lot of fun
Guys, any good blacklist checker for compromised hosts?
@Adnan Google's Safe Browsing API could work.
@Adnan PhishTank, VirusTotal API too
and the Alexa service from Amazon will do it too, via site rep.
@Polynomial Great. PhishTank looks good
16:12
keep in mind that PhishTank is only for phishing sites, not for malware.
Oh, this one looks quite neat
or other compromises (e.g. deface)
It seems to look through multiple blacklists
@Polynomial Yeah, the host I tried passed PhishTank but it failed the other tool.
Zone-H might be a decent indicator too
@Polynomial Oh, this one looks like a l33t bragging place
16:16
@Adnan it is, but it works as a nice index of compromised domains.
a deface implies they were at least able to get persistent XSS
16:27
I'm a modafuk1ng 1337er
@Simon Oh yes you are
Is it illegal to attack a website that hosts illegal activities?
Who's gonna report you to the police, the illegal hosters?
lulz
@Simon Yes
@Adnan How would you get caught though?
@Simon That's irrelevant.
16:33
It's not about getting caught.
That's like a serial killer only murdering felons
I heard there's a show about a such thing.
@Simon It's quite good.
@DavidFreitag I heard that too.
@Simon You heard right.
16:36
sigh here he is, again!
@DavidFreitag yea I did some stupid stuff as well, you just need to keep it in mid that it can get you in serious trouble :p
@LucasKauffman Yeah, typically my nefarious activities lately amount to scraping websites, and other various databases (games usually) for datas.
Or if i want to understand how an attack works now, i will setup a server on my network and stage the attack on myself
you dirty hacker
2
@LucasKauffman He so 1333333337
moar 3's, moar.
Well it's not like i can actually do anything cool
But it's nice to be able to read an article on how to do something, then just do it. (or attempt to anyway)
16:48
@DavidFreitag we are just messing with you ;)
So defensive
@LucasKauffman I know, i just didn't want to come off sounding like i think i'm some badass super hacker.
@Simon One more reptrain!
WHERE
16:50
Fuck my life.
What the fuck do you want me to add?
I already upvoted your answer.
I'm so sad that I'm gonna go buy a chocolate bar and eat my emotions.
@Simon Legality is not defined in terms of police efficiency.
Is illegal that which contradicts the Law.
2 days ago, by Thomas Pornin
Take the idea, add some snark, bold font and a picture, and you are all set.
@Adnan re the phonetics, I think your answer does help a bit, but youre right - it doesnt really answer it.
@Adnan dont think its TL?
@AviD True. It wasn't until I saw your comment that I realized I forgot to check CW.
well, whatever TL would be now... still not used to the new reasons.
16:55
@AviD I think it can be useful to others. 4 people agree so far
heh. Fair enough.
@Adnan How is it any more useful then "OMG Have I been hacked???!??" questions?
@ThomasPornin I should have formulated my sentence as: "Is it likely to get in trouble if I..."
@tylerl What question are you talking about?
I'm just biased against "here is my log/exploit/files/whatever. Whatever doth meaning holds yon datath?"
16:56
@Adnan Future rep train one.
@tylerl exactly.
@Adnan THIS
@Adnan and, it was only 2.
@tylerl @AviD Oh wait wait.. I was talking about the phonetic one
It has 4 upvotes
I was hoping to get some, help! stats.stackexchange.com/questions/66708/…
16:58
Is the phonetic question really a security one though?
@AviD @tylerl As for the other one (the JavaScript one), yeah I agree. It's a bit too localized.
@Adnan ah no, I meant TL on the obfuscated comment / possible reptrain one.
@Adnan so flag it, I'll hammer it.
@Adnan More or less. It would be helpful for anyone who's worried when he sees the script tag on his website.
@myusuf3 I think you're in the wrong place.
@AviD I thought about it, but can't decide which closing reson
17:00
holy crap sorry about that the icon looks the same
@Adnan heh, me neither, thats why I wanted YOU to flag it ;-)
ill take care of it...
@Simon I especially liked drjimbob comment.
@Simon I think very much so.
@AviD Wait till jimbob writes an answer
It's about password policy, and constrained entropy.
17:00
I think it would be really helpful
@AviD I see.
its not about "how to read it", but "how to choose a password that CAN be read, but is still strong".
@AviD Did he formulate his question that way though?
@AviD correct-horse-battery-staple
I gotta go re-read it.
17:01
@tylerl probably a good answer, yes - add it!
@tylerl I wonder how many people are actually using that password.
@Simon I thought so, but I am biased - she asked me first, and I told her to post it (friend of mine...)
well what was wrong with my comment over here security.stackexchange.com/questions/40227/… .
@AviD I'll let @Simon add it. He's desperate for rep.
@Simon if its not clear, perhaps it should be edited to make it so.
17:02
@Lucas +1 for "In addition to Adnan's answer:"
:D
@Adnan hurray
@Adnan you got another medal now no?
@AviD Any way to ping jimbob and ask him if he's gonna write an answer?
@Cherokee Besides it being incorrect in numerous ways, you mean?
Hum @AviD I think you should edit her question and add the one you just typed.
as in ??
17:03
@Adnan comment?
@tylerl You're the man.
@Cherokee \x signifies hex-encoded characters, not "shellcode"
for example
@AviD I did comment, but he hasn't responded. I really liked his note on the <script> thing
@LucasKauffman I think they take an hour, right?
@Adnan ah idk
@Simon fair enough, and done.
think thats why the downvotes?
17:05
@AviD Here we go, now I like it.
@Tylerl . But yes you are right . I stand corrected .
I upvoted it before I liked it anyway because it was an interesting question, even if I was unsure if it belonged here.
But now it certainly does.
@Cherokee Adnan decoded the obfuscated javascript. it's just a simple cookie-stealing attempt
@Cherokee also, since the comment was properly escaped, it probably doesn't indicate any particular vunerability. Just a failed attempt at XSS
@LucasKauffman I saw your clever way to hop on the rep train.
@Simon This rep train ain't leaving the station.
17:07
@tylerl it better does...
I'm thinking about answering something that starts with "To add to Lucas' answer..."
@LucasKauffman it better does?
@tylerl Agreed
@tylerl Make it leave!
17:08
@tylerl I want it to go "Chou chou"
loooooooooooool
chou chouuuuu
@Simon It needs one more answer
@Adnan Nice lure.
@Simon Peer pressure.
@tylerl . Yep . I wrote i what i understood from it . Its Hex encoded . And what attacker might have been trying but you are right . I should have decoded it before answering .
17:08
@Simon No, really. Check the SuperCollider equation.
Oh. Well, I'll let you go on my account.
@Cherokee meh. I didn't downvote you.
So you can write an answer.
@Simon add another answer
126
Q: What formula should be used to determine "hot" questions?

Jeff AtwoodRight now the front page Popular tab is fairly broken -- it's a simple descending sort by views. As Joel said in podcast #18, it is "a self-fulfilling prophecy." But this is not intentional, it's only because we haven't had time to improve it yet! As I sit down to write a better algorithm, I tho...

17:09
Here's the password: correct-horse-battery-staple
@tylerl . You Can :D . But yeah thanks for the input man . Really Appreciated .
Funny enough, i don't have enough rep to down vote on Sec.SE, i only strategically upvote.
Interesting.
One day, I'm gonna answer 3 questions in a single day.
@Simon Come on, be realistic.
@Adnan I've done 2 last time, does that mean that I'm not ready for 3?
17:12
@Simon Don't strain yourself. If you overdo it you may not be able to answer even a single question of up to even a week!
@DavidFreitag Hehehehehe.. dude!
@Simon You're dying to get yourself some rep, and average about 1 answer a week. I think I see your problem.
@tylerl I don't understand your point.
:)
Although the amount of valid questions that float through here, it might be difficult to answer a ton per day. It's a bit different farming rep on StackOverflow.
To be fair, I don't know the answer to most of the questions. I'm browsing this place to learn more mostly.
The script one I could have answered it, of course.
17:14
@Lucas Get ready! Soon I'll be joining you in the 3rd row
@Simon The stack exchange is a learning experience for most.
@DavidFreitag Except bears.
@Simon And the ignorant.
@Adnan NOOOO
@tylerl Don't fight it. Just take it like a man.
17:16
@DavidFreitag Does an ignorant knows he's an ignorant or that would defeat the definition of an ignorant?
@tylerl You might actually enjoy it! :D
@Simon An ignorant could know he is being ignorant. It's like saying "I know i'm being dumb for the fun of it."
@Adnan Luckily Hendrik has been AFK for about 3 months. Should be easy to bump off the list.
@DavidFreitag What about a genuine ignorant?
17:17
@Simon They are lost in a world more blissful than any mere mortal could even imagine.
Holy shit!! I'm only 13 days away from joining the Epic club.
@DavidFreitag Wow. I like to be in my own world sometimes, it sounds fun.
@Adnan I'm 49 days away!
I lied.
@Simon Are you 50 days away, Simon? Are you?
@Adnan sweet
I need to overtake the RoryM
@Simon It's about finding a way to get your head so far up your ass that you never see the light of day ever again.
17:20
@Adnan I'm actually dying. I came here to make friends before my death and all you did was laugh at me constantly and complain about my question-answering productivity.
@Simon you lazy slag
@DavidFreitag It doesn't sounds as fun now.
> It's like, wave comes in wave goes out. You just can't explain that!
Alright, I shouldn't make jokes about death, just in case someone doesn't get my sarcasm.
@Simon it's kay
17:21
@Simon Fecal matter aside, it's nice because you are never wrong, and you can never fail. It's sort of win-win.
you silly canadian
@Simon What are you dying from? Patheticiosis?
@Adnan I'm still waiting for the apology.
@DavidFreitag What's that quote again? "I'd rather be unhappy than an happy imbecile". Something like that.
@DavidFreitag There's no word for that in Finnish.
17:23
> Bread goes in, toast comes out. You just can't explain that!
Oh wait, that is "please". Yeah, there's no word for please.
@Adnan No, I had an appendix surgery 2 years ago and my appendix grew back to kill me.
@DavidFreitag Oh god.
@Simon That guy is freaking hysterical.
@Simon Well, it was nice to know you. You've always been like the Village Joker to us.
I would vote someone like that into some office of power just to hear the stupid shit they would spout.
@Simon Well, kill it first. Get a kitchen knife.
17:26
@Adnan That's a nice status.
@DavidFreitag All I have here is a 3 pen. Maybe I can manage something.
@DavidFreitag Dude, you live in the U.S.! You already have like 20 of those.
@Simon That would work. You may have to put a bit more effort into it.
@Adnan Nah, the ones in power are usually silent. The ones who spout nonsense are usually severely republican reporters.
Anthony Weiner, Michele Bachmann, Bob Filner, ...
I wonder what DJ Stephanie is doing right now.
Oh, Herman Cain. That dude was phenomenal.
@Simon Not thinking of you
17:30
@Simon Regretting a picture she took with a greasy frenchman.
@Adnan Ow
@DavidFreitag OW
I mean, don't get me wrong @Adnan, the politicians spout stupid stuff, but not on nearly a regular basis as political commentators.
Those fuckers essentially get paid to spout nonsense.
Why didn't my parents raise me in English? Oh wait, 'cause they don't speak a damn word of it.
LOOK WHAT THEY'VE DONE TO ME
@DavidFreitag Which is to say; they know they'll get paid more the more nonsensical the political nonsense is that they spout
@Simon Sweetie, I think English is the last of your problems.
17:32
@tylerl More radical (aka, more nonsense) means more ratings, means more money.
@tylerl Are you saying that they are, somewhat clever?
@Adnan Right, I forgot that I'm dying.
@Adnan cough goatee cough
@DavidFreitag OWWWWWWWWWWWWW
@DavidFreitag "goatee"
@Adnan FFS
17:32
@Simon Here, turn around, i want my sword back.
I think it was more of a dagger.
Nah dude, i buried a claymore right between some thoracic vertebrae.
If I shave my goatee, I'll look even more like a kid.
Stupid babyface.
PLANTING CLAYMORE
@Simon Don't shave it. Improve it.
@DavidFreitag How the hell do you improve a goatee, by letting it grow more?
17:35
Or, have one of your mates beat the living hell out of you. Some facial scars will improve the baby face.
@Simon How would that change anything?
Maybe some strategically placed napalm.
@DavidFreitag No, they've always respected my 130 pounds.
@Adnan All the ladies dig hair.
Nothing screams sexy like a burn victim.
Especially DJ Stephanie.
17:36
@Simon That's what all the ladies tell hairy dudes so they don't hurt their feelings
@Adnan Right... Ladies love to hurt people's feelings.
@Simon Yeah, ladies love hair. That's why we never see big-foot.
@DavidFreitag Great, now I'm the weirdo who laughs at work.
@Simon Again, how does that change anything?
@Simon Goatee == Improved face. Beard == Improved goatee.
17:37
@Simon It's alright. At least you aren't the weirdo who cries uncontrollably at work.
@Adnan Oh yes, I forgot. I'm not at work, I'm at the hospital in a bed.
Damn. I feel a little bad for doing this.
And this is an improved beard.
@Xander Well, my gf complains when my beard is too hairy.
@Adnan What's that?
17:38
@Xander Typical beard wearer
He's a circus animal.
If you need a goal to shoot for, here are plenty of options to choose from.
@Adnan 13 days of +200 rep. That might translate to a bit more than a fortnight.
Not even a little bit creepy
17:41
I'd go in a dark alley with that dude.
@ThomasPornin Yeah, that's not going to be easy.
@Thomas What happens after Legendary? Do you just give up on life?
@Adnan You become ascended.
@Simon I did ascend several dozen times.
@ThomasPornin Air Canada doesn't count.
Lord Bear.
17:43
@Adnan You can still show off, but there is no badge. For instance, I can say that I have done one Epic beyond Legendary (+200 rep for 204 days, currently).
@Adnan it was a NetHack reference.
I find it hard to believe that you're doing all this only to show off.
@Simon I have to cater to a difficult crowd (i.e. myself).
Any UK folks on?
@ThomasPornin You should host a cryptographic convention in Montreal.
@schroeder possibly
17:47
anyone here preparing for OSCP/GREM ??
@Cherokee @LucasKauffman is your man for that, he was here a little while ago...
@RoryMcCune I'm looking to apply to UK IT Sec management jobs in the UK and I was wondering if I could ask a couple questions about the hiring logistics. I'm getting conflicting reports.
@roryMcCune Thanks
@schroeder yeah gotta got AFK for a minute but may be able to help :)
1) is all hiring done through recruiters? 2) is negotiating salary an expectaed part of the process or not, and if so, do you negotiate with the recruiter or the employer?
17:51
@schroeder I've never been hired through a recruiter
@tylerl good to know
Granted I'd only worked 6 jobs before I started my own company...
cause to hell with employers.
except me
lol
So, bypassing recruiters would not be strange
@schroeder depends on the company.
Smaller companies are less likely to use recruiting firms
cause teh cost isn't worth it
hm - good to know
17:54
@Schroder . Never go Through Recruiters. Join forums , make contacts in industry and you will find a foot in the door . Quite a few jobs are not advertised and most of the times if an existing employee refers you , you are in atleast for a interview and a real chance .
@schroeder 1) depends on the company. I've had jobs through recruiters and direct. Some large companies have approved panels, but in most cases they'll take direct CVs
@Cherokee That certainly is the case in the US and Canada, but I have heard other IT folks from the UK say that I have to go through recruiters
@schroeder 2) yep salary negotiations would be part of the process with employers. You might if you're using an agent give them an idea of range so that they can not put you in for vacancies in the wrong range altogether (assuming you trust them of couse :) )
In larger companies they may have their hands tied somewhat as the role will be at a grade and that grade will have a range
smaller companies not so much
sure - that's standard here, too
@schroeder . Not sure about UK but in asia as well it happens the same way . Plus if you are good and have written research papers , have done some responsible disclosures and all you are already a few leaps ahead of Competition .That's what i have seen in my couple of years of career .
17:58
@schroeder also in the UK some agents have a pretty bad rep (this may be the same everywhere, but definitely is in the UK)
Hm, when did youtube get the red loading bar across the top of the page?
In the UK, are IT Sec managers "techs who manage" or "managers of tech", or a mixed bag?
@schroeder if you're looking for security roles I'd say that Ben Colbert at Proprius, Chris holt at DCL or barclay simpson would be good people to speak to

« first day (965 days earlier)      last day (4220 days later) »