The DMZ

Terry Chia

01:21

@ThomasPornin Why? The standard BigInteger isn't big enough for you?

@CodesInChaos I usually just drop in the bcrypt.net library. Works well enough.

Terry Chia

03:20

-1

Q: Hi! I'm a hacker in Russia. I have more shop update everyday and i want sell all i have .Y!H :[email protected]

I'm a hacker in Russia. I have more shop update everyday and i want sell all i have . IF who want to buy let's contact me through Y!H :[email protected] . List my price let's see it and read clearly my thread before contact me ! Thanks Ccv US is 3$ per ccv Ccv US is 5$ per c...

lol

Simon

It's the 3rd time that he posts that, 2 were answers.

Scott Pack

03:52

> however if you've closed off every other method of entry, updating the kernel is unnecessary since the hole you'd be patching against probably involves a port other than TCP port 80

>_<

Terry Chia

04:25

@ScottPack Where is that from?

Scott Pack

Start here

It's so easy to forget the firewall. I heard of someone who built a web server for a website and even went as far as hacking the TCP/IP stack to throw away traffic that wasn't port 80. Another thing that gets overlooked is unnecessary services - if it doesn't need to be turned on, turn it off. — Aaron Mason Sep 13 at 1:35

Time to go to bed. It's almost 3 hours past my bed time.

Gentlemen.

Terry Chia

04:45

@ScottPack What the flying fuck. That's the dumbest thing I have heard in a long time.

Terry Chia

05:25

23

A: What are the different widely used RAID levels and when should I consider them?

Also RAID ONE MILLION!!!! 128 Disks so reads would be fast, horrible writes but very reliable I'd imagine, oh and you'd get 1/128th the available space, so not great from a budgetary perspective. Don't do this with flash drives, I tried and set fire to the atmosphere...

LMAO.

Stack Exchange

07:41

But the rind is where all the vitamins are!

Adnan

So, there's a place I'm sure all of you would like to visit.

Terry Chia

@Adnan Heh.

TildalWave

08:35

There, I endorsed a few of you on LinkedIn, if you have problems with that then blame @AviD, I got a mail from LinkedIn notifying me he added new skills and I couldn't resist :P

Terry Chia

@TildalWave What an ass!

TildalWave

@TerryChia A$$!

AviD

@TildalWave mee??

the new skills I added was you endorsing me.

yknow, with like icons and stuff.

Rory Alsop

ahhh - yes, that makes sense. Blame a mod :-)

2

Terry Chia

08:52

@RoryAlsop Sure, blame the blame on the modship.

AviD

@RoryAlsop as per usual. sounds about right.

Hey, anybody here ever use eventbrite?

I am getting dozens of emails, every time somebody registers to the owasp il conf it pings me. any way to shut that off?

ManishEarth

@AviD le filter

AviD

@ManishEarth heh

cmon, that's too passive. I want to do this right.

ManishEarth

@AviD ...ragequit the event?

AviD

@ManishEarth hehe, dammit! I've spent all these hours organizing it, but now I'm getting all these emails??!? I'M NOT GOING!!!

JimL

08:56

Hey, what do you think about this backup/file share service? Located in Norway, datacenters in Norway and they say they use both client side and server side encryption. I'm aware this comes off as an ad, and I'm sorry, but I can't be the only one looking for a secure and reliable backup solution.
http://onlinebackupcompany.com/filecloud/

I just contacted them asking for more info, which encryptions etc

AviD

hmm, very cool - in the 11 hours since I opened registration, over 70 have signed up. and most of those hours were middle of the night...

Adnan

@JimL I don't know, names like that make me feel uncomfortable.

an online backup company called Online Backup Company.

AviD

@Adnan "Jim"??

@Adnan hehe. yeah, with a name like that, I was expecting banana flavored ice cream.

Adnan

I wouldn't really buy a cough medicine called Cough Medicine

Terry Chia

@Adnan What do you think they do?

AviD

09:01

@Adnan or a word processor called "Word".

Adnan

@TerryChia I don't know, they haven't expressed it well enough

AviD

a painting program called "Paint".

Terry Chia

@AviD The horror.

Adnan

@AviD Or a phone called iPhone

AviD

@Adnan dang, you've got a point.

Terry Chia

09:03

@AviD TWSS

AviD

weeeaaaak

bleeeaauuurgh. Meeting time. gotta put on shoes and drive into the city. worst part of my week.

Terry Chia

@AviD Don't forget the pants.

AviD

@TerryChia exactly. I hate having to wear pants.

TildalWave

@AviD Ah, then you should add the "Endorsable" skill to your list :P

AviD

@TildalWave wait, did somebody really do that??? :-0

Lucas Kauffman

09:44

Morning gentlemen

Adnan

@LucasKauffman Morning, good sir.

Lucas Kauffman

NSA breached our biggest Telco

which is responsible for most of the telephone network in the middle east and africa

Adnan

@LucasKauffman Is that euphemism for what you did last night?

Lucas Kauffman

nope

mate of mine had to spend his weekend their

prime mister is going to do a press conference

Adnan

@LucasKauffman Holy shit! This is serious.

@Lucas So, anything official yet?

and is it related to this? security.blogs.cnn.com/2013/06/18/…

TildalWave

09:51

@AviD Dunno, but it's a skill, isn't it? :)

Lucas Kauffman

10:49

@Adnan not sure, the thing is that Belgacom also has BICS which is the biggest mobile data as well as telephone provider in Africa and the Middle East

Polynomial

Heh, I didn't realise that photo of me at 44con made it onto here

Lucas Kauffman

they manage most of the international phone calls to and from those places

Polynomial

that was a messy after-party, as you might be able to tell from the photo

Adnan

@Polynomial How can you make your tongue like that?

I cannot do that with mine. It's difficult to maneuver in certain terrain.

Polynomial

@Adnan ninjaness

Rory Alsop

10:53

@Poly - quick query - do you do ATM hacking?

Adnan

@LucasKauffman Wow, then it is big.

Rory Alsop

I have a friend who might need someone now Barnaby Jack is no more

Lucas Kauffman

@RoryAlsop IOActive needs a new director?

Rory Alsop

@LucasKauffman pffft

Lucas Kauffman

ah nvm

@RoryAlsop wait is this coming from Wim Remes :p?

Polynomial

10:55

@RoryAlsop I may or may not have done something to do with ATMs at some point.

shifty eyes

Rory Alsop

@Polynomial Cool - later on today I'll ping you a quick email with a contact I'd like to introduce you to

Polynomial

@RoryAlsop Keep in mind the stuff I may or may not have done may or may not be under NDA.

Rory Alsop

that's likely to be okay. It just sounds like there might be an opportunity to do some more of that kind of thing

Polynomial

so yeah I can give some vague info but nothing specific.

ah cool

Lucas Kauffman

11:09

BORN TO BE WIIIIIILD

Rory Alsop

ahh, the song of the wild Belgian!

:-)

Lucas Kauffman

@RoryAlsop the advantage of a separate lab environment is that you can put on some music while working :P

Rory McCune

@RoryAlsop yeah I got that e-mail too :op

but my knowledge of ATM hacking is... not that much :)

Rory Alsop

@Rorym - me neither, but I was pretty certain I knew someone who had done something in that area

Rory McCune

@RoryAlsop yeah at the banks we always got externals in to do that as it's seen as a bit specialised..

I remember a bank that once wanted to have Adobe Flash based ads downloaded onto their ATMs directly from the Ad providers.

Rory Alsop

11:15

noooooooooooooo

Rory McCune

Oh the LOLs that were had while saying NO! to that one :)

Rory Alsop

ooh - lunchtime. Time for a walk around the block (one cafe, 6 L7-8 portals...)

Rory McCune

nice!

Terry Chia

@RoryMcCune What the fuck. <== only appropriate reaction here.

Rory McCune

@RoryAlsop BTW have done lawn, will be able to bring the mower back round once I change cars, but if you need it before then feel free to collect if you're about :)

@TerryChia yeah they were thinking of ways to make money off the ATM fleet and to someone in marketing that seemed like a reasonable idea I think..

Polynomial

11:18

@RoryAlsop MWR!?

tut tut

don't even know where I work

Lucas Kauffman

@RoryMcCune The appropriate response to that would be you buying a fish and slapping the client several times with it in the face

Rory McCune

@LucasKauffman heh you could put that in the report "made use of a piscine based preventative control"

Lucas Kauffman

@RoryMcCune and you could at it to your expenses! "One large trout"

Rory McCune

@LucasKauffman I'd love to see what the EY finance people would make of that. I used to get an expense Exception for using the standard airport carpark!

Lucas Kauffman

@RoryMcCune They are actually quite relaxed about our expenses here, I've never ever had an expense rejection as long as the partner signed off on it and I had a receipt

@RoryMcCune even the occasional pizza during our out of business hours testing is paid for :p

Rory Alsop

11:48

@rorym - i need to work from home tomorrow (kids off and no childcare options) so I can swing by

@Poly - gaaah, sorry

Rory McCune

@RoryAlsop cool cool, should be about most of tomorrow, though gotta pop out for an MOT and sorting out car at some point :)

Rory Alsop

no worries - will call first

lynks

12:05

so how was 44con?

Scott Pack

@TerryChia I don't disagree. That's one of those solutions that is interesting and could work in certain select situations. I would never bring it up as a viable solution in a public forum either. It's too easy to end up weakening your environment.

Terry Chia

@ScottPack With that being said, it could be an interesting if very niche idea if someone is willing to put in the effort of maintaining a fork of the kernel.

Or heck, just use a firewall.

Scott Pack

Now that I've had sleep that's what I'm thinking. iptables exists within the kernel. The only difference is that it's programmable whereas his method isn't.

Terry Chia

@ScottPack Yeah... iptables is just a wrapper around netfilter anyway. It's all kernel-based.

Simon

Morning.

I realized something this morning: I love nuts.

7

Also, it's my 99th consecutive day.

Lucas Kauffman

12:22

@Simon Well good you broke up with your girlfriend then, time to find yourself a boyfriend!

Terry Chia

Someone asks on the PHP developer mailinglist for an audit of PHP due to the NSA disclosures. PHP doesn't need the NSA to be insecure.

Tweeted by i0n1c on September 16, 2013 at 12:19 PM

BURN!

Thomas Pornin

@Simon Well, don't worry, we too love you (to some extent).

Terry Chia

/cc @Simon

Simon

@LucasKauffman Nono, I like the kind of nuts that you eat.

5

Actually, that doesn't help my case.

Scott Pack

I'm not posting an image of that.

Simon

12:23

@ThomasPornin Coming from you, it's a huge compliment anyway.

@TerryChia My poor PHP.

Lucas Kauffman

@Simon It's okay Simon, we like you the way you are, regardless of your openness about your sexual tendencies

Scott Pack

Simon likes his compliments like he likes his nuts. Huge and full of love?

6

Lucas Kauffman

@ScottPack He loves sucking those nuts dry.

Scott Pack

Snide remarks not withstanding, I think I can speak for everyone when we say you're safe here.

Terry Chia

@Simon It's Stefan Esser. You know he is right.

Thomas Pornin

12:24

@TerryChia Mostly, writing BigInteger code is fun. However, I have some extra reasons: higher performance (especially for small integers), better support for bit fields, and better integration in a generic library I am writing (for computations on finite fields).

Simon

@ScottPack I feel like eating huge nuts would be less trouble.

@TerryChia goes to wiki

Terry Chia

Also, can we stop talking about @Simon's love of nuts? Stop mocking the poor fellow. He has enough nuts on his plate already.

Simon

He doesn't even have a wiki page. Therefore, he's not right.

Terry Chia

@Simon The dude wrote Suhosin lol.

Simon

@TerryChia More stuff I've never heard of.

Terry Chia

12:26

@Simon hardened-php.net/suhosin

Simon

Oh. He sounds like a cool guy now.

Thomas Pornin

@TerryChia Using an authority claim to state that PHP is insecure: isn't it a bit overkill ?

Terry Chia

@ThomasPornin True, but I'm trying to convince poor @Simon here to abandon PHP.

Simon

One day, one day.

However, I should finish my god damn maths class before I learn a new language.

And let's face it, I'm not motivated for shit.

Terry Chia

@Simon Unless it's about nuts.

Simon

12:30

@TerryChia If only you knew how tasty they are.

Terry Chia

@Simon ...

Simon

@TerryChia "You'll love my nuts" - Vince.

Is anyone else having trouble to get on gmail?

Terry Chia

@Simon Nope.

Scott Pack

Or how about some nice salty Schweddy Balls?

Simon

@ScottPack No idea what those are.

Scott Pack

12:35

hulu.com/watch/4156

Simon

Now that I'm asking if gmail is down, it loaded fine with the chat and everything. Sigh.

Sorry, currently our video library can only be watched from within the United States

No, I'm not gonna get a proxy from the US nor set a US exiting node on Tor.

Too many steps.

Scott Pack

I'm checking to see if this stream is good enough to bother posting. Waiting on ads to finish

nbc.com/saturday-night-live/video/…

Rory McCune

@ScottPack youtube.com/watch?v=6R5xcydYKqU that the one you're thinking of?

Scott Pack

@RoryMcCune Probably, but my link is higher quality and full length

Terry Chia

@ScottPack Is that what you tell the ladies?

Rory McCune

12:39

@ScottPack but is your link available outside the US :oP

Simon

@RoryMcCune Your emote has a big nose.

Scott Pack

@RoryMcCune We'll find out if Simon disappears for about 5 minutes.

Simon

wut

Rory McCune

@ScottPack heh well the NBS link doesn't work in the UK anyway..

Simon

COME ON LOOOOOOOAAAAAAAAADDDDDDD

Stephane

12:40

Nothing like waiting for 20 minutes for a webex call to start to tell you this day is going to be crappy

Scott Pack

@RoryMcCune Neither does the emergency number

Stephane

Sorry, just venting

Simon

We're sorry, but the clip you selected isn't available from your location. Please select another clip.

I had to type this ^

Scott Pack

Fuckers

Oh, yeah, @RoryMcCune, that clip doesn't have the best parts either.

Rory McCune

@ScottPack yeah I'm sure I've seen a longer version but a basic youtube search doesn't show it...

Scott Pack

12:44

Here, this will start at the segment with Paul Schweddy

►

AviD

@ScottPack oh I love Schweddy's Balls!

Scott Pack

@RoryMcCune NBC does a pretty fantastic job of keeping SNL skits clear of youtube.

@AviD They're so tender and creamy.

So, @AviD, are Schweddy Balls kosher?

AviD

He sounds kosher

Rory McCune

I did not realise it was also an ice cream flavour...

Simon

@ScottPack Is this show 39248324 years old or what?

Scott Pack

12:47

@RoryMcCune Oh yeah. Quite smooth and slightly salty.

Simon

Man, she seems to be a huge fan of balls.

Antony Vennard

@AviD Hello! I have a question - when are you gonna send me your ideas email ;)

Simon

I think they managed to make every single joke about balls in one short sketch. Props.

lynks

oh wow, I so nearly just locked myself out of a box.

Scott Pack

@lynks You nearly forgot breakfast in bed didn't you?

lynks

12:50

adding a new user, accidentally chowned the whole /home directory to the new user. Couldn't log in to any admin accounts.

Antony Vennard

@lynks Could be worse. Could have forgotten FDE passphrase.

Terry Chia

@lynks lmao, remote or local box?

Scott Pack

@AntonyVennard Nah, that's when you log into the console and check out a recovery token.

lynks

@TerryChia remote, public key only (so all ~/.ssh/authorized_keys files were unreadable

Terry Chia

@lynks ouch... how did you fix it?

lynks

12:52

I had to log in as the new user, the only account open. Which meant going and getting his private key from him :P

Then su, then panic over.

Antony Vennard

@ScottPack well, that's true. Unless you're a home user who doesn't have one. I may have locked myself out of an experimental box once...!

Scott Pack

>_<

Terry Chia

@lynks Ah that would work. But bad sysadmin! bad :P

lynks

You know how they say "we will never ask for your password/private key"... depends how bad your sysadmin is.

Terry Chia

@AntonyVennard What, you don't have your FDE password written down on a piece of paper attached to your monitor????

Antony Vennard

12:54

@TerryChia No sorry. And at the time, I didn't know the NSA was handily archiving all encryption keys either.

Terry Chia

@AntonyVennard Man! Imagine how much the NSA can add to their budgets if they would rent out their supercomputers to recover lost encryption keys!

"Lost your encryption key? No problem! Contact the NSA now to recover it for a discounted price of $9,999! More discounts available if your purchase in bulk."

Simon

Great moments.

So yesterday, I went to pick up some stuff at the apartment and then my ex proceeded to tell me how much her parents hate me now and all.

AviD

@AntonyVennard oh maan, almost forgot about that.

Scott Pack

@TerryChia Noob!

AviD

definitely after the owasp conf... and after I get some sleep .

Terry Chia

12:57

@ScottPack Hah!

Simon

That's his password on the SE network.

Antony Vennard

@AviD Okay cool. I'm in no rush at the moment, but I'd like to get something kicked off. When's the OWASP conference? Are you presenting?

AviD

oct.1. selecting the talks today/tomorrow, will decide thenn.

but I'm organizing, pretty much by myself...

Antony Vennard

@AviD Ah okay. Well not so far away then. Sounds good.

AviD

@AntonyVennard you should see the list of talks.

Antony Vennard

13:00

@AviD Is there a list I can look at?

AviD

not yet. I'll post it when we select.

have a selection meeting tonite.... have to narrow down to about 60% of the proposals.

its gonna be hard....

Terry Chia

@AviD ahem...

AviD

waited for that :-)

Simon

Is this a dream? IT'S SUNNY OUTSIDE!

Terry Chia

@Simon Only in Canada.

Scott Pack

13:08

It's dreary outside here. Take it back.

AviD

you're both wrong. its bloody hot out, but its starting to cool off, relatively speaking.

Simon

It's been raining/ugly for the last few days, leave my sun alone.

Scott Pack

The weekend was incredible. It hit 72 yesterday. Then last night rain and it's supposed to be in the 80s this week. Ugh.

Simon

You're incredible.

AviD

@Simon thank you.

Simon

13:25

Is it even possible to convert a HTML page into Excel?

Rory Alsop

@Simon - sure....but why?

Simon

@RoryAlsop Weird stuff that I'm getting asked to do. The page generates a report and they want it in Excel too.

Terry Chia

@Simon That sounds horrible.

Simon

@TerryChia Yep.

Terry Chia

What's wrong with generating PDF reports like normal people?

AviD

13:27

have you read the PDF spec? its disgusting.

Simon

@TerryChia They want both PDF and Excel.

Rory Alsop

ahhh - if you are generating your page the correct way (ie content separate from presentation) then this should be easy - just give them all the content as an xml file or better yet as a csv

Simon

Well, it's one of the dudes who asked me this. I bet if I'd tell my boss he'd facepalm.

Terry Chia

@AviD CTRL-P an existing webpage. :P

Rory Alsop

I did have a client who wanted all reports in word, pdf and excel

Terry Chia

13:28

Kidding...

@RoryAlsop What, no love for powerpoint?

AviD

HTML-to-Excel conversion really only makes sense if the webpage is made out of tables.

Rory Alsop

for x-hundred web applications

Simon

@RoryAlsop Oh, I'll look into it. Thanks.

AviD

but if thats the case, then it damn well better be a data-heavy page in the first place.

Rory Alsop

yep - what @AviD said

AviD

13:29

but thats only client-side.

Rory Alsop

@Terry - no

Polynomial

more like PoorPoint!

AviD

serverside, if the data is generated seperate from the presentation, as @RoryAlsop said, then just having another action/filter/whatever is very painless.

Terry Chia

But yeah, direct HTML -> Excel doesn't make sense imo. You have the data. Format it properly in a way that makes sense for Excel instead of doing a half-assed conversion.

AviD

many frameworks will do this for you automatically and transparently.

Simon

13:31

@Polynomial everybody, give it up for @Polynomial.

AviD

its how many RESTful apps do it, its how MVC is designed....

@RoryAlsop @TerryChia we do Prezi now, Prezi is cool.

Rory McCune

@AviD indeed all my recent presentations are prezi :)

Thomas Pornin

@TerryChia Once I did generate HTML-for-Excel, but that was because it was much more reliable than CSV for data which included both UTF-8 strings and embedded newline characters.

Terry Chia

@AviD I'm using reveal.js currently. Have to try out prezi soon.

Rory Alsop

Yay for Prezi

Rory McCune

13:32

@AviD yeah respond_to blocks in ruby on rails are cool for that.

AviD

@RoryMcCune really? you have to write a block to do that? ;-)

Rory McCune

@AviD lol well you specify what you want to happen when a specific format is requested .. .xml, .html and .json you get for free

Terry Chia

@RoryMcCune Angular.js + Node.js + RethinkDB ftw!

AviD

asp.net web-api is really awesome for this too - unless you specifically want to block a certain format, it will by default take your return data and format it according to whatever was request - json, xml, html, ....

@RoryMcCune ah yeah, okay.

@TerryChia that sounds awfully tiring.

Rory McCune

@TerryChia ok you've managed to find a product I've never heard of, what's RethinkDB

Simon

13:35

@TerryChia You can stop reviewing first posts now.

Terry Chia

@RoryMcCune Hahaha! It's a new NoSQL database that was up on the GitHub trending repositories list a while ago.

It actually looks like a better version of Mongo. I'm planning to give it a shot one of these days.

Antony Vennard

@TerryChia Doesn't have .js on the end. Can't be cool. Or does it have a .io domain name?

If it does I might let it off.

Terry Chia

@AntonyVennard Writing a database in Javascript..... Oh gawd I can picture it now.....

Rory McCune

@AntonyVennard looks like they're proper old-school and have a .com

Antony Vennard

@RoryMcCune That's so yesterday.

Terry Chia

13:39

@AntonyVennard Hey! .io domains are expensive!

Rory McCune

@AntonyVennard I'm not sure, I think they might be shooting for a bit of a retro feel..

Antony Vennard

@RoryMcCune Yeah I guess .com could do it, for the whole retro thing.

@TerryChia Wow, so they are.

Simon

13:57

Hooray for our ISPs. One of them has 30% packet loss and our main one goes from 2% to 16%.

Transcript for