The DMZ

D3C4FF

02:13

@paste Wait. I thought @tildalwave had a fairly bad-ass beard...

paste

02:39

Girls can have beards too

Terry Chia

@paste Did @Iszi have a nice one?

paste

Yeah, facial hair looks good on her

Stack Exchange

04:01

'Sorry, I left out my glass of water from last night.' OH GOD I APPARENTLY LIVE IN A GARBAGE PIT.

CodesInChaos

07:42

@StackExchange So true.

TildalWave

08:06

@paste I'm gonna ignore this :P

@StackExchange other people have too much time on their hands

AviD

@TildalWave keeping all your stuff in the closet is just plain inefficient! Things should be right where you need them, and statistically that will be right where you last used them!

TildalWave

08:25

Yar.. SE/XKCD forgot not everyone suffers OCD

CodesInChaos

The word "chaos" in my nick is there for a reason

Rory Alsop

09:10

finextra.com/News/FullStory.aspx?newsitemid=25228

> The Comptroller says that he has some faith in the ability of big banks, with massive resources and large IT security teams, to fight off attacks. However, he warns that hackers will increasingly turn their attentions to small community banks with less sophisticated defences and a reliance on outside IT vendors.

yep - that's one bit, however I think state cyber-warfare will still go for the big players...

Terry Chia

@RoryAlsop What's a Comptroller? Is it a computer troll?

Rory Alsop

@TerryChia I think it should be. But apparently it's a 'merkin word

Lucas Kauffman

Turns out it was the GCHQ was behind the BICS hack at Belgacom

Rory Alsop

@LucasKauffman really? Hmmmm

Lucas Kauffman

@RoryAlsop yea Snowden released some documents about the hack

Stephane

09:31

@LucasKauffman Link ?

Lucas Kauffman

spiegel.de/international/europe/…

Stephane

09:46

@LucasKauffman ty

lynks

was that PIE question deleted? can't seem to dig it up and wanted to re-read @Thomas 's answer today.

nevermind found it. was sure "PIE" appeared in the title, but it does not

lynks

10:24

just tried to move a loopback filesystem file into its own mount point. don't do that.

AviD

11:11

@TildalWave Oh I have the OCD. It's just finely tuned with an engineer's sense towards human efficiency, not objective orderliness.

@RoryAlsop BBBZZZZZZRRRRRRTTTT!!! You said "cyber" in a non-ironic usage....

Thomas Pornin

10

A: Why doesn't Linux randomize the address of the executable code segment?

Although the details greatly vary between architectures, what I say here applies equally well to 32-bit x86, 64-bit x86, but also ARM and PowerPC: faced with the same issues, about all architecture designers have used similar solutions. There are (roughly speaking) four kinds of "accesses", at...

lynks

@ThomasPornin Thanks, I'll be reading that daily until I understand it all.

Terry Chia

11:38

@lynks You can still read it even when you understood it.

lynks

@TerryChia ain't nobody got time fo dat.

TildalWave

11:57

@AviD oh that I have then as well LOL

I wouldn't call it OCD tho, maybe OC, but not D

CodesInChaos

Mine is selective. For example I feel it's necessary to edit bad posts on SE, even when I'm sure they'll be closed and/or deleted withing the hour.

lynks

My cousin just came out with this; "Looking for a new girlfriend, I'm eschewing the traditional 'can I have your number' for the more direct 'can i have your pgp key'" A good filter I say.

CodesInChaos

Pretty strict filter.

Terry Chia

0

Q: What is this QR code authentication scheme called?

What is this pattern for mobile authentication called? It's more convenient than entering complex password on mobile phone, and I wanted to read about it more A user is authenticated within webapp and he wants to bind his mobile app with his account He uses his mobile app to scan QR code contai...

Am I missing something or is this totally stupid?

@lynks Cmon, even I don't have a pgp key.

lynks

@CodesInChaos is that a bad thing?

CodesInChaos

12:13

Even most cryptographers only have a PGP key because it'd be embarrassing to not have one. They don't actually use it.

(at least that's my impression)

Terry Chia

@CodesInChaos They probably use it for emails. I won't take a cryptographer that doesn't sign their emails seriously. :P

I won't actually verify it though. Obligatory XKCD.

If you want to be extra safe, check that there's a big block of jumbled characters at the bottom.

Rory Alsop

@Tildal(cc @AviD) it's actually CDO...that way all the letters are in the correct order!

CodesInChaos

Even when you have a pgp key I'd avoid signing stuff as much as possible

AviD

@RoryAlsop hehe, yes, I am familiar.

lynks

There are a couple of people I talk to that I would not if we didn't encrypt and sign it all.

CodesInChaos

12:16

I'm more of a DH based authentication guy

Terry Chia

> Microsoft (They have a million servers,[1] although no one seems sure why.)

what-if.xkcd.com/63

AviD

@TildalWave thats right, there's nothing wrong with it! It's the others that are wrong!

lynks

@CodesInChaos afraid it might catch up with you?

Rory Alsop

@AviD - I looked for the original cat image that goes with it, but my google-fu is weak today

CodesInChaos

Deniability is already weak enough without signatures, no need to make it even weaker

TildalWave

12:17

@RoryAlsop haha nice one, took me a while to realize it too... need ... moar ... coffee

CodesInChaos

@TerryChia Might be useful in some corner cases. For example client-sided encryption.

Terry Chia

@CodesInChaos But the key k is obtained from a scanned QR-code. Which implies that the server already has knowledge of k.

CodesInChaos

@TerryChia No, it's for key sharing between several trusted clients

at least that's the one case I see where it's somewhat useful

Terry Chia

@CodesInChaos Maybe I'm just slow tonight. Mind explaining more?

CodesInChaos

You want to encrypt stuff, but need the same key on all clients

so you either enter the same password on all clients, or you'll need to transfer it in some other way

Terry Chia

12:21

@CodesInChaos Where does the webapp stated in his question come into play in that scenario? Of course I can assume the guy doesn't know what he is talking about...

CodesInChaos

since passwords tend to have low entropy, replacing it with a high entropy key that's transferred via QR might be useful

I assumed it's an App installed on the client

Terry Chia

@CodesInChaos I get the scenario you described. It makes sense in that case.

CodesInChaos

but I don't really know what that guy wants to do

Terry Chia

It doesn't make sense the way he describes it, webapp + authentication?

CodesInChaos

wouldn't be unusual if it made no sense

Terry Chia

12:23

Of course he might not know how it actually works...

Rory McCune

@LucasKauffman did you see the latest on the belgacom thing? spiegel.de/fotostrecke/…

looks like it was GCHQ...

whoops

CodesInChaos

@TerryChia Not sure, depends on the details. Perhaps it's some form of two-factor-auth

where the phone or paper serves as "something you have"

Rory McCune

I'm sure there won't be any blow-back on the UK hacking other EU countries will there...

CodesInChaos

While the implementations have a relatively bad reputation, I'd still prefer OTR+jabber over GPG+email

Terry Chia

@CodesInChaos I'll be interested if anyone (@ThomasPornin maybe?) can come up with a reasonable explanation.

lynks

12:28

@RoryMcCune bad times.

Rory McCune

@lynks indeed, networks/apps/systems have not been designed to deal with this level of attack.

it'll be a disaster for online stuff if everyone needs to start defending against that.

@LucasKauffman sorry just read back on the transcrpt and realised I'm slow on this one..

@lynks we had a presentation on incident response last night and all I'll say is it sounds like that'll be a good business to be in for quite a while!

lynks

@RoryMcCune I'm going to refrain from having a political discussion on a public message board. Suffice to say, I dont like Snowden very much.

Terry Chia

@lynks +1

Rory McCune

@lynks Rly? Lots of people have said that the knew all along that this kind of stuff was happening but this is the first proof that there's been

I'm quite glad it's out in the open 'cause it stops all the arguments about "this couldn't happen to us"

Also I'm pretty disappointed in my own government hacking our allies telecoms companies (if this turns out to be true and it sounds like it will)

lynks

@RoryMcCune yeah there are certainly some positives, but nothing excuses all the shit Snowden is putting the services through. In many cases, destroying entire career's worth of work.

Rory McCune

12:32

I'd have hoped we wouldn't do that. It doesn't help trying to take a moral stand on Internet hacking from other countries like china when it turns out we're doing the exact same thing

to our allies no less

lynks

Even, albeit indirectly, putting lives at risk.

@RoryMcCune Yeah that was a bit disappointing

Adnan

@TerryChia +1

Rory McCune

If the US Gov had had decent whistleblower protections in the first place this might not have happened.

Adnan

@Adnan +1

2

Terry Chia

@Adnan That's sad.

lynks

12:33

@Adnan the star of shame

Adnan

@TerryChia Today I feel sad.

@lynks At least it's something

Simon

Morning.

Rory McCune

Afternoon

Terry Chia

Night

Adnan

@Simon Yes I am.

Rory McCune

12:35

yay cycle complete!

Simon

So last night, I went to bed at 3h30 AM, got up at 7 AM.

Terry Chia

@Adnan CCCCCCCCC-OMBO BREAKER!

Simon

It's gonna be a great day.

Adnan

@TerryChia Oh, I thought he said "mourning"

Terry Chia

@Simon It's Friday. I got two free jackets at work. It's an awesome day.

Adnan

12:35

@Simon It's not. No day is a great day.

Simon

@TerryChia What's written on them?

Adnan

It's an illusion

Simon

@Adnan Is life an illusion?

Terry Chia

@Simon Red Hat Certified Engineer.

Simon

@TerryChia Oh, that's sick.

Terry Chia

12:36

@Simon Your good looks certainly is.

Adnan

@TerryChia His good what now?

Simon

@TerryChia I don't know if those women at the club last n8 would agree.

lynks

@TerryChia I would like a jacket please.

Adnan

@Simon Happiness certainly is.

Terry Chia

@Simon They probably had a lot to drink.

Simon

12:37

@TerryChia Well, probably.

Terry Chia

And they probably had a lot to think about this morning.

lynks

@TerryChia wait, are you redhat certified?

Terry Chia

@lynks Yep. :)

lynks

@TerryChia isn't that like....really hard?

3

Simon

@TerryChia Nah. Those girls do that kind of stuff weekly.

Terry Chia

12:38

@lynks Nah. It's easy if you have experience with Linux.

Simon

@lynks That's what she said.

Terry Chia

And TWSS.

@Simon BAAAAAAAAAAAAH!

Simon

@TerryChia I'm fucking half asleep on my chair and faster than you, c'mon.

lynks

@TerryChia I always though redhat enterprise people were like @Gilles level gurus

Simon

@lynks Are you saying that Terry sucks?

Terry Chia

12:39

@lynks Nope. The RHCE cert is mostly about configuring a bunch of network services.

Postfix, SMB, NFS, Apache that sort of things.

lynks

@Simon only on weekends

Simon

@lynks Oh.

lynks

@TerryChia pfff I can do that

@Simon and on weekends his name changes

Simon

On a side note, I can still hear a whistling sound in my ears.

Terry Chia

@lynks But well, no Google. Only man pages and /usr/doc files. That's the tricky part.

Simon

12:40

@lynks Does he become Sventslka

Or whatever the fuck that name was.

AviD

@lynks nah, its the *nix-y version of CCNA and MCSE.

lynks

@AviD ahh, then what am I thinking of. I remember my uncle employing redhat sysadmins at a very high wage.

Simon

A coffee sounds great right now for some reason.

Terry Chia

@lynks Well, there is the RHCA cert which is definitely tougher to get. You need to know how to write selinux policies and that sort of thing.

AviD

@Simon oh yeah. I just got a new package last night, dying to try it out. Unfortunately we have to leave soon, driving to visit the 'rents for the weekend.

2

smells so darn good!

Simon

12:43

Coffee smells better than it tastes, imo.

lynks

@AviD why is nobody else starring this

AviD

huh? why is that being starred? the second one, sure, but why star my parents??

Terry Chia

@AviD New package.

lynks

@AviD they go together quite well

Terry Chia

Dying to try it out.

Simon

12:44

Wow. I still don't get it.

AviD

@TerryChia meh, thats weak

Simon

My double-entendre ability is gone.

Terry Chia

@Simon You can't lose what you never had.

AviD

@Simon no no, you're fine - for a change - there is only a single entendre there.

Simon

@TerryChia Oh nah, I'm pro at this usually.

@AviD Ok good.

lynks

12:44

@AviD I think thats a nationality-thing, in the UK "package" has pretty much only one meaning.

AviD

@lynks well I get that part, but the context doesnt play it nicely.

Terry Chia

So I just updated my iPhone 4 to iOS 7. I can't see what all the hate was about.

It's dogass slow since it's a 3 year old phone, but it's still a nice.

AviD

@TerryChia It's an Apple OS....

Terry Chia

@AviD Says the guy using Windows...

:P

AviD

@TerryChia if you had been born a couple decades earlier, you would still be on AOL...

@TerryChia yeah, exactly.

Terry Chia

13:20

So.... anyone has any recommendations for x86 Assembly books before I throw down some cash and get this one?

amazon.com/dp/013602212X/?tag=stackoverfl08-20

Hmm, this one looks good as well and it's significantly cheaper....

amazon.com/Assembly-Language-Step-Step-Programming/dp/…

Simon

No, I'm not a nurd.

Thomas Pornin

@TerryChia In the question, the QR code is a red herring (which may induce some weakness)

AviD

@TerryChia sure, because you can always tell the quality of a book by the cheaper price on its cover.

Terry Chia

@AviD Nah, the first book is meant as a textbook. Probably explains the price...

@ThomasPornin Are you gonna be dropping an answer in there?

Thomas Pornin

@TerryChia Yep. Just began.

Terry Chia

13:33

@ThomasPornin Great, looking forward to reading it.

Iszi

@ThomasPornin Seriously? I mean, with the length of most of your answers, I always assumed you'd started writing all your posts long before the users even thought to ask the questions!

Terry Chia

@Iszi He probably needs time to type out the fully formed answer in his head.

Thomas Pornin

@Iszi When a sculptor creates a masterpiece, he does not actually create the statue; the statue has always been there; he just removes the pieces of stone which were around it.

Terry Chia

13:51

So, people like @lynks or @Polynomial. Any book recommendations for x86 assembly? :P

Thomas Pornin

@TerryChia I had a good book, but it is in French and out of print (it was 20 years ago)

Try the original 80386 manual: microsym.com/editor/assets/386intel.pdf

Antony Vennard

@TerryChia I personally didn't find any one book brilliantly helpful - a collection of different books, a bit of experimentation and googling helped me most. This book does introduce assembly and is a good intro to shellcode: amazon.com/Hacking-Art-Exploitation-Jon-Erickson/dp/1593271441/… but as I say, it is one of a few.

@Terry you might like en.wikibooks.org/wiki/X86_Assembly

and you should definitely get these: intel.com/content/www/us/en/processors/…

@TerryChia the problem with books is that they're often out of date/wrong. For example, the assembly with linux one has a chapter on using int 80 - that's the software interrupt for making a systemcall. These days, syscalls are done with sysenter/syscall. int 80 is actually really useful only for testing your rootkit hooks correctly without a deluge of "other stuff on the system"... :)

Terry Chia

14:11

@ThomasPornin Thanks, but I was actually hoping for something a little less dry. :P

Simon

So... Programming and stuff, right?

Antony Vennard

Which reminds me, rootkit aresonal is a fantastic book (I think @Poly would agree ?) which contains an introduction to assembly to start off with. It is highly Windows focused, but that won't hurt you.

Terry Chia

@AntonyVennard Thanks for the various recommendations. Yeah, the outdated aspect bugged me a bit.

Thomas Pornin

@TerryChia It's assembly. It is dry, by nature. Get used to it.

Terry Chia

I'm actually looking for something a little more focused on assembly itself. I found that I need more grounding in the basics before revisiting the fun stuff like RE or exploit writing.

Simon

14:13

Dry is not a positive thing in many situations.

Thomas Pornin

@TerryChia You really want to start with a simple model (80386) because each CPU version adds a lot of opcodes which make the whole picture more confused.

Terry Chia

@Simon Nothing that will concern you. It isn't PHP.

Thomas Pornin

@TerryChia I wrote an answer but I am not very happy with it; it is sloppily structured.

CodesInChaos

The way I started was looking up the opcodes I needed while reversing starcraft

Simon

@ThomasPornin -1

Terry Chia

14:16

@ThomasPornin Ahhh, yeah the way you described it makes sense.

I thought it was stupid. :P

Thomas Pornin

@TerryChia Well, the bit with the QR code is kinda stupid. The rest makes sense, though.

Antony Vennard

The other thing you can do is take simple C programs and get the compiler to emit assembler listings. Of course, they need to be v simple C programs, but it can work for some things. For GCC, you might want to use whatever the intel syntax switch is. I personally find AT&T hard to read.

Simon

Anyone, help?

Where's @Adnan when you need his silly coments?

Thomas Pornin

@Simon Help with what ?

Terry Chia

@Simon Probably busy being sad and depressed today.

Simon

14:17

@ThomasPornin A translator would be nice.

@TerryChia Why is that?

copy

@TerryChia Not a book, but these lectures are decent: opensecuritytraining.info/IntroX86.html

Simon

@copy Don't encourage them!!!

copy

Huh?

Thomas Pornin

@Simon You don't make much sense this morning.

I mean, you are worse than usual.

Simon

@ThomasPornin I just realized.

Terry Chia

14:19

@ThomasPornin s/this morning/always

Thomas Pornin

What did you put in your coffee this morning ?

Simon

Well... 3.5 hours of sleep.

Because I decided clubbing on a Thursday was a clever thing to do.

Antony Vennard

@Terry Another exercise you could do is to have a go at that canyoucrackit challenge from a while ago. The second part is to write a mini emulator for an instruction set that kinda ressembles 16-bit x86 sorta. I don't know where you'll find the original JS, but my solution is here.

Thomas Pornin

@Simon club (verb): to hit (a person or animal) with a heavy stick or object

Simon

@ThomasPornin Oh c'mon, you were young back then too. You know what it means.

copy

14:22

@AntonyVennard Or just this: codegolf.stackexchange.com/questions/4732/…

Antony Vennard

@copy Yep. Any would do. I was mostly posting it because I know @Simon loves these discussions ;)

Simon

@AntonyVennard Oh you!!!!

Thomas Pornin

@Simon Yes. You congregated with some of your peers in turbulent youth, got your eardrums ripped apart and your intestines devastated with chemical warfare, and this morning you feel as if you had indeed been mauled by someone wielding a club. For some reason you think it was "fun".

Simon

@ThomasPornin It's funny because my ears are still fucked up.

I didn't drink much, I was the driver.

The other funny part is that I will be at a rave tonight.

I'm sorry, me.

Rory Alsop

I'm gigging next Wednesday - of course, as we are a mid-life crisis rock band, we put the speakers at the front of the stage so we can still talk but the audience get the volume. I works a treat :-)

Simon

14:27

Haha.

Antony Vennard

@RoryAlsop Isn't it weird to hear what you're playing from behind the speakers? Or can you still hear it fine?

Simon

Most DJs wear ear protection. That's the clever thing to do when you're traveling the world constantly to mix.

@RoryAlsop I drove my buddy's STi on my way back home last night. A solid hour of joy.

Terry Chia

@RoryAlsop Do you use CIEMs?

Rory Alsop

14:49

@Antony - we still have our wedge monitors. At some point I want to buy in ear monitors, but it's a challenge

CodesInChaos

Shopping on websites with $ prices is funny. My brain assumes 1 EUR = 1 USD and in the very end I get pleasantly surprised because it costs less than I expected once it's converted.

Rory Alsop

@Simon - nice!

Terry Chia

15:09

@RoryAlsop Why is it a challenge?

Everett

15:55

Simon, I'd say I remember clubbing on Thursday nights... But the club was too good to remember it ;)

I used to go to a place called the Vortex on Thursday nights. That was the 90's. By 2k I think it was shuttered...

Rory, what kinda tunes you spin?

The bot Data

16:20

Anyone there?

Rory Alsop

@Everett heh - no spinning. It's all live. See www.metaltech.me for info :-)

Everett

16:34

Just us chickens bot

@Rory Alsop - Which clown are you ;) ?

@Rory Alsop - d00D reminds me of Psykosonic, I like it.

and.. uhm... Green Jello

AFK - Lunch

Simon