The DMZ

Terry Chia

15:00

Was Ciphercloud the one that created the big fuss with the DMCA takedown over on crypto or am I thinking of another company?

Simon

@Adnan Are you crying?

I didn't mean to hurt you.

AJ Henderson

updated and answered

Adnan

@AJHenderson You should have just asked your own question and answered it with your own answer.

AJ Henderson

ehh, it addresses his concern

and your answer is still valid

AviD

@CodesInChaos sleazy snake oil is sleazy.

Adnan

15:02

Is this what we're doing now? Completely rewriting question so they can match our answers?

AviD

@CodesInChaos they probably got GRC.com to design their crypto.

Simon

Not me, I don't answer.

Adnan

@AJHenderson Mine isn't really an answer.

AJ Henderson

well, it is now

and it's addressing the question behind the question

I think that makes it a valid edit

Adnan

Yup, it seems that we have sunk to that level.

AviD

15:03

@AJHenderson good edit.

Terry Chia

@Adnan Why are you being such an ass today? It's a good edit that fixed the crappy parts of the question.

Simon

Dayum.

AviD

@AJHenderson that is the guidance for XY problem. Answer the actual problem, not the one asked.

Adnan

Now we're officially making radical changes on questions to match our answers.

AJ Henderson

I do agree with Adnan that it's a fundamental alteration to the question, I just think that it is a valid radical change since it makes it fit the site and still addresses the root question

the new question still captures the answer to the original

Lucas Kauffman

15:04

@TerryChia sand in his vagina.

AviD

@Adnan its a good edit. the fact that the answer was hidden in the fact of the misconception in the question, does not change the fact the the answer is that the question is based on a misconception.

AJ Henderson

if it didn't capture that, then I'd agree my edit was too severe

Adnan

@LucasKauffman More accurately, snow.

AJ Henderson

@AviD that's how I typically answer anyway, I just don't always alter the question if the question is valid enough without alteration

AviD

and when you have a question with the XY problem (where a faulty solution is pre-supposed to be the answer), you should definitely correct the question.

Adnan

15:06

Sorry, in my book, just shoving the word "security" doesn't make the question on-topic.

AviD

@AJHenderson the question was invalid, even irrelevant of the specific ontopicness or not.

Adnan

See: The previous condom argument.

AviD

@Adnan no, but "PCI" does.

AJ Henderson

@AviD yeah, which is why I altered it in this case :)

I'm just playing middle man here saying I understand where Adnan is coming from even if I disagree with him in this case

Simon

How about you all just go drink a damn glass of water and realize how silly this whole argument is?

AviD

15:07

heh, got a badge over on English for my starwars comment.

AJ Henderson

I fully believe my edit was good for this case, just saying I also understand Adnan's concern

AviD

dayum, now its top answer too :D

Terry Chia

What do you want me to do? LEAVE? Then they'll keep being wrong!

AviD

@AJHenderson I agree.

Simon

@TerryChia Pretty much, yeah.

Adnan

15:08

0

Q: Are there any security related rules in PCI-DSS that govern what kind of background color I can use on my merchant website?

Is there a PCI-DSS rule that a merchant cannot use pink backgrounds until we have actually received the payment? I can't seem to find an official reference that describes this as a PCI DSS requirement. Is it one? If so, where can I find it?

AviD

@Adnan ass :)

David Freitag

lol

AJ Henderson

@Adnan while I'd agree that is a bad question, I'd not vote to close as off-topic though

AviD

@Adnan it was a legitimate misconception, even if it was a RTFR one. and tbf to him, reading that crap is crap.

AJ Henderson

but rather "too localized" even though they took that away

AviD

15:10

@AJHenderson the pink background??

Lucas Kauffman

@Adnan you enfant terrible

AJ Henderson

@AviD yeah

AviD

@AJHenderson that is trivially irrelevant.

the funds capture is something that could be mistaken, by someone who is naive about security and regulations.

AJ Henderson

@AviD yeah, which is why I don't think the same logic applies to the existing case, but it does bring up a question about where that line is

AviD

common sense.

AJ Henderson

15:14

which is why I mentioned it would be "too localized" since not enough people would make that error

AviD

"I'll know it when I see it" ?

AJ Henderson

the question is if it is something that might be useful to others in the future because of being a common misconception

AviD

@AJHenderson s/not enough people/nobody/

AJ Henderson

if yes, it's on topic and generally useful, if no, it is on topic and too localized

which now results in "off topic" since that's the official answer to "this question isn't useful"

I still am frustrated by the removal of "too localized"

AviD

@AJHenderson actually, in this case its neither - its a blatant troll attempt.

AJ Henderson

15:15

I notice it a lot as a good close reason both here and on Photography

Lucas Kauffman

@AJHenderson you can write it yourself :p

AJ Henderson

@LucasKauffman yeah, but only under "off topic" which isn't really true

since if it was more generally useful it would be on topic

Lucas Kauffman

@AviD did you ban Adnan?

AJ Henderson

@AviD well yes, in this case it is

Terry Chia

Ari Juels discussing Honeywords: 'I didn't know Blink182 wasn't a randomly generated password. Apparently you have to be young and hip'.

Tweeted by matthew_d_green on October 22, 2013 at 3:14 PM

HAH! Funny considering blink182 is one of my favourite bands.

AviD

15:16

@LucasKauffman no, of course not. I think he's sulking because I deleted his question.

Adnan

@TerryChia Googling blink182

AviD

@TerryChia wasnt it a movie?

Terry Chia

@AviD What? lol

Adnan

regretting Googling blink182

AviD

ah no, that was Turk 182.

Iszi

15:19

@AviD Waitwut?

Terry Chia

RT @wikidsystems: Just googled "how to shutdown windows 8" <- Easy. Install Windows 8.1. http://bit.ly/1deLWeo

Tweeted by SecurityHumor on October 22, 2013 at 3:15 PM

Simon

@Adnan Are you serious?

Iszi

@Simon I think he just put that there to set up the punchline.

AJ Henderson

@TerryChia I do have to admit that I was the only person in the room the other day who could figure out how to actually turn off windows 8

it should say something about the usability of a system when nobody can even figure out how to find the off button

Simon

@Iszi Hopefully.

AviD

15:20

@AJHenderson why would you ever need to shut it off?

AJ Henderson

@AviD to put the laptop away

Iszi

@AviD Good point. If you never turn it on, there's no need to turn it off.

AviD

@Iszi TWSS

@AJHenderson just close it...?

AJ Henderson

putting it away for a week at a time

even standby would run in to problems

Terry Chia

@AJHenderson I'm glad I don't have the same problem. Linux ftw.

Iszi

15:22

@AJHenderson That's what Hybrid Sleep is for.

Terry Chia

@AJHenderson Oh damn, you just reminded me to charge my Macbook Air. I don't think I opened it for a month now...

AJ Henderson

@Iszi did they make that actually work reliably yet

Iszi

@AviD Oh, I just found that Q. Is there a "delete beyond deletion" option I can hit on that?

AJ Henderson

my experience with that has been that if you are very very lucky, it won't crash your computer entirely on rare occasion

Iszi

@AJHenderson Works fine for me.

AJ Henderson

15:23

it generally never wakes up on either the laptop or desktop that I have tried the setting on

AviD

@AJHenderson standby? whats wrong with hibernate?

AJ Henderson

straight up hibernate works fine on both

but nobody could find hibernate either

AviD

@AJHenderson its been working like a beaut since 7. at least.

AJ Henderson

Windows 8 buries it in that silly invisible corner menu

@AviD they introduced it in 7

that's the system it didn't work for me on

on two different computers from different manufacturers

suspend works fine, hibernate works fine, hybrid failed to resume regularly

atleast within a reasonable time frame

Adnan

@Simon @Iszi Honestly, this is the first time I hear of the name

Iszi

15:25

Zero problems with hybrid sleep on my laptop running Windows 7.

AJ Henderson

(as in I left it running overnight once to try and wake up)

AviD

@AJHenderson it is hardware dependant, to a large extent... might be a driver issue?

Simon

@Adnan Damn.

AviD

@Iszi same.

David Freitag

@Adnan Sad a day.

AJ Henderson

15:26

@Adnan not missing much

David Freitag

That was basically the entirety of my high school music... lol

AJ Henderson

@AviD I'm sure it probably is, but my experience was that it worked poorly on two (new) computers

granted, one was a custom built desktop, but the other was a Vaio. I also had initial poor responses with a Lenovo though I didn't do as much testing on that one before turning it off

Terry Chia

@DavidFreitag I still listen to blink182 regularly. But my musical taste probably has zero in common with the people in this room. :P

Adnan

@DavidFreitag Why?

@AJHenderson Yup, thought so.

David Freitag

@Adnan They are a decently good band

@TerryChia They pop up in my playlists occasionally, suddenly lots of memories rush back into my head.

Adnan

15:28

> Genres: Pop punk, alternative rock, skate punk

No, thank you.

David Freitag

@Adnan More for me then

AJ Henderson

@DavidFreitag decently good is debateable, they had a couple of decent songs, but I could never get in to most of their stuff

AviD

@DavidFreitag I thought Justin Beiber was the entirety of your high school music?

Terry Chia

@DavidFreitag The new stuff is mostly average, but the self titled album was awesome.

David Freitag

@AviD I was in high school when that dude was in diapers.

AJ Henderson

15:30

@DavidFreitag ok, now you are depressing me

David Freitag

@TerryChia Their new stuff sucks, i could care less. But the old stuff is still jsut as good to me

@AJHenderson What, he's like 9 or 10, right?

Adnan

Has anybody seen how awesomely Tor.SE are failing?

26

Tor – tor.stackexchange.com

Beta Q&A site for researchers, developers, and users of Tor

Currently in public beta.

Oh, this makes me so happy.

AviD

Schadenfraude.

AJ Henderson

@Adnan it does seem like it would be difficult to make a site on Tor. How hard can it get? It's not a complicated topic

Terry Chia

@DavidFreitag The Dogs eating dogs EP was pretty ok actually. But Neighborhood sucks so bad.

AviD

15:32

Tor is the browser/vpn of choice for hipsters who like pointing out to the NSA how counterculture they are.

AJ Henderson

what is tor, how do I use tor, what are the security risks, what can I find on tor (aka, where the drugs at) and um...

David Freitag

@AJHenderson I have such a wide taste of music it's not surprising that many people in here won't agree with me, but i'll listen to Melodic metal with @Adnan all day, and rock out to some slayer with @Copy late at night. But right now i'm rolling some Hands Like Houses

Adnan

@AviD Pronounced 'roy' not 'raw'.

AJ Henderson

@DavidFreitag I have a wide taste too, I just am not a big Blink182 fan

there is other skater punk that I like

AviD

@Adnan heh

actually thought that was another @rory comment.

David Freitag

15:33

@AJHenderson And by the same token i don't like much other skater punk at all

AJ Henderson

country is about the only thing I won't touch

Terry Chia

@DavidFreitag Have you heard The Wonder Years? Pretty good stuff.

David Freitag

@AJHenderson yeah, that and rap/RMB/reggae... shudders

@TerryChia Nah, not so much... Mainly the reason why Blink182 is so good for me is the memories it brings back

AviD

@TerryChia with Fred Savage?

Terry Chia

@AviD Hah. Talking about the band.

@AviD That one was a little old for me. :P

AviD

15:37

you had to google it, didnt you.

Terry Chia

@AviD Yes.

AviD

For shame.

Adnan

> So if you have the name ‘John’ a million times, you will get a million different cipher texts

Killed me

AJ Henderson

my personal preferences tend to be towards liking melodic or symphonic metal the most, followed by certain types of rap or techno/electronic (that are more musical and less repetitive) For example, certain Daft Punk

also really like groups like Breaking Benjamin, Three Days Grace and Linkin Park

Adnan

►

@CodesInChaos On a more serious note, ciphercloud.com/News/PressReleases/PressArticles/tabid/106/…

AJ Henderson

15:46

also extends on the other side to groups like Blue Man Group, Nightwish, Apocalyptica, TSO, and a few others that I can never remember the names of but that come up in my radio stations

Adnan

> CipherCloud Delivers Breakthrough Searchable Strong Encryption

Apparently, their breakthrough was with

> Advance Intuitive Search – Supports flexible search terms, such as "starts with," "ends with," wild cards, natural language matching and Boolean phrases, compatible with today's Internet search conventions.

AJ Henderson

@Adnan yeah, I thought it wasn't a big deal until I saw that part

and then my jaw dropped

I'm guessing there isn't any technical information on the how available though

Terry Chia

@AJHenderson They are encrypting your files. They are just storing an unencrypted version beside it.

AviD

@Adnan I dont see the problem with that.

it's called a full-text index. most databases have supported this for years.

AJ Henderson

show me all files starting with A, is the record still there, ok, show me all data starting with Ad

hmm, is it still there...

how do they manage to keep the data secure while supporting a search. I guess if it requires the key to search then it's less of a problem though

AviD

15:50

@AJHenderson s/secure//

@AJHenderson and the key part makes no sense - what, they will decrypt all records?

Adnan

@AviD :|

AviD

and assuming each record is encrypted with a different key, how would the user know which key to provide, until the record is located?

Adnan

That search is on encrypted data

AviD

@Adnan (I was being facetious, hope you realize that....)

AJ Henderson

it would seem that it would be a major security issue if you didn't need the key to access the record to be able to search for the record

because otherwise it leaks information by definition

AviD

15:52

seem?

AJ Henderson

well, they may have some magic rabit

AviD

@AJHenderson heads up - they be snake oil vendors.

@AJHenderson magic snake.

heh, that sounds dirty.

AJ Henderson

@AviD so is that a snake that is fed a regular diet of magical rabbits?

AviD

do snakes eat rabbits?

AJ Henderson

apparently these snakes do

AviD

15:53

I know they eat mice, but rabbits are substantially larger.

AJ Henderson

I'd think a big enough snake might

AviD

then again, snakes can eat elephants.

AJ Henderson

google.com/…

google answers the mystery

(of snake eating rabbits, not magical encryption)

AviD

AJ Henderson

I suppose if you make the assumption that you are not using unique keys on records (such as a private collection of records stored in the cloud) then it should be possible to build a search index that can work off of an encrypted search pattern. That's probably what they are talking about, which would still be rather impressive, though of limited use in high security needs (good for cloud purposes though)

kind of similar to the cryptography I can never remember that allows for operations to be performed on encrypted data using encrypted operators and the output is valid for the plaintext when decrypted

AviD

16:00

@AJHenderson homomorphic encryption?

AJ Henderson

there's a lot of weird crypto work specifically for cloud environments where the one doing the processing isn't trusted with the data itself

yes

that

AviD

but in this case the indices would still be unencrypted, since they cant predefine the search terms.

AJ Henderson

well in theory you could find a way to encrypt the term in some way maybe so that it would work with an encrypted index

AviD

unless for every search, they always return:

> No results found! Everything is encrypted securely.

AJ Henderson

I would expect it isn't very space efficient though

but would still be a step up from current

AviD

16:01

@AJHenderson I might believe it if Schneier came out with this, or @Thomas's company.

This company? Pffft.

Again, snake oilers.

AJ Henderson

yeah, I'm still thinking pics or it didn't happen

ie, pics of how they do it

AviD

They just discovered the concept of IV for symetric encryption - and they are a crypto company.

AJ Henderson

just saying it could be feasible to get some stuff, but without more details, I'd be suspect of the security

Simon

SECURITAY

AJ Henderson

respect my securitay?

Polynomial

16:04

Securi-Tay!

(it's a security conference in Scotland)

0

Q: sudo move config file in unaccesable dir

I'm trying to "rewrite" a config file somewhere on my server if ($return = exec("sudo mv.sh '/etc/my/config.cfg' '/etc/my/config.cfg.bak'",$output)){ echo 'Yaaay'; } else { print_r($output); print_r($return); die('Couldn\'t move original config file'); } the dir /etc/my is owned by the ...

php exec sudo

hrrrrrrrrrrrrrk

the tags alone are cause for a headache

Simon

lulz

AJ Henderson

what's wrong with PHP executing SUDO commands?

it sounds like a great plan

maybe that's how they do the search

Polynomial

@AJHenderson $result = exec('ls -l ./' . $_GET['search']); // what could possibly go wrong

3

AJ Henderson

@Polynomial that's * worthy

Simon

Nothing, it's clearly injection-proof because PHP has a built-in protection against that.

Polynomial

16:07

@Simon kekekeke

Simon

lululuul

This song makes me want to take off my clothes and dance in the streets.

►

Polynomial

@Simon Do it.

and send a copy of the police report afterwards

Simon

I feel like I would possibly regret it.

CodesInChaos

@AJHenderson AFAICT they simply store a plaintext index on the gateway.

AJ Henderson

@CodesInChaos actually, I suppose doing that and encrypting the index with the master key would be a passable solution for the company level isolation

still doesn't offer much though

that is probably what they are doing though, based on their reputation from what you guys are saying

(and perhaps I'm optimistic that they are encrypting the index)

CodesInChaos

16:14

there is little point in encrypting anything on the gateway. The gateway holds the encryption keys.

I'm just not sure what the point is in using the "cloud", when you have a stateful gateway.

Lucas Kauffman

16:34

@TerryChia a wild hipster MongoDB user apeared

Simon

I'm a modafukin' hipster with the hardstyle flavor.

Lucas Kauffman

@Simon BAM BAM BAM BAM BAM

Simon

@LucasKauffman Damn right.

I totally forgot to listen to what you linked when I saw it this morning, time to do it now.

Lucas Kauffman

@Simon raw to the floor.

Simon

RAW I'MA GIVE IT TO YA

CodesInChaos

16:43

@LucasKauffman Mongo is okay. The frightening part is that he wants to give an application running on the endusers computer direct access to the database.

Simon

Damn, the kick is Jumpstyleish but it's too slow to be Jumpstyle.

confusing/10.

CodesInChaos

"db.dropDatabase()" -- Ay, ay, sir.

Simon

@CodesInChaos Shouldn't you pass the database name as a parameter?

I mean, "db.dropDatabase($_GET['dbName']);" now that's secure.

Lucas Kauffman

@CodesInChaos I missed that part I think

Simon

HELLO @tylerl

That's the fastest hello you ever got, admit it.

tylerl

16:47

@Simon indeed

Simon

I win.

Lucas Kauffman

@CodesInChaos updated

AJ Henderson

@Simon don't you mean HELO @tylerl

Simon

@AJHenderson I don't understand nerd.

tylerl

@AJHenderson Hopefully in this day and age you'd be using EHLO

Simon

16:54

What are you dudes saying.

tylerl

i mean is this 1983?

Simon

I wasn't even born in 1983.

AJ Henderson

@Simon neither was I

though I was concieved

CodesInChaos

In this day and age, we should finally kill SMTP

tylerl

@Simon SMTP was 1 year old

Simon

16:56

@tylerl I was -8, do I win?

tylerl

no.. 2 years.

@CodesInChaos Why? it's pretty expansible.

AJ Henderson

what we should kill however is SMTP that isn't over TLS or similar

tylerl

The primary problem is that the fact that it's globally federated means that encryption has to be presumbed to not be available

AJ Henderson

and SMTP that isn't authenticated as authoritative

but SMTP itself is fine

Transcript for