The DMZ

TildalWave

00:00

Man flu is a pejoratively used phrase that refers to the idea that men, when they have a cold, exaggerate and claim they have the flu. Whilst a commonly used phrase in the UK and Ireland, it is referred to in other cultures and there is a continuing discussion over the scientific basis for the phrase. Popular culture A web-based survey of readers of Nuts magazine in late 2006 stirred interest in this notion, which was criticised as unscientific and unreliable. It has been suggested that such exaggeration is possibly just as prevalent in women. This condition can only truly be called "ma...

wiki is wrong, man flu is real!

well, at least male scientist claim that to be true :)

there have tho been studies suggesting flu shots work better on women

independent.co.uk/life-style/health-and-families/health-news/…

Karthik Rangarajan

I can attest that men and women equally exaggerate and claim they have a flu based on my completely non scientific empirical studies.

Karthik Rangarajan

01:44

This has possibly been asked somewhere on SE, but I'll try my luck here - can anyone off the top of their head think of a tool that I can use to monitor all packets across my network, and save as pcap dump (or similar format)?

copy

Can't Wireshark do that?

Karthik Rangarajan

I've never done actual network stuff before, and this is one of the things on my todo list. We've had a few people bruteforcing ldap and such, and want to come up with a way to figure out who did it after the fact.

we use ntop for network usage, so we have a machine that gets all packets.

@copy Wireshark was what I thought, but it needs to be something I can possibly script with.

copy

Wireshark does have a CLI

If that's good enough for you

Karthik Rangarajan

tshark, yeah.

I've not done much research, thought I'd take the lazy way out and see if anyone has set up something similar :D

TildalWave

02:09

@KarthikRangarajan snort?

Karthik Rangarajan

@TildalWave snort will only alert in case of attacks.

we want something that just monitors all the things.

TildalWave

@KarthikRangarajan wireshark then

Karthik Rangarajan

@TildalWave that's what it's looking like.

TildalWave

ah I see...

Karthik Rangarajan

I just need to figure out a way that I can automate the whole thing, delete pcap files based on date, and then somehow parse the whole thing into a GUI.,

Not at all ambitious, am I?

TildalWave

02:11

wireshark.org/docs/wsug_html_chunked/ChCustCommandLine.html

would this do?

Karthik Rangarajan

@TildalWave yup, thanks, found this (and tshark) as well.

This would probably do in terms of raw capture.

now I just need to write a wrapper around it to do other things.

TildalWave

good luck :)

Karthik Rangarajan

though I am still blanking out on a web based GUI to review pcap dumps.

TildalWave

I'm a dev what do I know about using stuff?

Karthik Rangarajan

@TildalWave hahaha, a long running joke for me was that the only person who ever used the code I wrote was me.

the last few months in my previous job made that joke invalid

5 other people used it with varying degrees of success.

I've always sucked in writing UIs.

my Georgia Tech hackathon team went to a UI hackathon once. They had to create a whole new category to give us an award, because our UI looked like poop.

TildalWave

02:18

When I think I'm gonna hate writing UIs I just ask the users what they'd like. They never agree on anything anyway.

Karthik Rangarajan

because he wasn't getting a result from his search term

The worst part of the last job was getting calls from my manager at 7.45 in the morning going "Well your code doesn't work!"

turns out the dataset didn't HAVE that search term

Almost told him "The problem exists between the keyboard and chair" but I stopped myself.

TildalWave

@KarthikRangarajan That's why I always display parsed query too in search results, some folks just can't believe there simply isn't something there

Karthik Rangarajan

this was my first real UI, and I wrote the whole thing without using stuff like Bootstrap

It was clunky and I have no idea how/why it worked, but it did.

TildalWave

well it's not so much a job of the frontend, the app has to send back the parsed query how it uses it internally to query the database, frontend just displays it (or not)

and it's crapload of work to display it in readable form too

Karthik Rangarajan

yeah, I was dealing with far too much data.

think an aggregation of twitter, dump sites, IRC data from a gazillion and one channels...

Oh, and for some reason, we weren't using an intelligent mechanism like Lucene for full text searching. Oh no, we used SQL Server for that.

Blew my mind when it was proposed, and any opinion I presented was ignored completely in favor of "its a Microsoft technology!"

TildalWave

02:31

you'd be surprised how often I use spatial indexes for such data simply because they're by far the most optimized for range search performance in database engines that I have licences for

it sometimes takes a whole night to process indexes but once it's done it's lightspeed

Karthik Rangarajan

@TildalWave that was the argument our SQL Server guru made, and it was convincing when the dataset hadn't hit 50 million rows.

Though we didn't have a real server, we had a VM with 16GB of RAM, and unknown number of cores.

TildalWave

Well, they're really useful but tricky to program for if you're not used to a bit different approach that they require. For example, you'll have really slow write performance if you have the indexes active, so you'd want to first disable them on bulk transactions, then re-enable back

and querying is completely different too, but I worked with GIS a lot back in the days so I'm used to it

Karthik Rangarajan

ah yes, that was another problem - we had to have continuous writing capabilities.

it wasn't a very well thought out system.

it was more of a "let's sell this to the customer and then think of how to build it" problem.

huh I might be wrong, but I get the feeling I might have met @AviD (if he has ever consulted in the US that is)

TildalWave

You can have both but you either won't be able to include new updates in your queries, or they'll be really slow... if you can juggle your bottlenecks with some skill, nobody will notice really... there's always 99% of the time when users play solitaire that you can run such cron jobs

Karthik Rangarajan

well I hope they somehow solve that problem. I did try to improve it as much as I could before I left, but there's only so much you can do.

Ethan

03:05

@KarthikRangarajan

Karthik Rangarajan

03:30

@Ethan?

Ethan

nvm

sorry

Stack Exchange

05:03

The weak twin primes conjecture states that there are infinitely many pairs of primes. The strong twin primes conjecture states that every prime p has a twin prime (p+2), although (p+2) may not look prime at first. The tautological prime conjecture states that the tautological prime conjecture is true.

Karthik Rangarajan

05:15

Watching the 1995 historical documentary, Hackers.

tylerl

05:30

I think everything I said here was right, but can I get a fact-check anyway?

0

A: NX bit: does it protect the stack?

By marking the stack as non-execute, you effectively prevent code inserted into the stack from running. You're not protecting the stack from modification; rather, you're causing a hard crash when the code attempts to jump to a position in the NX-marked stack. The workaround is to not attempt to ...

Low-level stuff isn't where I spend most of my time

AviD

07:32

@KarthikRangarajan except for mothers. Mothers are never sick in any way.

Karthik Rangarajan

@AviD and if they are, they pretend that they are okay

AviD

exactly.

Karthik Rangarajan

also, @AviD, I get the feeling we may have met before.

I worked with an Avi when I was an intern

for this guy you may now. Ariel Silverstone.

AviD

I thought so too! In Atlanta?

ha! I thought that was you!

Karthik Rangarajan

Yes! That travel company!

Hah, it is you!

Nice to find you on the Internet!

AviD

07:33

hehe, small world.

@KarthikRangarajan Indeed. glad to see you didnt get stuck there. :-)

Karthik Rangarajan

heh, they invited me back after I graduated. I declined,

I have to tell you though, I learned a few things about code review from you when you were there, though it was supposed to be me doing a knowledge transfer.

heh, imagine that, an intern doing a knowledge transfer

AviD

@KarthikRangarajan ha, if you would have mentioned georgia tech sooner, I might have connected the dots.

Karthik Rangarajan

heh yeah, I figured it out only after I saw your LinkedIn profile.

AviD

@KarthikRangarajan hehe, never heard of that before.

Karthik Rangarajan

And I wasn't sure even then because I didn't see the company that I thought you worked for then.

AviD

07:36

btw after "we" replaced you, that "position" got bigger. Much bigger.

Karthik Rangarajan

ah really? Did it get better?

AviD

@KarthikRangarajan yeah, I was freelancing / subcontractor.

@KarthikRangarajan well.... a little bit. It got a lot better, for a short while, but it didnt last.

Karthik Rangarajan

Ah that makes sense. I still don't understand why Ariel didn't go local and hire someone from Veracode or Fortify to do the job, but then, when was Ariel ever normal.

AviD

the code quality was too poor.

Karthik Rangarajan

I still remember the brazilian steak house where you drank beer and I drank water.

AviD

07:37

@KarthikRangarajan umm, because they were more expensive? Even with travel expenses.

@KarthikRangarajan oh dammit, that was torture.

Karthik Rangarajan

Oh Veracode/Fortify was more expensive? Hm, I did not know that.

AviD

eventually we did start doing it mostly remote, so we saved on some expenses there too.

Karthik Rangarajan

Well I had put in some effort into cleaning up the workflow

AviD

and then, after repeatedly training numerous folk for this - it was about full time and a half, for a couple years - they moved it in house, somehow.

Karthik Rangarajan

though I heard later that Ariel was pissed that i had raised expectations for the SLA.

though the source I heard it from is highly unreliable.

Well all I remember about the internship was blasting through bad code, and the horrible time wasted at the brazilian steakhouse.

AviD

07:39

@KarthikRangarajan yeah, we automated it a bit and formalized it a bunch, but then they had to keep getting exceptional approval. otherwise there still wouldnt be any new version.

Karthik Rangarajan

I graduated and went to Citrix. Lasted there for a very short time...they had absolutely no technical work for me.

And then the guy who used to do IR for Ariel asked me if I wanted to for this consulting company that got acquired by Dell.

AviD

@KarthikRangarajan who's that then?

whoa, penny just dropped. But I meant who is the guy?

Karthik Rangarajan

heh, don't think you met him. Rick.

AviD

@KarthikRangarajan actually, I think I did - at the Brazilian steakhouse.

Karthik Rangarajan

nah he wasn't there.

AviD

07:44

okay, so I might be confused.

Karthik Rangarajan

He hated Ariel

AviD

was a long time ago....

Karthik Rangarajan

yup, a very long time ago.

AviD

@KarthikRangarajan seems he had that in common with many.

Karthik Rangarajan

hahaha, yes, he did.

AviD

07:45

though some loved him - a couple of the guys went with him to Expedia.

Karthik Rangarajan

He called me once when I was working for the aforementioned company and went, in the typical Ariel way, "Karthik, I am big man now. I want to know about this virus. I know you work for this company. Find out what you can and let me know."

My response was "Ariel, here's the link to open a ticket. Thanks!"

AviD

haha, typical.

Karthik Rangarajan

Yeah, he was weird.

AviD

so it looks like Rick pulled in some other friends, SecureWorks and Security-Art supposedly had a big cooperation.

Karthik Rangarajan

They did?

There was something in the works but it never materialized.

or so I thought.

There were a couple of conversations with Youram and Ian Amit, but once Ian left I thought the conversation died.

AviD

07:50

well, I was on the outside, so I have no idea how reliable my information is.

Karthik Rangarajan

wow every single one of my classmates/batchmates are getting married. I feel bad for them.

AviD

Ah, there you go.

@KarthikRangarajan heeeey, we love it here!

Karthik Rangarajan

@AviD well, I am speaking from the cynical point of view of someone who got out of a 7 year long relationship.

And was going to get married in about an year or so.

AviD

ah, you can empathize with @Simon then.

I'm sorry.

(sorry about what I said about @Simon....)

Karthik Rangarajan

hahahaha

yeah, I was wondering...but yeah, I am supposed to be all sad and mopey, but in my head, better now than 5 years down the line.

AviD

07:53

yeah, I figure.

yknow, it is customary here, when someone gets divorced, to say to them "congratulations".

Karthik Rangarajan

The guy that came after you at the other company was pretty smart...but he was entirely too cocky for my taste.

Divorces suck though - you have to then start a new life from scratch, and its worse if you have kids.

I know a guy who's my age who's had two divorces now.

two.

and he married a third time.

Alright gotta go to work tomorrow, I'm going to try going to sleep.

@AviD nice finding you on the Internet after all this time, we should meet if you are at Defcon/BlackHat/$RandomConference in the USA.

AviD

@KarthikRangarajan dont remember which one that was, I trained a few of them.

@KarthikRangarajan absolutely!

Karthik Rangarajan

and this time, let's go to some place that's NOT a steakhouse, and where we can actually eat ;)

Lucas Kauffman

good morning gents, @simon

AviD

@KarthikRangarajan haha, yeah.

Lucas Kauffman

08:06

aah I love it when I have to work during a holiday and then after an hour I can say "finished for the day"

AviD

@LucasKauffman hmm, you've never actually been married, right....? ;-)

Lucas Kauffman

@AviD no not yet

maybe in a year or two

AviD

whoa, hold on there, I wasnt offering.

Lucas Kauffman

@AviD I wasn't going to ask you anyway

@AviD as you might have noticed I prefer boobies, (while it still could be that you have moobs, I prefer the female kind)

AviD

that's... disgusting.

and - no.

now go sit in the corner.

Lucas Kauffman

08:10

@AviD I DON'T WANT TO

I HATE YOU

runs away

@AviD do you have holidays for xmass and new years eve? Or is that too christian to have official holidays?

AviD

nah, doesnt really exist in any formal way here.

many take a "sick day" (i.e. "hungover") on January 1st, and those of us working with overseas clients / colleagues have some more quiet time.

thats about it.

Lucas Kauffman

@AviD when do you celebrate new year then?

AviD

@LucasKauffman "celebrate"... what's to celebrate, I'm just another year closer to the grave!

Lucas Kauffman

or is it the same but nobody gets off regardless

AviD

besides, "New years" is such an arbitrary day... it's not like that day a whole year pops through.

Lucas Kauffman

08:15

@AviD well I'm celebrating that!

AviD

@LucasKauffman haha, that I'm closer to the grave?

Lucas Kauffman

@AviD nope but it's an excuse to drink and party, and that's the most important part :p

AviD

Now you are also eyeing the moderator diamond....?

Lucas Kauffman

@AviD of course, that's why I want to get married, so that when you die within a few years I can have all of your moderator rights!

AviD

@LucasKauffman this, pretty much. On the other hand, we do have Rosh Hashana, the Jewish new year (usually around september or so), when everyone does have 2 1/2 days off...

@LucasKauffman since when do you need an excuse?

Lucas Kauffman

08:17

@AviD fair point

kalina

10:02

@Simon as your nurse I declare you cannot be saved *injects with a poison* *turns off life support*

Rory Alsop

@Lucas - Scotland is special: we get the 1st and 2nd of January off as statutory public holidays. We also have whisky. The two may be somehow connected;-)

@kalina - is that just to make sure?

kalina

yes

I don't want him accidentally getting better

AviD

10:27

@kalina this is @Simon we're talking about. I'm not sure the poison is necessary.

kalina

10:47

I'd rather not take the chance

He might reappear when least expected

Iszi

Anyone who's ever wanted to just drop LMGTFY or JFGI on an SO user might want to check out the newest tag over on Programming Puzzles & Code Golf...

Code-Trolling

Rory Alsop

@iszi - I like code trolling as a concept, but code golf mostly confuses me.

AviD

for the most part, both of those seem to me like focusing on the worst elements of coding.

Code golf is not good code, or smart code - it's crappy code, trying too damn hard to be clever. And you know what they say about writing code as clever as you can....

Having a site dedicated to code golf, is just playing with crap. Kind of like RateMyPoo.com.

And code golfers ostensibly shunning code trollers, is just like playing with more like. Like someone on RMP saying "Oh no, real ratemypooers only use a bucket, those trollers are using a toilet!"

</end scat talk for the week>

I really hope someone flags some of that.

Rory Alsop

11:05

Hahahaaha

TildalWave

13:33

@AviD wow you're forming some strong opinion on something you just argued it doesn't matter

AviD

hehe

no, its not that I think it doesnt matter, I think code golfing is not where professional programmers should be.

e.g. if I see anything that looks like golf in a production system, I would fire the programmer, then rehire him and make him go sit with @Simon. Just for spite.

TildalWave

@AviD it's hard to have fun otherwise, if you have no life outside of binary, so you invent entertainment of your own... you know, this can be translated to pretty much any science there is, why would coders be any different?

@AviD So you'd rather be admin golfing with a code golfer than actually invite him/her for a game of golf? You see where I'm going?

anyway, I'm now mentally preparing for the pre-new year's shopping, it's not easy to decide what I'd like to get wasted on two days in advance

still, I'm a lot better off than this guy: theguardian.com/science/antarctica-live/video/2013/dec/30/…

AviD

13:59

@TildalWave because the whole point of coding, is doing it right. And the whole point of code golf, as far as I can see it, is doing it just wrong enough.

@TildalWave actually, no clue.

TildalWave

@AviD you're a part of the problem :P

AviD

@TildalWave I assumed so...

So you know how when you're swamped, juggling several tasks and projects, all with a too-close deadline... and then all of a sudden one of the bigger projects has to wait for the client, so it's not your responsibility (at least not in that timeframe)?

Yeah, my day rocks.

TildalWave

I'm joking you know? I personally never really got the purpose of code golfing, it kinds reminds me of a cry for help

AviD

@TildalWave yeah, I can see that - programmers desperately trying to throw off the yoke of formality, and responsibility.

Like the Olympic gymnast, who just wants to swing around childlike, carefree, without having to live up to his coach's discipline....

like this:

►

blade19899

14:49

spiegel.de/international/world/…

After years of speculation that electronics can be accessed by intelligence agencies through a back door, an internal NSA catalog reveals that such methods already exist for numerous end-user devices.

Scott Pack

15:25

ohai guise!

TildalWave

OK I've seen Ali Ahmad added a community ad for 2014 for Cuckoo... but the image isn't 220x250 pix

So I made fast one that will be in the required size...

how's this?

Scott Pack

Sounds like a wiener!

TildalWave

the text is just from the Cuckoo website

Anyone uses it? I'm not helping promote some crap am I? LOL

Scott Pack

Never heard of it.

I don't do malware analysis, though.

TildalWave

me neither, but I saw the ad placement so ...

Simon

16:27

allo

I posted a quality question:

0

Q: What encryption is used on: NDN3h

I'm competing in a online decrypting challenge. The currently stuck on the 3th challenge. It gives you the code: NDN3h I've tried multiple decrpytors, but I can't get the right one. Im hoping someone here could help me. Regrards, Simon

encryption

AJ Henderson

17:09

0

Q: How could disabling 'Hide File Extensions' in Windows make a system more secure?

I'm reading up on the Cryptolocker virus, and I came across this comment, it says: And one additional measure: disable the default "Hide extensions for known file types" check box in Explorer. I still consider this one of the stupidest moves MS ever made in Windows. The comment has 17 thumb...

windows

hmm, I'm not sure what to make of the answer to that one. On the one hand, I agree with the answer in theory, but on the other hand, what user that didn't already turn off that stupid setting is going to have a clue what an extension even is

TildalWave

18:08

1

Q: Stump the Chump with Auditd 02

As part of the continuing series of Linux system event auditing I need another spec to bang my head against. What I need is a brief spec indicating what you're trying to accomplish and anything you might think is relevant to your environment. I'll then do my best to build out a config to do it ...

discussion blog

Yay @Scott's philanthropy quest 2014 is here! Bring out your worst weapons :)

Simon

18:42

@TildalWave Downvoted.

TildalWave

:P

actually, what the bleep is going on, I got 2 upvotes on some old answer today and it's not even the most upvoted one

Iszi

19:01

Crap on a cracker! When did inSSIDer stop being free?

And when did the Wikipedia fundraiser ads get so freaking huge?

Simon

@kalina pls b a poisonless nurse

Karthik Rangarajan

20:12

performing a full packet capture on a network 24/7 on a 50mbps network - good idea/bad idea?

Iszi

@KarthikRangarajan Like adult diapers... Depends.

I presume you're talking about your home network?

Karthik Rangarajan

20:29

@Iszi Nope. I am talking about an office.

Iszi

@KarthikRangarajan Is consent to network and/or computer system monitoring part of the office's AUP?

Karthik Rangarajan

@Iszi Yes.

Legally we're allowed to do it. I am just wondering about the technical feasibility of doing it.

Iszi

@KarthikRangarajan And by "full packet capture" do you mean to say full logging of all packets, or just monitoring and alerting?

Karthik Rangarajan

@Iszi full logging of packets.

Is the task I have written down.

However, my backup is setting up Snort for monitoring and alerting.

Completely unrelated question - is there a good website I can point users to where they can check for password strength? rumkin.com is fairly arbitrary and not very good.

Iszi

@KarthikRangarajan You should not be pointing users to any website to check for password strength.

3

Passwords should only be entered into the system or application for which they're intended to be used.

@ScottPack Don't you run the IDS/IPS in your shop? Maybe help @KarthikRangarajan with regards to guidance on full packet capture and logging?

I don't personally have much experience, but I understand it probably takes some beefy hardware and even then it's hard to make sure that literally everything gets processed unless you want to introduce lag.

Thomas Pornin

20:52

@KarthikRangarajan It can be mathematically proven that no good "password strength checker" can actually exist.

Let alone as a Web site.

Moreover, training your users to enter their office password on Web sites may have... suboptimal side effects.

@KarthikRangarajan At full bandwidth, that's 540 GBytes per day. Heuristically it should be less -- but maybe not really less. Say, like 50 GB per day.

This can be stored, but searching it afterwards looks like a daunting task.

Karthik Rangarajan

@ThomasPornin that was my calculation, and that's why I asked if it is a good/bad idea.

It is a daunting task, and even if I remove packet captures or offload them to a different backup disk every night, searching through them is going to be a nightmare.

@Iszi yeah, I was going against my better judgement asking that question about password strength...I would personally never enter my password into any of those checkers, but there were some questions about it, so I was wondering if there was anything trusted/recommended.

@ThomasPornin re. the mathematical proof for password strength, thanks - based on my minimal research, I suspected that, but I couldn't be sure.

Thanks for helping me to not go against my better judgement @Iszi, @ThomasPornin! :)

AviD

@is do you remember the name of that site, along the lines of a password checker - "Is my password secure?" and no matter what you put in, it comes back right away with "NO! you just entered it in an untrusted site, you putz". Or something like that.

Karthik Rangarajan

hahaha I remember someone showing me that once.

Iszi

21:14

@AviD I think it got starred in here once.

AviD

@Iszi thats not saying much.

Iszi

@Avi BTW I think you need at least three characters to ping.

AviD

hehe, oops. yes, 3 is the minimum. that was a typo.

Iszi

Hah. I was Googling for that site and came across a question on our own.

9

Q: Is howsecureismypassword.net safe to use?

Is it safe to enter my real passwords to test them? I mean, are the entered passwords being recorded/transmitted to someone else?

passwords

AviD

@Iszi yeah, I went googling, found a lot of noteworthy crap, but not what I was looking for.

So. My teenage daughter just opened a Facebook account. Aside from the complete education re security and privacy, and the impending horrific waste of time - does anyone know of a facebook app that she can add, to grant me permission to see all her activity? (with her permission, of course).

other than MitM her browser, and echoing out her FB stream...

that actually wouldnt work with her anyway, she knows to check for the EV certificate, issuer, etc.

Karthik Rangarajan

21:24

@AviD if it's a blanket app, it wouldn't be very hard to write one yourself...

Just ask for ALL THE PERMISSIONS.

TildalWave

@AviD ismytwitterpasswordsecure.com

4

AviD

@KarthikRangarajan yeah, I considered it, but I really dont want to get into learning the fb api, and besides I'm pretty lazy.

if there is nothing, I might consider it....

Karthik Rangarajan

@AviD gogostat.com/pg

That's what google tells me.

AviD

sometime

@TildalWave excellent.

Karthik Rangarajan

@TildalWave hah! That's going on my wiki page...

TildalWave

21:26

no problem ;)

BTW I made NASA write a blog post today :)

so the day is good, me happy

Iszi

@TildalWave Link?

TildalWave

@Iszi sdoisgo.blogspot.com/2013/12/…

AviD

@KarthikRangarajan that looks interesting. thanks.

Karthik Rangarajan

@TildalWave that's awesome. The only thing I've done today is make a dog poop.

Jeff Ferland

@TildalWave "no"

TildalWave

21:27

@KarthikRangarajan hehehe I don't wanna know, right?

Karthik Rangarajan

@TildalWave it involved putting him on a grassy surface and just standing and staring at him until he decided to poop.

It's hard taking care of injured living beings.

Iszi

@TildalWave Right. And those bright lights dancing on the horizon are just swamp gas...

AviD

@KarthikRangarajan HOW DID YOU MAKE DOGPOOP???

TildalWave

@JeffFerland Hey Jeff, thanks for restoring control over your Twitter, those Russky posts didn't make much sense even with my rusty Cyrillic / Russian

Iszi

@AviD WHY ARE YOU SO INTERESTED???

AviD

21:29

@KarthikRangarajan oh, I see, that's a little different than the way I read it.

@Iszi cuz I've only ever made humanpoops.

Karthik Rangarajan

@AviD No, I did not manufacture dog poop, if that's what you're asking...

Jeff Ferland

@TildalWave Yeah, I so rarely sign on there anymore... never even thought about the password being that old. Glad it didn't go to basically anything else I can think of.

TildalWave

@Iszi C'mon that's not even close. Gotta admit it's quite something to make NASA guys write about it. That's no swamp gas :P

AviD

hehe, okay, doh

Karthik Rangarajan

Though the dog did take a giant shit today. Must be all the cat food he ate.

Jeff Ferland

21:30

@AviD Smart kid

@AviD I'm not aware of anything like that, and I'm fairly sure that Facebook would cease & desist something like that if it did exist.

AviD

@JeffFerland yeah, I'm turning her into a proper ~~paranoid~~ security geek.

@JeffFerland really? it seems like a fantastic feature that should be built in.

like gmail has account delegating.

obviously with the user's permission...

Jeff Ferland

@AviD facebook.com/help/156236274442491

Karthik Rangarajan

Didn't Facebook say something about parental monitoring of 13 yo Facebook users?

AviD

so who said anything about unauthorized access?

Karthik Rangarajan

@AviD One simple way to do it might be to set up Facebook on a spare mobile device as her.

I said spare because you never want to post something on her Facebook by mistake :P

AviD

21:43

@KarthikRangarajan "mistake" ;-)

@KarthikRangarajan hmm, doesnt even need to be a mobile.... that is an interesting idea. I could easily setup a dedicated vm for this...

Karthik Rangarajan

"Daddy, why did you post on my Facebook wall saying you'll kill my boyfriend?" "Sorry honey, it was a mistake."

AviD

though it is a little more invasive than I was hoping for.

@KarthikRangarajan heh, first thing she did was share a post of mine saying basically that.

Karthik Rangarajan

@AviD yeah its not a nice option. Read only access would be much nicer.

AviD

2

Karthik Rangarajan

but on the flipside, it helps you protect her against random stupid guys.

though I'm sure she can protect herself.

@AviD I saw that at a con once. I was wondering why, until I saw the guy walking around with his daughter.

AviD

21:48

we actually had a facebook security expert come through here. Ex-cop, decided to go private to help with all the incidents of online abuse and etc. kind of a PI with a specific niche... He does a speaking tour, through the schools, for parents, etc. Brilliant.

Karthik Rangarajan

ah that's definitely nice of him. As long as he balances security versus usability.

i.e. he doesn't convince kids that Facebook is evil.

(even if it is)

Iszi

0

A: What drove Neo to seek out knowledge of "The Matrix" and Morpheus?

Neo knows morpheus he is in the Dictionary morpheus is God of Dreams and trinity is Biblical figure and Neo is the one = GOD i think Neo is remaking the matrix as he see's fit so he can find Morpheus and trinity in the next version of the matrix as morpheus told him in Neo's room that the Oracle ...

Wait... WHAT?!

TildalWave

OK thanks to Physics.SE newsletter, I now know why I got two upvotes on some old answer re destroying hard disks

7

Q: Is aluminium magnetic?

From high school, I remember that Aluminium has 13 electrons and thus has an unpaired electron in the 3p shell. This should make Aluminium magnetic. However, the wiki page of Aluminium says its non-magnetic at one place(with a citation needed tag though) and at another place says it's paramagneti...

electromagnetism

Karthik Rangarajan

@Iszi hahahaha that was awesome. Aside from the fact that I got a headache reading a non punctuated blob of text.

Seth

Would this be on-topic here?

1

Q: Monitor BIOS activity

As I read today, Secret services are able to infect the BIOS of almost every computer using different methods. Is there a way to find out if this has happened on my Ubuntu notebook, for example monitoring the BIOS activity? Greetings

bios malware

copy

22:00

@Seth Regarding that reply: You can't trust the checksum anymore if the Bios is infected

Seth

Hmm. I guess that would be true.

copy

It's surely on topic on our site, but may have been answered before

Seth

Do you know of a dupe here?

copy

Not specifically

Seth

:-/

Jeff Ferland

22:08

@Seth @copy security.stackexchange.com/questions/3786/…

Seth

Ah, that works. Thanks :)

Scott Pack

@Iszi The last time I looked it was free for Windows and Android, but $15 for OSX. Is that not true anymore?

@KarthikRangarajan As @Iszi said I have a bit of experience with security monitoring, primarily around the data collection and IDS side. How may I service you today?

@TildalWave You'd be better off retweeting that instead of favoring it. More people will see that way.

AviD

22:25

@KarthikRangarajan no, he totally comes at it from the kids side. Tries to expose them gently to the darker side of it.

hell, he managed to surprise me with some of his stories.

Simon

@AviD 1. I already have one 2. Well, duh 3. Meh, whatevs 4. And if you hurt me, I hurt you 5. No problem, I like to be early anyway 6. Sure 7. I don't like to lie so that's fine 8. I beg to differ 9. lulz, alright 10. Let's fuck.

AviD

@Simon 11. I can ban you permanently.

Simon

If it's not written on the t-shirt, I don't believe it.

AviD

Trust the T-Shirt!

Simon

#TtT

TildalWave

22:41

@ScottPack see what?

I'm not sure what are we talking about?

TildalWave

22:54

Karthik Rangarajan

@ScottPack One of the tasks on my list (that keeps getting longer) is to set up some sort of a full packet capture on our network here. We have a 50 mbps network, so it might not be the best idea.

TildalWave

heh guess what this is ^

no trick photography, just tricky shadows

Karthik Rangarajan

however, we would like to at least know when there are scans/attacks/brute force password guessing stuff happening internally.

Scott Pack

@TildalWave The tweet of me asking for people to submit specs. You favorited the tweet but didn't retweet it.

@KarthikRangarajan Is that 50 Mbps or MBps? One is easy, one is slightly trickier.

TildalWave

@ScottPack oh, I forgot ... I'll correct that in a sec

Scott Pack

22:56

@TildalWave DAMNIT SON!

Karthik Rangarajan

@ScottPack 50 Mbps.

Scott Pack

@TildalWave Oh, we went to an Indian place instead of Slovenian. L'sigh.

Karthik Rangarajan

@ScottPack or wait...let me cehck.

Scott Pack

@KarthikRangarajan A full packet capture on 50 Mbps is pretty easy.

Karthik Rangarajan

@ScottPack 50 Mbps

@ScottPack ah that's good to hear. any suggested methodology to do it?

(I can ask an actual question if it's easier to answer there versus here)

AviD

22:58

sure, the capture is easy, its what you do with it that gets tricky.

Scott Pack

@KarthikRangarajan Do you know how you're getting the feed yet?

@AviD Troof.

TildalWave

@ScottPack Where the bleep is it? I can't find it in the list...

(I had cider)

(plural)

AviD

@ScottPack I think that was kind of his intent...

Transcript for