The DMZ

Scott Pack

00:00

@KarthikRangarajan Definitely hit me up more as you go down his project. I'll try to clean up and post my puppet manifests too. I'll need to clean them up so they're not so site specific, and write readmes. The former should be easy

Simon

00:12

@TildalWave om nom nom

Karthik Rangarajan

00:36

@ScottPack will do, thanks!

Simon

01:20

I wanna listen to "What does the fox say?" but I don't wanna wake up in the middle of the night with the song stuck in my head again.

@kalina Are you alive? I wanna show you how much of a nerd I used to be too.

Scott Pack

01:39

@Simon It'll be fine. Don't worry about.

Simon

@ScottPack So, should I listen to it again?

Scott Pack

02:53

@Simon Uncontested.

Simon

I don't wanna anymore.

Scott Pack

Pussy.

user10381

hey

Scott Pack

Hey you.

Simon

03:40

@ScottPack You made the guy leave.

TildalWave

Charlie Brooker's 2013 Wipe is out, which I'm gonna watch so... good night! ;)

Simon

n8

FEichinger

Just ... thought I'd leave this here.

3

Simon

my keys

TildalWave

@FEichinger hahaha brilliant!

thanks!

.... ZZzzzzzz 1 sheep over the fence, 2 sheep over the fence, 3 ..... sh.... fe..............

Scott Pack

04:02

@FEichinger Ok. That's fantastic.

Vignesh4303

06:12

belated christmas wishes and happy new year to all @polynomial,@adnan@rory alsop @lucas

copy

@Vignesh4303 Thanks, you too

Lucas Kauffman

07:51

@Vignesh4303 thanks for you too

Lucas Kauffman

08:05

what's with the shitty questions today

Iszi

08:21

@ScottPack Apparently it's going payware in 4.0.

Karthik Rangarajan

08:34

@LucasKauffman maybe everyone made it their objective to learn security as a new year resolution...

AviD

08:52

@FEichinger oy. How did I get on a list with @Adnan and @Simon??

Now I need to watch out for the TSA.

AviD

09:19

oooo Atari 2600 emulator!!

looks just like I remember it.

Lucas Kauffman

10:49

@AviD you're old

Rory Alsop

11:02

@FEichinger - hang on, didn't @kalina set fire to me as well? :-)

AviD

11:23

@RoryAlsop heh, I figured I'd try to search for all the times @kalina said "fire" or "burn"... but it was far too many

and seeing as she's burned down the whole DMZ more than once, I think this list is moot.

@LucasKauffman you're ugly

Rory Alsop

11:51

@LucasKauffman stoppit you...

Lucas Kauffman

:p

Rоry McCune

12:09

@LucasKauffman yeah or you'll get reported for ageist behaviour!

see @RoryAlsop @AviD us over 40's need to stick together

Rory Alsop

@RоryMcCune hahaha - yup

Lucas Kauffman

hahaha

AviD

I'm not 40 yet, you senile old fogey!

Lucas Kauffman

@AviD Shut up you old bat

Rоry McCune

@AviD ahh but I was using the standard methodology where perceived age = actual age + (3 x number of children)

AviD

12:11

@LucasKauffman I just saw the bat in Adventure. I missed that old coot.

@RоryMcCune ahh, of course. Me and Methuselah.

is that actual number of children, or the number it feels like?

Rоry McCune

@AviD ooh good question there should probably be a weighting for number of children in your house on a regular basis making noise+mess

AviD

@RоryMcCune also the perceived number of kids increases exponentially, not linearly.

so 2 kids much more than twice as much as one kid.

Rоry McCune

@AviD ouch, well I suppose all you need to do is get your .Gov to buy into that and you'll be able to pick-up your pension real soon now!

AviD

@RоryMcCune would it shock you to know that I do get a monthly child stipend?

thats not a stipend of new children every month, but money for the kids.

Rоry McCune

@AviD ah yeah they get that here too IIRC although the gov are always messing about with amounts and boundrys and the like

AviD

12:15

not a lot, mind you, but I just noticed it increased a bit more when my baby was born.

@RоryMcCune yeah, its all about the political games here.

Rory Alsop

@AviD not for all - our 3rd provides only a fractional increase in noise and mess (and sometimes a decrease as she appears to defuse the elder two)

@RоryMcCune yeah - it has been a long time since we managed to get any child benefits

that's what happens when you work in such a highly paid industry (not!)

ManishEarth

First! ? :>

hmm, limerick time

Rory Alsop

@ManishEarth ?

ManishEarth

@RoryAlsop Some people are exceedingly brave / Adventure with crypto is what they crave / Because the established tools / are only for fools / Don't be a Dave

screwed up meter once again, but meh

@RoryAlsop limericks=stars=hats

Rory Alsop

@ManishEarth oh? Where? I thought using the S-word got stars :-)

(he hinted)

ManishEarth

12:26

I really want a hat / so I post limericks in chat / people will star/ 'cos that's what they are / and that's that

@RoryAlsop hah

I suck at limericks

3

Rory Alsop

@ManishEarth You doing anything for Hogmanay celebrations?

ManishEarth

hogawha?

Rory Alsop

Hogmanay

Hogmanay (Scots: , , Scottish English: ) is the Scots word for the last day of the year and is synonymous with the celebration of the New Year (Gregorian calendar) in the Scottish manner. However, it is normally only the start of a celebration that lasts through the night until the morning of New Year's Day (1 January) or, in some cases, 2 January—a Scottish Bank Holiday. Etymology The etymology of the word is obscure. The three main theories derive it either from a French, Norse or a Goidelic (Insular Celtic) root. The word is first recorded in 1604 in the Elgin Records as hagmonay (d...

proper New Year celebrations

ManishEarth

Yeah, I know, Googled it

@RoryAlsop spending time with SO, nothing special

I would have gone home but nothing special at home either :p

AviD

@RoryAlsop yeah, and the russians have Novi God. So bleedin' wat.

Rory Alsop

12:32

@AviD doesn't matter what it is called - it is an excuse for a party, and some whisky, ergo it is a 'good thing'

AviD

eggsactly.

Do Scots do eggnog?

Do Scots ever make their drinks Irish?

Or do you just call that "drinks".

Rory Alsop

@AviD An Irish coffee is generally different to a Scotch coffee, yes - but in Scotland we also add any spirit to coffees and name them after whatever country that spirit comes from :-)

FEichinger

13:42

@RoryAlsop Did not show up in my search, no.

Rory Alsop

14:04

@FEichinger :-)

TildalWave

14:17

g'day

Utkarsh

@AviD remember me?

TildalWave

@AviD actually, they have two

also...

Old New Year

The Old New Year or the Orthodox New Year (, , , , , Serbian: Српска Нова Година or Srpska Nova Godina , Macedonian and Bulgarian: Стара Нова година, , ) is an informal traditional Orthodox holiday, celebrated as the start of the New Year by the Julian calendar. In the 20th and 21st centuries, the Old New Year falls on January 13 in the Gregorian calendar, 13 days after its New Year. In Russia Although the Russian Soviet Federative Socialist Republic officially adopted the Gregorian calendar in 1918, the Russian Orthodox Church continued to use the Julian calendar. The New Year became a ho...

AJ Henderson

15:03

0

A: Can ISP detect DNS requests for a web site embedded in another website ?

If you use a domain name for an iframe in your site, the browser will have to resolve it. This means it will have to make a call to DNS from the client. There is no way for you to provide the resolution to them. If you can use an IP address for the site rather than a domain name, then the clie...

is my answer meandering too much in trying to direct him to the fact his concern is fundamentally flawed?

I decided that it was worth an answer since the implied security question is that his threat model is horribly out of whack

Scott Pack

@Iszi Fuckers

There once was a man from Nantucket. His nose was so long that he stuck it. Right in the ear of the lady next year. Whom he later buried in a bucket.

@ManishEarth How's that for a limerick?

AJ Henderson

@ScottPack wait, so they want $15 for something that can look for SSIDs? That seems a wee bit overpriced

ManishEarth

@ScottPack have a hat

AJ Henderson

since it's basically a regex on a packet sniffer

or am I missing something

Scott Pack

@AJHenderson It is a really nice tool, but that's a bit much I'll agree.

It's not that nice.

So what are we doing limericks for?

AJ Henderson

15:08

@ScottPack yeah, I could see asking $5 for it

but $20 is insane

I mean, polish is worth a bit, but it doesn't look that polished

Rory Alsop

@AJHenderson It seems a lot like his previous question, to be honest. And your answer works on both :-)

Scott Pack

They also have other tools which apparently are well worth the money.

I've talked to a couple of proper network guys who use them.

AJ Henderson

@ScottPack do they have a bundle?

Scott Pack

I dunno

AJ Henderson

maybe they are intentionally pricing it out of reach to push people towards a bundle

hey look we have this $5 tool you can buy for $20 but if you buy this with our other $20 tool, it's only $25 what a deal

@RoryAlsop well I think it is a direct derivitive, someone pointed out that DNS would be a problem still, so rather than abandon his fruitless endeavor he's going further down the rabbit hole

we actually had someone like that on photography yesterday too

Rory Alsop

15:11

@AJHenderson hmmm - I think your answer is good, but I may leave him a wee comment

AJ Henderson

where every answer we gave that tried to steer him away from his incorrect path just made him push harder down it

there's something amusing when they focus entirely on the 1 line you put in to actually make it an answer while ignoring 95% of your post that is screaming "BAD FUCKING IDEA" at the top of your lungs

but simply more politely

Rory Alsop

@AJHenderson I haven't been there in ages. Thought about it again this morning when I was dredging through old kit - found a nice 55mm Digital Filter...which doesn't fit my Canon lenses and I was going to ask about adapters...

Looks like it has already been answered though

kalina

wtb a star

AJ Henderson

hmm, another interesting observation I missed at first on that question. The ISP wouldn't know for sure that the iframe DNS request was related to his site

his clients just could often use google in another tab while on his site

but the fundamental problem is still his threat model

Rory Alsop

@kalina 'be' or 'buy' a star?

kalina

15:20

buy

GIVE ME A STAR

FOR HATS

GREAT JUSTICE

AviD

@kalina If you can carry moonbeams home in jar, you'll be better off than you are

2

Rory Alsop

@kalina Manish produced a limerick or two...

kalina

can I have some of what you're smoking?

AviD

OR WOULD YOU LIKE TO SWING ON A STAR

Rory Alsop

earned his hat

kalina

15:23

sets fire to @Simon

2

there, I earned my hat

GIEF

AviD

done!

kalina

yay star

AJ Henderson

have I mentioned lately what a very odd collection of people we are?

2

ManishEarth

@AJHenderson have your star and shut up :p

AviD

@AJHenderson I AM NOT A BUTTERFLY PINNED TO A BOARD

I MUST BE FREE

AJ Henderson

15:31

@ManishEarth I already got an actual star

but I'm always happy to take another

kalina

fire.vad-systems.de/151

AviD

@kalina is that like the new hats? We try to collect as many as possible?

kalina

I don't know, it depends if you like being crispy or not

AviD

Finally something @Simon can excel at!

ManishEarth

@AviD As a mod you can game that :p

Rory Alsop

15:43

@kalina I thought you had set me on fire, but apparently not. I feel left out...

AJ Henderson

@kalina wow, really, you've set avid on fire more than adnan

kalina

hey, what's wrong with adnan?

AviD

@AJHenderson That's because I'm nice. @kalina hates nice.

kalina

other than the obvious things that I cant say due to the likelihood of being banned

AJ Henderson

@AviD then why don't I have any fires? :(

AviD

15:45

ahem. That is a good question that you should be asking yourself.

kalina

some people aren't worth my fire

AJ Henderson

:( :( :(

AviD

oh snap

AJ Henderson

how do you make the crying smiley which isn't really much of a smiley again?

ManishEarth

@AJHenderson :'(

kalina

15:46

:*(

AJ Henderson

@ManishEarth that's more of a spastic reverse wink smiley

kalina

@manish jumping in with the sneaky edit just there

AviD

@kalina sad kiss?

@kalina no, its these guys!

►

Adnan

@AJHenderson :D

@AJHenderson I like your answer on the hash history question. It looks very familiar.

On a different topic: Happy new year, everybody. Leave your car keys home.

Lucas Kauffman

16:04

Happy new year, may your life be prosperous and full of beer and boobies!

2

AviD

@Adnan Unless you need to put them in the bowl.

Lucas Kauffman

Also who deleted my FBI comment :(

AviD

@LucasKauffman which one?

I think I deleted your TSA comment...

Lucas Kauffman

Yea that one :P

COULD YOU BEEEEEE LOOOOOVED AAAAND BE LOVED

No? Too early for Singalongs?

FEichinger

@kalina I already posted this here. Because I'm evil and ... something. I dunno.

TildalWave

16:18

@Adnan HNY! But what if you need your car keys for the bowl?

dang, @AviD already thought of that

perv! :)

AJ Henderson

@Adnan yeah, I know it's the same as what you said, but I thought you were saying it very technically correct, but to the point that it made the simple point more convoluted

so yeah, I restated it in simpleese :)

I also gave you an upvote btw

hmm, looks like our friend with the messed up threat model isn't buying the fact he is misjudging his threat model

Gilles

16:58

If your problem is ISPs tracking who visits your site, why don't you try and make sure everyone visits your site? Add news feeds, blogs, whitepapers etc. Just a thought... — Rory Alsop 2 hours ago

well, it works for Google

TildalWave

17:29

I can't stop watching Muppets on YouTube now, @AviD what have you done?? Damn you!!!

►

Pöpcørn :))

(turn the captions on hehe)

Gilles

Bork bork bork!

Gilles

18:32

pfff. Google's animation doesn't change at midnight. They just serve a different animated gif after midnight.

Rory Alsop

I'm guessing the 3 and 4 change places

Gilles

@RoryAlsop no, they don't

and if you load the page after midnight server time:

I checked with .in a few minutes ago, nothing happened at midnight

AJ Henderson

19:17

:(

TildalWave

3 hours 40 minutes, then my wall calendars will be obsolete ... really loved one of them :(

AJ Henderson

I've still got almost 10 hours to go

Gilles

@TildalWave just wait 5 years and use a marker over the 3

ManishEarth

@Gilles 6 years you mean

Gilles

@ManishEarth no, 5. 6 years will be the time to shelve it again

AJ Henderson

19:23

@Gilles pretty sure the days of the week won't line up right

Gilles

@AJHenderson why not?

AJ Henderson

January 1st 2018 is a Monday, not a Tuesday

though it does make an interesting puzzle to find what calendar years could be altered by adding lines to make it so that they look like another calendar and the days of the week match up

there just about have to be some cases where it could work

TildalWave

I might just frame the pictures like I did with some other one from around 2000

they usually look good in the hallway or in the bathroom (depends on their size)

FEichinger

@AJHenderson That would actually be pretty easy. Every number has an associated set of numbers it can be turned into, and then you just gotta check every year that matches for March 1's weekday.

Gilles

@AJHenderson but that's in 4 years. In 5 years it will be time to whip out a 2019 calendar.

By the way @ManishEarth did you figure out the elusive 10th secret hat?

AJ Henderson

19:31

@Gilles hmm, good point, but what do you mean about a marker over the 3 then

how do you turn a 3 in to a 9

ManishEarth

@Gilles Nah. It probably is for getting a prize in the 3 competitions that were held, but just that it will be awarded in the end.

Gilles

@AJHenderson complete the loop on the top left?

Simon

@FEichinger That's pretty cool, I should have clicked on it yesterday.

Gilles

@ManishEarth no, I saw it in the wild, and not from someone who competed

AJ Henderson

@Gilles I suppose, that's a bit of a screwed up 9, but it would match the days of the week then

ManishEarth

19:32

@Gilles who?

Gilles

@ManishEarth unix.stackexchange.com/users/10762/chris-down I don't know what it's for. The hat itself evokes mistery.

ManishEarth

Hmm.. Balpha and someone else were wearing it in a screenshot

FEichinger

@Simon I might add some navigation to it at some point, but for now: /room/year/ (ex. /151/2013, /35/2013, /0 )

Simon

@FEichinger Cool, cool. How "forgiving" is the detection of the setting on fire? Does it have to be literally "sets X on fire"?

AJ Henderson

@FEichinger is it bad that immediately upon seeing that post I started fuzzing inputs?

FEichinger

19:36

@Simon It's manual. As long as there's no API for chat, all I can do is run a script over the search results ... which causes all sorts of mayhem.

Simon

@FEichinger Ah I see.

FEichinger

I usually add everything that's either "die in a fire" or "sets fire to".

And I can only add for a single target, so no setting-the-entire-room-ablaze.

Simon

Yeah that's fair.

Gilles

@ManishEarth What about the doge picture? Have you seen it?

ManishEarth

@Gilles it's not a secret hat

The hats in the sprites image are either non secret or nonexistant

It was the same last year

Simon

19:40

@kalina Next time, I'd appreciate if you wouldn't set me on fire when I'm sleeping.

FEichinger

@Simon To be fair, most of what I did there is just migrating the thing from the original nodejs to PHP, and added some caching, filters and a bit more information to it.

AJ Henderson

@Simon but that's the best time, if you're very lucky you never feel it

FEichinger

Markdown, why do you hate me today? Geez.

Simon

@FEichinger It's cool anyway.

AJ Henderson

at least that's what my observations have lead me to believe

ManishEarth

19:48

@Gilles Since when has he had it?

Gilles

@ManishEarth at least a couple of days is all I know

ManishEarth

hmm

ManishEarth

19:58

@Gilles repcapping 5 days in a row

Simon

@AJHenderson I'm sure you feel it.

ManishEarth

@Gilles I think. I'm pretty close, today just 30 more and I probably can repcap tomorrow

@Gilles Or not. Skeet doesn't have it

Iszi

Oh, there's hats today?

Gilles

@ManishEarth I don't think so, I checked the usual high-rep suspects and none had it

ManishEarth

hm

Simon

20:06

@ManishEarth Any idea what you're gonna do with your life after January 4th?

2

Gilles

plus it wouldn't have fit the theme, would it? This hat is about mystery

ManishEarth

@Simon Hey, I'm not that obsessed with hats

Simon

Yeah right.

ManishEarth

I know the network well enough to know which site to get hats from that's all

Gilles

@ManishEarth are you getting tumbleweed after all?

Simon

20:07

The first step is to admit that you have a problem.

ManishEarth

Nah

Gilles

I'm a bit surprised I didn't get marauder on U&L

OTOH the question just isn't me

ManishEarth

@Gilles I have a question, lemme know beforehand if it is inappropriate for U&L: "How can one prevent 'bash injection' from bash?" Basically, I have a program that does somecommand "$1", and I want $1 to be a string only, and not have extra quotation marks and pipes to run other commands

Gilles

@ManishEarth the answer is somecommand "$1" (assuming that somecommand itself doesn't do bad stuff)

ManishEarth

@Gilles No chance of "injection" whatsoever?

Gilles

20:14

no, "$1" is a string (not containing null bytes). No chance of injection. Just make sure that the double quotes are there

ManishEarth

alright, thanks :)

Gilles

that's assuming I understood your question correctly: your program is a shell script, right?

ManishEarth

@Gilles yes

but it has setuid and is being called in a rather insecure manner

Gilles

@ManishEarth setuid shell script? You have other problems

ManishEarth

@Gilles as in?

Gilles

20:16

first, some shells keep you safe and drop privileges before executing other code

ManishEarth

wait, it's not setuid, but go on

Gilles

if your shell doesn't keep you safe, it needs to reset IFS, PATH, ENV, and so on to safe defaults. I don't trust any shell to reset them all properly.

Plus most unices won't execute a setuid script anyway. What unix variant are you using?

ManishEarth

@Gilles Ubuntu

Linux

Gilles

@ManishEarth no setuid scripts on linux

use sudo

which is safe if set up properly

ManishEarth

Yeah, this isn't setuid, I did some other magic to make it work :p

I actually don't want root, I want it to run as me

Simon

20:19

sudo make me a sandwich

Gilles

11

A: How to safely pass variables to root-enabled scripts?

Running shell scripts under sudo is safe provided that sudo is configured to reset the environment. Conversely, if sudo doesn't reset the environment, then running a shell script is not safe, even if your script doesn't use its parameters (see Allow setuid on shell scripts). Make sure that you ha...

@Simon Simon is not in the sudoers file. This incident will be reported.

Simon

@Gilles FBI agents just knocked at my door.

ManishEarth

@Gilles I basically needed a way for me to pop up a custom alert on my laptop from an insecure remote machine. So I added a PHP file that ran a script containing notify-send. I wanted to know how to make sure that the custom text wasn't injectable :)

@Gilles Somehow, without setuid, the thing is working, though

One has to be the logged in user to use a display, right?

OH

ok, that's why it works

interesting

Gilles

@ManishEarth no, it's enough to have local or TCP access plus the cookie

ManishEarth

cookie?

Gilles

20:28

the cookie (found via $XAUTHORITY) is a session password

ManishEarth

it can be done with tcp? how? sorcery

hmm, the apache user can see my data. Not good.

Gilles

@ManishEarth start X without -nolisten tcp

I think Ubuntu has -nolisten tcp by default

ManishEarth

ah

Simon

Silly Ubuntu

Gilles

in the days of SSH, which does its own X11 forwarding, having the X server accept TCP connections has gone out of fashion

maybe it'll come back if IPsec goes into use

ManishEarth

20:32

@Gilles oh that makes sense

AviD

@FEichinger You must really like @kalina, to go through all this effort.

I'm surprised @Adnan didnt make a similar grand gesture.

FEichinger

@AviD Nah, not much effort involved.

AviD

@FEichinger sure, when you care.

@Gilles or advertising.

FEichinger

It's more like a little project to distract me from the day-to-day.

AviD

@Simon That is unconnected.

Simon

20:42

@AviD But they said that it was legal to browse such things...

Man, that's bullshit. I download the client from the English website, my OS is in English and it defaults to French anyway. Sigh.

Gilles

3

Q: How can it be detected that a number generator is not really random?

I heard that random number generation in computers isn't really random, but there is no efficient algorithm to detect it. How can it be detected at all ?

This question could use another answer that gets the crypto aspects right (without neglecting that not all randomness needs to be cryptographically correct)

I'll put a small incentive

Karthik Rangarajan

22:26

Happy New Year, everyone. I hope this year you defend all the things (if you are in defense) or hack all the things (if you are in offense).

4

TildalWave

22:51

8 minutes to go here ...

@RoryA looks like you might get some auroras late tomorrow and the day after

a long one M 6.4

from a few minutes ago

Happy New Year! :)

Rory Alsop

23:11

Happy new year to you early folks as well. Still 50 minutes to go here.

@tildal - will Hopper for a clear night then

S/hopper/hope

Gilles

@RoryAlsop happy end of year

Lucas Kauffman

Hap poppers. Met year!!!!!

Rory Alsop

You too @Gilles - have an awesome 2014.

TildalWave

It's crazy here they don't wanna stop with rockets. It used to be a clear night, not any more LOL

what crisis?

Transcript for