The DMZ

Holocryptic

19:03

O hai guyz! I has a ? Iz this tha place to ask? @ScottPack sed it wuz cool.

Scott Pack

@Holocryptic Don't make me ban you

Holocryptic

mwahahaha!

It's all... blue.. in here...

Well, cool digs you have here. I'm just an interloper. I'll show myself the door.

Iszi

19:16

critical flaw fixed by MS today could be exploited remotely to break into PCs that aren't even connected to a network http://bit.ly/r4WZ81

Tweeted by briankrebs on July 12, 2011 at 7:13 PM

I guess that depends on how you define "network".

Rory Alsop

@Iszi :-) - I have a query - how do you get the twitter post to show up in here?

Iszi

@RoryAlsop Just post a link to it.

...and only the link.

Rory Alsop

just twitter.com/ blahh, yes?

gotcha

Iszi

@RoryAlsop For above, I posted https://twitter.com/#%21/briankrebs/status/90861377589231617

Rory Alsop

thanks - I know it was probably on something I should have read, but missed :-)

Iszi

19:19

@RoryAlsop OneBox is really easy to use, and excitingly easy to stumble upon.

Hasn't happened in awhile for me, but it used to be now and again that I'd throw up a link in here and all of a sudden be pleasantly surprised to see it OneBoxed!

Rory Alsop

had to close

2

Q: What kind of nefarious deeds can IP address Spoofing be used for?

Possible Duplicate: What security risks does IP spoofing bring? I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is. Can IP address spoofing still be used for: Denial of Service attacks Man in the middle attacks Are there othe...

as an almost exact duplicate of

7

Q: What security risks does IP spoofing bring?

By manipulating the TCP packet and changing the source address one is able to spoof the IP. As I understand it, you will not be able to set up a full handshake by doing this, as you will never receieve the returning packets. Does anyone know how this poses as a security risk today? Some risks:...

network attacks

Iszi

Makes sense. What about that ip-spoofing?

Ooh, there's a lot in there! Maybe update the tags in the older thread?

Rory Alsop

@Iszi done

Thomas Pornin

Dang, I hit the daily reputation cap on crypto.SE in 41 minutes.

2

Iszi

@ThomasPornin Haha! Like that's at all surprising, coming from you!

What's with Crypto.SE anyway? Is that to cover some fuzzy area between Math.SE and Security.SE?

Thomas Pornin

19:28

@Iszi Rather cstheory.SE and security.SE

details have not been completely worked out yet

Rory Alsop

19:40

@ThomasPornin hahahaha

WTG

(apparently that's the phrase all the cool kids use)

Scott Pack

Yeah, pretty much

Ninefingers

20:00

Two things. Firstly, I hit refresh and look what they did with the place! Looks even more awesome than the meta pics.

Secondly, @ThomasPornin, no surprises there! First to 10k anyone?

Iszi

@Ninefingers I'll put money there!

Heck, I think he'd break 10k before public beta if it weren't for the caps!

Why is it that the "user profile on..." link doesn't point to the website that's relevant to the chat room?

Seems it instead goes to the place where the user has highest rep?

Rebecca Chernoff

goes to whatever the user has as their parent account

Hendrik Brummermann

I really wished there was a ignore list which hide questions, answers and comments from certain people.

Scott Pack

20:15

@HendrikBrummermann I think we've had that discussion in this room a few times :)

Iszi

@RebeccaChernoff Can we change that?

Scott Pack

@Iszi go your chat profile page, and there's a big "Change" button

Hendrik Brummermann

Is parent account the site I signed up first to?

Rebecca Chernoff

if you want the behavior changed, you should post on meta

Iszi

@HendrikBrummermann Probably, unless you've changed it.

Scott Pack

20:19

@HendrikBrummermann That's a very good question. I signed up on SO first, but SF was my parent.

I got asked if we wanted this migrated: serverfault.com/q/289571/3356

I'm thinking it's far too vague to be useful, but if anyone wants to take a whack at it, feel free :)

Iszi

@ScottPack Not seeing it. Care to be a bit more direct?

Scott Pack

chat.stackexchange.com/users/15/iszi

Iszi

Oooohhh.... I see it now.

Scott Pack

In the left hand box, look at the 5th thing

yeah

Iszi

Sweet. Done.

Now I just wish the ITSec icon would get updated on the profiles.

M'vy

20:24

@Iszi where?

Iszi

@Mvy - On the "accounts" tab.

Don't you love it when you run Windows Update, install a dozen or so updates, reboot, and then find out that you (or, more likely Windows) didn't install the freaking half-gig-sized service pack?!

Scott Pack

I dunno. If I want to update my system and reboot I just do this: yum clean all && yum update -y yum && yum update -y glibc && yum update -y && reboot

I don't have those problems.

Iszi

@ScottPack You hush.

Thomas Pornin

21:13

UPS are great !

(I am getting power shortages here, because of an ongoing Storm Apocalypse)

nealmcb

@ScottPack Woo hoo - auditd answer! I'm reading and working on the typos :)

9

Q: Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig.rules) but it isn't clear what the performance impact of each would be, nor what sort of environ...

linux ids audit

@ScottPack Do you know anything about the examples in capp.rules, nispom.rules, stig.rules?

Are any of them of any use? Too noisy? Performance impact?

nealmcb

22:12

Heh - the sec.se shield icon that appears on the right of oneboxed posts looks like some sort of inhuman eye. Perhaps a transhuman eye?

AviD

awww maaan, I missed it! I missed launch day! :(

wouldja believe - I forgot?

spent launch day... launching a boat...

M'vy

:P

AviD

but, looks like you all managed fine without me... site looks fanatastic!

even the hungover lion looks happy

well, not happy, sad. but appropriately so. :D

gotta say, one of the least talked about elements that I think is the best - the fonts work fantastic, especially with the colo(u)r scheme. loving it! @Jin

btw, @Jin tiny issue (not even worth submitting a bugmeta...) - The mod/analytics page (security.stackexchange.com/admin/analytics. non-mods: dont even bother trying ;)...) has a horizontal scrollbar on it, that wasnt there before. Kind of extraneous, like 98% is displayed anyway...

oh, and while we're on the subject of tiny issues (that's what SHE said! ;) ), the color for "favorite tags" questions (light pink/orange) seems a bit... incongruous. Can we have something more in line with the rest of the color scheme? like, a light bluish-something?

M'vy

22:27

non mods can't access it :P

AviD

@Mvy heh, like I said... :P

M'vy

I thought you said than non mod does not even try this :P

But it was a warning : my bad

AviD

@Mvy better?

M'vy

XD

AviD

@RoryAlsop is there a way for editors and such to get notifications on blog events?

such as proposed blog, queue, etc.

I find I havent got around to squeezing another site into my daily rounds.

M'vy

22:33

Also to put on ToDo-if-possible list : openid login and get rid of captcha for logged editors/contributors on comments :D

AviD

@Mvy and as long as we're at it, tie it in to the se proper sites...

@ScottPack (and anyone else on g+) - is g+ really worth bothering with?

M'vy

Well for the moment its cool

hoping it does not go like facebook

AviD

in my case - I dont even have a twatter account, and my facebook account is dormant, to use a charitable word... Not sure I have use for it, but maybe it being "not facebook" is what I need to get into "social"...

@Mvy ya, well, I dont really care about "cool"...

M'vy

What would you expect from it :P

AviD

I think the main thing stopping me from just jumping in and trying it out (and, worst case, abandoning it down the line), is that I'm worried that enabling it is a oneway street.

getting rid of buzz (and wave even more so) was a real pain.

M'vy

22:38

oh

AviD

hmm @Jin, Dont know if this is on purpose or not, but the tronlines are disappearing on my laptop... when my eyeline is slightly off-center, the tronlines just fade away. Very cool if its on purpose, umm a bug i guess, if not?

reminds me of those stickers,cups, etc that my kids have - the picture changes depending on your angle of vision.

M'vy

you have an holographic laptop?

AviD

@Mvy hehe, nooo.... but that would be AWESOME!!

no, the tronlines are a bit faded... so offcenter makes everything a bit darker, ergo the lines fade away even more...

@RoryAlsop just read your blogpost - kudos!

M'vy

Well sleep time

AviD

23:06

@Mvy gnite

@RebeccaChernoff who/how can I go about discussing SEI sponsorship of OWASP?
I'm on the IL chapter board, and I'm putting together the regional OWASP/AppSec conference (September).

I would love if I could get ITsec more exposure there.

There are several options for sponsoring, either conference sponsor at several levels, project sponsor for any project that SEI likes (like SO has done in the past for opensource projects...), organizational sponsor (either global or chapter), or any mix of the above.

Scott Pack

@nealmcb Thanks for the fixes. I wrote it all up in vim, and was in a bit of a hurry to rush out the door so it looks like I forgot the spell check. Whoops!

To answer your other question, no, I haven't fiddled around with any of those other rule sets.

AviD

and now I notice another tiny issue, @Jin the "replied" arrow on my own post (i.e. when I replied to someone else) is almost the same color as "my post". Hard to see. Can ya make it darker?

Scott Pack

If you look at the auditd section of that CIS benchmark you'll find the "scoring bash script". It has a HUGE number of other checks that I totally left out.

AviD

@ScottPack!

Scott Pack

Hey @Avi!

Fun on the boat?

AviD

23:12

not bad, thanks... I got to be puked on, so that's always fun.

Scott Pack

I know how you feel :|

AviD

my dad-in-law's 60'th, took us all out on a yacht... only the sea was real choppy, so half the family wound up with their heads in the toilets/sinks (sometimes simultaneously)....

Scott Pack

Thrilling....

Just a day trip?

AviD

my youngest was sitting in my lap, when she leaned forward, and.... blech.

other than that (and the queaziness, and the still bobbing feeling in my head), was real nice...

@ScottPack ayup.

couldnt get me there for longer than that.

not cuz of the boat, cuz of the family ;)

Scott Pack

Yeah. I'm not sure I could last that long with a large percentage of my family either.

Last spring, while visiting my folks, the little one got a bit of a GI thing and ended up puking all over the wife, handed to me, then puked again on my head.

That was pretty much the highlight of that trip :)

AviD

23:19

oyy, thats just inconsiderate.

Scott Pack

She had just turned 1. I suppose it was expected.

AviD

@ScottPack yeah, well.... we all been in that one.

Scott Pack

See, this is what you're missing, @WesleyDavid. Jealous yet?

So, back to galvanized tacks. Site activity has really popped today. Yay.

12 new questions in less than 24 hours. I wonder if it's a graduation burst or an indication of things to come

AviD

@ScottPack umm... who be wesley?

is that the kid from STNG?

Scott Pack

That would be Crusher....

He's a guy I met from SF. I was rather hoping he's been on chat recently enough that the '@' mention will let him see our chatter about the absolute treasures of child rearing

AviD

23:28

@ScottPack hehe

Scott Pack

Speaking of...bathtime! Bbiab

AviD

enjoy! bathtime is one of the best parts of the day... except for naptime.

Rebecca Chernoff

@AviD hmm, is there a meta post?

AviD

yes, there was... hang on.

5

Q: Is SEI an OWASP member / sponsor?

From OWASP.org: The Open Web Application Security Project (OWASP) is a 501c3 not-for-profit worldwide charitable organization focused on improving the security of application software. Our mission is to make application security visible, so that people and organizations can make informed deci...

discussion feature-request

about the generic global org sponsorship, not the conf.

should I just meta up one for the conf sponsorship?

Rebecca Chernoff

Oh, I was searching on meta.security not meta.so.

sure

nealmcb

23:47

@AviD I'm confused. I don't see any semi-transparency in the inbox, or in the image you posted in your meta question. The whole inbox popup is the same background color except for its slightly darker header and chrome

AviD

@nealmcb whaaa?

@nealmcb I can read through the inbox background!

and the header colors show through...

compare, the top two messages, to the third one, to the bottom ones.

top 2 look gray-ish cuz of the dark blue, 3rd looks highlighted cuz of the light blue.

is it really just me? am I going blind?

well, color blind, at any rate...

nealmcb

AviD

@nealmcb do you not see it?

or are you just japing me? you ol' hoon.

nealmcb

It all looks identical to me - seriously. I am colorblind, but that doesn't affect this sort of thing

AviD

hmm, maybe its a color-contrast thing.

top few dont look shaded-er?

nealmcb

23:56

Is it so subtle that it could just be an illusion?

AviD

okay we need another opinion here...

@nealmcb lol, maybe, maybe... I could just be sunstroked from being out on the boatboat all day...

nealmcb

Zoom in on the image and get rid of the surround

AviD

@nealmcb you zoom! I see it in your pic...

oh, nevermind... if @Jin dont see it, it wont matter... and if he do, then it's moo' anyway.

Transcript for