The DMZ

Scott Pack

00:06

Gentlemen.

Gilles

where? <arms gun>

tylerl

00:19

@Gilles how exactly do you arm a gun?

Gilles

like legging it, only the other way round?

Scott Pack

Where does a Frenchman get a gun?

Gilles

in his holster?

Scott Pack

Is that a euphemism?

Gilles

what, you don't know?

Scott Pack

00:23

I've had a long day.

Terry Chia

02:17

@Polynomial Yeah, I'm doing the CTF right now so I thought it would be fun to pick up a board and play around with it.

Looks cheap enough anyway.

@DavidFreitag Hmm, looks like I won't get free shipping on those.

@DavidFreitag @Polynomial Thanks for the tips. :)

Scott Pack

02:49

sigh Yeah....I'm pretty sure my employer has been fucking up my taxes.

kalina

you guys are such a tough crowd

25 edits on AskUbuntu without a single reject

here, you can't make your mind up what too minor is

Scott Pack

eh?

What can I say, just removing "thanks" without fixing everything else that was wrong with it....

Also, 4 periods is grammatically correct when using an ellipses to end a sentence.

Because, after all, the ellipsis is simply treated as another word so the period ends the sentence.

kalina

@ScottPack ...

@ScottPack link to instance and advise on what else you'd have changed?

Scott Pack

03:05

security.stackexchange.com/review/suggested-edits/20072

Well, that was less than useful

security.stackexchange.com/posts/46756/revisions

Woah, now that's interesting. On all but one Adnan rejected them as too minor, as expected. On one, however, Adnan accepted it and Terry rejected for too minor. It was also one of the more substantial edits.

Terry Chia

@ScottPack I think I misclicked that one.

Scott Pack

tsk tsk

kalina

@ScottPack cough

20 mins ago, by kalina

here, you can't make your mind up what too minor is

@ScottPack wasn't aware SYN needed capitalising, see the disclaimer in "about me" on my profile

Scott Pack

The language you use implies that the reviewers uniformly can't. I'd argue that, in general, everyone is internally consistent.

@kalina Oh, that's not what I was referring to, just the that that the entire post was just simply terribly written.

kalina

@ScottPack I've witnessed the same every time I've done edits here

It seems pretty consistently inconsistent

Scott Pack

03:17

What, internal consistent? Awesome, that's what people should generally strive for.

kalina

@ScottPack the that that the?

Simon

Consistency is for boring people.

kalina

your face is for boring people

Terry Chia

@kalina Can we just agree that @Adnan is a grinch when it comes to accepting edits and leave it at that?

Scott Pack

Hey, I have little enough faith in my own writing skills. So I know that if I recognize something as terrible it must be really bad.

kalina

03:18

I'm not even that bothered, I just find you guys funny

Scott Pack

@TerryChia I think so. Based on what I've seen of @kalina's complaints they're all about his reviews anyway.

Now that I'm building up a bunch of test VMs on my laptop I'm beginning to grock the whole SSD thing.

kalina

way to kill chat

tylerl

04:13

@ScottPack what's "the whole SSD thing"?

Scott Pack

Most people seem to go all loose in the knees and frothy over SSDs.

ManishEarth

09:22

Bug fixing in Firefox leads to many interesting security issues

0

Q: Should websites be allowed to disable autocomplete on forms or fields?

Currently, there is an HTML form/input attribute called autocomplete, which, when set to off, disables autocomplete/autofill for that form or element. Some banks seem to use this to prevent password managers from working. These days sites like Yahoo Mail seem to do it as well because they feel t...

(also security.stackexchange.com/questions/42209/…)

Terry Chia

13:14

@vsz - Gandalf quite openly throws lightning bolts around when he's fighting the Nazgul on Weathertop, as well as when he's fighting the Balrog. The Hobbits have Swords +1 (+1,000,000 versus Ringwraiths) from their first dungeon-bash (in the Barrows). The Fellowship have Cloaks of Concealment. Galadriel is capable of ripping apart an enemy fortress. Elrond has Cure Light Wounds, Cure Serious Wounds, and Cure Oh-My-God-Please-Let-Me-Die-So-The-Pain-Can-Stop Wounds. Subtle? I don't think so. — Jimmy Shelter 12 hours ago

Hahahaha!

Scott Pack

14:19

I generally feel like Middle Earth is a low magic setting with some high magic people. Let's pick a bigger city, say Minas Tirith, and compare the level of magic there as opposed to an equivalent city in Forgotten Realms, Waterdeep.

Everybody in Middle Earth has heard of magic but very...very few people really believe in MAGICK or ever come in contact with it.

In Faerun you see people flinging about crazy magic all over the place and any city big enough to have walls will have at least one magic item shop and every church will have people casting spells.

Terry Chia

@ScottPack I think it's because Tolkien's idea of "magic" isn't the same as what we consider magic to be.

Scott Pack

Yeah, what magic we do see in Tolkien tends to be much more subtle

The story that we follow has a fair bit of magic in it, but it seems as if that's definitely out of the norm for the rest of the setting.

I'm feeling like that guy is using the exception to prove the rule.

Terry Chia

@ScottPack Yeah, I just found the +1,000,000 versus Ringwraiths statement funny. :P

Scott Pack

A bit overdone, but definitely funny. Also the extent of Elrond's curing power.

Terry Chia

Another thing is that the main story (LOTR) is set in a time period where magic is fading from the world.

Scott Pack

14:25

It's also worth noting that herblore was also used quite a bit by the healing peoples.

Without question.

LOTR shows a world in decline

I don't have many memories of indications that magic was widespread, just more common. Also, still somewhat subtle.

There weren't Palantir in every home, or in booths on street corners. There were only a handful.

The stones to build the great cities weren't levitated into place and melded together using arcane arts. They were mined, shaped with tools, and fitted together by man. They just happened to be the best that men could be.

The only swords that we know are magical are elven blades. The barrow blades were clearly of better make but to use DnD terms could easily have been Masterwork, maybe with an exotic metals.

Per the item creation rules the default for magical weapons is that they glow. The crafter can choose to not have them glow at creation time, but that tends to get glossed over.

Terry Chia

@ScottPack Well yeah, they were crafted by one of the greatest Elves... :P

Scott Pack

@TerryChia I had forgotten who made them. That seems to help things, eh?

They were crafted by the Elves of old, most likely by the greatest of them himself. Immortal creatures who are equivalent to Christian angels and only came to earth to hang out for a while.

Terry Chia

@ScottPack Well no, the angels equivalent will be the Valar and Maiar.

Scott Pack

14:41

Full disclosure, it's been about 15 years since I read the Silmarillion, but be careful of pedantry there. There are several choirs of angels of different abilities and numbers.

Terry Chia

@ScottPack Valar = the big bad bosses. Morgoth was one of them.

Scott Pack

Please. Melkor. :)

Terry Chia

Maiar = servants of the big bad bosses. Gandalf//Sauron//Saruman.

@ScottPack I suppose you call Gandalf Olórin?

Scott Pack

Nah, his original name was Gandalf so I'll go with it.

I seem to remember the Valinor Elves were only slightly lesser in power than the Maiar.

Terry Chia

@ScottPack His original name is Olórin.

Scott Pack

14:48

No, his original name was Gandalf. Then he was given a backstory after the fact.

Remember, all The Hobbit Dwarves (and Gandalf) were named after named Dwarves from the Edda.

Probably because Tolkien happened to have that list of names in his head when he was telling the story to his kids.

Terry Chia

@ScottPack Ah, you meant original as in when the story was told.

Scott Pack

I mean whatever helps my argument at the time!

Terry Chia

I think LOTR is still one of my favourite stories.

Scott Pack

I haven't read it in a while, I should probably do that again before too long.

My daughter really liked the movies, and we've been reading The Hobbit lately.

Incidentally, that is a much harder book to read out loud than to yourself.

Terry Chia

@ScottPack They completely botched the Hobbit movies though.

Scott Pack

14:59

I haven't seen the second one yet. I enjoyed the first one, but it did go a bit to the side.

Reading the book I'm also thinking that staying properly true to it would be a pretty bad movie.

Most of the scenes are pretty slow, the story is choppy and disjointed.

Terry Chia

They pulled some stuff from the Appendix of LOTR (which was fine) as well as introduced completely new characters (which was stupid).

The second movie is very action packed though, so as a movie I can't complain.

Scott Pack

Reading it as an adult it's painfully obvious that he was making the story up as he went along as a stream of conciousness.

So, yes, the only way to make it a properly good movie would be to pull in from the EU as it were.

The whole UberOrc nonsense was exactly that, though.

Scott Pack

15:21

So. I'm playing with OpenVAS for the first time in a long time.

It's come quite a long way.

Given the price of Nessus, however, I'm still pretty convinced that for a company the price difference isn't big enough.

Using the Greenbone Security Assistant has some awkward workflows, but it does have some trending and reporting advantages over standalone Nessus.

Terry Chia

15:43

@ScottPack Ah really? I tried it about one or two years ago. I couldn't even get it to run.

Scott Pack

15:54

They do provide a demo VM which helps quite a bit.

I want to try out Seccubus to see what it's like now, but as I said, I'm not really convinced that it's worth the $1200/yr savings. For many companies that's pretty well petty funds.

Rоry McCune

@ScottPack true 'dat our Nessus license pays for itself every week we use it...

Scott Pack

It looks like the Greenbone stuff does add on the ability to do asset trending and false positive flagging/risk recasting, which are really nice features, neither of which are available with Nessus.

Rоry McCune

@ScottPack the thing I wonder with OpenVAS is who's writing all the plugins... kinda hard to keep up with Tenable on that front..

Scott Pack

@RоryMcCune I had the same notions.

@RоryMcCune Have you used any of the open source frontends? The last one I used was Inprotect, and it was ok, but clearly a dying work in progress. That was before they switched to the REST API.

Rоry McCune

@ScottPack I've not. last time I had a look at OpenVAS and associated tech was a year ago when I was setting up a workshop... it was a bit tricky to get working so ended up using Nessus :)

@ScottPack BTW have you tried to the NessusDB export option in Nessus?

I don't remember seeing it until recently..

so not entirely sure what it does...

Scott Pack

16:16

I haven't, and it is pretty new.

Now that we have SecurityCenter....

It looks like Seccubus is actually being maintained

github.com/schubergphilis/Seccubus_v2

TildalWave

18:05

40 more close votes for my first Steward badge ... Close all the questions!! :D

Scott Pack

Not bad.

Lucas Kauffman

having a cold coming on, so I read this: livestrong.com/article/120994-home-remedies-cold-using-whiskey

I really wonder if it's just another excuse or if it really works

Rоry McCune

18:21

@LucasKauffman only one way to find out.... For SCIENCE!

Scott Pack

Look at @LucasKauffman sitting here talking about whiskey when there's science to be done.

Lucas Kauffman

FOR SCIENCE

jezus

the fumes

will knock you out

Scott Pack

Eat fewer beans.

Lucas Kauffman

@ScottPack this whisky ain't got no beans in it son

10 years old Irish single malt

with honey

and lemon juice

Scott Pack

18:37

Sounds yummy.

Lucas Kauffman

it is actually

but the alcohol fumes are not making it easy to breath

maybe that's part of the cure

Scott Pack

Woah. Equal parts honey, whiskey, and lemon juice? Jimminy!

Lucas Kauffman

it's quite nice tbh

I can feel the warmth in my throath

Scott Pack

So when did Dell buy Sonicwall?

Lucas Kauffman

@ScottPack a very long time ago, because my VPN client has always been Dell Sonicwall

Rоry McCune

18:44

@ScottPack 2012

Scott Pack

So when @LucasKauffman says "very long time" he means "1-2 years".

Lucas Kauffman

yes

that would be correct

about the time I started working

1.5 years ago

oh yea this thing is coming on hard

2

Scott Pack

TWSS

Griffin

19:23

Hey guys something's been screwing me up for a while. Way back when (like a few days ago, way more in internet time) someone posted a link to a twitter post where a guy had encrypted adobe's logo with the same encryption they used and it came still looking like the adobe logo with different colors. What I'm wondering is how it happened. My thinking is if he took each pixel and replaced it with the encrypted value it kind of makes sense that it'd look like that with a different color. Correct?

TildalWave

ladies

Griffin

@TildalWave Tidal.

okay... what's with the Avatar?

TildalWave

@Griffin scienceblogs.com/goodmath/2008/09/04/…

@Griffin which one do you see?

or this...

Block cipher mode of operation

In cryptography, a mode of operation is an algorithm that uses a block cipher to provide an information service such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transformation (encryption or decryption) of one fixed-length group of bits called a block. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block. Most modes require a unique binary sequence, often called an initialization vector (IV), for each encryption operation. The I...

Griffin

@TildalWave You've got what appears to be your old avatar (back when I came in here regularly) with a beard, a red nose, and a flaming torch. It makes me think of like a prophet from a movie where he's got a staff and a big beard telling the people where to go. Except your staff is on fire (cooler) and you have a red nose (not cooler).

@TildalWave Thank you.

TildalWave

i.e. the infamous image of the linux penguin encrypted in ECB mode

Scott Pack

19:31

So. Aptitude recommended I install libatm1, which is a collection of libraries for ATM.

What the fuck guys?

Griffin

@TildalWave I was thinking of it as a hashing kind of thing and was like "well unless you add a random salt (which you should) it's going to output the same thing every time"

TildalWave

@Griffin oh that ... well, it used to have a Santa hat on and that red nose made more sense then ... let's just say I'm too lazy to make another one now, I tried with some "disguised as a cock" one but I'm not sure I like it that much, so I switched back ... yay for gravatar.com :D

Griffin

@TildalWave I would ask what "disguised as a cock" means but I'm afraid to know the answer.

Ohh you all be soo proud of me. I'm taking Net110 at my local community college. It's online though. Had to turn down a intro to programming at a much better college because of it tho :( Not happy about that. But it's still nice to have a 3 credit class.

CodesInChaos

20:02

@Griffin The IV in CBC mode allows you to choose the first 16 bytes of the decrypted file

with many file formats you can put a "skip the next 100kB" command in there

so you put the first image in the beginning of the encrypted file (ignoring the second half)

and the second image into the second half of the file (encrypted), choosing an IV that causes the parser to skip the first half

No magic, but you need to understand the image format pretty well

Griffin

20:44

@CodesInChaos You lost me? Are you talking about making sure you don't encrypt the file format stuff?

CodesInChaos

you concat two files, one encrypted one not.

then you use a few tricks in the beginning of the file so that the correct part will be displayed

the main trick is that thanks to the IV you can freely choose the first 16 bytes of the encrypted file

You essentially write something like "This is a jpeg. The next 100kB are a comment, then the actual image follows" in the first 16 bytes. Then that header is followed by 100kB of garbage resulting from encrypting the other image, and finally the data you want to display