« first day (1137 days earlier)      last day (4041 days later) » 
00:00 - 23:0023:00 - 00:00

00:07
Well. That set me upon a trip through the ThinkGeek youtube channel.
I think this was my favorite.
 
2 hours later…
02:18
@RoryAlsop Damn you people with kids and excuses to be childish whenever you like!!! How on Earth would I ever excuse me if I ordered one, or avoid being a laughingstock if I wore it? :#
 
1 hour later…
03:20
@ScottPack Oh shit I just found my raving outfit.
@RoryAlsop Oh crap, I laughed so hard.
03:40
@ScottPack what did you install the prompted the recommendation?
@RoryAlsop If memory serves, that was an April 1 joke product that, because of popular demand, they actually started making.
@CodesInChaos like, for example? This is no doubt a very useful feature and certainly something I'd like to see... but I typically don't see it.
 
1 hour later…
04:52
Did this guy seriously just recommend Delphi in 2014? npr.org/2014/01/25/266162832/…
 
2 hours later…
06:37
@TerryChia "This guy" was named Eric Cartman.
My neighbor just went off to college, and she decided to do Computer Science as her major. Good for her... but the "introduction to programming" course taught programming basics using C++ as the language.
So over holiday break I went over to their house to help her with some of the basics. And the whole time all I kept thinking was they couldn't have picked a worse language to teach kids programming on.
@tylerl My school does the same. Of course the "intro to programming" class is all about loops and variable types etc so the language didn't really matter.
Learning Programming in C++ is like learning to drive with a tractor-trailer semi. 90% of what you have to learn has nothing to do with driving. But you HAVE to learn how to properly connect up the brake lines to your trailer or your driving lessons will go terribly.
And in C++, you have to understand how character arrays are stored in memory or all of your programs will segfault.
FWIW, my first year we learned Pascal. Bloody waste of time. Year after, they switched to Java. Not necessarily better, but at least not totally irrelevant.
Still, that same first year I was writing MIPS assembly to run on a CPU that I had to design myself using logic gates. So I guess I didn't exactly have it easy either.
06:54
@tylerl That sounds fun. :)
It was. Which is how students knew whether or not they belonged in that major.
 
2 hours later…
08:35
@tylerl well thats kind of the point. To be a great developer, you really need to understand what is happening between the high-level code you write, and the CPU. You need to understand the connection between the brake lines and the trailer, even if you shouldnt be dealing with it 98% of the time.
And the inverse is part of the problem with the scripters-cum-coders - just because you can kinda throw together a few lines of PHP to serve up a functional website, does not make you a professional programmer.
so yeah - C++ sucks as a first language, but some might say it is good as a teaching language.
My opinion is they should be using straight C for teaching the basics, memory, etc - then for teach OO dont use C++, but something usable. Or Java.
@AviD My first programming class used C to teach things like the difference between a for and while loop. I think that's pretty stupid.
And they used C++ for the OO module.
@TerryChia now THAT is stupid. And I had that too.
@TerryChia if its just the semantic differences, I would agree with you. But if they also examine the actual effects, e.g. down to assembly and hardware level, e.g. memory. e.g. big-O() notation etc - then it could make sense.
@AviD Oh definitely not. It's "this is how you do a while loop", "this is how you do a for loop", "you know those things called if-else statements?, "here's how you print some text to stdout".
@TerryChia well then, once the basics of the language are down, it probably shouldnt make much difference what language you use.
As long as its not PHP.
Oh, I think they used jGrasp for the C module as well. That's the shittiest IDE I have ever used.
08:53
when I was in uni, we werent allowed to use an IDE. We had to use Emacs.
@TerryChia I am running DD-WRT, not Tomato.
@Adnan That is ridiculous. Israel is not the most expensive???
@Adnan besides, coming from you, security would probably explode the package. Just to be sure.
@AviD Ah. I'm running dd-wrt at the moment but it doesn't support the 5ghz band on my router.
Tell you what, I'll find a boutique beer place, go out for a night of drinking, and send you the bill. Will be much cheaper... :-)
@TerryChia really? why not?
does on mine.
@AviD Some issues with the drivers or something like that IIRC.
ah. Sucks to be you.
@TerryChia so, basically a porn parody of Game of Thrones? I thought that was Game of Thrones.
@AviD Hence
yesterday, by Terry Chia
I'm guessing it's the exact same show with less good looking actors.
09:08
@TerryChia heh. okay.... I'm not gonna read the whole transcript, I'm just lookin at da pikchures.
 
2 hours later…
11:07
feeling absolutely shit today
@LucasKauffman why, what did you do to her last night?
-_-
just feeling sick
I want chicken soup
I would too, just from hearing about it. Shame on you.
@LucasKauffman of course, that is the best medicine for everything. From scraped knee to brain tumors, broken hearts included.
not to rub it in your face, but I'm actually quite pleased. Someone brought me a bottle of The Macallan last night, Fine Oak variety.
11:15
@AviD the green one?
Looking forward to it... Would have popped the cork on it last night, but he preferred to try my Charred Talisker, so I acquiesced.
ah no that's the select oak
@LucasKauffman I think so.
@LucasKauffman oh damn, now you got me confused - maybe thats what it was.
@AviD I really like the MacAllan, best whisky I've drunk so far
it is on my list (of favorite non-smokey single malts)
'course, the bottle is too tall to fit on my whisky shelves. So I need to move the shelf above up a bit... without breaking any glasses. Still, I am quite chuffed about it.
0
Q: What kind of things you should do in Symantec Cyber Readiness Challenge?

Gari BNDid someone participated in Symantec Cyber Readiness Challenge? What kind of things you do there? Can you give me examples to specific tasks (and what was needed in order to complete them) from past challenges?

should that be migrated to meta, or just closed outright?
and btw, ? Really?
11:26
@AviD Closed imo.
@TerryChia give it a vote then, willya luv?
@AviD Hmm, kinda lazy to write a custom off topic reason.
DOOOO EEEEETTT
@AviD Meh, done.
meh, good enough.
11:30
Woah, MS is really serious about taking on Amazon. arstechnica.com/information-technology/2014/01/…
Azure was always appreciably cheaper than AWS... .
@AviD Ah really? Didn't really do much price shopping on cloud vendors.
Although I'm thinking of moving my blog away from Linode.
for the most part. It is hard to do a straight apples-to-apples comparison though.
@TerryChia really? whys that?
@AviD Price mostly. Linode isn't the cheapest VPS around.
@TerryChia so wait till mid-March, and compare to Azure. They do support Linux now, yknow....
11:37
@AviD I'll do some shopping once my Linode instance expires.
Best quote:
> "up to 20 times faster than a standard dial-up connection! Complex graphics pop-up instantly."
--> Because of course dial up is still standard. Welcome to 1998.
@AviD Holy shit!
11:56
Huh! I guess Linode isn't as expensive as I thought.
@TerryChia Digital Ocean, cheap and fast. Probably run by the NSA but hey can't have everything...
EC2 pricing is hella complex. O_O
@TerryChia yeah, exactly. Thats why I said it's hard to really do a straight comparison to Azure.
Also complex, though not quite as much, but its also different complex.
I'm paying $20 per month for Linode. I don't think I can get a cheaper VPS from Azure.
I found a vulnerability with my current hosting provider where I could reboot every single host
and they still haven't respnded to me
12:03
@TerryChia well that depends on how big an instance, and how much you use it.
I even found a server with a logged in VNC using root
it could be much cheaper, if it sits idle most of the time.
@AviD 1 GB RAM, 48GB Storage.
no no, it doesnt work like that.
its not that simple!
btw if you want cheap dedicated hardware check kimsufi.com
12:06
@LucasKauffman That website is in French...
@TerryChia it's really per-hour.... so if you have an estimate of how many hours you use it on average per month, you can figure it out. It might be much cheaper.
@AviD Well, I'm hosting my blog on it so that's not really an option is it? :P
that said, I dont think azure is really aimed at VDI as much as Linode is.
@LucasKauffman Woah, that's real cheap.
12:08
@TerryChia au contraire. since you wont be working the CPU very much, it will be substantially less.
and lets be honest, who reads your blog anyway? ;-)
@AviD Spambots.
@TerryChia lol. and there is the real cost of spam.
I read terry's blog
@AviD Hey don't be racist now. Spambots are also people.
@LucasKauffman @TerryChia you're right, only spambots.
12:10
I always add comments like "Buy cheap rolex here bit.ly/34ar4 "
Oh, I'm actually paying $18 a month since Linode has a 10% discount for signing up for a year.
@LucasKauffman Now I know you don't read my blog. It doesn't have a comment section.
@TerryChia :P
Ah! So this is DMZ
12:29
@user239752 No it's not!
@TerryChia then what is it! lol
@user239752 It's a secret.
It is the lair of the monster of Loch Ness also know as the common "Rory"
 
1 hour later…
13:51
There is no 'common' Rory...
4
14:08
@RoryAlsop how can that statement be 17 minutes old and have no stars!
3
Happy Oz Day!
14:33
Oz Happy Day?
14:58
Indeed - we had our Australia day celebration barbecue yesterday. In the rain...
15:27
@RoryAlsop Rorus Vulgaris?
@RoryAlsop I shoveled nearly 4 inches of snow off my driveway and sidewalk yesterday. It looks like I'll be doing it again this afternoon. :(
@ScottPack I have seen both movies, and liked them both. Of course, the second one features a bear, so I am thrilled.
@ThomasPornin Hah!
Anyone watching Agents of Shield?
@TerryChia I am, but I'm a week or two behind right now.
I just started on the first episode. Pretty good.
@ThomasPornin Don't get me wrong, I did enjoy the first one. We just tend not to go out to movies very often.
I do also get annoyed with Story Purists who have an aneurysm a character said "we" in scene 5 paragraph 6 sentence 2 instead of "all of us" as was in the book.
@TerryChia It's a good solid b-grade television. Fun to watch.
15:35
@ScottPack Choosing who you get to the movies with, is as important as what movie you are going to watch.
@ThomasPornin Quite right indeed. These days it's just at least one of ['Wife','Daughter'].
@tylerl I was doing an update. If I remember when next that machine is powered on I'll see what packages were updated.
@ScottPack But it's a completely different tone! That character would never say "we", that changes everything!
16:04
-6
Q: Why is the StackExchange network so strict on people?

Joshua ZweisteinI must begin saying that I lost my job, because I made a question for a problem I couldn't solve and nobody came to answer. 30 minutes passed from then, still nothing..what I did? Along the answer I made to the other questions I posted the link to mine..still nothing..must say thanks for that, as...

@kalina So he lost his job because no one answered a question he has on a Q&A site?
Sounds like he didn't deserve it in the first place.
I'm confused. Was be fired because he wasn't able to get the answer within 30 minutes or because he asked it in the first place?
blinks This story is beginning to sound like a Lifetime drama.
How would you talk if you lost your job? I think worse. And I was also a drug dealer and have been in prison. Before I was really bad, not now. I was in prison for having killed a person in a dispute. Now I wanted my life to change. — Joshua Zweistein 1 hour ago
"I posted a question on AskReddit" thank $DEITY that we are not Reddit.
@AviD NAZI!
I call Godwin.
Is there a proposal for Godwin.SE?
16:13
I'm on Zweistein's side. I'm glad people like @AviD and I can walk down the street and say to people, "You sir, are clearly a Nazi." without it being any big thing.
2
Isn't that right, @AviD?
I'm sorry, even joking about it I find myself offensive.
I propose that on Godwin.SE, instead of little diamonds next to the moderators' names, we use itty bitty swastikas.
And we all have to call them itty bittys.
@AviD Oh wow. Yeah, I was already pretty well rubbing myself on the line.
@ScottPack thats disgusting.
@AviD But the swastikas should be in the opposite direction from the nazi swastika. Will lead to endless arguments.
Ganesh needs a bra.
16:17
Is it just me, or is that elephant god kinda hot?
@AviD Trying to lighten the mood. :)
And on that note. I'm going to put on my apron and start vacuuming.
16:55
@AviD sounds like a Skunk Anansie song (NSFW)
@ScottPack snow hasn't hit us yet - but it looks like it could :-)
17:36
Reminds me of the latest Charlie Brooker's comments on Nick Griffin's cookery show: "Disappointingly, he doesn't cook Chicken Supremacist, or Egg Fried Reich, or Swastika Masala..." :)))
18:30
wut?
Although, Egg Fried Reich is pretty clever.
@ScottPack Oh I guess it'll be mostly Brits that'll recognize what I was referring to. I'll try to find you some video, if it's already available on YouTube (the last Charlie Brooker's Weekly Wipe was aired only a few days ago)
19:05
Too many trolls lately on SE, it's kinda unnerving. What is supposed to be the suggested way of handling questions from users that draw their own ridiculous conclusions based on self-admitted ignorance on the subject they inquire about? For example, here's one on Astro.SE: astronomy.stackexchange.com/questions/1531/stars-moon-positions The guy concludes that it must be the stars that orbit the Earth, since he can't see them moving. I mean, it's not even off-topic, it's just retarded.
@RoryAlsop we've got a decent covering on the hills, but it's not got down to the village so far...
@RоryMcCune Has there ever been an avalanche in Scotland? :D
@TildalWave heh one or two, we get quite a few land slides out where I am
@RоryMcCune Seriously? From snow cover?
@TildalWave but your answer there is brilliant.
19:19
@TildalWave nah the land slides are mainly from rain on the hills and roads cut into the side of hills
its a similar problem to the 101 questions, just even more so.
Let's call these the -101.
We see them a lot here too, usually around crypto.
@AviD Perhaps, but I really detested even writing it, because of that final conclusion on the OP's part. I mean, how do you address that without at least appearing as condescending?
they spend about 6 months near here shoring up the hill with big nets to stop it blocking the road...
@RоryMcCune Yup, makes sense. So what was the most snow you ever got there, as far as you remember?
I think your dual pronged response was perfect. Ignore it, then vocally call out your purposeful ignoring so it doesnt get missed by being too subtle.
19:21
@TildalWave 2-3 years back it was bad. Couldn't get the car out of the drive for 3 weeks and I had to make tunnels in the snow for the cats so they could go outside....
@RоryMcCune Oww so much like here too that year. I didn't realize you can get so much now in Scotland too. OK, I guess if there's a strong front you'll be pounded by it just as well, but I thought that you get higher average temperatures during winter because of the Atlantic jetstream.
@TildalWave west coast does, but that was back in the east. TBH that was very unusual, this year on the other hand has been weirdly mild
lots and lots of rain (highest recorded for Scotland in Dec which is saying something) and lots of wind
@RоryMcCune well, sure, all your snow popped over to the U.S. for the season this year.
but smeg all snow
yup, same here... we got some snow on Friday, but it already melted away by now
19:25
@AviD seems that way, eh!
@AviD came from your stretch of the woods too, didn't it? :D
@AviD you prolly had more snow than we did this year
@TildalWave "to". we actually had an incredibly unusual amount of snow.
Considering the usual is approximately "none".
last snowstorm this big that I remember was in '91, tho I'm not even sure that one was as bad as this one.
that should teach you a lesson, next year you'll keep your fridge closed :P
hehe
I know some areas nearby received nearly 8 inches yesterday, and could have received another 50% again, or more, today. I wouldn't be surprised if we have 8 inches out there now.
19:31
@ScottPack I know some people who did, too.
What a 14,000 Volt shock will do to your eyes (not for squeamish!): livescience.com/42778-electrical-burn-star-cataract.html
yaaaaaay. SSL was insecure until now, but now we have GRC to really protect us! grc.com/fingerprints.htm
@AviD I see they finally put the site on HTTPS too, yay for compliance! Double rainbow!!
heh
20:18
How can Mr Gibson come up with this stuff. The internet does not need random capitals
The better question would be, how did the Internet survive before Mr. Gibson came up with his random stuff.
Why can't EV be spoofed?
Ahh, I see, it's shoved into compiled c++ code
20:41
0
Q: Is Gibson's fingerprinting service really relevant in today's security context?

ManishearthI just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? To me it does not seem to add any security: it lets you know that you are being snooped on, but...

rant away
@ManishEarth closed as offtopic. This is a security site, Gibson is not on topic here.
4
heh. I like your footnote #1.
12
Q: Could SQRL really be as secure as they say?

Wayne WernerI just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems like it would be pretty awesome - one of the problems that I can think of is if the QR reader i...

@AviD I like it too :p
@ManishEarth yeah, yours is kind of a dupe of that.
I actually keep quoting it when discussing security with others, many ask "why don't browsers do this or that"
@AviD the "Gibson is stoopid" bit? :p
besides, the whole concept is flawed - "SSL is broken, so use SSL, to check THIS site for the fingerprints. And if the NSA hacks this site too - we'll change the page to let you know!"
@ManishEarth isnt that the point of the question?
20:44
haha true but the why is important
@ManishEarth that's awesome :-)
sometimes I have to TL;DR that as "Unusable security - isn't."
Security laymen (as in, most layman than me) are in two camps, one is in the "secure all the things, screw usability", the other is "I hate those red pages FF shows when you visit a broken cert site, plz can has fix, i don't care about security, nobody will haxx me". Security vs usability.
@ManishEarth right. And our job is to come in and solve for both.
I have found myself making UX suggestions to dev/design teams, simply because otherwise they wouldnt be able to implement my security recommendations.
So some people are like "Why don't you make the user check the fingerprint by snail mail (no, pigeon post, because the NSA can read snail mail (no, use encrypted pigeons, the NSA intercepts the usual ones))" and the quote comes handy. Others are like "make all this go away", and the quote comes handy to support them but I also get the opportunity to haxx their passw0rdz the next day to scare 'em :p
(ok, only done the "don't like SSL dialogs? Here, lemme disable them. [1 day later], heres your password, with fries!" thing once, but I can do it again!)
@AviD yeah, seems like a tough one. /me sucks at UX, though I like to make broad statements about the UX of a design
yeah, I wouldnt claim to have anything intelligent to add to a design team about the visuals, it was more about flow and focus.
@RoryAlsop I really wish I never have to suffer same thought patterns that mr. Gibson does, he must be screaming from within all the time.
21:27
@ManishEarth I'm on it.
The Bear is about to rant. Stand back.
@ManishEarth You might wanna use your chat trolling / rep whoring charms after he posts an answer tho, it's surprising you've only got a single upvote for the question so far (mine, so I'll expect that beer one day...) even though you mention Gibson, and in the title no less.
i have chat trolling / rep whoring charms? :o
of course you do
unless you hijacked Manish' account and don't know what you're doing :P
@ManishEarth BTW those are terms denoting positive trades here in DMZ
heh
I've actually been spending more time on GitHub and Mozilla Bugzilla than on SE these days.
I have a tendency to drift from online community to online community, hope that doesn't happen here
(Before SE I was a long time Wikipedia user)
21:36
drifting is normal
I doubt it will happen here though, on WP I didn't have any responsibility though I did have some powers and was part of a dev team for a tool (still am, still commit). Here I have responsibility. I think it will clear up once I balance out my acads
Also, anyone here use Windows Phone?
@ManishEarth and I thought you're busy with your college
for me responsibility makes it worse, not better.
Got a Lumia 520 for free (hackathon ftw!), and wondering if I should write an SE app for it
@TildalWave I am. I keep some free time for online-y things like SE, GitHub, BMO, etc
@ManishEarth I do, as does @Iszi.
@ManishEarth what kind of app?
21:38
@AviD initially a read app with inbox (and possibly commenting) abilities.
I dont have tons of experience on this, but apparently it is the easiest / simplest of the mobile platforms to develop for.
SE API 2.2 has write perms, but it's not public yet. I know how to use 2.2 though.
So I might develop write API magic into it a bit early
hmm, is there not one already?
@AviD JS/HTML! :D
23
Q: Overflow7 - Stack Exchange sites on Windows Phone 7

Stuart Video of 1.0 On YouTube - http://bit.ly/stackoverflowforwp7 About This is a Stack Overflow app for Windows Phone 7 - it allows you to browse, read and bookmark Stack Exchange sites Screenshot License and Download There are two versions of the app available: Free link - full functional...

@ManishEarth exactly :) (well, if you want....)
21:40
@ManishEarth BMO? What do you do there?
I guess that's Bugzilla Mozilla Org?
@TildalWave bugzilla.mozilla.org. I fix simple bugs, triage new ones, hang around in general
I do JS magicz
@ManishEarth ah cool, didn't know it's social too
then again, it still surprises me that SE is
@TildalWave not really social. There is IRC as well where I sometimes hang around. The main site is about business, but the discussions are nice
@ManishEarth so only for trained bughunters?
@TildalWave not really
Well, it can be confusing at first but everyone is helpful
I was confused by hg first. I had someone to help me with the bmo review system
21:43
I guess I'd have to check it then
I haz JS skillz too
@TildalWave I plan to write a post on how to get started fixing Moz bugs soon
@ManishEarth make sure to post a link here when you're done, I'd like to read it
Because first you have to be able to find the bug (there is a "god first bug" system with mentors who help you with all sorts of things. There are also some pages on the Web that help find stuff). Then you have to be able to get the code. Then you may want to be able to build the code. Then you have to make patches. Then you have to upload and ask for review. You can get help for this on IRC, but a single blog post would be better
@ManishEarth would that be an interesting subject for one of the SE community blogs?
21:48
Code Review perhaps? Do they have a blog?
bug-squashing doesn't really fit anywhere. Maybe Programmers; I already have access to their blogging interface
actually, what's CR still doing in beta?
But note that I am a newbie to bug squashing firefox so it might be best if I don't post it under SE. I don't know a bunch of caveats and all
Just discovered one yesterday, ./mach build ......./something.js[m] doesn't work, you have to build the entire folder (which is what my usual lazy self usually did so I never noticed). Spent hours wondering why my new code didn't work till I realized that it wasn't compiling -_-
@ManishEarth OK, but you can post a proposal and then have it peer reviewed etc.
@TildalWave by who? It would need to be someone experienced with FF bug squashing
Plus I want to thank the dude who taught me all this, and I can't really do that under SE.
21:50
@ManishEarth dunno, depends on which SE community you'd target with it
What I could do is post about making FF log its own passwords, silently, on secse :p
I already have this post which lets you do all sorts of tweaking of FF.
But the secse blog is more theoretical and less "let's hack this thing". But I don't mind doing it for the secse blog if they want it
I actually have a (probably) working .sh file that does this to Linux ... for FF 23. The password manager got moved around so I will have to start from scratch for 26
And I haven't yet updated my Ubuntu FF
@ManishEarth Cool, that is handy. I never bothered to find out how the new structure works since the .ja files
I don't know how it works either, it just does :P
All I know is how to tweak it. Information gathered from MDN and various outdated pages
yeah, well unpacking is in the binaries, but I didn't bother to understand their structure but did play with it before when they were just .js files, it was too easy not to LOL
Need to figure out how to spoof binaries too. Probably hidden deep in the makefiles
22:01
are these .ja files signed?
nopes. Open source. Why would they?
If they did, anyone could spoof it
because the key would be open source
yes... that was a bit stupid question, sorry
@TildalWave If I make small changes in c++ code, would that reflect as a large change in the compiled binary? patchfile-size wise
I just earned the Yearling badge :) 366 days, 366 consecutive too
22:03
sup losers
my dander.
3
lol oh lawd
@ManishEarth no, it shouldn't if you don't load and compile much else into it
interesting.
I wonder if I could theoretically patch malware into FF
in a small form
course you could @ManishEarth
with a bit of asm understanding
22:06
as in, create an opening for malware (eg add my own hardcoded EV cert), keep it in a concise patchable form, and deploy
@deed02392 Well, with asm you can create rudimentary stuff, but more complex things are hard
@ManishEarth Well it's already doing everything you'd need, like file I/O, SOCKS, the lot ... so adding some file search, pack and send to it should really increase its binary, for example
though I'm pretty sure the cert thing can be bypassed via ASM itself
actually is FF open source?
because it's just a bunch of strings
how about recompiling it and doing a MITM when the user gets an update
22:08
@deed02392 already did a bunch of shit with my locally built FF. But munging network (and sometimes security) related code usually requires a full build :(
i wonder if it verifies cert for update server
@deed02392 ?
firefox update server?
how does the update mechanism work?
it probably downloads new binaries
22:09
Probably patches
hmm you sure about that
Firstly, a lot of the UI magic is in JS code which is just zipped up
So that can be patched.
Not sure about the main cpp binary
@deed02392 nope
actually it's irrelevant anyway as long as you detect their current version in the MITM
While I contribute to FF, I don't know how most of the base stuff works. I just label it as magic and move on
you just create a diff with that and then send them the patch
I'm just brainstorming methods you might target a FF user remotely to make their install malicious
probably off-topic to what you have in mind
22:11
you would need to bypass the cert first.
I bet updates use a hardcoded cert
you'd hope
i doubt it's hardcoded
probably uses the rest of the ca bundle
Just found updates.js. Hope there is some corresponding c++ code
fuck
The update cert things are preferences
The whole f'in thing is configurable
Open firefox, go to about:config, and type app.update
I can see the use of configuring it, but configuration is something a non root can do.
With a couple of seconds on the computer, I can configure it to use my server for updates instead
No need to even compile, it's directly editable by non root
I shall go to Bugzilla with this tomorrow
@deed02392 thanks, you were right
beautiful @ManishEarth!
though the code I found is only for addons
hmm
slightly less severe then
22:24
@deed02392 however the prefs seem to be used for FF updates too. Not sure
they will probably come back and say physical access issues are not a FF issue
@ManishEarth IT IS DONE.
@TomLeek Thanks :D
the bear hath morphed
Whoa, long post. I thought Gibson was a dude you guys don't like to spend time on.
22:39
@ManishEarth WHEN I WRITE, I SPEND TIME ON MYSELF, NOT ON THE INITIAL PRETEXT FOR THE ANSWER.
2
hahaha that's exactly why I answer on SE too
@TomLeek I don't quite get your point about signing though
As in crypto signing, or the text "I, Gibson, hereby solemnly swear that this fingerprint is true"
I don't see what ecdsa signing would add
@ManishEarth It would avoid the situation where Gibson is part of the attack, sends a bogus fingerprint, and then claims that he never did it.
ah
oh, so I could copy the ecdsa signed message and thus it is attached to him even if he takes it down from the site
sneaky
00:00 - 23:0023:00 - 00:00

« first day (1137 days earlier)      last day (4041 days later) »