The DMZ

Scott Pack

00:41

@FalconMomot It's less complex than your face!

Falcon Momot

@ScottPack My face is kind of complicated, so sure :P

pacifist

your face isn't complicated in theory, it's just the implementation has some terrible defaults

(sorry if it came off mean - may not've been as witty as hoped)

tylerl

@pacifist par for the dmz

Falcon Momot

01:00

@pacifist some of the defaults are changed :P

Scott Pack

Default settings can sometimes be quite elegant but are often boring.

Falcon Momot

thus the facepaint and metal

I should go get an airbrush one of these days

Scott Pack

01:54

Planning on centerfold modeling?

Falcon Momot

@ScottPack it's much easier to apply warpaint with them. facepaint runs and can't be made even. #cyberpunkproblems

In short: what I want is a server which can only be accessible from port 80... so, how do I completely isolate the OS from the outside world, making my web server the only and unique way to get in and out??? is such a thing even possible??? — george b 6 mins ago

ugh, this guy

FEichinger

02:24

Mar 14 at 18:14, by FEichinger

Close all ports, be surprised by how "functional" your machine suddenly becomes.

Falcon Momot

heh

Simon

02:39

@DavidFreitag I couldn't recognize the intro at all but as soon as I heard the synth, I remembered the track. I totally forgot about this one, it's reaaaally great!

Anonymous

03:02

sup @Simon!

Stack Exchange

04:02

If data fails the Teacher's t test, you can just force it to take the test again until it passes.

Terry Chia

@LucasKauffman Around here, a statement like that probably means you are going to assassinate the POTUS.

Terry Chia

05:20

> public function encrypt($value) {
return strtr(base64_encode(mcrypt_encrypt(MCRYPT_RIJNDAEL_256, hash('sha256', $this->key, true), $value, MCRYPT_MODE_ECB)), '+/=', '-_,');
}

Another gem from opencart!

Falcon Momot

05:41

ugh. eyeroll

why do people think hashes are good PRNGs and KDFs?

(and why is ECB still implemented by anyone)

Terry Chia

@FalconMomot This is clearly the far more important point. :P

Falcon Momot

though so far the only academically-acceptable source I've seen decrying the use of SHA2 as a PRNG entropy distiller is a French government report without data, criticizing Java

@TerryChia nothing wrong with ECB if you're only encrypting a single block and don't plan to use the key again.

:P

Terry Chia

@FalconMomot Sure, what are the odds of that happening?

Falcon Momot

I'd be more interested in the derivation of $this->key

Terry Chia

@FalconMomot Appears to be a read from a user config file.

Falcon Momot

05:46

oh, lovely

that likely restricts the keyspace quite a bit

TildalWave

you must be bleepin joking me

0

Q: Fuzzdb detected as Trojans

I recently downloaded fuzzdb from http://code.google.com/p/fuzzdb/ and my antivirus kept on detecting some of the files as Trojans. I need to know if these files are safe?

Terry Chia

@FalconMomot I presume that's why the guy ignorantly used SHA256 in the first place.

Hey, the output appears random so it must be good right?

Falcon Momot

@TerryChia it does raise the bar a little, sure, but it's far from a uniform distribution, especially used on that.

Terry Chia

Also, no HMAC is applied on the encrypted result. Woohoo!

Falcon Momot

ugh.

I'm not sure an HMAC is really necessary in this case.

well

I guess it depends on what is being encrypted

for some reason I assumed it was password hashes but I guess there isn't any reason for that

yeah, the lack of HMAC is a shame.

Terry Chia

05:50

@FalconMomot It appears to be mostly used to encrypt certain columns of a product table in the database. (It's a ecommerce app). Also, it's always a good idea to apply message authentication, you really can't go wrong with that.

Falcon Momot

is it really so difficult to use cryptographic primitives only for their intended purpose, and not abuse encryption for authentication and hashes for KDFs?

@TerryChia it is, but sometimes it isn't worth the overhead.

Terry Chia

@FalconMomot Oh, I already complained about their password hashing. github.com/opencart/opencart/issues/1269

@FalconMomot Oh cmon, what kind of weak ass server are you using if computing a HMAC is an overhead?

Falcon Momot

oh god

github.com/opencart/opencart/issues/1269#issuecomment-38146718

@TerryChia one that processes a fuckton of data.

I mean

there are people that think using 4096-bit RSA keys and AES256 on webservers is unacceptable overhead

so I always try to think about what the marginal benefit and cost of a measure are

Terry Chia

@FalconMomot Ehh, I can understand that at least. 2048-bit RSA keys and AES128 is more than sufficient.

Falcon Momot

applying an HMAC to data in your own backing database because it might not be trusted doesn't seem to be marginally beneficial. encrypting and applying HMAC to database communication, on the other hand, is clearly the right thing to do.

Terry Chia

05:56

Ok, I'm done with poking around random $PHPAPP today.

Falcon Momot

yeah, I tire of writing software patents

(as evidenced by me chatting here)

FEichinger

06:22

0

Q: Is StackExchange/meta/stackoverflow.com secure

I just recently noticed that none of the security indicators for a secure connection are showing up for any of the StackExchange site associations that I visit. I find this odd as I use weak passwords on sites that have lame security and yet find that I need a complex password here. Whereas I sav...

discussion security

And this is why we should stop with ambiguous "security" indicators in consumer UI.

kiBytes

06:46

morning

facebook.com/zuck/posts/10101319050523971?stream_ref=1

I don't know why but I don't usually like everytime facebook acquire anything.

:( :( :( :( :( :(

We were in talks about maybe bringing a version of Minecraft to Oculus. I just cancelled that deal. Facebook creeps me out.

Tweeted by notch on March 25, 2014 at 10:25 PM

FEichinger

@kiBytes Yep. The Bridge had a nice conversation about this already

Terry Chia

07:02

@RоryMcCune I just saw this. I'm pretty sure they don't understand what opensource licensing means.

Rоry McCune

07:34

@TerryChia yeah that's another problem for them...

@kiBytes notch is right facebook (like google) are creepy, the idea that I'd want "facebook 3D, with unavoidable ads" ...

Lucas Kauffman

07:55

@TerryChia they've got a few projects like opencompute

and hadoop

►

CodesInChaos

08:16

@kiBytes ARGHHH. I liked oculus

Lucas Kauffman

►

@CodesInChaos Well now @jeff get's to play with it :p

pfff I need to use the word Cyber and I don't want to

I hate the word cyber

AviD

08:35

so write "cybersex" instead.

if you really need to, erase the last 3 letters, after.

CodesInChaos

08:53

@AviD But this is only acceptable if you put on a robe and a wizard hat

Lucas Kauffman

09:15

@AviD Financial institutions are under the constant threat of cybersex

AviD

@CodesInChaos umm.... okay?

@LucasKauffman see? That report just become a whole lot more fun to write!

Adnan

12:14

@Lucas A manager from our customer's Belgium office just walked in. He looks just like you.

I'm not sure if it's weird to ask him for a photo with him

Lucas Kauffman

@Adnan lol what :p ?

@Adnan I'm currently in Finland visiting this IT company, there's a really weird guy with black hair who has been staring at me in a creepy way

Adnan

@LucasKauffman Are you really in Finland?

and, I'm currently a skinhead.

Lucas Kauffman

@Adnan no :p

Terry Chia

@LucasKauffman Really? Because they are attempting to charge people differently based on use case which is definitely not compatible with GPL.

0

A: WordPress Private Expoit?

First of all he's a script kiddie since WordPress isn't a webapp launched yesterday. The whole community is working to make it better. Now the only point is that WordPress sites get compromised because of misconfigured servers wherein an attackers might be able to carry out a SymLink Attack and t...

LMAO, is he implying wordpress doesn't have flaws?

Lucas Kauffman

12:30

MY GOD

@TerryChia I just looked at his blog: "An evening with MongoDB, Node.JS and PHP"

says enough

Adnan

@TerryChia Have you used something called Beautiful Soup?

Terry Chia

@Adnan That's the python HTML parser right? Not deeply but I did use it once or twice.

Adnan

@TerryChia Yup. I have a duckedup page that I need to parse.

So far, nothing has worked for me. The amount of shit on that page.. wow. I decided to give Beautiful Soup a go.

Terry Chia

@Adnan That's a pretty elegant library IIRC.

Adnan

I still can't believe that it's that powerful like they claim it is.

Terry Chia

12:35

It's one of the more famous python libraries alongside things like requests.

Lucas Kauffman

@TerryChia GPL isn't the only open source licensing model

Terry Chia

@LucasKauffman The page says it's GPL-licensed. Regardless, no FOSS license allows you to restrict usage.

> For all private and non-commercial websites, the private license of NoSSL will be free - yes U$ 0.00 / U$ 0.00 - under GPL-license.

This is definitely not GPL.

Adnan

@TerryChia Wait, what?!

How does that sentence work?

Terry Chia

@Adnan Not a clue.

Rory Alsop

Re Oculus - there are some alternatives coming up that look awesome!

Ps - morning everyone

Adnan

12:49

@RoryAlsop Morning

Rory Alsop

So anyway
Http://www.justgiving.com/LexiesLongWalk

Blimming autocomplete

Feel free to sponsor my 7 year old daughter doing her half marathon :)

Terry Chia

Full Disclosure is back btw, if you guys didn't know.

Adnan

@TerryChia Jesus! I didn't know!

Also, hehehehe seclists.org/fulldisclosure/2014/Mar/339

3

@RoryAlsop Link not working

Terry Chia

@Adnan Hahaha! That's amazing.

Rory Alsop

Better @adnan?

Why would anyone want to do this

14

Q: Is it possible for tourists to enter/attend Japanese Game Shows?

A group of us are looking at a trip to Japan later this year. Joking lead to wondering about visiting a game show, watching one, and then the hypothetical 'can you even go enter one?' question. So - is there a way to enter a game show, or at the least, be in the audience?

japan entertainment

Scott Pack

12:57

I'm more interested in Tasty Soup

Adnan

@RoryAlsop Hmmm.. they say they accept PayPal, but can't find it on the payment method page. :(

Lucas Kauffman

@RoryAlsop how did they charge my credit card, I didn't have to put in a CCV or perform authentication o.O

Terry Chia

@LucasKauffman I thought CVV was optional?

Adnan

@LucasKauffman @Terry Relevant security.stackexchange.com/questions/21168/…

Rory Alsop

@adnan - I don't know, it may be that only the us end of justgiving does paypal

@lucas the llama - cv is optional

And thanks very much

Looks like whatever sponsorship level it gets to will be doubled by my employer, which is nice

Lucas Kauffman

13:05

@RoryAlsop If I were unethical I could put 20k on a CC, wait until your employer had doubled and then chargeback my 20k saying it was fraud

Adnan

@LucasKauffman I can do that.

Terry Chia

@Adnan Because we all know you have no ethics. :P

Adnan

@RoryAlsop Jesus!! I had to create an account, and then choose PayPal from there.

Couldn't find something creative to put in "message". Sorry.

@TerryChia No no no, I have ethics. I just don't have a sense of morality.

Thomas Pornin

13:30

@TerryChia Ah, there are details.

No FOSS license can restrict usage once acquired. But they can choose to who they sell the FOSS license.

makerofthings7

Interesting blog / paper from NSTIC.gov "It’s Time to Redesign Transport Layer Security" pomcor.com/2013/11/19/…

Thomas Pornin

So they can decide to provide you with some software (of their own) under GPL license subject to some arbitrary conditions. But (that's the point of GPL) they cannot sue you if you finally decide to use the software as you see fit.

However, they may decide to forgo ulterior business with you.

Rory Alsop

@lucas - except they have a limit on what they will match

@adnan -many thanks for the effort

deed02392

soup

Adnan

13:49

@deed02392 filet

deed02392

mm fillets

beef? fish?

how's the healthy living going @Adnan

Lucas Kauffman

►

Adnan

@deed02392 beef, fish, pork, chicken.. all yummy. I prefer chicken, though.

deed02392

had two big lumps of lean chicken for dinner last night

delicious

turkey steaks tonight maybe, or salmon

Adnan

@deed02392 How's the gym going?

deed02392

14:00

I kinda just asked you that!

Pretty good, still aching from workouts Sunday and Monday

Adnan

@deed02392 My bench press is up to 70kg now. Very happy with it.

deed02392

Nice one, have you put on that muscle you burned from too much cardio?

Adnan

Besides that, all going well.

@deed02392 According to my lifts and measurements, it seems that I have.

Sadly, I added 2cm to my belly.

Lucas Kauffman

@Adnan love handles

Adnan

@LucasKauffman :(

deed02392

14:14

hm how did that happen @Adnan?

Ate a little too much for muscle building?

Lucas Kauffman

@deed02392 lifting them burgers

deed02392

@LucasKauffman lolol

Terry Chia

This is very interesting. robert.ocallahan.org/2014/03/introducing-rr.html

Adnan

@deed02392 Indeed. I ate too much pasta and bread.

Terry Chia

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

sobs

Lucas Kauffman

14:26

@TerryChia of course, what else? If we don't use that it will break the application jow!

Terry Chia

@LucasKauffman Hehe.

Rоry McCune

14:53

aws.amazon.com/workspaces

kinda interesting idea, but single factor auth direct access to peoples desktops....

Lucas Kauffman

@RоryMcCune yea I'm not a huge fan either because of that, although the concept isn't bad

Iszi

@RоryMcCune "single factor auth direct access to peoples desktops" isn't a big deal - this is how authentication is still handled in most companies today. The problem is when you add "...over the Internet".

Terry Chia

@RоryMcCune Doesn't Azure offer something similar?

Rоry McCune

@Iszi yeah that was the bad bit. It's like removing the VPN from the accesing peoples systems

Adnan

@RоryMcCune It seems to support AWS MFA

Rоry McCune

14:56

@TerryChia well you can deploy desktop OSs to Azure sure enough, not sure about the management piece

Adnan

So, what's the problem?

Rоry McCune

@Adnan ahh does it I didn't see that on the site

@Adnan well from a security standpoint not so much if it allows 2FA, but with single factor it's waiting for someone to lose their password

Terry Chia

Regardless, the pricing is pretty steep...

Rоry McCune

and then all the companies docs go walk about

and as it's in the cloud it won't be easy to secure beyond what amazon do, which may or may not be great

Iszi

@Adnan Am I the only one who reads the "ass. PhD" in that guy's signature and can't help but think "butt doctor"?

@Adnan Wait... I thought Full Disclosure was shutting down?

Terry Chia

15:05

@Iszi Fyodor is reviving it.

makerofthings7

I'm interested in "indistinguishability obfuscation" ... where I believe I can securely store a private key in an application I send to end users. Does anyone know of any EXEs or sourcecode demonstrating this technology?

Rory Alsop

nope - you can't unless you separately send a key used to encrypt it :-)

Adnan

@Iszi I thought so, until @Terry pointed otherwise

makerofthings7

hmm just found a SE post security.stackexchange.com/q/50937/396

Terry Chia

@RoryAlsop There are academic papers on this topic. Nothing practical yet last I heard.

Rory Alsop

15:07

yep

hence my smiley

Adnan

@TerryChia Nor I think it will ever be practical

Terry Chia

@Adnan Yeah. One can dream though.

Rоry McCune

@TerryChia sweet dreams are made of this?

Terry Chia

@RоryMcCune I said dream. I never said it had to be sweet.

Rory Alsop

wow - just been looking at our stats. Did you know we are now consistently getting close to 50k views every day, and increasing?

Rоry McCune

15:13

@TerryChia well that ruins my segue into a cool 80's reference...

►

Lucas Kauffman

all the WOB WOB WOB WOB music

@RоryMcCune he's too young

Rоry McCune

@RoryAlsop cool!

Lucas Kauffman

oooh MS is going to open source Word v1 and MS-DOS

Rоry McCune

@LucasKauffman cough read the transcript cough :op

Lucas Kauffman

oh :(

Rоry McCune

15:20

@LucasKauffman @DavidFreitag was having a challenge getting it off their site, so @Adnan hacked amazon and found him a link

I'd expect the site has recovered from the crush by now so you should be able to get it...

David Freitag

@LucasKauffman It's mostly useless. The MS-DOS code is pure assembly that will only build with an archaic assembler that microsoft didn't release.

It's very sparsely commented as well.

Thomas Pornin

15:37

@DavidFreitag I am too lazy to read the transcript, so anybody has a link ?

Adnan

@ThomasPornin computerhistory.org/press/ms-source-code.html

@RоryMcCune Hey, man. I hacked nothing!

David Freitag

@ThomasPornin computerhistory.org/atchm/…

That's the actual link ^ no longer being crushed

Rоry McCune

@Adnan found a non-public URL and accessed it... well in france arstechnica.com/tech-policy/2014/02/… or the USA theregister.co.uk/2014/03/20/weev_ipad_hack_appeal

:D

Rory Alsop

this one - SO or MSO?:

0

Q: How does data.stackexchange.com allow queries securely?

https://data.stackexchange.com/ lets me query some (all?) of stackexchange's data/tables using arbitrary SQL queries, including parametrization. What program do they use to do this and is it published? I want to create something like this myself (different data), but am constantly worried ...

sql-injection

Adnan

@RoryAlsop MSESSA

Rory Alsop

15:43

erm ... oookaaaayyyyyy

Adnan

@RoryAlsop I'd say just close it as is. The dude got his answer from my comment.

deed02392

16:19

@Adnan Can't actually see where it cleans the query for things like DELETE or DROP statements

I read about it parsing the query, normalizing and then validating it

But didn't see any checks for dangerous query types, unless that safety mechanism is in the database itself based on the access level of the user executed queries?

Adnan

@deed02392 In my opinion, it's perfectly safe to assume that the user executing the queries has tight permissions to begin with

Rоry McCune

yeah I'd just use SQL permissions for this, only give them SELECT access to specific tables..

simples

Terry Chia

Exactly. Why bother parsing? Just don't execute it.

deed02392

@TerryChia It parses everything and appears to attempt to execute everything too

Terry Chia

@deed02392 Presumably the SQL server will reject it based on permissions..

deed02392

16:26

That's the consensus

Terry Chia

Not everything has to be controlled in the app you know.

deed02392

Duh

Didn't the last few lines make that obvious we all know that now

Adnan

@RоryMcCune and, in this case, even to specific columns. For example, you can't get some timestamps in some tables (to prevent cross-referencing and find voters)

Terry Chia

Also, why the hell are they using Google Code? :P

The interface is baaaaad.

Adnan

@TerryChia I hate browsing on that thing

tylerl

16:34

@TerryChia supposedly google is leaving google code and using github

David Freitag

mmmmm steak.

Terry Chia

@tylerl That will be nice indeed.

Adnan

@DavidFreitag I want!!

tylerl

@TerryChia it would be perfectly fine if they created a free alternative on google code which didn't suck

David Freitag

@Adnan How difficult is it to get steak where you are?

Terry Chia

16:36

@DavidFreitag How does that matter? :P It's easy to get them here yet I still want more. :P

David Freitag

@TerryChia I was just curious. Of course everyone wants moar steak :]

Adnan

@DavidFreitag Not that easy.

David Freitag

@Adnan I wonder how well a large steak would stay frozen in the post :3

Adnan

At least not one of those proper steaks.

You can, however, get schnitzel everywhere

David Freitag

Looks like chicken fried steak

Adnan

16:41

@DavidFreitag Except that in Finland it's made out of pork.

In my city, it's very difficult to get a decent steak made out of any animal

Thomas Pornin

@Adnan I have trouble with the notion of "steak" being made out of any animal except cows.

David Freitag

@Adnan You should raise some cattle and sell the steaks. I bet you'd make quite a lot.

Terry Chia

@ThomasPornin Same here.

David Freitag

@ThomasPornin You've obviously never had 'steak' from an American Chinese food place.

Thomas Pornin

I mean, the generic term for "meat" is "meat", not "steak".

Adnan

16:44

@ThomasPornin I actually do agree with you. It's just I can't get myself to ask for beef steak. In almost every restaurant I go some waiter/waitress say "Oh, but this is made out of pork" because of my beard and hair colour.

David Freitag

There are ham steaks? I get them from the store every now and then.

Adnan

If I start asking for specific meets, they'll probably start stressing things like "oh, but this has alcohol".

Thomas Pornin

@Adnan Just answer: "that's OK, I am Zoroastrian".

At least you'll have the satisfaction of knowing that a waiter or cook will have a lookup on Wikipedia.

Adnan

At a local restaurant, I was taking salad from the buffet, suddenly the waiter appears next to me "Oh no, sir. Sorry. This contains ham". I replied "It's okay, no problem". Surprised, he said "Oh, sorry, but you know those mazlimz are everywhere and sometimes we feel we need to ask".

David Freitag

@Adnan How awkward.

Adnan

16:47

A couple of times I asked for a beer "Sorry, sir. We don't have non-alcoholic beer".

Even though I didn't ask for it

David Freitag

Huehuehue.

Adnan

I wonder, if I were a bit "brown", how would I be treated?

David Freitag

Well, think of it from their perspective. If they didn't make assumptions like they do, it might bite them in the ass.

Heh, i just found 4 paychecks on my desk.

Thomas Pornin

Oh, a cute one: security.stackexchange.com/questions/54223/…

David Freitag

@ThomasPornin Setup a RasPi in the school with a WiFi card and voila.

Adnan

16:52

@DavidFreitag Which reminds me... One time I was at a restaurant, some dude order "Item 12". Item 12 says "Kananpoikaa punaviinikastike", which means chicken with red wine sauce. After the dude started eating, he yelled for the waiter and said "What did you serve me? This is disrespect for my religion!! Take it back and bring me something without alcohol".

I almost threw my chair at the dude.

Uggghhhh!!1

David Freitag

@Adnan And that is the exact reason why people make the assumptions they do

Because people are stupid.

3

Terry Chia

@DavidFreitag That should be the tagline of the infosec industry.

Adnan

> That should be the tagline of the * industry.

Actually

> That should be The Tagline.

Jeff Ferland

17:43

@kiBytes Say, anything else you really really like? :P

Adnan

@JeffFerland When is Facebook gonna acquire StackExchange?

Jeff Ferland

@Adnan Ha. Jeff Atwood would have a vein pop right in front of you if you said that.

Adnan

@JeffFerland Hey, man, anything that adds upvote/downvote functionality to Facebook posts.

Rоry McCune

@JeffFerland facebook should acquire reddit for the lulz

Jeff Ferland

@RоryMcCune Oh heavens

Rоry McCune

17:54

@JeffFerland I can just imagine the rage if that happened.. heh

David Freitag

@RоryMcCune Acquired it and then integrated it into Facebook ;]

Jeff Ferland

@RоryMcCune Yeah, I can't see that one working out for anybody.

Rоry McCune

@JeffFerland no but it would be super funny

@DavidFreitag yeah "your mum liked your post on /r/nsfw"

8

David Freitag

@RоryMcCune Huehuehue.

Rоry McCune

hmm actually @JeffFerland you couldn't arrange for that to be Facebooks April fools gag this year could you, I'd have to buy myself some popcorn if that happened

Jeff Ferland

17:57

@RоryMcCune Shit... who owns Reddit and how can I get in touch?

Rоry McCune

@JeffFerland I think they're still part of Conde Nast but operated entirely independantly.. with that lot you could probably get a name off their blog redditblog.com and message them on reddit...

Transcript for