@RоryMcCune cool!

@Simon It's going to be Christmas in July!

@JeffFerland Oh lawd. People live in the wrong timezone and now this.

@JeffFerland Do you need a janitor who can code at FB or something? I can also be the guy you insult to feel better, I'm already doing this for free here.

@Simon Yes, code janitors welcome!

@Adnan Keeping an article in which he more-or-less explicitly recognizes having been wrong is a rather smart move; it is a bit of: "see everybody how humble I am !"

@JeffFerland Awesome!

@ThomasPornin You never had to do that, right?

@ThomasPornin Smart indeed. Clickbait title + "look how humble I am". 2 birds.

@Adnan sorry - I read that as 'jailbait' :-)

also - when did your profile pic change?

@Simon My humility is so towering that I don't have to advertise it in any way.

Riiiiight.

@RoryAlsop well it is @Adnan so that's understandable...

@RоryMcCune exactly

Personally, I think that would be more like a @AviD kind of situation.

@RoryAlsop About an hour ago. I don't like the mugshot anymore.

@RоryMcCune Heeeeeey!! What the hell?! 16 is perfectly legal in Finland.

@Adnan Took you a while to get it.

@Simon I didn't get it. What is it?

@Adnan That picture was awful, you can't even compare it with your current one.

@Simon Dude... that was the point of that picture. That was its exact purpose.

I've said it many times.

@Adnan The purpose was to let us die slowly?

That's... amazing, well done.

Apparently Stack Exchange's topbar contains porn. Whee.

Your face contains porn.

(I'm a guest speaker at a Mozilla event at a college, trying to use wifi but failing miserably)

@ManishEarth start behaving like stars do, you know, like Prince ... it'll be fixed in no time :)

Port 22 is totally blocked, too. And corkscrew no worky worky.

lol

Don't forget to mention how nerdy you are with Christmas hats during your talk.

Not that I want to tunnel out, but I do want a shell where I can run IRC and also test some python that uses requests.

@ManishEarth In all fairness, they must have flagged the whole StackExchange domain based on my messages on the DMZ.

hahaha

like: "My background & notable milestones: - #1 Hat Gatherer on SE in 2013"

@ManishEarth try opening the SSH at port 443

that is usually never blocked

@kiBytes but I'd need to then listen on 443 on the other side

if you really need that now I can open it for you in my server

and I don't have root on the host machine. I had a root server but I'm replacing it right now so no root machine for the next week

@kiBytes nope, no worries

@ManishEarth Novice mistake.

Also, this proxy works via HTTP CONNECT

ops

however ... hmmm

I wonder if arbitrary ports are blocked

if you want to make a quick test I have my netcat ready xD

so all ports are blocked

sure. nc yourhost 443?

hold for a second

try it (kibytes.com)

!attack kibytes.com

go go go!

I said hello in the nc

oops wrong window soz

I havent received anything so far

Doesn't look like it went through

It's definitely HTTP CONNECT then. Nothing I can do.

aside from DNS tunneling, which I don't have the time / energy to set up from my phone

try 43224

nope

@ManishEarth If it is HTTP CONNECT, then corkscrew should definitely work.

but it somehow doesn't

lemme try again

wiki.archlinux.org/index.php/…

mmm ok done it

now I am listening on 443

packet sent

nop

nothing

let me try it from here

HTTP CONNECT means that the proxy just forwards bytes in both direction, which allows an arbitrary TCP-based protocol to be tunnelled. This is meant for SSL, but also works for SSH.

for me it is working

nc kibytes.com 443

However, some proxies do check that what they forward is really SSL.

@ThomasPornin I know, but I tried it in the morning. No worky. I'll try it a bit dfferently this time

Other will do the forwarding only after due authentication of the client, which may use passwords or, even worse, some Windows / Active Directory Kerberos ticket.

Proxy could not open connnection to anapnea.net:  Forbidden
ssh_exchange_identification: Connection closed by remote host

no auth for this proxy

ok, closing it =)

yeah, thanks though

no problem

Ok I am gonna get ready

okay, looks like the proxy only allows CONNECT to port 443

night out with some security wannabe people =)

I'm comparing stream and block ciphers... can anyone tell me what VPNs generally use? I can't tell from looking at my client configuration. Since it's "networking" I would think stream cipher, but unsure...

@ManishEarth Oh well, many do that. You don't have a handy server somewhere with SSH on port 443 ?

@ManishEarth Want a tunnel on 443?

@ThomasPornin I have a handy server with non-root shell access

@ManishEarth All you have to do is ask.

@makerofthings7 Most VPN use either IPSec or tunnelling through SSL (or even SSH) so they use whatever algorithms are applicable there, which may or may not use "stream ciphers".

@Adnan er, okay.

Notion of "stream cipher" is kinda overrated anyway.

Not gonna need it much, but it would be useful to get some things done

E.g. AES is a block cipher, but AES in CTR mode (or variant, like GCM) is definitely a stream cipher.

@ThomasPornin Yes, I was reading many of your posts on AES GCM and don't see any reason for stream ciphers....

@ManishEarth Without root access, no bind() on port 443... only 1024+

@ThomasPornin yep

hmmm AES GCM is considered a stream cipher?

@ManishEarth Email?

@makerofthings7 "Stream ciphers" are actually an subcase. A generic block cipher can be used in many ways, but it is hoped that by restricting yourself to the specific case of encrypting a long stream of data, you may have better performance with a specific algorithm which does not have the versatility of a block cipher.

@Adnan username at the big googly mail guy who spies on us

When you have a recent PC with the AES hardware opcode, anything AES-based will just be more than fast enough, which voids the need for stream ciphers.

@ManishEarth I'll be impressed if a bot manages to parse that.

@Adnan Deleting generally causes far more backlash than adding a correction.

@Simon lol

On smaller architectures, stream ciphers can give an edge.

@Simon not too concerned about bots, usually I just say username@gmail though. Was bored.

hehe

and AES-CTR has a nice feature most stream ciphers lack: It's random access. You don't have to start in the beginning.

Not important for network connections, but great for files

For network protocols you just want a standard AEAD interface and you don't need to care about the details of the cipher as long as you chose a secure one.

How do bad, bad, bad, bad people usually test if an e-mail really exists when they parse websites? Do they simply assume that it does and send e-mails to the address anyway? Or hope that they'll receive a reply one day?

@Simon Judging for the number of "failed: user does not exist" errors I get in my email server logs, I must assume that spammers do not check e-mail addresses.

Return addresses are faked anyway, they cannot receive a response.

Oh right, that would make sense -.-

@ManishEarth Today I learned: Never change your SSH port before whitelisting the new port.

@ThomasPornin far from it; they generate ${plausible_firstname}@yourdomain.com

When they want a return path, they include a unique ID in the HTTP link that the gullible user is supposed to click.

@Adnan did you just lock yourself out? :(

@ManishEarth Sorry, lost control over my box. I can't do anything before I get physical access.

@ManishEarth Yup, I did.

Sorry about that :(

@ThomasPornin Ah, that could work.

@ManishEarth Nah, it's alright. I learned my lesson.

I feel like coding a crawler just to get the kick out of it.

And it would be a great excuse to finally learn Python.

@Simon Generally speaking, spammers are not interested in email addresses which merely exist; they are interested in addresses such that the owner is ready to read spams and click on links.

@ThomasPornin Well, isn't it a waste of resource if half of your e-mails in your DB is inactive/nonexistent?

I guess that the fact that there's more or less a good way to test them makes it irrelevant.

@Simon Spammers don't care, they don't use their resources. They send spams through botnets, i.e. stolen bandwidth.

Ah, right.

And it would be surprising if only 50% of the addresses in a spammer's DB were wrong. 99.9% would be much closer, I think.

Rofl.

Anyway, e-mail spamming isn't really what's the most profitable nowadays I assume?

But like you said, if you do it with other people's resource, why not just do it?

@ThomasPornin In their infinite wisdom, gmail seems to have decided to load external images by default. Confirm those email addresses!

@Simon I don't have statistics, but mere economics suggest that any given activity, illicit or not, cannot yield profits disproportionate with involved risks for prolonged periods of time.

Spamming is not exactly risky, so it cannot make truckloads of money either.

In fact, it is probable that the spamming business is profitable only for the botnet owners, who sell their services to gullible spammers (who still believe that spamming works for attracting business).

I receive many spams which include things like '%RAND_NAME', meaning that there is some spammer somewhere who does not know how to use his own spamming software.

@CodesInChaos No, they don't

They proxy 'em

proxies prevent the IP leak, and if used well the timing leak (when did your read it), but the spammer still sees that they were opened.

@Manish Check your email

@CodesInChaos yep

@DavidFreitag username?

wait i won't need it

Now if gmail opens them for invalid emails, this technically doesn't leaky anything anymore, but I'd expect spammers to be too lazy to account for it.

or i might. hmm

@ManishEarth Sent.

thx

I wonder happens if i lock myself out of my EC2 instance..

@ThomasPornin Now that's funny. I rarely receive spam so I've never seen this.

@DavidFreitag ssh -ND 8888 a@b.com -p 443 -o "ProxyCommand /path/to/corkscrew 10.30.0.1 8080", right?

still giving the same error :(

@ManishEarth Is that an example IP? Cause that ain't mine..

@Simon I use to get about 400 spams per day, but the flow has reduced, down to about 100 or so.

@DavidFreitag that's the proxy IP

@ThomasPornin On the same e-mail or various? Also, your e-mail is probably published on many websites because of the papers you wrote, right?

@DavidFreitag 10.x.y.z IP are local network IP

@ManishEarth Does it have to be port 443?

I guess...

@Simon My email address has been valid for more than 12 years, and spammers never forget.

Sounds like a sad love story.

@ManishEarth & @DavidFreitag would you two like to rent a room? Only $20 per night :)

lol

i'll look this up, one mo

@ManishEarth If you can use 22 i can lend you my EC2 instance. I'm a little leary about messing with the SSH settings on it.

I have my own port 22 thingy

really, get a room!

@DavidFreitag Anyway, thanks, but I don't really need the tunnel (just wanted IRC and easy-to-work-with Git, which I can do tomorrow instead) that much

wait wait

@TildalWave Why one measly room? The internet is a vast and endless place to have fun.

@DavidFreitag So is a room.

@DavidFreitag because you can lock it as private and share things you normally wouldn't in a public one ... gee you never rented a motel room before?

@TildalWave No, I've always had a bedroom door or a car.

And besides. Chat isn't over https.

@DavidFreitag but @ManishEarth wants to share his port 22 with you, I'm not sure I wanna witness that :)

@TildalWave Our generation doesn't feel like it's needed to hide most of the stuff as yours does.

@Simon dude, you don't know what you're saying, I lived through the 80's if there's a prude generation between the two of us, it ain't mine :P

lulz

@TildalWave There's nothing wrong with a just a little data exchange.

Download Festival is going to be a good weekend!

too many choices though

@RoryAlsop Download Festival?

@DavidFreitag what used to be the Donnington Monsters of Rock festival

@RoryAlsop That's an extremely misleading name :|

@DavidFreitag yeah, not sure why they changed it. Same venue, same bands (ie Iron Maiden headlined last year :-)

@RoryAlsop So jelly :]

@DavidFreitag got VIP tickets this year as well! Which is nice!

@RoryAlsop Heh, bet those were expensive..

@DavidFreitag mebbes ;-/

@RoryAlsop Sepultura and Skid Row in small font? :OO

@TildalWave Actually never seen Sepultura - so I'm looking forward to getting down the front

@RoryAlsop One of my fav trash metal bands tho I'm more into punk so Ratos de Porão fits me better ... still, that's a respectable name here I've been to their concert and loved it

mind the stage diving :))

@TildalWave I managed to stage dive at a Skid Row gig a while back - or maybe a Megadeth gig - can't remember. Was good fun despite the bruises

Gutted that Oderus Urungus is dead though - GWAR were brilliant when I went to see them

@RoryAlsop I'm sure it's more likely the latter LOL

@RoryAlsop yeah that's too bad

pay attention to the drumming on Sepultura, that dude is brilliant

@RoryAlsop Yeah, i heard about that, what a shame :\

I have a mate who guested with Sepultura - did vocals at two gigs. He says they are awesome to work with.

@ManishEarth Still need the tunnel? I now have physical to my box and I fixed the issue.

Nah, but thanks

Alright. I'll switch to my old ultra "secure" port then.

Just gonna leave that right here.

Possibly the best advertising i have ever seen.

NSFW.

@DavidFreitag I remember @RoryA posting this about a year ago.

However, he cropped most of the picture and left only the lady.

@Adnan there was more in the picture?

> As of today, Hackers using Windows PE, with Powershell and an X: drive that contains over 60 tcpip connections and hundreds of files, Hackers have been able to disable Norton, McAfee, Webroot and even DBAN and KILLDISK uploaded from disks.

This reads like a markov chain generator

@Gilles why has that not been burninated yet

flagged, anyway

clearly the SU mods are slackers

> not an answer – 4 hours ago × 4

the real WTF is that this post has an upvote

that's worth tracking - is the upvote from a sock?

@RoryAlsop or from a serial reviewer. I looked at the users who dealt with that post in the first posts queue and the late answers queue. I can't find evidence that either of them is a serial reviewer, but lacking vote information I don't have all the information

added my downvote and a flag but it's still there ... not sure what I find more disturbing, its contents or the upvote on it

Quoted someone $500 for transferring their domain away from GoDaddy. Starting to think that wasn't enough.