The DMZ

tylerl

03:42

I imagine it's time for another go at this:

forums.cpanel.net/f185/…

I wonder if they'll be more likely to patch it if I assign it a CVE number.

pacifist

05:15

@tylerl ... I'm torn on whether I agree with your last two sentences - I agree they should be able to disable it, but I'm kind of more comfortable with people being dos'd out of their systems than it being easy to bruteforce the systems by default. Trusting people to pick a good password for cpanel isn't something I'm super comfortable about

Terry Chia

> Since cPhulkd conveniently blocks ALL authentication for a given account, not just through cPanel but also SSH and every other avenue,

@pacifist This is the ridiculous bit.

pacifist

ah, I see, that is an interesting choice isn't it

Terry Chia

05:54

> Moreover, the scheme I describe above is homemade crypto, and that's bad. I can get away with it because I am totally awesome, but this cannot be promoted on a general basis.

8

A: Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

PBKDF2 and Bcrypt do not support increasing the cost, starting from the output at a given iteration count, without knowledge of the password. There is no intrinsic reason for that; a password hashing process could allow for such offline stretching while still be "good". But these algorithms happe...

Heh.

kiBytes

Today facts:

There is more computer power into mining crypto-currencies than computer power into helping in scientific studies, medicine...

Lucas Kauffman

06:08

@kiBytes because the former generates profit whereas the latter doesn't

Terry Chia

@LucasKauffman And that's just sad really. Morning. :)

Lucas Kauffman

morning ^^

kiBytes

07:22

@LucasKauffman The latter generates much more benefit, because health benefit is infinite.

Terry Chia

@kiBytes Are you suggesting that people overlook short-term profits for long-term beenfits? The notion is absurd!

Oh, /sarcasm

AviD

Beginning: A NEW ERA OF GREATNESS.

Good morning, I am here.

Rоry McCune

@AviD happy April Fools day to you too Avi :p

oh and morning all

AviD

@RоryMcCune my business advisor (read: my wife) turned down the idea of million-dollar invoices. :-(

Rоry McCune

@AviD aww, all you'd need is one person not to read it right and... bam sorted

AviD

07:33

haha, in that scenario I am more likely to be blacklisted and/or sued.

Lucas Kauffman

@AviD So will there be any troll questions today?

whats the SE april fools joke?

AviD

why would today be any different?

Lucas Kauffman

ah the unicoin

currently mining unicoin

Rоry McCune

@LucasKauffman not defcoin twitter.com/defcoin ?

TheRookierLearner

08:02

Good morning everyone!

Anyone mining unicoins? ;)

Rory Alsop

08:31

hello all - decided against a LinkedIn update saying I was leaving security for a life on tour with the band...figured it would steal my thunder when I actually do announce it :-)

Rоry McCune

@RoryAlsop what about an update saying that you're leaving security and rock music to pursue your true passion of HR management?

6

Rory Alsop

hahahahaha

I have discovered you can't mine the unicoins on an ipad - yet another failing

Rоry McCune

@RoryAlsop so do mods not get an infinite supply... lame!

AviD

@RoryAlsop do rock gods use linkedin for music-type things?

Rory Alsop

might do...

Because Unicorns

Terry Chia

08:38

The comments color one is painful on the eyes.

Rory Alsop

we also vaguely use Kilt-R - a Scottish LinkedIn... unfortunately it is still crap, but improving

Rоry McCune

@RoryAlsop I should probably log into that again some time

was a bit of a wasteland last time I was there...

AviD

@RoryAlsop WAIT, that is NOT a joke????

@RoryAlsop @TerryChia share some pics, for the lazy.

Terry Chia

@AviD Eh, think geocities font color.

AviD

no no, not good enough.

Rory Alsop

08:56

sorry @AviD - it isn't a joke...

AviD

I need to see this. link?

Or would you need to toss a cedar at me?

Rory Alsop

kiltr.com

for the diaspora

!

AviD

Interesting.

I managed to find some odd sites while searching for that....

Rоry McCune

09:13

they just need to sort out the ordering and that'll look nice :op

Terry Chia

@RоryMcCune That really puts into perspective just how incredible Big Bear's rep is.

Rоry McCune

@TerryChia yeah even divided by 10 he'd be on the front page!

Terry Chia

Also, huh I have been slacking off recently. @AJ overtook me again.

FEichinger

6

Q: Is it possible to use "Cut everyone's reputation by 10" multiple times

I've used "Cut everyone's reputation by 10" already, and it is a great power - no need for me to learn anymore, I've got into the top 10 engineers with three mouse-clicks. However, I'm sad because Jon Skeet still has more reputation than me. So, I was wondering, is it possible to use the powers...

Terry Chia

@RоryMcCune Btw, minnowboard.org/meet-minnowboard-max

This looks sick.

Rоry McCune

09:21

@TerryChia that does look nice, the dual-core one especially should be powerful enough for basic PC stuff + nice and small

Terry Chia

It looks near perfect for a thin client (and slightly more) tbh. Decent amounts of RAM, good graphics capability, x86 so no problems running your preferred Linux distro.

Lucas Kauffman

09:44

@TerryChia does it play full hd?

kiBytes

10:48

Ok, I am going to have a thrilling security metrics meeting

later!

CodesInChaos

11:16

The concept of security metrics sounds weird

Adnan

@tylerl But, seriously, minus the music, that's actually almost 95% accurate. That's how a summer day in Finland is usually.

@CodesInChaos What about imperial security?

AviD

@Adnan no it's not. The guy was grilling his fish, instead of letting it rot in a hole in the ground.

Adnan

@AviD You're confusing Finland with Sweden.

@AviD Or Iceland

AviD

oh, thats not a finland thing? sorry!

so whats the weird (some would say "gross") thing you guys do to your fishes?

CodesInChaos

I'd guess they accuse each other of doing it.

Adnan

11:27

@AviD In some parts of Finland, there are people who make Fish Wine. It's very rare, but some people make it.

You ferment the fish for a couple of weeks, discard the solid parts, bottle and age.

AviD

that.... does not sound fantastic.

FEichinger

"discard the solid parts"

Lovely.

Rоry McCune

@kiBytes I'll give you a TL;DR - Management will insist that things are measured, the measures proposed will either be ungatherable or they will be gatherable but not representative of the real state of security. Once implemented they'll be gamed, especially if tied to salary increases/bonuses :)

AviD

@RоryMcCune thats why setting the right metrics is so tricky, and yet so important.

Rоry McCune

@AviD the problem generally comes where management won't accept that for some things it's really not possible

AviD

11:35

exactly, then those are the wrong things.

Rоry McCune

"metric: decrease the number of IDS alerts" --> "action: removed noisy signatures from IDS even if they might indicate a breach"

"metric: decrease number of security incidents" --> "action: reclassify things as other than security incidents"

AviD

f.e. when I do an SDL project, one of the big deliverables is setting metrics. albeit for development security, but still. and yeah, its one of the most tricky bits of the project.

Rоry McCune

@AviD thing is for me most metrics fail when they run up against humans or are used for performance evaluation

AviD

@RоryMcCune hehe, yeah, this one always makes me laugh and grimace.

we are secure by definition!

Terry Chia

@LucasKauffman Probably, I think the graphics chipset is HD4000.

Rоry McCune

11:38

saw it in the UK with the banks. they gave bonuses based on counter staff selling things --> result: counter staff mis-sold lots of things and banks got massive fines

AviD

@RоryMcCune right. they should definitly NOT be used for performance evaluation, except for the company's performance.

at most, it highlights the need for e.g. more training.

and the humans involved should be interested, not actively working against it.

Rоry McCune

@AviD sure, but tell that to management who don't understand what their staff do, it's the easy way out, give them some nice measurable metrics...

AviD

of course, once you remove the evaluation, you go a long way to that.

@RоryMcCune yeah. I mean, I have told this to them, but most times they just dont get it.

Rоry McCune

@AviD so what metrics do you typically recommend for SDL projects?

AviD

'course, the ones that DO get it, succeed in implementing the SDL a hell of a lot better.

usually start with the simple ones, e.g.:
1. number of security bugs
2. impact of security bugs
3. time spent fixing security bugs

later on, we can add things like "window of vulnerability" (i.e. how long a security vulnerability was in production).

Rоry McCune

11:41

@AviD of course with that one as they get better with component inventories the stat will get worse...

AviD

those first 3 are actually more aimed at the Dev managers, than security - they want to see ROI on security efforts, this gives it to them in a weighted fashion.

@RоryMcCune right. the first set too, if they haven't done proper measurements till now...

I do always preface the whole shebang with "it's gonn' get worse before it get's better."

Rоry McCune

@AviD ROI on security <shudder> , I understand why people want that but I always prefer to think of security like insurance or health and safety

Terry Chia

Okok, enough about boring security metrics stuff. Let's bash on PHP.

AviD

@RоryMcCune yes, sometimes that is necessary - for security folk, and CIOs. R&D managers, on the other hand, want to know that their programmers are spending their time well, and making as many features as they can.

if they working on not-features, they need to know the cost/benefit.

Rоry McCune

@TerryChia wait till you work in a corporate... then you'll thank us for making you cynical about these things before you encountered them...

AviD

11:44

hahaha

Rоry McCune

@AviD seriously it took me some years of going through the processes in big Co's before I worked out that it was all shite and you just had to play the game

AviD

well... I still believe there is a core that is NOT shite. it just usually does not exist, and when it does its hard to find.

Terry Chia

Huh, I didn't know python had semicolons.

Rоry McCune

@AviD oh not to say that performance appraisals/development plans/staff improvement can't be done well, but I've never seen it in a company of over 1000 staff

AviD

@RоryMcCune and in the rare case that it is, its because a single department was able to be run independently (so effectively its not a big company). And yes, I agree.

but it has more to do with the douchebags and incompetents that run the henhouse, than with any actual constraints.

It could be done well, it just isn't.

Rоry McCune

11:53

on an entirely different not did you see the latest video from Scott Bradlee?

►

I've no idea who Jason Derulo or "2 chainz" are but this versions good

Adnan

@tylerl and that's from my work place's balcony. Just now.

TildalWave

Oh noes I'm in the review queue again, feels like someone sucked all our users' brains out through a straw

Adnan

@RоryMcCune Is this some cover?

Rоry McCune

@Adnan yeah they do covers of modern songs in an variety of old-school styles

I like 'em

Adnan

@RоryMcCune They're fantastic!!

@RоryMcCune Here's one cover that I really like youtube.com/watch?v=4gZydBL_SFg

Rоry McCune

11:58

@Adnan most of their stuff is pretty good...

@Adnan that is good

TildalWave

@Adnan dunno if this is original but that cover @Rоry posted is way, way better youtube.com/watch?v=RbtPXFlZlHg

Adnan

@TildalWave Oh lord! Wow! That's.. awful.

TildalWave

@Adnan indeed :)

Rоry McCune

and has 154 million views!

Adnan

@RоryMcCune In all fairness, the three of us have just contributed to that number.

Rоry McCune

12:07

@Adnan yep I shall absolve my guilt by going to listen to some other good music :)

TildalWave

-1

Q: Is it possible to create your own security updates on Ubuntu 12.04?

My main Question is: Is it possible to create your own security packages? [ NOTE: I enjoy teaching myself new skills for many different things. So please give me an answer in a 4th grade reading level. What I mean is that I won't have a clue what you're trying to tell me if the words are way to...

updates

(no comment)

Adnan

So, how many Unicoins have you guys collected so far?

TildalWave

None, I just buy that "no sidebar widget" power-up on all sites and that's the end of it. Never particularly liked April Fools TBH

Adnan

I've just adopted the SSL tag :D

Sorry, @Thomas

CodesInChaos

I see no "sidebar widget"

Thomas Pornin

12:19

@Adnan Do not worry; I would be wont to deprive you from your simple, if childish, pleasures.

TildalWave

I tried with that "cut everyone's rep but yours" one, but it didn't even change the order in the list so I recycled it. It's all gonna go away in a few hours anyway

Adnan

@ThomasPornin Here we go :|

TildalWave

you don't see this and saying how many Unicoins you have?

BTW nearly the whole SO front page is filled with css, html and js/jquery questions

that's not an April 1st prank, is it?

Terry Chia

@TildalWave Isn't that just a normal day?

Adnan

12:36

Damn it! I'm trying to "hack" the Unicoin thing. It's not that easy.

I guess I'll end up just automating the clicks.

CodesInChaos

@TildalWave all of those are about hacking unicoin

TildalWave

so you're saying some are enjoying this game so much they're trying to hack it so they won't find it enjoying anymore?

Terry Chia

This.... sounds retarded. isecpartners.github.io/passwords/2014/03/31/…

AviD

@TerryChia so does your face.

Adnan

@CodesInChaos and probably all from me

Terry Chia

12:46

(It's a joke btw) :P

Adnan

@TerryChia Dude.. it says 'smart'. How can it be retarded?

Rоry McCune

13:20

@TerryChia so you going to try and blag your way into Syscan then?

Terry Chia

@RоryMcCune I'm already a volunteer. :)

Rоry McCune

@TerryChia nice! so no blagging required

Terry Chia

They are very nice with exchanging labor for passes. This will be my third year helping out already.

Rоry McCune

looks like a cool line-up

Terry Chia

Yeah, many great speakers this year.

Rоry McCune

13:24

the training line-up looks good too, though not exactly cheap!

Terry Chia

@RоryMcCune Oh yeah, I think those are definitely "convince $EMPLOYER to pay" prices.

TildalWave

And let me guess, that OS fell from the skies, right? Please, get to grips, this question is way, way above your abilities and you're giving an uninformed advice that can be potentially dangerous, if anyone took it for granted. Controller chips can be manipulated and reserved space accessed. On certain memory chips (such as MLC that are now most often used due to affordability and storage space they offer), even multiple write operations on a single cell can be read back with specialized hardware. It's a bit like multi-layer optical disks where user can only access the top layer. — TildalWave 3 mins ago

I'm again ended up arguing with 8-year olds over bad advice... back to Black Sails :)

Rory Alsop

Do we think the question itself is a dupe of one of the two Bear linked to?

Lucas Kauffman

13:42

@RоryMcCune Isn't that the whole reason they want people to have an investment profile before banks are allowed to sell products to them?

Rоry McCune

@LucasKauffman that would help for some thing but the big mis-sell of the last couple of years (payment protection insurance) would likely still have happened

that was an obv. scam anyway, with the commissions they were paying it was plain that the product wasn't right...

TildalWave

@RoryAlsop hmmm not exactly, those are about SSDs and this one is about a Flash card (the difference being in simplified architecture and power constraints to rewrite a cell)

Lucas Kauffman

@RоryMcCune yea indeed, I think investment banking for the common person will be a lot more difficult to get into, banks will also have a harder time selling high risk products on one side, which imo will lead to reduction of the interests on savings

Rоry McCune

@LucasKauffman ya know I hadn't made that connection but good point.

There's another scam brewing in the UK but I don't know the source. Some products where you put a regular amount into an account are attracting much better interest rates even if you just cycle the money from one account to another

I've heard that bank staff actually advise people to shuffle money around to get the rate

AJ Henderson

so am I the only one a little depressed that the number of coins on each rock of the unicorn thing is server side?

CodesInChaos

13:48

List of password hashing competition candidates is now available (24 total)

@ThomasPornin submitted one, I didn't

Lucas Kauffman

@RоryMcCune Something they tried to do to sell me was a type of house saving where you get a nice interest and which can be used to pay your life insurance when you get a house. They give a massive interest on the savings on one side, but you are vendor locking yourself in on the other because no other bank will accept the savings account (which you can only use for getting the life insurance) at a lower rate. So basically they will recuperate everything once you get a mortage

@RоryMcCune there are some really bullshit saving products at the moment

Rоry McCune

@LucasKauffman yeah anytime a bank offer seems too good,... it is

Lucas Kauffman

@RоryMcCune It's the same with one of my new savings accounts, it gives me 1.5% interest, but I can only deposit 6k a year

AviD

...aaaaaand.... its gone.

just gone.

Rоry McCune

@AviD what's gone?

Lucas Kauffman

13:51

@RоryMcCune one thing banks can't do anymore though is invest savings money into high risk products :p

AviD

all your money. its just gone.

Rоry McCune

@AviD heh

Terry Chia

@LucasKauffman His youth.

AviD

►

Lucas Kauffman

@AviD I should have putten a bag of gold around my neck

Rоry McCune

13:52

@TerryChia wrong reply. and thanks for that you young whippersnapper

Lucas Kauffman

@AviD southparkstudios.com/clips/155015/jew-gold

AviD

:-)

Lucas Kauffman

anyway enough rant about the banks and how life is treating us bad because we can't afford to get that new android phone. In the end there are tons of people who are off a lot worse than us here

like @Simon

Thomas Pornin

@CodesInChaos Yeah, now I have some work looking at all of them to see what they do and how they do it.

Do you intend to try the reference code from all ?

AviD

@RоryMcCune @LucasKauffman cracked.com/…

Rоry McCune

14:00

The UK's latest bank dick move is denying people the right to withdraw money unless the provide evidence of what it's for

Apparently for Money Laundering reasons...

AviD

WHAT.

hookers and meth, now gimme my damn money.

5

Rоry McCune

yeah bank does that to me, there'll be one more transaction on my account, the one where I move to another bank!

Lucas Kauffman

@RоryMcCune what bank are you at now?

Terry Chia

@LucasKauffman No, you got it all wrong. @RoryAlsop is the one working at a bank. :P

Lucas Kauffman

@TerryChia you troll

Rоry McCune

14:06

@LucasKauffman with Intelligent Finance for now (you won't have heard of them ,worked for them back in 2000 when they had the first on-line offsetting account), about to move to First Direct (part of HSBC)

netsparker.com/blog/…

AviD

IF they approve the transfer.

Lucas Kauffman

@RоryMcCune I know HSBC

Terry Chia

@RоryMcCune Heh, now every pentester has a reason to get one of those.

Rоry McCune

@AviD should be ok here they basically want to shut that brand down and they've been getting increasingly keen to get people to move off it

Terry Chia

How is this an achievement?

Rоry McCune

14:09

@LucasKauffman yeah but not Intelligent finance. Interesting trivia for you, several of the screenshots in the Web App Hackers Handbook are early versions of the IF web app as the authors were on the team that tested it...

@TerryChia well if you're a tester that's an achievement..

AviD

XBox is so heavily gamified, you get an achievement for creating an account.

and another one for changing your name.

oh damn. Just realized, thats an april fools joke, isnt it.

Terry Chia

@AviD Heh.

AviD

Wouldnt have put it past them, to actually do it. IF there was some compelling benefit.

they are definitely a fun group.

Terry Chia

Someone should pitch it to pwnieexpress actually. :P

Adnan

@TerryChia What's that?

Terry Chia

14:18

@Adnan Click Rory's link.

Adnan

@TerryChia Whoa! That's cool!

Stack Exchange

Every choice, no matter how small, begins a new story.

Terry Chia

^ Isn't this a repeat?

CodesInChaos

That's 1349, not 1350. Today's is some javascript app, perhaps it confused the bot

TildalWave

@TerryChia yup, same in other chats

oh, not the same? well it looks the same here ...

Terry Chia

14:33

It looks exactly the same on the xkcd site for me as well.

The mouseover text is different though.

CodesInChaos

enable javascript

TildalWave

I have, doesn't do anything with that Bernardo.comic() ...

CodesInChaos

for be today's xkcd is collaborative story writing

pick existing captions or write your own

AviD

@TerryChia probably caching. It's always caching.

TildalWave

OK found out what's the problem, it won't work via HTTPS

Terry Chia

14:38

Ahhhhh, neat!

AviD

ahhh, its one of those interactive ones.

TildalWave

oh dear, not the 2048/4096 again

AviD

great. we have to sit around clicking all possible options now, for the next 45 minutes.

TildalWave

or... don't

AviD

yeah, right.

you're talking crazy now.

Adnan

14:43

UNICOINS!!! MMMM

I'm buying everything!!

Oh yeah!

CodesInChaos

@Adnan That's not even half a skeet

TildalWave

@Adnan F12, magnifying glass icon, hover over the number and click, doubleclick on it in the elements tab, enter any you like (no unicoins required)

Adnan

@CodesInChaos Yeah, but that's more than double a @Thomas

@TildalWave Whoa!! You can do that?!

TildalWave

@Adnan I know, crazy huh? Such skill!

Adnan

@TildalWave I changed my rep to 1 million. Can you see it now?

Or does it take some caching time to appear for everybody?

TildalWave

14:49

@Adnan all I can see is your ugly mug :))

Adnan

@TildalWave Yeah, it must be the caching.

and my mug isn't ugly!! It's amazing!

At least, it was amazing.

It was broken 6-7 years ago.

Terry Chia

Am I seeing this right? issues.apache.org/jira/browse/INFRA-7524

Apache is moving Subversion development to git? That's ironic in every sense of the word.

Adnan

@TerryChia April's fool!!

TildalWave

Adnan

@TildalWave Ahaa!! I see. So it's done propagating. Fantastic.

Terry Chia

15:01

> At least is isnt implemented in a dialect of x86 assembly that happens to also be a valid perl program.

Best comment ever.

TildalWave

@TerryChia someone was reading code golf posts

AviD

okay, today's xkcd is unsatisfying.

Adnan

@AviD To be fair, you're generally unsatisfied with everything.

AviD

pfftt.

that joke, for one, was particularly unsatisfying.

Adnan

github.com/apache/subversion

Thomas Pornin

15:09

@Adnan Subversion source code managed with git ? It does not catch fire spontaneously ?

Terry Chia

95

Q: Why can't my program compile under Windows 7 in French?

I'm running Windows 7 French and I'm trying to compile this really basic program, but Visual Studio is being stubborn and refuses to comply. I also tried compiling it with both GCC 4.7 and Clang trunk on Coliru and I get more or less the same errors (output is below the code), though I think Coli...

c++ visual-studio-2013 french

> Cryptography didn’t change much since 1976, when the idea of public-key cryptosystems was first introduced. Whitfield Diffie and Martin Hellman did only half of the work: we have discovered that by making public both the private and the public keys, we would remove the need for digital signatures or TLS. Several government agencies support our work in the domain.

blog.oauth.io/oauth-3-0

TildalWave

15:33

@TerryChia why is that closed as off-topic, yet all the top rated answers clearly show that it is on-topic?

Thomas Pornin

@CodesInChaos Well, that's good: only one other candidate (Catfish) tried to provide a "shortcut" method (faster hashing with a specific secret) and it does not go far (apparently only a 4x speedup).

Makwa is the only function which goes beyond that. It is also the only one to provide delegation.

I am now in the comfortable position of being alone in my category.

That's how Whirlpool got NESSIE's blessing, despite being bloody slow.

Adnan

@TildalWave Because it's an April Fools question.

TildalWave

@Adnan so?

Adnan

@TildalWave Dude! It's not a real question.

TildalWave

@Adnan I realize that, as should anyone that actually read the question. But April 1st isn't over yet, is it? So why hurry with close votes?

Downvote cause I am French !! — log0 2 hours ago

hehehe

it's a pretty funny thread, I got a few giggles out of it

Adnan

15:41

@TildalWave Alright, I actually agree. In the context of April Fools, it's on-topic.

Iszi

@TildalWave "April 1st isn't over yet" is dependent upon your GMT offset.

TildalWave

@Iszi the question is clearly about French language, which means pretty much all the timezones there are :P

and if you look at some answers, you can find same names in the close votes, for example

> You cannot use French keywords in a C++ (or C) program

fails to get it, and it's also false, you can always #define around it

Thomas Pornin

@TildalWave Technically, with a #define you get a macro, not a keyword.

TildalWave

hmmm, which language is the most globally represented? I mean, officially exists in as many time zones as possible?

@ThomasPornin well yes, but it can do the trick in this case

CodesInChaos

@ThomasPornin Delegation seems cool. I don't really see the point in shortcuts yet.

Xander

16:01

@TildalWave I think English has a pretty good shot at that title. en.wikipedia.org/wiki/…

TildalWave

@Xander looks like it yes, French isn't so well represented in Asia en.wikipedia.org/wiki/File:New-Map-Francophone_World.PNG

CodesInChaos

@TildalWave How cares about official languages?

Thomas Pornin

16:23

@CodesInChaos Shortcuts can be useful for some systems where the database is shared between trusted and less-trusted frontends.

It also helps control-freak admins who want to crack users' passwords but are not good enough to hook into the password entry GUI.

CodesInChaos

doesn't sound too useful to me, compared with simply computing two different hashes or encrypting passwords with public key crypto

Thomas Pornin

16:39

@CodesInChaos Anyway, the "shortcut" thing was part of the properties listed as desirable by the call for submissions, so I provide.

Do you think delegation would be cool enough to warrant a presentation at PasswordsCon ?

CodesInChaos

17:25

I don't have much conference experience.

To me it certainly sounds like one of the most interesting features introduced during the competition

Ladadadada

17:55

I have a feeling SkepticalScience will be looking for a security consultant soon. skepticalscience.com/widget-hacked.html

Adnan

@Ladadadada You should volunteer. We wouldn't want them seeking the advice of "security experts" such as myself.

Rоry McCune

@Ladadadada X Server live on the Internet, I've not seen that in a while...

Ladadadada

@RоryMcCune X11 running on a server. I haven't seen that since we fired our lead developer.

(I'm kidding. He got poached and it was a dev server... but still.)

Rоry McCune

@Ladadadada unfortunately I'd like to say I've not seen that recently, but the number of people who do default desktop installs of Linux on servers....

CodesInChaos

@RоryMcCune Sounds like something I'd do :)

TildalWave

18:10

@Ladadadada I first thought it's just an april fools joke

Kitten Sneezes and Cow Farts are properly legit units of energy :)

Thomas Pornin

18:35

@TildalWave However, Cow Farts also contribute to greenhouse effect (exact amount is subject to dispute, though, because the one widely quoted figure of "15% of all greenhouse effect" comes from a study sponsored by anti-meat vegetarian groups, whose scientific independence is questionable).

Lucas Kauffman

@RоryMcCune can't imagine testing an application and then writing a publically published book about it :p

@TildalWave did you enjoy black sails?

Rоry McCune

@LucasKauffman well the book wasn't about that app, but they used screenshots from it. 99% of people wouldn't have recognised them but I was the IT security Analyst at IF when it launched so recognised them straight off...

Lucas Kauffman

@RоryMcCune what did you tell them :p?

Rоry McCune

@LucasKauffman haven't actually mentioned it to them

Lucas Kauffman

xD

TildalWave

18:44

@LucasKauffman it's watchable :) of course, everyone is way too good looking and have a complete set of shiny white teeth and speak softly ... but the boobies are nice and it has some other moments :D

Adnan

0

Q: I discovered multiple secuirty vulerbilities with Stack Exchange. How to proceed?

While testing Stack Exchange sites, I discovered that if you used specially-crafted HTTP requests, you can actually post any kind of question, no matter how ridiculous or off-topic. There seems to be a bug. For example, you can easily post programming questions on Physics.SE, or religious questi...

penetration-test http csrf

I was thinking about since this morning, but I didn't get time to write it. Too late, I guess.

The more I read it, the more cheesy I find it. Hmmm

Lucas Kauffman

Even at 101 rep, I am still awesome. — Thomas Pornin 47 secs ago

3

Adnan

19:04

@Lucas Bitcoin minor! Of course! +1 by the way

Oh, how. Somebody voted to close as "breaking the security of specific system". I feel that's @Gilles

Payback :(

Lucas Kauffman

@Adnan It was me

as it is kind of :p

Iszi

19:17

@LucasKauffman C'mon, just use the custom close reason and say what it really is.

Xander

@Adnan voted to close and upvoted. That should even it out, I think. :-)

TildalWave

> Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

Falcon Momot

19:34

@TildalWave well yes. note the date :P

TildalWave

@FalconMomot inorite?

Iszi

@Adnan Voted to close as PEBKAC. Now we just need one more vote on that, or a close reason not yet chosen, to make it stick.

3

TildalWave

someone should write a rant answer before it's closed tho, say in the line of "It's exactly people like you that are the problem, not the websites you hack! Have you no shame?" :))

Iszi

Wow. This got flagged as Spam/Offensive?

Xander

Pro tip of the day: If you change a Base64 encoded form value, or a Hex-encoded cookie value to an arbitrary string and it results in an error, that is not called a "security vulnerability." It is called "being an asshat."

Iszi

19:40

I... don't see what the problem is there.

TildalWave

@Iszi Where? Let me guess .... Maths.SE? Someone flagged as offensive someone using the word "porn" in one reply just the other day.

Iszi

@TildalWave Didn't note the site, and the flag got handled before I could counter it.

@RоryMcCune No, make that marketing.

Adnan

@TildalWave You're an assole

TildalWave

@Adnan hehehe

Xander

@TildalWave Boo! I'd just finished scrolling all the way through a 233 page PDF, and I come back to the site to find that.

TildalWave

19:58

@Xander hehehe sorry!

Xander

@TildalWave :-P

Transcript for