The DMZ

tylerl

02:13

Thanks to the power of ASP.NET, I was able to write and deploy a service in merely 6 hours which would have taken a full 35 minutes using Python.

Microsoft: Enterprise Ready.

Scott Pack

02:24

Huzzah!

Scott Pack

02:34

Are you fucking kidding me?

CIS released a benchmark for Ubuntu 12.04 LTS Wednesday of last week.

14.04 LTS will be out within a couple of weeks.

tylerl

03:19

@ScottPack The answer is no. I am not fucking kidding you. Or indeed either one of those options on its own.

Scott Pack

@tylerl I refuse to believe.

Oy. I have 99 answers on Sec.SE. I should find something else to put up. Get myself an even 100.

Terry Chia

03:53

@tylerl Hey, that same service will probably take you 2 days and 30 XML files in Java.

tylerl

@TerryChia And if you write it in C++, it'll take 25 minutes to compile and will have 83 remote code execution vulnerabilities that will slowly be discovered one by one over the next 18 years.

Adnan

04:57

I don't know why we tolerate this bullshit!

27

A: Does Heartbleed mean new certificates for every SSL server?

It means much more than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just superseded Changing all passwords Invalidating all session keys and cookies Evaluating the...

27

A: What should a website operator do about the Heartbleed OpenSSL exploit?

There is more to consider than just new certificates (or rather, new key pairs) for every affected server. It also means: Patching affected systems to OpenSSL 1.0.1g Revocation of the old keypairs that were just supersceded Changing all passwords Invalidating all session keys and cookies Evalua...

Same exact answer (99%) posted two times.

three times

7

A: What should end-users do about Heartbleed?

End users should just wait until their sysadmins contact them with further instructions. At some point, after your sysadmins have patched to OpenSSL 1.0.1g, expect to have to: Change all passwords Login again to all services (because all session keys and cookies need to be invalidated) Help sen...

(this one is about 85% similar)

@AviD Where are you when this crap happens? Or do we only crack down on April Fools self-flagged posts?

(Yes, I'm still pissed because of that message you left under my flag. I know the post was crap and a joke. That's why I fucking flagged it)

Terry Chia

05:25

So the heartbeat bug got rewarded 15k. That's kinda sad.

Adnan

@TerryChia By whom?

Terry Chia

@Adnan hackerone.com/reports/6626

Adnan

@TerryChia Why is it sad?

Terry Chia

@Adnan Ehh, pretty small reward for a large bug don't you think?

Adnan

@TerryChia But that's just one organization's reward. Surely, others might reward as well.

Terry Chia

05:31

@Adnan Nah, I'm pretty sure not. The IBB team is sponsored by FB and MS.

AFAIK that's the only bug bounty out there for OpenSSL.

Adnan

Plus, OpenSSL doesn't really have a bug bounty program. So, to be honest, that's not bad at all.

What I find interesting is that Neel had decided to donate the money.

Was his decision? What about the other alleged contributors?

Terry Chia

@Adnan I have a feeling that was Google's decision though. What's 15k when donating it is good PR?

@Adnan Nah, the IBB has an ongoing bug bounty for OpenSSL and a few other projects. Decent way to cash in legally if you find bugs in them.

Adnan

@TerryChia Probably paid the Finnish dudes 5k each to shut them up. #ConspiracyTheory

On a different topic, Microsoft has published the RTF patch. So, it's time to push the update to work stations and enable formatted emails again.

Stack Exchange

I looked at some of the data dumps from vulnerable sites, and it was ... bad. I saw emails, passwords, password hints. SSL keys and session cookies. Important servers brimming with visitor IPs. Attack ships on fire off the shoulder of Orion, c-beams glittering in the dark near the TannhÃ¤user Gate. I should probably patch OpenSSL.

tylerl

05:51

@Adnan You mean the people who came up w/ the heartbleed name? I don't think they actually contributed anything. It appears that they set up a website with some marketing immediately after it was disclosed and claimed themselves as discoverers.

Adnan

@tylerl Seemed like that to me. They, however, only shared their first names.

All three seem to work for Codenomicon

tylerl

@Adnan fishy

Adnan

At least according to the Internet, Codenomicon has indeed helped with this.

tylerl

Fishy as Finland in August.

3

Adnan

Here's some dude talking about the fishyness of the subject techrights.org/2014/04/08/howard-schmidt-codenomicon

tylerl

05:56

They got on top of it after the patches went out. But if they already knew about it, then why did they sit on it for so long?

Terry Chia

@tylerl Because web design takes time.

tylerl

@TerryChia the domain was registered last saturday, btw.

Jacob

07:43

@Adnan I would agree, but mainstream media never picked it up.

AviD

@Adnan haha, my message was ALSO a joke.... figured you could take it.

re those answers - do they, or do they not answer the question? And if they do - is it because the questions are dupes?

Adnan

@AviD Didn't know it was a joke. All good then.

@AviD They do answer the questions, but are we really gonna sit here and just let one user repeat almost he same exact answer 3 times like that?

AviD

@Adnan Please. If it's something hurtful, surprising, insulting, or anything I said - assume it's a joke.

Unless it's about @Simon.

deed02392

@Gilles Yep, now the company firewall won't let me access it

AviD

@Adnan my point is, if thats the case - look at the questions. it's likely they are dupes, in which case its moot.

Adnan

07:54

@AviD I mean, you guys are the mods. In most cases, are votes/flags/opinions are helpful to you. However, in this case, this needs mod action.

@AviD Then close them as dupes!

AviD

if they are not dupes, but it does answer the q - I see no problem with it, per se, though they should refernce each other.

Adnan

(or one of them)

AviD

@Adnan I just got here! havent looked at everything yet!

Adnan

Alright alright. Take your time

Terry Chia

@Adnan Old people move slowly. Give him a break will ya...

deed02392

07:56

@ThomasPornin We just upgraded to Windows 7 and IE.. 8.

AviD

if you flag it / VtC, that helps....

Adnan

But maaaan.. I'm really pissed. Those three answers are like a slap to the face. "Here you go, the same exact answer repeated three time with absolutely no effort. It's a copy from the first answer which, itself, is a copy from the heartbleed.com site. Yaaay"

I give @AJHenderson some hard time about his answer barrage, but that scuzzy lady.. she ones the #1 spot.

Terry Chia

@Adnan Not @Lucas?

AviD

it could be a reaction to all the stupid bandwagon questions on heartbleed. I feel the same.

Terry Chia

@AviD I think I asked already, can you nuke the tag?

We don't need tags for specific vulns.

Adnan

07:59

@TerryChia Apparently, now we do.

AviD

People! It's just another vulnerability in a specific package. Serious vuln, sure, popular package, of course. But this happens, and will happen again. Deal with it.

Adnan

Next time somebody asks an SSL question, I'll just re-post Thomas' canonical answer and link to it.

AviD

@Adnan @TerryChia yeah I was agreeing with you, till I saw how many q's there are there.

@Adnan that is legit, if it answers the question.

Terry Chia

@AviD I'm pretty sure most of the questions can do with dupe cleanups as well.

Although I'm too busy to flag them myself.

AviD

@TerryChia I agree. but I cant be arsed to read - and understand - them all right now, need to get into all the details first.

hopefully can do so in the afternoon, but some leads there might help.

Terry Chia

08:02

@ScottPack and other Marvel fans here, have you caught up with Agents of SHIELD yet? The past 3-4 episodes were awesome.

AviD

@TerryChia I'm a few episodes behind, but thanks for the spoilers.

Terry Chia

@AviD PFFT!

BTW, if you want to avoid spoilers, don't watch the latest one without watching Capt America 2.

I got spoiled real bad. :(

AviD

yeah I heard something about that.

Rоry McCune

The heartbleed honeypots are funny

AviD

on the one hand, its kinda cool how they tie in the different venues in the same continuity. On the other hand, as someone who doesnt go to movies often, it kinda sucks.

Terry Chia

08:10

@AviD This is the first real big tie in I think? The Thor TDW one wasn't that relevant at all.

AviD

well, other than the whole "coulson died" thing, which may have been mentioned once or twice.

Terry Chia

@AviD Ehh, you can't blame them for that. Avengers was out long before the series even started.

Heck, the blu-ray torrent for Avengers was out long before the series started.

Adnan

@RоryMcCune I need to set one of those up on my server.

AviD

no blame intended. it's what I'm talking about, cool that the series relies on the movies.

Terry Chia

Yeah, Marvel has something really good going. Guardians of the Galaxy later this year should be awesome as well.

Rоry McCune

08:13

@Adnan yeah do one that has something like [main-transaction-site=shortened_url_here] and then redirect them to something like goatse :)

AviD

read an article recently about how, even after subtracting all the characters whose movies rights are owned by others (Spiderman, Xmen), Marvel still has many hundreds of popular characters.

most in the same continuity, which helps feed and snowball many more movies.

Which was one of the main factors in the Disney buy.

Adnan

@RоryMcCune Oh come on man!

That's not cool

Rоry McCune

@Adnan what.? if people go round scanning systems with exploits what's the harm in redirecting them somewhere not nice!

(unless your exclamation was because you'd not seen goatse before and went searching for it when I mentioned it....)

in which case whoops, don't go looking for that

it's not nice

Adnan

08:28

@RоryMcCune I haven't seen it before and I don't plan on seeing it.

Rоry McCune

@Adnan good plan that man

AviD

@Adnan oh you really should. You don't know what you're missing.

Adnan

@RоryMcCune @AviD I've read other people's description about it. That was enough.

Same goes to most other Internet shock things

Rоry McCune

@Adnan if you're ever looking for a laugh look on Youtube for 2 girls 1 cup reaction vidoes

they don't show any of the content, but the reactions are v.funny

Terry Chia

@RоryMcCune You.... have a weird sense of humor.

AviD

08:34

@TerryChia He is Scottish.

kiBytes

Finally I managed my boss to buy the cobit for isec

Definitely is a good manual

tylerl

Heap allocation patterns make private key exposure unlikely for #heartbleed #dontpanic.

Tweeted by neelmehta on April 8, 2014 at 8:08 PM

I got that same idea from what I know of OpenSSL

AviD

@tylerl I got that same idea from what I know of technology. #dontpanic indeed.

tylerl

Also, this just underscores my original point that we need a language that (a) is safe, and (b) can be used to write code that you can embed into any other program without a messy FFI.

@ThomasPornin ^^

AviD

indeed.

tylerl

08:44

Did I tell you that I actually started building such a language once upon a time?

AviD

Crap. Besides the score of questions already tagged heartbleed, seems we have another pile of q's about it, without the tag.

Terry Chia

@AviD You know what we need? We need @kalina.

tylerl

LOL

AviD

@tylerl Building isnt the problem. Design + deployment is the issue.

Terry Chia

You know what a good interim step will be? Getting people to stop using the huge mess that is OpenSSL.

tylerl

08:46

@AviD The actual design is a big part. How do you do system-wide garbage collection in code that get embedded in to a c++ program?

Terry Chia

Even that's a monumental task.

tylerl

@TerryChia GnuTLS isn't much better.

So.... NSS?

Terry Chia

@tylerl PolarSSL is great as far as neat code goes.

Jacob

@tylerl I'm not sure that a single twitter message is proof of that though. Even it seems to be correct.

Terry Chia

@Jacob That guy found the damn bug.

tylerl

08:50

@TerryChia what makes it better?

@Jacob The single twitter message is from the guy who discovered it, though.

Terry Chia

@tylerl No huge #define mess, sensible error codes, much easier to read.

Jacob

@tylerl Yeah, that does add a significant amount of credibility to it, but unlikely != impossible.

tylerl

@TerryChia Yes, I can see they don't use openssl's silly STACK_OF(x) idea ... or whatever he called it.

Plus it's GPL2+, so that's reasonable. Not quite as reasonable as BSD, but you can't have everything.

deed02392

argh, I hate Vodafone

tylerl

@deed02392 And I hate visigoths.

2

Terry Chia

08:55

@tylerl It's dual licensed as well if you want to use it in non-free software and aren't a cheapass.

deed02392

they're too incompetent to serve up drivers for their own hardware on their business support page

tylerl

@TerryChia A mere €2750.

deed02392

and when I call to ask about it, they say 1: try installing in another computer, 2: oh well your IT support needs to sort out drivers

tylerl

...per product

deed02392

and now I try to have a banana to calm myself, it tastes completely bland

Terry Chia

08:58

@deed02392 TWSS

AviD

09:10

@tylerl exactly. and even generally language design is not simple.

look at PHP.

Terry Chia

@AviD I don't think an iota of design went into PHP really.

3

AviD

well, I would say half the language thats true. The other half, many iotas went in, but all unrelated.

but anyway, thats my point. It's not easy.

deed02392

10:21

Sorry that was a non-sense rant. I'm still confused and angry with Vodafone.

Adnan

10:40

@Lekensteyn How is it going?

deed02392

10:57

@Adnan He seemed to think he's done it

just sending a heartbeat request directly after server_hello

Adnan

@deed02392 He's done some nice work. Clients do seem vulnerable.

deed02392

Yeah it was said everywhere that clients would be vulnerable

I suppose the difficulty is though the negotiation is slightly different when exploiting the client

You have to wait for it to connect and then trigger the exploit at some point that heartbeat requests are valid

AviD

how does one get twitter to shorten links?

deed02392

@AviD Happens automatically

AviD

@deed02392 not for me :-(

deed02392

11:07

you can't just ask for t.co links though

Adnan

@AviD Post a long link. Tweet your twat thing, it gets shortened

deed02392

when you make a tweet or send a DM it should do it

AviD

hmm

ok thanks

deed02392

DM me the link @AviD if you like

@deed02392

Adnan

@deed02392 Well, what you've read is very likely what we also have read. It's just that we haven't seen examples of client exploits.

That's why @Lekensteyn's work is very nice.

AviD

11:08

oh dang, yeah it did. it just displays the full link.

deed02392

@Adnan Yeah that's fair enough

@AviD yeah that's right, but hover over and it's t.co

AviD

yup.

hmm, that agenda seems even more apropos now... we have a big talk on the security of SSL, at the next owaspil meeting. coincidentally this was set last week.

Hope he can pivot to include heartbleed, could make it fun.

Terry Chia

@Adnan I think that's because it isn't generally as interesting especially since most browsers aren't linked against OpenSSL.

Adnan

@TerryChia Completely understandable. All I'm saying it's nice that someone is actually testing the possibility.

TildalWave

11:37

Damn Popular Bugs

25 questions tagged with heartbleed ... really?

OK back to my coffee, maybe I'm just grumpy

Adnan

@TildalWave You are, but you're also right.

Fucking heartbleed!

TildalWave

@Adnan Well I got 55 new rep overnight because I was too lazy to actually explain my VTC reason, so I answered that OAuth and OpenID don't send around your password. So there is one good thing about it (I got 55 rep), but there's so much bad (others got more rep) that it's offensive :)

joking of course, what do I care about rep

AviD

it's offensive, regardless of rep

4 hours ago, by AviD

People! It's just another vulnerability in a specific package. Serious vuln, sure, popular package, of course. But this happens, and will happen again. Deal with it.

TildalWave

It's just funny (or offensive) that the more some bug is actually documented, the more questions it generates ... don't people read? Most of the questions about Heartbleed are actually explained on pages that people asking questions link to.

AviD

hell, I've barely read the actual documentation, and I've got a pretty good idea of what it is, just from reading the flags on those questions.

Terry Chia

11:48

You know what's funny? Just look at the damn patch. It isn't that complicated to understand.

TildalWave

OK I obviously need my coffee IV, maybe I really am grumpy and none of it even matters

AviD

even funnier? It actually has almost nothing to do with TLS, or cryptography in general. It's a standard non-validated-length memcpy bug, it just happens to be in the TLS implemenation code.

Terry Chia

Someone explain to me why anyone would think this is a good idea? pastebin.com/90uKu0Wz

TildalWave

@AviD No, no it's not that. You understand what's behind it, so that's different. But folks actually are asking about nearly identical questions that are in the heartbleed.com FAQ (and they link to there)

AviD

nah, too early to read C code.

Terry Chia

11:50

@AviD Eh, not much to do with C really. This library is generating salts by hashing the current system time.

AviD

@TildalWave because, they're scared. which is because, they don't understand it. which is because, they think it's crypto-innards of TLS.

Which it ain't.

TildalWave

@AviD Scared? You mean panicky? Scared is OK, I love scaring people. It tends to wake them up. Panicky ain't good. They cringe and lock up.

AviD

ah yeah, panic is more accurate. a subset of scared, but with different reaction.

Terry Chia

12:27

Does anyone have code snippets for a CSPRNG in C that works across Windows and Unixes?

Adnan

@TerryChia I'm not that good with C (actually, I'm not good at all), but I have used wincrypt.h and a /dev/random read successfully many times.

Terry Chia

@Adnan Was hoping someone has something copy-pastable before I write the code myself. :P

/lazy mode

Adnan

@TerryChia Here's a thing for Windows github.com/cjdelisle/cnacl/blob/master/randombytes/…

Terry Chia

Ah nice, they have a urandom one as well.

I'll just stick those between some #ifdefs. Thanks!

Adnan

@TerryChia You're welcome.

TildalWave

12:36

why, again, are we allowing anonymous users to suggest edits? security.stackexchange.com/review/suggested-edits/24262

AviD

@TildalWave to keep things interesting.

TildalWave

@AviD No, seriously, is there a reason for it? Or just to keep us on our feet and some Shog's fetish or something?

Terry Chia

12:52

Anyone used the SE mobile app?

Adnan

16

Q: Do we have stats showing that anonymous edits are helpful?

Rejecting edits from anonymous users adding "plz to help of working things" is getting a bit tiresome. I haven't had to do it a lot, but I don't believe I've ever seen an anonymous edit that was worth anyone's time, which makes me wonder if this feature has any benefit. What proportion of anony...

Terry Chia

The iOS one is pretty neat for browsing the site.

Rоry McCune

@RoryAlsop as a fan of musical pyrotechnics you might like this one.. flame-o-phone..

►

TildalWave

@Adnan that's pretty crap accepted answer there, it basically says that anonymous edits are awful but that he sees no reason to make any changes... nice conclusion, why even bother providing stats then?

Terry Chia

@TildalWave You need to relax and drink more coffee.

TildalWave

13:00

@TerryChia I'm trying :) I could use a massage tho, if you're offering :P

Rоry McCune

@TerryChia ya know coffee isn't known to relax you... herbal tea that's what you want...

Terry Chia

@RоryMcCune Or a beer or 3. ;)

TildalWave

too early for that

Rоry McCune

@TerryChia beer yep or gin, that's very relaxing

TildalWave

shuddup

Terry Chia

13:01

@TildalWave Too early for beer? Never!

Rоry McCune

►

@TerryChia you've been hanging out with those syscan types haven't you....

Terry Chia

@RоryMcCune Heh, did I mention that the last three talks of day 1 took place in a bar?

Rоry McCune

@TerryChia yeah from what I saw on twitter of that con, it's pretty boozy, even for a hacker event..

TildalWave

@RоryMcCune OK this is only annoying me more :)) ... Chrome shows the sound icon but I don't hear a thing. It works in IE tho (no, it's not my sound levels, they're fine ... never really figured it out what's going on, most work, some don't)

Rоry McCune

@TildalWave ooh application selective muting, I'd actually like that as a feature but must be v.annoying when uncontrolled...

TildalWave

13:05

@RоryMcCune Indeed.... I even tried unmuting gtalk notifications to see if that helps, because with Google you never know where they're reusing some registry settings or whatever. I've seen more awful solutions, so I wouldn't be surprised if that helped. It didn't tho, so I'm still digging.

AJ Henderson

@Adnan mistype? I don't think I have any answers on the heartbeat stuff, or did I miss some sarcasm in that?

TildalWave

@Adnan you might like "Scuzzy lady" more now:

You may also be interested in @Adnan's answer to this similar question, which also involves tricking a Certificate Authority :) — scuzzy-delta 7 mins ago

Adnan

@AJHenderson No no, not at all. It's a totally different thing. Never mind. I was joking anyway.

AJ Henderson

I figured, I just wasn't following. I haven't seen scuzzy lady's posts yet

(I tend to post early and often, but don't often check back unless someone comments on an answer)

AviD

@RоryMcCune umm, that already exists in windows?

Adnan

13:11

@TildalWave Nope, still don't like her.

Rоry McCune

@AviD ? whereabouts would I find this setting, oh great windows guru?

AviD

@RоryMcCune click the volume icon in the systray... right below the volume slider, there says "Mixer"

Rоry McCune

@AviD cool! I did not know that was there!

AviD

@RоryMcCune I'll let my 8 year old son know you appreciate his efforts ;-)

Rоry McCune

ooh muting flash, that would be tempting if I wasn't ad blocking..

@AviD hey ya learn something new everyday, and I did think that was a bit good for you to have come up with it..

AviD

13:13

tbf, he taught me that too, I didnt know about it either till relatively recently.

@RоryMcCune hahaha, you're insulting me at the same time as flattering my son? I take that as a win.

TildalWave

@Adnan Why? And how do you know it's her, not him?

Terry Chia

Calibration request: When Windows XP was released, Linux kernel 2.0.39 and Mac OS X 10.1 were current. Anyone still have support for those?

Tweeted by 41414141 on April 9, 2014 at 1:13 PM

TildalWave

@AviD OK you Windows guru, and if all the volume sliders are fine (high enough, not muted), and you hear some videos and you don't the others? Then what?

AJ Henderson

@TildalWave find better porn sites?

AviD

@TildalWave could that video not have sound? could it have its own volume setting?

@AJHenderson ha!

could it be flash that is crashing?

TildalWave

13:18

@AJHenderson :P cute

AviD

kill the process and try loading it again.

AJ Henderson

in seriousness though, I'd check the source files first to make sure they actually have audio and aren't corrupt somehow

TildalWave

@AviD Nope, there's no console errors, nothing. So my focus is now on debugging codecs

AviD

I've had flash crash my sound service. I had to kill that process, kill flash, restart the service. then try again.

AJ Henderson

and then also check if they are using different audio codecs than videos that work

you need both an audio and video codec for a video file to play back

AviD

13:19

@TildalWave you think flash always gives you console errors? How adorable.

TildalWave

@AviD that'd mean I wouldn't hear a thing in other videos as well, yet I do

AviD

@TildalWave true, okay so not that.

gimme a link, I'll try it.

TildalWave

it's just some specific format, I've isolated it to MP3 VBR decompressor now ... could be timer

@AviD that last youtube link @RоryM posted

AviD

and other youtube vids work fine?

TildalWave

or actually the most of google's pronunciation recordings

e.g. this works but this doesn't

Adnan

13:24

@TildalWave Oh it's a her.

AviD

hmm. the 2nd one is quite a bit quieter than the 1st.

TildalWave

@AviD trust me, that "bummer" one is really loud so it can't be sound volume

there's not even a hiss for the "pineapple" one

Rory Alsop

Rory - will look at that later. Currently sat in with promoters and agents discussing touring prerequisites. Oh, and first drink of the day was 1015 :-)

Terry Chia

Can I get a sanity check? I'm really sleepy right now. pastebin.com/fkXXGfq8

TildalWave

so I have ssl.gstatic.com/dictionary/static/sounds/de/0/bummer.mp3 (works), and ssl.gstatic.com/dictionary/static/sounds/de/0/pineapple.mp3 (doesn't work)

but only in Chrome

everywhere else is just fine

I think it's the mixer, because the one that doesn't work is mono, and the one that does is stereo

Adnan

13:34

@TerryChia What's the problem?

AviD

@TildalWave ah! so maybe you have the speaker balance messed up?

Terry Chia

@Adnan No problem, just wanting to make sure I don't write horrible code. :P

AviD

as in, you only hear the speaker which does not have any sound in that track.

Rоry McCune

@RoryAlsop nice!

TildalWave

@AviD only that it isn't ... it's all centered and I hear stereo in stereo, and I also hear mono on both sides in other apps, just in Chrome I don't hear a thing

so now the question is, how to access Chrome's audio graph?

Adnan

13:40

@TerryChia This doesn't strike me as horrible code (possibly because I don't know much C). However, whenever I see a call like this memcpy(rand, buf, len), I hold my balls a bit.

AviD

might it have to do anything with the difference between the HTML5 / Flash players?

TildalWave

OK that's great, I can make it play via ykifle.github.io/audiograph

Terry Chia

@Adnan The buffer is guaranteed to be len sized though because I allocated it that way isn't it?

Adnan

@TerryChia To me it makes perfect sense.

TildalWave

I just connect the source to destination and hit play, and it works in Chrome ... how can I do this for Chrome's settings now?

Adnan

13:41

@Terry Any reason you don't have an upper limit on the size of the generated salt?

I'd put something like 128 bits.

AviD

@TildalWave are you playing it in html5 or flash?

Adnan

Doesn't need to be longer than that.

Terry Chia

@Adnan No particular reason, I'm trying to replace some code in another library and I want it to be much of a drop in replacement as possible.

The library only calls it with 16 bytes though, so should be safe there.

Adnan

@TerryChia If you add <memory.h> under the WIN32, you can use memcpy_s(). I like this one.

You specify the maximum size of the destination

I don't know how to code C, so that makes me sleep a bit better at night.

TildalWave

May I ask you how many sockpuppets you have, if even your non-compliance excuse comments are getting upvotes? This is ridiculous really! -1, edit when you can. — TildalWave 16 secs ago

can someone check this one for sockpuppeting please?

@AviD HTML5

afk...

Adnan

13:50

@TildalWave No no no no

Please remove that comment.

You're in NO position to directly accuse users of that.

Ask @AviD or @RoryA to look into it

Talk to the mods about it as much as you want, but do NOT accuse users directly like that.

You're an SE mod. This makes us look bad.

TildalWave

14:04

@Adnan Heh it does? C'mon, that's a link to "there's answers that might have you covered" and it has 5 upvotes, and upvotes on comments even. Please!

Thomas Pornin

@TerryChia Mmh, there are some potential issues with your code

Rory Alsop

I can't readily check it until this evening, but moved it to comment

Terry Chia

@ThomasPornin I updated it somewhat, pastebin.com/Qd1Pmxxf

Thomas Pornin

@TerryChia First, you are using a variable-length array (stack allocated with a size obtained as parameter): this is "standard" but still does not work with every compiler, and it does not have nice failure conditions: if the length is too large, you overflow the stack, possibly past the guard page, so this could evade detection.

Also, you use #include <fcntl.h> which may fail on non-Unix systems. To read /dev/urandom, you should use the ISO C function (fopen(), not open()).

You don't check for a short read either. This is bad.

You don't check errno for EINTR, in which case you should read again, not fail.

In the Windows code, you don't close the context, so you are leaking memory.

In the Unix code you don't close the file descriptor, so you are leaking descriptors.

Terry Chia

@ThomasPornin Anything else? Thanks btw. :)

Thomas Pornin

14:11

@TerryChia Not for the moment. I won't comment on your placement of braces, which is ugly and contrary to the Tradition, but that's about aesthetics.

Terry Chia

if {
}?

Lekensteyn

@scuzzy-delta suggested to post a Q+A about the Heartbleed client PoC, is it appropriate in its current form? security.stackexchange.com/q/55249/2630

Adnan

@ThomasPornin That looks like C# braces

Thomas Pornin

@TerryChia That's what K&R use and recommend.

Terry Chia

@ThomasPornin Cheers, I am trying to force myself to write more C to understand it better. :) Any little bit of criticism helps.

Lekensteyn

14:15

Hey @Adnan, the proof is there, clients are indeed vulnerable

Adnan

@Lekensteyn Yup, I looked at GitHub this morning. Very nice work.

@TerryChia Show us how it looks after applying Thomas' advice.

David Freitag

@ThomasPornin I have always preferred the same-line-braces as well. Having braces on separate lines by themselves just seems like a waste of a line.

TildalWave

@RoryAlsop Cheers Rory ;)

Thomas Pornin

I am beginning to be fed up with all these "does Heartbleed apply to FOO ?" questions.

Terry Chia

The Bear has spoken. Time to nuke the questions.

David Freitag

14:29

I'm just waiting to hear about it on the local news

That sort of thing is usually a good laugh

Thomas Pornin

5

Lucas Kauffman

@TerryChia @Adnan wut?

Terry Chia

@LucasKauffman wut?

Lucas Kauffman

@TerryChia something about heartbleed

Terry Chia

@LucasKauffman Yeah, you are gonna have to be more specific...

Adnan

14:58

@ThomasPornin I guess we don't mind publicity, as long as it's shitty quality publicity.

Shitty heartbleed questions brings us more views = Good

Other good things that brings us more views = Bad

Uggghhh... I'm pissed.

Almost all of the regulars are complaining about this, yet the moderation team has been reluctant to even look at this.

We're still encouraging more people to ask by leaving all of the dupes open, leaving shitty answers laying around, etc.

I don't mind a revolution lead by @Thomas at this point.

2

Lekensteyn

What would be the best canonical answer for questions asking whether an unrelated part of OpenSSL is affected? For questions such as:

0

Q: PHP Apps and the HeartBleed bug

I built an app that generates Certificate Signing Requests using the PHP OpenSSL Module. Is there any way that the HeartBleed bug can affect these (in use) private keys and CSRs that were generated while OpenSSL 1.0.1e was installed on the generating webserver?

php openssl heartbleed

Thomas Pornin

The Canada Revenue Agency has just stopped its online services because of the Heartbleed bug.

Adnan

@ThomasPornin Obliviously because it's safer than patching the issue.

Iszi

@Adnan No, it's probably because it's a government website and there's 20 miles of red tape to go through before the patch can be pushed - so they'd rather have it down than up while it's un-patched.

Though, strictly speaking, a site that's not up can't be exploited at all so it really is safer to shut it down than to just patch a single bug.

Adnan

15:23

Some times, the news in Finland is just ridiculous yle.fi/uutiset/emergency_calls_possible_without_a_sim_card/…

Rоry McCune

@Adnan so they're saying that they made successful mobile phone calls from areas with no mobile phone coverage ?!? (or am i reading it wrong)

deed02392

15:45

That sounds like what they're saying @RоryMcCune

Makes me wonder if what was lost in translation was something like, YOUR network provider was out of range but another provider was

You know, when sometimes your signal quality is really low and it says emergency calls only, I think that's because you're actually able to contact say Orange when you're really only a Vodafone customer. So Orange's masts will allow you to connect to make an emergency call

TildalWave

@Adnan pissed or pissed off?

one is drunk the other is bloody annoyed ;)

tho you can be both

Xander

@Adnan If all the regulars were indeed having an issue with it, then (we) should be closing the dupes. We're not helpless here.

TildalWave

@Xander Man, I've been in the review queue since I woke up and it's still not empty ... help wanted!

Xander

@TildalWave It is empty for me.

I have 15 reviews from the close queue so far today.

TildalWave

I also hate that we can't vote on questions within the close review queue any more so it's slower because there's so many that really, really need to be clearly shown to that we're not interested in how hard they find reading

Transcript for