@RoryAlsop there's quite I few I didn't know . interesting that they even go in for different languages as well, not sure I've heard american rap translated to yiddish before!
@RoryAlsop yeah for what it is it's pretty cool, only thing is it's laptop grade CPUs
@AviD hmm well I see where he's coming from the insistence on "write all tests first" feels OTT but then I'm not a proper dev. it has caused quite a backlash on him/rails though
the TDD/BDD crowd are quite vocal
also for big/complex codebases in dynamic languages like rails test coverage is definitely very important
@AviD interestingly on that topic have you seen the BDD-Security stuff?
@AviD yeah I know it's the tests first then code thing that I though he wasn't too fond of (admitedly I've seen more of the chat around it than the actual preso :)
I'd like to suggest that "TDD works" because of cognitive dissonance.
Same as any dubious claims made by adherents.
Don't get me wrong, TDD does have its place - a substantial refactoring would be foolhardy without it, for example.
And there are many examples of non-trivial methods, that shoul...
What I mean by this, is that sometimes architects look to simplify and improve testability, at the expense of other important forces.
For example, I'm reviewing a very complicated application, made so by extensive use of design patterns that overly favor testing, e.g. IoC, DI, AOP, etc...
Now...
While this may not be what you were asking, it might help. Your kid is clearly talented, and more to the point is obviously bored. Point her at the Certified Ethical Hacker qualification, it will take her mind off mischief and will set her on a decent, challenging and respectable career path doin...
@RоryMcCune or maybe you just found the secret code to pass you through to the real techs - the ones with the cargo pants and a subway map on their wall.
Maybe a stuffed penguin and a poster of some bearded dude.
the funniest part is when they put me on hold, then come back 10 minutes later and tell me there is a problem with my router, since they can't log in to it.
After I've explained to them that I have my own router behind their modem.
and they need to know all the versions of everything I have, to fix the problem on their end.
@gnat sure, let's take you as an example - do you believe that basing your design on some testing requirements is a good design, and that it works? — AviD35 secs ago
@LucasKauffman you raise a good point. If I incapacitate you, you would just have even more free time, laying in bed, to just answer even more questions.
@RоryMcCune morning rory, just setting everything up and getting up to speed on everything. I suppose I'd better get good at this security stuff quickly then :)
@ColinCassidy don't worry I can let you in on the secret now you're one of us. insist that all security controls are set to the highest possible level (don't do risk analysis) then if they don't take your advice and get pwned it's all their fault :)
@RоryMcCune not sure what my travel arrangements are at the moment, but I'll try and swing by. If nothing else it'll be an excuse to go and see Eireann again.
@Adnan you'd be amused at the number of networks I test where they have strict filters on things going in and out of the DMZ but totally forget to ban drive mapping over RDP....
@TerryChia good hopefully it enters the annals of clueless things to do :) vodafone actually seem to have gained a clue since last time I logged in there...
@TerryChia Hello. Regarding your HKDF question, I am not aware of any major protocol which uses it. However, HKDF was defined to serve as a kind of guideline for new protocols.
Meaning: if you define a new protocol and need a KDF, use this one, it has been declared "fine".
Although I have recently defined two protocols / algorithms which needed a KDF and do not use HKDF.
I've been looking for a place to sell 0day's.
I have been going through all known DarkNet Marketplaces, but didn't really find anything.
Does anyone know a marketplace, or a website where you can find brokers?
@LucasKauffman heh yeah VA scanners can definitely do that, especially on web apps (time based SQL injection testing does bad things to apps with one connection to the DB...)
@RoryAlsop customer thought a breach was pentesters.. don't remember that one but then I'm old so forgetful (thought I'd get that one in there before @TerryChia or @LucasKauffman did)
@Adnan Hey careful, people might not recognize the snark. Someone once took my comment about Google hiring thousands of people sitting in front of computers to snatch up domains seriously.
BTW all if you like Oreilly Books, their eBook line is 50% off and if you buy books whos original (not discounted) cost is over $100 it goes up to 60% off...
@TerryChia I do agree with you but the cost difference is nice with that kind of discount. My general problem is that I'm too easily distracted from eBooks, where pBooks I can sit away from the Internet/computers...
@RоryMcCune The only technical book I have on my kindle is the entire Subaru Forester maintenance guide. A good couple of thousand pages - but easily navigable on here. Would be nightmare in paper
@Iszi The city is called "Québec" and is located in the province called "Québec". English-speaking people often get confused about it, and insist on calling the city "Quebec City".
@ThomasPornin I understand, hence the initialisim QC. The problem comes when you say QC City - it's like saying "Quebec City City".
Similarly, NYC City = New York City City / ATM Machine = Automated Teller Machine Machine / PIN Number = Personal Identification Number Number / IDS System = Intrusion Detection System System, etc.
I don't think it's really a 'problem', it's just helping be less ambiguous, especially when the acronym could have another meaning in the given context
@ThomasPornin See, and any time the French get involved in making initialisms for an otherwise-English-speaking audience, the results are all jacked up.
@ThomasPornin Ok, fine. Whatever. Perhaps the point doesn't apply for this particular case but I believe it still stands in general. Case in point: UTC.
The "UTC" acronym was chosen precisely so that it does not exhibit any local bias: it is the "wrong acronym" in all languages (and that was the point).
@ThomasPornin Dunno about all languages, but definitely French & English. And if the French weren't involved, we'd have an acronym that more closely matched what a larger majority of the world's population would expect.
@ThomasPornin My point being is that English speakers, by far, constitute a larger amount of the world's population than French and yet French have had a strong influence in the formation of certain initialisms that are used internationally.
Then again, if we really go down that road, it could be argued that everyone should be putting their acronyms in Mandarin.
@Iszi French is the diplomatic language because it has the needed precision. English sucks for diplomacy.
("from occupied territories"...)
French is also the international postal language because international post was invented by French and they were damn good at it back in the day (it was long ago).
Nowadays we use English as the "lingua franca" because it seems that while most people in the World can learn a second language, many English speakers seem absolutely incapable of it.
3
But we must still talk to them because they have a lot of nuclear warheads.
@RоryMcCune The historically approved method of setting a default language is by taking control of the administrative apparatus of the biggest conqueror.
@RоryMcCune That's how China speaks Chinese -- Mandarin chinese.
In particular when Mongol Emperor Kubilai (grand-son of Temujin) pacified China and then absorbed its administrative structure, by which he basically surrendered his core mongolity to the Chinese.
I've fully de-obfuscated the code, just for fun.
First some comments on the naughty side of the code. Use of the @ operator is applied to almost every function call. This will suppress warnings that could be generated by the code, so helps to keep it hidden from sysadmins who regularly check the...
> We found two years ago a memory disclosure vulnerability in the OpenSSH server which allows to remotely extract data from the sshd server's children processes memory zones.
This vulnerability exploits a bad check on the network layer of the sshd server that we trigger to retrieve all children processes memory sections thereby allowing us to dump: - system users hashes - keys - many random things ;)
@RoryAlsop true it's a nice model though (assuming there's no hidden nasties) lets me pledge small amounts in return for content (makes up for my adblocking youtube) and if even 1% of their viewer base do it, they'll be sorted.
Poor timing on the team's part because just as I was getting to understand things well enough to start doing the proper security stuff one of the guys dropped health stuff so I was reassigned to pick up some of that stuff.
@LucasKauffman So far yeah. Pretty good group of guys, nobody's really a blocker for any changes. It's just a matter of figuring out exactly what we need to do and doing it.
@LucasKauffman He's asking for 20 Bitcoins, that's about $9000 too low for a one-time sale, and just the perfect amount for a high number of motivated parties.
Selling it to interested parties (including governments) would be around 30-60x that price.
<excited> new server bits have all shipped so will hopefully get it built this week. Now the only question is lxc, docker, kvm or ESXi for virtualization
well I have a specific case (running multiple rails apps for a tutorial). So I could use lxc or docker (Which was a wrapper round lxc AFAIK, but now uses libcontainer) or I could go full virtualization with kvm or commercial bare metal virtualization with ESXi
or I could just run multiple instances of the same app with rails
there are pros and cons to each approach
lxc/docker, nice easy but the networking looks painful
@Adnan well that's their chat. idea is that you're using a lot of stuff in the kernel in common, so save a lot of memory that way. Not sure about the reality of it of course.
I ran into someone using it what will be their prod env the other day...
I've been looking for a place to sell 0day's.
I have been going through all known DarkNet Marketplaces, but didn't really find anything.
Does anyone know a marketplace, or a website where you can find brokers?
