The DMZ

Gilles

01:47

It's not. get_key asks for a password, calls a C program (xor) with via stdin (but the password is in memory). The C program returns the xor of the key and the keyfile it reads (and I don't think he even has all the keyfile in memory). Which is piped to cryptsetup. In short decrypt device means promt_password | xor keyfile | cryptsetup luksOpen -d - device. I don't think it will ever be all in memory, or at least not in the part of the process I control. — xavierm02 14 mins ago

double facepalm, in fact: for somehow thinking that the key isn't in memory, and for rolling his own crypto

Rory Alsop

06:48

@Xander - that's a weird thing to start the day with...

Stack Exchange

Trains rotate the Earth around various axes while elevators shift its position in space.

Terry Chia

09:39

This is really interesting. securityblog.redhat.com/2014/05/07/…

ack__

10:10

Hi all, can someone explain where you vote for QOTW ?

I keep receiving those notifications but can't find where actually vote..

AviD

@TerryChia Huh. Is Red Hat still around?

ack__

@TerryChia: do you know of a practical successful exploitation case of that over network, local or internet ?

Adnan

10:42

Finnish news agency is at it... AGAIN! yle.fi/uutiset/…

Apparently, according to Microsoft, the Finnish language provides a layer of security to information services.

Adnan

11:03

@RoryM Seen this? appseceurope2014.sched.org

Looks quite neat

Oh, Twitter says you have seen already

Rоry McCune

11:17

@Adnan as the social media officer for the conference ( :op) Indeed I have, neat isn't it!

Lucas Kauffman

@RоryMcCune Social Media Officer :p

SMO

Rоry McCune

@LucasKauffman I volunteered to be tweet monkey. As I'm a sad addict anyway it helps justify my time on the site :)

Lucas Kauffman

@RоryMcCune "Can't you see I'm working here?"

xD

does that mean you do overtime when you visit facebook at home :p?

Rоry McCune

@LucasKauffman hmm not sure I'll be able to persuade the missus of that one... might be worth a try though!

Lucas Kauffman

@RоryMcCune hey you are putting the cat's food on the table, she can't complain!

Rоry McCune

11:23

@LucasKauffman Also I'm promoting her talk as she's one of the presenters at the conf.

Lucas Kauffman

@RоryMcCune even better

@RоryMcCune you're the victim here!

AviD

@RоryMcCune how many do you expect to show?

Rоry McCune

@AviD her talk or the whole conf?

AviD

@RоryMcCune conf

havent gotten down to her talk yet, long schedule! :)

Rоry McCune

@AviD well the chat on the site is 400+, so I guess we'll need to see :) there's lots on and it's a good name, so hopefully attendance will be good

AviD

11:30

excellent

Rory Alsop

Afternoon all

21

Q: Requests for Question of The Week blog posts

Since starting the Security Stack Exchange Blog on 15 July 2011 we have some excellent blog posts, and a large number of these are from our Question of the Week posts. Going forwards, it is probably simplest to post your favourite Questions of the week as answers on this question, and vote for yo...

AviD

@RоryMcCune nice, I know quite a few of those names there :-)

Rory Alsop

@M'vy - I see you still have a draft blog post on ISO27001.... hint

Rоry McCune

@AviD yeah there's some good names on the list for both the trainings and talks...

AviD

@RоryMcCune hmm, problem with that site is you cant see all the speakers at a glance, unless you hover

Rory Alsop

11:34

@RоryMcCune I see Marion is speaking. Are you not?

AviD

oh duh, you can click "Speakers".

Rоry McCune

@RoryAlsop I'm on the conf. panel for talk reviews so it felt like a bit of a conflict to submit a talk :)

AviD

@RоryMcCune meh, we do that as standard here ;-)

we just refrain from voting on ourselves, and trust the others to be mature and transparent enough.

Rоry McCune

@AviD the system we had let me put myself down as a "conflict of interest" for marions talk so I didn't have to vote on that one :)

AviD

is there no abstract or description for each talk?

titles only go so far in helpfulness...

Rоry McCune

11:40

@AviD yeah that should be coming Real Soon Now :)

hopefully to the sched site and the main site..

AviD

I like that site. Might try to use it next time here.

not cheap, though.

probably wont have budget for fluff like that...

I would love to be able to make this years conf more "global-ish", multi-day and pull international crowds.

unlikely though...

Rоry McCune

@AviD no though quite shiney...

BTW the Javazone people are having fun with conference movies again....

2014.javazone.no

Adnan

12:02

@RоryMcCune Whoa! Didn't know that.

Great job on the tweeting

Rory Alsop

12:46

@RоryMcCune do you want me to ping spelling mistakes your way...? ;-P

hint - look in the first pink box here: appseceurope2014.sched.org/list/descriptions

ahem, sorry - my proofreading genes kicking in

AviD

that's not a spelling mistake, they are actually going to be doing the registration on easy chairs.

Rоry McCune

@RoryAlsop actually Justin Clarke is your man for those, I already sent him one :)

Rory Alsop

@RоryMcCune hahaha - right, off to wind Justin up then

Lucas Kauffman

13:03

I'm having with these on conf calls: crocopuffs.com/soundboard/arnold.html

CodesInChaos

2

Rory Alsop

@LucasKauffman i like that idea

Rory Alsop

13:23

@AviD or any of the usual suspects, have you seen Aarthi's roaming unicorn thingy?

bit.ly/TheRoamingUnicorn

I have signed up

@RоryMcCune how about you?

Rоry McCune

@RoryAlsop given the bit.ly hack yesterday, it's not going to be dodgy if I follow that link is it?

Rory Alsop

@RоryMcCune it worked again just now

I would give you the full URL, but it is on google docs

Rоry McCune

@RoryAlsop yeah still looks legit from here

Simon

13:44

A tool called CardiacArrest to test Heartbleed? Fucking kill me now.

4

Gilles

@Gilles A good hash should have a very very low possibility, but the possibility remains. Also, from the question MD5 was considered, and MD5 is known to have collision vulnerabilities (granted, the chance of a random collision is still miniscule, but it is there. Even more, you're hashing user input, so they could theoretically use a collision to perform an attack). 'course, the max length of an email address is 254 characters, and any hash with collisions in that range is terrible. — Bob 10 hours ago

sigh

Scott Pack

@RoryAlsop I thought it sounded fun. Plus it'll give me the impetus to go see the weird stuff around town. Like the 7ft bronze statue of Arnold Schwarzenegger.

Adnan

14:09

I am... I.. uhhh.. I'm working with Node.js :(

Terry Chia

@Adnan Are you using MongoDB as well?

Adnan

@TerryChia Not yet.

Actually, I don't think this project even needs a database

Terry Chia

@Adnan Find a reason. You can't be hipster unless you use both node.js and mongodb.

Adnan

@TerryChia Actually, (I can't believe I'm saying this), but I'm very much enjoying it.

I've got a simple websocket server up and running in half an hour

Terry Chia

Where is @AviD when we need him?

Oi @AviD, your mockery is needed.

Simon

14:12

Has anyone ever used Heroku?

Terry Chia

@Simon I have.

Adnan

Never heard of it

Terry Chia

It's expensive as fuck for anything other than the free tier.

Simon

@TerryChia I guess it's the perfect solution when you have a static HTML page or with something that will have less than 10k rows?

(DB rows that is)

Terry Chia

@Simon Erm no, static pages go for Amazon S3 or Github Pages.

Simon

14:14

Hum.

Scott Pack

@Adnan Since when has a projected needing a database been a requirement for using MongoDB?

3

Simon

Well for now it is static but eventually I will add an admin interface where the owner will be able to edit pages so there will be dynamic content.

Terry Chia

DB wise it's more a matter of query load rather than size, but if you exceed the free tier I strongly recommend spinning up something on EC2 instead if you can deal with setting up the stuff.

Simon

I see. I'll look into it when I get the chance

thanks

Scott Pack

Terry Chia

14:15

Again, Heroku is convenient but expensive as fuck. You have to decide if it's worth it.

Adnan

@ScottPack Hey man, I can be severely outdated on these matters.

I've been taught to use the things I need when I need them

Scott Pack

You're not hipster enough to use Node.jS. Clearly.

Terry Chia

@Adnan That's not the hipster way. You have to introduce the FOTM in every project you do.

Simon

I also don't know PostgreSQL but I'm assuming that it can't be much different than MySQL

It's about time that I learn a new DB engine anyway

Scott Pack

That's true. PostgreSQL is just a MySQL clone. You'll have no trouble figuring it out in a few minutes.

Simon

14:19

Oh, cool then.

Terry Chia

@ScottPack Careful, he might just believe you.

Simon

I did believe him :(

I feel betrayed.

Terry Chia

You probably won't notice it from a dev perspective especially if you use something that abstracts the raw SQL but it is quite different.

Scott Pack

The administrative commands are very different.

The admin commands for MySQL still feel very much like SQL, I kind of like that.

Postgre, however, doesn't.

Simon

I guess I'm gonna have to play with it to judge if I like it or not.

That's how things work, usually.

AviD

14:32

@RoryAlsop no I hadn't....

I'm not going to bother though, international shipping to/from here is such a pain.

it's name should be "roamicorn" though

Simon

@AviD How long do you have to walk to get a bucket of water where you live?

AviD

@Simon pretty far. At least a couple of flights, I dont keep any buckets in my office.

@TerryChia nah, no need - @Adnan mocked himself just fine.

Simon

You're no fun.

Scott Pack

@AviD Too many officials to pay off in customs?

AviD

that too.

Rоry McCune

14:51

@Simon Yeah big in the RoR world...

Simon

@RоryMcCune Why so?

Rоry McCune

@Simon they have really great integration with github and rails, you can push straight into deployment

also IIRC the run on a rails stack

Simon

@RоryMcCune Oh, that's neat.

Rоry McCune

actually I didn't even know they did anything apart from rails hosting.

Terry Chia

@RоryMcCune You pay huge for that integration though.

@RоryMcCune Heroku is pretty neat for Python stuff as well.

Rоry McCune

14:53

looks like they've spread out into Node.JS so @Adnan should be sorted for his latest hipster app :op

@TerryChia yeah it's like AWS and Azure you pay for convenience... the more convenience the more pay :)

Simon

Oh, the PHP support is in beta.

Terry Chia

@RоryMcCune Not really the same thing though, it's a PaaS not a IaaS. :P

And isn't heroku running on AWS as well?

Adnan

@RоryMcCune It's not hipster, aaaand it's not mine :(

Rоry McCune

@TerryChia yeah it was an analogy heroku --> AWS/Azure --> VPS in cost and loss of convenience

@Adnan yeah yeah yeah, node.js == hipster. and you're the dev ;op

Simon

Anyway, I wouldn't do anything fancy in PHP, it has PDO support which is all I request.

Terry Chia

14:56

@RоryMcCune That's a weird analogy, I would consider AWS/Azure and VPS-es to be on the same level.

It's just that AWS has all the awesome services in addition to EC2.

Which makes things super convenient.

Adnan

@RоryMcCune :(

Terry Chia

@Simon You shouldn't do anything fancy in PHP. :P

Simon

@TerryChia Valid point.

Terry Chia

You have node.js for the fancy stuff.

Simon

Haha

Rоry McCune

15:01

@TerryChia well AWS is billed per hour (usually) and VPS is per month (usually) so AWS is more convenient in that regard but if you run it 24x7 for a month the cost is usually higher than VPS :)

Terry Chia

@RоryMcCune Hehe, Linode is chargly hourly now as well btw, really bluring the lines. ;) I just think of EC2 as a really expensive VPS.

Rоry McCune

@TerryChia yeah so some services make the distinction really tricky, but that's my mental model and then you get the physical servers at the bottom, painful to spin up but for a given level of performance cheaper again..

M'vy

15:24

@RoryAlsop hm. you might be right indeed :)

> M'vy, 2 years ago (3 February, 2012 @ 21:49:52)

Eeeeek

Adnan

Wow! First time I realize this: It's almost impossible to capture loopback traffic with Wireshark.

Very disappointing

ManishEarth

@Adnan no offense, but I thought this was you :o

7

Q: Is it acceptable to insult god in a user profile?

Like always I hang around in Stack Overflow's chatrooms. Today, someone posted a link to his new "reloaded" user profile.demo Along the lines I read in Arabic "god is a pig". So I asked him to remove it: Me: I have a lot of respect towards you because of your knowledge but what you wrote the...

discussion profile-page etiquette

Because you are prone to random experiments, and I think you speak Arabic and a bunch of European languages.

Adnan

15:42

@ManishEarth Heeeey, I don't believe in god in the first place, why would I think he's a pig?

Frankly, for someone to go that length to Google Translate something and paste it in their profile just to offend some people tells me they're sad.

Very sad.

However, I don't think he should be forced to remove it.

ManishEarth

@Adnan Might not have Google Translated it :)

@Adnan impeccable logic :p

I agree

Adnan

15:57

There, I posted an answer expressing my opinion on the matter

0

A: Is it acceptable to insult god in a user profile?

My 2¢ For someone to go to Google Translate then write a drive-by offensive message in their profile just for the sake of trolling is a sad sad person. To have your life molded around the hatred of one particular thing that keeps you up at night thinking about it everyday. So much so that it's t...

ManishEarth

@Adnan Best not get involved in such posts on MSE :p

Adnan

@ManishEarth Yeah, I don't want to lose my precious rep there

and what the hell?! There's now Meta.SE?

I've just noticed the URL (after you mentioned it)

ManishEarth

@Adnan yep!

Lucas Kauffman

16:21

mmmm beefstew

Adnan

@LucasKauffman Please... picture!

deed02392

@Adnan Ohh, no, just my current job still

Lucas Kauffman

@Adnan still cooking

Adnan

@LucasKauffman Update us when you finish.

Lucas Kauffman

@Adnan I will

going to cook it for about another hour and a half

Adnan

16:26

@LucasKauffman How long has it been cooking?

Lucas Kauffman

@Adnan about 15 minutes

Adnan

Hmmm... now that's someone who knows what he's doing.

Maaan, I'm just hungry!

Lucas Kauffman

of course, bacon baked with onion

then prepare the beef pieces with black pepper, oregano, and mustard

bake the pieces of spiced beef

until they are brown on the outside

poor in some beer or red wine

add the mushrooms

add the meat gravy

let it stew

cook for about half an hour

turn the heat half down so it doesn't cook cook

for another hour - hour and a half

Adnan

Ahh... @Kisuminttu, when you can stand up normally again, please cook this with me.

Lucas Kauffman

@Adnan do I want to know why she can't stand normally anymore?

Adnan

16:30

@LucasKauffman Jesus Christ! Her leg was broken while she was running.

Are you now taking @AviD's place?

Lucas Kauffman

well you are Adnan :p

@Adnan btw prepping for OSCP this is a must have in house:

Scott Pack

He's got a point

Lucas Kauffman

Adnan

@LucasKauffman Speaking of which... Skype

Lucas Kauffman

one moment

Iszi

16:32

@LucasKauffman What the hell is that? Looks like piss.

Scott Pack

@Adnan If you're going to sext with @LucasKauffman at least be more subtle about it.

Lucas Kauffman

@Iszi It's an energy drink, you get it mostly on conferences, I got some of the leftovers from brucon

@Iszi it makes red bull look like regular water

Iszi

@LucasKauffman Oh, I thought it was something someone was trying to pass off as beer.

Scott Pack

How does the taste compare to RedBull?

Because RedBull tastes like red dye.

Lucas Kauffman

@ScottPack it's disgusting

Scott Pack

16:35

I assume it contains yerba?

Adnan

@ScottPack mmmmmm... yerba

Hadn't had some in yeeeeeears

Scott Pack

I need to get some yerba for the office.

Adnan

I can't seem to find any here

Lucas Kauffman

@ScottPack motherboard.vice.com/blog/…

> The first time you drink it,” Ohlig says, “it kind of tastes like horse urine filtered through hay.

2

Adnan

eBay it is

Kisunminttu

16:43

@Adnan , I would love to cook that with you : )

And I think I can show you a place that sells that here...

David Freitag

In case anyone was wondering, i think i finally found a solution to my weird serial port problem.

0

A: .Net SerialPort Object won't communicate

It seems like i have found the solution to this problem while I was doing some research for a different project. I stumbled on a post in the Arduino forum where someone was having a similar issue with an Atmega32U4 (which has a proper USART). It would seem that there were two properties of the S...

cc:/ @deed02392

Scott Pack

Even yerba tea is a bit rough. It's a very grassy flavor with a strong bite. I counter it with a healthy dollop of agave. The agave has a nice mineraly overtone to it but doesn't taste as sweet as honey. It really does a good job of smoothing out the harshness of the yerba.

Adnan

@ScottPack Not to be a one-upper, but I actually do like the harsh taste of yerba.

Kisunminttu

@Scott Pack I've been meaning to get some agave with my next iherb order. Are they all the same or do you have recommendations?

Adnan

In some parts of Syria, you grow up drinking it before you can speak.

Pretty much at the same time you start drinking Raki

David Freitag

16:49

@Kisunminttu Making some tequilla?

Kisunminttu

@Adnan before you can say "no like"? :p

@DavidFreitag , nope, I'm just one of those people who like trying out new stuff : )

But that is an interesting idea... :p

Adnan

@Kisunminttu For example: "Can I run on a slippery pavement while drunk?"

Terry Chia

@Adnan Yes you can.

Disregarding the consequences of course.

Adnan

@TerryChia Yeah, for about 3-4 seconds

Kisunminttu

@Adnan , hey! The wall hit me , okay!?

2

Sounds way cooler, anyway :p

Adnan

16:56

@Kisunminttu Being assaulted by a static inanimate object?

Kisunminttu

So, wanna make tequila? I still have some bones intact!

Adnan

Sure... so cool

Kisunminttu

@Adnan :(

Adnan

@Kisunminttu Oh, sorry, love. I got carried away with that one.

I'll make it up to you tonight after I finish work, alright?

Kisunminttu

@Adnan :)

Sounds fantabulous, honey

Adnan

17:02

@TildalWave \m/ \m/

Finally, some juicy chat flags!

Scott Pack

@Kisunminttu I've just always bought the store brand from our local grocery store.

@Adnan Truthful personal preference isn't one-upmanship. Hell, I really like a 1:1 mix of tonic water and unsweetened cranberry juice at breakfast

user3499545

You don't actually drink tonic with cranberry juice, right? It's just an outlandish hypothetical, right?

Stephen Ostermiller

17:18

Moderators, can I migrate this question here: webmasters.stackexchange.com/questions/60958/…

Adnan

@StephenOstermiller Please don't.

While it Security.SE is a plausible place for it, the question itself is badly written and not understandable.

Looking at the asker's question history, I don't think it's likely he'll improve the question.

It will end up getting closed here.

@RoryAlsop What do you think?

Rory Alsop

@Adnan Agreed - the question itself shows some ...gaps... in the OP's understanding of email cc @StephenOstermiller

it doesn't really work

deed02392

17:41

hey @DavidFreitag that's really weird

is it a SerialPort quirk that doesn't let comms happen until a handshake is done?

David Freitag

I'm not sure really. What makes no sense is that Handshaking works when DtrEnable and RtsEnable are false, and no Handshaking works with them set to true

But from the port logs, it looks like when with handshaking and dtr/rts are true the port simply opens and times out. The same is true for no handshaking and dtr/rts are false.

Scott Pack

18:14

@user3499545 No, totes serious.

@user3499545 It's a great way to use up day old tonic water. It's lost enough of its fizz to not be overwhelming but isn't quite flat.

Falcon Momot

mmm, cranberry-vodka-tonic.

Rory Alsop

@ScottPack surely with gin or vodka. Or if you need to drive, just straight tonic, with or without fizz

deed02392

@DavidFreitag handshaking works just by setting them to false? what are they by default then, null?

because handshaking wasn't working when you left them unset was it?

David Freitag

@deed02392 They are false by default.

deed02392

I thought it wasn't working when it was unset

David Freitag

18:30

@deed02392 Handshaking wasn't working when they were false. The only way to get the laptops to communicate is with no handshaking and setting them to true

David Freitag

18:44

@Adnan I think I may have done it again. If @Kisunminttu falls again because she was running drunk from some tequila that I inspired, I'd be pretty upset.

Adnan

19:40

@DavidFreitag Let's hope not. Otherwise, I'll go all American on you with lawsuits and whatnot

David Freitag

@Adnan I don't have much to take, and you'll get my car over my dead body.

Adnan

@DavidFreitag Do you have guns?

David Freitag

@Adnan Nope

Adnan

@DavidFreitag Well then the dead body thing isn't gonna be difficult. Yaaay.. free car

David Freitag

Unless you count the plastic capped variety.

Scott Pack

19:43

@RoryAlsop For breakfast? Nah, just cranberry and tonic. For lunch? Sure, I'd throw some vodka in there. Not gin, though. If I have a gin and tonic I want to taste the gin and the tonic. The cranberry would just override at least one of those.

David Freitag

@Adnan Heh, at that point it might come down to hari kari out of respect.

Adnan

@DavidFreitag Oh, nice. I like sushi

David Freitag

@Adnan Do you know what hari kari is?

Adnan

@DavidFreitag Yes, and it's not hari kari

It's hara kiri

David Freitag

Woops. Well i suppose i was pretty close without a wiki search.

Adnan

19:49

Doesn't change anything, I still like sushi

David Freitag

@Adnan I don't eat sushi regularly enough to make a distinction. Although i can say i don't outright hate it.

Adnan

@DavidFreitag Once every two weeks. Maaan, those small rice balls with raw stuff taste awesome.

Especially the western-style ones.

David Freitag

A coworker gets this stuff with sweet potato in it. I hesitate to call it sushi because it doesn't actually have any meat in it.

Adnan

@DavidFreitag Hey, man. Taste avocado-cucumber sushi. Hmmmmm mmmm

David Freitag

@Adnan Not a huge fan of avocado.

Adnan

19:54

Then just cucumber. Jeesus

David Freitag

Heh

I don't get out much. Unfortunately I'm a pretty typical American.

Adnan

20:10

@Lucas Where's my stew?!

You promised pictures of stew!

Rory Alsop

I love sushi, but hate sashimi

Fish are bad, mmmmmkay

David Freitag

@RoryAlsop Never had sashimi.

Rory Alsop

Is fish sushi

Pretty much

David Freitag

But I did have a pretty much raw bit of tuna at a very upscale restaurant not to long ago. That wasn't terribly enjoyable.

Adnan

@RoryAlsop Oh yeah, sashimi.. niccce

Especially if it's made with properly salted fish

Maann, raw salted fish is the thing!

Rory Alsop

20:30

Nope. Big nope.

kiBytes

20:43

Guys =)

just passing by

to say hello =)

Adnan

@kiBytes Whoa! Been a long time

kiBytes

Yes quite stressful weeks

but alive and smooth =)

everything good over here?

Rory Alsop

21:17

Hey! Yes all good here

Lucas Kauffman

21:40

@RoryAlsop It is

I love sushi and sashimi

That's mah stew @Adnan

Adnan

@LucasKauffman Yummmm

Looks delicious

Rory Alsop

I concur with @Adnan

Lucas Kauffman

21:58

This one's with red wine I had left, it's also very good if you add a nice abbey beer

Transcript for