> if you want to be extra paranoid before generating a GPG key, you can always roll a number of dice, and cat those numbers into /dev/random, and that will be mixed into the entropy pool. It can't hurt, and against certain attacks, it could certainly help.

> - Theo Ts'o

> Remove AES_bi_ige_encrypt() from libcrypto. This routine is supposed to use two keys and four IVs to do much magic...

good morning ;)

@TildalWave Infinite Garble Extension

Dave strikes again.

Agents of SHIELD season finale is awesome. /cc @ScottPack @AviD

morning all

@tylerl you can cat into /dev/random?

mornin @RoryAlsop

@deed02392 Yes.

@TerryChia Presuming you need to be root to write to that device

@deed02392 Nope.

Whatever you write into /dev/random only gets mixed into the entropy pool.

If I understand the wiki correctly, you can write data to it and it'll be added to the entropy pool, but you won't be able to harm the randomness coming out of it because if it isn't sufficiently random it won't increase the estimate of bits of entropy available?

@tylerl Here's guidance on how best to use a dice for seeding the rng device: galton.org/essays/1890-1899/galton-1890-dice.pdf

Um if you statically link a dll to other dll's, isn't it true it doesn't matter if those other dll's are corrupt or missing?

I thought it only mattered if they were dynamically linked

Hey in there

@Stephane mo'nin

Hellfest getting closer.... Yay, metal!

@Stephane Yay! Download (aka the Donnington Monsters of Rock festival) is also getting closer. VIP tickets FTW!

I found out yesterday there is a rock festival on Ibiza. Right now. In sunshine, with beaches! Maybe next year

Lucky bastard!

It sounds excellent

@Stephane heh - plus, my manager knows some of the bands personally, so I'm hoping for some proper introductions

@RoryAlsop Nice. Any specifics?

@Stephane the one I'm really hoping to meet is Monster Magnet :-)

have been a fan of theirs for a while

I'm happy knowing that I'll be seeing great bands with friend while still having the confort of a warm bed but it's the same :P

@Stephane we'll have comfy beds - we're taking a big yurt :-)

I missed the opportunity to talk both to Amorphis and Amon Amarth these past 6 month :(

@Stephane ooooh

I did get to chat to Nekrogoblikon last year at Download, and they took away a copy of our latest album and some t-shirts. (Not seen pics of any of them wearing them, but still)

I'm talking "real, warm beds with an excellent chef to cook or prepare us munchies" kind of warm beds :P

But hellfest is actually too big to talk to the bands

@RoryAlsop That doesn't sound like something a Scottish person will enjoy. ;)

@Stephane That is actually my favourite thing about playing at big festivals - we get our own chef

@TerryChia In shorts I can cope with temperatures even into the 30's

I know, right

crazy

It's metal.. It's expected to be crazy...

@Stephane Nah, that was referring to a Scottish guy coping with heat. ;)

@TerryChia How's that not metal ;)

@RoryAlsop Wait, you're playing in a band?

@Stephane of course

links on my music.se profile :-)

Well, what do you know ? Learn something new every day :) heading there

@Stephane I mean it's not like I talk about it every day - (shaddup @Terry :-)

@Stephane www.facebook.com/metaltech

www.youtube.com/metaltechtheband

www.metaltech.me

and @metltek on the tweeter

@RoryAlsop I have absolutely no problems with you talking about metaltech every day. I only mock you about the age thing.

@TerryChia hahahahaha. How about the parenting thing - I only need 3 upvotes for my 10k over there.... mock me if you like, but feel free to upvote any useful posts by this aging father :-)

@RoryAlsop I'm not signing up for a new site just to upvote you. :P

@TerryChia quite right too

Your friends might start to suspect that parenthood is imminent if you do

@TerryChia I think that leaves me with 3 episodes to catch up on.

@ScottPack Ah. Pretty nice guest appearances on those.

@RoryAlsop Congratulations on your 10K. :-)

@Adnan That edit is invalid. Those are both forms of static analysis. The question has nothing to do with dynamic analysis.

Is there a difference between terminal services encryption level and RDP encryption level? I'm reading a pentest report and they appear to be used interchangeably

You ever have one of those wrong number calls where you kinda feel like you had to work a little too hard to convince the caller they weren't talking to the person they wanted to?

@Iszi surprisingly often

@deed02392 "terminal services" and "RDP" both relate to the same thing (the protocol by which one can open a "remote desktop" on a Windows machine) but Microsoft changed the name several times.

equally as often, they're rude as if it's my fault

or simply hang up

@ThomasPornin Oh ok, thanks, I'm trying to figure out which I need to be looking at when they say our encryption levels are set to 'medium'. I only see a Low, Client compatible, High and FIPS option

There are two ways to have encryption with RDP: either using the encryption system which is integral to the protocol itself, or by wrapping it into a SSL tunnel (what Microsoft calls a Remote Desktop Gateway).

@thomas, we're on S2003, I guess 'RDP with TLS' is the ancestor of that product/solution?

Some days I think I could answer the phone with "Fuck you and the horse that rode in on your mother!" and nobody would notice.

@deed02392 At some point it assumed the "Forefront" trademark.

I think it also got named "UAG".

@Iszi Yes. Until we changed phone service providers last year, my direct office number was the same (except for one digit in the area code) as that of a pen (i.e. writing utensil) manufacturer/retailer of some sort. I regularly fielded calls from people who never sounded entirely convinced that I couldn't actually sell them some pens.

I should have taken advantage and opened up a side business.

@ThomasPornin ah, we don't want that, we are working for an internal only solution but considering insider threats who can sniff/inject on the network

so we've identified encryption levels being insufficient and the fact there's no authentication in RDP (with s2003) unless you use TLS

The "one digit off" match I most commonly get calls for is someone in the logistics department. Can't recall having gotten a call for this automotive company before.

@deed02392 The inherent encryption capabilities of RDP are notoriously poorly specified, and also poorly secure.

The main issue is that while the server may use a certificate, this will often be a self-signed certificate, and clients won't mind if the certificate changes.

@thomas indeed. so is it reasonable to assume even with High/FIPS, if we're using the RDP to implement it, it's irrelevant?

So fake servers and Man-in-the-Middle are always a possibility.

yeah. and if we're concerned about eavesdropping of insufficiently encrypted packets then we should certainly be concerned about MITM, because the requirements are the same?

@deed02392 If Microsoft claims "FIPS" then this can help a lot for formal compliance.

This does not necessarily translates to actual security, though.

@deed02392 Usually, people who can eavesdrop can also, technically, become active attackers.

@Thomas that's what I figure...

@deed02392 That's ancient. :O

Update your OS-es man! :P

@deed02392 Ah, I think there is a twist.

If I remember well, at some point, some version of RDP replaced the internal encryption layer with an internal TLS

That is, the TLS records are wrapped into RDP records

In that case you get SSL-level security, but the point about clients not worrying about self-signed certificates still applies.

OK, so if we go down the route of using certificates we need to make sure our managed clients care about the right certificate

Interesting, because in the article it says the certificate must be in the clients trusted root store so that implies it will refuse any connection using a certificate not in there

@deed02392 Oh say screw it, use the FIPS mode and claim that you are secure to management. ;)

@deed02392 Not by default. It will warn on any connection to a system providing an untrusted certificate.

@deed02392 Yes. And the "managed clients" include the human users, who must refrain from clicking through the warning popup (and the popup has a box "don't ever warn me again I know what I am doing" which is devastating to security).

@TerryChia We get audited so it will just come up again next time

Oh. We can't control/enforce that it only accepts certain certificates?

@deed02392 Perhaps you can - I've never tried - but my point was simply that it's not done by default. The article you're reading may be misleading.

@Iszi Yeah I'd say it is, OK thanks for that

@deed02392 Right -- they use a nifty property of randomness: If you XOR random with random, you get random. If you XOR random with predictable or even malicious, you still get random. So anything you dump into the random pool can only increase entropy.

@tylerl It also works if you combine things with a hash function.

Why is 1978-mode vi even installed anymore? If you're using VI, you're using VIM. And that should be the end of it.

@tylerl It seems that there are a few hardcore BSD-ists who use nvi, not vim (because of the license, of course).

@ThomasPornin hm. I would expect hardcore BSDists to be using BSD instead of Linux.

@tylerl Don't underestimate the power of the Fanatism.

@Xander Thank you very much sir :-)

@Iszi hello Dave. No, I'm Iszi. Yes, hello Dave, you're my wife now...

@tylerl yes. But definitely not emacs :-)

@RoryAlsop that is slightly creepy

@AJHenderson that's nothing - all League of Gentlemen episodes are mental

@Xander You're absolutely correct. This one slipped me.

@AJHenderson you have an odd definition of "slightly"

@TerryChia no spoilers! I'm a few episodes behind. pre-cap2...

and uurgghh, had one of those days. Full day training, non-stop talking and standing.

even I was getting annoyed by the sound of my voice.

you would appreciate League of Gentlemen, @AviD. All available from BBC - seriously worth watching them all

@AviD not fun

@AviD just don't listen. Put your headphones in and listen to some of that @Simon hipster dubtechnohardrawstepstyle

at least the people werent as stupid braindead amateur incompetent boring as last time...

@RoryAlsop hehe

@RoryAlsop love 'dat dubtechnohardrawstepstyle.

@RoryAlsop Holy fuck, that's one hell of a crossover genre.

@Simon - heh

@deed02392 @ThomasPornin to be accurate, rdp is the protocol, "terminal services" is the service that handles it :-)

@ThomasPornin I didn't think these problems are still relevant in current versions, is this so?

@AviD whilst IANAB I thought modern versions are better, they definitely warn you enough if you try to use a less secure client to connect...

ah, thats a good point, the version of the RDC / mstsc.exe client also is in play.

IANAB?

I Am Not A Bro?

I Am Not A Bear :op

aaahhh of course.

hellop

finally some peace

=)

@kiBytes peace?

yes, I had loads of work lately =)

I'm usually in Ubuntu, but at the moment I'm in Windows 7.

I'm trying to download an EXE, and Chrome says "________ is malicious, and Chrome has blocked it."

Does it say that for all EXEs?

@IQAndreas only the ones that are malicious

@Braiam Darn. Is it pretty good at detecting that, or is it prone to false-positives?

@IQAndreas Do you really want to find out the hard way?

@Xander LEEEEEEEEROOOOOOYY!!!!!!!

Is it on-topic here to ask "Is there a file recovery utility that Chrome doesn't think looks suspicious?

@IQAndreas no

@IQAndreas Recuva

also, Chrome is pretty good at detecting malware

I mean, it won't detect everything but if it says some URL is infected it probably has a good reason to say so

@IQAndreas not free to download, no.

@TildalWave maaaaan, dont you go confusing people about the difference between "malware" and "infections"

> "Heartbleed virus"

@AviD Recuva is awesome - and free. I have used it a billion times and not once has chrome complained at me.

@AviD shit, you're right... how does it feel? :P

@TildalWave like crap!

@AviD why?

@DavidFreitag Free to download? I don't trust it.

Works just fine for me.

@AviD It seems to be one of those "You can have the free version, but buy the pay version instead! Only $29.95!"

hmm. can it fix borked usb disks?

Yes. In fact that's pretty much all i use it for

That and when i decide to wipe grub every now and then.

ooo. I have/had a great usb disk, allluva sudden it reports as "No media in drive".

Just know that if there is a hardware issue with the drive aint no software gonna fix that.

I'm pretty sure its a firmware issue.

hardware issue is also possible.

it's a corsair survivor.

so I am leaning to "not a hardware problem".

Don't those have a lifetime warranty?

@IQAndreas for normal stuff the free version works OK, but the safe wipe options don't ... and they for some reason didn't disable them, so you think you've actually done something, and in reality it reverts to simple overwrites

@DavidFreitag ooh, do they? I should probably look into that.

though shipping would probably make that process suck.

not to mention that I didnt buy it myself....

But sometimes hardware issues are somewhat recoverable. I had a friend who was using a GoPro and he rammed a tree with his face and subsequently the GoPro. I was able to recover about half the stuff he had on the SD card.

did I just say "safe wipe"?

@DavidFreitag meh, I had enough other backups that I'm not worried about the data. I just want functionaltiy back.

I think our phone system is going haywire... I'm the only person in the building and three lines are active...

I'd learned - I used to have a usb-watch. few extra drops of moisture, that stopped working. Now I dont expect a usb to be my main backup, ever.

@AviD Have you tried to write a new partition table with gdisk or something like that?

@DavidFreitag not gdisk, but yeah something like that.

So i just ordered some boards for a pretty neat project I'm working on.

that's genderist.

It's an embedded PXE booter

so? guys cant do it?

Eh?

okay, you said "boards" not "broads".

nevermind.

just one of those days....

Micro-SD + Base-10 Ethernet + USB

ah, cute! what is it for?

d'oh

like I said...

I should probably not be allowed online....

The computers at school have password protected Bioses so I'm going to serve GRUB over PXE with this. Then use GRUB to boot from USB/CD

Cost me 13$ for 3 boards and about $80 for 3 sets of components.

@DavidFreitag pics or it didn't happen

@DavidFreitag Doesn't the BIOS prioritize booting from CD anyway, or was the school smart enough to disable that?

But I must say, I am impressed. :)

(it's full moon)

in other related news (cc @AviD), SpaceIL has now started a crowdfunding campaign to land the first Israeli spacecraft on the Moon

heh, amoosing

@TildalWave Interesting approach. So they're doubling-down on attracting the Israeli donors at the expense of alienating virtually all others. Risky, but the goal is low enough that it might work out. It'll be interesting to see how they do.

Is that corsair the attack exchange one @Avid

no, but that sounds cool. I just got mine from stack exchange

so, is attack exchange kinda like fight club?

Bloody auto complete:-)

heehee

Did you see puzzling.SE is in private beta

anyway, yeah. is yours still functional?

Seems to be yes

But I haven't let it get moist

moist

moist.

Moist.

moist.

moist

yeah, moist.

though neither did I.

that's what she said!

@RoryAlsop uhm.. what?

I can't believe @AviD and I failed to get a single star for that

Yay

pathetic

reads like some song lyrics now

It's some of that there dubtechnohatdrawfunkstyle

with a Tesla coil

that is one moist starwall.

@tylerl Yup I thought that too, I'll prolly follow it so I'll let you know how it panned out.

@tylerl not only that, it happens to be one of those things that the huge majority would join only because they are specifically supporting Israel, anyway.

it's not like there is going to be any groundbreaking space science there.

Someone say Tesla coil?

@RoryAlsop fantastic, that song is an excellent choice ... and for a moment there I also thought that's one of you guys :)

@RoryAlsop Tesla Magic Space Car!!

related

Plus, Tesla cars is a brainchild of Elon Musk (SpaceX) anyway, so there is another connection

I should probably now find some video of the laser propelled spacecraft, that sounds like a lot of high energy zapping too

@TildalWave oh definitely.

And Elon Musk is one of the backers of the Save Tesla Museum or whatev its called

shit, Chrome sound doesn't work again on some video

how does this one sound like?

funny, I just realized I get sound if I play it via the YouTube app ... it's not so impressive, thought there's more zapping LOL

@AviD he is? didn't know that

@TildalWave well, that oatmeal post mentioned it in the part2.

@AviD teslasciencecenter.org

@TildalWave theoatmeal.com/comics/tesla_model_s2

@AviD cheers, yes, where do you think I found the name of it? :P and blimey they raised nearly $1.4M

now they want $8M :D

heh, sometimes I like to link the obvious

I would love to hear an Orion launch

From a distance

you and your odd Scottish euphemisms.

:-P

@RoryAlsop I presume you mean the project Orion with its thousands of nuclear blasts for propulsion? There was some quite funny explanation why that wouldn't work on TED Talks, I'll try and find it

ted.com/talks/george_dyson_on_project_orion

Will hopefully see that in about ten mins. Just read the space boat article. Awesome

I thought NASA and others had proved that orion would work. Supplemented by a thousand Larry Niven fans.

@RoryAlsop You'll see in the talk how the project developed, NASA had its own ideas about it, but a lot smaller ship. Technically yes, I don't see any problem (except the obvious ones), if you use a fission reactor as the source of electricity that you then use to heat up hydrogen of your nuclear-thermal rocket, but those "nuclear explosion propelled spacecraft" were definitely crazy

tho it would be awesome to see ... from 10.000 miles away

@TildalWave want to play a gig with them and the BadPiper and Babymetal

@RoryAlsop Oww man you gotta make that happen! Terrahawks intro song!!

Ahhh - back on a proper computer.

I

just

love

the

star

wall

*****************************************

hehe it changed the order now, makes more sense

so... how about this one, metal-opera with tesla coils style:

@TildalWave how strange. Is it bad that I have never seen Terrahawks?

It might have been after my time...

@RoryAlsop not so strange no, especially if they were aired on beebs at 6 in the morning

@TildalWave it looks like the sort of thing I would have watched though

I did some but IIRC I was also a bit too old for it at the time, it's from early 80's something

@TildalWave early 80's I was in a country with no TV. Well, you could get TV 2 weeks delayed on VHS if you wanted, but we had more fun finding mortars, mines, armoured vehicles etc :-)

A proper childhood

Mmm...moist.

@RoryAlsop similar, I was rarely home in those days

hat's now an interesting star wall

I still can't quite figure it out how in hell could I have been doing all that stuff, time must have been passing slower then or something else relativistic who knows

@TildalWave we were faster. Back then....

@RoryAlsop I think we're just complicating our lives with all the tools to make it easier now

enslaved by the machine ...