The DMZ

Terry Chia

03:43

@DavidFreitag PHP? Node.js?

Scott Pack

All the cool kids are using Node.PHP

Iszi

05:43

Ok, can someone please verify I'm not crazy? From a drivers/software compatibility standpoint, should there be any difference whatsoever between OEM Windows and Retail Windows? i.e.: If I blow away the OEM build, and install a Retail copy of the OS, is there any logical reason whatsoever that I should not be able to re-install all of the drivers for the system?

Terry Chia

@Iszi Maybe the OEM drivers does some weird checks?

Iszi

@TerryChia But, for crying out loud, why?

Terry Chia

@Iszi Who the hell knows? It's just a guess anyway.

Iszi

What functional reason would there be for this?

Terry Chia

The Windows experts in the room probably knows more than me. @RоryMcCune @AviD

Iszi

05:47

I've got one driver that's not showing up right. The support person hasn't even bothered to ask for any specifics about it from Device Manager. They just told me to uninstall it and reboot. When the reboot didn't fix it, they started suggesting that I need them to send me recovery discs so I can do a full re-build.

A full OS re-install just to fix one driver, because supposedly there's something magical about their OEM version.

this.josh

06:10

is this a UEFI windows authenticating version?

All your OEM HW are belong to us...

No functional reason. A business reason. Tie cheap hardware to cheap OS licensing and vice versa.

IQAndreas

Is information sent back and forth when connected via SSH in plain-text or encrypted?

this.josh

Except for protocol negotiation and handshaking, the data is encrypted while in transit

Terry Chia

06:28

Hmm, is there any reason why google only supports ECDSA with SNI?

IQAndreas

@this.josh Thanks. If you'd like rep for that, I can post it as a question on SE and accept your answer. I'm just new to SSH, so I asked in chat since I assumed it was a "silly" or "noobish" question.

Terry Chia

@IQAndreas Well, the "Secure" part of SSH implies encryption. :P

this.josh

Your welcome. I don't need the rep, but I would be supprised if the question isn't an answer somewhere in this mess

So Zenith really was the best of the television makers...

It is almost a silly question, but if someone can honestly ask it, I don't see why it wouldn't be valid. A better question would be: What protection does SSH provide over a insure protocol like rlogin or rsh?

IQAndreas

0

Q: Is all data sent over SSH encrypted?

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?

I tweaked the wording a bit to make it more "StackExchangey"

this.josh

Oww 'easy to intercept' is a qualitative term which depends on the resources and sophistication of your attacker. Although it doesn't really apply for SSH

Lighty

07:09

gooooooood morning ladies gentleman and @TerryChia

Terry Chia

Huh, I just realized twitter.com has a really weird TLS handshake setup.

If you send out a ClientHello without a cipher suite supported by Twitter you get an empty response instead of a handshake failure.

Is this common?

Lighty

if its twitter, isnt it called a wingshake?

and maybe the devs programmed nothing instead of an error response? o.o

AviD

07:59

@Iszi yes, it is possible, but not a functional one - the hardware vendors will often install a "custom" OEM build, with their specific drivers.

and crapware, of course.

@Iszi ok no, that's clueless. Unless they specifically want you to be using their OEM OS, and this is their leverage....

Terry Chia

Oh hey, @deed02392: github.com/Ayrx/tlsenum

I need to clean up the code and write setup scripts/READMEs but the basic functionality is there.

AviD

congrats on the release!

Terry Chia

@AviD Random stuff on Github qualifies as a release now? :P

AviD

I assume you've scanned it for silly heartbleed-style bugs, right....? ;-)

@TerryChia no, but this does ;-)

Terry Chia

@AviD It doesn't do anything besides send ClientHello and parse ServerHello.

AviD

08:09

@TerryChia and you think there is no room for secbugs??

Terry Chia

Nothing gets executed. :P

@AviD Well, nothing that would affect the client. Worst case is I parse the ServerHello response incorrectly and a wrong ciphersuite gets printed out.

AviD

meh, I'd have to look at what your code does to have a clue to continue this conversation aggressively, and I don't want to do that. ;-)

so just consider me your friendly neighborhood secbug troll....

deed02392

@TerryChia Thanks! I'll take al ook

AviD

reminding you that its never too early, and no project too small, to do proper code security.

Terry Chia

@AviD Heh. You are more than welcome to poke at it for security holes. :P

AviD

08:13

@deed02392 oo, you program in Ook! ?

@TerryChia I would, I really would, but I can't, because I don't want to.

Terry Chia

@deed02392 It only enumerates TLS 1.2 at the moment, plus there may be weird exceptions poking out since the error handling isn't quite done yet.

deed02392

@AviD derp

Terry Chia

@AviD Dangit! Here I am hoping for a free code review.

Maybe I should get @Adnan to certify it.

AviD

hehe, you could try and sweeten the deal...

btw its python?

Terry Chia

@AviD Yup.

AviD

08:16

actually I don't really know python. this may be a good excuse to make time to learn it.

well, not good excuse, but an excuse....

Terry Chia

@deed02392 Oh, Python 3 btw if you want to run it.

deed02392

@TerryChia I will be when I get home.

What suites does Twitter purport to support?

Adnan

@TerryChia I'm offering 40% discount on my certification

Terry Chia

Hey @CodesInChaos, was wondering if you know why Google only supports ECDSA with SNI?

@deed02392 I use this as a reference: ssllabs.com/ssltest/…

It's fairly accurate.

And the output of my tool: pastebin.com/9WP88C7L

Adnan

@TerryChia Sweet! So you got it work?

Terry Chia

08:22

@Adnan Yep!

It assumes the server decides the priority and ignores client preferences but it seems like that's what everyone is doing anyway.

deed02392

@TerryChia list(tls_mapping.keys())might be a bit more readable than the list comprehension in main()

Terry Chia

@deed02392 Good point. :) Code definitely needs cleanup.

deed02392

@TerryChia Next task, STARTTLS support? :)

Terry Chia

@deed02392 Next task is enumerating the non TLS 1.2 ciphers. It doesn't do that yet. :P

deed02392

ah, fair enough

Lighty

09:01

my dream as a student, is to create shit like this once: i.imgur.com/hoSaSV5.gif

Terry Chia

Lighty

i saw that

some people shouldnt be allowed to have internet

Lighty

09:32

anyone here with a bit of brains on games?

hehe, that rhymes :3

Lucas Kauffman

09:43

6 bottles of Club Mate: Check
8 Cans of Nalu: Check
2L of Pepsi Max: Check
Cheese cubes: Check
Salami cubes: Check
Kali image: Check
Scripts: Check
Precompiled local privilege esc exploits: Check
Windows 7 with Visual Studio: Check
**OSCP Here I come**

Lighty

throws chocolate at you you forgot one

Terry Chia

@LucasKauffman I see you are missing the three bottles of whisky to dull the pain. ;)

Lucas Kauffman

@TerryChia I'll need some if this ends in tears

Lighty

and a bottle of ice-cold smirnoff ice to soften the whisky

Terry Chia

@LucasKauffman Hehe. You should probably get off Stackexchange for the 24 hours.

Lucas Kauffman

09:45

I probably will :p

Lighty

i could use a cold glass of smirnoff now, i need to do reshearch on how to implent google analytics into a own-made dashboard for websites/webshops :S

Rоry McCune

@LucasKauffman Good luck! When's your time start?

Lucas Kauffman

@RоryMcCune in 12 minutes

Rоry McCune

@LucasKauffman in that case shoo shoo no Sec.SE while examining :op

Lucas Kauffman

alright see you later guys!

Rоry McCune

09:48

@LucasKauffman laters

Terry Chia

So we can expect @LucasKauffman to start posting drunk messages in 25 hours?

2

AviD

@Lighty or a credit card

Lighty

why a credit card @Avi

ohlol fail

AviD

also not the first time such cluelessness was around...

Lighty

i didnt have enough tea today to process such information, please try again when i'm not sleeping on my keyboard

Adnan

10:02

@Lucas Good luck!

Lighty

i spilled cooking hot teawater over my right hand...

@Adnan! fix it with your almighty haircut! D:

Rory Alsop

@LucasKauffman Pepsi Max??? Nooooooooo! That's not a drink

but good luck anyway

@Lighty depends on the game

Lighty

nah, i was talking to someone who was blaming that a game was "bad of quality" because in his view, it should have been a singleplayer game without servers (wichs counteract as DRM), instead of multiplayer/cloud based gaming

AviD

10:19

> YOU DIDNT DO WHAT I WANT SO YOURE STUPID AND SHOULDNT BE ALLOWED ANYTHING

Lighty

yes

exctly that

then he went back to play call of duty while mating with my mom who is a fat lady i guess

AviD

heh

> HOW FAT IS SHE

Lighty

in internet words, everyone did my mom, and she is also the biggest person in existence

pretty fat i guess

AviD

►

Lighty

pretty much yes

Kisunminttu

10:27

voi vittusaatana

Lighty

hello dere

Kisunminttu

I spent 2+ hours last night trying to come up with a fix for my sewing machine problem. Most of the comments on forums said "check the thread, you've inserted it wrong" and I was like "psh fuq dat, I know my shit"

Lighty

have you tried turning it off and on again?

Kisunminttu

Today, I downloaded the manual and yep. The thread wasn't in place like it should be.

Well, soon I'll have a new skirt!

@Lighty I tried almost everything, including that :D

Lighty

it would be a shame

if someone would rip that skirt off

and eat it

Kisunminttu

10:30

@Lighty , I'm thinking that one part of that scenario is possible

Lighty

>:3

Kisunminttu

I'm listening to Finnish hip hop and I'm keeping the volume down so my neighbors don't hear it & judge me...

Lighty

listen to AC/DC then, better solution

Adnan

@Lighty "haircut" hehehehe...

Lighty

:3

Adnan

10:33

What I do is go to the barber lady and say "Just make it shorter so I don't look like a homeless person"

She insists on having me pick some style, and I spend 5-10 minutes convincing her that it's just better this way.

I like my haircuts MS Paint style. Select and resize.

Lighty

story of my life

well, i like longer hair, but i have a girlfreind....

so we all knows what happens when it gets too long

either she does it or the barber does it

Adnan

@Lighty Oh, I'm sorry to hear that.

I have a girlfriend too. We need some support group.

Kisunminttu

@Adnan ahem

Lighty

oops

Adnan

@Kisunminttu Oh, you're here.. agaaain

Lighty

10:36

grabs popcorn may the odds be forever in your favour :3

Kisunminttu

@Adnan of course I'm here :3 you're here, aren't you?

Adnan

@Kisunminttu By the way, I probably haven't said this enough this morning, but that blue dress looked so freaking amazing on you.

Please wear it more often. Wow.

AviD

> hurhur, it looks better crumpled on the floor in the morning hurhur

Kisunminttu

@Adnan Oh, stop it, you :3

AviD

> 'course, polyester doesn't crumple hurhur

Lighty

10:37

how about

no dress?

Kisunminttu

@AviD viscose, I think

AviD

@Kisunminttu what is that smiley?

Adnan

@AviD EXACTLY!

Lighty

@Adnan here, for you: i.imgur.com/KCM9NbF.png

Adnan

Looks like something dirty.

Kisunminttu

10:39

@AviD Holy shit, it actually is polyester!

How did you know!

Adnan

@Kisunminttu :O

@AviD We need to talk!

AviD

hehe

Adnan

@Lighty I don't like coffee.

Rory Alsop

@AviD what is that dotted line on the left of your post? And what does it mean

Lighty

hehe.... everyone suspects him... perfect >:3

Terry Chia

10:40

> what? this?

Kisunminttu

AviD

@RoryAlsop it uses a ">" and signifies a quote

Lighty

:3

kitteh

AviD

because it is a quote

from a movie

classic quote

Adnan

@Kisunminttu But you're not a cat.

oooh.. Kisu.

Lighty

10:40

insert pussy comment here

Terry Chia

@Lighty Your overuse of smileys is incredibly annoying.

Barry Carlyon

CAT!

=^.^=

AviD

@Lighty we will need to have a talk soon....

Rory Alsop

@Adnan step 1: buy Wahl hairclippers in 1998 (£25); step 2: selfie buzzcut every fortnight; step 3: profit (still using them, although I may need a new set this year)

AviD

@Kisunminttu ahhhh.... I too thought it was dirty.

Lighty

10:41

i-i can explain...

Rory Alsop

@AviD I thought it was a quote, but ones that you were making up :-)

Adnan

@RoryAlsop I used to do that in my skinhead days. I just hated the mess.

AviD

hehe, no! From only THE BEST MOVIE IN ALL TIME.

Adnan

@AviD Me too!

AviD

looking for the clip....

Rory Alsop

10:42

@Adnan not that short!

AviD

@Adnan I am embarrased.

Rory Alsop

@AviD I won't be able to watch it. Am at work.

Terry Chia

@AviD Of course you would. Pervert.

AviD

@RoryAlsop I'm sure you've seen it... its not familiar?

Adnan

@AviD Why? I do that with her all the time. Don't feel embarrassed

AviD

10:43

@Adnan no no, I am embarrassed that I thought like you.

Rory Alsop

@AviD nope. Sadly

Kisunminttu

@Adnan I wonder what you mean by that...

Adnan

@RoryAlsop How do you clean the hair that is everywhere

Rory Alsop

@Adnan don't make it go everywhere

Adnan

@Kisunminttu I mean that we love each other all the time.

@RoryAlsop But but but.. it falls on the floor

under the sink

Kisunminttu

10:44

@Adnan :*

Rory Alsop

cut hair over bin. hair goes in bin. hoover up occasional miss

Adnan

near the toilet

@RoryAlsop Oooooh

Rory Alsop

simples

AviD

@RoryAlsop you've never seen the best movie evar?

Adnan

Yeap. I'll do that for my next haircut

Very likely the one before going to Scotland

AviD

10:45

Weekend at Bernie's

Weekend at Bernie's is a 1989 dark comedy film directed by Ted Kotcheff and starring Andrew McCarthy and Jonathan Silverman as young insurance corporation employees who discover their boss Bernie is deceased. Discovering that Bernie ordered their deaths to cover up his embezzlement with orders to not kill them if he is around, they attempt to convince people that Bernie is still alive. The film was released three times on DVD; once from Artisan Entertainment in 1998, and twice by MGM in 2005 and 2011. MGM released the film for the first time on Blu-ray on May 6, 2014. Plot Larry Wilson (...

Rory Alsop

at that length, you don't need to look in a mirror or anything, just run clippers over head until cutting noise stops

AviD

that, of course/.

Lighty

yarr harr...

Kisunminttu

@Adnan I can help you with that :)

Rory Alsop

@AviD Ah - heard of it. Not seen it. It didn't strike me as appealing in any way, however I have only seen the poster so I am basing my decision on that.

It reminded me of Porkys

Which sucked soooo badly

AviD

10:46

it was hysterical. In the '80s. So do the math yourself.

Rory Alsop

@AviD ahh - definitely not selling it to me then

Adnan

@Kisunminttu All right. I'm now off for some NodeJSing and AngularJSing

AviD

@RoryAlsop hehe, yeah, well....

Adnan

and Socket.IOing

Terry Chia

@Adnan That's a new one.

AviD

10:47

I still think you should watch it, even if only for the popculture references.

Terry Chia

Dammit, you are more hipster than me now!

AviD

the first part is kinda painful, but about 1/3 of the way through it does turn funny.

or did, no idea if it holds up.

Terry Chia

@AviD TWSS?

Lighty

he has the most awesome profile picture of the whole exchange, can't get any more hipster then mudahfudging Tiger

Kisunminttu

@Adnan Have fun. I'm going to turn on my productive gear, too.

Adnan

10:48

@TerryChia Wait until I go to my dev. machine. I'll take a screenshot of the "techs used" folder.

@Lighty Thank you.

AviD

@Lighty thanks, I guess, but he meant @Adnan

Adnan

@Kisu Laters, love.

Lighty

i was talking about Avid's tiger pic, but Adnan only has awesome hair

sshh

Kisunminttu

@Adnan Laters, sweetheart <3

Adnan

@Lighty I don't have that much hair anymore.

Lighty

10:50

girlfreinds eh...

Terry Chia

Oh, llama boy is back.

@LucasKauffman Broke down so soon?

Adnan

@Lucas So, you're OSCP now?

Lucas Kauffman

no I was an hour early -_-

@Adnan yes ran autopwn, got all the machines

Terry Chia

@LucasKauffman Lmao, how did that happen?

Adnan

@LucasKauffman :D

Lucas Kauffman

10:51

@TerryChia it's GMT+1, I was sure I was in GMT+1

Terry Chia

@LucasKauffman Heh. At least you weren't an hour late.

Lucas Kauffman

indeed

Adnan

@Lucas 5 machines, right?

Lucas Kauffman

Im not sure

Adnan

I remember that dude told me they were 5

Lucas Kauffman

10:53

and how many you need?

to pass?

Adnan

I think 4

Terry Chia

@LucasKauffman There's probably a big red button that says "ROOT ACCESS". Click it.

Lucas Kauffman

@TerryChia must be cant be much harder

Adnan

@Lucas Yup, I just asked him. 4 machines

Lucas Kauffman

alright

Rory Alsop

10:59

@AviD okay - if it is on Sky OnDemand then I'll watch it

Adnan

@Lucas Is the report factored in the the result?

Rory Alsop

just because I trust you :-)

Adnan

I remember reading somewhere it was 70 points out of 100 to pass

AviD

@RoryAlsop hahaha, cinema-injection! ;-)

Lucas Kauffman

@Adnan what do you mean?

AviD

11:00

dont be expecting anything high-brow. It is purely low-brow, 80's style physical humour.

Rory Alsop

@AviD I can cope with that, I'm sure

Adnan

@LucasKauffman 5 machines in total, and 4 machines give you 70 points.

Sounds weird to me

Does each machine have its own score?

Lucas Kauffman

right

Im off

Adnan

See ya

Terry Chia

11:11

@deed02392 D'oh, I just realized that my current code works just fine for TLS < 1.2 since it's the server that picks the highest supported TLS version anyway.

I just have to display the information.

deed02392

@TerryChia Nice :)

AviD

@TerryChia maybe its just @Adnan's influence, but when you say "I just have to display the information" I'm thinking "oh lord PLEASE do not open that trenchcoat."

Terry Chia

@AviD You are just a pervert. It has nothing to do with @Adnan.

2

AviD

true. Grandma's chicken salad.

deed02392

@TerryChia LOL

Lighty

11:21

did you guys know Australians don't have sex? they mate :3

Rory Alsop

@Lighty hahahahahaha

deed02392

I've felt hungry all morning despite continuously eating

Terry Chia

@deed02392 Welcome to my life every single day.

deed02392

Banana, apple, a handful of mixed nuts and a fruit & nut bar I've had

yet still I hunger

Lighty

sums up my life too..

deed02392

11:24

@TerryChia I'm going to go to the canteen and stuff my face with carbohydrates

Terry Chia

Also, your snacks are way healthier than what I eat.

deed02392

@TerryChia Well I'd be twice the size I am now if they were remotely unhealthy, I put on weight easily

I'm technically underweight but still, makes sense to make an effort to only put the best I can in my body

except chicken burgers. I'm going to destroy one of those if they're doing them today

oh and hey I think I'm going to sell my E6410 and get a Mac

MBP Retina. Air options aren't powerful enough for my liking

Lighty

i need to work on a ac because my boss wants me to

get a mouse

dont get the trackpadthingie...

Terry Chia

@deed02392 Max out the RAM, that's the only advice I have.

SSDs can be swapped later.

deed02392

@TerryChia Not sure they can, supposedly the connectors are non-standard or somethin

or did you mean swapped later for one salvaged from another MB

Terry Chia

11:29

@deed02392 Non-standard, but there are companies selling them.

Rory Alsop

I had a play with a couple of the Mac things at the weekend. I can honestly say they actually exceeded my annoyance from last time. Why would they make the trackpad thing soooo useless

Terry Chia

@RoryAlsop You are literally the only person I know that calls the trackpads on a Mac useless.

Lighty

theyre not useless

theyre fckin HORRIBLE

Terry Chia

Even the diehard WIndows laptop guys I know admit that the trackpads on a Mac exceed anything on a Windows laptop.

deed02392

what's the support for Windows like on these things, so I can game if I want to?

boot camp was discontinued I heard?

Adnan

11:31

@Terry Here you go

Terry Chia

@deed02392 Pretty good actually.

@deed02392 Nope, it still exists and works.

deed02392

@TerryChia Awesome

Terry Chia

@Adnan Wow, that's totally hipster.

MongoDB is missing though.

Adnan

@TerryChia The project doesn't require a DB

Terry Chia

May 9 at 14:14, by Scott Pack

@Adnan Since when has a projected needing a database been a requirement for using MongoDB?

deed02392

11:32

:| £240 to go from 4 GB RAM to 16 GB

Adnan

@TerryChia What would I use the for then?

@deed02392 That's the only upped spec?

deed02392

@Adnan 8 Gig is an extra £80

Terry Chia

@Adnan You can store your code in MongoDB and dynamically execute it. ;)

Adnan

Hehehehhe

deed02392

lol, I just shivered because somewhere out there, someone is doing that

Terry Chia

11:34

See, now deploying your code is simply updating your database! Easy!

deed02392

:D

Rоry McCune

@deed02392 IIRC you were looking for testers the other day.. did someone get you an answer?

Terry Chia

I may need to book a flight to SV. I'm sure I can pitch that to a VC somewhere.

deed02392

@RоryMcCune Hmm what for?

@RоryMcCune Oh yes, opinions on whether or not security consulting gets boring/samey after a while

I think the consensus was no, not really

Rоry McCune

@deed02392 ahh that was the one.

Terry Chia

11:35

@deed02392 You want the cynical version? Ask @AviD.

Rоry McCune

@deed02392 interesting...

deed02392

@RоryMcCune More opinions welcome :)

AviD

@TerryChia heeey, why am I the cynical git here alluva sudden?

oh right, experience + wisdom.

Terry Chia

@AviD How the hell is it sudden?

I thought it has been well established by now?

Rоry McCune

@deed02392 my answer, 'cause they're all personal is that it depends on the testing type. I have good tests and others where I'm super bored, generally 'cause the scope is very locked down so I can't really try anything innovative. Reporting is always boring (although working out how to automate it can be fun)

Terry Chia

11:37

@AviD Hey, @RoryAlsop has an order of magnitude more experience than you and he still seems to enjoy his job!

Rоry McCune

@deed02392 so after nearly 9 years of testing the answer is yeah it can get a bit boring, but not anything like as boring as going to meetings and writing policies :)

@TerryChia yeah but @RoryAlsop is a mutant, he has an over-active happiness gland :op

Terry Chia

@RоryMcCune Ooooh, is he in the new X-Men movie?

deed02392

"(although working out how to automate it can be fun)" that does sound fun hehe

awesome, thanks for the input @RоryMcCune

Rоry McCune

@TerryChia Mr happy... could be

deed02392

I think I've decided to take a job with NC.C Group

AviD

11:39

@TerryChia oh okay, I just read what that was referring to, and yes you are absolutely right.

Lighty

holy crud, they charge €2,- here for a glass of cola :S

Rоry McCune

@deed02392 yeah I like writing scripts to slice and dice XML and turn it into something useful :)

deed02392

Well, my signed contract is in the post so that's a pretty solid decision

Rоry McCune

@deed02392 cool which office?

deed02392

Leatherhead

AviD

11:39

@deed02392 the trick is to keep moving around, finding new things to learn, and stick to interesting projects (for your own personal value of interesting).

Rоry McCune

@deed02392 who runs that one?

deed02392

Coll.in Gillingham

AviD

that is the upside of consulting, you dont have to stay on one thing very long.

Terry Chia

@RоryMcCune I think that's a NP hard problem.

AviD

unfortunately, being the cynical git that I am, there is very little that fits in my own value of "interesting".

@TerryChia ah, that's because he also has more wisdom.

and with his wisdom comes patience. Mine, not so much.

deed02392

11:42

the chicken burgers are gon' all be gone if I don't go now. brb

AviD

@deed02392 excellent! congrats, and good luck!

Rоry McCune

@deed02392 ah yeah IIRC he was the account manager I dealt with when I was at RBS

@deed02392 good guy

Transcript for