The DMZ - 2014-06-25 (page 1 of 5)

« first day (1287 days earlier) ← previous day next day → last day (3583 days later) »

4:06 AM

To everyone who responds to everything by saying they've 'lost their faith in humanity': Thanks--I'll let humanity know. I'm sure they'll be crushed.

3

3 hours later…

7:03 AM

Jesus. this is my least favorite part about programming

I've been at it for about 7 hours and haven't written a single line of code.

...but I've read about 70 pages of specs, manuals, source code, commentary, examples, and other mind-numbing madness.

But if you'll pardon me, I need to go shave a yak.

@tylerl Whatchya workin on?

@DavidFreitag I'm writing a libnss module that will search through multiple passwd/shadow/group files instead of sticking to just the ones in /etc/

@tylerl Ah. Sounds like fun

Also, metaprogramming in C using DEFINEs -- I kinda want to kick someone.

'course, I'll prolly end up doing it myself too. But I won't like it.

And I've spent a depressing amount of time trying to figure out the bloody purpose of functions like getpwent_r() instead of getpwent(), giving that neither is re-entrant.

All they had to do is pass double pointer to setpwent and endpwent, and you could totally use it to manage state in a reasonable way. It makes LOADS of sense and is exactly what the _r suffix is supposed to mean.... but... nope. Sorry. We're just dumb.

7:41 AM

@RoryAlsop oh! happy happy birthday!! Are you still hungover?

@RoryAlsop happy birthday

I thought @Rory was supposed to be a divine being of some kind, such creatures aren't "born" and thus don't have birthdays

@kalina He's Exception: Integer Overflow years old, that's a bit divine no?

no

It's unbelievable that any of you would error handle the getting of age data from the database

therefore you should just collapse on the floor after "He's"

i went to ZZTop yesterday, i stood like, not more then a mere metre away from them! :D

7:50 AM

Read that article about a US SWAT team throwing a flashbang into a baby's cot by accident?

@Lighty did you touch their beards?

@AviD Nah, but i think they powdered them, atleast, the powder was on their jackets

dandruff

the Ben Miller band preformed as support act, complete hillbilly's, yet awesome

  /* Get lock.  */
  __libc_lock_lock (lock);

is that really necessary?

(this shows up all over the glibc source)

8:00 AM

libc is unnecessary.

I mean, If you have a function call that says lock_lock(lock) , the comment "by the way, this locks something (a lock)" is a bit redundant.

@tylerl i = i + 1; // Add one to i

never seen that?

@AviD That should be i++; // Add one to i

@AviD Yes, though not typically in code that is used by literally every program on the computer.

stupid worthless comments. Usually because of stupid worthless coding policies that require comments for everything.

@CodesInChaos I've seen it both ways.

8:03 AM

@CodesInChaos ++i is more efficient

MSDN is pretty great at redundancy as well.

I've actually even seen private int Increment(int i) { ... I'll let you guess the rest.

True story.

Originally I though GhostDoc were a parody. But there are people who seriously use that thing.

@CodesInChaos true, all the "Learn to Code in 21 hours" are rife with worthless comments. If your coders learned from those, it is likely they picked up that dirty habit too.

but then, if they learned to code from those books, its likely they don't know how to code either.

@AviD Did you print it and made the original writer eat that code?

8:05 AM

@AviD Learn to code by lunchtime. You'll be writing security-critical software before you can say "disaster"

@AviD that's really just full retard

@AviD So's your face.

@AviD If it's Java you need a IncrementFactory.

@tylerl Like those questions we sometimes get on here "Hello, I am making critical transactional app for a bank, how to secure bank application? thx"

@LucasKauffman dear god. I've personally answered at least a dozen.

@LucasKauffman no, it's a typical programmer hack when you get your bonus based on how many lines you wrote. Or yelled at.

@TerryChia ha, so true.

@tylerl STOP ENCOURAGING THEM!

8:09 AM

There should be a law, if you're breached by a vuln >1 year old, you register as sex offender for screwing your customers without permission

Tweeted by edwardmccabe on June 25, 2014 at 2:40 AM

3

5

A: What are the main security considerations that must be taken into account if you intend on creating a (localised) whistleblower website?

If you have to ask, then you shouldn't do it. Security is difficult to get right, and requires a fair amount of experience to recognize all the ways in which it can go wrong. And a safe-haven for whistle-blowers represents not only a clear target for determined attackers, but it also comes with ...

None of you guys have an answer to this?

0

Q: Best practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server. I was wo...

I've seen it being done and I'm really curious how you implement it properly

@LucasKauffman You have to figure out what you're defending against

@tylerl +1

@LucasKauffman If the sending server signs its logs, what does that signature indicate? That the server actually sent the logs? Or that the logs weren't tampered with before being sent?

8:13 AM

@tylerl that the logs weren't tampered with

@LucasKauffman some products already do this.

However, I refuse in principle to answer any question that asks for "Best Practices".

0

Q: Good practice for log signing

I can imagine that for sensitive systems logging to a central logging server it can be handy to be able to verify the integrity of the logs. Each line can either be signed or a shared secret may be used (HMAC) to add an additional field before sending it off to a central logging server. I was wo...

better?

hehe

so tired

I will rest for just a moment

thats still just "Best Practices", just with lower standards.

8:15 AM

@AviD BOOM. PWNT.

like @Simon.

@LucasKauffman no, now you're asking for casual practices and you should already know those

oo oo, no, like @Kisunminttu. Get it? Because of @Adnan? No? Never mind.

I don't think you should be mean to @Kisunminttu as she already has enough on her plate dealing with the mistakes she's made

pffffrt

8:17 AM

@LucasKauffman So you're signing messages in a potentially hostile environment, and you want to know the best practices for detecting whether or not the data was tampered with before the signature was applied? Is that right?

application of more pressure may result in her cracking and setting you all on fire

@tylerl fdisk

@tylerl no after the signature was applied. The idea is that an auditor can verify that the presented logs haven't been tampered with

@kalina I wrote an article on how to recover rebuild your partition table after someone uses fdisk in anger.

fdisk, as you know, is the solution to all problems in computing

@kalina thats the thing, I was being mean to @Adnan.

8:19 AM

@AviD stating that kisu has low standards is insulting to kisu while being mean to adnan

I'm not bothered about the latter but I will not tolerate the former

@kalina This raises the question, are you @Kisunminttu's sockpuppet?

@LucasKauffman But they can be tampered with before they get signed. So you have to sign them before there's an opportunity to tamper... which, it turns out would have to be pretty early on. At least before they hit the log file.

@tylerl yep

maybe before that. And really, there's no guarantee even then

oh jeezus. This client's app, besides having 3.5 MLoC in Java, and an undetermined amount of code in 4GL, now shows having 1.25 MLoC of.... PHP.

NOT.TOUCHING.IT.

8:22 AM

@TerryChia no

gives @AviD some vaseline you'll need it

@tylerl I've seen it in practice being used where they added a HMAC of the log to each log line.

I wanna respond with one of those anigifs from secreactions: kids playing tag "nuh uh, not it! NOT IT!"

mloc is what?

oh

@kalina million lines of code

8:23 AM

million lines of code

midlands lotus owners club

yea, that

also known as: a shittonne of crappy code

user image

minimum level operational capability

8:24 AM

user image

missing logical or in expression used as brand condition

@Lighty yes, this one is perfect.

master pre-light off checklist

"All aboard the nopetrain, next stop - notphpville!

I hope you enjoy your week of PHP hell

in fact, why don't you off load it onto a PHP... er...

what is the PHP equivalent of "developer"?

8:26 AM

a Lighty

@kalina naah, really not doing that, I agreed to the java only.

some nouns also suggest Unlucky Person, Daredevil or @FEichinger

@AviD maybe the java relies on the php in some way and you'll have no choice

besides, you think over a million lines of php can be covered in a week??

@AviD I don't think 10 lines of PHP can be covered in a week to a quality standard that would be acceptable in other languages

let alone more

8:27 AM

@AviD Sure you can. Just grep the source for db code and you have enough crap to report.

@TerryChia ah, but its never about "enough to report", its about "what else is there"

if it was "enough to report", I'd stop as soon as I saw ".php"

@AviD so report "this section of the project needs rewriting as it's been written in PHP"

@AviD You need that scanner I wrote?

except that I'm not doing the PHP! There is not enough money.

@TerryChia what scanner?

gist: The most awesomest scanner in the whole world!, 2013-07-17 14:00:32Z

vuln_scanner.py

import os

for r,d,f in os.walk("/var/www"):
    for files in f:
        if files.endswith(".php"):
            print "You are fucked!"

Oh, SE inlines gists now?

8:30 AM

heh, nice

nobody cares

please explain to me why Star Trek has the cult following that it does

Because Gene Roddenberry was such a genius, they even named the word "genius" after him.

that's not true

no

don't lie to me

@kalina what do ya mean?

@kalina everything has a cult following. That's why they call it a cult following.

8:32 AM

@Lighty if I have to explain that sentence to you, you should just sit on the sidelines and wait for the next conversation to begin

@kalina i would make a comment about furry cults/fandom, but i wouldnt :P

@Lighty ...

@Lighty if you want to contribute to this conversation, go find the xkcd with the crazy straws, and link it here.

@Lighty those comments wouldn't be relevant to me at all

I have certainly never dressed up as a pony for day to day life

or even harley

although harley quinn does seem like an appropriate outfit

@AviD lazyass

The new crowd is heavily shaped by this guy named Eric, who's basically the Paris Hilton of the amateur plastic crazy straw design world.

8:35 AM

I'm sure the next place I'm DJ'ing has foam party/fancy dress rules

@tylerl well done. @kalina, this.

@AviD I don't follow

this doesn't answer my question

of course it does

nope

your answer is not acceptable

ok so puncturing a pen with a needle was not a good idea

better then shooting your finger with a nailgun while making a roof...

8:43 AM

I wasn't trying to inflict pain on myself

i was referring to the risc factor of accidents while handeling a nailgun

nailguns run on RISC ?

there is a risc factor?

interesting

I didn't realise there was a nailgun in the world powered by sparc

let me put it this way, if you ever need to use one, try to hold the wooden planks atleast a few inches away from the inpact site, the moment you realize those planks are thinner then the actual nails... well

it stings

let me get this straight

because I'm not completely clear what you're saying

did you just say "when using a tool that propels nails through surfaces, don't hold the surface so close to where you're nailing" ?

8:50 AM

yup

...

right so, moving swiftly on

before the brain damage sets in

user image

damnit @AviD, you dissapoint me, i'd ATLEAST excpected a burning comment about young whippersnappers

that's a meme in the making, that is

8:52 AM

@kalina Is it, lass?

what is "las"?

@Lighty your father is a young whippersnapper. I'm not sure what to call you.

@kalina VEGAS.

@AviD i just wanna bet hes a bit older then you.... and a bit more.. "filled"

@LucasKauffman you're still missing punctuation that turns these three words into something readable

@Lighty did you just call your own father "fat"??

the infants these days, no respect.

8:54 AM

@LucasKauffman are you Scottish?

@AviD I don't get hangovers. Well, I did have one once - it was my stag do, so it was expected :-)

Great Scott.

@RoryAlsop merry popping out of your mother day

@kalina Divine beings still have days when others can worship them :-)

> Remember, when you get drunk, you are borrowing happiness from tomorrow.

@kalina heh - better :-)

8:55 AM

Every day is a Rory day!

I guess you dont pay interest on that loan.

he's a 120kg 2metre tall guy, and really strong who got me addicted to gaming, ofcourse i can call him filled

@RoryAlsop your "Name Day"?

@RoryAlsop I don't worship anything or anybody

except for Ben and Jerry

@Lighty and now you called your dad gay??

8:56 AM

two individuals that deserve worship for the happiness they've bought to my life

NOT that there is anything wrong with that.

@kalina nihilist

@AviD homophobe

@AviD I actually am

16 secs ago, by AviD

NOT that there is anything wrong with that.

It says so on my facebook page

@kalina that scene from Big Lebowski....

@kalina oh? link?

8:57 AM

@AviD never seen it

@AviD im not following you...

;-)

@kalina WHAT.

@AviD no.

that would be like the most epic disaster in the history of humanity

how can you claim you're bored when you still have that at the top of your todo list??

not only would you know my name, my age, what I look like, you'd also have access to a list of my not-so-privacy-concerned friends

who would most likely quite happily fill in additional details, like my address

THIS DISASTER SHALL NEVER COME TO PASS

I'm sure searching facebook for people who list their religion as nihilist would narrow it down to a few million people

have fun with that

give you something to do instead of pretending to be a security professional

9:00 AM

@kalina shure, because I'm the one you have to worry about.

is anyne getting security messages on laviejolie.com ?

@AviD no, you're right

@AviD heh - us oldtimers are well past that one.

in fact, the other week when I left my phone unlocked was quite a close call

@AviD I don't

I don't even know what you're talking about

@kalina you should

It's very good

user image

2

9:04 AM

I can't watch something recommended by AviD

I have standards

The Big Lebowski is rather good

@kalina How about something recommended by me?

hmmm - anyone got views on this? I think it's off topic - a config/rtfm issue

1

Q: adding certificate that resides on smartcard to the microsoft store with private key ownership

how can we solve CryptAcquireCertificatePrivateKey fails with 0x8009200B when adding certificate from smartcard to local user store? in an enrollment system where users generate smartcard certificate request online to a CA , the certificate is loaded 'offline' in the smartcard, for example sever...

cryptography public-key-infrastructure smartcard

and should we have a 'Dave' tag, d'ya think:

54

Q: Convincing my manager to use salts

My manager says we don't need to salt our passwords because people are not likely to use the same password because they all have different native languages, in addition to the websites they are active at. What is the best counter argument to this?

passwords hash salt

g'day mates

@emberfang mo'nin

or if you are out in 'straya, afternoon

@RoryAlsop it was still recommended by avid

9:19 AM

I'm still recovering from that heat-wave

@emberfang we have had one in Scotland for over a week now. Over 20 Centigrade every day. It's just not right!

Ugh. Morning.

@RoryAlsop We have warm weather here for a couple weeks now, and this weekend there is a pretty big festival (Graspop metal meeting) and they are predicting rain...

ey up @FE

@RoryAlsop that's barely a heat wave

@FEichinger Ugh. Morning.

9:23 AM

@kalina it is in Scotland

@Arperum Good line up! We saw most of those at Download and they were good!

not quite most - but certainly many

@RoryAlsop *barely* a heat wave.

Sure it's t shirt weather but it's not bikini weather

@kalina I look stupid in a bikini

10

haha

but it is definitely taps aff weather

@Arperum Avenged Sevenfold and Behemoth have awesome stage shows on this tour

@RoryAlsop Which ones in specific did a good show? So I can make sure not to miss these, because there are always at least two bands playing at the same time (except for the headliners)

9:24 AM

And Alter Bridge are awesome

Don't miss Steel Panther

@Arperum My top 5: Alter Bridge, Avenged Sevenfold, Soundgarden, Black Label Society, Steel Panther

However, Sabbath and Slayer weren't playing at Download - so they may well be higher up the list.

@RoryAlsop I've seen slayer at Fortarock this year already, it wasn't that special. They barely moved on the stage at all...

@Arperum ahh. Best overall stage show was Avenged's - amazing stage hardware/screens/pyro etc. Behemoth also had good kit.

Steel Panther have a lot of audience participation, especially for their song 17 girls. If you know of them you will understand.

@RoryAlsop I'll try to remember to go watch these two in particular.

@RoryAlsop I don't know steel panther, but I know of situations with massive crowd participation (The Bard Song or Valhallla at a Blind Guardian show come to mind)

Black Label Society and Alter Bridge were both just amazing though - Kennedy and Tremonti, and Zakk Wylde really know how to rock

@Arperum ahh - perhaps look at some of their youtube stuff. very NSFW. Imagine Poison without the political correctness. They went down very well at Download

@RoryAlsop I might do so tonight. At work now though. It'll be a while until I'm home.

9:35 AM

enjoy - try Glory Hole, and perhaps the video from Download Festival of "17 girls"

@LucasKauffman - the adobe password hack was because they DIDN'T hash the passwords at all, let alone salts - they used 3DES in ECB mode, so no salt and also no IV (which is used typically for chaining modes...)

this re the daveboss nosalt q.

also, I dont blame the manager in this case - I blame the consultant who did a pisspoor job of halfsplaining salts to the clueless boss.

@Lighty Don't make jokes about me. It's unhealthy for you.

@FEichinger @Lighty he's right. Only we get to make jokes at @FEichinger. You haven't earned that privilege yet.

@AviD yarr harr

Dead serious. There's a very limited set of people who I allow making jokes about me. Anyone else gets a bump right up my shitlist.

9:47 AM

@FEichinger So, there is a whitelist of permitted jokers. I would assume there is also a blacklist of severe offenders. Now, we hear that there is also a brown list??

go easy, he's just out of bed you meanies :p

@AviD I could now make a nazi joke, but I feel that'd be insensitive.

« first day (1287 days earlier) ← previous day next day → last day (3583 days later) »

Transcript for

Jun '1425

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile