The DMZ

Iszi

02:27

Erm... what should be done with answers like these?

1

A: Tamper-proof BIOS password & settings storage with Trusted Platform Module?

--- this is comment, not an answer --- http://www.intel.com/design/mobile/platform/downloads/Trusted_Platform_Module_White_Paper.pdf BIOS Code The TCPA specifies the measurement of integrity of BIOS code at system startup. In order to accomplish such integrity measurement and reporting, th...

It's way too big for a true comment, yet it really isn't an answer either.

nealmcb

05:00

Ahh - finished some updates on the recent GPRS/EDGE breaks here and at Wikipedia.

1

A: Smartphone / GSM Sniffer

The most commonly deployed 2G (GPRS/EDGE) ciphers have now been publicly broken, and the evidence indicates that they were once again intentionally left weak by the mobile industry designers. See this news coverage: Researchers Hack Mobile Data Communications - Technology Review Codebreaker Ka...

Stefano Palazzo

10:02

you might want to check if my question isn't off topic, I'm not sure

1

Q: What useful things can I do with the html5 "keygen" element?

There's a new input type keygen in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" enctype="multipart/form-data"> <p><keygen name="key"></p> <p><in...

also, uhm, you don't have a public-key-crypto tag?

Rory Alsop

11:11

@ScottPack It's a doll, and even has a blow-up nozzle detailed on her back.

@Iszi - the lead singer's sister. The boxes even opened like real lego boxes, with perforations, and the pieces were in little plastic bags ready to be assembled

Christoffer

12:11

I was wondering if anyone is aware of that ONE resource considered the authoritative source for defining an IT-security taxonomy? I'm specifically looking for definitions of things such as 'information security', 'risk', 'threat', 'security architecture' and so forth. (I'm sick and tired of having to constantly explain to people the difference between various terms, risk vs threat etc.

Iszi

14:08

@Christoffer I doubt there is any "one" resource. Good luck.

I know this one's not IT, or IT Security related, but I still say we need to get XKCD on a feed in here. Seriously about LOLed in my cube on this.

nealmcb

14:42

@Iszi Well it is security related, though not IT security. The pattern of dealing with security issues using tools actually made from viruses is very important to security. See also why Randall is addressing cancer a lot recently: blog.xkcd.com/2011/06/30/family-illness

Jeff Ferland

15:21

@ThomasPornin security.stackexchange.com/questions/6050/… That response is definitely over my head. Go get 'em Tiger.

Also, I can now confirm ONE new user as a result of DEFCON :P

Iszi

@nealmcb Didn't realize the motive behind the cancer theme. Thanks.

Hehe. This is funny. I think I can probably be accused of this, in the sense that I'm usually the bassist in Guitar Hero/Rock Band/etc. even when I play solo:

Hrm... 404 still blah?

security.stackexchange.com/tags/security/info

Christoffer

15:43

@Iszi Well, I'll continue my pursuit for this. Perhaps it would be a reasonable idea to use sec.se as the starting point through the community wiki? May have to give this some thought, but would love to see THE source on definitions. Perhaps it's only me missing them, everyone else seem so occupied with installing the next-gen ultra appliance that will solve security logging. sigh

Thomas Pornin

16:12

Hello

@JeffFerland That response makes no sense to me. It would take a while to unravel the source of the confusion in the head of that poster -- and a Q&A site is not the right format for such a discussion/therapy.

Jeff Ferland

@ThomasPornin Insanity is usually over my head.

Thomas Pornin

I think he was quite impressed at a presentation of which he understood about nothing, and much less than what he believes he understood.

Jeff Ferland

16:50

Things I like: a site where I can say, "this doesn't seem right", get lots of karma votes for it, and generally feel good at the end of the day.

Thanks, security.se

Jeff Ferland

17:26

client.bill.setHours(5)
.setDescription("Tilting at windmills")

Scott Pack

18:44

@RoryAlsop Why am I completely unsurprised that you guys officially have a blow up doll in the band?

Although, I suppose that I should be surprise that it's not four legged and wooly.

2

Iszi

18:58

So, yeah... for shiggles I just tried to get Excel 2007 to enumerate all of its cells for me. It's a little thing I used to do back in the day due to some sort of sadistic sense of PC nerdism. Usually, this would bring Excel to its knees for awhile, and sometimes the entire PC with it - though I'm not sure why simple addition is such a hard task for any computer, especially with the horsepower we have these days.

Jeff Ferland

@Iszi Probably doesn't add up the values Markov-chain style. AKA memory-go-boom.

Iszi

I kept the operations pretty simple. Start out with: A1=1, B1=A1+1. Then, copy B1 all the way down to... OMFG, we now have a column XFD!

That worked pretty well, marking every cell in the first row and ending with XFD1=16,384. (Value, not formula)

Then, I write A2=XFD1+1. Processes easily enough. Now, copy B1:XFD1 to B2:XFD2. Easy-peasy. Now that I've gotten my template row made, I try to copy A2:XFD2 to A3:XFD1048576 (love the new row maximum!).

Here's where Excel wimps out. First, it gives me this:

Then, after clicking OK, I get this:

It's like the computer refuses to be put through this torture anymore. Wonder if there's any way to force it?

This is on an XP SP3 system, with dual-core 3GHz CPU and 2 GB of RAM.

Wow. Weather just got real nasty in a quick hurry here.

Jeff Ferland

19:15

Courtesy of my company's pain-in-the-ass web filters, I see no images.

Iszi

First one:

The operation you are about to perform affects a large number of cells and may take a significant amount of time to complete. Are you sure you want to continue?

Note: This operation will be performed automatically in 60 seconds if no response is received.

Second one:

Excel cannot complete this task with available resources. Choose less data or close other applications.

Jeff Ferland

yeah... just the internal code of Excel... wasn't designed to do that smartly, or perhaps thinks like "audit equation" are mucking it up on the back end.

I have two rules I like to tell business users about dealing with large amounts of data: 1) Excel is not a database. 2) Never use Access.

Iszi

19:32

Anyone have links to good documentation regarding Wake on Wireless LAN? I'm gonna be Googling it, but was interested if someone here has actual experience and knows a solid go-to resource.

Particularly, I'm considering setting up Wake on Wireless LAN on a machine on my home network. The WiFi is WPA2-AES protected, with MAC filtering.

Thomas Pornin

@Iszi revolutionwifi.blogspot.com/2010/11/wake-on-wireless-lan.html

Apparently there are consequences.

I used WoL once, when I had a small server (always up) and a big PC (down when I was not at home, but with a SSH server when up).

So I could boot the big PC up from the small server, which itself could be contacted from outside.

AviD

good evening, @all

Thomas Pornin

for WoWLAN, the receiving machine must be part of the wireless network even when it is off

AviD

@Iszi I had to read that 3 times, to realize you're not talking about an FPS.

Iszi

@ThomasPornin That's what I thought. Seems like it'd be a tricky proposition.

Thomas Pornin

19:44

so it is not completely dead, only _mostly dead.

Iszi

@AviD First Person Shooter?

AviD

yeah

"Quake on Wireless LAN"

course then I'm thinking about that XKCD with the microwave...

Iszi

@ThomasPornin That's what he said...

@AviD Which?

AviD

@JeffFerland me?? why do you think I could do better...?

@Iszi hang on....

Thomas Pornin

@Iszi I see that people know their classics.

Jeff Ferland

19:46

@AviD wait, how am I dragged into this? Are you only mostly dead?

AviD

Iszi

@AviD Ah, right.

Thomas Pornin

Anyway, WoWLAN (or WoL) requires sending a "magic packet" which the target sees (a packet is magic if it contains a specific sequence which includes the target MAC address).

so this necessarily involves some kind of broadcast

AviD

@ThomasPornin wait, now we switched to world of warcraft??

Rory Alsop

@ScottPack - She doesn't actually come out that often:-)

Evening all

AviD

19:48

hey @RoryAlsop

Rory Alsop

How's tricks @AviD

AviD

@RoryAlsop alls good, thanks....

how was first day??

Rory Alsop

Pleasant - I got a laptop, found the coffee machine, got given a calendar full of meetings for the rest of the week:-)

AviD

ah, so you're all sorted, then...

Rory Alsop

very organised for first day - won't get my door pass until tomorrow but that's still pretty organised

@ScottPack I thought that was the Welsh?

AviD

19:51

@RoryAlsop for sure - laptop AND calendar on the first day? thats shocking....

usually its just the coffee machine....

Rory Alsop

heh -I know

AviD

so hows it look? big scary corporate style?

Iszi

Hrm. Upon further review, WoWLAN might not be that good of an idea. At least, not in its current incarnation. Maybe if some more work is done to get some of the kinks out, it could be worthwhile.

Rory Alsop

nah - very similar to E&Y. Different style, but same idea...only this time I get to be in charge of growing a team from the very start

really looking forward to it

Iszi

Even if I could implement it, and it would be just for that one laptop on the home network, I don't think I'd do it.

AviD

19:54

@RoryAlsop fantastic

@JeffFerland that was referring to this:

5 hours ago, by Jeff Ferland

@ThomasPornin http://security.stackexchange.com/questions/6050/real-salt-and-fake-salt/6269#6269 That response is definitely over my head. Go get 'em Tiger.

dang, I hate wearing pants all day.

Rory Alsop

@AviD I'm hoping that's in the American sense, not the British sense...

AviD

@RoryAlsop lol, yeah I meant "trousers", sorry

though I imagine that still doesnt sound much better...

Rory Alsop

heh, @AviD the 'commando'

AviD

@RoryAlsop hehe

well, since I usually work at home, I hang out in shorts all day. In the summer, anyway.

Rory Alsop

I have been, when not at a client

AviD

20:01

when I go out for meetings, I bother getting dressed.... but its too hot for this crap

Rory Alsop

those days are gone - today was hot and sunny, and I was in a suit again

AviD

shorts == short pants, not sure what you fellows call 'em

@RoryAlsop oy. hope the aircon was full ablast

Rory Alsop

@AviD aye - shorts

@AviD aircon was wonderful

AviD

well thats good then, sounds like a pleasant office to work at - coffee and aircon, dont need much else. a chair would be a bonus, but not required ;)

hey @RoryAlsop you ever eat jellyfish? survivingtheworld.net/Lesson1147.html

Jeff Ferland

@RoryAlsop ah yes, back to the big accounting world...

Rory Alsop

20:05

hahahah - you have found my weakness, my Kryptonite

I don't do fish of any kind

AviD

@RoryAlsop oh my goodness, really??

Rory Alsop

@JeffFerland well, luckily I get to avoid the accounting and audit

AviD

wait, didnt we discuss penguins once?

@JeffFerland oo are you guys competitors now...? ;) <tries to rock the boat>

Rory Alsop

@AviD two legs good, 4 legs good...but fish have none or a milion - bad

penguins aint fish

even if they do smell like em

@Jeff - where you work?

Jeff Ferland

@RoryAlsop bnncpa.com

AviD

20:06

@RoryAlsop ahh

Jeff Ferland

I have a few interviews this week, though. Escape time!

Rory Alsop

Looking good:-)

Jeff Ferland

Yeah... I've got high hopes for the OWASP/Atlanta guy's interview

Also, I did a what-the-hell-why-not app to Google's infosec positions

Rory Alsop

fingers coressed then

AviD

@JeffFerland who's that then?

Jeff Ferland

20:09

@AviD Tony UcedaVelez

AviD

uckadawho?

never heard o' him

Jeff Ferland

Guy I met at BSidesLV

You now know as much as I do if you can Google him

AviD

heh

I can do better....

turns out he's quite prolific on the OWASP internal mailing list....

I cant be bothered reading it, too much noise...

Jeff Ferland

@AviD does better involve me getting another job? :)

... or enough venture capital to start my own business? I've got some very boring but highly profitable markets identified for big business

AviD

I meant, I can do better than googling him.

seems he's big on OWASP politics...

Jeff Ferland

20:12

@AviD Yeah, I know.

AviD

so this is interesting. As a jewish guy interested in encryption and such, it turns out there's actually a term for me.... !

Crypto-Judaism

Crypto-Judaism is the secret adherence to Judaism while publicly professing to be of another faith; practitioners are referred to as "crypto-Jews" (origin from Greek kryptos - κρυπτός, 'hidden'). The term crypto-Jew is also used to describe descendants who maintain some Jewish traditions of their ancestors, often secretly, while publicly adhering to other faiths, most commonly Catholicism. The phenomenon arose in the Middle Ages following the expulsion of the Jews in 1492 from Spain. Europe Officially Jews who converted in Spain in the 14th and 15th centuries were known as Cristianos Nuev...

okay, well, not exactly.... but I still think its a cool name! :)

and, it does re-emphasize that crypto means "hidden", in forms other than encryption... ;-)

Iszi

@AviD So, you're saying steganography is indeed a form of "cryptography"?

Scott Pack

@RoryAlsop Welsh, Scots, Irish...it's hard to tell sometimes :)

AviD

@Iszi hmmm.... I... guess so...?

M'vy

I don't agree with this.

AviD

20:20

strictly speaking, anyway....

Scott Pack

@Iszi That's a great notion to think about. "I'm so in the closet, I've stegoed my faith!"

AviD

@ScottPack heh

Scott Pack

Reminds me of, well, most everyone who has ever lived in proximity to the Catholic church

AviD

"I'm actually keeping my faith out in the open, but noone notices it!"

Scott Pack

@AviD Even better

Rory Alsop

20:29

@AviD, @Graham - thoughts on that flagged question? It isn't exactly an ideal one for here, but is the sort of thing someone might google for, and the answers are okay

AviD

@RoryAlsop I have no problem with the ontopic, but I couldnt find any question there.

other than "what OS should I install"

which dont really count

Rory Alsop

yep

sort of what I meant, but I was also trying to understand where the kids stuff was - hey go back to school tomorrow - so was distracted

shall we get the mod-hammer out

?

AviD

@RoryAlsop tomorrow?? we've got 2 more weeks...

though from next year, they are starting a week earlier.

@RoryAlsop was gonna give him a chance to edit, but yeah, I guess.

Rory Alsop

the kids are delighted - 6 weeks is too long a holiday, even when we try and fill it, they still get bored and miss their friends

@AviD was just thinking it is a day since you posted your information request comment

AviD

@RoryAlsop kids are wweeeiiiirrrrd. then, they complain they wanna get out of school....

@RoryAlsop yeah.... and - done!

Rory Alsop

20:36

ya beat me to it

Iszi

If any of y'allz has an answer for this, go for it please:

0

Q: Synchronize Internet Time in a script?

Is there a way I can synchronize the system clock with an Internet Time server (i.e: time.nist.gov) via command-line? Preferably, this should be something executable via BAT or PowerShell script. This particular need arises because I have some VMs for which I regularly use the "save machine sta...

windows-7 script time

Rory Alsop

yay - I just earned "Excavator" over on SU

AviD

@RoryAlsop got the flag points!

@RoryAlsop wots that??

Rory Alsop

LOL

dunno

hang on

AviD

oo new badges!

Iszi

20:37

Sounds like Necromancer?

Rory Alsop

"Edited first post that was inactive for 6 months. "

AviD

Edited first post that was inactive for 6 months

[Archaeologist] Edited 100 posts that were inactive for 6 months

Rory Alsop

@Iszi don't know on Windoze

@AviD nice

Iszi

@AviD Oooh

Thomas Pornin

@AviD But edition counts as activity ?

AviD

20:39

[Proofreader] Approved or rejected 100 suggested edits

Rory Alsop

you must have that one, surely

Jeff Ferland

@Iszi BAM!

AviD

speaking of which, I dont get why I dont have copy editor yet. or even strunk & white.

btw, 7 users have the excavator thingie here.

security.stackexchange.com/badges/78/excavator

Rory Alsop

wonder what it counts as 'edited' and 'posts'

AviD

e.g. @ScottPack!!

Rory Alsop

20:42

heh

AviD

security.stackexchange.com/users?tab=editors&filter=all

983 edits!! woooo!

Iszi

Would I be too paranoid in saying "Unless the key was sent encrypted to you, you should create a new key and revoke the old one - the old one should be considered as compromised."

1

Q: Manually create Private RSA Key from Text file? To be used with SSL for IIS7

I have been sent two txt files from somebody who used to maintain a website for a client. One contains the certificate from Thawte with: ---BEGIN CERTIFICATE--- xxxxxxxx ---END CERTIFICATE--- The other contains the RSA Private Key -----BEGIN RSA PRIVATE KEY----- xxxxxxxx -----END RSA PRIVATE...

windows-server-2008 ssl iis-7

Rory Alsop

wow - see me at 154

that's an odd question @Iszi - I don't think it should necessarily count as compromised...totally depends on the usage.

I wouldn't trust it personally

but it may not be that big a deal to the poster

Iszi

True

Is that one that should be migrated to us?

AviD

dang, seems I'm also quite chatty. I seem to have posted many more comments than anyone else... at least in the modlist.

Iszi

20:45

@JeffFerland Hrm. Interesting... Reading the /? now.

Scott Pack

@AviD That counts retags as well. Those editor badges don't include retags or edits one makes to one's own posts.

Rory Alsop

@AviD - the stats show you try to provide guidance more, but close more questions:-)

AviD

@ScottPack ohhhh

Scott Pack

There's actually a nice script on data.SE that figures it all out for you. I'm just too lazy to go find it now.

Rory Alsop

whereas I kill lots of comments

Iszi

20:48

Ok... browser chat window acting wierdy.

Ctrl+F5 FTW

@JeffFerland It looks like the /update needs a /config in front.

AviD

oh my. not just mods....

according to data.se, I have commented about 2.5 times as much as #2.

Jeff Ferland

security.stackexchange.com/questions/6287/… <-- sometimes voting confuses me. Maybe I need more paragraphs.

Rory Alsop

hahahaha - 'gossip' badge for @AviD

AviD

@RoryAlsop hehe, that would be a great one. posted 1000 comments...

Rory Alsop

@JeffFerland there was a good answer on meta.so about how SEI tried to remove the problem of 'first post voting' by shuffling answers round if they came in around the same time or had the same number of votes

doesn't really work though

Jeff Ferland

20:53

@RoryAlsop I was the first post... :(

Rory Alsop

I bet you got shuffled

Jeff Ferland

Looks like I copy-catted now, though.

Rory Alsop

or possibly - you need more paragraphs

Jeff Ferland

/me writes shit that's tl;dr

Scott Pack

@AviD Here you go, let's not forget your userid is 33: data.stackexchange.com/it%20security/s/1397/…

Rory Alsop

20:54

I usually do that, and then do para insertion after I finish

@ScottPack I get 109

@AviD gets 39 - what is it you are editing, dude?

Jeff Ferland

I just get a kick that @Thomas' awesome but only tangentially related factoid has more upvotes. The Cult of Thomas Upvoters (alright, I'm one...)

Iszi

Wow. SU works fast. My question on synchronizing Internet Time in a script is already in top 5 on Google for this search...

encrypted.google.com/…

Scott Pack

@RoryAlsop I'm sitting at 56. Almost all the rest of mine are retags.

Rory Alsop

looks like I only edit other's posts:-)

@Iszi impressive, innit

AviD

@RoryAlsop huh.

lots o' tagging, thats for shure.

Rory Alsop

20:56

looks like you only get S&W credits for editing others

Scott Pack

@RoryAlsop But not retags, which are included in the edits calculations.

Iszi

@JeffFerland The /resync works fine on XP, but 7 seems to block it - damn UAC.

Jeff Ferland

@Iszi sudo make me a sandwich?

Iszi

@JeffFerland :-D

Now, if only Windows had sudo...

AviD

@Iszi runas?

Iszi

20:58

@AviD Never liked the command-line implementation of runas for some reason.

Rory Alsop

@JeffFerland got to love xkcd

Scott Pack

@Iszi Avi has a point. You can issue runas from the command line

Jeff Ferland

@Iszi yup, runas :)

AviD

@RoryAlsop? you're not going to agree?

nealmcb

@Iszi Wow. But can you approve my edit to add "windows" to the title? "ntpdate" is the answer where I live... Tags are just not very obvious.

AviD

21:00

seems to be a meme, here... ;)

Iszi

@RoryAlsop Seriously, can we get that added to our feed in here?

Jeff Ferland

Remember how I commented that I hadn't seen a question hit over 200 in the stackexchange drop-down list of most popular? I see a 326 now.

AviD

drawback of course is the password needs to be entered there...

Rory Alsop

what is at 326? Our xkcd question got to 230 the other day

@AviD agree? I love xkcd. Wish we could get it on feed in chat

AviD

english q

Jeff Ferland

21:01

Is there an American English equivalent of the British idiom "carrying coals to Newcastle"? (now at 271)

26

Q: Is there an American English equivalent of the British idiom "carrying coals to Newcastle"?

I'm an American living in the Netherlands who is learning Dutch. There's an idiom in Dutch that describes performing a needless/futile activity, "water naar de zee dragen," which literally translates to "carrying water to the sea." My Dutch parents-in-law asked me if there was an English equivale...

idioms american-english british-english phrase-requests

Rory Alsop

I see it at 271 - weird, eh

AviD

@RoryAlsop @Iszi talk to @ScottPack, he's the room owner

Iszi

@JeffFerland Not familiar with that one, so I couldn't help you there.

AviD

'course you are, read the answer.

has to do with the fact that the main export of Newcastle is (was?) coal.

Jeff Ferland

Ugh. IT is upgrading my laptop. Here we go with hell...

Iszi

21:03

@JeffFerland My desktop is supposed to be done some time this week. Just backed my profile up to a TB external.

AviD

okay, this is the kind of swag ITSecurity should get....

thinkgeek.com/computing/accessories/2940

simple, cheap(ish), and not totally generic. Also, has something to do with protecting yourself...

Jeff Ferland

Bash shortcuts are awesome...
pwgen
aptget install !$
apt-get install !*
sudo !!

Iszi

Hrm... adding && PAUSE to a shortcut path doesn't seem to actually && PAUSE.

Jeff Ferland

err, apt-get !*. Whatever.

Rory Alsop

@JeffFerland heh - I wondered

AviD

21:07

one of the better blog posts I've read in a while: blog.spiderlabs.com/2011/08/…

"What Web Application Security Monitoring Can Learn From Casino Surveillance"

more blackhat fallout....

Iszi

Mkay, got it.

@echo off
w32tm /resync
PAUSE

Save to MyDocs as `TimeSync.bat`, right-click, Send to->Desktop (create shortcut), right-click shortcut, Properties, Advanced..., Run as administrator, OK, OK.

In other news, chat's MarkDown hates me today.

nealmcb

@JeffFerland You mean apt-get !* I think....

Rory Alsop

this is an interesting analytics tool:

data.stackexchange.com/it%20security/s/95/…

that final column shows perceived answer quality

AviD

wow, I'm not even in top 15....!

well, its really the top 20 that matters.... ;-)

Rory Alsop

I'm further down than you! I have quantity, but not quality :-(

AviD

21:10

you're #21.... hence my previous comment :D

Iszi

@JeffFerland - Please edit your answer to show the correct command-line switch, and I'll accept.

Rory Alsop

@AviD fangyewfurrymuch

right - gotta go spend some time drinking wine wit'wife :-) see you later

p.s QOTW #6 will be out on Friday. Get voting for #7

AviD

@RoryAlsop hahahaha

Jeff Ferland

@nealmcb yeah, noticed that... but i was right where it counts, on the command line :)

AviD

@RoryAlsop gotta go too... gnite

Jeff Ferland

21:27

Time to go make some sushi....

Transcript for