« first day (1356 days earlier)      last day (3514 days later) » 

12:11 AM
> "[the hashkiller password dictionary...] contains 5,144 variations of the word "boob" (yes - I [sic] checked)"
/cc @LucasKauffman
heck you probably came up with 4896 of them
 
12:25 AM
@AviD Only?
@deed02392 Cool. The one SSL Labs has is still the gold standard but that's pretty annoying to automate since it's browser based.
 
well @RoryAlsop has had a few millennia to come up with a few of his own.
 
1:04 AM
I have kinda had it with KDE. It needs some serious bugfixing work.
switching now to MATE, which is basically the continuation of GNOME 2 . Why f*ck up perfection.
 
2:03 AM
> Perl is a molotov cocktail, it was probably useful once, but few people use it now.
> Java is a belt fed 240G automatic weapon where sometimes the belt has rounds, sometimes it doesn’t, and when it doesn’t during firing you get an NullPointerException, the gun explodes and you die.
> JavaScript is a sword without a hilt.
> bash is a cursed hammer, when wielded everything looks like a nail, especially your thumb.
> Ruby is a ruby encrusted sword, it is usually only used because of how shiny it is.
> PHP is a hose, you usually plug one end into a car exhaust, and the other you stick in through a window and then you sit in the car and turn the engine on.
4
 
2:42 AM
Turns out the iCloud vulnerability was a simple web/API based lack of throttle.
Aren't there frameworks that prevent such a thing?
:/
Then again, security is hard
5
 
 
2 hours later…
4:54 AM
@ManishEarth are there in any languages Apple uses?
 
5:22 AM
@RoryAlsop yea lots of naughty pictures leaked and tbf they aren't even half bad
 
 
1 hour later…
6:41 AM
@LucasKauffman note to self - google later :-)
 
 
1 hour later…
7:43 AM
yesterday, by Rоry McCune
"PHP is a hose, you usually plug one end into a car exhaust, and the other you stick in through a window and then you sit in the car and turn the engine on."
:op
 
@RоryMcCune Dammit! Ninja-ed by a fossil...
 
@TerryChia woah there, I'm a dinosaur, @RoryAlsop is a fossil :op
 
@TerryChia Well, he had plenty of time to post it.
Millions of years, even.
 
@RоryMcCune ...........
 
8:16 AM
@RоryMcCune RoryAlsop was there when the big bang happened.
 
@LucasKauffman I think he made the big bang happen. If you know what I mean. ;)
3
 
@LucasKauffman so @RoryAlsop is Jones!
 
Some say he farted
 
> She does not consider herself alive. She does not eat or sleep, and can remember everything she has experienced with clarity. In order to observe human life, she will occasionally find someone and choose to live their life with them as a companion. When the person dies, Jones will usually take on their name. Eglamore is one of these people.
 
8:25 AM
Jones is pretty much literally a force of nature
 
@LucasKauffman BTW if you haven't read gunnerkirgg don't start if you have other things to do... catching up when I found it took a while!
 
@ManishEarth Throttling is hard. By IP doesn't deal well with botnets, by target allows trivial DoS.
 
@RоryMcCune Yea, I basically lost yesterday due to it... I learned about it somewhere around 3PM, and basically I've only been reading yesterday, but I did caught up.
 
@Arperum yeah finding a good webcomic is like that, it's cool and all but you lose days!
 
Same(lost a day or more) happened for girlgenius and goblins. Both are pretty damn good.
 
8:38 AM
@Arperum girlgenius, yeah that's a long haul, I made the mistake of re-starting it the other day 'cause it had been a while... several hours later I realised I had other things to do..
 
urgh Belgium wants to buy the F-35
instead of the Saab Grippen or the Eurofighter Typhoon
 
@LucasKauffman wow I hope some people got very nice bribes for that one
F-35 looks like a very very expensive disaster to me
it totally blows my mind that countries are buying these things at $125 million EACH
 
@RoryAlsop: This is what happens when you buy a plane before it flies
I need to restart on goblins
and see if vexxar is back up
 
@RоryMcCune yea my opinion as well
 
@LucasKauffman Belgium keeps doing stupid things recently. Did you read about telenets plans for fucking up net neutrality too(article in Dutch)?
 
9:09 AM
@RоryMcCune Ahhh - yes, haven't read that for quite some time. Will need to catch up... sometime
 
@RoryAlsop recent ones have been quite good, so worth the catch up :)
 
@RоryMcCune It was your fault last time as well. Blimming time sink
 
@Arperum yes
 
 
2 hours later…
10:54 AM
I guess that @AviD won't be around today as he's AppSecIL'ing
 
@RоryMcCune So we should get our mocking in whilst he is gone?
 
@TerryChia well that and pinging @avid a lot
 
Oi @AviD you hipster neckbeard!!!!!!
4
 
11:16 AM
Good old @Avid
 
Are you sure we should be pinging @AviD in every message?
Because pinging @AviD this much might get boring after a bit.
 
What would @Avid do in our place?
 
I dunno, maybe @AviD can tell us
(chuckles like a schoolboy)
@RоryMcCune just had to star that so I remember to open a tab for it at home.
 
@RoryAlsop somehow that makes me feel very uncomfortable
What if @Avid was one of us?
 
11:36 AM
@RoryAlsop What was school like in the Ice Age?
 
@LucasKauffman @AviD one of us?
well in some sense I suppose @AviD is
but then in others perhaps @AviD is not
 
What's this talk about @AviD?
 
@RоryMcCune Does @AviD even really exists?
 
Did I miss something? Did @AviD do something?
 
@RоryMcCune Just a slob like one of us, just a stranger on the bus...
@Avid is trying to find his way home
 
11:42 AM
@TerryChia I'd graduated by then
 
@RoryAlsop @Avid wouldn't have been born even
 
11:56 AM
@LucasKauffman Was @AviD @AviD when @AviD was born?
 
I'm not sure if he was @Avid, but I suppose @Avid will become @Avid eventually
 
12:09 PM
@CodesInChaos Yet GMail, Apple, and everyone manage it fine. This wasn't an issue with insufficient throttling, this was an issue with forgetting to throttle for a single API endpoint (or login page, forgot which)
Yes, I said Apple manage sit fine -- the normal login portals are throttled okay. A specific one wasn't
I'm saying that any decent framework should have some throttling that can be applied to all login pages. And anyway, companies like Apple and all probably should be having a special thingy in their framework that lets them declare that a form is a login form (and the rest of the logic, including throttling, is taken care of)
 
1:10 PM
@AviD
 
@ManishEarth Lack of throttle? What does that mean?
 
@Simon It means that someone wrote a simple python script that brute forced the login page
no need for a botnet
 
@ManishEarth Oh, so there was so restriction by IP?
 
itertools+urllib2 ftw
yep
 
After X failed attempts, timeout for X
lawl
That's bad.
 
1:13 PM
I find this interesting though
Such a bug would probably be worth a huge bug bounty
Order of a few tens of thousands of dollars?
 
@ManishEarth Especially when a ton of the user base obviously have weak passwords.
 
Someone, somewhere, decided that JLaw boobies were worth more than ~$50k
(Then again, it's quite possible that the attacker got pics of celebrities AND got into the banks of a milliyum other people)
 
@ManishEarth I'd think that you'd be able to do more then look at a picture of boobies for $50k...
 
@Arperum haha
 
@ManishEarth Is a milliyum more or less then a millinom?
</terrible pun>
 
1:17 PM
ha
 
@Arperum You donut.
 
@Simon at least I'm tasty.
 
At least.
 
@deed02392 @LucasKauffman @RоryMcCune or any testers in here, if you run across any IIS servers running SSL during your tests and if you are able to mind giving my tool (github.com/Ayrx/tlsenum) a whirl to see if there are any problems?
I'm trying to see if github.com/Ayrx/tlsenum/issues/2 is a valid problem.
 
@TerryChia Has this code been reviewed?
@TerryChia You can actually run it against mine
 
1:29 PM
@LucasKauffman Nope, but the only thing is sends out is ClientHello packets.
 
@TerryChia skeleton-key.org
 
@TerryChia Do those packets have the balls to do the ice bucket challenge?
#simon
 
@LucasKauffman Hmm thanks. Interesting, I get a connection reset.
 
@TerryChia It's running an SSL VPN which requires IIS
 
1
A: Can an unlisted directory on webserver be discovered?

Haider QureshiDirectory brute forcing can be used to enumerate the directory, this can be done using tools like Directory Buster for Directory Enumeration These tools have millions of words of lists, which are bruteforced on the website, to enumerate directories. This is done at a rapid speed. To counter thi...

 
1:33 PM
this gives a not found error
it's a valid cert though
 
Read the last paragraph, sigh.
 
@LucasKauffman Yeah, I can see that. I'll have to see what's going on.
 
@Simon you can't hashtag your own name... #donut
 
@RoryAlsop Blame @AviD.
 
#@Avid
 
1:57 PM
After flagging all these posts, I feel like I should be the moderator of the entire planet.
#yolo
 
hahahahahaha - even when @AviD isn't here, Simon gets booted for doing that
 
:(
I'm not sure I understand why this question was downvoted this much: security.stackexchange.com/questions/66490/…
The dude put some effort into it at least.
 
2:15 PM
@Simon I upvoted. I think there must be a few kneejerk "Dave" downvotes , but I thought the question was okay
 
@RoryAlsop Yes, especially when the main reason why he wants to implement this is to make it faster which is a legit reason, imo.
It's different than the typical "I'm smarter than the devs" question.
 
2:50 PM
@Adnan That we know of.
 
3:00 PM
Microsoft's response to Docker?
 
Anybody knows about the deal between OECD and Switzerland regarding ending the thing with client secrecy?
When does the treaty come into effect?
I cannot find anything about that online.
 
@TerryChia How do you properly deal with datefield in django? I'd like to return a string with Y-m-d from the model instead of having to handle the object in my view.
Do you declare a method that does it directly in the model?
 
3:21 PM
@Adnan concerned about your swiss bank accounts getting dox'ed?
 
@RоryMcCune I'm interested in the details that will be uncovered regarding Russian, Iranian, and Syrian officials' accounts in Swiss banks
 
@Adnan Ahh I C, indeed could be interesting...
 
@Simon override __unicode__()?
 
@Adnan It has been signed but not yet ratified or scheduled for application
(in other word. It'll be applied "eventually")
 
@Stephane God damn it! Switzerland is one of the few countries where the enforcement date isn't specified.
 
@Adnan yup
 
@Stephane Thanks a lot for the link, by the way
 
3:47 PM
np
 
@deed02392 That should do it, thanks. What's the difference with str?
 
@Adnan Don't hold your breath for application, BTW... given the climate here...
 
@Stephane Oho
 
@Simon well Django does everything in unicode now, so str is basically deprecated to use
 
Very reluctant to enforce it?
 
3:49 PM
@deed02392 Ah cool, thanks again.
 
@Simon that's my fluffy explanation of it, if you're on Python 3 or something you might wanna double check the Django docs
anyway yeah, enjoy :p
 
@deed02392 Yeah, it says on Python 3 it's unicode that is actually deprecated.
 
yeah that's right
just assuming you're on 2 here
 
@deed02392 Yes I am.
 
@Adnan With the right-wings nuts rising in power and winning stupid votation one after the other, the covernment isn't keen to "look weak" regarding foreign influence
So chances are it's going to be as delayed as possible unless the EU or US decides to kick the banks in the nuts and refuse to give them access to the open market
 
3:53 PM
@Stephane I bet there's foreign influence to stay away from the enforcement of that treaty as well.
 
Silly foreigners.
 
(sorry... our local tea-party equivalent are a constant source of annoyance to me)
 
@Stephane We have those as well.
Here's their boss
 
Everybody does
@Adnan At least he looks happy
 
@Stephane Happy because he just murdered a bunch of puppies.
 
3:56 PM
@Simon Could be...
 
Also, it looks like he's been eating a few donuts.
 
Well, at least yours can't impose (and win) ballots to write stupid things in the constitution like prohibiting minarets or forcing quotas on foreign workers from the EU (among other silly things)
(I'll shut up now... this isn't good for my blood pressure)
 
@Adnan tuli iso jytkyy?
 
@deed02392 :D
 
haha
 
4:05 PM
@Stephane I'm actually for prohibiting minarets and forcing quotas on foreign workers from EU (and from outside EU as well).
 
@Adnan Well, I'm not. With a grand total of 4 Minarets, it's agravating a (largely) calm and well behaving population for no reason
@Adnan And a large proportion of our local work force is made of foreigners
It's not as if unemployment was really a problem here... tradingeconomics.com/switzerland/unemployment-rate
 
@Stephane Oh no, don't get me wrong. I'm not against immigration. I, myself, am an immigrant here in Finland
I'm for reasonable laws regarding immigration, especially in cases of integration and deportation.
 
@Adnan I'm pretty sure the situation is different in different countries. but in Switzerland ? That's beyond stupid: the main reason why the country is doing so well 8comparatively) is that the best people from our neighbors wants to work in Switzerland.
 
and I do believe that without immigration, the population growth in many countries will fall negative, which will be catastrophic in the long run for ageing countries (like the Nordics)
@Stephane Which is fantastic. The problem is that many people from EU/EEA are exploiting the free movement laws to come and stay without means of support.
I see nothing wrong with making rules to limit that
If the country has too many carpenters and too few doctors, then why accept more foreign carpenters?
 
@Adnan It doesn't really happen here because a/ the subsidies for foreigners aren't really great (i.e. you can't live off it) and life is really expensive
So we have a problem with migrants from outside the EU (and to a lesser extend, from very, poor countries in the EU) but that's about it
Every stats point to Switzerland NOT having a problem with foreigners
Except in the head of some brainless cavemen in central Switzerland...
But again, this is Switzerland. A weird place by many aspects
Well... that's the end of the (work) day for me... o/
 
 
2 hours later…
6:27 PM
@Adnan It is not catastrophic in the long run; it just means that people won't be able to enjoy 30+ years of retirement.
The whole concept of "people work, then retire, then die" works as long as the people who are retired but not yet dead are few when compared to the people still working.
Now, of course, politically speaking, it can be hard to make electors accept the idea that their dream of living long, in good health, with large pensions paid by other people and without working, that dream will never come true.
 
#ihadadream
 
@Adnan For a "short" time perhaps. But I don't believe evolution will allow getting few children voluntarily.
 
7:35 PM
@ThomasPornin I think the word you want is electorate?
 
@deed02392 voters
 
@Gilles Both "elector" and "voter" exist and are mostly synonymous; however, "elector" appears to be slightly older (15th century vs 16th century).
 
@ThomasPornin yes, but elector wouldn't be used in this context
 
@Gilles Why wouldn't it be used ? I am pretty sure I did use it, by the way.
 
This will not end well if 2 French boyz are arguing.
 
7:43 PM
if you're referring to the people who vote, then I think at least in UK English, electorate is most often used
 
... about English.
 
@Gilles Haha.
 
@Simon I got popcorn. To the death!
 
om nom nom
 
just sayin' anyway, I don't care personally, I just like it when people correct me if it's not my first language
 
7:44 PM
popcorn -> five minutes of buttery goodness + an hour of digging kernels out of my teeth
@deed02392 @Thomas has no first language. He was birthed with the knowledge of all languages simultaneously.
 
one might feasibly suggest @ThomasPornin could take Chuck Norris in a fight
@TerryChia that looks awesome
 
@ThomasPornin @CodesInChaos I don't see why that particular sentence was picked. I do support reasonable immigration regulations. That's a good compramise between no immigration (more old people, bad after-work life, etc.) and open borders (erasing national identity, local culture compramise, etc.)
 
@Adnan It is the Internet. Sentences get picked and punched to death at random.
 
Yes, even the mighty #yolo sentences.
 
I don't think that "let's close the borders" is a solution to the "immigrants don't integrate, leech off of the wellfare system, and do crimes" problem.
Make wellfare benefits conditional on successful integration, and deport immigrant criminals.. that might be a better solution
 
7:56 PM
Every time I've seen the "But leeching immigrants!" complaint in Germany, the statistics revealed there's only, like, 50 people actually doing that.
 
@FEichinger Literally 50?
 
@Adnan I was responding to "the population growth in many countries will fall negative" since I believe that this can only be a short term effect.
 
@Simon I believe 43 was the actual number last time.
Granted, that was "Romanian leechers" in particular, but the point still stands: It's an exaggerated problem.
And, for the record, that's in Bavaria, one of the largest states in Germany. Scale that down to other states and you end up with a handful or two.
 
@FEichinger Holy fuck! Any sources, please?
 
@FEichinger Not in 'murica. Abuse of welfare systems here is appalling.
 
7:59 PM
In Finland, politcians always use UK and Germany as examples of how immigration went wrong.
 
@DavidFreitag Yeah. I think it's getting abused pretty badly in Québec too.
Maybe The Donut knows
I mean The Bear.
 
@Simon My mom works at an energy assistance program in the state's capital. She helps families get oil and money if they have electric heat.
 
@Adnan Lemme see if I can find an English source ...
 
@FEichinger German works as well
 
@DavidFreitag She witnesses abuse daily?
 
8:00 PM
@Adnan But the sentence I responded too was not about that. It was about immigration as a solution for the "people are getting old and don't make enough children" problem.
 
She says 80% of the people that come through are festooned with jewelery and nice clothes and very expensive cars
@Simon Hourly.
 
Sigh.
 
@Simon The good news is that she has this nice big red stamp that says "Denied".
 
@DavidFreitag I hope she's using it as much as she can.
 
@ThomasPornin Nope, I didn't say it's a solution. Multiple times I made it clear that reasonable immigration is a meeting-it-half-way solution, and not a pnnecea.
 
8:02 PM
@Simon She is affectionately known as "The oil fairy" by the people she helps.
 
@DavidFreitag Aw, that's cute.
 
@Simon She's also the only white person in a... 20 block radius.
 
@DavidFreitag Ahhh.. I'm getting tired of hearing this, by the way. What kind of government help that allows you to have jewlery, nice clothes, and very expensive cars?
and 80%?
 
@Adnan Ballpark estimate that came straight from my butt. But you get the point.
 
@Adnan I don't care about "multiple times", I just logged on and commented on the first sentence I saw. I have not read the previous conversation, but I feel entitled to talk nonetheless. I think I really master this Internet thing now.
 
8:03 PM
Unless the U.S. is paying people a 6 figure salary in wellfare, I don't see that happening
@DavidFreitag No, I don't get the point. chat.stackexchange.com/transcript/message/17468494#17468494
 
@Adnan They have as many kids as they can, then when they whine to the government about having all these kids to feed but no money to do so.
 
@DavidFreitag Common practice here too.
 
@DavidFreitag How much do you get per head?
do they*
 
Kinky.
 
@Adnan I have no idea, but apparently it's enough to get an E-Class merc.
@Adnan You also can't rule out other sources of income.
 
8:05 PM
@DavidFreitag Damn, it sounds like the same old track played in Finland as well
No matter how calculate it, on paper it's bullshit
I'm sorry, I'm not gonna believe that someone on wellfare can affored jewlery, nice clothes, and very expensive cars.
 
@Adnan Yep, so my mom usually says, "Go sell all your fancy jewelery and that nice car I saw you drive up in, then maybe we can talk."
 
I mean, how? Does the U.S. government pay parents who have 10 kids $1k per kid or something?
Because if that's the case, then maaaaybe I can believe that
but then the 10 kids would really starve year long
 
@Adnan You donut. Those people can be in the drugs industry or whatever.
Obviously you don't declare that income.
 
@Simon That's what I'm thinking, but then it isn't a question of abusing the system.
@Adnan Honestly I don't know. I don't have first-hand experience. There must be a way for these people to game the system.
 
I'm pretty sure that politicians with money overseas to avoid taxes and tax cuts for the rich are hurting the system a lot more.
However, both must be feircly fought
(rich tax avoiders and wellfare fraudsters)
 
8:10 PM
@Adnan Sure, but they're still abusing the system. The fact that some people abuse it more than you do doesn't make what you're doing right.
@Adnan Yes indeed.
 
@Adnan Good luck with that. The very same politicians will ensure a bill like that never passes.
 
@ThomasPornin I think it's something like elector = votant and voter = électeur (in this context)
 
@Simon I never said that. Actually, I quite detest people who say that. "A: ISIS are killing people, they need to stop. B: Well, it's not like the U.S. didn't kill people!"
 
@Adnan A paper released by the State Ministry after inquiry by the Green Party.
Has a table with the statistics.
 
@Adnan Well, that's how I interpreted it, somehow.
 
8:12 PM
@FEichinger I wonder if that actually pinged him.
 
@DavidFreitag It did
 
@DavidFreitag Considering the message highlight, I assume it did.
 
@FEichinger Thanks a lot. Looking at it..
 
Anyway, tl;dr: There were only around 500 instances of welfare abuse by immigrants.
 
Also I have to note that most of the cases I'm referring to are U.S. citizens that are abusing the system.
 
8:20 PM
@FEichinger Well, it says there are 591 cases
463 are Germans
 
Actually, the second column is cases. (Which would make only 543.)
Third column is suspects.
 
@FEichinger But do they specify that the Germans are of foreign origins?
Becuase if not, then the cases by immigrants is less than 90
 
You're correct. Those are actually Germans, not immigrants.
Which brings me back to the initial 50, though.
 
Shit! I'm pretty sure news outlets in Finland would be very interested to have a look at that
 
Of course the counter-claim is "But that just means we haven't convicted the other thousands of ebil immigrants!"
 
8:26 PM
:D
 
D:
 
Remember, kids: Vote red if you can, and green if you can't. And if you're American ... well, tough break.
 
@Gilles I have checked on the Merriam-Webster: one definition of "elector" is "someone who can vote in an election", which maps to the French électeur. That's the meaning I want here. A votant ("someone who has actually voted") would in fact be translated to "voter" (it seems that "voter" covers both meanings).
 
2 beignes arguing.
 
@ThomasPornin I checked a few dictionaries (not the OED, I don't have access to it at the moment). They aren't consistent when you get down to nuances between the two words.
 
8:34 PM
Tu lui as fait peur :(
 
So I'm talking about Mass Effect 2 with a friend of mine.
I find it odd talking about romancing a character named Jack.
FYI.
 
8:49 PM
I'm hungry
 
@Adnan I'm sleep deprived and possibly addicted to melatonin.
 
@DavidFreitag Well, I'm solving my problem with a sandwich.
Good luck with yours
 
@Adnan I'm making mine worse with more mass effect.
 
9:25 PM
I wanted to get a pillow shaped like Death, but I was afraid there might be reaper cushions.
 
9:55 PM
In a CGI script, what characters can HTTP_COOKIE contain?
@JourneymanGeek still on hiatus, unclear whether it'll resume
@Arperum Now go read Freefall (very Asimov, except from someone who understands how humans work), Widdershins (magic), Endtown (post-apocalyptic), Skin Horse (black ops welfare, by the author of Narbonic. You have read Narbonic, right?), (cont.)
(cont.) A Miracle of Science (serious mad science, finished), Casey and Andy (zany mad science, finished), Gaia (fantasy by the authors of Sandra and Woo), (cont.)
(cont.) Order of the Stick (the second-best D&D-inspired webcomic), YAFGC (the best D&D-inspired webcoming, though the inspiration is very thin), What Birds Know (almost finished), and a couple more I'm forgetting. See you next year!
Oh, Spacetrawler (finished)
and Selkie
 
You are a horrible person.
 
and how could I forget Flaky Pastry
 
I had time related problems already (days of 34 hours would've been convenient). And now I can add at least 5 extra hours needed per day...
 
@Arperum Hey, I'm being nice and not bothering you with the second-raters
 
@Gilles I have a serious lack of time. Giving me some more things to do isn't helping with that...
 
10:10 PM
(for those just tuning in, Girl Genius and Gunnerkrigg Court have already been mentioned)
So, back on-topic, how is HTTP_COOKIE encoded in a CGI script?
 
 
1 hour later…
11:25 PM
@Gilles My name is Scott Pack and I approve and/or endorse the recommendation of the product and/or service called GUNNERKRIGG COURT.
 
Hi y'all. Anyone know of malware that will imbed spammy links in an SE site?
 
@C.Ross Ira Baxter?
 
sigh
 

« first day (1356 days earlier)      last day (3514 days later) »