The DMZ

Xander

00:37

@RoryMcCune Microsoft has responded. zdnet.com/…

@RоryMcCune And yeah, it's exactly as you said earlier. Getting rid of the new ciphers is indeed the officially suggested work-around.

ManishEarth

03:41

@SwiftOnSecurity sounds like what happens when you try to do security... ... entirely with white hats. http://t.co/VA4XxGABMo

Tweeted by FioraAeterna on November 17, 2014 at 3:04 AM in reply to SwiftOnSecurity

my siiiiiides

Stack Exchange

05:15

The universe long dead, Isaac surveyed the formless chaos. At last, he had arrived at an answer. 'I like you,' he declared to the void, 'but I don't LIKE like you.'

Lighty

08:29

'g mornin'

wow, this actually works on my tablet, didn't see that one coming

Rory Alsop

09:00

morning

David Freitag

09:16

@RoryAlsop So I got my oneplus one. It's fantastic

Arperum

@DavidFreitag It is indeed.

David Freitag

@Arperum Did you have to fiddle with the APN to get your signal working?

Rory Alsop

@DavidFreitag excellent - I'm impressed at the frequency of updates, among other things

But most importantly - the battery life is Huuuuuuuuuuuuge!

David Freitag

@RoryAlsop I have had three updates since I got it

@RoryAlsop I knoooooow it's insanity

Rory Alsop

I don't usually bother taking my external battery pack with me any more. Even when Ingressing!

Arperum

09:21

@DavidFreitag Yup. Think I had to anyway, just select it and save or something, no modifications needed.

David Freitag

@Arperum Yeah me too. I was wondering if it was just me

Rory Alsop

@DavidFreitag In the UK no fiddling required (on EE network) but I have seen a fiddle to unlock? other frequency ranges

David Freitag

@RoryAlsop I had to switch from HSPA+ to LTE

Arperum

@DavidFreitag I had it on my previous phone too when work made me switch provider

David Freitag

amazon.com/…

Bought one. So much awesome.

A bit expensive but definitely worth it

Rory Alsop

09:42

@DavidFreitag Ah - no, I really don't like playing games on a phone.

David Freitag

@RoryAlsop I enjoy playing games from when I was a kid. Having physical buttons is so much better

Rory Alsop

@DavidFreitag Oh I agree with buttons. I mostly play games on a PC (as I'm not really a fan of console controllers). It's probably age, but I don't enjoy a game on a small screen

David Freitag

@RoryAlsop I play gameboy games with an emulator. They were originally on a small screen so it isn't so bad

Rory Alsop

@DavidFreitag heh - gameboy was after my time

David Freitag

Also, they have a PS2 emulator for android. Roms are 6GB though!

Arperum

09:46

@RoryAlsop You are probably used to games like "create the galaxy".

Rory Alsop

@Arperum lol

ManishEarth

no response on the SE XSS vuln yet :(

granted, I submitted it on a weekend

and it's probably sleepytime for them now

David Freitag

@ManishEarth If they are in NY it's 5am

ManishEarth

bah

Living in the future isn't so awesome as it sounds

David Freitag

10:08

@ManishEarth Wait - so you mean you don't have flying cars?

Rоry McCune

10:37

@Xander another ref. for you :) odetodata.com/2014/11/…

@Adnan some more info. on MS14-066 for you.. blog.beyondtrust.com/triggering-ms14-066

Lighty

11:26

wow, teacher just gave us the info which languages we're going to learn, we're going to learn: PHP (followup/advanced), .NET, VBA, C#, Databases (Access and MySQL/PHPMyAdmin).

do I need vaseline?

Rоry McCune

11:47

►

well they do have some quite good songs..

Rory Alsop

hahahahahah - look at this:

-3

Q: I've developed a new technology, what to do next?

I've developed a new technology called ALIEN(ALigned International Encrypted Network). Its basic features are Can save 10^40 bytes of information in 100 bytes file, it is not a repository, it stores total data. Can add a privacy & security layer to the data. Can upload/download unlimited data in ...

Journeyman Geek

0_0

Lighty

wow.

David Freitag

@RoryAlsop What he didn't mention is that he reduced the video into a 1x1 single frame video file.

Rory Alsop

@DavidFreitag hahahahaha

TildalWave

12:16

He wasn't testing gzip on large files of no entropy whatsoever did he? </deflate>

there used to be some torrent sniffers that would do things like that, share essentially a 1.4 GB empty file with a name of some movie (add optional tags in it such as DVDRip, 2CD,...). You'd get ~~ridiculous~~ ludicrous download speeds with those.

raz

I think he means he splits files INTO 100 byte files... you know. For simplicity

TildalWave

12:32

It'll be interesting to see when mods decide to nuke it to Trollhalla.

Take a guided tour of UK skies >> http://nats.aero/blog/2014/11/take-guided-tour-uk-skies/ #dataviz #avgeek http://t.co/OFRTB3TL0o

Tweeted by NATSPressOffice on November 17, 2014 at 11:29 AM

this is cool

ManishEarth

@DavidFreitag Nah. But we have sweet bagels in the future

Simon

13:41

I'M SO TIRED

I'M A ZOMBIE

HELP

Rоry McCune

►

@Simon have you tried sleep?

Simon

I wasn't even born when that song came out.

@RоryMcCune Yes but not as much as I should have.

I probably slept like 7 hours which should not make me feel like a zombie.

Rоry McCune

@Simon here's a prescription for some more sleep then

@Simon whipper snapper

Simon

I'm so old now, I used to work da place with 6 hours, QQ.

raz

@RоryMcCune It's more cowbell

Simon

13:51

I've got a fever and the prescription is

MOAR COWBELL

Arperum

@Simon How are you even feeling like a zombie? I slept 5. Mostly because I forgot that I had to be at a client today, which means getting up an hour earlier.

Simon

@Arperum Judging by your spelling, you probably slept negative hours.

raz

Yeah I probably got 6 and feel great.

Simon

And also, I'm wondering the very same thing, boyz.

I think it's only a matter of coffee.

Arperum

@Simon Spelling improved. Don't blame sleep for lack of spelling. sleep has nothing to do with that.

Rоry McCune

13:52

weirdly requirements for sleep are very variable person-to-person. the elder rory hardly needs to sleep at all

Arperum

@RoryAlsop Why does everyone suddenly has invites available AFTER MY OnePlus arrives?

Simon

Still wondering if I should order that phone.

Considering I'm rocking a S2.

Griffin

I have a quicky question but it's an odd one. I was trying to create a SOCKS proxy server but I didn't want my users to be able to do anything. I want it to be so they can only use their connection as proxy and can't turn it into their own little sandbox (it's my sandbox and I still haven't learned how to share). So I kind of followed this guide askubuntu.com/questions/48129/…

The problem I'm getting is he doesn't want users to be able to use it as a proxy. Also he's doing it for a single user. I wanted a group. To fix this I modified his settings. I changed Match User to match group and uncommented TCP forwarding. Will this work?

Also (like most people) he prefers key based authentication but I am using password and I'd prefer to keep it that way.

raz

@Arperum I haven't gotten my invite yet :(

Simon

@raz Wanna know why?

raz

13:59

@Simon Yes?

Simon

@raz Because you're a donut, you donut.

raz

I hate you Simon

Simon

:D

I get a kick when I annoy people. Some would say that I live to annoy.

And for donuts.

Arperum

@raz I didn't get an invite either, I got into some preorder thing they did a couple weeks ago.

raz

@Arperum Lame! I was on the list since September :(

I'm gonna make my own Oneplus One! With blackjack! And Hookers!

Simon

14:02

wat

It started off real clean and then got supa durty.

Arperum

@raz That preorder thing was "on this specific monday, in this three hour timeframe, do your order, we'll deliver when production allows, invites have higher priority"

Simon

@Arperum Hahahaha, this means he got totally nailed.

raz

sigh

Arperum

I ordered, got an expexted delivery date of 4-5 weeks, one day later it was 2 weeks, after one week "your phone is ready, it'll be shipped soon" after exactly two weeks it arrived.

That was something like two weeks ago.

Simon

I like how you're just making him feel worse every time you add something to your story.

Arperum

14:06

@Simon I might just be a terrible person.

Simon

@Arperum Or someone very entertaining to others.

Rоry McCune

I probably shouldn't mention that I got an invite after just signing up on the website but decided not to use it

Arperum

This is getting mean for @raz. We're sorry that we have our OnePlus already and you are still waiting.

Simon

Maybe I should order mine now only to get it faster than him.

Rory Alsop

@Simon If you do want one - I'll send you an invite. I have 2 left :-)

Only if you are going to get one, mind

no wasters

Simon

14:10

Ya of course. I'll think about it, thanks.

Arperum

@RoryAlsop So one for @raz too? or is he excluded?

Simon

haha

raz

Simon

@raz What's the point? It won't be in your mailbox, man.

Rory Alsop

@raz lol - would you like one?

raz

14:14

I hate you guys so much >.<

Simon

MONSIEUR PORNIN

Avez-vous de la neige à Québec, oh grand prophète?

Rory Alsop

@Simon Où , oh où , a mon beignet disparu

Simon

@RoryAlsop 10/10

raz

Right, the Oneplus One doesn't do CDMA

Journeyman Geek

Not too suprised

everyone but the americans do GSM ;p

raz

14:19

I know :(

I'm still tempted to by the phone, it looks so awesome

buy*

Simon

@JourneymanGeek Sometimes, I'm wondering if the dog in your gravatar is straight.

Rоry McCune

I'm waiting for Wifi-Calling + iPhone 6 which is meant to be out on EE in the UK in "the autumn" whatever that means

Journeyman Geek

@Simon: Dog does not care about your petty differences.

Simon

@JourneymanGeek I'm sorry.

Xander

@RоryMcCune Oh, interesting. I've seen no problems with Chrome and IIS, at least not when both ends have the patch installed. I broke out Wireshark on Saturday and looked for that specifically.

Rоry McCune

14:26

@Xander interesting. I'm seeing this stuff, 'cause I'm keeping an eye on twitter for the exploit and some of the issues which may be caused by the patch seem to be a bigger issue at the mo'... (this will change when the exploit hits I'm sure..)

Rory Alsop

@Simon Il est allé partout où je suis allé

bonus points if you get the reference

Simon

I never get the bonus points.

Rory Alsop

►

Simon

Jesus Christ.

What did that guy smoke?

TildalWave

14:44

FTFY

@Simon it would be easier to answer what didn't he

Simon

@TildalWave Probably right.

Iszi

I think someone in here mentioned using DNS to track status changes on istheinternetonfire.com - how are you doing that?

Simon

@Iszi So damn rude, you just come in here and ask a question without saying "good morning lads".

Arperum

@Simon Maybe because it's nearly 4PM?

Simon

@Arperum He lives in a real timezone.

Iszi

14:51

@Arperum STFU. Everyone knows the canonical time zone in the DMZ is U.S. Eastern! (UTC -5 normally, UTC -4 during DST)

Simon

Haha.

Arperum

@Iszi That's cheating!

Iszi

Has anyone seen signs of "The Exploit" yet, by the way? Seems it's overdue, or this guy's blowing smoke. pastebin.com/bsgX01dU

Xander

@Iszi Put me down for a fiver for "blowing smoke."

Rory Alsop

@Iszi I like the way we have at least two canonical timezones in here. You USA-ians believe it is Eastern Time, there's a Singaporean view, and then there's the correct Greenwich Mean Time, based around the zero line of longitude :-)

Xander

14:57

@Iszi I only skimmed it but it's slightly incoherent, and he really just seems to be angling towards getting a patch for his Windows XP box.

Simon

@RoryAlsop Nonsense.

Xander

@RoryAlsop Which is a made up line that doesn't really exist, except in the hearts and minds of UKians and sailors.

Rоry McCune

@Iszi I'd suggest blowing smoke, he's days overdue, MS haven't changed the advisory and although he posted a couple of times on reddit, nothing since his "deadline" passed

@Xander it was actually agreed at a conference in the USA.... timeanddate.com/time/time-zones-history.html

Xander

@RоryMcCune Boo...Down with facts! That's what I have to say on the matter.

Rory Alsop

@Xander :-)

@RоryMcCune hahaha - I didn't know that

nice

Simon

15:12

Hasn't this been answered over 9000 times?

0

Q: employing SSL even on non critical web server

I know that SSL should be used on web servers that need to gather credit card information etc..however, is it industry best practice to also turn on SSL even for non critical web servers? eg those only used for static browsing, or those that just require a simple login and password , that's all. ...

ssl webserver

Iszi

@RоryMcCune Speaking of Reddit... someone dropped two links that suggest a working PoC exists. The post is a few days old though, so I'm wondering how long it really is going to be before weaponized code goes public.

reddit.com/r/netsec/comments/2m1alz/…

Rоry McCune

@Iszi yeah I've heard a bit about that one, seems like it's a start but a bit of a ways from reliable exploitation.. in a way it's good that it's taking a little while for an exploit to emerge as it's letting more aware people get patched and what's left probably won't patch regardless of how many weeks it takes...

raz

Damn it I'm gonna miss the next preorder of the Oneplus One

Where's a just and loving God when I need one?

Rory Alsop

@raz Here I am :-)

WOuld you like an invite

Well, not 'god' so much

and possibly not that just

;-P

Thomas Pornin

15:30

@Simon Oui.

Simon

@ThomasPornin What does that word mean?

Thomas Pornin

oui

Adverb: oui

yes
oui

Interjection: oui

yes
oui

Simon

That's helpful, thanks.

Rory Alsop

hahahaha

Thomas Pornin

Besides: ville.quebec.qc.ca/webcameras

Simon

15:33

Oh that's neat. It looks like we've had the similar amount of snow accumulation.

Rоry McCune

@Simon you're like, snow buddies

Thomas Pornin

About 3 or 4 cm this morning. Still snowing, though.

Simon

I kind of wanna go write something in the snow where one of the cameras is pointing now.

@RоryMcCune 4 lyf3

TildalWave

@Simon watch out even if it looks that way it's not sugarcoating for your donut

Simon

@TildalWave I bet it can be.

I'm still rocking my worn out summer tires (about 3/32 left)

Direction-wise, AWD saves my ass.

Braking-wise, nothing does.

Actually, a wall might but that wouldn't be that great.

raz

15:44

@RoryAlsop I would like an invite, but I have to make sure I can switch to AT&T first.

Rory Alsop

15:55

@Simon Write something using your Subaru! Big letters!

Simon

@RoryAlsop Good idea, I could draw donuts quite easily!

Bleh, it's snowing even more than this morning.

Rоry McCune

@Simon surely you must love snow tho'?

being canadian and all...

Simon

@RоryMcCune But I haven't even built my igloo yet

Rоry McCune

@Simon tsk tsk, you'd best get snow packin'

Simon

@RоryMcCune I know! Also, I gotta do it quick to make sure that my lady won't leave me for a bigger igloo.

Tinned_Tuna

17:37

►

ManishEarth

18:19

@JeffFerland Have you seen this? medium.com/@vivekbansal001/… Not sure how legitimate that is, but might be worth a look

Jeff Ferland

18:52

@ManishEarth "Yo Zuckerbro," (this is going to go poorly...)

ManishEarth

@JeffFerland lol yeah

raz

@Xander security.stackexchange.com/questions/73018/…

Why doesn't the answer given apply to the question?

It seems more than relevant, as the question is ambiguous to begin with.

Xander

@raz It does now. He edited it after I flagged it.

raz

Ah ok

Figured I'd ask

Xander

@raz I wouldn't have flagged it if the current version had existed. I'd dispute/dismiss the flag.

ManishEarth

19:03

@JeffFerland also, is this offer still open? :)

raz

@Xander Yeah I trust your judgment which is why I was double checking.

Jeff Ferland

@ManishEarth Thank you. I've routed it.

ManishEarth

@JeffFerland np

Jeff Ferland

@ManishEarth Yes! :)

ManishEarth

@JeffFerland Anything specific or ..?

raz

19:04

@Xander Just looked at the edit, yeah I would have flagged that too.

Xander

@raz Yup, thanks. :-) And I wish there were a way to rescind flags. It bugs me that there isn't, for exactly this sort of situation. We can rescind close votes now, but still not flags.

ManishEarth

@JeffFerland I'm looking for something for Summer 2015. Could be security or normal programming, just note that I have zero credentials for security (aside from the self xss thingy), and am a non-CS student (though I have tons of experience in open source). If something fits with that, great!

(intern, not job, still two years to go for that, thank goodness)

Jeff Ferland

@ManishEarth How's your Linux?

raz

@Xander I think it would be fine if there were a mechanism to that said, "Hey this flagged post has been edited since it was flagged." That would have prompted me to double check the edit.

ManishEarth

@JeffFerland I use it. Know the basics, have done some CTF poking. Understand tidbits about the filesystem and executable format (but not much).

Jeff Ferland

19:09

@ManishEarth Drop me a message. facebook.com/root

ManishEarth

@JeffFerland That is .... the best username ever

sent

Simon

19:36

Hey @JeffFerland, I once threw a 3-pointer from behind in basketball. Can I get an interview referral?

raz

@JeffFerland Hey I once did something better than @Simon can I get an interview referral?

Jeff Ferland

@Simon I can look around for Pewee basketball team signups..

@raz You can have high school tryouts?

Simon

Hahaha.

raz

@JeffFerland Sweet, I think I can make varsity

Jeff Ferland

Basically, Thomas Pornin or resume. I know you're all masters are sarcasm, but I need to justify you to other people as talented computer folks too ;)

raz

19:49

@JeffFerland haha, I'm actually quite happy in a computer security position at the moment. But if I ever want to work in CA, I'll let you know.

Simon

I thought sarcasm would be enough, this sucks.

raz

@Simon Are you even old enough to work Simon?

hosch250

I am working on solving a hypothetical murder.

Simon

@raz Can you legally work in CA @ 12 y/o?

Xander

@hosch250 The hypothetical butler did it.

Simon

19:52

@hosch250 What an entrance.

hosch250

One of the clues is encrypted using the Middle Squares Method of psuedorandom numbers.

raz

@hosch250 Colonel Mustard, kitchen, lead pipe

Xander

In the conservatory, with the candlestick.

hosch250

OK, thanks for the tips.

Xander

@raz Ha ha, beat me to it.

raz

19:52

@hosch250 Reward please

hosch250

OK.

Simon

@hosch250 Oh. The answer is 42. My pleasure.

raz

@Xander Dude you left out the Who. That's the most important part!

hosch250

Thanks.

How can text be encrypted using the Middle Squares Technique?

Xander

@raz No I didn't. See: chat.stackexchange.com/transcript/message/18649007#18649007

hosch250

19:53

Google and Bing aren't showing anything.

This is the problem: puzzling.stackexchange.com/questions/4360/…

Feel free to answer yourself.

raz

That seems like a lot of work. I'm gonna have a sandwich.

Simon

@raz Would it be too much work to make me one too?

raz

@Simon No, but it'd be too much work for me to ship it to you.

Simon

@raz Fine. sudo make me a sandwich.

raz

So I'd probably just eat your sandwich while waiting in line to at FedEx. Then the point is moot.

hosch250

20:01

What seems like a lot of work?

raz

@hosch250 Going back through the first 4 parts, attempting to break codes. I break stuff at work all the time.

hosch250

OK. Actually, the first four parts are done.

Just read the solutions.

If you need me, just ping me and I will see it shortly. I need to leave now :(

raz

20:37

0

Q: Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?

encryption hash integrity

Lucas Kauffman

22:34

hellloooooooo

Thomas Pornin

@LucasKauffman Isn't it a bit late in Europe right now ?

Lucas Kauffman

@ThomasPornin yea still need to setup a router for tomorrow's demo

gonna speak at a college

Xander

@LucasKauffman Break a leg!

Lucas Kauffman

@Xander yea if I don't get this pfrouter working, I'm going to break something

Xander

@LucasKauffman Ha ha.

Lucas Kauffman

22:43

it's gonna be fun though

bit of demos

bit of memes

bit of pwning

Thomas Pornin

@LucasKauffman At colleges, audience does not want a working demo. They want an epic and funny failure, preferably with fire involved.

5

They may settle for free beer as a substitute.

7

Transcript for