The DMZ - 2014-12-07

« first day (1452 days earlier) ← previous day next day → last day (3726 days later) »

AviD

00:07

room topic changed to The DMZ: The first breach costs you an arm.... [donuts] [double-entendre] [food] [libations] [rory] [security]

ftfy

2 hours later…

Terry Chia

02:19

@AviD You spelled doughnuts wrong.

Terry Chia

02:37

Man, Stallman is really on something: gnu.org/philosophy/javascript-trap.html

2 hours later…

tylerl

04:29

@TerryChia Updated: $Date: 2014/04/12 12:40:11 $ <== They had to wait a couple of weeks before publishing it or everyone would have thought it was a joke.

Iszi

04:59

@AviD Isn't donuts redundant of food? And of double-entendre, for that matter?

2 hours later…

AviD

06:58

@TerryChia no, I fixed it

@Iszi donuts is in its own class of food.

that would be like saying "isnt whisky just another liquid?"

@TerryChia this still surprises you?

@tylerl It's Stallman. Everyone still thinks he's a joke.

user image

note the spelling, @TerryChia

Journeyman Geek

@AviD: dude dosen't use a web browser anyway ;p

AviD

@JourneymanGeek of course he does. Lynx is still a web browser, just a non-graphical one.

Journeyman Geek

Er no

He uses email, and a perl script

AviD

besides, we dont mock @RoryAlsop for using Lynx, do we?

oh wait, YEAH WE DO

@JourneymanGeek hahaha

Iszi

@AviD Lynx? I thought he used Telnet?

AviD

07:04

@Iszi oh cmon, you think I really know? Or care?

Journeyman Geek

"I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly."

AviD

I do like his beginning comments though:

> JavaScript was once used for minor frills in web pages, such as cute but inessential navigation and display features. It was acceptable to consider these as mere extensions of HTML markup, rather than as true software.

> in a compacted form that we could call Obfuscript

Journeyman Geek

@AviD: JS is a webdev's hammer. ;p

(and every problem is a nail. Except the ones that are your thumb)

AviD

@JourneymanGeek oh. well clearly I havent read the whole thing yet.

"yet", we'll see.

Journeyman Geek

stallman.org/stallman-computing.html

I find this horrifying since the dude seems out of touch with the last... 30 years or so of computing.

AviD

07:07

@JourneymanGeek That's charitable.

Iszi

@AviD Pretty sure it's a Telnet implementation running on IPoAC.

Journeyman Geek

@Iszi: Birds are closed source, clearly

AviD

should someone tell him about all the internet infrastructure, and non-internet infrastructure, that he is by necessity using indirectly?

Journeyman Geek

He'd only use IPoAC if the birds had open source genetics.

Iszi

@JourneymanGeek Ah. Maybe someone needs to submit an RFC for IPoSS then.

Journeyman Geek

07:09

SS?

Iszi

Smoke Signal

Journeyman Geek

ahh

AviD

But seriously though, if it werent for respectable, upstanding folk like Stallman and McAfee, we would be a bunch of boring, straightlaced, not to mention sensible and productive, boring dudes.

And women, because they wouldnt have learned to be repulsed by our industry.

Journeyman Geek

lol

Linus!

He's pragmatic and takes no shit from anyone.

AviD

well he actually gets stuff done

Journeyman Geek

07:11

Yup

AviD

copy/pasting code is hard work!

Journeyman Geek

I'm still waiting on gnu herd. ;p

AviD

okay I think my brain needs a shower after reading that

@JourneymanGeek ha! he actually does mention that he uses lynx.... I said that as a joke!!!

@JourneymanGeek just discovered something very cool.

If you read enough of Stallmans writings, you get the same feeling as being very very drunk. Without a drop of alcohol.

Journeyman Geek

07:27

@AviD: Just wait till you get the hangover.

AviD

hahaha

I think I need to read Atlas Shrugged again just to clear my head.

stallman.org/amazon.html I think we should all buy copies of Stallman's books on Amazon, just to spite him!

he might appreciate that, he is a big fan of spite.

Iszi

I'm just wondering how much closed-source software is being served up on that Guardian article he linked.

Wait...

> Amazon distributes ebooks in a way that strips users of many freedoms (PDF or html).

Am I reading that right? He says PDF strips users of freedom, but the link on "PDF" points to a PDF authored by himself?

AviD

I dont think you are?

I think those links are to elaborations on the " distributes ebooks in a way that strips users "

I didnt click on those links, I've had enough

Iszi

@AviD Precisely, and the link to the PDF one is a PDF file authored by Stallman.

Terry Chia

@Iszi I think you need to sleep.

AviD

07:41

@Iszi its not the fact that it is pdf that strips users, its the way Amazon does it.

> Amazon requires users to identify themselves to get an ebook.

> In some countries, including the US, Amazon says the user cannot own the ebook.
• Amazon requires the user to accept a restrictive license on use of the ebook.
• The format is secret, and only proprietary user-restricting software can read it at all.

etc

Iszi

The statement I pasted above seems to imply PDF alone strips users of rights. HTML also.

Terry Chia

@Iszi No...

AviD

@Iszi no no no, the statement ended before the parentheses. Then he added links to more info.

TWO kinds of articles, one is in pdf, one is in HTML.

Iszi

@AviD Second bullet pasted there reinforces my presumption.

AviD

@TerryChia @Iszi @TerryChia is right. So very, very right.

@Iszi uhhh... how so?

Iszi

07:43

Oh, so he's not saying Amazon distributes as PDF.

AviD

nope

Iszi

(Which makes more sense now, considering the inclusion of "HTML". Can't say I've heard of ebooks coming as HTML.)

Still, considering that the most commonly used tool for displaying PDFs is closed-source, why would he do that?

AviD

becuase you dont have to use Adobe

Terry Chia

@Iszi That's like saying since the most commonly used OS is closed-source why does Stallman use a computer.

Iszi

No, the man's just full of ridiculous self-contradictions is all.

AviD

07:45

actually I'm not sure that browsers' builtin PDF rendering (such as Chrome) isnt used more than Adobe by now anyway.

@Iszi oh absolutely.

did you ever read the Church and the Bazaar?

I went between screaming profanities, laughing hysterically, and holding my head in pain.

I found that a good strong drink goes well with it.

oops, I meant Cathedral, sorry

and, uhh more oops, that was ESR, not Stallman

sorry, I think I'm drunk on stallman this morning.

Iszi

Wow. The FSF site actually has a list of licenses for each of its JavaScript components - about as long as my arm!

Terry Chia

@AviD Have you been writing elisp again? :P

AviD

@TerryChia heh

@TerryChia did you see the PHP joke going around the twitters today?

Terry Chia

@AviD Which one?

Iszi

Oh, this is awesome though. While Stallman is telling people not to use Amazon, FSF's Defective By Design campaign is encouraging them.

Defective by Design

Defective by Design is an anti-DRM (digital rights management) initiative by the Free Software Foundation. DRM technology, dubbed "digital restrictions management" or "digital restrictions mechanisms" by opponents, restricts users’ ability to freely use their purchased movies, music, literature, software, and hardware in ways they are accustomed to with ordinary non-restricted media (such as books and audio compact discs). The philosophy of the initiative is that DRM is designed to be deliberately defective, to restrict the use of the product. This, they claim, cripples the future of digital freedom...

AviD

07:50

user image

Iszi

> The Defective by Design site encourages users to use the tagging feature of Amazon.com, Slashdot and on other sites that allow tagging, to mark certain products with the 'defectivebydesign' tag.

Terry Chia

@AviD Heh.

AviD

5 mins ago, by Iszi

No, the man's just full of ridiculous self-contradictions is all.

Iszi

"Don't use proprietary products - except when it furthers our agenda!"

3 hours later…

Rоry McCune

10:27

1

Q: Checking for SQL Injection vulnerablities in non-php websites

I only have a basic knowledge on these things, anyway here my question goes: All the tools I have seen/used (like sqlmap) for SQLi vulnerabilities require a .php? link or something similar to get info and vulnerabilities. I want to know some ways and/or tools which allow you to test for SQLi with...

web-application php sql-injection mysql server

^ I'm trying to work out if this guy is being serious...

AviD

@RоryMcCune I know, right? Everybody knows SQL injection is a PHP-only feature.

Rоry McCune

@AviD yeah and those .com sites don't get it

AviD

@RоryMcCune forget the sites, I'm talking about the ones that serve .com files.

oh and dont get me started on .NET

speaking of which, I need to get up to date on all the changes of late, I've heard it's taken a few big steps since I was up to date....

Rоry McCune

@AviD yeah MS turned hippie

if you want to stay current you'll need a tie-die T-shirt for starters

Terry Chia

@AviD It's basically Kotlin for Windows now. ;)

AviD

10:36

googling for kotlin...

okay, who'm I kidding, I'm binging it

Terry Chia

@AviD Cmon man... @RоryMcCune and I have been mocking it for ages...

Rоry McCune

@AviD bit old-school there, now with the FF move you should be Yahoo'ing it

the new hotness

AviD

@RоryMcCune "hotness"

because anybody besides clueless hipsters and n00bs would ever consider using FF

OR yahoo

Terry Chia

@AviD But but but... it's free software!

Rоry McCune

@AviD or web app testers... other browsers make you set the system proxy (yeuchh)

AviD

10:38

hehe, dont start me again, I'm just now getting over the hangover

Rоry McCune

though that can still happen. Was testing an app last week that isn't in production yet and who's preferred browser is....... IE8!

Terry Chia

@RоryMcCune I'm guessing the targeted release date is 2010?

AviD

@RоryMcCune insurance company?

Rоry McCune

@TerryChia well the performance felt like it

AviD

@RоryMcCune but, umm.... no?

Rоry McCune

10:40

@AviD bank

AviD

@RоryMcCune heh, close enough

Terry Chia

@RоryMcCune Rewrite it in Node.JS duh. It's web scale.

Rоry McCune

@AviD ? if you set proxy in IE my experience is that it sets if at a system level

AviD

@TerryChia no no, didnt you hear? Node.js is dead, it's being forked.

Rоry McCune

@TerryChia pls old school. These days io.js is the way to go

AviD

10:41

@RоryMcCune user-level, actually. but doesnt need to be.

Terry Chia

@AviD @RоryMcCune Ah right.

Rоry McCune

@AviD so you can set it just for IE? tell me more

that's been annoying me for ages

Terry Chia

Forgive me, I have not been keeping up with the latest hipster happenings lately.

AviD

@RоryMcCune whoa dont remember... I wrote a tool to shortcut it for me, back when

Rоry McCune

@AviD aww .. now I'm going to need to go Yahoo for the answer

AviD

10:43

by default, you are not wrong (except that its per-user, not per-system). had to get in to the IE process internals for it, dont remember the details...

hmm, curious if I still have the code for that...

Terry Chia

@AviD I think that proves @RоryMcCune's point really...

AviD

3 mins ago, by AviD

@RоryMcCune user-level, actually. but doesnt need to be.

Rоry McCune

@AviD ok ok I meant per user :op but that and chrome both use the "OS wide" proxy by default and it's mega-annoying if you're testing 'cause all the outlook/update traffic gets caught up in burp

AviD

oh yes, that you are absolutely correct.

Rоry McCune

and I know you can go "show me in-scope only" but then you might miss an out of scope request thats relevant to the test

AviD

10:45

by default.

@RоryMcCune well if you use Fiddler you can scope it per-process

Rоry McCune

@AviD to paraphrase tom cruise... "show me the code" :)

Terry Chia

@RоryMcCune @AviD is telling you to reverse engineer IE. ;)

Rоry McCune

@AviD you windowsy you ... fiddler. With Burps new extensions, I'm kinda liking it even more at the moment

Terry Chia

Too bad IE is non-free software or you could just fork it. ;)

AviD

@TerryChia waaa? IE is not free?

@RоryMcCune oo what extensions?

Rоry McCune

10:46

@AviD pro.portswigger.net/bappstore

Terry Chia

@AviD FREE AS IN FREEDOM! /channels Stallman

AviD

though honestly I was never a fan. I always liked Fiddler's extensions, though since it was bought I'm not sure how it will hold up.

Rоry McCune

quite a few testers are writing free extensions for burp now

AviD

@TerryChia BEER!

@RоryMcCune interesting, do you need burp pro for that?

Rоry McCune

@AviD I think so yeah

AviD

10:47

aww shucks

Terry Chia

I usually use mitmproxy, does this make me weird? :P

AviD

dont have a license for Pro anymore

@TerryChia doesnt make you weird, no, but it is a sign of it.

@RоryMcCune dont seem to be able to find the code for that tool :-(

was back before I was storing all code in online repos

Rоry McCune

@AviD yeah I used to lose stuff all the time pre-github

AviD

I only started with DVCS when Kiln came out....

then I went to BitBucket

Terry Chia

@RоryMcCune There was software before GitHub?

AviD

10:53

@RоryMcCune when I was hipsterStartup we were on github. ironically everything I contributed to was in a private repo....

Rоry McCune

@TerryChia hard to believe I know but I've seen it!

AviD

@TerryChia hahaha, see this is exactly the problem with hipster perspectives!

Rоry McCune

@AviD hopefully, unlike some people I've done reviews for they're managing access to github well. I've had ones where I need to prompt them to remove me from the repo 6 months after I've done the work

Terry Chia

@RоryMcCune I removed myself when I left my temp job.

I still have access to their Slack chat though...

AviD

@RоryMcCune heh... uhhh lemme check

Rоry McCune

10:55

@TerryChia yeah I don't think I have the access to remove myself, although TBH I've not looked. Just checked and one customer I did work for 8 months back still has me with access!

Terry Chia

@RоryMcCune You can leave organizations.

Rоry McCune

@TerryChia ahh I should do that then, was from a previous role, so I shouldn't need access now..

AviD

@TerryChia oh I was removed from that before the phone call was over.

Terry Chia

Talking about hipster tools, I actually really like Slack.

AviD

I agree.

Terry Chia

10:57

I like how you are not forced to use their client, any old IRC client can be used to connect to them.

AviD

@TerryChia oh? didnt know that.

I used webclient often though.

Terry Chia

@AviD They offer IRC and XMPP gateways I think.

Hmm, I have 522 contributions on GitHub. That's actually a lot less than I thought.

AviD

11:18

@TildalWave good call on VtC it as "Too Broad", I'm realizing that is a very good stand-in for "This is so frikkin basic it would be banned from a <whatever> 101 class".

or, lmgtfy for the less polite.

TildalWave

@AviD I considered it too broad as in there's so many problems with the question I couldn't describe them all in a single comment :)

Terry Chia

0

Q: How To Encrypt Group Emails?

I'm interested in encrypting e-mails. My very, very basic understanding is that I am to generate a private key, and share my public key with the message recipient (who will share his public key with me). Then, I can encrypt my messages utilizing his public key so that only he will be able to de...

encryption email

AviD

@TildalWave yeah, thats usually the case.

or, "Please teach me how to do XSS"

Terry Chia

Good question.

TildalWave

> I want to know some ways and/or tools which allow you to test for SQLi with non-php sites, like which only have .com or .net extensions

Wot? :))

AviD

11:21

@TerryChia is it? most tools do that automatically.

@TildalWave almost more problems with it than words in it :-)

TildalWave

exactly

and sqlmap is written in python

so what the bleep does he mean with...

> All the tools I have seen/used (like sqlmap) for SQLi vulnerabilities require a .php?

Terry Chia

@AviD How does it work? Does it encrypt separately for each person?

AviD

@TerryChia pretty sure that the way it is most commonly done, a message key is used to (symetrically) encrypt the whole message, and then the message key is encrypted for each person.

but I dont have the techy details, so I'm not writing an answer.

also, pretty sure its a dupe

Terry Chia

@AviD Let's wait for The Bear then. :)

AviD

anyway he wasnt asking "how is it done", he was asking "how should I do it" - which would be more of a SU question, if it wasnt a trivial "don't worry about it".

Rory Alsop

12:03

@Iszi pffft

@RоryMcCune a bappstore? ...Interesting

oh, and Afternoon all!

AviD

so, this is interesting - I was looking for something I remember writing some time ago, so I was searching through the chat transcript and old answers.

Turns out I used to be much smarter than I am now.

Senility must be setting in.

Rory Alsop

@AviD It happens...

AviD

what does?

AviD

12:24

who said that?

Journeyman Geek

Who said what?

AviD

what are you talking about?

Journeyman Geek

I have no idea. What were you talking about?

AviD

Me? I just got here now.

Terry Chia

Doughnuts.

Journeyman Geek

12:28

Doughnuts?

AviD

DOOOOONUTS

Journeyman Geek

hm. Not a great day.

Terry Chia

@AviD You just went full @Simon. Never go full @Simon.

Journeyman Geek

I spent a weekend trying to beat something into working unsucessfully

4

AviD

hehehe, it is well known that even @Simon cannot match my love for donuts. He just has access to them.

Terry Chia

12:29

@JourneymanGeek Erm...

AviD

Fondness makes the heart grow harder.

errm, or something like that

Rоry McCune

@LucasKauffman is this your new numberplate?

user image

2

Journeyman Geek

0_0

Wait, it installed

And... I'm an idiot who didn't realise the instructions referenced other instructions.

AviD

0

Q: Is firewall is a substitute of an antivirus?

If a computer has no antivirus installed in it. And if a flash memory is inserted, so will the firewall protect the computer if there is any virus in the flash memory.

oh lordy

anyone fancy a good, hard comment?

Journeyman Geek

Quite honestly, I don't want to risk getting infected by that level of stupid.

AviD

12:38

oh, are we talking about @Simon again? ;-)

Rory Alsop

@AviD done

AviD

oh well done. I wouldnt have had the patience to be even marginally polite.

Rory Alsop

@AviD hey - you know me

I'm mostly polite

AviD

@RoryAlsop Do I? Have we met before?

Damn senility.

Lucas Kauffman

@RоryMcCune #swag

Terry Chia

12:48

Oooh, I think I found a nice beer place in Singapore.

@LucasKauffman Any brands here you recognize? thirsty.com.sg

Lucas Kauffman

@AviD back in the 70's you met up I think, for your 40th birthdays

AviD

@LucasKauffman 1770?

Terry Chia

@AviD 0070.

AviD

lol

Lucas Kauffman

@TerryChia Belgian ones only Lindemans, which is probably my fav brand for fruity beers. Very sweet! For the other ones, I only know Brewdog, which is a pretty decent brewery

still want to try their atomic penguin beer

Terry Chia

12:53

Their shop seems to have a fair selection. I'll have to try some of them. :)

Lucas Kauffman

@TerryChia There's a good shop in the holland village shopping center, not that expensive and the guy has a nice range of good beers

3 hours later…

Simon

15:43

@AviD This is probably true. I haven't had one in a damn while.

The last time was probably when I recorded the IBC video.

@AviD NOW THAT'S JUST MEAN.

AviD

eehhhh, go eat a donut, eh?

@Simon you're right though, I was considering applying that to @Lighty instead. I was worried he wouldnt be able to take it and would get insulted and leave forever.

no wait, I meant I was worried that wouldnt happen.

Simon

@AviD luuuulz

3 hours later…

AviD

18:35

haha, this is gold: Re Sony:

> a list of employee complaints, mostly bemoaning the company's lack of creativity and risk-taking.

Really? Not enough risk? Have you seen their network??

Kisunminttu

@AviD Sony: i.lvme.me/o4lv8ld.jpg

AviD

heh

Adnan

19:15

@Xander Today I was having a discussion with a friend about fake likes and followers. He said that many people are using this technique to squash emerging Facebook pages. Apparently, if you throw about 5k fake likes on a page with 500-1000 likes, it will hurt the page very bad.

Lucas Kauffman

19:52

@AviD their risk appetite is quite large IMO

they got fucked more than one time

AviD

20:04

@LucasKauffman yes, that is what I was saying

@LucasKauffman but its a funny joke, because obviously they were referring to business risks, and creative risks, rather than security risk

@LucasKauffman thats what makes it funny

@LucasKauffman and this is what makes it unfunny, when I have to explain it

@LucasKauffman though at some point, if we keep explaining it, it will overflow, wrap around and become funny again

@LucasKauffman thats the thing about explaining jokes

@LucasKauffman the other thing about explaining jokes, is that they lose all subtlety.

@LucasKauffman often, the humour of a joke is based on the subtleness of what is being implied, yet not stated outright.

@LucasKauffman hmm, I guess that's why explaining a joke could ruin it, it takes away the subtlety, and states outright that which was intended to have been implied only.

@LucasKauffman interestingly, other (usually much less refined) forms of humour are based on the exact opposite: overstating the obvious, and effectively hammering you with the explicitness of the statement which should not have been needed to be stated aloud.

Kisunminttu

c-c-c-combobreaker!

5

AviD

@Kisunminttu @LucasKauffman, in fact, the pure bludgeonness of an insistent repetitiveness could actually increase the humour - assuming it doesnt become annoying first.

@LucasKauffman this is actually how it is possible - in theory - to humor-overflow a poor joke till it wraps around and becomes funny again.

@LucasKauffman In any event, even if such an attempt were to be unsuccessful, at the very least the obvious mocking of whoever was in such a need for the explanation in the first place, can bring its own form of (cheap) humour.

At least to whomever is doing the mocking.

@LucasKauffman You cannot escape from the straightjacket of your own incompetence.

mike drop

4

1 hour later…

Lucas Kauffman

21:31

@AviD still love you <3

AviD

@LucasKauffman of course you do. Because of my sesquipedalian tendencies, and you love to feel small.

Rоry McCune

21:44

good lord, is @AviD being sesquipedalian again?

AviD

I've been doing my reading.

Rоry McCune

Ah I C

BTW on the sony thing think this guy is regretting the interview he gave in 2007 cio.com/article/2439324/risk-management/…

AviD

@RоryMcCune whoa. just from reading the header, it seems he took AviD's Law of Regulatory Compliance to heart.

Rоry McCune

in which he argues against strong password policies and then from this bluecoat.com/security-blog/2014-12-04/… the malware that hit them exploited their weak passwords

not that I'm the greatest fan of strong password policies in the world

but that can't look good for him now

AviD

@RоryMcCune really? I am.

I just think most supposedly "strong password" policies are not.

that auditor should be fired.

not that compliance has all that much to do with security...

Rоry McCune

21:49

@AviD I guessed we'd be talking at tangents, I mean that I'm not a fan of most traditionally constituted strong password policies

AviD

@RоryMcCune oh I agree STRONGLY

but I never let that one slide ;-)

Rоry McCune

@AviD generally it has zero to do with actual security and something to do with proving that specific things which may relate to security have been done as described :)

AviD

I am happy to engage all those old-school corporate places - banks, insurance companies, etc - that insist at putting my information at risk. I argue with them often....

@RоryMcCune ... or not.

Rоry McCune

@AviD or indeed not

AviD

okay this is frustrating me greatly now.

Rоry McCune

21:53

@AviD wazzat?

AviD

yknow how remote desktop licensing allows you to have up to 2 connections for administration?

well apparently that excludes RemoteFX-enabled VMs.

Rоry McCune

@AviD yarr

@AviD ahh

AviD

at least, that's what its looking like now.

looks like I have to install a RD license server, and start managing CALs.

For myself.

bloody hell.

Rоry McCune

meh nasty

I'm currently thinking about whether to keep on the VMWare workstation upgrade path

AviD

and, since I didnt do their Licensing course, I am likely to do it wrong, and probably lock out all my machines.

Rоry McCune

21:55

have had a license since v2, now v11 is out and they want another £100 for the upgrade

AviD

for which I have valid, legitimate, legal, licenses.

Rоry McCune

@AviD pain of independent consultancy :op

AviD

heh

actually I kinda did this to myself.

AviD

22:09

okay, so I have a CAL pak, but thats for OS use, and doesnt apply for RD use? what?

I bet @JourneymanGeek could help.

Journeyman Geek

alas no

I haven't really worked at that scale at all

AviD

what scale? this is my personal desktop.

well, work desktop too,

well, it is also a personal VDI server.

well, okay fine.

yeah, I also have the Enterprise VL, but that is not helping me either, is it.

Huh. I take it back.

I was able to use my CAL pak license to have the RDS Activation site issue a RD CAL pak license. Interesting.

« first day (1452 days earlier) ← previous day next day → last day (3726 days later) »

Transcript for

Dec '147

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile