The DMZ

Simon

00:34

Nooooooo!

tylerl

04:10

Figured I'd twitter my favorite incident of the week:

This just happened -- ASV: Your site is insecure because #POODLE. Company: Disabling HTTPS. ASV: Looks good now. #pcidss

Tweeted by tylerlarson on December 19, 2014 at 4:08 AM

tylerl

05:45

2

Stack Exchange

08:18

Plus, you have to control for the fact that some people are into being blindfolded.

kalina

09:33

for the next 20 minutes, I am not a vegetarian

Arperum

@kalina Too much want for food?

ANd nothing but meat available?

kalina

no, I'm not really a vegetarian but I eat meat so infrequently that it's an easy mistake to make

but right now... bacon

4

Arperum

@kalina Ah, that way.

kalina

09:52

getting trolled by a moderator

can't even defend myself against that

if I do anything I'll just get banned

Rоry McCune

10:23

@kalina mods trolling? not in here surely

Terry Chia

@RоryMcCune @AviD hasn't been in today so no.

kalina

@RоryMcCune no of course not in here

kalina

10:53

I am feeling properly lethargic after all the bacons

clearly it's time to re-bed

Stephane

'morning

Rory Alsop

11:26

Morning all

@kalina linky - just so I can get a wee independent look?

Arperum

11:56

@RoryAlsop She was talking about the replies to this message

Stack Exchange

Stack Exchange Security Blog: QoTW #52 Which factors should I consider for devices that accept handwritten digital signatures?

roryalsop on December 19, 2014

Indrek asked this question on digital signature devices, such as the ones delivery drivers get you to sign for your packages. While he identified EU directive 1993/93/EC as appearing to regulate, he had some concerns around what should be done to ensure these signatures are as valid as paper counterparts.

sam280 pointed out that:

and

Which implies that the existing regulations don’t cater fully for this use case, and this is borne out by the accepted answer by D.W.

D.W.’s answer discusses the problem of law here but sums up with a very down to earth conclusion: …

Rоry McCune

@kalina I didn't realise you were the main person on the Elite-dangerous tag on Gaming.SE

raz

12:15

Good morning

Terry Chia

12:27

Anyone saw the news about the new git/hg vuln?

AviD

@TerryChia yeah, cute

wait, its hg too?

Terry Chia

@AviD Aye.

@AviD mercurial.selenic.com/wiki/…

AviD

tq

raz

@TerryChia Link?

Terry Chia

@raz article.gmane.org/gmane.linux.kernel/1853266

Computers are broken and will never work properly.

raz

12:38

They only do what we tell them, so who's really broken?

Simon

Your mom.

Rоry McCune

@TerryChia care for a wager that suits take "grinch" or "mis-fortune cookie" more seriously 'cause they have cool names, despite the fact that this is way worse...?

AviD

@RоryMcCune is it though? more like "meh".

Terry Chia

@RоryMcCune We obviously need a name and logo for this vuln.

AviD

@TerryChia GIT-SOME.

Terry Chia

12:40

@Simon echo "@Simon" >> .gitignore

@AviD Get that on Twitter ASAP.

AviD

@TerryChia ha. no.

Rоry McCune

@AviD mis-fortune cookie and grinch are meh this one acutally has the chance to allow for unauthorised access to dev machines. Here's a good example. use this vuln to steal SSH private keys (that every github dev uses ) from dev machines and then compromise all the repos that provides access to.

Simon

@TerryChia Are you using Linux or did you patch your system, sir?

AviD

@TerryChia how about: "SIMON-SAYS"? We already have a logo ready to go.

@RоryMcCune and what in hell are you running an untrusted repo for in the first place?

Terry Chia

@RоryMcCune That won't work because git is supposed to be distributed, right? right? ;)

@AviD Eh, this is bad because you aren't running it. You are simply cloning it.

Rоry McCune

12:42

@AviD you saying you've never cloned a git repo (remember no running of code here just git clone) before you checked for security...

AviD

@RоryMcCune also, it requires user action (not passive), and in this case "users" are (suposedly) intelligent developers.

Rоry McCune

@TerryChia yeah and everyone totally looks at all the commits :op

AviD

@TerryChia yes yes, that

Rоry McCune

@AviD ah ha ha ha ha ha ha

@AviD also is no more action for a dev than the equivalent of "going to a web page" people clone repos all the time

raz

@AviD Intelligent developers? Have you ever looked at source code?

4

Terry Chia

12:43

@RоryMcCune I bet most people don't. Even most security folks.

Heck, I clone repos to look at them for security issues.

AviD

@RоryMcCune well, duh

Rоry McCune

@TerryChia I am getting more paranoid as time goes by and attacking repos becomes more useful. but even there I can't read all the code I run

Terry Chia

@RоryMcCune N00b. :P

Rоry McCune

BTW on a related note did people know that you can easily check download checksums in powershell now

Get-Filehash

in powershell 4+

Simon

We all know that Terry is still going through PHP's code, line by line, before he goes to bed.

Terry Chia

12:47

►

THIS IS SO AWESOME!

raz

@RоryMcCune You know what other OS can do that easily? Any Linux distro.

Tinned_Tuna

@raz beat me to it...

Rоry McCune

@raz I know that, I was commenting that it's now possible easily on windows

raz

@RоryMcCune Might be the only thing that's easy to do on Windows...

Rоry McCune

@raz .... no

I use windows/linux/mac osx and they all have strengths and weaknesses

actually I think that of the 3 windows is developing the fastest these days

Terry Chia

12:49

@RоryMcCune TempleOS one true OS.

raz

@RоryMcCune I liked Win7 Pro. I think they took a step backward in 8/8.1.

But that's me.

Simon

No, that's everyone.

Rоry McCune

@raz win 8.1 is great once you get rid of Metro, which is easy to do

apart from that it's generally an improved version of win7

IMO

raz

@RоryMcCune ehhh kind of. By making things "more intuitive" for all users it makes it harder for people who actually know what they're doing to use it.

Rоry McCune

@raz apart from metro interface what did you reckon got worse?

Terry Chia

12:54

@RоryMcCune Yo momma.

raz

@RоryMcCune Some of the network config options were removed, or changed in a way that makes some things a pain.

Connecting to an unbroadcasted wireless network, then accidentally "forgetting it" can lead to trouble.

Maybe if I spent enough time with it I'd get used to it. But my work is Linux, and I really only use Win8 for browsing the web.

Simon

@raz You're a courageous man.

Rоry McCune

@Simon yeah using linux at work...

Simon

@RоryMcCune Oh stop that, I built over 9000 Ubuntu servers and use them on da daily at wurk.

Rоry McCune

@Simon you're just angling for a DBZ response now aren't you

Simon

13:08

^_^

You just gotta be careful when you update apache on a prod server lulz

Rоry McCune

@Simon did you know that the DBZNappa account has sent over 1million tweets! twitter.com/DBZNappa/with_replies

Simon

@RоryMcCune Holy crap.

Terry Chia

@Simon I bet you SSH into your server and run apt-get don't you?

Simon

@TerryChia No, I manually download the repos and unzip the tar.

THEN I INSTALL IT!

Rоry McCune

@Simon after checking the checksums right

Simon

13:14

@RоryMcCune Yes! If they don't match, I know they can be installed without any issues.

raz

@Simon Well look at you go

Terry Chia

@Simon You know saying stuff like this won't help you land that janitor job at Facebook right...?

Simon

@TerryChia Why? They would want me to have a bad practice to be a janitor?

paj28

13:50

guys, do you know of a simple port scanner that can be run on windows without admin privileges?

seems nmap requires pcap even just using connect scan

Rоry McCune

Ohnana

ehhh.... PortQry? from microsoft?

Rоry McCune

@paj28 depending on version blogs.technet.com/b/heyscriptingguy/archive/2014/03/19/…

Ohnana

why do you need one without privs?

Simon

@Ohnana I'm gonna go ahead and say that's because he doesn't have those privileges.

Rоry McCune

13:54

@Ohnana he's a hacker, probably trying to expand a successful foothold

paj28

and it's not possible to scan from my own laptop

Ohnana

aha. I demand more coffee.

paj28

portqry looks good!

Journeyman Geek

@paj28: You ask nicely for permission first ;p

paj28

i've got my get out of jail free card

no need to pester them for individual requests

Ohnana

13:57

@paj28 fateful last words

Terry Chia

@paj28 It does? I seem to recall that connect scan doesn't require admin; it just uses the OS TCP facilities.

Rоry McCune

@TerryChia on linux that's true

Terry Chia

@RоryMcCune Ahh. Windoze.

Linux best OS.

Rоry McCune

@TerryChia even with systemd?

Terry Chia

@RоryMcCune Heh. I don't dislike systemd.

Rоry McCune

14:00

@TerryChia unicorn :op

Terry Chia

I mean, systemd isn't exactly the most well written software but the old init system was in sore need of replacing.

Simon

Yeah, ok @unpingable?

Ohnana

i find systemd's output to be a little more informative. although the debian fork is just a fountain of lols

Rоry McCune

@Simon s'up?

Simon

I dreamed that I was in line at a grocery store and my gf (who was someone else) was the cashier and she was replacing my timing belt on my car. She then proceeded to tell me that she put a sensor back on backwards.

Journeyman Geek

14:05

She wasn't a donut?

I need to dig into that a bit :/

systemd that is.

Rоry McCune

Simon

@RоryMcCune Haha.

Rоry McCune

@Simon there's an appropriate dilbert for all occasions :) that one is almost as old as you!

Simon

@RоryMcCune It's almost 12 y/o?!?

Rоry McCune

@Simon 16 in fact

Ohnana

14:12

oh god that is almost older than me

I had just learned to read when that came out

Rоry McCune

17 hours ago, by Rоry McCune

@DavidFreitag ..... I am soooo old

Simon

My lady donut hit 24 on Monday, I keep telling her that she's damn old.

And she agrees.

Ohnana

@simon are you implying that you hold congress with donuts? so lost.

Simon

@Ohnana You'll get used to it.

Simon

14:39

Meni meni meni networking questions these days.

raz

@RoryAlsop Thanks for the bounty :D

Ohnana

@raz aw snap! I was waiting for that question to be answered. nice one

raz

@Ohnana Why thank you :)

I have to thank my friends Copy and Paste.

Simon

@raz Those are people that used to chat in here, you know.

Ohnana

I mean, you dug through a tech manual to copy/paste. give yourself some credit

Xander

14:51

@Simon Pro tip: Calling a lady "old" is not the best way to ensure her continued affection.

Simon

45

A: Why can a Tor exit node decrypt data, but not the entry node?

Tor uses a routing method called Onion routing. Much like an onion, each message (the core of the onion) is covered with layers of encryption. image attribution Your message is encrypted several times before it leaves your device. Node A can only decrypt (peel) the layer A, under which it would ...

@Xander When we're both the same age, it's all gud.

Ohnana

i have a silly question. how big can bounties be? can @RoryAlsop just go "I BID 26,000 REP!!!" or is there a limit

Rory Alsop

@Ohnana I think you can bid whatever you like

as long as it's over 50

Ohnana

oh man.

Rory Alsop

That would be quite funny

Rоry McCune

14:58

@Simon you're 24....

Ohnana

apparently the largest was aroun 550

raz

@Ohnana haha fair enough

Rory Alsop

@kalina It doesn't look like much...we do worse to @Simon :-)

@RоryMcCune Heh heh - Grinch:

> So to translate: News flash, designated admins can do admin things!

linux.slashdot.org/story/14/12/18/2022245/…

Simon

@RоryMcCune No, 12!

Rоry McCune

@RoryAlsop yeah but it has a scary name.... scaaarrrryyy name

@Simon so your better half is twice your age?

Simon

15:08

@RоryMcCune Yes, I like 'em well developed.

Ohnana

omfg I read the disclosure and these words came out of my mouth: "Y'all are BSing and you haven't even gotten to the POC!"

Simon

Does anyone have any experience with a mail server on Linux?

Rоry McCune

@Simon and she likes 'em underage...

Simon

@RоryMcCune Ok fine, I'm 12 mentally

kalina

@RоryMcCune me either

@RoryAlsop Simon doesn't classify all of us as enemies, though

Rоry McCune

15:10

@kalina ppphbt... you'll need to watch your OpSec cover, no coming and blowing up my ship once I start playing!

kalina

you wouldn't even see me attack

it would just happen

Rоry McCune

@kalina yeah but I might get a commander name...

kalina

you've made an assumption that my identity in Elite is linked to any of my other identities

Rоry McCune

@kalina not at all, I was suggesting that if I get attacked by a specific commander I may make a potentially justified assumption that it's you :op

kalina

do you assume it was me every time you burn yourself as well?

you know what, I'm sorry, I may be a little bit more agitated than usual

Rоry McCune

15:13

@kalina nope 'cause 1) I don't burn myself much and 2) that required physical presence in Lochgoilhead and I know you don't like the cold/wet weather up here

@kalina have a nice cup of tea then :)

kalina

nothing's going to help

more sleep might

Rory Alsop

@RоryMcCune When I blow up in Elite it's because I fly like a deranged Orangutan

Rоry McCune

@RoryAlsop when I tried beta for a bit I had mastered undock-->warp-->fly to station--> dock, reasonably well but that was about it

kalina

flying without flight assist

Rory Alsop

@kalina there is flight assist?

I actually have problems with the UI

kalina

15:21

yes

Rory Alsop

haven't yet sorted out sensible key mappings

I tried my old Elite keys - bad idea

kalina

it's a button that simulates stabalisation and changes the flight model from space to inner atmosphere

ie: you have to keep your engines on to maintain speed

you don't auto roll

Rоry McCune

@RoryAlsop IIRC it's on by default

kalina

if you stop applying movement control you stop moving

Rory Alsop

hmmm - not sure whether that is good or bad

kalina

15:22

it's both

it makes it playable to casuals and it allows those who're really good to be really good

without allowing there to be all that much of a gap between the two

but like you can't dock with a cargo bay of stolen stuff without being blown up, scanned by players, scanned by police, etc etc

silent running causes heat if the engines are actively working

flight assist off provides a massive advantage here because you can turn your engines off without slowing down

but t hen, stealing cargo and illicit goods is a pretty high level skill

so you'd have expected a mastery of flight control by then

Simon

You're a flight control.

kalina

I wish you would just catch ebola

Simon

Oh lawd, y u so Emo now?

kalina

I don't know

Rоry McCune

►

kalina

15:30

my brain has just decided to fuck my shit up for no apparent reason

Ohnana

@kalina sounds like ebola

Simon

@RоryMcCune Loved that episode.

kalina

@Ohnana if it were ebola, the reason would be apparent.

Simon

Unless there was more than one episode with these guys?

Rоry McCune

@Simon they turn up at various points AFAICR but that was the main one

Simon

15:49

@RоryMcCune You're having an affaire? Oh Come on Rory!

Rоry McCune

@Simon tut tut I'd have though you as the YOLO acronym king would recognize AFACIR

Simon

That "e" shouldn't be there but whatevs.

I didn't mean to disappoint you.

Tinned_Tuna

16:07

finally, bruteforce (vert. and horiz.) defences implemented. Only thing that sucks is the policy; we've just taken a punt, being careful to try to avoid raising lots of support tickets.

Simon

I... can't... resist.

You're a ticket.

Tinned_Tuna

@Simon I find your inability to pun effectively disturbing

Simon

I was punning back when you were still wearing diapers, have some respect.

Ohnana

@simon I thought practice made you better at something

Simon

Ohnana? More like Oh no no!

SEE, THAT WAS GOLDEN.

Ohnana

16:23

sigh. at least you didn't go for the rihanna reference.

Simon

Oh lawd, I totally didn't think about that.

raz

0

A: What is the best resource to learn malware analysis?

Learn reverse engineering, assembly language x86 and x64 preferably. If you don't have the time and patience to start learning those then you don't have the time and patience required to analyze malware on the lowest level. Programming is your friend so is networking and the security aspect of it...

Simon

@kalina Show me one of your melodic breaks.

raz

Really?!

I provide links with useful information and tutorials just like they asked. And the guy with nothing at all and a paragraph gets the check mark?

sigh

Simon

That question should be closed anyway.

raz

16:29

@Simon I don't care, it's the principle of it all!

Simon

Ohnana

take your upvotes and leave man

raz

@Ohnana I will turn this Stack Exchange around!

Rоry McCune

@raz you're feeling brave today I see... editing little bears answers!

raz

@RоryMcCune He missed a word!

Rоry McCune

16:43

@raz you're suggesting he's fallible?

raz

@RоryMcCune I'm not suggesting, I'm saying he missed a word.

Simon

Oh boy, I don't wanna part of this.

hides

Ohnana

he should post a bounty for his rep. watch the world burn

raz

@Ohnana Who's "he"

Ohnana

@raz the bear guy.

Noordung

16:49

Dang it's impossible to get the "I voted today" hat on Sec.SE ... I used up all my votes and apparently the system thinks I only voted 37 times in the stats, but doesn't allow me to vote again

This has always been f*cked up, never worked for me here. Similar to wiki edits on Space.se where it constantly shows I've only made one LOL

Simon

It's ok, you don't need it.

Noordung

yup I got it on Astro.SE anyway

Xander

@Noordung Weird. I haven't ever had a problem with that.

Noordung

I probably voted too many times on same people here and the system reversed it as serial voting. And on SEx.SE there probably isn't 40 posts that I didn't yet vote on LOL

raz

@Noordung You overflowed their signed char length

Noordung

16:56

yup I'm the unicode bomber

raz

@Noordung Quick, what's the unicode for sunglasses and a hoodie?

Xander

Has anybody here actually derived any value/use from keybase.io? I know several have signed up for it, and I'm currently wondering whether to bother.

Noordung

@raz oh I don't do the #*! emoji :D

raz

@Noordung Unicode: The original emoji

@Xander keybase.io?

Xander

@raz keybase.io

raz

17:01

@Xander That's an interesting idea. Something like that is necessary for something like GPG to become more common.

Encrypted Twitter feeds!

Simon

That is pretty damn neat.

Rоry McCune

@Xander not as yet. I can see it being useful if/when it's more adopted as an easy way to find and assess some level of trustworthyness to keys :)

@Xander but in general it doesn't do me any harm to use it ('cause I didn't take the idiotic "upload your private key here" option) so why not

Xander

@raz Perhaps. Or perhaps another dead-end. That is what I'm currently trying to ascertain. It certainly is an interesting (and potentially usable) concept for a keystore, but if nobody's interested in obtaining the keys to use them, it doesn't much matter.

@RоryMcCune Ok, that's good to know, thanks.

@RоryMcCune Ha ha, yes.

Rоry McCune

@Xander np, BTW if you need an invite I have some of those (if it's still invite only, I've not looked in a while)

raz

@Xander As long as you're submitting the public keys yourself I think it's secure. If there was a way to make generating keys easy for users in a secure fashion I think that'd really help adoption.

@RоryMcCune It still is

@RoryMcCune Ah I see what you're saying now

"Keybase.io is also a Keybase client, however certain crypto actions (signing and decrypting) are limited to users who store client-encrypted copies of their private keys on the server, an optional feature we didn't mention above."

Yeah, no wonder they didn't mention it above.

Ohnana

17:07

here rando website, take something that would hose me if it was leaked

^^ uses PGP at work to sign and encrypt data alll the time

Rоry McCune

@raz yeah it's way more trust than I'd be willing to give a random website :)

Xander

@RоryMcCune Sure, if you wouldn't mind. I think I'd like to give it a go. xander.sherry at gmail.

Rоry McCune

@Xander sent :)

Xander

@RоryMcCune Thanks!

Simon

@Xander It says invalid email.

Lighty

17:23

oh my god, I just made the best Dürum I ate in a while

and even made a fresh and light Yogurt sauce, little bits of cucumber

Tinned_Tuna

keybase.io ... not sure if I'm a fan, stuff isn't automagically signed. Seems like it's an optional step, could have a lot of users missing it out.

kalina

@Simon really? I cba writing something unique just for you just to throw it away

plus I'm getting ready to go out

Simon

Fine, bye.

kalina

Fine, be like that

Rоry McCune

now now you two, 'tis the season of goodwill

kalina

17:26

You know the deal yet you ask anyway, it's almost like you actively seek rejection

Simon

Fine.

I've never been rejected by a woman.

kalina

ahahahahaha

Simon

Wait yes I have, in elementary school.

Lighty

@Simon insert yourmom joke here

kalina

you know it's bad when even @Lighty makes a nearly valid diss of you

2

Simon

17:33

I wonder who star'd that.

Tom Leek

@raz THERE WILL BE BLOOD

Simon

I knew it, hiding was the right decision.

Lighty

I need some comments on the overall design of my new website

arcaniacraft.nl

pictures (more items for filling) will be applied later

includes awesome correct spelling

david

@DavidFreitag puu.sh/dBewW/7d75ba13d2.jpg

Thanks for the help David, works like a charm

Rоry McCune

17:48

@Lighty you were born in 1997....................

Simon

hahahahaha

Rоry McCune

21 hours ago, by Rоry McCune

@DavidFreitag ..... I am soooo old

@Simon wouldn't laugh too much if I was you he's way younger than you

Simon

Does that mean I'm old too?!?

Lighty

@RоryMcCune I am.... why the dots? D:

Rоry McCune

@Simon yeah

Simon

17:51

@Lighty Because you're like 3.

Rоry McCune

@Lighty 'cause I'm (your age x 2)+6

Lighty

@RоryMcCune hehehehe, silly old man :3

Rоry McCune

@Lighty nice, thanks for that

Simon

So mean.

Rоry McCune

where's @RoryAlsop so I can make fun of him for being older than me

Lighty

17:52

@RоryMcCune Don't be sad! People say grey hair looks sexy on older people

like George clooney

Rory Alsop

@RоryMcCune here I am!

herro

:-)

Rоry McCune

@RoryAlsop heh you're old :op

Rory Alsop

@RоryMcCune apparently

Rоry McCune

@RoryAlsop hell lighty isn't that much older than your oldest kid!

Rory Alsop

@RоryMcCune hahahahahahaha

Lighty

17:58

@RоryMcCune well, oly a few months untill my age number poofs to 18, and suddenly "an angsty teen with no responsibility and life experience" turns into "a car driver, tax payer, good student and responsible person"

Rоry McCune

@Lighty sure that'll happen

Iszi

@Lighty Don't forget "...who can legally own their own firearms"

Ah, that's a US thing though. Dunno if it's the same in Netherlands.

Lighty

@Iszi I'm form the netherlands, we have sane "Gun Laws" here, SPORTS, HUNTING or ARMY/POLICE only, very strict BG checks, and not for people under 21

but i'm doubting on doing that for sports though

Weaponary and Warfare always interested me in history class

Iszi

I probably should be a bit more concerned though, that someone who thinks "boobies" is a good profile description can legally own a firearm in the US.

@Lighty In the US, you can own long guns at 18, handguns at 21.

Lighty

@Iszi Are you saying there is something you don't like in my profile?

I always wanted to shoot a Rifle

Iszi

18:05

@Lighty Oh, no. Not at all. Just something I like that's probably somewhere it doesn't belong.

Lighty

a real one, not a "Air Pressure Bux"

Simon

'MERICA

"Guns don't kill people, I kill people with guns POW"

Lighty

Rory Alsop

@Simon cue other Rory

Simon

Obligatory Jon Lajoie.

Rory Alsop

18:07

►

Simon

@RoryAlsop I've got something better for ya:

►

NSFW lyrics.

Rоry McCune

@RoryAlsop I was going to go for GLC but I linked it here the other day :op

Rory Alsop

@Simon that's ... actually quite funny. After a bit

Simon

@RoryAlsop Yeah the dude has a few lulz songs.

If you wanna listen to it, here's probably my favorite of his: youtube.com/watch?v=AE4zF36dPxE

David Freitag

18:48

@Lighty No problem. You can also create windows applications as tabs, Visual Studio, Notepad, Calc... etc.

Transcript for