The DMZ

Stack Exchange

04:06

I honestly didn't think you could even USE emoji in variable names. Or that there were so many different crying ones.

tylerl

06:22

Re-marketing agency keeps contacting me trying to get in touch with my marketing department, they "specialize in helping our customers bring back qualified prospects who left their website without completing their purchase." He left me his address and phone number, and he won't leave me alone.

So I'm trying to sign him up for incessant marketing calls and emails.

Turns out that those "WIN A FREE IPAD!!1!!" sites really difficult to search for because Google does such a good job removing spam.

David Freitag

@tylerl Dude send him a box of glitter or a bag of dicks, maybe he will get the point

Just for reference: ruindays.com/products/bag-of-dicks

AviD

07:39

@RoryAlsop thats NOT a joke??

@schroeder @Simon isnt all PHP naturally obfuscated?

@Rhino ahh so I'm not the idiot this time. Cool cool.

wholly crappe! did I repcap again?

hmm, no, it was split over midnight, but close.

but damn did that user password q reptrain. I did NOT expect that.

M'vy

@AviD which?

AviD

39

Q: Why does the user pick the password?

Almost every web service I can imagine has the user pick the password. Why is this? Couldn't the system choose a better password? It doesn't have to be some complicated mess; see http://security.stackexchange.com/a/6116/56579. Do users just find their own choices more convenient? When selecting ...

hahaha All the Canadas

Rоry McCune

08:23

hey @AviD it's now even easier for you to get your hipster on, with docker for windows azure.microsoft.com/blog/2015/04/16/…

AviD

ya ya, heard, you keep telling me

Rоry McCune

it only came out yesterday...

AviD

only thing that means to me, besides nothing, is MAYBE that it is easier to set up discourse.

Rоry McCune

although at the moment it looks a bit ropey, relies on installing Virtualbox/msys-git and stuff

AviD

@RоryMcCune so if one eventually succeeds in getting it set up just right - does that mean he could run linux programs on the windowsdocker? or does it just do the same but for windows on windows?

M'vy

08:26

Hum there is a certain Rory commenting on that page, I think I know him from somewhere :P

AviD

(which, really, is not as needed in most cases...)

Rоry McCune

@AviD well essentially it's just running a linux VM on windows and then just running stuff on that. nothing you can't do with Hyper-V now...

AviD

yeah

Rоry McCune

@M'vy yeah I ain't installing that before I find out if it'll mess with my VMWare Workstation / Hyper-V installs....

AviD

but it will be like a linux vm, not a windows vm?

Rоry McCune

08:29

@AviD for now, when windows micro comes out, I think that'll change..

AviD

no no, this makes more sense. why bother with docker for windows containers, when you dont need them?

Rоry McCune

@AviD TBH I think that MS are in with docker purely so they can keep the cool kids on their platforms as much as possible

AviD

@RоryMcCune oh that is obvious

docker adds nothing to windows, except for the ability to run docker containers on windows

"backwards compatibility" of sorts ;-)

Rоry McCune

all docker does (from what I can see) is save some resources over full VMs at the cost of less isolation between systems, which in these days of powerful cheap computers seems like a bit of a waste..

AviD

@RоryMcCune except that for most systems, that lightweight isolation already exists.

you want to isolate instances of IIS? Done, already built in.

you want to isolate instances of your database? Done, if you're on MSSQL like a normal person.

Rоry McCune

08:33

@AviD yeah but I guess this is non-app specific isolation so you don't need to try and understand each one..

AviD

what else you want to isolate? unless its your own crappy bespoke app, odds are it already supports isolation.

Rоry McCune

as I say seems like a lot of hype for a minimal benefit and the cost is that people are running really non-prod ready code and downloading images from repos that are really not at all curated.. meh

AviD

the real benefit is that (supposedly) all those linux docker images can now work on windows.

Rоry McCune

@AviD yeah although for now all that is, is a thin linux VM running the images, like a small hypervisor layer..

AviD

perfect!

wouldnt want to mess up our hipster app with being on a production ready system.

Flyk

08:52

Girls have superpowers; they get wet without water, bleed without injury and can turn boneless things hard.

5

Rоry McCune

09:02

@Flyk an interesting choice of first message for the day :) Good Morning

Flyk

@RоryMcCune perhaps I'm achieving all three of these things today

Rоry McCune

@Flyk T.M.I !

Flyk

well...

Journeyman Geek

09:39

@AviD: Docker's main purpose feels like being a lazy dev's package manager ;p

(I'm considering setting up a VM to run my docker containers in ;p)

Flyk

10:41

1

Q: New profile page layout and the helpful flags page

Apologies if this is already something that has been mentioned (I had a quick look and didn't see anything). The new profile page looks nice but the switch between the various pages within your profile and the "helpful tag" page is a little jarring as the helpful tag page hasn't been updated with...

discussion feature-request flags profile-page

Rоry McCune

10:52

dailydot.com/crime/geo-inference-attack-google-craigslist-maps <-- deriving location based on browser caching..

Flyk

can you translate that for less technical people?

oh I get it, I think

that's pretty clever while simultaneously being so obvious

Rоry McCune

@Flyk yeah basically you have some pages cached which will be specific to your location. they test for how fast they can load resources for those pages, tells them where you are

that said to do it you need to pre-assemble a list of possible places

so it's a bit brute-force

unlikely that they'd ever test for Lochgoilhead for example

but things like "can load up the google france logo quickly" would work

Flyk

yeah it's unlikely that the specific tile on google maps that has my house on it would be tested on purpose

fortunately my VPN provider is in a different country to the country I live in, so I'm protected by that, since Google sends me to Google.nl

but it wouldn't protect against what they're actually doing

since I do use google maps, and facebook, and twitter

but not craigslist

Rоry McCune

@Flyk yeah so if they wanted to attack you with that google would be a bad option, but they could guess other sites for given countries

Flyk

nothing really stopping them from using other sites, though

Rоry McCune

11:03

indeed

Flyk

I guess this is another example of a system implemented for a purpose without the foresight of the actual impacts

like pre-emptive searching

Rоry McCune

yeah things like caching can have a lot of unforseen consequences

and the web was never designed to be this perfectly anonymous "do everything" platform

probably just as well, 'cause if it was it would likely never have been launched!

raz

11:17

@RоryMcCune I bet the goverments have all the cache timings for every cached page ever.

OMG THE GOVERNMENT KNOWS WHERE I LIVE!?!?

Journeyman Geek

Mine does. And my shoe size.

raz

The downside to that article is that they didn't give the vulnerability a cool name. Otherwise we'd be answering a slew of questions about it.

Rоry McCune

@RoryAlsop well Verizon apparently stand behind that list of CVEs as top exploited issues of 2014!

raz

@Flyk Did InfoSec not get the new profile? :(

Simon

11:35

@raz No but it's being worked on!

raz

@Simon By "Top Men"?

Simon

@raz Dude be careful otherwise someone will pull out the misogynist card!

AviD

@Simon cmon man, you've been asked to not to do that. You've been warned.

raz

@Simon It's a damn movie quote! Please tell me someone here knows the movie...

Simon

@AviD To not do what now? Show me the exact statement of someone telling me to not do whatever I just did.

@raz Nope :D

AviD

11:45

@Simon I keep telling you not to share your misogyny here

raz

@Simon sigh young people

Simon

I'd like to mention that until like 16 y/o I was watching dub'd movies.

@AviD I'm probably more respectful to women than you are.

AviD

o_O

Simon

pls, typing a joke in here to provoke a single person when I absolutely know those jokes are gonna get her supa mad does not mean that I believe what I said.

Journeyman Geek

sticks a trigger warning card on @Simon

Simon

11:54

@JourneymanGeek Oh I feel so much like telling you to mind your business right now.

Journeyman Geek

Top Men

►

Also

Get off my lawn.

AviD

@Simon I honestly have no idea what you're referring to. I havent read the transcript, just referring to this chat.stackexchange.com/transcript/message/21151055#21151055

@RоryMcCune I think that just shows how truly worthless that list is.

Simon

@AviD I dunno but it seems that every time I make a comment about women specifically to provoke @Flyk when we obviously poke each others all the damn time, I get shit on no matter how many times she has said pretty much the same things about men in the past.

AviD

I mean seriously, It's Verizon working on it, why in hell is everybody trusting them about this??

@Simon ....

Simon

@AviD Stop shitting on me.

AviD

11:58

4, because THAT is how you provoke @Flyk

Rоry McCune

@AviD well yeah but I don't think they realise how having an obviously crap chart like this makes all the rest of their data that's not obviously crap, look suspicious

AviD

@RоryMcCune I'm sorry, but having "VERIZON" at the top of it makes it all suspect, at best.

how am I the only one pointing that out?

Rоry McCune

@AviD well it all looked quite nice and sciency until now..

AviD

and seriously, why in hell is all infosec in love with this damn list??

Rоry McCune

but now I just think the whole thing must be crap

@AviD we don't have enough data to wave at management to convince them to give us more money :)

AviD

12:00

@RоryMcCune if "verizon" is not enough for you, consider the fact that the STATED purpose of the list is exploits of CVEs.

the overwhelming mass of vulnerabilities and exploits have little to do with CVEs.

@RоryMcCune heh

Rоry McCune

@AviD yeah exploits meaning someone actually exploited them but at least one of the list isn't really exploitable

AviD

@RоryMcCune why on earth would we imagine that management cares about data?

if management cared about data, they would be called "IT", not "management"

Rоry McCune

@AviD 'cause management care about hard numbers and definite things "if you can't measure it, you can't manage it"

senior management want everything measured and only really believe things (in a lot of cases) that are measured

AviD

@RоryMcCune yeah, whats the opposite of a tautology?

Rоry McCune

that's why CVSS exists

CVSS is obviously crap but it has to exist so people can pretend to prioritise things properly :)

AviD

12:03

@RоryMcCune the whole CVE system needs to be rebooted after a good rethink.

Rоry McCune

@AviD CVE/CVSS all crap indeed, but I'll wager no-one is going to consider replacing it now... too many large co's with an investment in it

AviD

it was designed back when there were only 30 types of systems, custom code was irrelevant, and sysadmins were the only ones that mattered in IT.

M'vy

@AviD not a tautology ?

AviD

@RоryMcCune "needs to be" != "will be"

@M'vy uhh no, as in the statement itself makes itself false

@M'vy A != A

M'vy

@AviD contradiction ?

AviD

12:06

@M'vy oh yeah that could work

derp

raz

i've got a question. Why is this off-topic and better for ServerFault?

1

Q: How to find more details on Invalid Certificates

Setup I am following this blog post to set up ASP.net MVC5 on Linux. When I get to the part that adds the Microsoft certificates, I am warned that they are invalid. For example, this command: certmgr -ssl -m https://go.microsoft.com returns the following: Mono Certificate Manager - version ...

certificates windows linux asp.net-mvc

AviD

I dont know that it is.

@raz okay now that I've read, I agree with you that it is not better for ServerFault.

It should be migrated to Linux.SE.

raz

@AviD So it's still off-topic for InfoSec?

Rory Alsop

Today the transcript is more confusing than usual

AviD

@raz doesnt seem to be a security question.

Rory Alsop

12:11

I may give up until I'm back on a non-mobile device

AviD

reads to me as "how do I handle certs on linux"

I removed the anti-MS ranty part though

@RoryAlsop heh, indeed

@RoryAlsop can you take a quick gander at @raz's q, see if you agree that it should be sent to linux.se?

raz

@AviD Yeah I thought about that. It comes off to me as, "How do I inspect a certificate without using a browser?" and/or "What could make a certificate invalid?"

Simon

I have an announcement to make: a co-worker just came to me with a box of donuts with a little paper plate to eat one at my desk.

I AM THE DONUT OVERLORD.

raz

@Simon I don't believe it.

AviD

@raz the first part is linux. the second, I think is not the core of the question.

Simon

12:13

@raz Would a picture of my headphones with a donut convince you?

AviD

@Simon its the paper plate part he doesnt believe.

we all assume you would just eat straight from the box.

Simon

@AviD LULZ

raz

@AviD Paper is a myth, like dinosaurs and water.

AviD

hell, I do. Though the whole box is always for me.

raz

@AviD I feel like he knows how to use Linux, he's just showing output. The questions he lists aren't Linux specific.

Simon

12:15

Ah for fucks sake, you can't upload pictures from a phone on the web page here.

SIGH.

AviD

> Is there a way I can view or inspect the certificate it's downloading, without having to use a browser?

that seems pretty linuxy

Rоry McCune

@Simon yes

AviD

and the first part should really come down to trusted root certs installed in his distro

raz

@AviD Yeah that's true

AviD

@RоryMcCune no, I think @Simon should mail each of us a box of donuts

Rоry McCune

12:17

@AviD well as long as mine get an added UGH en-route, that's fine

AviD

@raz though the appendix he has about his thoughts of possible issues ARE on topic here, though I doubt any of those are relevant.

raz

@AviD Yeah I see your point

AviD

@RоryMcCune no no, you should really taste some real donuts. you'll never want to go back to those heavy doughnuts.

Simon

AviD

@raz I'm actually not sure yet - because those would be GOOD questions to ask here, though I'm pretty sure the answer to both would be "NO"

Simon

12:18

Here, lads.

AviD

@Simon aaaawwww yeeeaaahh now thats a real donut, yisss

lookin good

M'vy

@AviD or is it a doughnut ? How would I know ?

raz

@AviD We could possibly re-edit it to fit InfoSec, but then i don't think he gets his real question answered.

Simon

I just sent this donut picture to my donut too.

raz

@Simon What headphones are those?

Simon

12:20

@raz ATH-M50

AviD

@raz right, thats what I was thinking. just migrated.

but those questions COULD be answered here :-)

also, just noticed there is no Linux.se

it's Unix.se

raz

@AviD same thing runs and hides

M'vy

unix&linux?

Simon

I haven't had a donut in a god damn while.

This is soooo goood lads.

AviD

I would lick the glaze off your paper plate.

Simon

12:23

Yeah you would.

AviD

maaaan I need to organize me a project in US, expense me some donuts.

ooo maybe I can find a client in Canada!

Simon

Yeah those come straight from Tim Horntons.

rip donut

AviD

it shall be digested over a thousand generations

Rоry McCune

@AviD knowing @Simon 's propensity for donuts, more like it would be more like 10 seconds rather than a thousand generations

AviD

@RоryMcCune eat != digest

also, sarlacc, man, cmon son

Journeyman Geek

12:37

it'll prolly spit him out

Rоry McCune

@AviD I know that.. Was your mind on Sarlacc's after yesterdays trailer by any chance?

AviD

heh, no - it always is

was sarlacc in the trailer? didnt see it

but yeah, trailer was awesome

Rоry McCune

@AviD ohh yeah

AviD

"Chewie - we're home". dyanomite!

Simon

Hey lads guess what, I only saw one of the Star Wars movies.

Rоry McCune

12:38

@AviD yeah if the movie lives up to the trailer, it'll be awesome

AviD

@Simon oooo if the whole trilogy was edited as an extra long movie that would be awesome

@RоryMcCune "Too bad they couldnt get the same guy to play Han Solo"

3

Flyk

14:09

@Flyk ...and can let men eat without cooking

(and/or women)

Simon

pls we can do that too

Journeyman Geek

@Flyk: Ah hah! Men cooking is as such a blow against the matriachy!

also, did you just reply... to yourself?

Flyk

@Simon that's true

bit salty, though

@JourneymanGeek I did, yes

what are you going to do about it?

Simon

@Flyk That is highly dependent of the pineapple consumption.

Flyk

well, not exclusively

Simon

14:17

You're right, donuts too.

Flyk

and chocolate

Simon

And donuts.

Flyk

red meats too, apparently

Simon

Donuts too.

Flyk

I mean I've never done any scientific testing

maybe I shall make that a project

this diet will provide you with the best tasting seamen

recommended by 100% of women

read our testimonials

"after six weeks I found that I just couldn't get enough of it"

"I was never really a fan before but now it's constant, I need it"

"before it was all salty and lumpy and now it's like eating the middle of cadbury's creme eggs"

Rоry McCune

14:38

M'vy

@RоryMcCune on-topic (topic #2, #3, #4) :)

Rоry McCune

@M'vy and @Simon did mention donuts as well... ok fair point that whole spiel was pretty much on topic

@Flyk s/seamen/semen/ I'd presume unless you're particularly referring to mariners?

Flyk

maybe I was being purposefully ambiguous

purposely?

one of those words

jrg

Anyone from the DMZ heading to BSides Cleveland in June?

Flyk

Who would willingly go to Cleveland?

jrg

14:43

Hey, I live here. It's not that bad! ;-)

Flyk

you say that like it improves things. ;)

Polynomial

pizzahut.com/assets/pizzanet/home.html

^ it gets even better if you view the source.

Flyk

it uses tables?

jrg

they loaded google analytics into it?

Flyk

it doesn't close the body tag?

no css?

absolute links instead of relative?

I wish I was clever enough to understand you, please reveal your secrets to me!

...

Polynomial

14:48

read it.

particularly the DTD at the top

Flyk

I can't read

Polynomial

HTML 3.2 goodness

Flyk

that's way too geeky for me

I would have never got it

Polynomial

... you're in the chat channel for an infosec Q&A site

"way too geeky" doesn't exist here

Flyk

yeah, strange things happen

Polynomial

14:50

I also particularly like that it says it's served by a super ye olde UNIX distro.

Terry Chia

@Polynomial I am?

jrg

the marketing team is probably trying to figure out why everyone is going to that page and trying to order pizza that way

Flyk

I like how it's assumed that because I know how to join an internet chat room that I must be some uber leet super haxxor goddess of packet based fire

you say syn, I say ack, I have no idea why though.

joke is on me

Simon

all, joke is on her

Flyk

pls

Polynomial

14:54

@Flyk I made the assumption that you'd probably be interested in an somewhat knowledgeable about the subject matter of the room you joined and have been in for several months.

Flyk

@Polynomial years

Polynomial

I don't think that's an unreasonable assumption to make in most cases.

Flyk

sure, it's not unreasonable

Polynomial

shrug

Flyk

but incorrect, in this instance

I can just about turn a computer on, if it has a power button that is bigger than all of the other buttons on the front of the hard drive box

otherwise I have to ask

Simon

14:55

And plug a USB device.

Terry Chia

@Polynomial donuts double-entendre food libations rory

Flyk

I don't know, sometimes I accidentally plug those into the ethernet ports

Rоry McCune

@Flyk pls , that's a nice facade to try and keep up, but you've let the OpSec on that one slip several times :op

Simon

poor ethernet

Flyk

@RоryMcCune hardly

Rоry McCune

14:57

@Flyk I can go find all that stuff you said about SQL server in the past if you like

Flyk

it's surely got to be getting to the point where it's a meme of sec.se chat that to make me shuttup and go afk you just talk technical

I know nothing about SQL

Simon

Do you guys pronounce Sequel or SQL?

Flyk

even if you find proof, I Google'd it

sequel, obv

Rоry McCune

Jun 3 '14 at 9:38, by kalina

or SQL server doing weird caching things that may or may not be a bug in SQL server but were completely unreproducible

Flyk

@RоryMcCune bunch of words that say nothing

Rоry McCune

14:58

Jun 2 '14 at 13:28, by kalina

one side effect to spending all this time on music is I appear to have lost all of my SQL knowledge

raz

@Simon Sequel, what are we poor people?

Simon

@raz lolololol

Flyk

@RоryMcCune what SQL knowledge? I lost it

Rоry McCune

@Flyk but you had it, which implies techy. Also you used to be an IT tester

which was an IT job

which by it's nature makes you techy

Flyk

@RоryMcCune everybody knows that people who work in testing just fuck about all day

I got really good at Angry Birds as a result

Rоry McCune

15:00

Jan 13 '14 at 16:38, by kalina

T-SQL \o/

you're a database geek

that's almost as bad as security

Flyk

ok, allow me to explain

xkcd.com/435

why is that not working

Rоry McCune

@Flyk you use XKCD to explain things and you're trying to say you're not a geek!

Flyk

https -.-

On the other hand, physicists like to say physics is to math as sex is to masturbation.

ok, over here on the left

that's "normal people"

next along, that's "people who kinda know a few things"

that's me

then you have three levels of geek

and then thomas pornin over on the right

Polynomial

so I guess the far right is cryptofolk

and UKIP

Flyk

yes, UKIP and Infosec and Crypography people are all basically the same group

Polynomial

15:02

I resent that

Flyk

I was joking

Polynomial

I'm only 14% as racist as UKIP

Rоry McCune

room topic changed to The DMZ: ' DROP Table Moratorium;-- [donuts] [double-entendre] [food] [libations] [pls] [rory] [security]

Flyk

so, from this we can take, that while I'm not exactly your normal end user, I'm also hardly going to recognize the HTTP version number in the html soruce of some web page

or - and I must stress this - find it funny

Rоry McCune

@Polynomial if you want another SCO box try armory.com

Simon

15:04

PLS WEEKEND CUM ON ME

2

owait

Flyk

8 secs ago, by Simon

PLS WEEKEND CUM ON ME

Rоry McCune

was the first Internet site I visited and it's still there

Flyk

cannot be undone

Polynomial

@RоryMcCune \o/

Rоry McCune

hey @Simon that website is older than you

Simon

15:06

pls I'm 12, everyone's older than me.

Flyk

@RoryAlsop has socks that are older than most of us

probably

Simon

ew

Rоry McCune

@Flyk not socks, but I have T-Shirts older than several of you

oldest one I can remember getting is from 1992

Simon

Wear them you naked man

Rоry McCune

oddly from the same town as that web site is hosted in

Flyk

15:09

@RоryMcCune damn

raz

I think my oldest tshirt is from 1999

Rоry McCune

@Flyk it's a Santa Cruz Beach boardwalk employee t-shirt

Flyk

@raz I was still too young to actually remember anything from even that far back

Simon

^

raz

@Flyk You mean you didn't party like it was 1999?

Flyk

15:11

@raz I would have been in bed

Polynomial

I party like it's a 1960s representation of a future 1999; by eating my food-pills in my flying car.

Simon

I bet you got @Flyk all excited when she read the word "pills".

Flyk

how well you know me /rolleyes

Simon

trulululu

raz

15:26

@Polynomial I'm still pissed we don't have flying cars.

jrg

@raz 2015 isn't over yet.

Flyk

I'm more annoyed about lack of hoverboards

self drying clothes would be cool too

although it always looked like it would mess up your hair

Xander

15:45

@raz I sort of am too, until I think about how people drive cars that don't fly. Add a 3rd dimension for your average driver to control, and I don't foresee a happy ending. So, it may be for the best.

Flyk

no it just reiterates the importance of survival of the fittest

Xander

@Flyk Survival of the lucky, you mean. Accidents often end up unfortunately for more than just the responsible driver.

raz

@Flyk Hoverboards exist

@Flyk The problem with cars is that people don't just kill themselves

Survival of the fittest doesn't quite apply

Flyk

16:38

@raz not really.

Simon

17:31

I really enjoy having a beer during lunch time on a work day.

What I don't enjoy is having to work after, slightly intoxicated.

fml

schroeder

@Simon lightweight ....

Simon

@schroeder I weigh 145 pounds dude.

schroeder

what are you drinking? La Fin Du Monde?

Simon

OH MY GOD LA FIN DU MONDE <3

I still have some left at home :p

Nah, I had a huge ass glass of Rickard's Red.

schroeder

For those NOT in Quebec, LFdM is a 9% beer

Simon

17:35

^ I'm sooo done after that.

@Xander likes it too IIRC.

Xander

@Simon Yes, it's fantastic. I introduced it to a co-worker a few years ago, and it instantly became his favorite beer.

Thomas Pornin

@schroeder For those who don't speak French, the name means "The End of the World" and that's what you feel when you drink it.

Simon

@Xander I think that's what happened to me too :p

@ThomasPornin In a positive or negative way?

Thomas Pornin

It is an eschatological beer.

By definition there is no moral value attached to the end of the Universe. It just is.

I must say that it tastes well, meaning that old Norse really got it wrong.

Simon

hehe

It's available pretty much anywhere too, which makes it even better.

schroeder

17:52

@ThomasPornin "a 'heady' spirit with a great finish" heh

Thomas Pornin

@Simon It can also be found in some stores and restaurants in France.

raz

@Flyk Totally I've seen them on youtube.

@Simon That's a great beer.

They have it on draft at the bar up the street right now. It's fantastic.

Flyk

@raz those don't count, they don't hover, they repel the special material they're "hovering" over

Transcript for