The DMZ

schroeder

00:02

@amccormack this was a tough call. Normally, I'd vote this one up, but then the OP takes some bad turns. There is no discussion of the types of tablets, it kind of sounds like a product recommendation, but then in comments, seems to want to know how the OS on the tablet will solve the problem. This means it's an OS-specific feature question.

so, it's off-topic because it's an iOS/Windows/Android question

but we don't know what one

amccormack

Ah

I don't disagree that it could have been better asked. I read it as a "We intended to deploy tablets but how do we keep them secure", which is also kind of broad, but I think it is a question that can be had at a high level.

I doubt the user comes back, but if he did, what do you recommend to reopen the question?

schroeder

If the details in the comments were included to describe the constraints/expectations, and provided more details, then we could have specific answers. Otherwise, your answer of an MDM is the correct one.

This is one of those kinds of questions that looks perfectly fine, but hides assumptions, details, and a subtle X/Y problem.

Steve DL

00:24

@amccormack iirc I voted as too broad/unclear

to me it sounds like "hey we dont really understand computers but we bought some tablets and we thought the internet could do our homework for us so we dont have to pay a contractor"

@amccormack we cant discuss the steps OP needs to take without a breakdown of what the machines are, who uses them, what for, and what threats must be protected against...

amccormack

@SteveDL I'm not too familiar with the process of closing, when it says "closed as _ by x,y,z", does it really just mean that those people voted to close but the reason is just the most popular reason?

Steve DL

An equivalent but properly scoped question would be: security.stackexchange.com/questions/89844/…

Which made me happy and which I bothered to reply to

It closes with the most popular reason yes

(or the one chosen by a higher-up moderator, if I understand their own voting process correctly)

amccormack

ah, I see

Steve DL

Organisational security policies are hard. There's a lot of ground work and processes to set up to do this properly and obtain both productivity and security. I wouldn't venture about telling these brave people how to configure tablet Foo with software Bar with no understanding of the use context and job requirements

and of the organisational context

HelpEric

00:50

Are there companies to which you can submit when companies have misconfigruations exposing data they likely did not want to expose? I know there are all sorts of bug bounty programs from apps and some vendors have them, but are there generic companies that do this? I was googling someone and found that Google had indexed some page that looks like it exposed a sales database.

Steve DL

Yes and no...

HelpEric

I couldn't find a clear security email, this is a large major company... I am also concerned about contacting them directly in case they turn around and claim I tried to hack them (by googling and actually being able to understand what I came up with)

not neccesarily concerned about a bounty or anything

Steve DL

most governments run a team that you can contact, but they'll only care if they use the software/hardware themselves. In some communities there are specific authorities (in FOSS Red Hat has a red team that touches other software, and there's the ossec mailing list... in the web you can contact browser vendors for certain issues...)

HelpEric

i would imagine this company is used by the us gov

Steve DL

(disclaimer: i don't need pentest or offensive sec or bounties)

HelpEric

00:53

but its not a web company

Steve DL

you should first get a good write up of what you did

and ask yourself whether it was legal or not

if legal, write to the company and give them 3-6 months to fix the issue and propagate the fix

HelpEric

its not their app, it looks like they misconfigured some oracle app

Steve DL

you can ask for money IFF they have public bounty programmes, and you are free to disclose the issue after a reasonable period of time, usually a few months so they can propagate to clients

you can then apply for a CVE identifier and enjoy the glory or lack thereof

it doesnt matter what the vulnerability

HelpEric

i don't think its a vulnerability, i think they just made it public

Steve DL

so long as it exists

and it can be reproduced

making confidential stuff publicly available is a vulnerability

(and third parties making use of said confidential stuff as if it were publicly available can have you condemned, because the people of the law are a bit silly sometimes)

if there is any chance that what you've done is illegal, then DO NOT disclose your identity

simply reveal to the company the existence of the issue anonymously

you can ask if they're willing to credit you but i would get a statement from them that they wont press charges against you

HelpEric

00:56

I wasn't bug hunting.

Steve DL

doesnt matter what you were doing

HelpEric

you can get a CVE if a company misconfigured a oracle product

Steve DL

what matters is how they'll perceive it

HelpEric

I am not sure it was a breach

Steve DL

and how clearly a (non-expert AT ALL) judge can understand you were not meaning to find the issue

HelpEric

00:57

What I did: I was googling a person with which I had an interview. This page came up. It shows a SQL query and the results

I said to myself, this should probably not be exposed

its like busienss names and addressess, but still it looks like stuff that should not be public

Steve DL

well, write to them

if you cannot manipulate the query though, it's likely to be a feature and not a bug

HelpEric

I didn't really dig into it too much, there may be other pages where you can execute

the info avaialble is some queries about their customers and the schema of these databases

its not dummy data, because it had the person I was googling's full name

no other option besides trying to find someone who works there in security on LinkedIn and emailing them?

I would like to get a safe third party invovled to mitigate any claims againstm e

Steve DL

they should have a URL

otherwise contact the person you were in touch with

HelpEric

i was not in touch with anyone

Steve DL

Which country do you live in?

HelpEric

01:01

the person I was googling seems to be a customer of the company

USA

Steve DL

hmkay, i dont know about US institutions

you're on your own :-P

HelpEric

i'll do some more research and sit on it for now, it looks mostly like business contacts so I don't think the risk of someone getting their identity stolen is super high

M'vy

07:10

heya

Rоry McCune

Mornin'

Rory Alsop

07:37

Morning all

Victor Lopez

09:18

@AviD Why is that so? About the DMCA take down, how does that affect you as a developer/company/creator.

AviD

@VictorLopez hmm?

Victor Lopez

@RоryMcCune So RSA algorithms should make it more secure?

Rоry McCune

@VictorLopez RSA is a crypographic algorithm, whether using it would make a mobile app. more secure entirely depends on how you use it.

Victor Lopez

So vulnerabilities can be among any unprotected piece of your software and not only in the user's data.

AviD

@RоryMcCune crypto magik faerie dust!

CodesInChaos

09:25

Most people who ask about using RSA would be better off using SSL/TLS.

AviD

do we still need to call it that?

SSL is dead. Long live TLS.

CodesInChaos

Not sure if everybody knows that SSL is now called TLS.

It was a dumb idea to rename it...

AviD

at least with technical non-security people, the fact that google is starting to downgrade SSL has helped raise awareness.

CodesInChaos

The tag on crypto.se is still called ssl

AviD

really? and there is no TLS tag?

here ssl is a synonym for tls

CodesInChaos

09:28

tls is a synonym of ssl on crypto.

AviD

does that make sense?

it was like that here for a while, eventually we reversed it.

CodesInChaos

the original decision was made in '11.

Revising it might be a good idea.

Perhaps I should write "TLS (formerly SSL)" from now on.

Victor Lopez

Was it since the hearthbleed and the poodle vulnerabilities?

CodesInChaos

If you control the client, you can disable everything apart from TLS 1.2. Most vulnerabilities only affected older versions.

TLS isn't great, but it isn't trivial to write something better either.

But as always, you first need a proper threat model before talking about which crypto solves the problem.

raz

11:11

0

Q: How do I find vulnerabilities in software?

I read an answer here which talked about becoming a PenTester. The answer said that you have to learn to break software. I posted a comment on the answer asking where do I start learning to break software, but I didn't get any replies, so I decided to ask my own question. How do I learn to break ...

"hell I've written a whole working windows executable only with a hex editor."

Somehow.... I doubt that

Terry Chia

@CodesInChaos Isn't it more like "TLS isn't great but writing something better and getting it widely deployed is impossible so fuck it"?

CodesInChaos

@TerryChia In a browser context yes. But if you control the client, you can do that.

Terry Chia

@CodesInChaos Ahh, must have missed the context. :)

CodesInChaos

The problem is that if your new protocol has fewer features, you'll always find somebody who complains.

Rory Alsop

@schroeder - is this one really off topic? I'm not sure:

2

Q: Does the new Fedora package manager allow unauthorized installations?

I just upgraded to Fedora 22. The biggest change from the previous version is that the yum package manager is now replaced with dnf. One change I've noticed is that if you try to execute a command that comes from a common package which is not yet installed, the terminal will prompt you to install...

linux privilege-escalation sudo install

Simon

11:26

IT'S FRIDAY FRIDAY

GOTTA GET DOWN ON FRIDAY FRIDAY

Rоry McCune

@Simon Hey Simon I have a young person question for you. What does xxx360noscopexxx mean?

Simon

Call of Duty reference. No scope implies that you don't scope in with your sniper, which makes the shot very inaccurate. The 360 well, you do a 360 spin.

Therefore, you jump, do a 360 then fire an extremely inaccurate sniper shot and hope it kills the other person.

Rоry McCune

Ah I see, ta :)

raz

@Simon 360?? Try 720

BOOM HEADSHOT

Simon

I was quite decent at CoD, fun games are fun.

Both on PC and PS3.

doppelgreener

11:40

@Simon and then when it hits on the 120th try you finally feel validated

raz

@Simon I was always a PC guy, I'm too slow with a controller.

Simon

@doppelgreener Sure! Then, you make a compilation in a video of 5 minutes which took a year to record and look like a damn pro.

@raz You'd get used to it after a while.

My sensibility on my controller was at the maximum.

If I'd go pick up my controller right at max sensibility, I wouldn't be able to play.

CodesInChaos

12:18

@Simon Does "inaccurate" mean "difficult to aim" or "you need pure luck because it spreads the shots randomly"?

Simon

@CodesInChaos You got it, it's entirely luck.

If you're moving at the same time, the range where it could end up being fired in is even bigger.

Rory Alsop

12:32

@Simon I'm a COD player. Only on PC. Consoles are for driving or flying games

@RоryMcCune and I knew what that was - not sure why it's a thing, but still :-)

it's funny doing it

M'vy

@RoryAlsop I'd limit that to driving

Unless modern console accept USB joysticks?

Simon

@RoryAlsop What's next, donuts are for donuts?

Simon

12:57

Here's a pet peeve of mine, when someone says something like "there's 99% of chance that ..." and this guy does it twice in his answer:

4

A: Is my job in trouble?

Out of my 15 years in workforce, I have spent months worrying about my job throughout my career, but was never fired in my life. 99% of things that we worry would happen, never happen, so, relax, enjoy your work, smile a lot, avoid arguing, build good relationships, focus on what you are doing 9...

It makes me want to kick his ass at 99%.

Thomas Pornin

@AviD I use "SSL" to designate the family of protocols that includes the historical SSL 2.0, SSL 3.0, and the TLS 1.0, TLS 1.1 and TLS 1.2.

AviD

@ThomasPornin hmm. Wouldnt it be less disingenuous to use "TLS" to designate the family of protocols, including the historical precursor to TLS, i.e. SSL?

Simon

@AviD Shut top.

Rоry McCune

@Simon yeah but 99% of the time you don't :op

Simon

@RоryMcCune S*?@%#RF#?%$#RU

Thomas Pornin

13:02

@AviD People are accustomed to the use of "SSL". The same people think that the 'S' in 'HTTPS' is for SSL (it is not, but they still think it). HTTPS is not HTTPT.

Simon

Whoops, that's my password.

Rоry McCune

@Simon I thought your pasword was hunter2

AviD

@Simon I thought your password was "donuts"

or, for a stronger passphrase, "donuts donuts donuts donuts"

Simon

^

Thomas Pornin

Plus, "TLS" is the name of a standard, while "SSL" is merely an acronym derived from what could have been a trademark (but actually was not).

AviD

13:03

@ThomasPornin heh. we should start calling it HTTPT.

Simon

Or even better: donuts^10

AviD

@ThomasPornin exactly, that's my point.

Simon

@AviD Oh for fucks sake.

AviD

@Simon naw, its hard to type that "^" on a phone

Simon

HTTPPROTECTEDAGAINSTMITM while we're at it?

Thomas Pornin

13:05

@AviD I mean that "TLS" is too restrictive since it does not include SSL 3.0, while "SSL" is a fuzzy enough term that it can include all TLS versions as well.

AviD

@ThomasPornin hmmph. don't you think it's time we DO exclude SSL?

Google does.

heh. if I would have posted my comment on that high school question, as an answer, I would have already repcapped from it.

Thomas Pornin

@AviD In fact I am writing an "SSL library" that explicitly supports only TLS and is still called "SSL".

AviD

@ThomasPornin that is sooo weird!

Thomas Pornin

@AviD We call it "marketing".

AviD

that's like having a donut, but made from bread and peanut butter.

I was in the donut store today, I really wanted to buy donuts, but I didn't, because they only had doughnuts.

Simon

13:11

@AviD Nah, historically donuts were never made from bread and peanut better.

Bad analogy son.

AviD

@Simon I meant as in something that is not the thing

Simon

Still not accurate.

does the pls dance to troll ovid

AviD

@Simon lsp

Simon

:(

Rоry McCune

@ThomasPornin How is BearSSL coming along? We'll need to get onto the viral marketing campaign when it's nearly ready :)

AviD

13:14

@RоryMcCune naw, just post it to npm and rubygems. 100,000 users will download and install it in a week.

Simon

lulz

Thomas Pornin

@RоryMcCune I am still working on the core engine -- I want to make it a state machine, to ease integration.

The record processing is done.

Rоry McCune

@ThomasPornin cool :)

@AviD :op

Thomas Pornin

I have most crypto algorithm; I still need to put together a constant-time GCM implementation (I have some ideas about that).

Rоry McCune

@AviD I'd say post it to the go repo. too, but they don't have one, it's just github for them

Thomas Pornin

13:16

First version will be RSA only; in the next one I'll include ECDHE.

Rоry McCune

@ThomasPornin is it just looking to be TLS1.2 or are you going to do earlier versions as well?

AviD

ya know what? @Simon, that highschool question is proof you're wrong, about me being a repwhore. I'm not posting my comment as an answer because its an answer to a parenting.se question (is there an education.se?), not a security.se one.

Simon

wat

Oh that question? I remember seeing it when it was first posted. Link?

Nevermind, it's at the top, I'm a silly donut.

My answer would have been something along the line of "You find out that a student uses the WiFi? Kick his god damn ass.".

Sometimes, you can't solve a problem through technology, you gotta use your foot.

Thomas Pornin

@RоryMcCune TLS 1.0, 1.1 and 1.2.

I think I'll skip DHE, and go for ECDHE.

TLS 1.2 is not necessarily better than TLS 1.0 or 1.1 when you optimize for code size, because TLS 1.0 implies MD5+SHA-1, while TLS 1.2 requires SHA-256 (or SHA-384). SHA-256 code is quite larger.

Rоry McCune

@ThomasPornin so any moderately modern client should be able to use it, cool :)

Simon

13:26

Personally, I'd review every single line of BearSSL but I'm assuming that he could implement a backdoor by compiling a single character.

AviD

@Simon I agree about the first part. not the second.

though we have an army saying here, if you dont learn through your head, you will learn through your feet.

Simon

Wow, an army saying? Do you even lift bro?

AviD

wut?

Simon

wot

AviD

wit

Simon

13:31

wat

AviD

wet

2

Simon

wyt

AviD

wrt

Simon

We ran out of vowels, we were supposed to stop.

You always ruin everything.

AviD

oh crap, whats wrong with @RоryMcCune

Simon

13:32

wat^2

AviD

@Simon, I would challenge you to a battle of wits, but I don't want to fight an unarmed man.

Simon

pls

Rоry McCune

@AviD I thought the clear elucidation of the verbal dexterity of members of the DMZ warranted preservation through the use of the Pin wall :op

4

AviD

@RоryMcCune pin abuse

Rоry McCune

@AviD are you suggesting that these messages aren't a fair representation of the conversation ?

AviD

13:34

pin flooding?

Rоry McCune

@AviD Denial of Pin attack.

CodesInChaos

13:52

@RоryMcCune It's a fair representation of the DMZ in general, not just of that conversation.

Stack Exchange

Instead of bobcat, package contained chair.

Simon

@StackExchange Hey, cool xkcd, man! Is posting this accelerating the process of updating the CSS for InfoSec.SE?

Silly SE bot.

AviD

@Simon youre a silly SE bot.

raz

15:41

Man, a bit dead in here

Even for a Friday

Rоry McCune

15:52

@raz you missed out on the wut-fest that @AviD and @Simon had earlier

raz

@RоryMcCune I wouldn't say I was "missing it" Rory

Rоry McCune

but yeah quiet for a Friday, would have thought all you US-ians would be cooling your heels waiting for the weekend to start (which it almost has here !)

raz

haha, I work 9 hour days so I can take a half day on Friday

1hr until beer is flowing!

Rоry McCune

@raz \o/

raz

And this hour can't go by fast enough

Rоry McCune

15:57

@raz you mean you'd rather trade the company of a quiet Internet chat room for alcohol and food!

pssshhh

raz

@RоryMcCune I see @LucasKauffman is already enjoying beer today

@RоryMcCune I wish the chatrooms were integrated into the mobile app

But I mean they can't even give us our damn profile! So why should we get chat integration.

Rоry McCune

@raz not seen him around here for a little while, thought he was off on his travels

@raz oh yeah that would be so much better

a decent mobile chat integration would be nice

I'd pay for that app.

raz

We're friends on Untappd, I see him checking in beers.

Rоry McCune

@raz ahh I C

raz

@RоryMcCune I'd pay $2

$2 for chat and review integration

Rоry McCune

16:00

@raz me too, so that's at least $4 for someone, should be enough to get an app started!

raz

@RоryMcCune Easily!

Rоry McCune

@raz hell with that kind of income you'd expect them to be going for VC funding!

raz

Viet Cong?

Rоry McCune

@raz Venture Capital

raz

Are they know for cheap app developers?

hahaha, right

Rоry McCune

16:02

where all those start-ups with no money get their revenue

have a lame idea, with some snazzy logos, hipster developers and a Node.JS codebase... here's $10m

raz

I think it's funnier to think that the Viet Cong are taking over apps, guerrilla style

Rоry McCune

@raz yeah that is amusing image, and would make meetings with the investors much more challenging!

raz

@RоryMcCune "Why did they bring children to a meeting... it was horrifying! We couldn't say no to the girl scout cookies... the cookies!"

Simon

Back in my days, Fridays were never quiet.

Rоry McCune

@Simon are these not your days any more?

getting a bit old are we :op

Simon

16:05

I'm very old QQ

raz

@Simon is almost.... 13?

Simon

I don't think I'll ever turn 13.

raz

You'll never be a man? I guess that makes sense

Simon

pls

CodesInChaos

16:20

Simon is the FBI.

Simon

The FB wat

raz

Silly Canadians

It's like your Mounted Police, but you know... without the horses.

raz

16:56

Alright ladies and gents, enjoy your weekend!

Simon

You too lad, you too.

Jeff Ferland

wtf star wall?

2

Simon

Is there something wrong with it?

schroeder

18:37

@RoryAlsop it looks like an internal Linux update package security architecture question that seems to me like a highly Linux-specific question - more than that, a question specific to a certain update manager

Rory Alsop

@schroeder - OK. I was wondering if it could be taken more generally. If it gets more votes to close I can remove the bounty and migrate it

TildalWave

21:01

@AviD I can find some time now or during the weekend for that logo design you mentioned

what happened here? :O

schroeder

we've been Simonized?

Rory Alsop

that's the strangest starwall I've seen in a while. Was on mobile all day so didn't see them

David Freitag

We can all thank @Rоry for that one

Rory Alsop

@DavidFreitag I did nuthin' - oh, t'other Rory

@raz use ChatsSEy - works brilliantly...except for the star wall, and uploading images

TildalWave

21:33

@RoryAlsop Does it praise random moderators when the screen locks?

Just trying to figure out where that brilliantly comes from

Unbreakable

I am new to this chat. I have some basic query related to programming. How to know the right chat room. Kindly help.

TildalWave

@Unbreakable check chat rooms on Stack Overflow and Programmers, or filter all rooms for specific keywords here chat.stackexchange.com

Rory Alsop

21:55

@TildalWave cheeky

TildalWave

@RoryAlsop :)

Unbreakable

22:19

Thanks!

this.josh

23:20

@ThomasPornin "constant-time GCM implementation"! Without being slow or dependent on specific architectures?

Transcript for