The DMZ

AviD

06:11

@RоryMcCune @TildalWave not opinions, context-sensitive tradeoffs.

and thats where the non-security folk get lost, that is not opinions.

CodesInChaos

07:00

If people want security reviews they should at least write a spec and (unless it's obvious) describe their threat model.

That way you can review the spec for weakness.

But you only need to review the code to check if it complies with the spec.

Rоry McCune

07:59

@AviD well, that's your opinion, for sure :op

AviD

10:26

@RоryMcCune no no, you got that wrong. It should be:

> "Yeah, well, that's just, like, your opinion, man"

Rоry McCune

@AviD yeah I realised that later.. BTW I take it you're not at the big Cyber-Sec conf. in Israel today

sounds like quite a major one from the mentions in my timeline.

AviD

no... going tomorrow though

Rоry McCune

@AviD is it a techy conf, or more InfoSecy?

AviD

@RоryMcCune hmm, kinda both, kinda fuzzy

hang on

sectech.tau.ac.il/cyberconference15

so some of the speakers are gov't and defense style, some are very techy

oh! didnt notice, Ol' Brucie is gonna be there!

Rоry McCune

@AviD yeah lots of heavy hitter sounding names, CEOs Generals etc

AviD

10:32

this one is a surprise.... "Vice President, Korea Internet & Security Agency"

okay they totally updated this list since last time I looked.

Hmm. I missed Bibi's talk.

I think I'm ok with that.

I dunno, most of the schedule look like group panels.

so not so technical.

Rоry McCune

sounds relatively interesting nonetheless, see they've got Nick Percocco from Rapid7..

AviD

dont know him, but sounds interesting.

though - if it is a group panel, how much will that matter

thats an especially weird panel. Nick and Marion (a reverse engineering expert), together with Aviva Litan and Keren Elazari - both very fuzzy executive-level.

Rоry McCune

@AviD he ran spiderlabs, the pentesting/research bit of trustwave IIRC

AviD

@RоryMcCune oh, I've heard of them

are they any good?

I know many of them personally, curious about other's impressions...

Rоry McCune

10:48

@AviD dunno really, I interviewed with them back 6-7 years back which is why I know nick as he did the interview. ..

I did see a couple of presos by people who were with spiderlabs that were a bit so-so but you can't really judge them on that

AviD

yeah, I've seen both kinds. so-so, and some very good ones too.

also my opinion is that quality of research != quality of public speaking

Rоry McCune

@AviD very true

TildalWave

@AviD That's really mean to Stephen Hawking you know? :D

AviD

good example

although... I heard that he is a very entertaining speaker

TildalWave

I'm now more in quality of coffee != level of self-awareness mode

@AviD ... I'm not going to compare it with sex, but it lasts longer.

AviD

10:54

@RоryMcCune ah okay, the techy talks are tomorrow afternoon - sectech.tau.ac.il/cyberconference15/index.php/events/…

some nice ones there

well, interesting speakers anyway.

it really pisses me off when conferences dont bother telling you the actual topic ahead of time.

"Come! It will be good. Trust us!"

"All topics are equally interesting for everybody!"

TildalWave

possibly with many tracks so you have to decide which one

doppelgreener

"We didn't have a topic arranged by the time we had to pay for this copy to get written! Oh god! Please come fill some seats!"

AviD

AppSecEU did something similar too - revelaed the topics relatively close to the conference, and then only the titles. the abstract for most talks was only shared right before, and even then not for all of them.

TildalWave

"Our paper submission deadline was four months ago. Sadly, that left us with less time than the developer 8 weeks to prepare."

AviD

not always the case. @RоryMcCune said he provided full details and abstract to the organizers many weeks in advance.

TildalWave

11:04

how's your coffee @AviD?

AviD

hmm, should have some

TildalWave

well your snark detector is offline ...

raz

@DavidFreitag Thanks!

AviD

ohh oops

Steve DL

security.stackexchange.com/questions/7088/… this thread makes me cringe

almost all of the answers advocate creating toxic waste :(

Ohnana

11:09

"we flushed it down the toilet"

D:

y u do dis to fishies

raz

@SteveDL Wow you really dug that one up

Steve DL

came up in my review thread, afair

Rоry McCune

@AviD that was AppsecEU, yeah they did want info. in advance, but then i was presenting from my own laptop, so I guess i could've just changed it if I had wanted :)

raz

@SteveDL gotcha, really you should pulp the paper back into paper.

AviD

@RоryMcCune yeah thats always the case though... but I meant things like the title and abstract

@raz or give it to a 3 year old to "take care" of. I guarantee it will be unretrievable.

Rоry McCune

11:13

@AviD sure for that title and abstract were part of getting chosen to speak so that was months in advance

raz

@AviD Vats of acid?

Steve DL

@raz it's the ink i'm worried about. I don't know how recycling plants operate but I suspect they have a way of dealing with the residual content in the water

AviD

@raz vats of 3 year olds.

raz

@SteveDL Make them into 3 year olds

AviD

so this is very perturbing to me. my cellular provider rolled out 4G a while ago, I finally got around to checking my phone. It should support it, the firmware is the right version - but, no 4G configurable.

raz

11:14

I mean... cardboard

AviD

couldnt find any info on how to fix it

raz

@AviD You might have to call your service provider, and ensure that they've enabled 4G for your account.

Silly, but I think sometimes that's the case depending on the technology (GSM vs. CDMA)

AviD

@raz nope, thats not it - it is enabled. the problem is I cant make my phone support it.

raz

@AviD What kind of phone do you have?

AviD

Lumia 920

Rоry McCune

11:18

@AviD with 4G isn't there some schtick that the bands used vary per country and not all phones will do 4G in all countries

AviD

hmm. I know there was that for 3G, but it was a fit here.

Rоry McCune

worldtimezone.com/gsm.html

AviD

besides, my problem isnt that it doesnt work, its that I cant turn it ON.

Rоry McCune

4G LTE Cellcom 1800Mhz; 4G LTE Orange 1800/2600Mhz; 4G LTE Pelephone 1800Mhz;

^is for israel

AviD

there is a network setting for max cellular speed - only settings I have there is 2G and 3G.

Rоry McCune

11:20

@AviD ahh that'll be because you've not enabled the "give the telecoms company loads of money" option

AviD

@RоryMcCune no but its on my PHONE, not the network

raz

@AviD Are you US based? Because that phone doesn't support some of the US 4G bands

@AviD Did you buy the phone outright?

AviD

@raz it supports 4G, not sure which bands. but thats besides the point.

@raz yeah

not from the telco

raz

@AviD You've seen this?

techview.co/2013/03/how-to-lumia-920-820-enable-4g-lte

AviD

No! that might do it. thanks!

raz

11:23

Have you updated your phone recently?

The last section says it's not recommended

And that your phone should be updated to get the 4G option ultimately

AviD

@raz yeah well its already fully updated

via OS, not telco

which, btw, is really something I just dont understand

raz

Then give that a shot, might be a shotty solution though

AviD

you dont ask you home ISP to manage your desktop OS, right??

raz

Haha, nope

AviD

@raz yeah, will do, later though.

Rоry McCune

11:25

@AviD yeah carrier settings are sometimes set by the carrier

and change what's available on the phone

I'm not a fan of this concept

but it's not unknown...

AviD

... which is what I dont even understand.

Rоry McCune

carriers like to carrier

AviD

@RоryMcCune carrierring should start from the sim card and network-facing. The OS itself is not a carrier thing

Rory Alsop

ello all

AviD

ello ello

Rory Alsop

11:28

@amccormack - did you register on our blog site? Think you need to do that and then I can change your account type to contributor

TildalWave

morning

Rory Alsop

@TildalWave no it isn't

:-)

Gutted it was overcast last night - space weather looked like we'd get a good one

TildalWave

@RoryAlsop it's always morning in the DMZ innit?

AviD

@TildalWave no no, it's always friday afternoon in the DMZ

TildalWave

(I didn't say it was a good one :P)

Rory Alsop

11:29

@TildalWave best time of day - so... yeah, okay

@AviD Nah - afternoons require coffee to get through. My mornings are peak flow and performance

AviD

@RoryAlsop nah, whisky. or cold beer.

TildalWave

kinda feels like morning here, so dark from the storm they even shot anti-hail rockets before

Rory Alsop

@AviD if I could, sure. But My child-taxiing duties never end before 21:45

TildalWave

missus came asking what that was, thought we're in a war or something LOL

Rory Alsop

@TildalWave anti-hail rockets are a thing???

wow!

(googles)

TildalWave

11:31

@RoryAlsop yup, silver iodide or something

I can even tell you how it tastes like, I breath in some when I went to put balcony flowers inside

but no hail, so it worked

Rory Alsop

cool - I want one

TildalWave

they make a pretty loud bang when that thing disperses

kinda like AA guns

Rory Alsop

@TildalWave For some reason I was expecting more firework type noises

TildalWave

@RoryAlsop well yes ... but no sparkling after

they probably shot these ones poliesterpriboj.com/protivgradne_rakete..en since they're made in Serbia and we used to be in the same country once (and I imagine they'd still have some on stock)

actually you know how it sounded like to me, like 155 mm Long Toms firing en.wikipedia.org/wiki/155_mm_Long_Tom

Ohnana

@TildalWave that sounds like it has environmental impact...

TildalWave

11:45

@Ohnana Argumentative ... there's been some dispute over it but if you ask me benefits outweigh consequences. We didn't have hail and it sure looked like when we had golf ball sized one and that did a lot of damage then

And I read some papers on the topic a few years back and it's not at all clear that it's damaging anything, it read more like tinfoilhattery to me. It's not aluminum dust or anything like it. Studies on how plants react to it were mostly concluding there's no serious side-effects and it isn't stable for long either.

Ohnana

oh, that's good to hear

TildalWave

> With an NFPA 704 health hazard rating of 2, silver iodide can cause temporary incapacitation or possible residual injury to humans and mammals with intense or continued but not chronic exposure. However, there have been several detailed ecological studies that showed negligible environmental and health impacts.

> The toxicity of silver and silver compounds (from silver iodide) was shown to be of low order in some studies. These findings likely result from the minute amounts of silver generated by cloud seeding, which are about 1% of industry emissions into the atmosphere in many parts of the world, or individual exposure from tooth fillings.

Cloud seeding

Cloud seeding, a form of weather modification, is the attempt to change the amount or type of precipitation that falls from clouds, by dispersing substances into the air that serve as cloud condensation or ice nuclei, which alter the microphysical processes within the cloud. The usual intent is to increase precipitation (rain or snow), but hail and fog suppression are also widely practiced in airports. Cloud seeding also occurs due to ice nucleators in nature, most of which are bacterial in origin. == Methodology == The most common chemicals used for cloud seeding include silver iodide, potassium...

TildalWave

12:08

... but I'll tell you if I suddenly start voting for some other camp or something like that :)

AviD

@TildalWave is that a euphemism for "batting for the other team"?

rowing up the other stream?

hmm, I dont know any other euphemisms that are not offensive.

"voting for another party" can work.

TildalWave

@AviD or maybe it's just silver iodide in me talking :))

AviD

@TildalWave ooo kinky

TildalWave

OK then I'll tell you if I start seeing double rainbows. Better?

AviD

haha oh snap, thats a good one.

Simon

12:27

pls

Rоry McCune

@Simon I'll take "what type of panel is @Simon going to get in his next monitor for $100 Alex"

Simon

wat

Rоry McCune

12:43

@Simon it's a parody based on the US gameshow jeopardy where the show supplies the answer and the contestant supplies the question

so if the answer is "pls" that was a valid question that could elicit that answer :)

Simon

That flew right over my head by 2348723482387423 feet.

Rоry McCune

Celebrity Jeopardy - SNL 40th Anniversary Special

►

to confuse things even more here's an SNL parody of it (NSFW words)

Simon

"The uploader has not made this video available in your country."

Silly UK.

Ohnuhnuh ô_ô

Ohnana

wat

also wpa2 enterprise networks with CAs not required can burn in hell

Rоry McCune

@Simon how weird is that, it's a US show...

Simon

12:53

And you're not on a VPN?

Canaduh can't see the video but the UK can?

wat

AviD

@RоryMcCune yeah SNL only allow from US and UK

Simon

tsk

Rоry McCune

@AviD ahh who knew

well you obviously

AviD

repeatedly :-(

TildalWave

13:06

@RоryMcCune hahaha that I wrote in the snow in your mother's handwriting joke is hilarious :)))

Rоry McCune

@TildalWave yeah it's not a bad sketch, I do find some of their stuff a bit hit or miss, but that one was good

TildalWave

@Simon it doesn't have French subtitles, that must be it

raz

13:19

Max rep today! w00t!

Ohnana

@raz not good enough. call me when you get it two days in a row

raz

@Ohnana Well I did that almost 8 months ago

But I don't get max rep very often.

Ohnana

@raz i think that's happened to me once

Rоry McCune

ya know I used to think that 200 was the max rep you could get in a day, then I looked at the bears rep. chart...

Terry Chia

@RоryMcCune Honestly +215 is pretty common. :P

1 rep train answer + accept.

Rоry McCune

13:27

@TerryChia yeah I'm guessing 430 isn't...

Terry Chia

@RоryMcCune That's gotta be rare even for the bear?

Rоry McCune

@TerryChia it looks like his top score..

Terry Chia

I'm guessing a bounty is involved.

Wait, bear hasn't got a 500 rep bounty?

Ohnana

@TerryChia bounties don't count towards the cap i thought

Journeyman Geek

kinda

430 would be tricky tho.

AviD

13:40

@JourneymanGeek not if that includes bounties

Journeyman Geek

Yeah. but multiple bounties or 200 regular rep, 2 accept and then a bounty

Simon

@TildalWave Sigh. I love it when they can't sell a product here because the text on the box isn't in French.

raz

@Simon I love having the new profile, OH WAIT... I don't

Simon

@raz "Aaawww yeaaaahh new profiles!" said no one ever in InfoSec.SE

3

Ohnana

@Simon are you fucking serious?

is that why all my shampoo bottles are in french

TildalWave

13:46

@Ohnana no, that's because you're a snob

Ohnana

@TildalWave head and shoulders isn't fancy bro

Rоry McCune

@Ohnana nah that's 'cause @Simon has been sneaking into your local supermarket at night and replacing them to mess with you

raz

I only buy English shampoo

TildalWave

@Ohnana I rest my case :)

Simon

@Ohnana Yeeeeep. At least here in Québec they cannot sell a product that isn't also written in English on the product.

Ohnana

13:47

@TildalWave wait, what?

Simon

Dunno about the rest of Canaduh, I assume that they don't give a crap.

AviD

Shave your head. then you can just use any liquid soap.

Bald for the win.

TildalWave

@raz you like the "Simple" labeling like "Shampoo for him"? :))

Simon

@AviD Said no one ever, ever.

AviD

@Simon you mean, everyone always.

Bald is the new hair.

TildalWave

13:49

"Simple" is a brand name in UK BTW

Rоry McCune

@Simon that's why they use shampoo instead of the real stuff

Ohnana

@AviD fun fact: the first night i was in my new apartment i didn't have shampoo, so i used hand soap to wash my hair and shower

it went okay

TildalWave

@AviD that's a bald statement! :)

erm, bold

@Ohnana You're saying that H&S bottles are in French in ... US? Actually, I dunno where you're from. Maybe you're from France

Ohnana

@TildalWave they're in french and english.

TildalWave

Really? Why?

Ohnana

13:59

i think the company does business in canada too and it's cheaper to print all the labels the same

old spice does the same thing.

TildalWave

yea but ...

from en.wikipedia.org/wiki/Languages_of_the_United_States

AviD

what the hell is tagalog?

is that like a kids made up language?

Rоry McCune

@AviD omniglot.com/writing/tagalog.htm

"Tagalog is an Austronesian language with about 57 million speakers in the Philippines, particularly in Manila, central and southern parts of Luzon, and also on the islands of Lubang, Marinduque, and the northern and eastern parts of Mindoro. Tagalog speakers can also be found in many other countries, including Canada, Guam, Midway Islands, Saudi Arabia, the UAE, UK and USA. "

Ohnana

@AviD it's filipino you uncultured silly pants

4

AviD

@Ohnana thats spanish

Ohnana

14:03

@AviD the official language is tagalog and english

i know this stuff and i'm like 20. try harder

AviD

you're an official language

CodesInChaos

@Ohnana The official language of the Culture is Marain.

Ohnana

@CodesInChaos you confused me for about 30 seconds. nice one

AviD

I thought the official language is PHP.

CodesInChaos

14:18

@AviD Barbarian

AviD

well, not so much language per se, but more an eclectic bunch of incompatible dialects.

Rоry McCune

in things I learned today which are.. interesting.. people are actually building banks using Go and Docker?!?

AviD

well, sure, that sounds about right for bank-level security.

Ohnana

@RоryMcCune wat

go just sounds like a kid's programming language, i'm sorry. i can't take it seriously.

Rоry McCune

@AviD that's like Integer overflowed sarcasm right?

AviD

14:21

@RоryMcCune bank level security, as we know, is considerably far from ultra-security.

Rоry McCune

@Ohnana speakerdeck.com/mattheath/…

AviD

@Ohnana I used to play a game called Go.

Not the ultra complex checkers game, it was more like a monopoly version of Risk...

ooh, its yoga time!

Rоry McCune

@AviD well so's everyone :op wasn't just security though, for me go is too young to really have all the warts and problems discovered

CodesInChaos

14:39

I still don't get how you can get people to use a statically typed language without any kind of generics.

(except two hardcoded ones)

@AviD ??? I only know go/baduk/weiqi

Thomas Pornin

15:14

@CodesInChaos To a large extent, Java succeeded at that.

Simon

You're a large extent.

EEEEYYYYYOOOOOO

CodesInChaos

@ThomasPornin Even java and delphi finally saw the light.

Thomas Pornin

@CodesInChaos Arguably, pre-1.5 Java, while not having generics, already had kind-of-generic arrays

I.e. you could implicitly cast a B[] into a A[] if class B extends A

CodesInChaos

@ThomasPornin That's about go level, which has kind-of-generic dictionaries and channels.

Lack of generics support was the main reason why I switched to C# from Delphi.

Thomas Pornin

Of course, the mere existence of PHP demonstrates that language quality and language acceptance are two very distinct things.

2

Simon

15:16

You're just bashing PHP because I was mean to you.

My relation with @ThomasPornin is 90% of me talking to him and 10% of him replying.

CodesInChaos

@Simon PHP's quality is self-evident.

raz

I can't seem to add a new search engine to chrome :(

CodesInChaos

@raz One google to rule them all.

Thomas Pornin

@raz If you use Chrome then you belong to Google. What else is there to say ?

raz

@ThomasPornin But i want to put a search engine in for Beer :(

Setting it as default works fine, but my keyword doesn't work.

untap works, but tap does not. Both are unique

Thomas Pornin

15:31

@raz I don't understand what you are talking about. Are you sure you need more beer ?

raz

@ThomasPornin Is there ever really enough beer?

Thomas Pornin

@raz Yes, a few moments before coma.

Iszi

17:58

Should this not be a subset of our site?

222

HackOverflow

Proposed Q&A site for white hat hackers interested in offensive hacking techniques in a legitimate scenarios, analysis of malicious code (rootkits/exploits/viruses), zombies/botnets/clones, kernel/code hacking, hack challenges. Note: Asset protection is off-topic!

Currently in definition.

schroeder

YES

Gilles

@Iszi yes

Ohnana

@Iszi 503. I'll give my super important opinion when it come back up

Gilles

@Ohnana #worksforme

Ohnana

do we get many hacking questions?

Gilles

18:05

@Ohnana yes. Not so many good ones.

CodesInChaos

@Gilles Don't be such an elitist.

David Freitag

I just realized I'm reading a question about famine while I'm eating my lunch

Ohnana

first world countries \o/

Gilles

@DavidFreitag next you'll be reading a question about insomnia in your sleep

David Freitag

@Gilles If only I could actually sleep...

Gilles

18:13

TIL that “Taylor Swift” is not just the pseudonym of a security researcher

David Freitag

Oh come on. I live at the bottom of the sea and even I knew that. You must live on mars or something...

Gilles

@DavidFreitag water does carry sound better than void

0

Q: Is there a lightweight library that can perform RSA-2048 encryption for an embedded application?

I'm looking for a C/C++ implementation of RSA with a 2048 bit key (preferably read from a file). My target is an embedded platform, so it comes with some odd restrictions. The hardware restricts us from using the new operator, and we have to use a special version of malloc supplied by the hardwar...

^^^^ candidate for bearssl

raz

@Iszi I would say yes, except we have that whole "Off-Topic" reason for close that involves "breaking software/security". Which I"m sure people will use to close legitimate questions about hacking.

Jeff Ferland

Isn't that a candidate for some perl code written on the back of a t-shirt? :)

raz

@Iszi I'd say some of the questions that get asked on InfoSec will get migrated to Hack Overflow if it ever goes Beta.

David Freitag

18:26

@Gilles Then why didn't you ping the bear?

Jeff Ferland

@raz We use that for "how do I hax0r my bank?" which is different from, "How do I exploit a buffer overflow in this specific code?"

Gilles

@DavidFreitag why would I?

Jeff Ferland

@raz Only if a moderator decides to migrate it. ;)

David Freitag

@Gilles It's a candidate for software he is developing...

raz

@JeffFerland Oh I agree with you, but I've seen many closed votes for that type of question with that Reason. I try and vote for keeping them open. But I'm not always successful.

Rоry McCune

18:57

hey @Simon this is funny imgur.com/gallery/1dJzw

Gilles

@raz I don't think so. What would be on-topic on HO but off-topic here?

Rоry McCune

3

Gilles

19:50

schroeder

@RоryMcCune in the 80's the West Edmonton Mall had more submarines than the Canadian military....

David Freitag

@Gilles That's your fault for not having your phone within an arm's reach. I can never understand how people leave things like their keys or cell phone in random places.

AviD

@CodesInChaos hmm, I think it was this one:

Travel Go

Go — The International Travel Game, later Travel Go, is a family board game, based on international travel, which was manufactured by Waddingtons Ltd from 1961 onwards. The objective of the game is to travel the world by air, sea, rail and road, collect a pre-determined number of souvenirs from each city visited, and to return to the starting point (London). The board is in two parts, and each player has a counter on each part. The outer edge is where the player moves when in a city, and is where money can be changed and tickets purchased. The inner part is a world map marked with travel routes...

yeah! this looks familiar: boardgamegeek.com/boardgame/7097/go-international-travel-game

though reading the description, I dont understand why it was such fun.

> Travelers run all the risks of international travel; having unexpected luck en route or encounter complications with customs and local regulations.
Players must also change currency frequently throughout the game.

CodesInChaos

@AviD heresy

AviD

20:09

@CodesInChaos yah, I know.... Actually was surprised the first time I heard people talking about Go as a great strategy game. that day IL.

CodesInChaos

@AviD starcraft and go are probably the games I played most

raz

20:25

@Gilles I think HackExchange will be a mix of SO and InfoSec with implementation level questions that wouldn't necessarily fit here.

@RoryAlsop This ChatSEy app is kinda sweet!

Gilles

@raz I think HackExchange will be crap that Sec.SE doesn't want and SO doesn't care about and will fold in beta, if it makes it that far

the worst thing would be if HE succeeded and fragmented Sec.SE, but I don't see that as a likely outcome

AviD

@raz like what? implementation level questions could be on topic here, if it is specifically security.

@Gilles true, but probably wont. SE will nuke it before it comes up for beta.

David Freitag

20:58

Woo, I've edited my first answer on SE and it was accepted.

Gilles

1

Q: How can I solve "Your connection to 192.*.*.* is encrypted with obsolete cryptography"

I just set up my apache server with SSL installed on it, and everything is perfect except that when I open the page with https:// I get the following message when I click the padlock next to the address bar in chrome: "Your connection to 192... is encrypted with obsolete cryptography*" I have an...

apache httpd cryptography

David Freitag

22:50

"use a virtual machine" -- and if you're really paranoid, bear in mind that by exploiting multiple flaws, malware can potentially climb up out of your VM and strangle you (venom.crowdstrike.com) — Steve Jessop 10 hours ago

AviD

23:17

and if you're really paranoid, bears will eat you.

Simon

23:40

@RоryMcCune Aw, I still don't understand everything in there! Like why could you browse the same pictures on mobile for 3 days?

schroeder

23:59

having no other place to talk about this: I found evidence of an NSA operation against one of our employees ....

how curious

took a couple days to figure out what was going on, but it seems pretty clear

an employee with an arabic-sounding name had their Skype traffic redirected

Transcript for