The DMZ

schroeder

00:00

to an unusual IP

this IP has no history of processing Skype traffic, but is known as a TOR node

this TOR node has a history of "collusion" on the TOR network .....

adding this IP to my blocked node list ....

schroeder

00:17

yay! new nmap version: seclists.org/nmap-dev/2015/q2/289

Rоry McCune

07:34

@Simon their mobile app. is quite nice, but yeah it does seem hard to work out the organisation of the site sometimes.

Rory Alsop

08:33

@schroeder weird

Rоry McCune

08:50

@schroeder that says some interesting things about the level of access they must have to whatevers needed to create an authentic looking skype node

thinking that there must be some crypto/authentication involved in the setup procedure

so either the client is backdoored to add the fake server ID or the server is capable of pretending to be valid or it's setting up some kind of MITM

Rоry McCune

09:07

20 years since Dilberts holy computer wars!

Journeyman Geek

0_0

Get off my lawn...

Rоry McCune

yeah I had just started working in IT back then...

didn't realise at that point exactly how accurate a reflection of business life Dilbert was...

Rory Alsop

09:27

@RоryMcCune Dilbert is the business 'how to' guide :-)

Rоry McCune

@RoryAlsop yeah it's full of little business parables like a modern day bible :)

raz

11:18

@AviD Most coding questions get punted to SO. DLL Injection, rop gadget imlementation (my rop gadget isn't working, not sure why), problems exploiting a specific vulnerability. While sometimes these questions are left alone, 90% of the time I see them punted to SO or closed as off-topic.

So I would say HackOverflow would get most of these types of questions. I think it'd probably be perpetually Beta, but since InfoSec closes these types of questions as Off Topic I see a use for the site.

Rory Alsop

@raz The ones that get migrated to SO are on topic at SO - so I'm not sure why Hackoverflow would be needed at all...

raz

@RoryAlsop I'm sure they're on topic. But I'm saying they should also be on-topic for InfoSec.

I'll start bringing questions I see up as examples.

Rоry McCune

@RoryAlsop 'cuz people want to 4wn3r15e s0m n00bs

2

raz

11:38

Oh look, New Navigation Alpha 2 was released... but we still don't have the damn new profile @StackExchange

Rory Alsop

12:00

@raz Okay - I have to ask. I know most of it is because I don't really see profiles much (at work they don't render at all), but what is it about these profiles?

what's wrong with the old one, and what will the new one bring?

Rоry McCune

12:27

@RoryAlsop shininess! and how many people we've "reached"

raz

@RoryAlsop I just want it because I don't have it. And I see other sites have it. And I don't understand why we don't have it.

Rory Alsop

@raz hahahaha - best reason ever

TildalWave

@raz And I wish I could use the old layout, especially on SEx.SE. Profile pages are now rather inconvenient for mods, two "tabs" to navigate through where you could previously see all you needed on one. And some links are missing, like "privileges" or "real name" (for mods)

Rory Alsop

@RоryMcCune ahhh - cheevo visibility

Rоry McCune

@RoryAlsop yeah it more prominently shows badges achieved + working on which also helps gamification :)

Rory Alsop

12:40

@RоryMcCune yeah - I tend to not really see them, ever, unless I go searching for them. To be honest, I don't really care about them. I want better mod tools (for spotting socks, voting rings, etc)

Lucas Kauffman

evening infidels

Rоry McCune

@LucasKauffman you singaporing?

Lucas Kauffman

@RоryMcCune yesh, 9 more days left

Rоry McCune

@LucasKauffman holiday or workin'?

Lucas Kauffman

holidays and a bit of networking

just got back from Hong Kong yesterday

it's just like in the movies :o

Rоry McCune

12:47

sounds like fun :)

Lucas Kauffman

it's good, hiked an average of 15 km a day

what's the dmz been up to? I haven't been online lately :(

Rоry McCune

@LucasKauffman is it not a touch hot for that kind of thing?

Lucas Kauffman

@RоryMcCune the metro system is well airconditioned :P

I did victoria peak, saw bruce lee's statue, ate dim sum, visited the 3D museum, watched the light show, saw panda bears at Ocean park

Rоry McCune

@LucasKauffman ahh I thought you meant hiked in the physical with a backpack sense...

Lucas Kauffman

@RоryMcCune nooo, I'm built for comfort, not for speed

Rоry McCune

12:53

@LucasKauffman has been relatively quiet. @AviD is gradually morphing into @Simon , she who must not be pinged seems to have wandered off, @ThomasPornin is creating BearSSL to show people how it's done, @RoryAlsop is even older than he was (I know how does that work) @Ohnana was horrified by smoking in Europe.. hmm that's some of it ..

oh and some smegger unpinned all my cool stuff from the pin wall :op

Lucas Kauffman

@RоryMcCune smoking in Europe?

@RоryMcCune RoryA starts back at 1 I guess

Journeyman Geek

@LucasKauffman: naw, older.

Rory Alsop

@LucasKauffman I never unpin things (I can't see them at work, or on my mobile)

Lucas Kauffman

@JourneymanGeek I learned many words

Rоry McCune

@LucasKauffman yeah those indoor cabinet things they have for people to smoke in..

@RoryAlsop it will have been the tigger

Lucas Kauffman

12:55

@RoryAlsop I meant your age, you start back at one :P

Stack Exchange

Neither a spokesperson for the organization nor the current world champion could be reached for comment.

Lucas Kauffman

@JourneymanGeek LAU SAI, AH BENG, KO NE NA BE CIOA CIBAI

I also learned what an Ah lian is

Journeyman Geek

hm

Your accent is attrocious

lol

Lucas Kauffman

@JourneymanGeek I know right

CodesInChaos

@TildalWave Even as a non-mod I find the two nested layers of tabs inconvenient.

Rory Alsop

12:57

@LucasKauffman it's actually at NEG(MaxInt-1)

Lucas Kauffman

@JourneymanGeek this is the way the angmoh speaks

Journeyman Geek

For a moment I thought you mixed up your cantonese and hokkien ;p

Oh, I used to do that on purpose in the army ;)

Lucas Kauffman

@JourneymanGeek I got ripped off one time tho :(

Journeyman Geek

where?

Lucas Kauffman

@JourneymanGeek telok blangah, bought sugarcane, the uncle charged me 5 bucks a pop

Journeyman Geek

12:59

ahh

alas

I need to go to SLS one of these days :/

(that wreched hive of scum, villany and sweet hardware for those willing to comparison shop)

Lucas Kauffman

@JourneymanGeek what's SLS?

like national service training?

Journeyman Geek

Sim Lim Square ;p

Used to be the hub of bootleg disks, and its infamous for ripping off forigners now ;p

Lucas Kauffman

@JourneymanGeek ah yea, the higher you go...

Journeyman Geek

The better it is

and the back alleys are often interesting.

Lucas Kauffman

@JourneymanGeek I know, they can't catch me tho

@JourneymanGeek hardware is mah thing

Journeyman Geek

13:02

I need to do some rolling upgrades

Lucas Kauffman

@JourneymanGeek to what?

Journeyman Geek

New SSD for my desktop (a 850 pro 256gb), my old SSD goes to my laptop, that HDD goes to my dad

need to price out a new GPU in 3-4 months, since I'm planning on a new 4K monitor

Lucas Kauffman

@JourneymanGeek if it doesn't need to be for heavy heavy gaming, check the nvidia GTX 960

Journeyman Geek

@LucasKauffman: got a 660. I'm pondering a 970 or 980ti

Lucas Kauffman

if needed you can later just pop in a second one

@JourneymanGeek 980ti is also sweet

Journeyman Geek

13:04

Yup, but pricy

Lucas Kauffman

@JourneymanGeek do they support SLI?

Journeyman Geek

and for stuff like that, I could save up to 10% comparson shopping

everything upwards from the 60s do

My 660 does

(hell, it barely supports 4K too)

raz

@TildalWave Yeah, I'm not a mod... I'd love the power though >:)

Rory Alsop

@raz with great power comes... a larger number of expletives deleted comments from otherwise normal individuals

TildalWave

@raz what "power"?

it's just more work, and if you dare use any "power" it's even more work

Rory Alsop

13:16

yup ^^ this is true

raz

@TildalWave So it's like working for the gov't.

Rоry McCune

@raz well apart from the NSA, then it's just reading other people's mail all da?>!"£!£"$"!£$>? Sorry I meant to say protecting others freedoms ... :op

raz

@RоryMcCune ahahaha, I wish I could snoop like that. The ultimate soap opera.

Rоry McCune

@raz you've got to bet that pre-snowden (and probably still now) people in places like NSA/GCHQ etc were doing some snooping on the side, human nature being what it is and the lack of auditing on access to their data being what it obviously is...

TildalWave

@raz actually no, working for gov't is writing excuses not to do anything, being a mod is exactly the opposite

Iszi

13:23

@TildalWave Writing excuses for everything you do?

TildalWave

@Iszi aye

I even had complaints like "you as a mod shouldn't write an answer to a too broad question"

14

Q: Why can't we launch from space?

So this may be a stupid question but I was wondering why we couldn't launch from space. I know that most of the fuel that we spend is for escaping Earth gravity. Yet, if we have already done this with the International Space Station, couldn't we bring parts up there. Then we could assemble a low ...

which then wasn't closed anyway, but it did cause a discussion on meta

3

Q: Too broad questions?

I'm studying space exploration MSc at the TUDelft (netherlands), so this site naturally attracts me. However I see alot of questions on this site I would deem as "way too broad to answer". Sure many of those questions I could answer and give some insight, but I'll end up writing books before I e...

discussion

raz

@TildalWave Discussing Meta discussions is so meta

I feel like this was answered in a Poodle question, but I can't find it.

0

Q: Check HMAC after completing decryption or before?

I have written a piece of software that symmetrically encrypts big files (multi-megabyte). Plaintext is encrypted, after the encryption the HMAC is calculated and written into the header of the file. During encryption, I update HMAC continuously, using as input chunks of encrypted data (encrypt t...

encryption authentication hmac decryption

Lucas Kauffman

@JourneymanGeek youtube.com/watch?v=lOUky1SPHFE

Journeyman Geek

lol

Iszi

@TildalWave I guess it kind-of depends. I'm assuming you didn't just answer-then-hammer.

TildalWave

13:35

@Iszi It remained open, so no hammer fell. And I don't like nuking too broad questions anyway, I'd always wait if someone wants to answer it then perhaps support community vote, if at all. On Space, too broad is often perfectly answerable (in equally broad sense).

example:

3

Q: Difference in atmospheric entry for Earth and Mars

Mars has only 0.6% the (surface) atmospheric pressure of Earth. Does this have a significant impact on the difficulty (heat shield parameters) of atmospheric entry? Is it basically the same as for Earth because most of the kinetic energy must be dissipated in the uppermost low pressure regions of...

mars reentry heat-shield atmospheric-entry

Iszi

14:14

@TildalWave Oh, so it wasn't "You shouldn't be answering a question that got closed as too broad" - it was "You shouldn't be answering a question that I think is too broad".

Rоry McCune

14:26

0

Q: Top banks using TLS 1.0

Am i vulnerable if my bank uses tls 1.0? Is it easy for somebody to do a MITM attack? Should I just access their online banking at home where I asssume it is safer to do so.

tls

^wat

how does being at home make a TLS connection more secure....

TildalWave

@Iszi aye

Iszi

@RоryMcCune It's certainly lower-risk than doing it over public WiFi.

Rоry McCune

@Iszi sure if he'd mentioned wifi, it would have least have made some sense, although I'm still not sure why TLS/1.0 gets picked out...

Iszi

@RоryMcCune Probably 'cause his bank's been smart enough to drop SSL, but too lazy to pick up TLS 1.1/1.2.

Stephane

14:45

Hiya

Rоry McCune

Watcha'

Stephane

Funny... I was going to ask about this question too...

I was wondering if it was on topic, really... And if it wasn't where to send the guy

Rоry McCune

yeah I'm not really sure it's answerable, you could say "TLS 1.0 is relatively ok " (all other things being equal) but then I don't really understand why he thinks TLS would be more or less ok from home...

TildalWave

@RоryMcCune he doesn't get run over by a car crossing the street?

Rоry McCune

@TildalWave ok, I'll revise that to say I couldn't think of an answer that wouldn't sound flippant :op

TildalWave

14:57

I think he just dumped a few unconnected thoughts and we're making too much of it trying to find connections

raz

15:43

@TildalWave Kind of like @Simon

raz

18:25

Did security die?

David Freitag

To anyone who was interested by the C.H.I.P. $9 computer but was put off by the international shipping prices, I may be getting a second one for free if you want it.

Ass seen here: kickstarter.com/projects/1598272670/…

raz

Ass? Is it hot?

David Freitag

Hahaha, nice typo.

@raz Well it's $9, I would have to say you get what you paid for.

raz

That's not bad though

1GHz, 4GB of memory

David Freitag

If you're interested I'll ship the second one to you

raz

18:30

I mean, throw a minimal linux distro on there and you've got a portable computer that fits yo pocket

David Freitag

I don't really need two, I have four raspi's and a slough of other boards laying about

raz

And compromise my true identity... I don't know.

David Freitag

@raz PO Box

I figured I'd offer. I recall there being at least a few people put off by the really high international pricing. I think @Lucas was one

@Arperum was another I think

raz

How much is international shipping?

Arperum

@DavidFreitag I'm a what?

David Freitag

18:33

@Arperum You were interested in the $9 linux board?

Arperum

@DavidFreitag Probably not. I'm not much of a hardware person.

David Freitag

@Arperum That's what most people said about raspi. You would be surprised what you can do with just software.

Arperum

@DavidFreitag I don't own a raspi.

David Freitag

I know, I was just using that as an example. It's pretty much exactly the same.

@DavidFreitag TBH that's not really that bad. It's about as much as you will pay for a padded envelope anyway.

raz

@DavidFreitag How dare you assume he owns a raspi!

David Freitag

18:48

@raz Did you hear? JC IS BACK!

businessinsider.com/…

raz

That's awesome!

David Freitag

Indeed!

raz

@DavidFreitag Wow a Netflix Top Gear

No censors!

David Freitag

I couldn't possibly be more excited.

Gilles

21:10

TildalWave

@DavidFreitag Why would networks think that it's the three stooges that made Top Gear when it was in fact how much money BBC threw into its production?

David Freitag

@TildalWave It's moving to Netflix which arguably has a larger budget. Either way, I don't care what JC is driving as long as it's JC driving it.

@TildalWave And that's totally not true. The first few seasons were just as good (if not better) as the later seasons and their budget was tiny then

I think it has more to do with the fact that JC has such a large influence and is so very well known in the industry. Since Top Gear had a massive following manufacturers listened to what they said and even let them use the cars as really great free advertising.

TildalWave

@DavidFreitag Tiny? That I doubt. They literally went everywhere even before. And if those go that means the whole filming crew goes too.

David Freitag

@TildalWave Have you actually seen the first few seasons? Apart from the track they had no footage from outside the studio.

Sure, by season 4 they had a quite large following, and even the studio was full when they were filming. In season 1 you could actually count the number of people in the room.

TildalWave

@DavidFreitag dunno which ones are the first ones to be honest ... but I watched some pretty old ones ... I remember they went to Nürburgring, they raced to Sweden two on the road through then still fairly new Channel tunnel and one with a ferry and a speedboat,...

David Freitag

21:22

But, regardless, it was neither the power/money of the BBC or the presenters. It was the combination of the two. Top Gear USA has a similar budget and similar hosts, but it isn't nearly as good as Top Gear UK.

TildalWave

they went to Jerusalem ... twice I think

...

David Freitag

Those are all past season 5

TildalWave

might be

David Freitag

Was the Nürburgring episode the one where JC took the diesel Jag around in 09:59?

If so, that was season 5. The Sweden special was later (season 6 I think) and the rest sound later. The Jerusalem episodes are very late, season 10+ at least.

TildalWave

dude I dunno, I never really sat down and watched that in peace, it was always just some background distraction

David Freitag

21:26

I dunno, I find the three of them to be particularly great. If they tried to do the show without all three it almost certainly wouldn't be as good.

TildalWave

I always thought there's room for improvement .... 8 out of 10 cats does Top Gear ... now that I'd take my time to watch :)

or Come Top Gear With Me :D

David Freitag

@TildalWave Sure, nothing's perfect.

Adi

22:00

@Codes @Thomas Suppose we have two users who want to send each other 2 messages per hour (A->B, then B->A, one message each 30 minutes.. not really important). They absolutely cannot use public-key crypto, so they decide on using a shared secret, an AES-128 key.

Somebody tells them that they should use two separate AES-128 keys which they both share and store. One key for encrypting messages from A->B, and the other for messages from B->A

This somebody says "This is more secure"

I think it's bullshit and there's no security improvement. Am I wrong?

schroeder

22:21

well, you reduce the key use in half, which would be "more secure"

but I wouldn't advocate for this use case

Terry Chia

23:35

Dayum, Facebook just gained an excellent CSO.

Transcript for