« first day (1672 days earlier)      last day (3213 days later) » 

raz
1:08 PM
@RоryMcCune Even more evidence that it's freaking hard to implement secure protocols correctly.
 
@raz indeed
 
"too long by 296 characters"
Almost there...
 
@RоryMcCune Dayum son, what a troll.
@JourneymanGeek wot
 
1:24 PM
Theeere we go.
 
@MartinRoryIngesen I'm sure that no one will notice that you've stolen my "Happy electing" line.
 
@Simon yeah it's pretty epic, elsewhere he pretty much admits he won't land another tech CEO job now..
 
I just borrowed it @Simon
Anyways; "candidate score 1/40." Quite. ಠ_ರೃ
 
@RоryMcCune Why not?
 
@Simon: I can't imagine why everyone would @Simon you @all
 
1:27 PM
@JourneymanGeek I can imagine why: donutness overload.
 
@Simon after being CEO and then talking about a load private stuff publicly, there's a lot of companies that wouldn't trust him to be discrete
 
@RоryMcCune Ah, right, hehe.
 
If @Simon becomes mod do we mock him more or less?
 
@raz Amusingly, I just answered a question on that theme:
5
Q: How to start writing crypto software

Christian VöglThis is just an academic question, I do not intend to write my own crypto software. Every time someone asks the question “How do I write my own Crypto?” the answer is don't. I'm currently studying computer science, and there is no course offered by the university which seems to be helpful. Th...

 
@TerryChia more, because he can't powerabuse :p
 
1:29 PM
@LucasKauffman Niceeeeee!
 
@LucasKauffman Shit, that's actually right.
 
@TerryChia @LucasKauffman @Simon like it ever stopped the tigger :op
 
@LucasKauffman if @Simon wants to modabuse his power, does he have to kick himself out of the DMZ?
@RоryMcCune kicking @Simon isn't considered modabuse, it's considered a responsibility
and an honor
 
@AviD Is that possible? That reminds me of my days on IRC where I would use a bot to kick myself.
 
@Simon "kick"
"irc"
 
1:32 PM
wat
 
heh
 
@Simon s/a bot/my mom/g
 
@MartinRoryIngesen oh snap
you just bought a vote, son
 
Am I doing this right @AviD?
 
you're a quick study
but, can you take it as well as you give it?
 
1:34 PM
Please. Rain down on me.
 
Wait
ANOTHER RORY?
 
No, he's a wannabe Rory.
 
btw @MartinRoryIngesen I was gonna ask you, is your entire nomination just a cruel mockery of @Simon's?
 
It's a mental disease.
 
because if so, it was a damn good job.
 
1:35 PM
@Simon isn't everyone a wannabe rory?
 
@RоryMcCune To some extent, yes.
 
> I've been an active member of Security.SE since the first day I joined


member for 24 days
3
 
@AviD To be honest, I tried to be way more funny, but the char-limit made me have to cut out all my jokes.
Yeah?
 
@MartinRoryIngesen YOU THINK TO BE A MODERATOR IS FUNNY SON?
 
member for 24 days
visited 21 days, 11 consecutive
 
1:35 PM
@MartinRoryIngesen no no, it was subtle, thats the best kind of mockery.
 
YOU THINK ALL THIS IS A JOKE?
 
not sure he even noticed
 
@MartinRoryIngesen You didn't even manage to get 24 consecutive days? Tsk, lightweight.
 
reverse psychology from @polynomial or is he just havin' a laugh
 
1:36 PM
> My rep is among the top 11 (pages)
^ nice
 
It's true!
@RоryMcCune Polynomial has my vote!
 
you'll fit in just fiiiine here :-)
 
@AviD Remember when you said that to me?
 
@Simon good point, I have been wrong before.
 
I thought you would have had learned by now.
Tehehe.
 
1:38 PM
see @MartinRoryIngesen? if you do the abuse just right, not only does he expect it, he does it to himself.
kinda extreme stockholm.
 
@AviD Wonderful! I like Stockholm this time of the year.
 
@RoryAlsop! New name for a band. Extreme Stockholm Syndrome.
 
Now to start with the tracklist @AviD!
- Me and my mom (feat. @Simon)
- Why so Rory?
 
I wouldn't associate myself with someone who thinks that "Me and ..." is proper grammar.
 
1:40 PM
its me and your mom
 
Oh man, poly is a /r/netsec mod :)
 
@Simon it could be, depending on context.
 
@AviD Let's assume the right context.
 
"I will fluff you up real hard!"
"Me... AND my mom!"
 
Burger quizz!
 
1:45 PM
@M'vy bzzzzt! The answer is (b) - delicious AND good for you.
 
@AviD: there's this local vegan burger chain...
they make the best buns I have eaten (and my mom's an epic cook), and seaweed seasoned fries ...
 
@AviD is there an actual equivalent of this outside France ?
 
@JourneymanGeek bzzzt! (c) - Not a real burger.
 
@M'vy burgers?
wut?
 
1:46 PM
Well, actuall, 'Burger Quizz' was a TV-show game
satirical, humouristic kind
 
@AviD In before you notice, sorry for stalking your LinkedIn.
 
@M'vy ohhh thought you were gonna start quizzing us on burgers.
 
@AviD not really
 
so, no, nothing like that outside of Franche.
 
the game had many variant, multiple-choice question etc... and 2 answers questions as well
like : me or my mom :)
and you have to answer as fast a possible to a maximum of questions
 
1:49 PM
@MartinRoryIngesen heh, not a problem, happens all the time. That's what its there for.
 
@AviD To be seen by weirdos?
 
possible traps: sometimes it's both, sometimes it's none
hence why I thought about it when you said "Me... AND my mom!"
 
Smokey AND the bandit!
 
@AviD yes and he problably will
 
Hum... there should really be a security review team for pypi repo...
 
1:53 PM
@M'vy there's none, it's full of shit, including @TerryChia's meterpreter
 
@M'vy Not possible.
 
@LucasKauffman yeah I know there's none. But there should be :)
 
It's an unmoderated repository.
 
@TerryChia your mother is an unmoderated repository.
3
 
yeah, well it's not a problem. One could review a particular version of a package
sign it and all.
 
1:55 PM
But if you see something really bad feel free to ping dstufft on #pypa in freenode.
 
@M'vy can't do that, then there are no updates, and will suck as bad as CC
Common Criteria
 
@M'vy Who reviews the package? Who signs it?
 
My idea is: having some kind of authority
 
Why should I trust that authority at all?
 
@M'vy I know where this is going
 
1:56 PM
instead you would want to have a reviewed branch, and merge commits slowly as they are reviewed.
 
@TerryChia that's true, but isn't it better than blind faith? (at least a bit)
 
That'd slow things up quite a lot.
 
@MartinRoryIngesen ahah. Yeah, it's been discussed a bit here I guess.
 
And assuming you can find someone people trust and is knowledgeable enough to properly review code, who's gonna pay that person to spend his valuable time reviewing random packages?
See why this is a difficult problem?
 
Never said it was an easy one :)
 
1:58 PM
The answer has always been to review your own damn dependencies.
 
@TerryChia ... which nobody does.
 
@AviD Exactly.
That's why we have jobs no?
 
Dependencies are overrated.
 
I was just getting a django-allauth and telling myself I don't know what's behind that code
 
Just reinvent the wheel.
 
1:59 PM
@TerryChia as @RоryMcCune has pointed out, this would be an interesting model for a startup - sell this reviewed repo as a service. I think there are some in this space.
 
@AviD Isn't that basically a "linux distribution"?
I think people complain that packages in there aren't updated often enough or some shit like that.
 
@AviD I was thinking non-profit org... but not sure it's viable
 
@TerryChia yeah, except it would be reviewed.
@TerryChia usually true, but doesnt have to be.
 
@TerryChia you got a point
 
@AviD Case in point: RHEL and how out of date all their packages are.
 
2:00 PM
@M'vy no no, he has a poin too.
@TerryChia but it doesnt have to be
 
and RedHat makes a shit ton of money doing that stuff.
 
RH just happens to be a particularly sucky company.
 
@AviD Ubuntu? The distribution is broken half the time.
 
@AviD you had me googled that one
 
@M'vy lol, YOU said it.
 
2:02 PM
@TerryChia oddly people use RH cause of that
or centos
 
@TerryChia what? I'm talking about software packages. ala npm, maven, etc
 
@JourneymanGeek Exactly. And it's making life difficult for tons of library developers including myself.
@AviD Half the point of a Linux distro is software packages.
 
errm, I meant libraries - as opposed to OS and associated stuff
ala npm, maven, etc
@RоryMcCune's type of stuff
 
@LucasKauffman : why the question ?
 
@AviD Or the packages Fedora/Ubuntu/Debian reviews and maintains...
 
2:06 PM
@TerryChia you arn't the target audience so to speak ;p
(drives me nuts as a user but that means that we have a stable platform for the next... what 5-6 years or so.)
 
I'm for renaming dependency to liability.
 
@AviD That's 99% the reason why people use RHEL, RedHat reviews software packages, accept them into it's repository and commits to maintaining them.
This goes as far as backporting security fixes to older but still supported versions.
 
@M'vy BECAUSE YOU ALWAYS SURRENDER WHEN THINGS GET HARD
 
@LucasKauffman SO DOES YOUR MOM
 
@AviD IF I WANTED MY COME BACK, I'D WHIPE IT OFF YOUR MOM'S FACE
 
2:08 PM
@JourneymanGeek Have you seen RHEL's version of OpenSSL? It's even more broken than the standard OpenSSL.
 
pls lads
 
@CodesInChaos nice one
@LucasKauffman </JimmyCarr>
 
@LucasKauffman STOP SHOUTING AT YOURSELF
 
Wow, that went south
 
@RоryMcCune yes
 
2:09 PM
@M'vy so did... naaaah too easy
so is... nope.
 
@TerryChia Nope. And I can't talk about the other horrors so...
 
Anyway, nice having a halfway on-topic conversation in this room after a long while. I'm going to go sleep now.
 
gn8
 
See you
 
raz
@M'vy It escalated quickly
 
2:13 PM
@raz indeed. By the way, it's not really relevant to the election I suppose.
 
@TerryChia nn @Terry
 
@TerryChia On-topic conversations put you to sleep?
 
@Xander Xander, what do you think you will do different from the current moderators?
How do you diversify yourself
 
@LucasKauffman I'm not sure thats the word you're looking for
 
by the way, shouldn't the conversation put into the dedicated room ? easier for future reference?
 
2:20 PM
@LucasKauffman Less swearing and fewer "your mom" jokes in the DMZ. And as for actual moderation, I don't think I'll do much differently. I like how sec.SE moderation works now. I'll just be another set of hands, in a different time zone.
 
@LucasKauffman also, there is a separate room for interrogating the suspects questioning the candidates.
 
Well that would mean people had to join it first.
 
Ha, I didn't even know that was there.
 
It's in the election page I think
 
@Xander still wont change the average. yeah, I am sorry about that.
 
2:21 PM
@AviD To each his own.
 
@Xander reeheelly holding back the obvious simons mom joke here... .
 
@AviD Ha ha
 
right, I've been useless so far today. Time for yoga.
 
I received a mail from a headhunter who managed to use the word "cyber" 7 times
 
@Adi: I think your candidature is needed
 
2:31 PM
Can one of you lads protect this question: security.stackexchange.com/questions/93912/… ?
 
huh, for some reason I can't protect it
did they change protect rights?
 
Could it be because it was posted only 23 hours ago?
 
ah possibly
 
@LucasKauffman @Simon Yeah, only mods can protect questions less than a day old.
 
@Xander if you were a mod, would you protect that question?
@Xander some strength you and @terry have which you also can include in your profiles is the fact you are working in different timezones than the current moderators
 
2:47 PM
must be a day for crypto attacks
@LucasKauffman some people from around your way did that one
 
@LucasKauffman Yeah, that was going to be part of my answer to your question in the other room. You're right, I should add it.
@LucasKauffman Yes. It's also a poorly worded question.
 
@M'vy no, that's the point
I think phrasing the question as “are you familiar with the Sec.SE subculture and do you have a sense of humor?” kind of misses the point
 
@Gilles Oh, that point.
 
@M'vy BTW you just failed that test
 
@Gilles Actually, I see the the subculture reference, but was more concerned about the "why" would you ask that this way.
 
2:55 PM
@RоryMcCune Interesting. Not necessarily directly applicable in practice, though, because they need the client to send more than 500 millions HTTP requests (all in the same SSL tunnel, but still) to the real server, so the server has to follow that infernal cadence.
 
@M'vy the sense of humor test is the one you failed
 
Cause for people not familiar, it would be really misleading, or not understandable at all.
 
@ThomasPornin yeah I guess "practical" is a relative term when it comes to crypto-system attacks...
 
@RоryMcCune Here the crypto content is not new, but the demonstration is supposed to hint at the attack being practical.
It has a name and a Web site, but no logo. Ergo, it does not work.
 
3:12 PM
1
Q: How to determine what type of hash algorithm is used

Prajneya KumarMy friend gave me a hashed/ encrypted ciphertext.. And i want to determine which hash algorithm is used.. 3_HA{_[Kg742ea6zy.CT30:b:SX@:T]vf{2A I would be even more obliged if anyone could decipher this for me...

"But it's not a duplicate! Look, my incomprehensible string of characters is different!" "Sorry, I used a fuzzy hashing algorithm to classify it."
 
@JeffFerland A bold move of yours to be bitter during a period of election.
 
@JeffFerland fast :)
 
@Simon You're not my king. I didn't vote for you.
 
@Simon He wants to show to the wannabe mods what they will have to do.
 
@JeffFerland You didn't vote for anyone yet you donut.
 
3:19 PM
@Simon It doesn't matter for him. His term's not up.
 
@Iszi What if he suddenly loses his rights and there are 2 positions available?
YOU DIDN'T THINK ABOUT THAT EX-DAD EH?
 
And who's gonna arrange that? You? Heh.
 
We have two candidates with a score of 1/40. We also have @polynomial going "I HAVE REP! IMMA TROLL!"

It's like the US presidential primaries
4
 
@RоryMcCune yea that guy was actually one of our interns
he spoke twice at brucon
 
@Iszi See, that's why I've left you, you never believed in me.
 
3:25 PM
@JeffFerland Who's Donald Trump?
 
@LucasKauffman well if it's trollin == trump then that's @poly
 
@RоryMcCune SuperUser isn't sending us their best questions...
 
Damn Chat.SE is going all HAL 9000 on me.
 
@JeffFerland heh
 
Damn Chat.SE is going all HAL 9000 on me.
 
raz
3:28 PM
@Iszi It won't allow you to do that Iszi
@Simon ever owned a pair of Shure headphones/earphones?
 
@raz No but I'd be curious to try them out.
 
@raz Apparently.
 
raz
And subway rides. All the reviews seem to point towards great bang for your buck.
 
@raz I have two pairs of those
they're great
 
3:32 PM
@raz Interesting. I'm not sure if I'd be willing to spend that much on earphones though.
 
@raz One of our boys has a set of over-the-ear Shures. I don't recall which model, but they're nice monitors.
 
I guess it didn't like me being in 10 rooms at once already.
 
@Simon trust me, once you've heard them... it's amazing sound quality
 
raz
@Simon I figured why not, see how the quality, comfort, and durability works out. The cheaper earbuds never stay in my ears, and I almost always end up having the wires fall out.
 
0
Q: My Mom's Flash Player

inquisitiveIdiotSo I am slightly more than a dilettante when it comes to security but hardly an expert. I have been reading up on the recent Adobe Flash issues and I wanted to ask a couple of questions: My Mom uses Mozilla on her computer and they have all but completely disavowed Flash. Flash is still used o...

cc @AviD @Simon
 
raz
3:33 PM
@Xander Oh nice, they look like cool headphones.
 
@raz you can actually easily replace the wire
 
@LucasKauffman I highly doubt that they're as good as headphones.
 
@Simon they're originally meant to be used at concerts, a friend of mine who's a real audiophile bought the 325 from shure and said he was amazed (he spends close to a grand on headphones)
 
headphones for concerts?
 
@M'vy no the earphones
they're used by artists
 
3:35 PM
ah, a DJ headset kindof thing then
 
@M'vy no artists as in people who play instruments or sing :p
 
raz
@LucasKauffman Yeah I wasn't willing to spend $300 on earphones. But those 325's have dual drivers. Which would be badass. I know the 535's have 3 drivers per ear.
 
raz
@M'vy Kind of looks like a hearing ade
 
If you're looking for headphones for ~200$, you can't really get anything better than the ATH-M50s.
 
3:37 PM
eeeek I hate these things. They never holds on my ears
 
raz
@LucasKauffman You mean on the Shure's? Yeah the construction was one of the reasons I went with the 215's over the 115's.
 
OMG I called it! security.stackexchange.com/questions/94013/… "I want the decrypted text from the given ciphertext actually... And since d other questions did not have that, that is why i posted it here... Please... I need the deciphered text"
 
@JeffFerland Ha ha.
 
@JeffFerland Don't you understand? He needs it.
 
@JeffFerland well... kudos for you
 
3:37 PM
@raz sound quality as well, I had a pair of SE115 before, SE215 is a lot better
the base is rounder
 
raz
@Simon Yeah Audio Technica makes a great pair of headphones. I have the ATH-AD500X. They're fantastic.
 
@raz Nice!
 
raz
@LucasKauffman Yeah I'm excited for these.
 
damn, the question is 33mins old, there's already a google result for it
 
@M'vy Yeah, it's pretty insane how quickly Google picks up SE content.
 
3:41 PM
sitemap 4tw
 
raz
@JeffFerland haha, it seems more encoded to me than encrypted/hashed
 
@Xander Well I guess they identified the sites as good content, but hell...
@raz the best thing is we can't tell
 
raz
@M'vy True! Based off entropy though, doesn't seem like it.
 
yeah, true.
 
@raz Define entropy.
 
raz
3:51 PM
@Xander sigh
 
4:01 PM
0
Q: My Mom's Flash Player

inquisitiveIdiotSo I am slightly more than a dilettante when it comes to security but hardly an expert. I have been reading up on the recent Adobe Flash issues and I wanted to ask a couple of questions: My Mom uses Mozilla on her computer and they have all but completely disavowed Flash. Flash is still used o...

 
raz
@M'vy @CodesInChaos dude you were ninja'ed before you were even born
 
> Flash is still used on most ticket buying sites
HOW DOES THIS HAPPEN
 
s/on most ticket buying sites//
 
4:44 PM
@Undo cough I know someone for whom the Firefox ban of Flash this week crippled their customers .... cough
friend of a friend, you know
 
It's time for adobe to open-source flash
 
@CodesInChaos Open-source something that's had over 50 vulnerabilities per year for the past six years? I'm not sure if I'd want to crack that particular book open for the world.
(Especially if I was the one who wrote it.)
 
5:15 PM
We need two other candidates.
I we get to 11 candidates then we obtain an extra election round.
 
I don't see how that's a plus :P
 
The entertainment value, of course !
 
@ThomasPornin fine
 
Do we need a malware recovery forum?
"nuke from orbit" as in "reformat the drive and reinstall everything". This question is more of a tech support question than it is an InfoSec question. You aren't asking about hacking/viruses, you are trying to recover from one. I don't believe there is a malware recovery site on Stackexchange, but there are multiple other forums dedicated to this topic, including on AV vendor's sites. — schroeder 2 hours ago
 
@ThomasPornin re: the comment you just posted... Does IIS send that subsequent HelloRequest before the initial negotiation has completed? If so your comment suggests that a server might fool the browser into negotiating with an evil certificate but saying it was happy with a non-evil certificate it never followed through with.
 
5:30 PM
I added my nomination
I I think @RоryMcCune will appreciate it :p
 
Adi
@DavidFreitag I've just realized that your last name means Friday.
This is the first time I actually fully read it
 
@RoryAlsop @jefff it looks like the election mocking is getting out of hand. At this point we have more parody nominations than actual ones.
 
Adi
To be honest, I think my votes will go: 1st @Lucas , 2nd @Terry , 3rd @Xander
 
Serves us right for complaining that we have too many good ones.
I think it might behoove us to have the community team review and delete the obvious mockeries.
 
Adi
Does the election mean that the idle mods will be stepping down, btw?
 
5:37 PM
Since mods cannot delete nominations.... :-(
^ talk about modabuse
 
Idle mods? We don't have any.
 
@RoryAlsop I think he meant "idol mods".
 
@AviD - agreed
Am on phone - is @GraceNote still in here?
 
yeah the comedy ones are funny but it perhaps would look a bit better if they didn't out-number the others :op
 
yes @GraceNote is here.
 
5:40 PM
S/he can probably sort out the parody ones pretty quickly
Pretty please @GraceNote
 
in principle I think the policy is to let even crap nominations run their course - remember when EvanCarrol ran on that other site? - but when it is so overwhelming it really belittles the serious nominations.
making a mockery of the whole process could really cause longterm damage, by accidentally electing a joke mod.
 
on another note entirely, I see keybase have raised $10m keybase.io/blog/2015-07-15/keybase-raises-series-a
looking to make PGP crypto usuable....
 
dont forget, not everyone who votes is party to our DMZ "in-jokes".
 
and of course removing their old-hat Node.JS client to be replaced with one written in Go :) :)
 
@RоryMcCune that's not enough.
 
5:42 PM
@AviD that's just series A
 
for that matter, being a regular in the DMZ - and being familiar with our subcutlure and sickhumor - is far from a requirement, expectation, or even necessarily a good thing at all.
 
:-)
 
@gowenfawr IIS sends the HelloRequest after the completion of the previous handshake. IIS actually waits for the HTTP request, which is "application data" from the point of view of SSL.
The second handshake occurs within the security context of the first one, i.e. it is encrypted (from the outside, you know the records are of type "handshake" but the contents are opaque).
 
Right - making the best of having no kids for a week... I'm off to the gym for the fourth time this week so far. (Okay, that's maybe not the best use, but it's a reasonable second)
 
Okay, that removes a lot of worry. Still would be very interesting to see which certificate gets shown to the user!
 
5:45 PM
Back in a bit
 
@Adi Election occurs because an idle mod did step down (Hendrik).
You won't nominate yourself ?
 
@ThomasPornin he's concerned about the power going to his head
 
Most candidates promise that they will be good mods and fair and benevolent, but you promised neo-fascist dictatorship, which looks a lot less boring.
 
@RоryMcCune good thing Abin Sur didnt select him then.
 
@ThomasPornin According to a meta thread that was posted earlier, apparently someone already tried that approach on ServerFault and found themselves duly stripped of their position and powers.
 
5:50 PM
@Xander uhh isnt that already the case at SF?
 
@AviD I dunno. I don't visit SF anymore, but I thought they were just mean for sport, rather than abusers of the tools.
 
@RоryMcCune I just came here to talk about them. Discovered them through a gist paste.
 
@JeffFerland We discovered your mom through a gist paste.
 
Ah ah. @thomas will eventually Ninja everyone by nominating last minute with a 2 words post :)
 
#ReasonsIShouldn'tRunForModerator
 
5:52 PM
@JeffFerland We're all keybased and twitter linked here.
 
@Iszi something, something, your ex-dad got your mom's private key
man, keybase.io/jeff and keybase.io/root have already been taken
I like my collection of /root URLs
 
@JeffFerland what about /jefff ?
using an unneeded f
jefufufa
 
@AviD Why did I know Jeff Dunham was coming? :)
 
@M'vy I have been tempted to nominate myself with a post saying "I am the Bear."
 
I mean, I got root on Facebook :)
 
5:54 PM
@JeffFerland it always is :-)
 
But then people could be stupid enough to vote for me, and I don't want to be a mod.
 
@ThomasPornin Well I'm pretty sure this is a insta-elect to be honest :)
 
@ThomasPornin Joo callin meh stoopid?
 
@ThomasPornin @M'vy tried something similar. His first version was something like "Hells bitches, I'm M'vy!"
 
:))))
 
5:56 PM
@ThomasPornin You would probably win with that.
 
Hmm, that's wierd. I though I had a keybase account. Turns out I don't...
 
Alright, who has invites?
 
I do.
wait, to what?
 
Keybase.io @AviD
 
@JeffFerland I am aware.
 
5:57 PM
Hmm, apparently today is Amazon's load test day
 
@JeffFerland I do. Where do you want it?
 
@MartinRoryIngesen meh, ask one of dem hipsters.
 
@Xander echo jeff storyinmemo com | sed 's/ /@/' | sed s/' /.'/
 
@Xander hey! Phrasing!
 
@AviD Ey, Jeff was the one who asked.
 
5:58 PM
@JeffFerland Sent.
 
You don't happen to have two @Xander?
 

« first day (1672 days earlier)      last day (3213 days later) »