« first day (1694 days earlier)      last day (3484 days later) » 

Adi
Adi
13:00
One more isn't a big deal
I like how I'm still one of the most active users on chat, after basically not being here for 2 years
(with breaks from not being here)
Are there chat stats somewhere?
@Flyk Where is your trophy for that achievement
oh now we're in trouble, @Kisunminttu is here
hey @Kisunminttu hows tricks?
13:00
WHO THE HELL IS TRICKS?
Silly Scots.
@Kisunminttu is here??
@Kisunminttu you here to degrumpify @Adi
13:01
Hey @Kisunminttu!
4000 pings later she's all like "cba with this" leaves
Adi
Adi
Whoa! @Kisu is here!
Long time no see on the DMZ
hey @Kisunminttu o/
@Flyk ah but thats not per-room
@RоryMcCune very good, thanks! And you?
13:01
@Adi tut tut you should've been first to notice :op
HI !
@AviD per room I'm 2nd in here I think
dayum
@RоryMcCune I think he's being snarky
@Flyk @AviD o/!
13:02
@Kisunminttu good thanks :) I have a shiney new office to sit in , so lots of room for all my tech clutter
3rd actually
@AviD you'd hope
@Kisunminttu how's it going?
wait, did you put me and @Flyk together again??
<- massively offended
might just put @AviD back on ignore
@RоryMcCune what kinds of tech clutter. I need details
13:03
Just dropping by to give @Adi a smooch :*
solve the confusion
@Flyk right??
Dawwwww
@Kisunminttu virtual smooches
Hi @Kisunminttu I'm new :P
Adi
Adi
13:03
@JukEboX Hi
@Kisunminttu Smooch received!
@Adi Hi
@Adi @Kisunminttu ...
Adi
Adi
@Kisu Like my new profile pic?
torry pls
I MITM'd (sexist name) your virtual smooch, I was kissed by a girl and I liked it
13:04
@AviD a beginner, eh
@JukEboX well I now have about 8 drawers full of assorted cables, properly sorted. My two PC stations setup on separate desks another set of drawers with things like all my old android devices/smartphones in 'em and of course (nontech) a whisky cabinet :)
Adi
Adi
@TerryChia Okay okay.. @Kisu, give him a smooch as well
@RoryAlsop hehe
@JukEboX hello and welcome :) (feels weird saying welcome since I haven't been here that long myself)
Adi
Adi
@Flyk You know what you have to do now to make this a full MITM, right? Ewwwww
13:04
hijacking all the virtual smooches
forwarding them on to @Simon's donut
^ just ... okay .. :-)
I see that they finally got the spelling of doughnuts right on the room message.
@RoryAlsop sounds like your set you just need a nice couch a microwave and a small fridge
@Kisunminttu Thanks. Still getting a hold of @Simon and his donuts
13:06
pls all
@JukEboX you play with another man's donuts?
@Adi I think a friendly hug is more appropriate. hug, @TerryChia?
Does @Simon know you're holding his donuts?
@Flyk I mean the usage of the term you donut
CREST and Offensive Security are delighted to be working together to drive greater confidence in the capabilities of the Penetration Testing industry. In July 2015, both parties entered in to a partnership which allows Offensive Security OSCP certified individuals to be granted CREST CRT (Pen) equivalency. /cc @RоryMcCune
13:07
@TerryChia no, there is a typo again
@LucasKauffman Huh cool.
@JukEboX he'll teach you everything about donuts if you're nice
@JukEboX coffee machine / pot
Adi
Adi
@LucasKauffman HOOOOOLY SHIT!
all you need to do is pay 500 bucks
...
13:07
@LucasKauffman yeah... interesting decision
@AviD hahahahahahahahahahaha. Why have I not seen that before!
@Kisunminttu Sure. The dynamic in here has me still rattled ^_^
@AviD the fact that article had to get so silly so quickly indicates the writer has no idea
@AviD I don't do coffee the rest of the world does so Yes... Yes you do need that
@LucasKauffman the two exams have a very different format, so it's weird to see them taken as equivalent
13:08
@Flyk yeah that's what @RoryAlsop is thinking. He's like "where is the joke in all of this? This is all true!"
@RоryMcCune Yes. The point is that scrypt uses a configurable amount of CPU and RAM, and its strength relies on it using a lot of RAM.
However, the two settings are not independent, so if you use a lot of RAM you also use a lot of CPU
@LucasKauffman ah now that makes sense. Keep up the crazy cert chasing, but without the mess of actually giving a test.
oh, @ThomasPornin is here, that's why the average word length just quadrupled
3
@AviD > Haha oh people. Always SO jealous and suspicious.
If you want the hashing to complete within, say, 1ms (for a busy Web server), then you use so little RAM that scrypt becomes weaker than bcrypt
Adi
Adi
13:09
@LucasKauffman Oh
@ThomasPornin ahh I see, of course, that makes sense :)
@RоryMcCune If I find someone to pay for me, I'll get it :p
Is the multiple choice exam hard?
@LucasKauffman how many questions?
@ThomasPornin Would bcrypt manage to complete that fast too?
@ThomasPornin is this not the case with bcrypt?
13:10
@LucasKauffman multiple choice is nearly always easy
the answers are literally there in front of you
@LucasKauffman for CRT, I've not done it but if you do testing reasonably regularly, I wouldn't have thought it would be too bad. Harder part with CRT and CCT is the practical which is very time constrained
@LucasKauffman and you have no Internet access whilst doing it
@AviD bcrypt uses a configurable amount of CPU, but a fixed amount of RAM (4 kB), and accesses the RAM in a "difficult" pattern ("difficult" meaning "hard to optimize for parallel architectures")
@Flyk are you saying that length matters?
@TildalWave this question is too ambiguous to answer with any certainty
@ThomasPornin ah, I see.
13:12
@TildalWave only if your not doing 2 in parallel :P
scrypt uses more RAM, but most of the accesses are sequential, so a scrypt-with-128 kB can be substantially sped up with a GPU, for a given budget
@JukEboX in serial you mean?
I actually did know that 4kb thing, didnt know about how its protected
Adi
Adi
@LucasKauffman Doesn't CREST exam have practical component as well?
I don't normally put my length in my serial
13:12
@Adi that's the one where you are excempted
hehehe
let's have a discussion about quantum parallelism
@TildalWave ;)
@ThomasPornin how do the new password schemes relate to this?
Adi
Adi
@LucasKauffman Odd. From what I know about CREST, OSCP is a lot a looooot more difficult
13:13
@Flyk only if we discuss movement in the 5th dimension as a result
@RоryMcCune is CRT actually the hard or the easy exam?
@AviD The good ones offer independent settings for CPU and RAM; but practical guidance is still lacking.
@LucasKauffman CRT is the easier of the two
ah, so thats why its not officially published yet, despite having been selected?
The PHC has decided that the "general winner" would be Argon2, but it is still being "finalized" so the algorithm itself is not yet really defined.
13:14
@LucasKauffman CCT is the higher level one, which is split Inf/App
cmon @CodesInChaos, get on with it!
@JukEboX I don't wanna
@LucasKauffman and now they have the CCSAS for Red Team stuff
When Argon2 is finished, we will be able to document "good settings" for it.
@ThomasPornin what about, for example, Makwa?
13:15
sometimes I wonder if these guys have a second channel for making up these names
@AviD Makwa is production-ready and is much simpler to configure since there is only a CPU cost.
and are in fact just spewing nonsense to confuse me greatly
@Flyk you want some spooky action at a distance?
@ThomasPornin so no memory hardness?
race conditions at a distance
pls no
13:15
how do you mitigate GPUs and such?
@TildalWave any kind of action, let's do it
After a lot of tests, it turns out that using GPU can be used to speed up Makwa, but not by a large amount (say an improvement of at most x1.7 per dollar)
@AviD No, no memory hardness.
Generally speaking, I don't really buy the concept of memory hardness.
@ThomasPornin me either
@ThomasPornin but the GPU doesn't dispose of heat from it as it should when over calculating like if your mining bitcoin
I'm only really fond of one kind of hardness and memory hardness is not it
13:16
@Flyk cmon, no "hardness is but a memory" style quips?
For a good password hashing function, you need to use something that the defender's machine does really well so that the best option for the attacker is to buy the same machine.
@ThomasPornin Never heard of it before. Does it mean a given problem is expensive in terms of memory?
@Flyk pls
@Flyk hey I don't do spooky action at a distance with girls I didn't entangle first :D
@ThomasPornin interesting - though I understand this is not a majority opinion, right?
13:17
@AviD "inb4"
@TildalWave has standards :D
@TildalWave entangling sounds fun
(not even implying you're wrong, just asking abou consensus)
"Memory hardness" relies on the assumption that a PC is really good at making random accesses in a lot of RAM.
Makwa, instead, assumes that a PC is really good at making multiplications on big integers.
Right now, GPU suck on large integer multiplications.
Bold assumption.
13:18
@ThomasPornin but arent GPUs / FPGA / etc even better at precisely that?
@ThomasPornin ah never mind
@AviD It turns out that no, they are not...
But this is, indeed, surprising.
As in: I was surprised.
@ThomasPornin more on floating points?
floating points at the best kind of points
@ThomasPornin so wait, what ARE they better at??
Doing the same floating point operation a few thousand times at once, from my understanding
13:19
@AviD Yes and no... a "normal" GPU is really good at making operations on single-prevision floating point values, with a 24-bit mantissa
So what a GPU does well is multiplying 24-bit values together
@Flyk Is your favorite mantissa the 24-bit one?
@ThomasPornin uhh...
Modern GPU are not bad at 32-bit integers
ya lost me
Floating point time!
13:20
@AviD I'm surprised that you've managed to keep up for this long.
You were probably pretending.
A single precision floating point number is made up of 32 bits
@Simon no, I get the concepts, its the details that trip me up.
@AviD Floating-point value have a range and precision; the "single-precision values" are what C calls 'float' and have 24 bits for the precision
1 sign bit, 7 exponent bits, 24 significand/mantissa bits
specifically, the advanced math-y bits.
@ThomasPornin okay THAT much I know
I mean, I'm not @Simon
13:21
I always forgot what to do when the number became denormalized
pls he not me
Single-precision values are good enough to make 3D graphics, so GPU optimize on those.
When using double-precision integers, GPU are less good (53-bit mantissa)
ohhh, derp - I didnt know what "single-prevision floating point values"
Typically they will be four times slower.
13:22
@ThomasPornin very interesting!
@AviD This is known as a "typographic error".
single-provision floating point values only get one unit of rations
What really kills GPU is power consumption.
@ThomasPornin well, sure, its obvious NOW, but I know so little I just assumed it was a new term I'd never heard
they have to return to the processor sooner than double-provision floating point values, making them faster to compute
13:23
@Flyk Sure, entangling is fun, if it doesn't lead to increase in entropy and quantum pairing :)
but then they can't go on as many nature hikes and are less precise as a result, since their memory isn't as good
When you are a serious attacker, what costs you much is not buying the hardware, but running it. GPU really eat a lot of power.
Meeting time. Back later
@ThomasPornin sure. And GPU-heavy AWS doesnt solve the latter, even though it does the former
@AviD The big cloud provider are good at optimizing their PUE (Power Usage Efficiency). Some claim to be down to about 1.09 (i.e. the cooling and lighting and other costs are only a 9% extra on what the hardware itself uses).
But, even so, a GPU that needs 375 W will use 375 W.
(In fact it may well use more than that...)
13:26
regardless, you're still paying the running costs. in the case of AWS, power is just the one component.
wat
It also turns out that underclocking is probably a good idea (for an attacker).
You can also get a $10 rubber hose and hit the server owner until they tell you the password
that is both surprising, and counter-intuitive, and yet makes perfect sense based on what you just explained.
@etherealflux why bother with a 10$ hose when a towel and a source of water would suffice?
@Flyk Dropping fat stacks o' cash like it ain't no big thing
Section 4, specifically.
well I suppose you could beat somebody to death with a stack of cash
I imagine covering the money in the blood of your victims is not good for being able to actually spend it, though
@ThomasPornin thanks.
cable ties, hair net, rubber gloves, ketamine, and a selection of knives
"in case of emergency"
13:33
@AviD not really liking "memory hardness" is, indeed, not a majority opinion.
I absolutely promise you that this is a first aid kit and not a serial killer kit
Fucking idiots doing Ketamine at festivals
10/10 would not be friend with
Memory hardness is a neat idea, but I believe that it entails a lot more thinking and planning at the configuration level, so it won't turn out well in the "real world".
hahaha I didnt expect to understand much of that, but I caught the subtle "Canaduh sux" jibe.
@Simon what's wrong with ketamine?
13:35
@Flyk People are dying on that shit.
@Simon so you hate anything that kills people?
Yeah except stuff like guns because guns don't kill people, I kill people, with guns POW.
so you hate Americans, McDonalds, water, fire, gas, cars, planes, cake, chocolate, ... well, fucking ev erything
As least they aren't doing krokodil
I don't remember ketamine ever boiling itself off and then jumping into somebody's digestive system
so no, it's not drugs killing people, it's basically accidental suicide
it's not Nitrous Oxide's fault that people choose to breathe it instead of oxygen and suffocate themselves
13:39
Why did this question rep-trained ?
59
Q: What is the purpose of these weird non-spam emails?

puhubearA mail made it through the spam filter and i wonder what the purpose is. It is not spam. Tracking? But how? Who? and why? In the source code there are this weird passages like ... =EA=85=9F =EA=8F=92 who benefits how? no links nothing else in this email. Delivered-To: [email protected] Received:...

@Flyk Why can't they smoke weed like the rest of the fucking planet and not risk dying?
@ThomasPornin Because people who come from other sites love to upvote questions like these.
@ThomasPornin I didnt understand (a lot of things, but specifically) why you say 72% improvement per dollar.
Doesnt that mean, if I put in a hundred dollars, that I get a several billion-fold improvement?
or just 172-fold improvement?
@Simon every day that you live you risk dying
if you go through life avoiding all risk you'll end up not living
Yeah, I drank water and almost drowned myself earlier.
@ThomasPornin wow, no clue
13:41
@Simon plenty of people have drowned themselves drinking water
simple? applies to everybody? understandable by noobs?
PS: I was not in an ocean.
maybe it was the bear answer.
@Simon still stands, plenty of people have drowned themselves drinking too much water
Polydipsia is real
13:43
@AviD I mean that, if you use CPU and get N password hashes for 1 dollar of budget, then using that dollar with GPU would have yielded 1.72*N password hashes.
Basically you insert dollars at one end, and obtain password hashes on the other side. With a GPU-based system, you get 72% more hashes out of your dollars.
ahh so the 1 dollar is arbitrary - as in, GPU is 72% more cost-effective.
That's it.
it was the over-specificity that confused me.
The point of saying "per dollar" is to insist on the idea that what matters is the "total cost", not just the retail price of the hardware.
@ThomasPornin I get that.
13:46
Of course, an amateur attacker who runs his PC in his parents' basement does not pay for the power, so his priorities may differ.
2
True story.
@ThomasPornin Password hashing vending machine? I like it. -> starts a Kickstarter project :)
but its a fixed gain per any budget, not recursive
exponential's the word you're looking for, I think
I prefer factorial gains, though
@etherealflux no, there's another specific word for it, I'm at a vocabularical loss right now
13:53
@AviD he says with a 17 syllable word
compounded
thats the word
@Flyk a made up one
ah yeah, I remember having exponential growth introduced via compound interest
@TildalWave quick get some VC money and passwordhashingmachine.io registered!
io.io.io.io
@etherealflux it's off to work we g.io
13:57
boilerstrap.io
@etherealflux sounds like a punk band
international.superstar.dj is the best
I did not realise that .dj was a valid TLD
and somebody already registered superstar.dj
This list of Internet top-level domains contains all top-level domains, i.e. the domains in the DNS root zone of the Domain Name System of the Internet. The official list of all top-level domains is maintained by the Internet Assigned Numbers Authority (IANA). IANA also oversees the approval process for new proposed top-level domains. As of February 2015, the root domain contains 1034 top-level domains, while a few have been retired and are no longer functional. == Original top-level domains == Seven generic top-level domains were created early in the development of the Internet, and pre-date the...
.dj is Djibouti.
14:01
stupid hipsters.
@Flyk yeah all the v. funny ones went , things like foo.bar was pre-regged
@ThomasPornin ahh I was assuming it was one of the vast number of new gTLDs
which included people who's business model is purely getting companies to by their .sucks domain name, before anyone else does
which I'm kind of surprised is legal
Amusingly, the "country" TLD do not match actual sovereign countries.
For instance, Faroe Islands have ".fo" despite being formally part of UK.
Oops, sorry, turns out they are Danish, not British
PEOPLE
TAKE NOTE
party.haus
TODAY, ON THE SIXTH OF AUGUST
TWO THOUSAND AND FIFTEEN
14:04
@AviD The Aussies were out for 60
THE YEAR OF OUR LORD
@AviD not mine
OUR SAVIOUR, THE GREAT BEAR
DID IN FACT
eat a sandwich
COMMIT HIS FIRST MISTAKE
14:05
heh, there's a .wang TLD, how many teenage boys will register a domain under that for funsies
IN PUBLIC
LOL
(why are we shouting?)
@RoryAlsop WE ARE NOT SHOUTING
WE ARE ANNOUNCING
IN THE TOWN SQUARE
AND LATER WE WILL BURN A WITCH
@AviD How do you know she is a witch?
@RoryAlsop she looks like a witch!
14:07
@AviD WHAT ARE WE DOING TO @Simon'S DOUGHNUT?
she's got a fake nose and a pointy hat!
and smells like a duck!
no wait, that one is wrong
every time I look away I get pinged multiple times and then chat scrolls 15 pages
@Flyk izza crayzee day in the dee emm zeeeee
@AviD I don't want to be set on fire
@RoryAlsop daily masturbation zone?
awww, the facility I was going to install my d-wave 2 in is unsuitable
want to sell: $10mil quantum computer, still boxed, apply within
or is it still boxed
I guess you won't know until you open it up
@Flyk why were you buying a $10 m quantum computer?
14:17
@RоryMcCune Because she's Taylor Swift.
@TerryChia aaand it's part of some diabolical scheme to get back at Katy Perry?
@RоryMcCune Possibly.
@LucasKauffman now that's not a very flattering suggestion for a picture of @Flyk
@Flyk I suppose folks could cut down if needed
14:35
I'll cut down all your moms.
14:47
@Flyk that was WITCH, with a "w"
rhymes with twitch?
@RоryMcCune I thought that was supposed to be me
@Flyk do you have a fake nose and pointy hat and smell like a duck?
@AviD well it was in response to @Flyk 's quantum computer purchase... Unless you're getting one too of course
15:01
@RoryAlsop cut down? Never
@RoryAlsop I don't think your stereotypes are appropriate
@RoryAlsop OH COME ON!! very NSFW.
damn japanese.
also, I would think that guy hasn't met @Simon.
@Flyk and I don't think your lack of knowledge of pop culture is appropriate!
@AviD you don't even know if it's lack of knowledge or obfuscation
maybe even misdirection instead of obfuscation
@Flyk obfuscation is not security
ergo its off topic here
erm
you're not security, ergo you're off topic here
15:18
dammit!
oh snap
I'm bored, you're boring me
raz
raz
15:32
In other news, the sky is blue
15:46
it's more of a gray color right now
@raz yeah but do you know why?
there's a perfectly geeky explanation for it :)
I'll continue then, shall I? :D
Rayleigh scattering (pronounced /ˈreɪli/ RAY-lee), named after the British physicist Lord Rayleigh (John William Strutt), is the (dominantly) elastic scattering of light or other electromagnetic radiation by particles much smaller than the wavelength of the radiation. The Rayleigh scattering does not change the state of material hence it is a parametric process. The particles may be individual atoms or molecules. It can occur when light travels through transparent solids and liquids, but is most prominently seen in gases. Rayleigh scattering results from the electric polarizability of the particles...
#adminabuse #kony2012
@AviD yeah I can tell that from the URL
 
2 hours later…
17:47
Gah...Beaten like a ginger stepchild. — PaulJWilliams Jul 16 '10 at 14:54
What the hell?
@Simon have you not heard that phrase before?
it's old and, rather distasteful
"beaten like a redheaded step-child"
@RоryMcCune Yeah, totally not gonna use that phrase.
@Simon yeah there's a lot of old-timey phrases that used to be considered ok , that really really wouldn't be now
Silly old people.
17:52
Because the gene for red hair can lay dormant for long periods, it was often believed that when a red haired child was born, that it the mother must have been unfaithful with a red haired man: the real father believing that the child was not his own.
^reminds me of that (NSFW if you watch the whole thing)
pls, copyright block
@Simon huh weird, works in the UK ok
"This video contains content from eOne UGC, who has blocked it in your country on copyright grounds."
WHO BLOCKS THINGS TO CANADUH?
@Simon eOne UGC.
17:55
pls bear
raz
raz
@RоryMcCune Taking it back
@raz exactly
@RоryMcCune Whassat? The "Porch Monkey" bit?
@Iszi yeah, it seemed to fit the subject of old people and phrases that used to be ok but aren't now :)

« first day (1694 days earlier)      last day (3484 days later) »