The DMZ

TildalWave

13:01

> ... including the one with sensitive information on Google Docs

WTF is wrong with people?

Simon

10/10

Xander

@Simon Tinfoil hattery questions are some of the most likely to reptrain, as they remind everyone of that scary movie they watched one time where the government hunted down The Man Who Saw Something He Was Not Supposed To See, and no one wants to be that guy.

raz

@TildalWave Dude I don't often store my passwords, but when I do... I use Google Docs. Stay cleartext my friends.

Simon

@Xander Hehe.

Flyk

@Xander Enemy of the State featuring Will Smith?

raz

13:03

@Xander But everyone wants to be the government agency, weird how that works.

Flyk

CAN THE FBI REALLY SEE THE CONTENTS OF MY BAG?!

raz

Or Conspiracy Theory

Pelican Brief

Mercury Rising

M'vy

Can StackExchange spy on my computer?

raz

Sneakers

Simon

Mars

Rory Alsop

13:04

@Flyk Onomy of the Stote featuring Woll Smoth would be funnier

raz

@M'vy If I go out in public can people see me?

Simon

@RoryAlsop 10/10 roro

Xander

@Flyk This is a prime example of the genre, yes. Or the Bourne series. Or The Man With One Red Shoe. Or...

Rory Alsop

@Simon Yay - I dun one that the youngsters get

Xander

@Raz, yes, all those too.

raz

13:05

@RoryAlsop North by Northwest?

TildalWave

-1

A: How to set up OpenSSH to use x509 PKI for authentication?

Have you looked at the following page about SunSSH on Solaris 11 from Oracle regarding their fork of the SSH? http://www.oracle.com/technetwork/articles/servers-storage-admin/howto-setup-x509-sunssh-1929594.html

question about OpenSSH, answer about SunSSH :O

Flyk

#StackExchange

Simon

#StackExchangeNewcomers

TildalWave

I was tempted to flag it as spam

raz

@TildalWave Gotta keep people guessing

If you give people what they want, they'll never learn.

M'vy

13:08

Hum I can't add a delete vote there

And flag is not relevant

TildalWave

@raz Wrong. Even Pavlov's dogs did better than that.

M'vy

Ahh it came up in the review list

Flyk

@TildalWave once upon a time I would flag stuff like this as NAA but the amount of incompetent moderators on here makes that a waste of time as well

raz

@TildalWave hahaha

@Flyk I flagged as link-only, which it is

Rory Alsop

@Flyk erm - even us old fossils have feelings...

Flyk

13:11

@RoryAlsop fml you can basically assume I never mean you when I am negative

Rory Alsop

@Flyk (hugs)

I was just joshing

(also - I don't tend to actually have feelings hurt by people on the internet. It's all too remote. You'd need to do it in person.)

Simon

@Flyk I introduced you to my donut yesterday as the one who insults everyone all the time.

Flyk

oh well

I like how I react to you how you react to me and yet I'm the bad person

Simon

I didn't say that you were a bad person.

Flyk

that is the reason the majority of the internet people I know of got demoted to disposable

Simon

13:20

pls

JukEboX

Curse those down voters!

Rоry McCune

^heh

JukEboX

Darn work net blocks pictures :(

raz

@RоryMcCune haha, pentesting?

@JukEboX You got downvoted?

M'vy

@RоryMcCune nice

JukEboX

13:29

yeah :(

Rоry McCune

@raz I think someone was looking at the Oracle blogs platform this morning after that latest blog

not me I hasten to add

AviD

@RоryMcCune stop copying twitter

and reddit

Rоry McCune

@AviD why? I wouldn't want people to miss out on the Lulz!

JukEboX

@raz yeah SU.se nerds :/

AviD

heh, fair enough. Carry on then.

JukEboX

13:30

@raz and Good Morning

raz

@JukEboX Good morning

JukEboX

Man I am really missing a good WORM infection.

I'm talking that in the wild exploit Apple/Windows security patch, see on CNN, confused the hell out of old people kind of WORM.

Simon

@RоryMcCune "HTML syntax NOT allowed"

What about JS? trololo

JukEboX

Who is the person here that does pentesting?

@raz Was that you?

Terry Chia

@AviD Yeah @RоryMcCune, that's MY thing.

Rоry McCune

13:41

interesting, first flag I've seen for a non-english SE chatroom

could be tricky to decide on those

Simon

Just validate it.

If it's not English, it must be offensive.

3

Rоry McCune

@Simon that wouldn't be nice

JukEboX

LOL why is my question still to of meta?

Why is it people keep deleting the questions I answer >_<

Rory Alsop

@schroeder - you need to beat Dr Jimbob in rep to feed my OCD and pattern matching:

security.stackexchange.com/users?tab=Reputation&filter=all

JukEboX

@Schroeder wow that was a close race for MOD. Congrats. @Xander put on a strong showing.

Rоry McCune

13:51

@RoryAlsop I tried to get all the mods into a vertical line once, byupvoting someone to make it work , but the admins noticed and reverted tham :( in my defence, I was only upvoting answers I thought were good

Rory Alsop

@RоryMcCune hahahahahahahaha

@RоryMcCune google translate helped me

Rоry McCune

@RoryAlsop yeah that might be the way. would be cool to see sites integrate instant translation based on browser language

although probably only once they're a bit more accurate

JukEboX

@RоryMcCune you mean like Google Chrome does? I don't think they can do that unless the host domain in off language

Rоry McCune

@JukEboX well AFAIK they offer the translation which is nice, what would be cool is if it just autotranslated anything you come across (With an option to disable of course)

raz

@JukEboX Nope, I do security research

Rоry McCune

13:58

@raz what sort of stuff do you research ?

raz

@RоryMcCune Security

...

duh

Rоry McCune

@raz :op

I was hoping for a wee bit more specificity there

Terry Chia

@RоryMcCune Information security.

Rоry McCune

but 'nuff said, a nudge is as good as a wink to a blind horse

2

raz

My last project was vulnerability analysis of the linux ipv6 stack

Rоry McCune

13:59

say no more

Simon

no more say

Rоry McCune

@raz ooh cool

Terry Chia

@raz It's secure because no one is using it? ;)

raz

@RоryMcCune Yeah I had fun with it, got a couple of crashes from a couple of devices.

@TerryChia lol, yes the less you use something the more secure it is. #GreatSecurity

Rоry McCune

@raz I have a feeling that IPv6 is largely going to be a cluster-smeg 'cause of all the hand written regexes in everything that only match on IPv4 addresses

Terry Chia

14:00

@RоryMcCune IPv6 will be a disaster if and when it ever gets widely deployed. ;)

raz

@RоryMcCune Oh there's a crazy attack service for it. Especially when you get into the xfrm type shit in Linux.

JukEboX

@raz does the IPv6 Model use the same as the IPV4 model?

AviD

@raz I reeally wanna say something nasty involving @Simon and his ahem, but I will skip it and just leave this referential comment instead.

JukEboX

@AviD LOL @Simon and his ||||REDACTED||||

Flyk

you know there's a possibility that you're just being really mean to somebody you don't know

raz

14:02

@JukEboX Kind of, but handling xfrm with the different IPv6-to-IPv4 tunnels and vice versa, plus adding in IPSec/AH. It's quite the cluster****

AviD

@Flyk "possibility"?

Flyk

oh, did I spell it wrong?

spellchecker didn't highlight it

JukEboX

@raz so could you tell me why some Windows 7/Vista NIC Cards were auto configured with the base Ethernet connection and a "pseudo tunnel adapter" ?

Flyk

sorry

raz

@JukEboX No, as I was doing analysis on the Linux stack.

@Flyk How dare you make a mistake!

Rоry McCune

14:04

@Flyk hey you're dripping sarcasm all over my keyboard :op

Flyk

you read your keyboard?

that's an interesting display

Rоry McCune

@Flyk :op the screen is above my keyboard, your post was dripping sarcasm, ergo the analogy of the sarcasm hitting the keyboard

Flyk

bla

Xander

20

Q: What is the Teredo Tunneling Pseudo-Interface?

I am running Windows 7 Ultimate, and when I do ipconfig /all in the command prompt I get, in addition to the Ethernet adapter Local Area Connection that I expected, something called Tunnel adapter Teredo Tunneling Pseudo-Interface. What is this? What can I use it for?

JukEboX

Thanks @Xander

@Xander ooooo that is pretty cool. Way to manipulate a protocol for old dumb systems Microsoft :thumbsup:

Simon

14:09

@Xander @Xander @Xander @Xander @Xander

raz

@Simon Are you repeating what your mom said last night?

Simon

pls

AviD

@Simon stop repeating her!

Simon

@AviD @RoryAlsop Go tell the SE lads that I want them to send me my t-shirt ASAP.

AviD

what tshirt?

Simon

14:13

For the election!

AviD

only the real candidates get tshirts.

not the joke nominations.

Simon

pls

AviD

actually I dont think they do election shirts anymore.

Simon

@AviD 'SCUSE ME?

Xander

@AviD Yeah, I haven't heard a peep, so I'm assuming that it isn't a thing any more.

Flyk

14:18

it takes them a while

presumably so they can... deal... with any newly elected moderators they don't like

JukEboX

What would it say on it?

"I almost made it to Mod" LOL

M'vy

@Flyk @simon took around a month last time

Simon

Ah, cheers.

M'vy

@JukEboX forever user :)

JukEboX

@M'vy ^_^

@Herringbone_Cat you awake yet?

M'vy

14:26

@JukEboX But I don't surrender!

raz

@M'vy Never give up, never surrender!

M'vy

I'll try to be sure to have 10k at least for the next one. Seems like rep is very important to voters.

Simon

@raz You're saying that because he's French, eh?

pls roz

raz

:23357360 False

AviD

nerp, I remembered wrong

raz

14:27

Galaxy Quest people... COME ON

Simon

failovid

raz

Best Star Trek movie, ever.

AviD

@raz WAIT GIVE ME A MOMENT

@raz yes yes, I wrote before remembering clearly

Simon

I haven't seen any Star Trek \o/

AviD

agreed

JukEboX

14:28

@raz Can you suggest any webpage pentest firm or tools? Or anyone here able to do pentesting of a few websites I have made?

Rory Alsop

@JukEboX depends on your budget...

that t'other rory is pretty good

Simon

in b4 3.58$

AviD

@raz really was an awesome movie.... should watch it with the kids again

raz

@JukEboX Yeah I don't do Pentesting, so I'm not too up on the tools

@AviD I feel it's a must watch kids movie.

AviD

@raz oh, they've seen it, of course

i said "again"

used to be my son's favorite movie

havent seen it in a couple years though

raz

14:31

Yeah... now I want to watch it. I know what I'm doing tonight!

Iszi

@RоryMcCune 404

Flyk

some comment about pentesting

raz

rabble rabble rabble

TildalWave

14:47

@JukEboX I can't be modded?

JukEboX

@TildalWave what?

@AviD what movie?

TildalWave

@JukEboX duckduckgo.com/?q=define+modded&ia=definition

JukEboX

@TildalWave I mean what are you sacking can't be modded?

TildalWave

your modhood

28 mins ago, by JukEboX

What would it say on it?

JukEboX

@TildalWave LOL

TildalWave

14:49

kids these days... so attention deficit :P

JukEboX

@TildalWave "MOD Lyfe""

TildalWave

#YOLO #MOD4LYFE #WTF

Simon

no

TildalWave

#PLS?

Simon

nein

JukEboX

14:51

#donuts ?

TildalWave

"My other personality is Canadian too"?

Simon

all.

JukEboX

@TildalWave "I Don't Know. Ask @Simon"

Journeyman Geek

@Simon ?

Simon

pls

Flyk

15:17

it's ok @Simon, I have your back

afk again

JukEboX

16:14

@Flyk killed chat

CodesInChaos

16:24

The oracle post @RоryMcCune linked 404s now.

Flyk

16:46

@JukEboX not the first time that's happened

I suppose I shouldn't really complain about it, what with it being pre-release software and all

but Windows Phone 10 just did the almost certainly fatal mistake of dropping my call via the phone crashing

Iszi

@Flyk I was wondering if I should try that preview. Thanks for the warning.

Flyk

let's be fair, the odds aren't in its favor

Iszi

@CodesInChaos web.archive.org/web/20150811052336/https://blogs.oracle.com/… (CC: @AviD)

Flyk

it is the fast ring release

assuming there is a difference

ok so, pretend that you're talking to an... actually... just explain to this non-programmer what that article is actually whining about

Is Oracle just whining because customers are reverse engineering their stuff looking for vulnerabilities and they're finding "stuff"?

CodesInChaos

I'm not sure. Either that, or because they're running dumb automatic analysis tools and swamp oracles with incorrect bug reports.

Xander

16:53

@CodesInChaos I suspect it's that.

Flyk

hence why I said "stuff"

CodesInChaos

Or Oracle simply thinks reverse engineering = evil

Flyk

is the technical content of the article actually valid?

CodesInChaos

They took it down after getting flamed

But it doesn't really have much technical content.

Flyk

for what reason was it flamed?

Xander

16:55

@Flyk Yes and no.

Simon

No and yes.

Flyk

@Xander fantastic, so everybody is wrong

that's the best kind of outcome

CodesInChaos

Because security researchers like reverse engineering and think sending legal threats to people who do it unacceptable.

Simon

You're unacceptable.

Flyk

really then this is just a new flavor of "Does the EULA actually mean anything?"

CodesInChaos

16:57

Pretty much.

Xander

@Flyk It is certainly true that outsiders are operating with limited information. Having been on that side of the fence, it is not fun to have to sift through huge static analysis reports from customers, containing nothing but hundreds of false positives while they loudly demand to know how quickly you're going to fix all of these issues.

@Flyk However the right answer is certainly not "no one but us knows what they're doing, so you should all go away and pretend that we'll take care of everything.

Flyk

well no, there has to be accountability

CodesInChaos

The part of their policy that requests evidence for exloitability is sane (though I'd apply slightly lower standards). The part where they say "don't reverse" is the problem.

LamonteCristo

Hey does anyone know of an Addon for IE that allows me to download the contents of a website 2 layers deep?

Searching is coming up with the wrong stuff....

Simon

lolie

Iszi

17:07

@LamonteCristo You want add-ons? Switch to Firefox. They've got something for everything. And I think Chrome is probably getting close too.

JukEboX

People make addons for IE?

Other than spam toolbars?

LamonteCristo

Thanks @Iszi problem is that I have a logged on session and can't switch browsers.

I can't loose the session I already have. (unless .NET can piggyback on what IE is doing)

Iszi

@Iszi Ack, meant to CC @RоryMcCune

@RоryMcCune Did you change your name again? Or is the sorting of auto-complete actually non-alphabetical?

@LamonteCristo Hm. And I doubt IE Tab would actually take over that session...

LamonteCristo

IE Tab? not sure...

Simon

When you import from a browser to another, does it transfer sessions?

Herringbone_Cat

17:12

@JukEboX what time do you think security guys come into work on the west coast

JukEboX

is slowling falling. . . . . . . . . . ZZZzzzzzz

Iszi

@LamonteCristo Just tested. Doesn't look like.

Herringbone_Cat

I think I'm exceptionally early today coming in about now.

JukEboX

@Herringbone_Cat Hey dude. Been waiting for you to show up. If they start at 9 I would say Noon EDT

Iszi

@JukEboX Is that kind-of like this?

JukEboX

17:14

@Iszi sorry dude. Work net blocked :/

Herringbone_Cat

@JukEboX If I show up before 10:30 it's a good day.

JukEboX

Noon my time dude. That's 9AM WDT

@Herringbone_Cat you late today?

Rоry McCune

@Flyk @Xander @CodesInChaos I took the Oracle blog to be "we know better than you customers/researchers, and if you reverse engineer our stuff you're breaking your license agreements" this might have had some validity if Oracle didn't have a truly terrible record on security which, to me, indicates that they really don't know better than customers/researchers

Iszi

@JukEboX It's just a page with this:

Rоry McCune

and it stands in stark contrast to MS/Google/FB/ most other clueful companies who actively engage the research community

Iszi

17:16

@RоryMcCune Yeah, I love the whole "religion debate" over bug bounties bit.

JukEboX

@Iszi blocked again

Herringbone_Cat

@JukEboX No, i'm about a half hour early. All is well.

JukEboX

@Herringbone_Cat oh ok. You do network/web based pen test at all?

Iszi

@JukEboX Are you kidding? That's just imgur.

JukEboX

@Iszi nope. WOrk net is strict

LOL @Flyk

Iszi

17:17

You oughta set up a VPN at home.

CodesInChaos

Oracle says "You can't validate without source code". But don't come to the obvious solution of publishing the source code.

Rоry McCune

@Iszi yeah realistically it's correct to say that bug bounty money could be paid to more internal staff, but there's a PR aspect of providing researchers an incentive to work with you and not just sell to grey/black markets which causes more problems for customers down the line

Iszi

@CodesInChaos Oh, no... we can't make our IP public! We'll get hax0red!

(See what I did there?)

JukEboX

@Iszi ;)

CodesInChaos

@Iszi Everybody knows that you get haxxored within 5 mins when people know your IP.

Iszi

17:20

@RоryMcCune I kept reading to hope that she'd come around to a coherent and reasonable argument for her stance, but... well, just this again.

I do agree with their "POC or GTFO" stance. But the whole IP thing is just BS.

Rоry McCune

@Iszi yeah, there's really no good outcome from them here and you have to wonder how a CSO that unaware of the effect of their words gets by

Iszi

@RоryMcCune By writing murder mysteries on the side, apparently.

Herringbone_Cat

@JukEboX Sure, not so much as I used to, but enough to stay compliant :)

JukEboX

@Herringbone_Cat I was thinking about getting some of my sites Pen tested. Nothing to serious just help me learn what issues I have.

Or maybe just my home net

Iszi

Semi-unrelated note: Someone really needs to make a "what movie/show is that GIF from" site.

JukEboX

17:23

@Iszi YES!

@Iszi

Herringbone_Cat

@JukEboX Go get yourself a copy of Kali and register a copy of Nessus. play with metasploit autopwn. That should get you started

Xander

@RоryMcCune @CodesInChaos To me, the most appalling bit was not so much that they think they know better, but the ridiculously sarcastic and condescending tone of the post in conveying that belief. It was written as if she wanted to make extra sure that all their customers knew how stupid they really were.

Simon

@Herringbone_Cat That should get him started to join the script kiddie club, yes.

Rоry McCune

@Xander yeah the tone was appalling for a professional blog from a major software company

JukEboX

@Herringbone_Cat that for website testing or home Net testing?

Herringbone_Cat

17:26

@Simon It is interesting the overlap between the script kiddie club and the penetration tester consultant for $$$$ club.

Simon

sURE IS.

Iszi

@RоryMcCune s\ from a major software company\.\

Herringbone_Cat

@JukEboX It does everything, but if you're focused on web application stuff, Acunetix is also a good scanner.

JukEboX

@Herringbone_Cat Will I need to learn any languages?

Simon

That was a caps lock fail, not fixing it.

Herringbone_Cat

17:27

@JukEboX Not for those tools. But they aren't exactly simple either.

JukEboX

@Herringbone_Cat ok Cool.

Iszi

Or is it forward-slashes? I'm never sure if I get that right.

JukEboX

has caught the itis real bad

Herringbone_Cat

if you want to be a real full on script kiddie you can go purchase a pwnpad or something from pwnie express, that's the yuppie script kiddie deluxe right there

Iszi

@JukEboX Mis-read: "has caught the tits real bad". Was wondering how catching tits is ever bad.

JukEboX

17:28

That's to much l33tsp34k for me

@Iszi LOL no the "itis".

@Iszi urbandictionary.com/define.php?term=itis

Iszi

Kinda like the odd expression, "useless as tits on a board". I don't understand how tits could be useless anywhere.

@JukEboX Yeah, I'm not testing UD against my work proxy. Thanks.

JukEboX

@Iszi "refers to the feeling one gets after eating large amounts of food. often associated with the need to take a nap after eating"

Iszi

@JukEboX Ah. So, the itis is a precursor to food coma?

JukEboX

Correct

It's a "Blaxploitation" word if you will

Iszi

@JukEboX A what? Is that another term of endearment for @Simon's mom or something?

(Cue pls in 3, 2, 1...)

And the ex-son disappoints yet again.

CodesInChaos

17:35

@Xander It's oracle, what did you expect?

Simon

lsp

Xander

@CodesInChaos Fair point. Still not excusable.

Iszi

@Simon Too little, too late, kiddo.

JukEboX

@Iszi

Blaxploitation

Blaxploitation or blacksploitation is an ethnic subgenre of the exploitation film. It emerged in the United States in the early 1970s. Blaxploitation films were originally made specifically for an urban black audience, but the genre's audience appeal soon broadened across racial and ethnic lines. The Los Angeles National Association for the Advancement of Colored People (NAACP) head and ex-film publicist Junius Griffin coined the term, which is a portmanteau of the words "black" and "exploitation." Blaxploitation films were the first to regularly feature soundtracks of funk and soul music a...

Transcript for