« first day (1725 days earlier)      last day (3453 days later) » 
00:00 - 16:0017:00 - 22:00

00:17
@RoryAlsop you should get one of these. or 50. engadget.com/2015/09/03/…
hey @schroeder why did you reopen that question that was asking for sites for practicing hacking social networks? its a clear product recommendation request...
@AviD I thought it was something different and was trying to sync up with him
@AviD but yes, I'll close it
My recommendation to use IRC/Twitter bots to accomplish the task could have been on topic as a non-product recommendation option, but yeah - he wants a pre-made cyber range as a classroom.
@schroeder yeah, thats a nice idea! and, as you say, it's a "how do I solve this" answer and not a "give me a product" answer.
@AviD now I want to design one to include in my SelfPhish service
hehe, go for it!
HackMeBook
01:21
@AviD I was thinking more of an adaptive AI to use as a bot on existing social networks
@AviD I use an adaptive heuristic algorithm for phishing emails, and now I'm sketching notes for a IM bot ....
02:11
The Scottish pork taboo was Donald Alexander Mackenzie's phrase for discussing an aversion to pork amongst Scots, particularly Highlanders, which he believed to stem from an ancient taboo. Several writers who confirm that there was a prejudice against pork, or a superstitious attitude to pigs, do not see it in terms of a taboo related to an ancient cult. Any prejudice is generally agreed to have been fading by 1800. Some writers attribute a scarcity or dislike of pork in certain periods to a shortage of pig fodder. == Donald Mackenzie's ideas == He gave a lecture on the Scottish pork taboo in 1920...
 
1 hour later…
03:20
yay for home
bigyawn
yay for sleepses
By home do you mean the DMZ?
 
5 hours later…
08:01
Highlights of yesterday - the awesome Vulcan, the Typhoon, Red Arrows and a fun display from a Saab Drakken!
08:15
@schroeder actually thinking about it, a "fake" social network makes no sense, since the biggest part of of hacking that IS some form of social engineering...
:23914160 was that your password??
@AviD Thankfully, no. :P
Getting used to be new Razer mouse.
right, right. That was too short. Everybody knows the best password is "1234".
08:42
I thought it was "0000"
no no, "1234" is the password I have on my luggage
actually that's "12345"
Pa$$w0rd..everyone knows that is the most complex password there is.
09:21
0
Q: Bypassing Stack Exchange unique IP visits

limbenjaminStack exchange sites award Bronze, Silver and Gold badges to questions which are visited via a certain shared link by unique IP addresses. Announcer - Share a link to a question later visited by 25 unique IP addresses Booster - Share a link to a question later visited by 300 unique IP addres...

puttig this to the test
09:38
HE HAXORED OUR SYSTEMS?? MUST BE A VIRUS
09:53
@LucasKauffman off topic, should be on MSE
I VTC-ed to our meta, and it can go to MSE from there then
@AviD you know he might be a candidate for ban with that for rigging the system ... we have vote fraud ban, so why wouldn't we have badge fraud one? I mean, it's badges ... they're almost as good as photos of beer :)))
@TildalWave well, no, he is asking a security question, just happens to be using SE as an example for usage of a pseudo-security mechanism.
and the answer would be specific to SE
@TildalWave well it depends. He hasn't admitted it outright, and I dont have the tools to verify this. That said, the badge is pretty straightforward, and explicitly does not exclude his own access from different IPs.
@TildalWave that doesnt mean fraud. Suspicious, yes, but its not evidence.
@AviD what do you mean you don't have the tools? click on the link I just posted
12 secs ago, by AviD
@TildalWave that doesnt mean fraud. Suspicious, yes, but its not evidence.
10:08
why would this be considered fraud? The requirements say "Share a link to a question later visited by 1000 unique IP addresses"
@AviD well evidence will be in the logs won't it? so it's something for CMs / Devs to look into
well correction, he did just sorta admit it.
but he does have an excellent point.
What I meant was, I managed to get 1000 legit unique IP addresses, but there wasn't an actual user behind each IP. This defeats the purpose of the achievement, which is to share the question with a 1000 users and not 1 user behind 1000 IPs. — limbenjamin 16 mins ago
No where does it mention that there needs to be an actual human being behind each IP?
@TildalWave yes, exactly.
yes, but this is meta, not a general question that we can answer in a general sense
10:08
@limbenjamin oh hai
it's too broad as such
did you read the question?
@limbenjamin I agree. It is explicitly vague, though admittedly the intent is obvious.
10:09
> Other than unique IP addresses, is there a better indicator to track unique visitors?
and the answer is: depends
@TildalWave ah, true.
so he would need to provide more context - which he kinda did, using SE as an example.
which then makes it SE meta
look, I agree that this is not a great question - and I suspect @limbenjamin was using this as a sneaky way to raise this issue. Amirite? ;-)
but it is also a infosec related qn, which makes it sec se
as in, report a bug, file a complaint, beg for forgiveness, whatever :)))
10:11
i think its a legit problem we are likely to face very soon.
@limbenjamin the infosec one that doesn't pertain to SE specifically is too broad
ipv6 addresses are handed out like free.
@limbenjamin Nice to see a fellow Singaporean. :)
Also, who the fuck cares? It's just badges.
oh hi.
@TildalWave if the name of the site was different, would it bother you?
@TerryChia yes, but SEI does tend to take manipulation of the gamification elements quite seriously.
10:14
@AviD They didn't for hats. ;)
Also, pretty difficult to do anything about this unless they want to restrict it to registered accounts.
well.... to some extent.
@AviD I'd vote to close as too broad :P
@limbenjamin you used ipv6 for it?
@TerryChia exactly
there was an uncomfortable conversation about that one year...
@TildalWave why? too localized, if anything ;-)
might or might not have done it. how do you prove it was done by me
i can easily sabotage someone else by boosting their badge count
the share URL is not exactly randomly generated
10:16
also, I'm not sure how much that is really outside the rules, even if outside the intent.
@AviD Damn it, OK now tell me, how many ways can you think of that this could be done on any platform, specific or not? Because I can think of so many ways how you could scrutinize it so your bollocks fall off, mine would fall of just listing them.
@TildalWave it's not about a list, though, which I agree would be too broad.
could they check credential? sure. could they check if the page actually rendered? sure. could they check for suspicious increase in visits? sure. .........
it's a pretty generic question, really, doesnt need to be specific: how can I uniquely identify users that might be anonymous?
you can't
which makes it really broad
because you have to opt for the next best thing
which can be kinda whatever fits
10:20
a proper answer could get into tracking cookies; graylisted ips; split paths for registered users; geolocation; or the very concept of "unique identity".
@TildalWave I don't disagree - it's a tricky question.
lissen, I agree with you that as the question stands, it is a poor fit.
but there are really two posts there in one: 1. I hacked the badges! 2. Btw how could we uniquefy anonymous endusers?
well you know how it is with tracking .... I mean, let's just mention EU cookie law here, shall we? :D
@TildalWave Theoretically you can't. You can in practice most of the time.
if that was cleaned up it could be a good question, if there is no great answer.
@TerryChia that was my point
but means of achieving that will be different, system to system
okay then, lets take this specific example of hacking SE's IP badges. Let's crowdsource a better solution then, shall we?
10:22
@TildalWave And? Still a good question.
@AviD to the kickstarter?
@AviD Rollbacks when you see abnormal activities. Don't need anything more sophisticated. It's just freaking badges.
@LucasKauffman To the kickstarter!
To the Batstarter!
ooo okay new idea for a startup: sasme exact thing as kickstarter, but Batman themed.
@TerryChia you didn't say that for my FCrDNS question, which is more specific, and could be one of the ways of achieving this :P
@TildalWave Your what now?
10:24
JUST so that people can exclaim: "TO THE BATSTARTER!!"
I have not been actually looking at the main site for about 6 months now.
6
Q: Should content delivery depend on FCrDNS (forward-confirmed reverse DNS) look-ups and why?

TildalWaveFirst, let me clear that this isn't a duplicate of Does deliberately wrong information from a DNS server violate standards generally accepted good practices? thread, as I'm not interested in legal aspects or DNS standards, nor ISP best practices. That is not my concern at this moment, and while m...

@Terry Chia not necessarily. If it hits reddit front page, it goes viral and will definitely be flagged as an abnormality, although it is legit traffic
@limbenjamin true, but if that happens 47 times in a month, that is more abnormal.
I asked that with a different intention, but it is a way to check for same IPv6 tunnel
combine that with request rate and voila
10:25
@limbenjamin Best part about Stack Exchange is that you can always yell on meta if something isn't right and they can fix it.
UNLESS you happen to have a huge following. Like @codinghorror. Or JoelS. Or Troy Hunt.
I don't have a solution to the problem. For too long, we have been stuck with the mindset that unique IP = different person
Question: Is paying people on Mechanical Turk to visit my share URL considered legit or not?
Damn but we should get Taylor Swift on here.
@limbenjamin I very agree with this.
@TerryChia right?
@TerryChia it's definitely not sanctioned if that's what you're asking
10:27
@TildalWave Why not?
obviously outside the intent, definitely not outside the overly vague rules.
WHICH IS THE PROBLEM.
@LucasKauffman huh??
instead of tailor swift
DJ Detweiller
makes beautiful music
it's all about the flute
@LucasKauffman wut
I was talking about this
10:28
anyway, i didnt spend a single cent, nor did I have abuse university/company resources/infrastructure
@LucasKauffman also, lets hear some of that beautiful music. No more of that crap you just linked.
@AviD DJ Detwiller is just 100 years ahead of time
@TerryChia because it would be nigh impossible to prove the intent the way it's currently tracked... they might still invalidate those badges for suspicious number of them tho, like they do with voting
@LucasKauffman ah that explains the distortion
What standard of the test though. The intention of the law? Or the interpretation of the law. This isn't a legal court, so the burden of proof can be lower.
10:31
@TerryChia maybe a bit of a weird question, any chance you have an estimate what you normally spend on decent internet, gas and electricity a month?
in singapore, 2gbps connection for around 40USD
hokay guise - lets just let it chill. Look, either this is a bug in the spec, and SEI will handle it, or they will answer that this is an intentional loophole, and we can put this all to rest.
Either way, let's not argue about the badges, and just get creative with actual solutions.
@limbenjamin so 60 SGD? Does that come with static IP?
We dont need no steenkeen batches
dynamic IP, but sort of reserved, in the sense that when you reboot the router, u tend to get back the same one
10:32
@limbenjamin and whatabout electricity? How much do you spend a month?
hmm.. depends I would say around 100SGD a month for a household of 5
@limbenjamin that's with an aircon right?
WOW, our electricity is waaaay pricier
not 24/7, 4 hours a day
@limbenjamin seems good, might need to learn how to sleep with just a fan then
10:34
@TheJulyPlot mod message and a "until we hear from you" ban is usual means of dealing with suspicious voting activity, for example, but I don't see how that could work here, OP is here for example and we heard form him already ;) I don't think there is any standard of test, it's SE, it's whimsical :))
@TildalWave also, I think it's clear that @limbenjamin had no malicious intent, and WILL NOT CONTINUE with this, until it is clarified.
RIGHT, @limbenjamin?? ;-)
@limbenjamin so let's put like monthly expenses at about 250 including water electricity interwebs?
@AviD It's for 'research purposes'
whimsical in a sense that it often means more who's complaining than with how solid arguments
10:36
more of raising awareness, now that I think of it, there might have been a better avenue
@lu
@AviD oh I don't care about that
@LucasKauffman yea, around that ballpark
@limbenjamin how much you spend on food?
@limbenjamin uhhh yeeaahhh.... "miiiiight have been", yup ;-)
u thinking of migrating to SG?
10:37
@LucasKauffman you getting a little chummy there, eh?
food ranges from $3 all the way to couple hundred
@limbenjamin I'm one interview left and the chances are quite high
don't get creepy.
depends if you are ok with hawker food
@limbenjamin I am, but I doubt it's healthy for every day :p I don't mind cooking
10:38
@LucasKauffman you're not worried about the binge drinking ban? :)))
single or bringing a family?
@TildalWave don't start me on that, I tried calculating how much taxes I need to pay if I want to bring my beer and whisky and it was close to 400 euros :(
hehehehe
yea, alcohol/tabacco is heavily taxed
@limbenjamin single, aiming to rent a 4 room HDB flat and bring my own furniture
@limbenjamin considering the average belgian drinks 150 liters of beer a year, you can imagine this is quite painful :p
10:40
single then not worth cooking, just eat out. $3 a meal eating out vs buying ingredients and all that
I think SG is an awesome place, I really like the attitude of people. But it kinda feels like California with all those restrictions in place, and I already have that in EU
@limbenjamin I always cook for several days and then freeze it into portion boxes
@limbenjamin but I know myself :( I will eat way too much
i see. just my opinion. I did something similar when I lived in geneva. Food prices in geneva was unreasonable.
i find SG food prices to be not worth the effort to cook and all that
true that (about Geneva)
@limbenjamin geneva is crazy :p
10:42
is that a meme?
@limbenjamin true, and quite good too, but I'm just afraid I'll get too fat
@limbenjamin although the climate makes me eat a lot less
@limbenjamin transportation if you take bus and MRT? 200 a month?
$120 a month gives u a travel pass, unlimited MRT rides, up to 4 bus rides a day
@limbenjamin oh sweet
10:46
@limbenjamin: I considered that then realised I spend less than that ;p
yep, its an upper bound, per trip price is around $2
@LucasKauffman: cool ;p
I think I spend ~5 dollars a day on transport. Tho, I live relatively near where I work (Bus from home to harbourfront's ~ 5 minutes or so, then train to one north)
I'll probably living around Bukit Panjang, so one bussride to the MRT exchange to raffles
no idea on utilities, parents pay it, and its dropped drastically since we switched to LED lighting, and my brother moved out
raffles? Swanky ;p
hmm.. strange. i pay $1.70 per trip from bishan to kent ridge
10:49
yeah, MRT's awesome when it works
@JourneymanGeek in all honesty, you don't even know how good it works until you've lived in Europe, it's absolutely amazing compared to Belgium
@LucasKauffman: Oh, when it works, it works ;p
and its got great accessibility once you got used to it
When it breaks tho, all heck breaks loose cause no one is used to it not working, even now
@JourneymanGeek yea but at least they put in some busses
that doesn't happen here
if you're stuck, you're fucked
10:51
lol
@LucasKauffman coming in blind, but are you talking about @Simon's mom again?
government takes it quite personally when it happens.
12 secs ago, by AviD
@LucasKauffman coming in blind, but are you talking about @Simon's mom again?
@AviD maybe
One moment you're happily in the tunnel. Next moment its dark and you're crying for mommy....
Oh wait.
10:52
yeah, I leave for a while, come back, first thing I see is obviously about @Simon's mom.
@LucasKauffman: I've been in a bus that broke down
@JourneymanGeek Does sex always end that way for you?
rest of your ride is free (if you wait for the replacement bus) as is your next ride (in the same day)
@DavidFreitag clearly you are relating too much to this.
@JourneymanGeek See, you have made the false presumption that I was having sex in the first place.
@JourneymanGeek for some reason I do love riding the LRT, it reminds me of a roller coaster ride
10:53
@LucasKauffman I think my family pays about $200 a month for all.
@LucasKauffman: never ridden one.
But we use the air con sparingly.
$60/month for Internet is on the high side, we pay $30/mth for 200 Mbps.
@TerryChia I pay $80 for 150mb/s
@TerryChia: SH?
SH's 200 mbps is 20mbps
@JourneymanGeek M1.
10:56
buuut ipv6
I think Myrepublic's about 50 for 1 gbps
My entirely family uses M1 for Internet and phone so we get a nice discount.
ahh
SH's nicee if you want to go for internet/tv/phone at once place or want redundant connections
I'd go with myrepublic (and pay the extra for the static IP)
I spent a month in SG without AC and I thought I was going to die
It's $250/mo for HD television, phone, and 100mb/s service here.
10:58
alright whatabout phone ?
(If I move out, chances are I'm not bothering with a cable TV subscription)
Just for phone? $30/mo
@LucasKauffman Honestly, you'll get used to it.
I pay ~40 sgd for 100min/100 texts. current plans give you 2gb, but mine's 12.
I'll probably switch to the new telco when they come out.
hardly ever uses his phone outside data anyway
@LucasKauffman You confirmed coming over?
10:59
@JourneymanGeek LOL, I pay $50/mo for 512MB of data
@TerryChia I have one last interview, but so far the messages have been positive
@LucasKauffman Cool. Still with EY?
@TerryChia yep
just one last interview with their partner
and if he's happy I'll be able to come over
What position will you be here?
@TerryChia I have no idea, normally I keep the same rank, I'll normally be joining their pentest team, but I hope I get to do some GRC as well with regard to business continiouity
but that's what Ill be hearing on tuesday I guess
11:06
Nice. :)
What's the partners name? Might have heard of him.
Steve Lam
Hmm nope. Doesn't ring a bell.
Well let's see what happens I hope I get this sorted asap
@LucasKauffman Isn't he the guy from Broken Lizard?
LAM not LEMME
meh, I've heard it both ways
btw anyone here playing planetary anhilation?
@LucasKauffman is that another euphemism for your dirty games with @Simon's mom?
seriously, its like every time I look at this tab someone is saying something nasty about @Simon's mom. Cmon guys, get over this.
12:05
@TheJulyPlot no, I mean where my bed is physically located
@LucasKauffman there isn't really anything to test...
@LucasKauffman sampling a huge section of the track and then layering a breakbeat over it is not "remixing"
and then the flute starts
oh god my ears
well this is awkward
I appear to have woken up allergic to myself
._.
That would mean... it could be lupus.
Its never lupus.
12:29
@JourneymanGeek It's lupus or hodgkins
oh right, I recognize your avatar now
@LucasKauffman the only broken part about all of this that I can see is that this guy has 49x linked to 1000 people badges but has only reached 36k people according to his profile
nice math
12:54
seriously though I need to stop sneezing
13:17
afternoon all
@RоryMcCune o/
^That was my location at 10:30 this morning
Up a hill in cloud.. nice walk
bit a bit blowy
@RоryMcCune I bet you have a few clients like that
@AviD Well, your comment on "don't roll your own" is of course correct -- it always is.
@ThomasPornin hey now, that's all you're not ruling out?
and no comment on the cryptosnobs? ;-)
I bet you're just upset about the cryptosnobs comment.
Btw, you should know the cryptosnobs comment was made lovingly.
Also, I'm really liking this cryptosnobs term.
13:26
"snob" means "without nobility" which is statistically true of most cryptographers (and most everybody, really).
My main point, though, is that "adding randomness" does not necessarily implies extra security.
Conceptually, you get more security out of some extra randomness, you need the defender to know that extra random value, and the attacker to not know it.
Here, neither defender nor attacker knows the X value, so it should not change things with regards to overall security.
@ThomasPornin oh I agree. I was taking the edge case of his own mindset - thinking that it is "moar securer cuz random", I simply wanted to show him the outside possibilty of what would happen if his perception were true.
I explicitly declared that, too, and then gave a proper, if extraneous, answer.
"Speak to them in their own language" (as long you make clear it is inaccurate)
@ThomasPornin and in fact, harms overall security.
btw @ThomasPornin d'ya mind if I quote you on that thing you said about engineering and economics?
@AviD I don't mind, but I read it somewhere so I cannot be considered the original author.
kk
Actually I think I read it with "engineering", and I added "economics"
@ThomasPornin also, I could be wrong, but I dont think our answers differ substantially - other than yours being more strictly correct, and mine aiming to clarify his own mis-assumptions.
13:38
@Adi do I even want to know what you were looking for?
@ThomasPornin that's very cool, that also correlates with what you were explaining to me the other day about Makwa, scrypt vs bcrypt, and "memory hard"...
14:16
@RоryMcCune That is soooo cool, very movie-like!
@Simon aye what the picture doesn't show is the wind was howling around when we got to the top!
@RоryMcCune Creepy, love it.
Oh come on.
I like creepy atmospheres, not creeps.
^^ that's the view up to the top "The black castle" as it's called
(BTW I didn't star that :) )
14:25
Is there an actual castle?
nah they just call it that
there is a wreck of a WWII aircraft around there somewhere
Nice.
but didn't find it this time..
How far away are you from stores like groceries etc?
@Simon we have a small shop in the village (5 mins walk) for like milk and bread and stuff
but a decent ASDA (UK walmart) is about 50 mins drive
14:27
Ouch.
although, hopefully, they're going to start doing home delivery here at the end of the year!
which will be awesome 'cause it'll save me 2.5-3 hour trips every week
Yeah no kidding, it must take a whole afternoon to do the trip.
that Hill I was up this morning is just across the loch from our house though so while we don't have shops we do have like 3-4 good mountains to climb right next door
:)
Yeah that's definitely the kind of place where I'd like to live when I get older.
@Simon yeah well Canada has loads of good wilderness places to be for sure
14:32
Oh yes but it's inconvenient right now because of work and our activities.
So later on that will most-likely happen, or at least get a cottage.
@RоryMcCune it holds the black night?
@LucasKauffman pls, no one knows since you need to wear the black amulet to see the castle.
@Simon Legend has it, it is protected by several Rories
:O
@LucasKauffman dunno but in Gaelic it's "Caisteal Dubh"
the gaelic language is not one for easy spelling
14:47
@RоryMcCune is that like Scottish dubstep?
@AviD ... no
right, that would be "Steaippehh Dubh"
wow I'm like really good at languages
15:04
@RоryMcCune WOB WOB WOB
or more like
Wubh Wubh Wubh
@LucasKauffman shouldnt that be WERBLE WERBLE WERBLE
could very much be
So, I'm having to learn python.
some people here would be happy.
@AviD finally
it's about bloody time
yeah well, we needed a language schoolkids could understand easily.
15:17
blah
I said blah dammit
obey the blah
fine! I will take my presence and go elsewhere!
probably to bed
where it's snuggly
Sorry i mean blah
Hoe about pffft
and I can contort myself into weirdly comfortable positions and play Fallout Shelter
How*genuine typeo
15:26
*falloutshelterisnotaeuphemism
@kalina you misspelled "blerch"
Ineverthoughtitwasaeuphemisms untilyoupointeditout
Btw serious advice required; who has done a PhD, and how did it affect job prospects after taking N years out of the workplace to complete it?
15:41
@TheJulyPlot IIRC @ThomasPornin has one of those
but I'm not sure in what order he did it
I'm definitely the wrong person to ask, as I have but a BA degree.. in accountancy
@RоryMcCune The PhD is what you do first when you begin a career in Research
But then I went to the private sector
I believe he does, among many of his other achievements. I am under no illusion that I will ever match his achievements.
@ThomasPornin where there is some semblence of good pay :)
The PhD is not important in itself; what matters is what you learn while you are writing it.
See I think my motivation is wrong, I want it for the achievement of doing it and possibly to change paths to lecturing.
Although I have a thirst for knowledge and a lot to learn.
15:45
Ah, if you want to enter the Academic world then there is no choice; you have to comply to the Tradition.
I currently have a 3 years funding for a studentship, and turning it down is proving vwry difficult, as I would have to quit my job.
You want to learn and you get money to have time to learn. What's difficult in that choice ?
Just remember that Academia will make you knowledgeable, not rich.
Because it is a lot less money than I get now, I have a job in security already and I would have to give that up.
Im not motivated by money...I want to do the PhD, i just need to get the courage to hand in my notice. PhD starts on October the 1st and may have to spend 6 months on gardening leave, so there may be complicating. Thank you for the advice. I think I may have just made the decision.
Thank you as well Rory. :)
00:00 - 16:0017:00 - 22:00

« first day (1725 days earlier)      last day (3453 days later) »