The DMZ

TildalWave

17:00

why does google only return crappy images of vision? there's so many awesome ones

better

000

lame

TildalWave

your nick is lame alright?

you don't get to call anything else as lame until you change it back

000

lame

000

17:20

1

Q: Is there a name for this flawed way of thinking about security?

I've recently encountered a developer who thinks that she can implement security on the client end of a web application. Breaking the security is as trivial as reading a few lines of Javascript and changing a URL. In other words, the "security" of the application is entirely a facade. I know t...

^ ovid nuke this already

AviD

@TildalWave ooh maybe I will modabuse him to change his name. to @Lame.

000

And this Steve guy always argues like a mong.

Mark Hulkalo

Abuse him.

TildalWave

@000 "incompetence"

Lucas Kauffman

@AviD why do you need this big 4 stuff?

TildalWave

17:30

so he can cast big 4 spells?

oh shit stuff not staff

David Freitag

@AviD Speaking of name changes, @000 is waiting for you to abuse the system and change his name back.

Iszi

When are people going to learn: Just because someone's not in the office doesn't mean they're not working and available. Try calling/e-mailing/IMing them if you've got an issue with something they're doing/did before bugging other people in their department!

Ohnana

17:46

@RоryMcCune ew keep it away from the kernel

Rory Alsop

@AviD bonuses instead of a raise mean you aren't then fixed in paying the employee all the additional things that come with a salary raise. So much lower risk. Bad year = no bonus, as opposed to bad year = oops, can't pay salaries, you're all out of a job

JukEboX

Guys is the NORSE map down?

map.norsecorp.com/v1

000

downforeveryoneorjustme.com

JukEboX

The site is up @000 but the data isn't flowing

wondering if it is my work net or the site

Rory Alsop

@000 I added the final vote. And pointed him at the english.se post on it

000

17:54

Cheers.

TildalWave

@Iszi heh I even had the opposite experience and had to keep skype on when I was at the office because others would assume I'm not and try to contact me at home :)

@JukEboX wow there's an insane attack going on right now

Ohnana

PEW PEW

TildalWave

someone is heavily DDoSing someone in NY

Ohnana

saudi arabia is also seeing a huge uptick in activity

Rоry McCune

@Ohnana which appears to be going from Saudi to saudi, and given this looks like port scan activity to me, it's probably someone's annual VA scan :op

Ohnana

18:07

lmao!

how does norse pull this data?

TildalWave

probably packets off some backbone

Rоry McCune

I'm guesing they get IDS sesnor feeds from places

it looks like NIDS stuff

source-->destination-->port is the kind of info. SNort or simialar would record

TildalWave

possible but I doubt it, would they get data from Saudi Arabia then?

what about backbone routers?

Rоry McCune

@TildalWave well if they can get feeds from Saudi backbone routers, I don't see why they can't get it from nids

if they get it from routers how do they determine "attacks"

usually some kind of security device would make that distinction

TildalWave

@RоryMcCune not Saudi backbone but international traffic like Hurricane Electric et al.

@RоryMcCune load?

Rоry McCune

18:12

@TildalWave well the traffic we were discussing there was saudi-->saudi, so didn't come from an international backbone

@TildalWave large quantities of traffic does not intent create (apart from in DDoS land)

TildalWave

@RоryMcCune ah yes true even if it's not from IDS it's collated by IDS-like algo

Rоry McCune

"Norse Intelligence Service combines an automated, globally distributed network of intelligent attack sensors – the Norse Intelligence Network – and sophisticated, actuarial-based risk scoring with human counterintelligence expertise."

so it's either data from their customers aggregated, and/or data from appliances they have agreements to place with providers

TildalWave

ah there you go then

I was wrong

so what else is new? :D

Iszi

@TildalWave Easy fix to the "try to contact me at home" issue: Don't give out your home phone number. Have your desk phone forward if not answered.

TildalWave

@Iszi They don't, I have a work number they call.

Rоry McCune

18:18

#Connect2015 @shanselman Visual Studio lets you deploy your http://asp.net 5 to Docker on Linux https://t.co/xypUxVgygq

Tweeted by chanezon on November 18, 2015 at 3:20 PM

^Heyyyy @AviD how happy must you be now :op

Iszi

If y'all could give this question some love, it would be appreciated.

2

Q: How to update Server 5 to TLS 1.2?

In the latest version of Apple's Server software (5.0.4) with El Capitan (10.11), SSL websites use TLS version 1.0. But, as one Ivan Ristic says, « The bottom line is that TLS 1.0 is insecure and we must migrate away from it ». How to achieve that with Server 5?

mac osx-server el-capitan apache openssl

Ohnana

1. stop using a mac as a server

3

2. sudo yum install openssl-*

Iszi

@Ohnana OpenSSL is built-in to the OS. And they're using the 0.9.8 branch.

Ohnana

@Iszi refer to step one

Iszi

@Ohnana Hey, if I had a choice...

Ohnana

18:21

@Iszi i see. go to step 3, drinking your sorrows

2

Iszi

@Ohnana It's only 13:22L

Ohnana

i didn't specify the time dawg

TildalWave

@Iszi we have an unwritten rule that if I'm not available via skype then I shouldn't be disturbed ... I didn't even know about this "rule" but apparently I was so upset once over phone that nobody dared call me on it any more LOL

Iszi

@Ohnana i.e.: I'm still in the office.

Ohnana

@Iszi mix it with decaf

000

18:23

@Iszi You don't always work remotely?

Rоry McCune

It's never to early for a FUSILIER!

►

Iszi

@000 Only about 20% of the time, give or take.

000

o

David Freitag

18:37

@Ohnana Wait, apple makes servers?

Ohnana

@DavidFreitag yeah, i had to do forensics on one

it's basically a mac with an apache clone

David Freitag

@Ohnana pukes

Ohnana

it's shit

Iszi

Man, when did the Comms Room die? That place used to be packed!

@DavidFreitag Dunno if they're still actually making servers. They don't even make a server OS any more - Server is now an app you load on top of vanilla OS X.

David Freitag

@Iszi Oh god that sounds awful.

Iszi

19:24

@DavidFreitag In certain regards, it makes sense. But at the same time, there's surely going to be stuff in a normal OS X build that you wouldn't want/need on a server.

Ohnana

like OSX

Iszi

Kinda reminds me of how I wish I'd see Server Core used a bit more often. But then, I'd probably be a bit lost myself - gotta learn some more about how to get around without the GUI for some things.

Rоry McCune

@Iszi pls server core is old-school, you want nano!

Ohnana

@RоryMcCune PURGE THE HERETIC

Rоry McCune

@Ohnana wait, who's the heretic here, me or him?

Ohnana

19:32

@RоryMcCune NANO IS AN AFFRONT TO THE EMPEROR.

Rоry McCune

@Ohnana it is

Iszi

@RоryMcCune This?

Arduino

Arduino is an open-source computer hardware and software company, project and user community that designs and manufactures microcontroller-based kits for building digital devices and interactive objects that can sense and control objects in the physical world. The project is based on microcontroller board designs, manufactured by several vendors, using various microcontrollers. These systems provide sets of digital and analog I/O pins that can be interfaced to various expansion boards ("shields") and other circuits. The boards feature serial communications interfaces, including USB on some models...

Rоry McCune

?

Ohnana

@RоryMcCune THE GOOD AND HOLY FOLLOW THE WAY OF VI

Rоry McCune

@Iszi nonono, Windows Server Nano

Iszi

19:33

@RоryMcCune Zefuq are you talking about?

Rоry McCune

@Ohnana blogs.technet.com/b/windowsserver/archive/2015/04/08/…

Ohnana

awww you ruined my space marine rant

Rоry McCune

@Iszi blogs.technet.com/b/windowsserver/archive/2015/04/08/…

Ohnana

hmm i'm going to go hurl

Rоry McCune

wow you kids are out of the tech loop

windows server nano is the new App Hosting hotness

that plus a bit of docker and your sorted.

Ohnana

19:34

oh look it's docker MS style that thinks it's a server

Rоry McCune

96% less attack surface than full windows server

Iszi

Damn, no console login at all?

That's some shit, coming from Windows.

Dropping 32-bit support too? Nice.

Rоry McCune

Inorite

it's like hard-core

Iszi

Wait, are they dropping Server Core for this?

Ohnana

whoa did MS finally make a decent secure platform?

Rоry McCune

19:35

@Iszi I think this is in addition to

it's pretty new and AFAIK not all Win APIs are supported on it

e.g. blogs.technet.com/b/nanoserver/archive/2015/11/16/… you need a tool to tell you if your legacy app will work on it

@Iszi blogs.technet.com/b/windowsserver/archive/2015/11/16/… is a more up to date bit on it

TildalWave

it's dropping 32bit support

Rоry McCune

@TildalWave faster than an EDM artist drops the bass

000

@Ohnana That'd be a bold claim, sir.

Ohnana

@000 i know. then again, 96% could just be the law of big numbers at play

96% of a million is significant :P

TildalWave

@RоryMcCune well that's a good thing if you're starting from scratch but really not as pressing upgrade if you have legacy code as it was from 16 to 32 bit is it?

I mean let's face it, 64 bit support is still required only in niche cases

Rоry McCune

19:40

@TildalWave oh no, legacy stuff I doubt will make in on there, but it's a nice option for new apps

Iszi

Okay, I'm really feeling out of the loop now. NAP's been deprecated? In favor of what? Or did they just kill it?

Rоry McCune

@Iszi NAP, NetworkAccessProtection?

Iszi

@RоryMcCune Aye, but I think with spaces

Rоry McCune

I recall thinking that there had been a clear out on the security product side

but not sure I ever dug out details

TildalWave

welcome to 2013

NAP was already dropped in 2012 R2

Iszi

19:47

@TildalWave Deprecated, not dropped.

Does anyone actually use Server Core?

TildalWave

@Iszi potatoes potatos

Iszi

@TildalWave No, "dropped' means it's no longer there. "Deprecated", apparently, means it's there but you're not supposed to be using it.

TildalWave

so my missus' nightstand's top drawer is deprecated?

Iszi

> Network Access Protection (NAP) is deprecated. Other options for keeping client computers up to date and secure for remote access include DirectAccess, Windows Web Application Proxy, and various non-Microsoft solutions. technet.microsoft.com/en-us/library/dn303411.aspx

Thomas Pornin

@RоryMcCune What I find most probable is that they register connection attempts from the outside, on ports that are either blocked on the router, or are simply rejected by the target server.

Calling this type of activity "attacks" stretches the definition.

000

19:55

allo

David Freitag

@Iszi I don't think anyone else but me in this room will know what that is

000

@DavidFreitag pls, we all know what it is because of you.

David Freitag

@000 Suresure

Ohnana

@DavidFreitag it's an arduino. they're a staple of hobbyists and school projects

David Freitag

@Ohnana You're a staple.

000

20:03

fkin rekt

Iszi

@TildalWave Ok, rephrasing: "Deprecated" means it's there but nobody's supposed to be using it.

Which usually means everybody does. Like @Simon's mom.

TildalWave

yup, still my missus nightstand's top drawer :)

000

Who's @Simon?

You guys sure talk about him a lot.

Iszi

@000 No, we mostly just talk about his mom.

000

whatevs

David Freitag

20:05

@000 Oh just some foolish young lad. He enjoyed running around naked tightly gripping his ween.

Iszi

Used to keep waving it in @kalina's face too, until she threatened to burn it off.

000

pls my ween is surely immune to fire.

Iszi

Now that would be a feat: Surgical removal of penis by liberal application of fire.

David Freitag

@000 Yeah, it's so small that due to the principles of uncertainty the fire could never know exactly where your ween is to burn it.

000

THAT IS NOT HOW IT WORKS

Rоry McCune

20:08

@ThomasPornin yeah that's fairly plausible given that when I was watching it, there were no "attacks" on 80 or 443, presumably as they're allowed

@000 hint, if you get a burning sensation in your ween, it may not be because it's on fire....

@000 and I might recommend seeking medical advice

David Freitag

@RоryMcCune Yeah, he got that little surprise from his mom.

Iszi

@ThomasPornin No, it just omits an adjective - "attempted".

000

There was some dude on reddit explaining how he things were getting kinky with a gurl then suddenly she jumped on his ween and then on the next day he had herpes.

I feel like I would want to kill myself.

David Freitag

@000 The correct response that is to want to kill her, not yourself.

Self harm is never the answer. Always harm others instead.

000

plsssssssssss

You can NEVER have unprotected sex again.

Rоry McCune

20:12

@000 if you got herpes? seems a little OTT as a reaction.. I recall hearing about a guy back in the day who used to book himself appointments at the STD clinic in advance as he knew he'd be back

@000 tell that to Charlie sheen

David Freitag

@000 I'd have to be having sex in the first place.

RIP chat

Mark Hulkalo

Herpes in 1 day?

I doubt it.

000

I got too many responses in a short lapse of time, I didn't know what to say.

It caused a brain overflow.

@MarkHulkalo wot?

Mark Hulkalo

@000 You can't get herpes in one day.

David Freitag

Oooh maybe if we keep overrunning @000's buffers we can exploit an RCE and eat his lunch.

000

20:15

@MarkHulkalo I'm sure you can.

Mark Hulkalo

Well, you can, but it won't show the next day

It doesn't work that fast

000

Ah I might have made that part up.

David Freitag

@000 That shit takes time to fester.

Mark Hulkalo

Besides, he could have a yeast infection which mimics herpes

000

WHATEVS YOU UNDERSTOOD THE STORY

Mark Hulkalo

20:15

NO I DIDN'T

David Freitag

@MarkHulkalo Wait dudes can get that too?

Mark Hulkalo

@DavidFreitag Yeah. It burns like herpes.

David Freitag

THANKS SEX ED, I LEARNED SO MUCH

Mark Hulkalo

You gotta clean yourself

Mostly uncircumcised guys get it

David Freitag

@MarkHulkalo With bleach and ammonia. At the same time.

Mark Hulkalo

20:17

But if you have, uh... sex fluids on your ween, and you fall asleep instead of washing it... you could probably get it bad.

David Freitag

HALP HALP MY JUNK TURNED INTO MUSTARD GAS

000

@MarkHulkalo wat

Mark Hulkalo

source: lived in rural China for a bit, uh, studying... yeah, that's it. I was studying something. And there was no running water or electricity.

Went to a pharmacist and they gave me some cream, and it went away in a day

David Freitag

@MarkHulkalo You were studying the male yeast infection.

Mark Hulkalo

Spent a few weeks in the deep countryside for a wedding

David Freitag

20:18

@MarkHulkalo There was no electricity or running water, but they had a pharmacist?

Mark Hulkalo

Right. I had to travel for about 4 hours to get to the pharmacist.

David Freitag

@MarkHulkalo huehuehue "In the deep"

000

rolling in da deeeep

Mark Hulkalo

Yeah, took us 5 hours by bus, then we switched buses... took 2 hours. Then we switched buses again (midget van), and drove for another hour.

Ohnana

@000 herpes is controllable. it's one of the lesser evils of STDs

Mark Hulkalo

20:19

It's evil. I'm proud to be clean

BECAUSE I'M NOT A HO

Ohnana

also if you're having unprotected casual sex, please come to my house so i can slap you upside the head

and then fill your pockets with rubbers

000

@Ohnana Would you like to have an herpesic (lol) ween in your ween hole?

I SURE WOULD NOT AND I DON'T EVEN HAVE A WEEN HOLE

Well I do but not the same kind, y'know.

Ohnana

@000 if it was wearing a ween coat, and they weren't in an outbreak, sure

Mark Hulkalo

I have unprotected sex all the time

000

Yeah but ween coats suck.

Ohnana

20:20

i'd also use gloves too

000

And wouldn't put it in your mouth hole.

Ohnana

again -- condoms and clear skin

000

Condoms: ruining your sensibility since 1954.

Before 1954, sensibility didn't exist

Mark Hulkalo

You can get antibiotics over the counter without seeing a doctor in China

and pretty much everything else, including viagra

not that I needed it.

Doing my part to contribute to drug-resistant superbugs!

Rоry McCune

@000 pls sense and sensibility (and zombies) is set way before 1954

000

20:23

I'd like to try viagra once.

kalina

well you'd need to get laid once in order for it to be worth it

Mark Hulkalo

Ouch kalina

you're brutal

David Freitag

@kalina That's not true, Viagra can prevent a pulmonary edema.

kalina

is that what you tell yourself?

Mark Hulkalo

I read that as enema

the cringe is strong

Rоry McCune

20:26

@MarkHulkalo well either that or she was making a pass at him...

000

pls kalinuh I live with my donut

I get laid 24/7

399 days per year

David Freitag

@000 Sex with a boston creme doesn't count.

000

all

Iszi

@kalina His hand doesn't count?

Mark Hulkalo

@RоryMcCune Better run away quick

David Freitag

20:28

@kalina If I were at an extremely high altitude with no source of oxygen, then yes, I'd take one in the hope that the raging erection could save my life.

2

Rоry McCune

@MarkHulkalo it was him she was putatively making a pass at ... not me. I'm old enough to be her father

David Freitag

@RоryMcCune Some chicks are into that though

Iszi

@RоryMcCune I thought he meant run away to avoid the repercussions of implying that @kalina might make a pass at @000.

'Cause I'm pretty sure there's lots of fire involved.

Rоry McCune

@Iszi ahh I see. I'm safe on that score, Scotland is a) cold and b) very wet at the moment, @kalina won't venture near here, and it's too soggy to burn

Mark Hulkalo

"too soggy to burn"

That's the most British/Scottish thing I've ever heard

Thomas Pornin

21:08

Has somebody here already installed the last upgrade to Windows 10 ("threshold 2") ?

My VM decided that it was the thing to do. It went through a lot of progress bars (well, circles), 2 reboots, and now it seems stuck on the "we've got some new features to get excited about" screen.

Am I just hasty ?

Rоry McCune

@ThomasPornin I've not been forced to do that as yet, so leaving it be for the time being...

Thomas Pornin

@RоryMcCune Apparently you do not have any choice, except deactivating all updates.

Rоry McCune

@ThomasPornin handy, I must just be further back in the queue than you...

Thomas Pornin

I can see from the outside that the VM is working but is not stuck in an infinite loop (CPU raises to 200% -- I gave two cores to the VM -- but does not stay continuously there).

Ohnana

@ThomasPornin woooow

talk about user hostile

Thomas Pornin

21:18

Mmh, I inadvertently killed it. But after a reboot, it seems fine.

The search bar now displays a message: "I'm Cortana. Ask me anything."

Iszi

@ThomasPornin That's new? Thought it was standard for Win10. (Caveat: I haven't upgraded yet. Waiting for holiday break.)

Ohnana

"do you know what a user experience is"

Iszi

@Ohnana What rock have you been hiding under? Forced updates on Win10 is old news.

Ohnana

@Iszi a cozy unix rock

Iszi

You need Pro or Enterprise versions of Win10 to have any amount of choice. Even then, it's not as granular as it used to be.

Gilles

21:21

@Ohnana that's when someone forces you to meet a user. <shudder>

@Iszi s/10//, it's been there since what, vista?

(trying to remember when the phenomenon started of people having to remove the battery at the end of a meeting because their laptop just wouldn't shut down)

Thomas Pornin

@Iszi Dunno. Maybe it displays it only the first time after a major upgrade.

Iszi

21:39

@Gilles Um, no? Until Windows 10, an Administrator could upt-out of certain updates, apply updates manually when desired, or disable updates entirely.

Since Win10, options are far less granular - and the options that do exist do not include a full opt-out in most cases.

Ohnana

jayzus christ this company owns a fuckton of tiny 3 address blocks and it's making footprinting really fucking annyoing

Gilles

@Iszi Ah, I see. Ordinary users were not permitted or not competent to stop updates in earlier versions.

Iszi

@Gilles Well, for most consumer systems, the "ordinary users" are also the Administrators. The distinction is generally only important in business environments.

Gilles

@Iszi I've seen that with people who had corporate laptops, so they were probably not admins (or if they were they wouldn't have known what to do anyway) and it might have been due to some (rather common) administrative policy.

Iszi

(Feels like) Stupid question: Why would nmap -p - only output one closed port, when nmap -p # (where "#" is a known-open port) shows there's something open?

@Gilles Yeah, most corporate systems won't let users manage their own updates. Sensible admins will try to schedule the operations during off-hours. But if the system hasn't been online in awhile, it might get it forced regardless.

For my workstation, there's a period usually from around 09:30 to 11:00 where it's pretty much useless because it's doing an inventory check-in and applying updates. And at least one day a week, I'm prompted to reboot in the middle of the day so that it can finish updates. I guess the admins don't expect us to leave our systems on overnight (or know how to configure them for WoL).

Ohnana

21:50

my laptop is managed by intune, and it loves to update at random times

Iszi

22:52

1

Q: Why would "nmap -p -" miss an open port?

I ran nmap -p - against a system that I knew to have at least one listening service. The only output that was returned was for port 113 (ident), which showed "closed". I ran nmap again, but this time used nmap -p # (where # is the port number of a known-open port). This time, Nmap showed the por...

nmap

Gilles

23:34

@Iszi wireshark, capture network traffic, look at what that command does

kalina

@Iszi because NSA

Transcript for