« first day (1854 days earlier)      last day (3324 days later) » 
01:00 - 20:0020:00 - 00:00

01:47
@ThomasPornin Excellent. Thank you.
 
2 hours later…
03:49
@Xander
0
A: Is reskinning work computer desktops a practical security measure?

XanderNo, it is not a practical security measure. I'm not going to speculate on the specific case you mentioned as I don't have all of the facts, but there are a couple of more generally relevant points. First: Attackers do not determine which attacks might work based on the desktop chrome. They'...

@MarkBuffalo Yes?
I have no idea how anyone could come up with that kind of thought... but it's definitely interesting.
@Adi yes
Reskinning Windows 7 to look like Windows 2000 to foil hackers? Heh.
@MarkBuffalo Yeah, it's a bit of a reach.
03:51
@Xander It's funny
@LucasKauffman Ha, well, yes, that too.
04:05
That's thinking outside the box, though.
I like that.
Some might say that rolling your own crypto is also thinking outside the box, and you know how we feel about that.
Of course. :) But he's taking the necessary steps to overcoming his ignorance by posting about it.
Yeah that and the public ridicule
A little humility goes a long way.
@MarkBuffalo s/humility/humiliation
04:08
Ha, well they are often close.
Ghost in the Shell it the best show ever.
Only saw the movie, I think
@MarkBuffalo Which one, there are three
and now I am watching Star Wars: The Clone Wars. Such happiness.
@DavidFreitag No. Cowboy Bebob.
04:10
@DavidFreitag The first one.
I like Cowboy Bebop as well
@Xander Only reason why that's not #1 is the number of episodes
Also because GITS is so much better
@DavidFreitag The music more than makes up for the brevity.
@Xander While that's true, I'm looking for a good show, not a good soundtrack
The Bebop movie was fantastic though
Try Star Wars: The Clone Wars
I watch it with my baby girl
Try Star Wars: The fellowship of the ring
@MarkBuffalo All of the butts to be hurt over that one
Yep.
I dated a girl who flipped on me for butchering a Tolkien quote
She was nerdier than me. Fanatically nerdy
@MarkBuffalo Ya don't say
You know me, I'm a super nerd... but she was on a whole 'nother level. VY Nerdis Majoris.
Yeah well at least your super hero name isn't Toe Man
04:23
So I submitted those responses we talked about.
:|
Well, hopefully the police don't show up at your house
If you end up in a padded room, don't dwell on the fact that I told you so.
Also, I think you made a critical logic error.
I'm about to make a critical sleep error
or awake error
Good night, David
Lightweight
Scared Poopless – LTE and your laptop: intelsecurity.com/advanced-threat-research/content/…
 
2 hours later…
 
3 hours later…
09:13
morning all
@DavidFreitag @JukEboX go to sleep the two of you
not necessarily together tho'
just in general given it's $late-O'Clock in the US now
:)
heya
09:31
watcha'
watcha' @RoryAlsop how's tricks?
09:50
Good morning. Busy busy busy
Laughing at trend micro, y'know, the usual
10:01
@RoryAlsop that was hilarious
although really it's disturbing that that level of incompetence is legal in a software vendor in 2015
shows how "self-regulation" doesn't work
10:47
the best part is it's actually a security product
11:07
yeah even with my level of hardened cynicism, the idea that a security company are shipping products in 2015/6 without doing security architecture reviews or security testing is a bit of a shocker.
 
1 hour later…
Adi
Adi
12:24
Have they issued a statement yet?
Adi
Adi
"ActiveUpdate technology"
:|
Technology
12:45
Heh - on the mods list, it turns out I'm the only mod across the whole network with two names :-)
That amuses me even more than being the mod who slightly breaks formatting of the list by needing 2 lines.
This morning is a simple pleasures morning
Adi
Adi
@RoryAlsop From where have they fetched the name value?
From the sites I mod - so the performance sites have me as Dr Mayhem, and the others as Rory Alsop
(I liked Whence, btw)
Adi
Adi
13:06
Are these two full of poop?
AFAIK, these were resolved ~ 8 years ago
@Adi Resolved 8 years ago? And they're still there? :P
Adi
Adi
@MarkBuffalo I'm looking for confirmation that these CSRF attacks are indeed applicable.
Maybe they made a comeback.
Adi
Adi
Which Is why I'm looking for confirmation
I can't find anything on that
So either these two have 0days, or they're full of poop. So far, it seems they're full of poop
New Engineer has problem with code base... checks out latest version, but the oldest version of another file... and hacks it up to work. Exploit makes a comeback.
Adi
Adi
13:10
This is almost groundbreaking since many (maaaaaaaaaany) internal applications do anti-CSRF with referer and X-Requested-With checking
1 min ago, by Adi
Which Is why I'm looking for confirmation
Yea
I'm just stating a possibility of how it could come back.
Adi
Adi
Of course it's possible
'cause I've seen that happen before T_t
Adi
Adi
It's possible that someone intentionally added it
It's possible that it's a new feature
It's possible it's a fix that bugged an old fix
Yar.
I like to think about these things
Looks like I'll be busy at work for a bit. Sweet.
Adi
Adi
13:12
We're all glad to hear you're getting busy.
ESL speakers problems :D
13:27
@Adi yeah to me these statements read as "if you have some horribly vulnerable old adobe products this is easy to exploit" however if you're doing that and the attacker can get you to run content, he'd just pwn you and not much about with Trend...
hello brother nailgun of reasoned discussion
Adi
Adi
@Ohnana Please mind the capitalization. Very important
@Ohnana I generated one for you, Brother Crimson Fire of Mercy
hELLO bROTHER nAILGUN oF rEASONED dISCUSSION
oh sweeet. even as a terrorist i'm a big ol' softy
Hi guys
And gals
You can decide what you are
13:46
o/
@Ohnana
Sup
how is your face
I need to do a website redesign and upgrade
I need more time >_<
Adi
Adi
Hey.. heeey there boy.. are you looking to buy some.. uhh.. some time?
I can't find a suitable drug dealer kind of picture for a guy hiding in bushes
@Adi lol. First 10 minutes are free right?
Adi
Adi
13:56
@JukEboX That's how they get you
@Adi yeah I know
aannd now I'm listening to Time is on my side
MS16-007 CVE-2016-0019 Windows RDP Security Bypass http://www.youtube.com/watch?feature=player_embedded&v=86_Qh_X5l5k http://eromang.zataz.com/2016/01/13/ms16-007-cve-2016-0019-windows-rdp-security-bypass/
^probably not very serious , but an amusing bug all the same
Adi
Adi
@RоryMcCune The dude has a lot of PoC videos
a lot
@Adi oh yeah 114 pages... that's a fair few, eh!
14:24
Zzzzz
Adi
Adi
It would really be nice if, in one's final moments, you get some stats on how many times you were pwned by a 0-day
Oh, and Captcha stats, like success rate or time spent on them
@Adi a fallout new vegas style death slideshow would make me so happy
"The Claymore of Moderation"
you know, I am a UU in real life... I feel like i should introduce myself like this at the next coffee hour
15:04
LOL Fortinet is boned
more like their customers are boned
Adi
Adi
@Ohnana We know you are, Brother Crimson Fire of Mercy
or, BCFM
Adi
Adi
@Ohnana Did you their response? :D
@Adi "it's not a backdoor, it's an authentication management issue"
yeah no shit sherlock it's an auth issue
WHO PUT IT THERE?!
either you're working for the agency of 404 or you hired idiots. pick a sword and fall on it
Adi
Adi
15:14
One thing annoying me is that I can't get the exploit code to work on the FortiOS 5.0.4 I have
16:01
Who am I? 1- I'm dead 2- People use me to exchange messages 3- I'm also good at creating drama
the hardest part of these riddles is thinking of something that's not a person
the "I" throws me off every damn time
pls it's not even hard
@Simon TWSS
o pls
@Simon Blackberry
16:07
No!
@Simon what they are like le dead are they not
Yes but that is not what I had in mind.
@Simon is this going to be a football answer?
Hell no.
You're already thinking waaaayyy too far.
@Simon pls I just thought it was a reference to the recent story about cops hacking PGP blackberries
but then I realised that was a little too on-topic for you :op
16:09
soz not dat clever son
4- I was the first to witness the pls dance
wat
@RоryMcCune 10/10
Should be a gif.
@RоryMcCune thankfully i am in my school library and no one minds me laughing
@Ohnana Except that guy who's been staring at you for an hour now, he likes it.
Adi
Adi
16:20
@Simon everyone is looking at their phones
@Adi 11/10
The slowmotion on iPhone is too slow IMO.
Adi
Adi
Speaking of Nordics and winter
It should be a tiny bit faster.
Hehehe
Adi
Adi
Personal space
16:22
Always appreciated.
@Adi that's probably 'cause finns don't feel the cold too...
@Adi your country is so awkward
@Ohnana I like finnish people
they're a nice polite bunch
@RоryMcCune i didn't say they were unlikable
they're just awkward snow creatures
Are we snow creatures too?
16:29
yes it must be an interesting mix of cultures to compare with middle eastern ones where that form of awkwardness isn't common
@Simon nah, canadians are just "nice"
o
@kalina Stop looking at me like that.
@Simon that's not necessarily a bad thing tho'
@Simon I think @kalina is just lurking
to avoid procrastination in here
procrastinawat
we've actually seen less of quite a few people... I reckon there's some new years resolutions at work here
even the tigger is less evident than usual
New years resolutions are dumb.
Why do you need a new year to do something better with yourself?
16:35
@Simon I think it's seen as a useful point of reflection
Compared to the rest of the year where you should not take time to think?
@Simon well if we're going to be all logical about everything :op
Summer "#yolo"
Winter "I should be reasonable"
@Simon i'm doing a resolution every month
@Ohnana Now that's better.
16:37
so far january's is stalling, but i have time
It's ok, you can blame it on not wanting to join the bandwagon.
my resolution this month is 5760x1080
lulz
Mine is 1920x1080, simple, effective and honest.
hopes nobody asks how a screen resolution can be honest
@Matthew oi lad, fancy a lil cup of tea?
@Matthew see as topics go resolutions is probably one of the more on-topic things that comes up
Tea, hot chocolate, all good...
16:53
@RоryMcCune I would have a resolution, but it gets complicated with multiple monitors, all of differing heights...
@RоryMcCune lol, buzzkill!! :b
@Matthew yeah I was thinking about the question and it goes something like 1920x1080+2760x1440+1680x1050
@DavidFreitag hey if you want to go sleeping about with @JukEboX despite his cold, that's down to you
Or despite the fact that he's a man with a ween.
@RоryMcCune Maybe it'll be good for my immune system, I can't even remember the last time I got sick
Dovid, you're just asking for it now.
16:57
@Simon Hey man, I'm a fair trade cuddler
ew
@RоryMcCune Actually, on checking, all my current screens are 1920x1080. Just all different physical sizes. No wonder I get a headache when I move windows around...
@Simon Yeah, one of these days I'm just going to come down with ebola or something good like that
@Simon a warm body's a warm body
16:58
@Matthew lulz you donut
@Ohnana no
@Matthew Do you use Windows 10, 7, or *nix?
If it's the former, you can set a custom scaling for each display so everything appears the same physical size
Win 7. My laptop is getting on a bit
@Matthew You should look into the free upgrade to 10. It's magnificent.
@DavidFreitag vmware doesn't work on the corporate laptops
It's magnificent at stealing your personal info too.
@Ohnana wot
17:00
@Simon Not if you hit it with a big stick
Although I did get the long awaited email from the IT department about a replacement in Q1. They didn't specify which year
@Simon someone upgraded to beta test it, and vmware thinks your mouse is held down all the time so you can't click in a vm
When I was in high school we got laptops from the school, I uninstalled Windows 7 and installed arch linux. When I gave it back to IT they were like... WAT?
@Ohnana lulz that's fun
@DavidFreitag you were that kid
17:01
@Ohnana Wait so vmware as a software doesn't work on specific hardware?
@DavidFreitag for win10, apparently
@Ohnana But definitely not as special as Markus.
idk if they have a patch out
@Ohnana No, most people destroyed theirs, that was the first computer I ever had. I cherished it.
The guy was like "If it were up to me I'd let you keep it and say someone destroyed it, but it's not... so... sorry"
School + Windows 7... I feel old
17:03
You sound old too, lad.
@Matthew It was 2006
LUNCH OMNOMNOM
WOOHOOO
/r/worldnews has turned into MuslimHateSim2k16
and that kind of pisses me off
When I was at school, they got new fangled Win2k machines in the year I left...
@Matthew Which means that you are at least 134 years old.
17:06
@Simon pls he's a youngster... back when I were a lad it were BBC Model B's (if you were lucky) and ZX Spectrums if you weren't
@RоryMcCune Well you're 183.
@Simon impeccable logic there
General Tso!
@Ohnana true
@Ohnana did you see the report of the refugee gang rape in Germany?
@JukEboX you mean the gang that included an american tourist, a german, peruvian and a handful of people from other EU countries
yes. yes i did.
yeah they were all being called "North African Looking"
and then they go and try and pass of the fact that whatever it was called is "common practice" in the Islamic World
17:17
yeah, apparently islam commands you to rape literally everyone -- despite the fact that it actually teaches you're not supposed to touch anyone you're not married to
the actual custom is "don't even shake hands with a woman"
unless your #daesh
then apparently you can marry, screw, divorce, repeate
@JukEboX wahabbism for the win
@Ohnana freaking ridiculous
I am not saying democracy is the best in the world but I like to think that my wife and friends that are women aren't "Slaves"
@JukEboX lots of sane people think that way
17:33
Although if we are thinkgin about 60%-70% of lslamic sects see women as "slaves" since they "belong" to their husbands
I see give the Kurds their lands in Turkey and build a country there for them
They are a progressive Islam for the times.
christians have a touch of that thinking as well
Which ones?
...all of them
hurk I ate too much
evangelicals are the worst offenders by far
17:35
They say that Women belong to the husband?
@Ohnana Evangelicals are just con artists. They should all be persecuted for tax fraud
@JukEboX quite literally, multiple times
@JukEboX that would be a "televangelist"
I wouldn't mind belonging to someone
@ohh
@Ohnana televangelists == Evangelists
Just as long as it isn't someone who threatens me with the hose if I don't put the lotion on
Just like Scientology == The Church Of THe Jefi
17:36
Evangelicalism, Evangelical Christianity, or Evangelical Protestantism is a worldwide, transdenominational movement within Protestant Christianity maintaining that the essence of the gospel consists in the doctrine of salvation by grace through faith in Jesus Christ's atonement. Evangelicals believe in the centrality of the conversion or "born again" experience in receiving salvation, in the authority of the Bible as God's revelation to humanity, and spreading the Christian message. Evangelical Protestantism gained great momentum in the 18th and 19th centuries with the emergence of Methodism and...
All Hail FSM
He boiled for your sins.
@Ohnana sorry I think all religion is a joke to begin with
televangelists belong to the "prosperity gospel" sect, which is just organized fraud
17:50
> class X<A,B,C,D,E>{class Y:X<Y,Y,Y,Y,Y>{Y.Y.Y.Y.Y.Y.Y.Y.Y y;}}
Produces a 28MB executable with C# ^
70
A: Build a Compiler Bomb

Vladimir ReshetnikovC#, about 1 min to compile, 28MB output binary: class X<A,B,C,D,E>{class Y:X<Y,Y,Y,Y,Y>{Y.Y.Y.Y.Y.Y.Y.Y.Y y;}} Adding more Y's will increase the size exponentially.

@DavidFreitag how the fuq
@Ohnana It's generic magic. It causes the compiler to generate a shit load of classes to handle every single possible corner case.
@DavidFreitag oh
There is a similar C++ asnwer
22
A: Build a Compiler Bomb

Toby SpeightC++, 250 + 26 = 276 bytes template<int A,int B>struct a{static const int n;}; template<int A,int B>const int a<A,B>::n=a<A-1,a<A,B-1>::n>::n; template<int A>struct a<A,0>{static const int n=a<A-1,1>::n;}; template<int B>struct a<0,B>{static const int n=B+1;}; int h=a<4,2>::n; This is the Ack...

But C# has way better syntactic sugar
that is damn impressive
17:57
Yeah PPCG comes out with some insane stuff
18:19
Free flag:
0
Q: I am terrified to go into work and I don't know who to talk to about whats been going on

desI am a 20 year old female waitress and I am having terrible anxiety and experiencing serious effects from my job. I can't sleep, I feel sick to my stomach and I began smoking cigarettes, and a lot of them.. It is becoming very difficult to bring myself to go into work because I am afraid of my bo...

i appreciate that people take off-topic posts as the perfect reason to mouth off at someone
I'm 80% (top of my head statistic) sure that's a bot.
@Simon why?
sounds like someone looking for security in the physical sense
Because it looks super spammy to me.
And seriously: don't be a dumbass and check the website out a bit before posting on it to see if what you're posting makes sense.
(if that's a real person)
very true
reading comprehension is a rare skill sometimes
18:36
YASSSSSS IT FINALLY WORKS
dovid pls
Async serial wrapper eeeeesss complete
Hi everyone, I would like to ask a question on SE about the name of a specific PRNG function, but I don't know which site is the most suited to the question... Either security / crypto / maths are very good candidates in my opininon. Any idea?
Probably crypto.
Hi @Lamia long time no see :D
18:46
@DavidFreitag Hi David! how is everything
@Lamia Busy busy busy
Developing an OS? :p
Haha, only when I get some free time :]
what are you busy with if I may ask?
Thanks @Simon, I'll ask there then. Thanks for the advice! :)
18:49
My pleasure.
@Lamia Lots of work projects. Spent the past two days arguing on the phone with board manufacturers/assemblers
i had worried that crypto would split the se community, but it seems to be a good alternative
@DavidFreitag cool type of busy :p
@Ohnana Did you really think that?
the hardcore crypto nerds can hang out and be as hardcore as they want (and have their peers understand them) and we can focus on other pure sec stuff like threat management and such
@DavidFreitag a little
the topic overlap was a little strange at first, but it really worked out
18:52
but it must be tiring as it involves using the phone :p *ihate
@Lamia I hate having to use the phone, and the worst part is they have all been conference calls with me, my boss, and a bunch of people from the other respective companies
You're a respective company.
Which usually devolve into screaming matches on their end, and I don't tolerate that crap so I hang up on them. But of course they want our business so they get their act together and call me back
@DavidFreitag "Please call me back when you are ready to discuss the matter calmly. click"
One life goal of mine is to reply to a very rude email with "u wot m8"
Still gotta receive a rude email :(
18:59
@Ohnana More like "Please call me back when you are done being children"
@DavidFreitag ugh how much I hate conference calls.
specially when there are many people on the call
0
Q: Redirecting/rickrolling intruders

Philip RowlandsWhile browsing for Node.js packages, I came across this one. It's purpose is to redirects crawlers away from a site, and by default it Rickrolls them. I find the idea amusing, but is it a good idea to do this to intruders, given that unvalidated redirects are a security risk?

-.-'
that's hilarious
also it's a valid question. could someone use this site functionality to attack someone?
As usual: can't be answered without seeing the packages' code.
@Ohnana It depends on whether the target of such an attack finds a rick roll a personal affront or not.
19:08
@DavidFreitag but if they manage to change the directing link?
@Ohnana Node.JS means it's running on the server, as long as someone didn't do something apocalyptically dense like give it an internet-facing API nobody should have access to that.
"as long as someone didn't do something apocalyptically dense" is asking too much
It seems like a really, really dumb thing to do. I highly doubt a such thing would crash a scanner or do anything at all to it.
@Ohnana Yeah but I'm suuuper naive.
@Simon And moreover, how do they distinguish a scanner from legitimate traffic?
@Simon it pollutes the logs with 302s, so the person checking the positives would get trolled
19:11
Any decent scanner will spoof User Agent's
@DavidFreitag probably does it to anyone looking for those pages
@Ohnana I wouldn't even check those logs if I were running scanners.
no one legit looks for those pages
The only logs I'd care about are the ones that say that it has successfully infected a server.
@Simon Or the logs containing potentially infectable targets
19:13
Yep.
Waste of time and energyyyyyy.
19:30
why do you hate fun
@Ohnana The idea is fun but in practice it sucks bolls.
I like real fun.
01:00 - 20:0020:00 - 00:00

« first day (1854 days earlier)      last day (3324 days later) »