The DMZ

Simon

00:00

@DavidFreitag Fun fact: I told Code Black that he might be the problem because he's been complaining about problems with both OS X and W10. Then, he got slightly mad and he said he's been building PCs for a while.

Silly Code Black.

David Freitag

01:17

@Simon wat

Mark Buffalo

I'm wasting too much time on these kind of projects

I should make one that provides a service, plain and simple

also, it's going to take 10 hours to crack the password using my method + shitty computer

David Freitag

@MarkBuffalo "I'm spending too much time on this project. I should be spending time on another project that's equally as silly"

Mark Buffalo

ain't no one got time for that

Well, David... companies want a service

If you can provide them a service, and they like it, they'll pay cash money for it.

David Freitag

@MarkBuffalo No, they'll send you a purchase order

(╭ರ_⊙)

@Simon How exactly did you tell him this?

Mark Buffalo

01:49

That post really pissed off Steve Sether, lol

I led him on with the NSA cargo culting, then backtracked at the last minute and he's all, "YOU CAN'T DO THAT!!!!!!!!!!"

Ohnana

03:45

@DavidFreitag pork shoulder

Mark Buffalo

03:55

@Ohnana Love that

We use it to make stir fry

A gigantic block of pork shoulder costs like $23 at costco. It's enough to last like a half a month for david

Mark Buffalo

04:09

Terry Chia

08:52

Rоry McCune

@TerryChia heh

mornin' all

M'vy

morning

@TerryChia I find your lack of faith disturbing

Rory Alsop

09:10

morning all

Adi

09:35

Mornin'

@RоryM I might be coming to the UK in a few months to take my CREST exam :D

Rоry McCune

@Adi yay! you starting with the CRT?

Adi

@RоryMcCune Indeed

Rоry McCune

@Adi cool, so I guess you're just coming over to do the written bit (OSCP handled your practical?)

Adi

@RоryMcCune Not gonna go the OSCP -> CREST route

Apparently, there are some downsides

Rоry McCune

@Adi ahh I didn't know that

well TBH I reckon you'll find the CRT practical pretty easy after the OSCP

Adi

09:38

@RоryMcCune Yeah, if you go the OSCP route then you lose something related to CESG or CHECK

or something like that

I don't quite understand it, but since I'll be paying anyway and I have the technical skills/knowledge, so why not

Rory Alsop

@Adi good stuff!

Rоry McCune

@Adi you might find that doesn't apply to you (@RoryAlsop may know better) but I think that you can't be a CHECK Team member or leader as you're a durn foreigner

but no harm in doing it the "full" way

one thing to note in looking at the syllabus is that it was written by #Fogeys a couple of years ago, so some of the concepts/tools might be a bit old-school

Adi

@RоryM There might be a possibility of transfer to the UK through a Finnish company. It's in the planning stages

@RоryM They offered a figure around 55k GBP (to be raised to 60k after probation). You think that's good?

Rоry McCune

@Adi yeah that's not bad, London or not London?

(it's better if it's not London)

Adi

@RоryMcCune Manchester

Rоry McCune

09:43

as London costs a frackin' fortune to live in...

Rory Alsop

@RоryMcCune yep - think that only applies to Team Leader

Rоry McCune

@Adi Manchester! heh NCC head office

@RoryAlsop ahh that was the bit I wasn't sure about..

Adi

@RоryMcCune Sadly, it's not related to NCC

Rоry McCune

@Adi well you'll have loads of tester types to meet up with Manchester is the biggest centre for it outside of London

there's NCC + Pentest + MWR + some others

Adi

@RоryMcCune Oh yeah.. 'cause you know what a tester likes to talk about after work :D

Rоry McCune

09:45

@Adi if it plays out, I can put you in touch with some people who've moved down that way and likely give you the script on things like good/bad areas etc

Adi

More testing stuff

Rоry McCune

@Adi or hacking'y stuff in general

Adi

@RоryMcCune Yeah, I don't wanna move to areas where those dirty foreigners move.

Rоry McCune

@Adi lolz, Manchester Had/Has some pretty rough areas that you likely wouldn't want to end up in

Adi

@RоryMcCune Yeah, the guy who is arranging it told me that you wanna stay out of the ghettos

I laughed it off thinking it's like ghettos in Finland

but then he told me stories and news articles

Yeah.. definitely not like ghettos in Finland

Rоry McCune

09:52

@Adi yeah I don't know about now, but Moss side in Manchester used to have a pretty bad rep.

kinda like the gorbals in Glasgow

there's less of these areas nowadays, but not none

that said there's quite a few studenty areas in Manchester which are likely nicer/friendlier

@Adi if you see @paj28 on the DMZ he's a manchester type so will know the score better than me

Adi

I'll do that

Though at this point I'm trying not to get ahead of myself. There are still a few things stuck regarding my eligibility for the shortage list

It seems to be not as straightforward as I thought

Rоry McCune

@Adi ahh with Governments, nothing ever is...

Adi

If I'm not eligible for the shortage list, then it's not gonna happen at all

I was told of some 30 day rule where the company need to prove that no Britt can fill the position

Rory Alsop

@RоryMcCune just checked -actually it applies to all CHECK team members. They must be British Nationals

Adi

@RoryAlsop Fick

Rory Alsop

09:57

@Adi But that does not apply to CREST

Rоry McCune

@Adi don't worry too much CHECK only applies for government work

CREST is good for all private sector stuff

Adi

Whew! Good

Rory Alsop

@Adi and CREST is superior to CHECK in many ways (not least in terms of being up to date)

Rоry McCune

@Adi also you don't want to do public sector things that require CHECK it's all stupid datacentres where you can't take your phone

Rory Alsop

@Adi CREST was born out of CHECK not really working for private sector at all

Reddit made me laugh today. NSFW text - imgur.com/gallery/C4W8M

Rоry McCune

10:15

@RoryAlsop heh

Rory Alsop

I know - killing time while the builders fit a new front door - then I can leave and go to work

Terry Chia

All them acronyms though.

Rоry McCune

@TerryChia hey hey CREST is coming to Sinapore, so you too can get involved in Acronym soup!

Terry Chia

@RоryMcCune You must be one of those that list all their certificates after their name during introductions. ;)

Rоry McCune

@TerryChia oh hell no, I have the ones I have to have

and I rarely mention them unless necessary

Terry Chia

10:30

Rory McCune, CISSP, blah blah blah, blah blah blah :P

Rоry McCune

@TerryChia pls Torry, who'd admit to being a CISSP voluntarily!

Terry Chia

@RоryMcCune Management types like @RoryAlsop? shots fired

Rоry McCune

@TerryChia lolz you'll not get him on that one, IIRC he let his CISSP lapse.

Terry Chia

@RоryMcCune Well, he has met their work experience requirement about a 100 times over by now.

paj28

12:03

@Adi - come to Manchester! You'll like it here :-)

If you have 5 years infosec experience at team leader level, I think you're eligable for the skills shortage list

Unfilled for 30 days is pretty much a technicality for pen test firms that always struggle to fill the roles they want

Thomas Pornin

12:21

It is getting hotter everywhere except penguinland and the north-east of Canada.

Mark Buffalo

12:35

@ThomasPornin Good

Ismael Miguel, Portimão, Portugal

137 7

Is this guy a sock puppet for Steve Sether? I clearly addressed Steve Sether in a post, and this guy responds angrily at me.

And he acts as if I responded to him

Simon

Nah, you just make everyone angry, Markus.

Rоry McCune

12:56

@paj28 yeah I don't think there's a single pen test company in the uK that doesn't have a permanent "We are hiring" section on their site.

Simon

@RоryMcCune That's understandable, since most of their staff has gone MIA due to the floods.

Rоry McCune

@Simon phhbt floods, that's normal rainfall levels in Argyll

Simon

Silly Brits.

Mark Buffalo

@Simon Same writing style + same tone + wrong account :p

RoraΖ

13:29

@ThomasPornin aka Donut Land

Mark Buffalo

13:51

2

Q: Reason behind HeapSpray format

I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs wouldn't EIP just slide down the sled until it hits the Shellcode? In addition, in a Heap Spray a pre...

attacks browser-hijacking

@RoraΖ <3

Simon

@RoraΖ I'd totally run away if I were you.

Mark Buffalo

@RoraΖ You seem to know how to bypass ASLR

And you live in DC

See through you we can

Clearly you work for a hospital

Good answer though

RoraΖ

@MarkBuffalo haha, thanks

@Simon I'm always on the run

Simon

14:16

1

Q: "malware" URLs in posts

I wonder about until what point most of the questions about questionable URLs are all authentic. I know they can and are often obfuscated by moderators...However, could not some of them being posted here be done in a spirit of social engineering, either for publicity reasons, to infect, find ou...

privacy social-engineering

I don't think a question has ever confused me more than this one ^

And there's an upvote, yeah sure dude.

Mark Buffalo

VTC "unclear"

JukEboX

Hi Hi

Mark Buffalo

@JukEboX Hai

Ohnana

@JukEboX how is your face

Mark Buffalo

Someone told me to stop being an idiot :(

That post made a lot of people angry

JukEboX

14:23

What's shaken?

Mine is fine. @Oha

@Ohnana does your face hurt?

Ohnana

@MarkBuffalo being less abrasive is good

@JukEboX currently my back is unhappy because hotel bed

but my face is just fine

JukEboX

@Ohnana it is? Cause it's killing me.

Simon

@MarkBuffalo fkin rekt

JukEboX

ba-doom-psshh

AnyWho

Mark Buffalo

@Simon ikr

@Ohnana I hate that. Eventually, if you travel enough, it goes away

JukEboX

14:24

@Ohnana Yeah I Had that yesterday.

Ohnana

@JukEboX accurate statement :D

JukEboX

@Ohnana take Advil or I-B-Profin?

Ohnana

it's fine. left my painkillers in the hotel room in my morning stupor

but i'm just trying to be mindful of posture and stretching. i'm young, my body can take abuse

JukEboX

Yeah I don't know why mine was hurting yesterday. Maybe I stretched the wrong way when I got up

Simon

@Ohnana ( ͡° ͜ʖ ͡°)

Ohnana

14:30

@Simon ᕙ( ͡° ͜ʖ ͡°)ᕗ

Simon

Is that Dobby? omg 2 soon ohnuhnuh

Ohnana

no those are arms

u blind

Simon

It could be ears you donut.

Do you know many people with flappy arms?

JukEboX

Those look like arms to me @Simon

Simon

Wow, I wonder what your arms look like, lads.

JukEboX

14:36

like this --> \o/

Simon

@MarkBuffalo In which question are you getting rekt? I wanna read the rekage.

Mark Buffalo

@Simon the BBC password thing. but I am currently updating the post

Simon

@MarkBuffalo To create more reking? Neat.

Mark Buffalo

Yes, I need to be wrecked more

Simon

A mod has to clean those comments, jeezus.

A bunch of kids arguing, how lovely.

JukEboX

15:01

How do you guys always seem to be reading the same questions?

Rоry McCune

@JukEboX they're all the same person, did you not know?

it's sad really seeing someone with that many multiple personalities, but still quite an impressive feat to watch

Mark Buffalo

@RоryMcCune Who?

JukEboX

@RоryMcCune I know it really scares me a bit. I always only get to read the part where it's like "What a loser. THat question is ridiculous." or "you should have moderated it". And the last conversation before something like that is completely different. It's like they are all telepathic

Simon

Yeah, it's just like the I Am Charlie thing.

Except that in this instance, We Are Thomas Pornu

JukEboX

You mean we are all Rory

Mark Buffalo

15:11

@RоryMcCune I just got the joke... LOL

Rоry McCune

Splitloop - Both Knees (Breakfastaz remix)

►

Simon

Look what kind of bad practice node.js creates:

0

Q: Saving SHA2 encrypted username password in session

Say I have a server. That server could be a node.js server that serves an app. In that app you could be asked to login. The login credentials would be authenticated agains LDAP. That server could request/Post data from other servers via Rest. Those restful endpoints could be secured with basic au...

encryption authentication

JukEboX

15:32

@Simon WISH I understood Javascript

Mark Buffalo

@Simon Ewwwwww

Store username+password salt? why :<

I don't know enough about Node to answer this, but it seems like a terrible idea considering this same concept in a different language.

Simon

@ThomasPornin lulz good point about the SHA-2 "decryption"

Mark Buffalo

Test

@Simon To answer your earlier question, it doesn't seem like you can stack site joining to get more rep. If there were true, I'd be at 7k+ now.

It's still showing 6702 network wide

@DavidFreitag security.stackexchange.com/questions/111358/…

TheJulyPlot

15:54

4 hours of death by power point training on iso 27001 and i'm on the verged off ending it all....geneually think this may be the single most tedious subject in all of infosec.

Mark Buffalo

@TheJulyPlot You made the hot network questions list

and started a rep train

I also updated my post, and I'm thinking of removing the NSA stuff since it pissed people off to the point of insulting me directly lol

TheJulyPlot

@MarkBuffalo oh yeah..that's pretty cool.

haha yeah I noticed that

Mark Buffalo

@TheJulyPlot don't end it. :(

Simon

Markus, no one needs a reason to be insulting you.

TheJulyPlot

by end it, i mean the presentation...not my life.

Mark Buffalo

15:58

@Simon ikr

TheJulyPlot

although..give me another 4 hours of this and that may be an option

Mark Buffalo

lol

Ohnana

@TheJulyPlot just go back in time. forget hitler, destroy powerpoint.

wow that is a critical level of butthurt

TheJulyPlot

@Ohnana dunno if i kill baby bill gate, early 80s bill gates though..doable.

Mark Buffalo

@Ohnana What is?

@Ohnana Do you mean PowerPoint makes you critically butthurt? No, that is a perfectly valid response to PowerPoint.

Simon

16:01

I love it when people don't understand a concept and are arrogant about it.

Mark Buffalo

@Simon The hash vs. encryption concept?

Simon

It is more a matter of the person than the concept but yes.

-2

Q: How MD5 and salt algorithms come into play if the attacker uses curl?

When the user logs into any site, they supply a username ('user01') and password ('password123') into a form then submit. The user has no idea what their hashed password value is that is stored in the database. The user just types 'password123' as password. If someone wants to brute force that ac...

passwords salt md5

Oh for fucks sake.

"If someone wants to brute force that account, they can just use a dictionary attack and post to the same login URL with curl"

Kill me now.

Mark Buffalo

LOL

Simon

I don't understand how schools teach web development but spend literally no time on security.

Ohnana

@MarkBuffalo sorry, i meant o nthat question

real talk: you need to know when to disengage

like, seriously. being a funny dbag on chat is hilariously awesome, but on the main site it's just not worth it

Simon

16:11

^

Ohnana

there are too many people who are hysterical and uptight

TheJulyPlot

@Simon I know people that full web dev degrees, and games technology degrees and they do not even understand basic security concepts

Mark Buffalo

@Ohnana Which question? :b

@TheJulyPlot Unfortunately, schools don't teach this. We were taught SQL injection at my school.

Ohnana

@MarkBuffalo the BBC password one

David Freitag

woo woo All aboard the rep train

Mark Buffalo

16:12

@Ohnana Do you want me to delete my response?

I actually upvoted Steve Sether, lol

Simon

@TheJulyPlot Yep. I've had 3 web dev classes and one major web project and nothing about security was taught.

TheJulyPlot

@MarkBuffalo @Simon yeah it is not ideal

Ohnana

@MarkBuffalo the answer to the question is cool, but slogging it out in the comments is just an uphill battle 9/10 times

Mark Buffalo

And by, "we were taught SQL injection at my school," I mean my college taught us how to create vulnerable code.

Ohnana

@MarkBuffalo O. LAWD.

TheJulyPlot

16:14

@DavidFreitag having a look though these github.com/bsidesnyc/BSidesNYC2016/wiki/Agenda

Simon

Yeah, that's far too common.

TheJulyPlot

looks like it was a good event

David Freitag

@TheJulyPlot Yeah BSidesNYC was pretty awesome

Mark Buffalo

@Ohnana Agreed, I deleted my comments. Let them go critical butthurt mode if they need to. I shouldn't even respond to that.

Simon

@DavidFreitag Did you meet the love of your life there?

David Freitag

16:15

@Simon No, I sat in the corner and kept my mouth shut

Ohnana

@MarkBuffalo :thumbs:

Simon

@DavidFreitag 4evaalone

Ohnana

i will say that reading the comments is a good peer review

you have the opportunity to change your answer based on feedback, and I've found that helpful -- because that's why comments are a thing in the first place!

Mark Buffalo

I agree with the Peer Review part. @NeilSmithline has called me out on my mistakes before, and it made me realize I posted something incorrect.

when at the time I was blurring the lines

But "@MarkBuffalo stop being an idiot" isn't peer review :b

Simon

Neil's not an asshole though.

Mark Buffalo

16:17

Neil's great

Simon

Alright there, why don't you suck his ween while you're at it?

Silly Markus.

Mark Buffalo

@Simon Because you and I see the world through different... orientations.

Simon

Booooring.

Ohnana

it would be cool to experience the world as a different orientation/race/sex/whatever

like a temporary character respec

Mark Buffalo

I agree

Simon

16:21

I just want to have a lady hole for a day.

3

Mark Buffalo

@Simon They have surgeries for that.

Simon

For a day?

Ohnana

@Simon at least a day

or do you mean exactly one day

Simon

Uno daysos.

Exactlos uno daysos.

David Freitag

@MarkBuffalo That's definitely a peer review

Mark Buffalo

16:33

@DavidFreitag :(

David Freitag

It's so tempting to keep conversating with someone in comments

@TheJulyPlot The keynotes were particularly cool

Ohnana

@DavidFreitag don't do eet

ees bahd

Mark Buffalo

Yeah, very tempting

But I find it gets off-topic quickly

David Freitag

Someone quoted Gibson again

1

A: How Should WiFi Passwords be securely stored on IOT (embedded) devices?

You may want to listen to the podcast Security Now, Episode 543 on https://www.grc.com/securitynow.htm, where the talk about the Ring Doorbell IoT device. Note: A transcript of the show will be available for download soon, in the meantime listen to it on http://www.podtrac.com/pts/redirect.mp3/t...

I was actually going to email Steve if I didn't get a solution here. I'll listen through; most WiFi chips require you to store the execution code in a separate easy to read flash-chip (XiP). — MandoMando 14 mins ago

TheJulyPlot

@DavidFreitag what was the subject of them?

Mark Buffalo

16:45

@DavidFreitag His website is like a 1990s / early 2000s mass-marketing chain letter scam spam product

TheJulyPlot

How do you know whether a song is catchy if you've been deaf your whole life? — MonkeyZeus 1 min ago

Mark Buffalo

back to work

David Freitag

@MarkBuffalo back to lunch you mean

Mark Buffalo

17:04

@DavidFreitag I usually do both at the same time

@DavidFreitag any nozzle progress?

David Freitag

17:34

@MarkBuffalo I'm gonna have to go and knock him upside the head...

I wonder if Gibson is aware that we as a community hate him with the fiery burning passion of a few dozen suns

Ohnana

@TheJulyPlot cc @MarkBuffalo i want an answer to this question

Mark Buffalo

usenix.org/system/files/conference/woot14/woot14-malvoni.pdf

WOW

@DavidFreitag You might like this

@Ohnana I can hear, just not very well. I remember music very well, and I can make it in my head despite hearing distorted noises on the outside.

Ohnana

@MarkBuffalo interesting

@DavidFreitag he probably has people screen his email for him

so uh, why am i supposed to hate steve gibson again?

David Freitag

> Parallella board with 16- or 64-core Epiphany accelerator and ZedBoard with Zynq reconfigurable logic [16, 2]. Proposed implementations were integrated into John the Ripper password cracker resulting in improved energy efficiency by a factor of 35+ compared to heavily optimized implementations on modern CPUs.

Woooow

Mark Buffalo

I am only on page 3 of 7, and I'm blown away

Ohnana

17:49

@DavidFreitag ooooh shit

David Freitag

That's like $10k worth of FPGA goodness

Mark Buffalo

@Ohnana Click the article I linked. Someone linked it here:

2

Q: What effect on internet crime did the more recent developments in encryption have?

I'm doing a presentation on the effect of encryption on internet enabled/based crime, what would people say is the largest development in encryption of say the last 5-10 years what and what kind of enabling effect did it have?

encryption crime

David Freitag

@Ohnana Because he's a fraud and has no idea what he's doing

15

Q: Does Gibson's fingerprinting service add much additional security?

I just read this post and it proposes a method of storing SSL fingerprints online so that you can double check that your certificates have not been tampered with. But is it really relevant or useful? To me it does not seem to add any security: it lets you know that you are being snooped on, but...

tls web-browser

Stack Exchange Security Blog: Debunking SQRL

Terry Chia on October 17, 2013

This blog post is inspired by a question on Information Security Stack Exchange about two weeks ago. The question seems to have attracted quite a bit of attention (some of it in an attempt to defend the flawed scheme) so I would like to write a more thorough analysis of the scheme.

Let us start by discussing the current standard for authentication. Passwords. No one is arguing that passwords are perfect. Far from it. Passwords, at least passwords in use by most people are incredibly weak. Short, predictable, easy to guess. This problem is made worse by the fact that most applications do not sto …

Ohnana

@MarkBuffalo i did, i'm sending it to a colleague

David Freitag

27

Q: Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems like it would be pretty awesome - one of the problems that I can think of is if the QR reader i...

authentication cryptography security-theater qr-code

@Ohnana See those ^^^^

Mark Buffalo

17:53

@DavidFreitag tldr: gibson is just as bad as mythbusters?

David Freitag

@MarkBuffalo What's wrong with mythbusters?

Simon

Those are old, sqrl has been modified. A new analysis would be needed.

Mark Buffalo

I like watching it, but in almost every episode, they fail to take a lot of things into account and declare a myth busted

David Freitag

tl;dr: Gibson is a snake oil vendor, and even worse he really does believe his snake oil truly works.

@MarkBuffalo Due to budget and time constraints

Ohnana

@MarkBuffalo honestly, their "busted" just means "we couldn't reproduce it reliably"

Mark Buffalo

17:54

@Ohnana Pretty much

David Freitag

It's not the Mythbuster's fault, it's Discovery's fault

They weren't funded with a bottomless wallet, you know.

Ohnana

attrition.org/errata/charlatan/steve_gibson shit dawg, this guy has a hate club

David Freitag

Especially when they shot a cannonball into someone's house

@Ohnana Yup.

@Ohnana I would not bad mouth someone unless I had really, really good reason to do so.

Mark Buffalo

attrition.org/errata/charlatan/steve_gibson/…

LOL

malware exploitation framework

Ohnana

@DavidFreitag fair enough

Mark Buffalo

17:58

attrition.org/errata/charlatan/steve_gibson/grc-xss.html

David Freitag

@MarkBuffalo fail

Ohnana

@MarkBuffalo i mean, metasploit is technically malware

and you can host exploit modules in it

and you can use it to test things

Mark Buffalo

@Ohnana Agreed, I think this one is cherry picking

David Freitag

@Ohnana if you're looking for some good humor, I'd recommend going to his site and reading

Mark Buffalo

I make mistakes like this when I type things up in a hurry

Ohnana

18:00

@MarkBuffalo R.E.K.T ft. My Sides

Rоry McCune

18:14

neerajcodesolutions.com/2015/01/…

^oh dear

just goes to show, you don't need to use PHP to have crap security

Simon

Sweet SQL injection bro.

Rоry McCune

the passwords stored in the clear are just an added bonus at that point

Simon

@RоryMcCune All passwords should be stored in clear roro, it makes our job easier as devs.

No need to create an impersonation feature, you can just get the user's password and login as him!

Rоry McCune

@Simon pls somon everyone knows that double-ROT-13 is how you store passwords securely

to the untrained eye it looks like clear-text

but actually it's pretty secure

Simon

I still haven't found anyone who was able to crack my double ROT-13 hashing algorithm, that's true.

Mark Buffalo

18:18

@RоryMcCune Lol

The problem is that this is what colleges are teaching in the U.S....

That's part of the problem, anyway

Simon

Does anyone like creepy music clips? I've got one for ya:

Paul Birken - WampaStomp [don't 016]

►

Rоry McCune

@MarkBuffalo you say "problem", I say "job security for pentesters" :op

2

Mark Buffalo

@RоryMcCune rofl

Thomas Pornin

18:29

@MarkBuffalo Science is boring. A scientific result is a number at the bottom of a spreadsheet. Mythbuster blows things up, which is less scientific but more entertaining.

Mark Buffalo

@ThomasPornin True :p

Simon

Stop showing your tongue to Pornu, respect the man.

Mark Buffalo

@DavidFreitag He would probably make a lot more money if he went into real security research, and realized there are lots of problems to solve. There is no one-size fits all solution.

The Real Britney Spears

is this the demilitarized zone?

Ohnana

@TheRealBritneySpears that it is

welcome

The Real Britney Spears

18:35

hmmm

Ohnana

we take our name from the networking concept, not korea

Mark Buffalo

@TheRealBritneySpears Hit me baby one more time.

0

Q: How many security-related websites/sofware/system/human brain will break when we get more than 10000 CVEs a year?

The last time such a question was asked, there weren't even an official solution. Now we are supposedly on 5 digit CVE numbers for a whole year now, I've never seen then in the wild (apart from on MITRE website). Will the security industry crumble and fall when the number go over?

cve

Free VTC

Ohnana

VTC -- this question made my brain hurt

Mark Buffalo

my brain is goo today

I caught a cold ;_;

Simon

s/today/everyday/

The Real Britney Spears

18:42

@MarkBuffalo meh

schroeder

@MarkBuffalo I left it open to give you all a chance

Mark Buffalo

@schroeder You can close it, it's a duplicate which has a good answer already

it's also too broad

schroeder

@MarkBuffalo oh, I totally agree, but some of these low-hanging fruit I leave to give folks a chance to gain some points

Mark Buffalo

haha, sure :p

When I see low hanging fruit, I jump on it. Free points

schroeder

my vote overrides all other votes - so it can get unfair if I'm too active

yes, you got it, you all get my crumbs

Mark Buffalo

18:52

lol

Simon

@schroeder Brag about it, Vancouver.

schroeder

@Simon we have Japadog

Simon

That's literally all you have.

Oh and also Roberto Luongo.

WAIT NO, you traded him!

Silly Canucks.

Ohnana

i downloaded kali mini. no live environment.

who the fuck installs kali

NO ONE

Simon

That's what you get for wanting to use something "mini".

Mark Buffalo

18:59

@Ohnana lol

Transcript for