@Simon never 4get

@Simon Talk about confrontational issues

I'd probably rather forget it.

@Simon then stop bringing it up

@Simon I'd rather take you out for Donuts

@Ohnana Oh man, you wanna wrestle or something here?

Let's get some Timbits and Chili and bury the hatchet. Or the rifle

no i am sick

@Ohnana Get well soon

@MarkBuffalo Only if we wrestle and the loser falls in donuts full of sugar powder on them.

@Simon deal

sugar powder in strange places... ick

@Ohnana Yeah, not meant to be fun.

@Ohnana That just makes it sweeter

Hurrrrrrrrrk

apparently windows hides it's "insert from link" functionality by making you use the file browser

documented? noooo

@Ohnana "insert from link"?

insert a picture from url

the "insert from online pictures" only lets you use bing image search

Hmm... never seen feature

Interesting

who the heck would use a company specializing in "human capital solutions"

/googles

@RоryMcCune fogeys.

@Simon or big corps who think that people are "human capital"

@Ohnana you'll find loads amongst the sociopaths of big business

so basically it's outsourcing HR

@Ohnana it's a fancy name for recuiters

which is literally the worst thing you could do with HR

I just ain't a fan of people being called "human capital"

@RоryMcCune all the morons I get linkedin spam from?

@RоryMcCune mm yeah. doesnt sit well

@TildalWave annnd you get the prize for where did I hear that phrase today

recruiters seem to be getting a bit keen in the UK at the moment

but you'd think they would acutally learn to customize their linkedin invites

@RоryMcCune oh geez open a bank account for me will you so I can collect all tze moneys?

@RоryMcCune I'm getting tons of recruiter requests this month

a huge uptick

@TildalWave sure I'll just need to you to send me all your personal details + a setup fee :)

interestingly enough, i've been getting less recruiter spam now that i'm listed as "preferred name (legal name) last name"

hueeeee

@schroeder yeah I guess some more money has hit some projects in the UK. I guess there's a lot of work going on in banking with "Challenger banks" popping up so that'll generate some activity, then we have .Gov chucking some cash at "cyber" which will also create more stuff

@RоryMcCune I get about 2-3 invitations per week to work for some [insert UK bank] ... which I always thought is because of some of you folks in my connections working for some of them ... automated spam tho, I only got one personalized invitation this month

even that one was more to say sorry LOL

@RоryMcCune isn't all one really needs to open a bank account in Gibraltar that setup fee?

@TildalWave I was more thinking of 419 scams and their "setup fees"

oh yeah sorry that would be a couple thousand miles South then

@RоryMcCune can you tell me more about the "Challenger banks"? I'm on the 3rd interview with ECS and a focus on banking

@schroeder ok so traditionally UK banking has been mainly the Big banks (HSBC, Barclays, RBS, Lloyds) there are quite a few banks which are just brands of them, or spinnoffs of them which use similar systems (e.g. Sainsburys bank, Tesco Bank). The "Challenger Banks" are entirely new and there seem to be quite a few coming a long at the moment, Mondo, Metro etc

It'll be interesting to see how they get on breaking into the banking world

@RоryMcCune $BIG_BANKS roro, pls.

@RоryMcCune thanks for the heads up

the reason it's kind of interesting is that there haven't really been a lot of new banks in the UK over the years, and we're now seeing a spate of them

of course if I was IT/Infosec in a new bank I'd be very worried as they'll be moving quickly and will be a huge target for attackers

+ the FCA will be breathing down their necks to make sure all is well with them

and they likely don't have as much experience of dealing with regulators as the established players

I'm guessing that some of them will white-label existing products in a lot of cases but at least one (Mondo) actually appear to be writing their code from scratch in Golang!

after wrestling with paywalls, this article on challenger banks seems most informative of the free ones globalbankingandfinance.com/…

@TildalWave oh thanks! Reading ...

@TildalWave there's some "interesting" statements in that article "embracing Cloud, Mobile, Web and Big Data are all technologically straightforward from existing core COBOL IT systems

@RоryMcCune lol

yeah playing out a reliance on mainframes and cobol as a "strength" is a very interesting position to take

COBOL 4 lyf3

not one I would really support

> From a personal, customer perspective I am looking forward to seeing how the battle plays out. Because unusually, whoever wins the battle, ultimately it is the bank customer who will win the war.

I kinda disagree with that position

the only thing that is certain is that if they fuck it up, it's the customer that will pay for it

@TildalWave optimistic little bugger

@RоryMcCune that might be to persuade people. executives don't care about the details, statements like those will win them over

it's just vague enough that it works

@Ohnana unless you know... you've heard of COBOL :op

@RоryMcCune Yep, it sounds like what I refer to as, "dead phrases." There's no soul behind the words, it's just completely dead.. and seems sociopathic.

@schroeder Same. I get sometimes dozens every week... they're almost all completely clueless resume fishers.

If anyone is too shy to tell Markus to shut top, just let me know.

@Simon somehow, I doubt that "shyness" is an issue for anyone in the DMZ

Fine then, you tell him.

Those freaking Vancouverians think they're better than everyone in the East.

That was embarrassing.

nbcnews.com/news/us-news/…?

wtf

nice hyperlink

There goes my reddit experience once again, cheers Markus.

oh man $25

Am I gonna be the one who says it?

@Simon no

Fine, then do it.

@Ohnana This is just the most insane thing I've read all week

I'm gonna go get a coffee and if you haven't said it when I'm back, I'll say it.

@MarkBuffalo seriously though

it is crazy. these people had the power to kill anyone they wanted and look at what they did with it

$25.

I would've just paid it because it's a service... wtf @ arguing until guns are drawn

It looks like you didn't say it ohnuhnuh.

'MERICA

Not even 'MERICA. Deep south nutnecks in Misssippiiioipipipipipipi.

yes, missou is prime 'MERICA territory

Mississippi*

"nutneck" um

this is an interesting mental image

Oh jeez

@Ohnana Well, uh... I meant nutjob rednecks.

and I know not all rednecks are bad.. so....

@MarkBuffalo i like the conjugation

so I used nutnecks... and that... ugh

oh boy zika fever is going to spread to the americas

It has already started

This is this years Mass Media illness scare

@JukEboX i mean it's causing congenital ancephaly

that's not exactly minor

it won't kill you, but it will cause people lots of grief

You're a congenital ancephaly.

@Ohnana Shit... we might be preggers again

True. Your white blood cells attack your circuliatory system which is pretty crazy

I'm not letting my wife leave the house for 9 months now

-.-

Markus, the abusive husband.

@MarkBuffalo I am keeping mine in a bubble for 1 more month

@MarkBuffalo as long as you're about three weeks in, the virus can't hurt the baby

so just be careful and wash your hands

@Simon Didn't let her leave the house in China because of smog

there are no cases in the USA, and trapping mosquitos will help greatly

instead, I waited on her hand and foot

Mosquitoes are the worst.

Anybody tried crashsafari.com ?

Apparently it can kill an iPhone right away.

yeah the breed that's carrying zika also carries dengue, chikunga, and all those lovely diseases

On Linux/chromium, the browser is quite impacted (but the OS resists).

@ThomasPornin Kill as in gotta reboot or kill as in bricked?

@ThomasPornin Yeah I just saw that, haha.

@ThomasPornin oh lawd it made chrome/windows hang

i thought i got rekt

@Simon Kill as in "reboots spontaneously"

@ThomasPornin Neat, linking to my buddy then.

oh god it makes my browser lockup

On chromium it is not really crashed, only it uses all available CPU and all RAM.

i can close the tab but it freezes

@ThomasPornin Yes, but you can close the tab at least.

can you nuke OSX with it?

It is a three-line DoS that simply pushes increasingly long strings into history.

i really wanna look at this with burp suite

@Ohnana I don't have OS X at hand right now/

Just use a simple wget

just sent it to my partner

he has a mac

                var total = "";
                for( var i = 0; i < 100000; i++ ) {
                    total = total + i.toString();
                    history.pushState(0,0, total );
                }

@ThomasPornin That reminds me. I found a critical bug in the android camera that will kill the phone

Literally kill the phone until the power is full. wtf. works on 3 different phones

lmao @ that code

@ThomasPornin That. Is. Awesome.

@ThomasPornin see Thomas I understood that until you go to i.toString() and the pushState () WTF does that stuff do?

God damn it, I couldn't close it in time and it did freeze my PC.

@JukEboX i.toString makes the int into a string type

so 1 becomes "1"

and them pushState looks like a browser API function call

Why would you want that?

the ints are just garbage data

12345678910....

@Ohnana IIRC history.pushstate adds something to the browser history

why not use total += i.toString();?

so that pushes a very large number of things onto the browser's histor

@MarkBuffalo because it's a shitty browser hack and no one cares

^

Talk about being nitpicky, sigh.

yeah developer.mozilla.org/en-US/docs/Web/API/History_API adds browser history entries

ahh I see so it basically adds 1 11 111 1111 11111 etc to the history

till it burns up your resources

So it's not really a bug per se?

That's a really good denial of service attack

@Simon well in theory the browser should contrain resources burned in some way

@Simon a website should not be able to arbitrarily write history

o

and there should be a limit to length

mmh, my history is still filled with garbage

but in the same way that Billion Laughs works on almost all XML parsers

Oh damn yeah, the history is loaded with the website.

if you allow the feature, it's kind of hard to delineate what's malicious and what's not

httpX://crashsafari.com/01234567891011121314151617181920212223242526272829303132‌​333435363738394041424344454647484950515253545556575859606162636465666768697071727‌​37475767778798081828384858687888990919293

^^ that is how long it is

and i snipped that for stack exchange

now i have to clear my browser history... and i didn't even do anything fun

checked httpX://crashsafari.com/01234567891011121314151617181920212223242526272829303132‌​‌​33343536373839404142434445464748495051525354555657585960616263646566676869707‌​1727‌​37475767778798081828384858687888990919293

checked

clearly this is satanscript

Did anyone test it on their Android with Chrome?

Do I have to be the guinea pig?

Amusing: clearing my last hour of history logged me out of SE.

@ThomasPornin just happened to me

@ThomasPornin Shit, it did it for me too.

wow we suck at internetting

LOL

i think the last time i got logged out was when @AviD posted that mass logout script

silk on an amazon tablet crashed the browser but the OS looked ok

@Simon imma do it

@Ohnana Did I ever tell you about my career on my website?

@Simon ಠ_ಠ

Hang on, I gotta check my Apache config.

uh oh my music just stopped on my phone

Ah, yes, it is it.

@MarkBuffalo Hey man, did you check out my career section on my website? pittoreski.com/career

oh lawd my background died, it's the default now

i think my phone bit it

ô_ô

You're making me want to try it.

@Simon Nice logout thing.

lmao

wot

It redirects to superlogout.com

keep that rule in place

but it didn't affect me lol

maximum trolling potential

For sure.

@Ohnana Welcome to the wonderful world of HTML5.

@Xander /sudoku

@Xander If I'm understanding this correctly, you can write fake history to a user's browser?

Or real history, if you're a nice person.

@MarkBuffalo it's actually sending you to those pages though

it's just redirecting lightning fast

Is it?

at least i think it is

> The new URL must be of the same origin as the current URL; otherwise, pushState() will throw an exception.

And the exception will eat even more CPU.

@ThomasPornin "otherwise" meaning an exploit hasn't been found?

Can you view a user's history? Hm

@MarkBuffalo Yes, it's designed to enabled browsers (specifically the back and forward buttons) to work correctly with SPAs.

@MarkBuffalo developer.mozilla.org/en-US/docs/Web/API/History_API

@MarkBuffalo That'd be absolutely wrong.

@MarkBuffalo No, but in the past there have been CSS/JS exploits for that.

Seems like it's possible if you find an exploit. But at that point, you have RCE, so it's a moot point

@MarkBuffalo Everything's possible if you find an exploit #yolo

But I wonder if there is a way to trick the history into thinking you're currently on a remote origin

@ThomasPornin I'm coming over for a beer this weekend.

@MarkBuffalo No, not by design. That would be a security flaw, and if you can find a way to do that, you can earn yourself a nice shiny CVE.

@Simon Btw, I am in Montreal right now

@ThomasPornin That'd make things easier to get a beer.

Sigh. Another lousy question rep-training, and gaining a pageful of even lousier answers.

Are you at CGI downtown?

@Simon Nope. Just left CGI. First day at my new job (normally in Lévis, but the main team is in Montreal).

@ThomasPornin Oh wow! Damn it, my friend gave me your extension and all, now I've got nothing to stalk you.

Who's your employer (if you're allowed to say)?

@Simon Desjardins.

@ThomasPornin Well done.

da bear is going to steal all my cash now :(

@Simon There's nothing to steal.

@ThomasPornin Oh while we're at it, tell them that the character restrictions in their password on AccèsD is ridiculous.

@ThomasPornin How come I didn't know about this? LinkedIn is falling down on the job. They're supposed to let me know when this sort of thing happens.

@Xander Did he even update his linkedin?

@Simon That is beside the point.

Hahaha.

so apparently that site kills the new edge browser

and it filled up someone's SSD

Also, what if you sync your history with your smartphone?

Would it transfer a ton of data?

i guess so

/checks chrome history

o right i'm not logged in on this machine

excellent