« first day (1882 days earlier)      last day (3302 days later) » 

09:08
shivers
indeed a touch chilly today
09:29
what's going on with @Simon's best friend Begueradj?
Nothing useful - that user name is unfortunately not what he wants to do. So he's suspended instead
And Morning!
can't some good soul point him to the help section explaining how to delete an account then? :))
on second thought, better not... might be the unflushable and only resurfaces under a different moniker some time later on
feel free to delete that if there's a risk it might offend someone
09:50
Oh hai!
@TildalWave meh. Its obvious enough
and there's this amazing thing called 'walking away'
He knows how to, at one point asked me to, but cancelled the delete request. Twice.
So. Suspension
10:24
How likely is someone randomly selected for hacking when her iCloud account, microsoft account and paypal account (different email address) all tempted within 2-3 months time frame?
10:48
@TelkittytheWebDeveloper Depends on whether they've ever used all these services from the same place. How about a keylogger on a laptop used to access all of these, looking for "high value" logins?
10:59
0
Q: Attribute based access control and role based, online bookstore example

AerealI am asked to answer a question that says: One online book-store wants to grand access to clients regarding their subscription. There are 3 types of subscriptions A , B and C. Customers get access in the subscription type they chose. Also if a book is not listed in the subscription list it's ...

I think this book store is doomed. On the 16th of the first month, they file for bankrupcy...
@Matthew it could be anything really
11:41
@TildalWave Oh crap. I'm sorry.
morning
@DavidFreitag Freak
11:59
@RоryMcCune yes it has put me off heckling you, I'd get owned, you don't even miss a beat
@TildalWave no, this is an invalid temperature
grand access?
@TildalWave he didn't like my Windows 10 answer
12:15
@RоryMcCune I think your AD photo is adding to the perception of you being about 70...
@Matthew yeah that was taken on the morning of a 4:30am start, I have had a couple of surprised comments about my age based on it...
^silly gadget of the day
glowing cat-ear headphones
no doubt the audio quality leaves a lot to be desired
yeah the review indicates that the headphones ain't bad but the speakers aren't up to much engadget.com/2016/02/09/axent-wear-cat-ear-headphones
@kalina It's possible Seinhauser have got a new designer, but I suspect you're right...
seinheiser don't do crazy like that
12:22
I did see some which had moving ears, and read your brain activity...
oh yay my dealer has new "next gen 20 out of 10 super skunk"
so I asked him to give me a call back with a more realistic scale when he's not high
mmm I need coffees
20 out of 10 ! That sounds SUPER!
Is that more than 9000?
@RoryAlsop I know, it's almost too good to be true
I bet it doesn't knock me out in one go
I bet it doesn't knock me out at all
as for the "next gen", what do you think this is the console wars?
everybody knows "next gen" means "the same as 5 years ago in the mainstream PC market"
@kalina so you're suggesting that this isn't the LL Cool J of skunk?
Sam Hanna is not impressive
12:38
@TildalWave Ask ovid, he's his favorite user!
hiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii siiiiiiiiiiiiiiiiiiiiiiiiiimoooooooooooooooooooooooooooooonnnn
aaaaaaaalllllllllllllllllllllllllllllllllllllllooooooooooooo
good morning
@MarkBuffalo Hi mark! I guess you're talking about that iPhone-question. I was wrong indeed. I tried to do research, but missed the right keywords (thumbnails, windows) I guess. Thanks for pointing me on it. Learned something of your reply there and I'll do more research in the future as I'm indeed a beginner.
I don't understand what Facebook is doing today but I have received like 15 "do you know X, Y?" emails
each with different people
12:43
@kalina Yeah, Facebook kept doing that to me as well... glad I no longer have an account
basically I think it's time for a new approach to email
If FB can communicate to you through email, you're gonna have a bad time.
"Do you know X person and Y person?" No, I don't. I live under a rock.
because this mailbox seems to just get facebook and amazon spam
and amazon can properly fuck off as well
@MarkBuffalo Stop replying to kalinuh and reply to the guy who was kind enough to admit that he was wrong you donut.
12:43
I don't need 30 emails per order
What an ungrateful mong you are.
you get your WOOO ORDER CONFIRMED
then you get a dispatch
then a did you get your item?
then a rate me!
then a please rate me!
then a you still haven't rated me!
then a HI HELLO DO YOU EVEN RATE?
If you weren't buying stuff every day, it wouldn't even bother you.
then a here are some other things that people looked at
yeah then you try and use some other E-Commerce sites and remember why it was that you love amazon, which is they actually deliver
12:44
and here are some more things you looked at
then a YO CAN YOU PLEASE RATE FFS
@O'Niel No problem
then a it's been a week since delivery, what did you think?
@kalina What's amazon.com pointing to in your host file?
@kalina hate that
'Cause I think we're not using the same amazon.
12:45
my host file doesn't have an amazon.com in it
Made you look!
@Simon my amazon ordering massively increased when I moved to the countryside
@Simon nope
@RоryMcCune Understandable.
@Simon Amazon.ca are probably more canadian, eh?
12:46
@kalina Then you don't know if a virus didn't put it there.
@Simon I'm up to like 140 orders a year
@kalina PFFFFFFFFFFT.
little more laid back
@Simon pls I don't get virii
@RоryMcCune That's nutty
@RоryMcCune I actually stopped buying things on Amazon a while back
like a year ago
Considering that 1 CAD = 0.72 USD, yup, I gotta shop at .ca
@RоryMcCune God damn man, I don't even know if I got 140 orders total.
12:47
@MarkBuffalo amazon is the best/cheapest option for me to buy anything, nearest large shopping centre is over an hours drive away
I definitely ordered more than 100 things from Amazon last year
I have prime so shipping is usually 0
Yep, and the store is probably more expensive anyway
and amazon are extremely reliable
Amazon are extremely reliable
although I hate how careless they are about the environment
12:47
@kalina yeah the packaging thing is nuts
I got a huge shopping centre with 300+ stores literally 10 mins away from my house.
@RоryMcCune I sometimes order stuff from dx. You get stuff you order. Eventually.
there is nothing more stupid than buying a SD card from Amazon and it turning up in a box big enough to have a PC case in it
Though where possible I buy local.
@JourneymanGeek yeah obscure electronics might be best from DX as long as you know about the shipping times
12:48
(we have decent small computer stores here still!)
@RоryMcCune I joke that they are suprise gifts to myself.
@Simon sure when I had that there were many fewer amazon orders
@JourneymanGeek lolz
@RоryMcCune Yeah I get that.
@RоryMcCune I don't know, even living near a shopping center unless it's something I require today I will just order it online
less hassle than being out in public with all the cretins
trick is to consididate orders so you get the better shipping.
Electronics are usually cheaper on Amazon so that's pretty much the only thing I get there.
12:49
@kalina ah I used to use walks to the shops as a good reason for excercise :) but yeah amazon is still handier
@kalina meh. I go to SLS simply cause its a disreputable hive of scum and villany.
Gotta support the local grubby places!
no you don't
@Simon heh, at some point I may order speakers off em.
@kalina and its cheaper
12:50
I WAS POINTING AT KALINUH PLS JOURNEY
Unless you buy a phone and they sell you the special warranty
But no one buys a phone there
@JourneymanGeek but you might catch something by being there
except dumb people.
@kalina what dosen't kill you....
...can still make you very ill
... can make you wish it did.
Also, I tend to go on weekdays when its less crazy
12:52
Yeah people are dumb in general so it's better to avoid social areas as much as possible.
eugh I need to go out and commit a felony
but that means I need to get dressed
which means I need to get cleaned
which means I need to stand up
which means I need to finish coffee
which means I need to lift my arm away from the computer and pick up the coffee
mmm coffee
technically in certain parts of the world, you don't need to get dressed to commit a felony
well true but I have certain standards I must adhere to
no nakedness in public
only purchase marijuana from dealers with enough balls to sell outside a police station
only drive the loudest car possible to said pick up
Is that having balls or being dumb?
12:54
which means I need to export this track so I have something to listen to
it's a safety precaution - if anything goes wrong police are literally a stone's throw away
for which you'd get prison time for throwing a stone at a police officer
@kalina u wot m8
basically fuck, out of the 74 emails I've received so far today 65 of them got deleted for being fucking pointless fluff
@MarkBuffalo u fkin' wot
come at me
@kalina u focking wot m8
@kalina unless your dealers are crooked cops....
@JourneymanGeek oh no that's not the case
possibly the most laughable thing ever
@MarkBuffalo yow wanna make summat of it lets av it
proof that once upon a time I enjoyed being in the bridge
I didn't think that existed
13:00
@kalina When is that ever safe?
I'm trying to find the game of stars image
if I could remember my gravatar password I'd change my avatar
don't do it
We enjoy the rainbow pony
It's you
Cute rainbow pony of DEATH
well it's time for sugarplum angel with a heart made of fire
13:17
@kalina TIL what HBO stands for.
@RoryAlsop oh?
heart broken orphan?
From that link by @Iszi
I should delete it because of mobile data.
There's actual jobs where the title is Paranoid? That's funny
@MarkBuffalo Am I correct? security.stackexchange.com/a/113299/99202 before answering I watched the video again (already seen it in the past), and researched every term.
@O'Niel Overwriting all free space on an SSD will defeat wear-leveling
It'll probably dramatically reduce the lifespan of your drive, too
@O'Niel SSD erase isn't done that way. Providers generally encrypt the disk then "wipe" by dropping the keys
13:28
Yeah, that's a good method too
@O'Niel and on hard drives
18
A: How can I reliably erase all information on a hard drive?

Rоry McCuneFrom a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices t...

FDE -> drop keys -> reformat works for pretty much every drive
@MarkBuffalo It'll defeat wear-leveling because then the microcontroller doesn't have free blocks to remap or use as 'new' ones?
bascially no-one in moderns times has any evidence that a single write over with 0's is insufficient
standard still talk about multiple over-writes 'cause they're old and outdated
@RоryMcCune I've never been able to recover data that's been overwritten once
13:30
@RоryMcCune Note that "modern times" here means "within the last 15 years"
But yeah, Guttman 35 is where it's at
@ThomasPornin yeah, I'm old so that counts :)
That's the ultimate tinfoil
In the world of Information Security, tinfoil determines the winner.
This whole overwrite business is still grossly inefficient. Using encryption and dropping the key is a lot better.
Ain't Seagate able to recover overwritten data?
13:32
@RоryMcCune What do you mean by "dropping the key"?
I'd like to make sure we're on the same concept, and that I am not missing anything d:
@MarkBuffalo they use symmetric encrpytion (e.g. AES) and store the key on disk. If they wipe that key, the data is effectively unobtainable
unless someone else has the key
or can break 128-bit AES
@O'Niel In older times, some companies could retrieve overwritten data by scanning the disk surface for data elements "on the edge" (during the overwrite, the write head was never at exactly the same emplacement than it was during the previous write).
so why wipe the data if you can just wipe the key
yea, that's what I thought here
But it was expensive and hard disk density has increased a lot, so it is unclear whether it is still doable right now.
13:34
@ThomasPornin Okay, thanks!
@RоryMcCune This is a nice illustration of the general principle: cryptography does not solve the problem, but it concentrates it into something smaller, thus more easily managed.
Instead of wiping 250 GB, you just wipe 16 bytes.
@ThomasPornin yeah, that's a good way of thinking about it ..
Wipe my bytes real good.
Mmh, when responding to a message with Edge, the cursor in the bottom edit box is set at the start instead of after the ":xxxxxx". This is inconvenient.
That's what you get for using Edge.
13:36
Also, there is some autocorrect thing activated.
@Iszi I love article you linked. This is exactly how I feel.
@RоryMcCune @MarkBuffalo Edited my post. Better now? security.stackexchange.com/a/113299/99202
@RоryMcCune Also, if I recall correctly, magnetic force microscopy takes a long time just to find a few bits/bytes. It's not practical at all
@MarkBuffalo It depends on which bits you are after.
If you want the lost encryption key for the nuclear force launching codes, then it is worth the effort.
@MarkBuffalo Works quite well on washing machine sized disks though
13:45
@ThomasPornin Haha, yeah
@Matthew The old, gigantic hard drives?
@O'Niel yeah looks better now
@RоryMcCune You look better.
-1
Q: Access to system32

Vadim TatarnikovIs there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.

.
@Matthew Dude. That is voodoo-level forensics.
@MarkBuffalo I know! Is very impressive, and almost completely impractical for any more modern system.
13:50
@Matthew After viewing the article you linked, I feel inadequate :(
@Matthew You're very impressive and almost completely impractical for any more modern system.
@MarkBuffalo Wish I did it... Sadly, wasn't me that did it
@Simon Glad to hear it
@Matthew @MarkBuffalo that's about the only time anyone's done it, and its an old drive
Also, no one ever seems to realise that there's an addentium to the guttmann paper and the point of the guttmann pass is to wipe drives of any encoding method. :(
@JourneymanGeek Yeah. It's also reading the intended data, not the previous data. With such large sectors, it's possible that there is some evidence of previous states, but they didn't look for it
13:55
yup
No one's actually reported getting information from a drive with a MFM
Besides, its easier to beat someone with a wrench
@JourneymanGeek But Guttman is good for tinfoil
Tinfoil count since Markus joined the chat this morning: 3
@Simon Tinfoil
@MarkBuffalo people who quote guttmann without reading the whole paper should be taught the proper way of data sanitisation with hard raps to the knuckes with a fully functional jackhammer.
@JourneymanGeek O_O
13:58
35 passes is not a bloody magic incantation. Its much like chasing a cat before doing your morning prayers.
Just cause your dad did it does not make it right
@JourneymanGeek But it's got electrolytes.
@JourneymanGeek So what you're saying is, chase the cat after you finish your morning prayers?
@MarkBuffalo so so does your mom... and just cause your dad did it...
The only thing Guttman 35 is missing is chicory
@MarkBuffalo The story went that this old priest would go to a riverbank to do his prayers. A cat would drink the milk that he brought as an offering so he'd chase it off.
Nah dude, I'm just messing with you
-2
Q: Access to system32

Vadim TatarnikovIs there a way anyone can access the system32 folder on Windows without being logged in? If so, how would he do that and how to prevent it.

you focking wot m8
14:00
I posted this literally 5 mins ago Markus.
@MarkBuffalo clearly there's a special place in hell for you.
@Simon Yeah, I'm bringing it back
@JourneymanGeek <3
-.-
There's a special place in hell for him too
I'm now a hundred percent sure that you were the special kid at your school.
14:01
But his special place probably dosen't have chicory in their coffee.
@Simon chicory man.
@Simon You should be 110% sure.
14:14
@kalina it says it at the bottom of your game of stars poster. in very small writing
> Worms written in 2001 are more capable of lateral movement than most pentesters
2
@RоryMcCune You might like this. There's a lot of talk about containers.
@MarkBuffalo interesting talk but I think his quote is missing a point
Worms don't have to worry about clean-up/not breaking things
pentesters do
Yup, that's 100% true
@MarkBuffalo Worms that were crawling around a couple of million years ago are also very good at lateral movement
@Matthew lol
Yup, we banned them.
No way am I allowing my kids to get on the cloud via those toys. That's super creepy
It was an astonishgly poor move from vtech
I swear that banning more than a single A4 side of terms and conditions, printed at 12 pt in Arial (and that being the full thing - no external references) would reveal a whole lot of dodgy companies. If you need that much pseudolegalese bumf, stop trying to cover your arse
it's like walking into a restaurant and being told "Hey you might get food poisoning here, but that's your risk"
and when challenged the restaurant says "hey it's impossible to rule out food poisoning"
Yeah, blaming the parents is dumb
Are you even legally allowed to collect information on children? I doubt it.
14:37
Yes - legally you can in the UK. But you have a lot of hoops you are supposed to jump through in order to protect it.
That's messed up. You can't do that in the states
And you can't just divest responsibility by saying "it's your problem" - The ICO have certain requirements around any PII
That terms of use makes me want to projectile vomit
Almost makes me want to campaign at the toy shops that sell these things to stop selling them due to irresponsible manufacturer
They'd drop them like a lead balloon if it was causing physical harm...
shouldn't even be gathering data like this on kids
you were able to access their voice files, pictures, etc
14:42
I certainly hadn't realised how much data they were collecting - don't have kids, so tend to ignore anything aimed at them. Last time I saw a Vtech device, it was sort of like a noisy calculator
> But it’s not just pictures. The server also contained chat messages exchanged between parents and their children. The oldest logs were dated from the end of last year, while the most recent ones were from November of this year.
Fucking disgusting
Did they even run the idea past someone with some security knowledge?
I've been saying this all along... security regulation needs to be a thing
Adi
Adi
'sup, homies?
morning, @Adi
14:46
Some government contractors now need to have some, in the UK at least...
Not in the states
OK, I've tried with this, but am getting nowhere...
@NeilSmithline You seem to underestimate the consequence of the problem. If you allow an address email as a username you could deny service to a company for a ton of users. For example, 2 companies provide a similar service. Company A doesn't want its users to switch to Company B. So, Company A, for every user they have, will create an account on company B using the email of their client as a username, Then when a user of A try to create an account for B, he will receive a message telling him that there is already an account even if he didn't created one. — ꓨꓵꓷꓤꓯꓷꓯꓲꓠ 33 mins ago
Only if you're moronic enough to have a username field and an email field which you treat as separate for some purposes, but equal for others...
Oh dear... TFH...
0
A: Do you need to restrict the possible characters of a username?

ꓨꓵꓷꓤꓯꓷꓯꓲꓠAside from low-level attacks like XSS and SQL injections, this problem has way bigger repercussion when you look at the protocol level. Source of the problem The root issue is that login form provide one single box to enter either your username or your email. The idea behind that decision is th...

15:03
This is so mind-numbingly stupid
I can't believe I bothered to read that
I actually almost fell asleep
@MarkBuffalo "On the other hand, when is the last time that you were asked to confirm that you own a username?"
Lost a damn point downvoting it. Oh well
?!????????????!!!!!!!!!!!!!!!????????????
In the case of Twitter, "username" = something without an @ in, "email"= something with an @ in. Easy to tell which is which. Doesn't imply the rest of the bumf though
@Simon I just lost like 25 IQ points and am now classified as profoundly special
15:06
@Matthew I really don't understand how this is an issue.
You're able to detect if it's a username or an email, because if it's an email, the individual will have to confirm it.
It's a fake issue he's making up in his head that has no relevance to the real world
@Simon No, nor me...
Also, his username is stupid
But he thought up something cool, and wanted to "share" it with us. Unfortunately, I am now brain-damaged... and I don't say this lightly.
9 squares are not a good username
The guy pissed me off so much that I wrote a wall of text.
Adi
Adi
15:12
18
Q: How can I explain to my son why sunlight will hurt his eyes?

kennethMy 30 month old son asked me why people's eyes will hurt if one stares at Mr Sun. I told him the sun shoots sunlight, which is not visible and not touchable. But it exists and is made of atoms just like other things we can see. If it hits our eyes, our eyes will hurt just like a man hurts from a ...

@Adi Um... my babies close their eyes if things get too bright. Sounds like possible brain damage here.
@Adi How about "The sunlight will hurt your eyes".
Adi
Adi
I don't know.. tell him to stare at the sun if he likes. If he goes blind, that's on him... the idiot
parenting sounds like it should be banned under the Geneva convention
15:14
@Ohnana Being a parent has given me severe PTSD
LOL
Adi
Adi
> Look, son. I have no time for your shit. There are your eyes, and there is the sun. Wanna look at it? Be my guest.
"Mr Sun"? Rupert Murdoch?
@RoryAlsop oh yeah
@kalina Oh come on with the old avatar.
@Simon oh come on with the same boring avatar
15:19
34
Q: Upgoat or Downgoat?

DowngoatGiven an image of a goat, your program should best try to identify whether the goat is upside down, or not. Examples These are examples of what the input may be. Not actual inputs Input: Output: Downgoat Spec Your program should be at most 30,000 bytes The input will contain the full goa...

I just did this in 93 bytes using c#, but I cheated
sounds like you're being productive today
well, actually, 105
@kalina You went PINK!
...
you're so new, it's adorable
Why, thank you.
back to good ol' kalina :)
15:22
@kalina old school!
@kalina Wanna wrestle?
whatever excuse you want to use to get your hands on me this time
You said you want to cuddle with me yesterday so shush.
no, that's not what was said at all
Anyone installed the last version of tortoiseSVN ?
15:25
@kalina Sorry, I'm oviding.
fkin rekt ovid
@M'vy Puke
@M'vy I feel your pain though
I want git, and I want it know :S
reverting to previous version...
the new one seems to run slow and crashes sometimes
15:44
ugh svn is the worst
"Hey want to branch??? Let me duplicate the entire effing repository for you so you can experiment on that stupid thing that won't work."
@M'vy I use git-svn so that all my local source changes can be done with git. And just use the git-svn commands to update/fetch/commit.
yeah, maybe I should, but our repo is very remote with a bad connection here, so if I recheckout all the things, I'm up for the week-end :S
Well one weekend headache or weeks of migraines
You could also just maybe checkout a single branch if you only work with one thing.
so i have a question about the site
say a super horrible answer pops up in Low quality
but it's actually trying to be an answer, it's not spam or a comment.
what do?
@Ohnana Downvote.
15:56
@diagprov there's no downvote button in that queue i think
it just shows the vote total
I generally open the question by clicking on it. Then downvote.
It is annoying though that you can't just downvote in the queue.
@Ohnana add a comment to elaborate?
Is this the chatroom for all moderators for Sec.SE? lol seems like it

« first day (1882 days earlier)      last day (3302 days later) »