The DMZ

Ohnana

15:00

@MarkBuffalo democrat trolling republicans

Mark Buffalo

@Xander I know, I'm just messing around

> A Kentucky lawmaker has introduced a bill that would require men who are seeking erectile dysfunction drugs like Viagra to be married, to get a note of consent from their wives, and to swear on the Bible to remain faithful.

Ohnana

yeah, technically he's robbing the government by not paying his debt back

Mark Buffalo

LOL

@Ohnana Exactly! I am paying my student loan down.

76

Q: What is the risk of copy and pasting Linux commands from a website? How can some commands be invisible?

Like all beginners in the land of Linux, I usually look for websites that contain some useful shell commands, mark it with my mouse, copy it (CTRL + C) and paste it into a terminal. For example, if I need to install package_name.deb sudo apt-get install package_name.deb I will give my root ...

this is not a duplicate?

kalina

that is two questions

it should be closed as too broad

Mark Buffalo

I edited the title

the OP had a bad title

kalina

15:06

you edited the title to say that?

Mark Buffalo

yes, because it attracts more people from google :b

kalina

you need more skills

that kind of behavior is unacceptable

Ohnana

@kalina the question is already closed as fucky, so you might as well edit the title for clarity

Mark Buffalo

do eet

kalina

FIRST OF ALL

What (are) the risk(s)

Simon

15:07

OH MARKUS I THOUGHT IT WASN'T A DUPLICATE

kalina

because What is the risk is stupid use of language

Simon

WOULD YOU LOOK AT THAT?

kalina

I can has hax pl0x is more literate than what is the risk

secondly, you're clearly asking two questions

Rory Alsop

@kalina see - no salt!

Rоry McCune

@kalina s/salary/earnings/

kalina

15:09

@RoryAlsop what?

@RоryMcCune two very specific things, don't you agree?

Rоry McCune

@kalina sure earnings is better 'cause you have more control, salary implies employment which whilst more secure, has it's downsides

either way the point was that lack of uni. education doesn't seem to have held you back

Simon

Well clearly she's uneducated about a lot of things, hence why she chooses Windows over other OS.

fkin_re_rekt

Mark Buffalo

@Simon I'm going to back up and hide for now

to avoid the fallout

kalina

@Simon unfortunately in order for it to rekt I have to give a damn

Xander

@Simon Says the PHP programmer.

kalina

15:11

and well, I harvested all of my fucks

Simon

@Xander My title: Software Developer.

kalina

so there are no more fucks to give

Rоry McCune

@Simon do you start the day with <?php

Simon

@RоryMcCune No, <? because I'm pro-shorthand tags.

kalina

@Simon "Junior Software Developer"

Simon

15:12

That's a lie.

@kalina That is not my title.

Xander

@Simon They let PHP programmers have the title "Software Developer?" I tell you, standards these days...

Rоry McCune

@Simon sounds like the kind of thing a PHP developer would know about

Simon

PLS I'VE SPENT THE WHOLE DAY DOING .NET YESTERDAY

LEAVE ME ALONE

Rоry McCune

@Simon VB.NET or c#?

kalina

@Simon oh grats on being where all the real developers were a decade ago

2

(rekt)

Simon

15:13

@kalina Oh yeah, sorry, I guess I should be doing some Go like hipsters.

@RоryMcCune VB.

Mark Buffalo

@Simon I like how you say ".NET" instead of "VB.NET" because you don't want anyone to know the truth.

Rоry McCune

@Simon ohh so near, then someone made you write in VB.NET (I'm asuming we're not talking classic VB here....)

kalina

so you were using the .NET adapted language rather than C#

Rory Alsop

@kalina Salary - from Latin salārium, money given to Roman soldiers to buy salt

kalina

Simon likes VB so much because he's DIM

4

Simon

15:15

Would you look at all these Windows peasants trying to make a point.

kalina

@RoryAlsop if I ever get to your age I hope I still remember what I was doing when I was younger

Rоry McCune

@RoryAlsop ya know you don't help yourself in avoiding the age jokes, with information like that...

Lighty

I got a C# coffee mug, its glorious

kalina

if you removed those three pinned messages I bet I'd own the entire star list

Xander

@Lighty That is fantastic.

Simon

15:17

Nice brackets for a one-liner.

Arperum

> via 9gag.com

kalina

ah, do I opsec failure and show you my mug

Rory Alsop

@kalina :-)

Lighty

Not that specific mug, but the text on it is on my (bigger) mug

Xander

@kalina Please do.

Arperum

15:18

@Lighty Ya well, pics or it doesn't exist.

Lighty

Simon

NICE BRACKETS

WHAT A WASTE OF SPACE

Lighty

You're a waste of space @Simon

Rory Alsop

@Lighty Simon rekt pls

Simon

Wanna leave and come back in a few months again?

Because that's how you get me to get you to leave.

Lighty

15:21

I only come here because I have nothing better to do

like

everyone here

Rоry McCune

@Lighty you mean you're not here for the scintillating conversation?

or the insightful InfoSec commentary

Rory Alsop

@RоryMcCune Scintillation: Rapid variation in the light of a celestial body caused by turbulence in Earth's atmosphere; a twinkling

Lighty

@RоryMcCune Its fun to read the interesting convos here ins secret once a while, not denying that

stuff gets discussed here that is not complete screwing around, and pretty good for learning

not always, but you guys have your moments

Simon

Shut top.

Arperum

@RoryAlsop When did you become a dictionary that only contains obscure meanings of words?

kalina

15:23

@Xander nah

it's just the xkcd make me a sandwich cartoon with the text redone

in comic sans

to make me a coffee

Rory Alsop

@Arperum since the early 1700's

Rоry McCune

@RoryAlsop Dr Johnson I presume?

Arperum

@RoryAlsop I never noticed before. Seems like someone rebooted that part recently.

kalina

@Lighty you stalk us?

you spy on us from the transcript?

Rоry McCune

and this a private room too...

kalina

15:25

@Lighty I know sometimes they do my head in as well

Mark Buffalo

@Lighty I love those brackets. That is my style.

kalina

@Simon's code must be shocking

Mark Buffalo

simon's code probably looks like this

Dim me as wit
Message I am USING VB.NET;

kalina

Coffee coffee = new Coffee();if(coffee.Empty()) { coffee.Refill(); } else coffee.Drink(); </simon>

Lighty

</simon>

Simon

15:27

All of you can eat my left nut.

Lighty

@kalina Stalk, no, read when bored, yes

Mark Buffalo

@Simon Can't eat that which does not exist, Tom Green.

Lighty

@Simon Implying said nut exists

kalina

@Lighty DO WE LOOK LIKE A WEB COMIC TO YOU?

Lighty

@kalina Your profile pic does

Simon

15:28

And all of you can go to an originality class.

Lighty

and if the DMZ was a comic

it'll prolly be "in the back"

kalina

@Simon are you really inviting me to be that close to your nuts with my mouth full of teeth?

2

Simon

@kalina Ah you're right, unwise, I don't want AIDS.

kalina

@Lighty the first breach costs you an arm

Lighty

@kalina Kinky

Mark Buffalo

15:28

Dim wit as New Simon()

kalina

@MarkBuffalo you got there in the end

@Simon that's... so mean

Mark Buffalo

@kalina Sometimes it takes a few tries

kalina

I am the cleanest women you'll never meet, stop comparing all women to your mom

Lighty

Aids is a horrible disease people, and shouldn't be joked about, just as cancer, ebola, or Simon

kalina

ooooooh lighty rekts simon

Rory Alsop

15:30

@kalina that's how you get ants

kalina

I'm going to brb because little children are noisy and swinging things around and as a responsible adult I feel I should join in

Lighty

@kalina With or without a shotgun?

Rory Alsop

swing noisy children about!

kalina

princess bitch award goes to kalina for taking all of the toys and placing them high enough that they're out of arms reach

Mark Buffalo

@kalina You have churns?

kalina

15:35

I don't understand the question

Adi

@kalina I think even if I had the chance to cause @Simon considerable pain by biting one of his nuts, I would still not do it

It's still my mouth on @Simon's nuts, whether it was painful for him or not

Lighty

@Adi Prolly be worse than orange juice and toothpaste

Adi

Who's this?

Why is it talking to me?

Lighty

screetches

Mark Buffalo

@Adi He is the lurker below

kalina

15:38

@MarkBuffalo stop acting like you're not the newest person in the room

@Lighty has been here for years!

Mark Buffalo

@kalina Lighty lurks! I am not a lurker, although I am the newest one here

kalina

@Adi different perspectives I guess, it wouldn't be the first time I'd have been in a similar situation whereas I guess it would for you

@MarkBuffalo even though you have more internet points than me

who in turn has more than Simon

even though Simon has been here forever and has an interest in the subject

all point at Simon and giggle

Mark Buffalo

@kalina To be fair, I don't know why I have points

I know nothing about anything at all

kalina

because you're a rep whore with no standards

Adi

@MarkBuffalo :|

You know something

kalina

15:41

@Adi you're right, he does

Adi

You saying "I know nothing" doesn't make you seem humble

kalina

he knows how to open up an internet browser and get into this chat room

Adi

It just makes you seem like an annoying ass

kalina

is that why you hate me so much?

Mark Buffalo

@kalina True, that's all I know how to do

@Adi You seem easily annoyed... although I will admit I am indeed a donkey.

Adi

15:42

@kalina Bad chat message syncing

@MarkBuffalo You're doing it again. It's either faking being humble or self-deprecation to create a false image

Ohnana

@kalina haha damn you just called his ass out

kalina

@Ohnana yes because I'm well known for being soft and gentle with new people

Adi

Both are annoying

Mark Buffalo

@Adi You're reading too far into it

kalina

@Adi so it annoys you every time I say I know nothing?

Mark Buffalo

15:44

Everything annoys @Adi

Adi

Ugghhhhh.. the only think I'm annoyed about is this train internet

kalina

@Adi does it annoy you even further when I then go on to demonstrate that I know nothing about the current conversation

train internet is the best internet

Ohnana

0

Q: Why is encryption bad for passwords?

We use PGP for almost everything and it's so infeasible to bruteforce that it's considered secure. This is the guiding principle beyond CryptoLocker. But for stuff like e-mail, SSH and HTTPS, it's still considered secure even though the computational cost of encryption should be low since these a...

encryption passwords password-management password-policy

Adi

@kalina I think you rarely annoy me. I've gotten used to you

Ohnana

um

kalina

15:45

@Adi d'awwww

Mark Buffalo

@Ohnana I really like anti-weak passwords

Adi

@kalina Why else do you think I ask about you every time you disappear?

Believe it or not, some of us here don't dislike you so much

kalina

@Adi well at least there's one of you

Rоry McCune

@kalina pls

Mark Buffalo

I have a dream... and that dream is for Adi to not hate me one day

Adi

15:48

@MarkBuffalo Don't feel bad about it. My default is to hate everybody. I come pre-hardened like that

Mark Buffalo

I know, hopefully I can become non-default

kalina

he did used to hate me a lot when I first arrived here

Adi

I've come to stop disliking so many folks here

kalina

believing correctly that I'm an imposter who serves no purpose here

Adi

Like Kalina, Lighty, and a few others

and I've come to actually like a very small minority of those, like Rory M and David

Simon

15:51

How can you stop disliking Lighty?

Adi

@Simon I'm not saying he stopped being annoying to me. It's just that, over the time, I understood him a bit more

I learned more about him to know why he's annoying

and then it becomes kinda okay

Rоry McCune

googleonlinesecurity.blogspot.ca/2016/02/… <-- Buffer overflow in DNS resolution in glibc anyone...

Simon

Interesting, your hatred has gone next level where it wrapped around.

Rоry McCune

(apologies for the on-topic message)

:op

Adi

@Simon It's more like being around here long enough to see folks as actual human beings with their own unique personalities, life situations, feelings, hopes, dreams, etc.

Simon

15:54

@RоryMcCune Wasn't there something else somewhat recently about getaddrinfo?

Mark Buffalo

@RоryMcCune lol.

Simon

@Adi I see.

Rоry McCune

@Simon yeah it rings a bell but I can't place it. This one could be v.interesting as, IIRC many SSH servers do a DNS lookup when you connect to them, so it might be possible to just connect to an SSH server without logging in, to pwn it

Simon

Damn.

Mark Buffalo

@RоryMcCune This actually triggers me. A while back, I was doing a DNS probe of a few thousand servers, and got rm -rf /*'d after that. This was, uh... 18 years ago

Rоry McCune

15:57

30

A: What is the point of sshd “UseDNS” option?

The UseDNS option is mostly useless. If the client machines are out there on the Internet, there is a high chance that they don't have any reverse DNS, their reverse DNS doesn't resolve forward, or their DNS doesn't provide any information other than “belongs to this ISP” which the IP address alr...

^ yeah that's it SSH does it by default

Mark Buffalo

Lol

Rоry McCune

so an exploit for this bug would == bad times for many SSH server owners

Adi

@Simon blog.qualys.com/laws-of-vulnerabilities/2015/01/27/… ?

Simon

@Adi Yep, that must be it.

Rоry McCune

@Adi yeah that sounds a lot like this...

you'd have thought they would've audited the code after the last time...

Ohnana

16:00

@MarkBuffalo REKT

Mark Buffalo

@Ohnana Yeah, their DNS response pretty much pwned me

Then they got shell and gave me a nice rm -rf to the grill

that's about the time I started obsessively learning about RCE

Simon

And then your daughter, who wasn't even born yet, triggered a buffer overflow.

Mark Buffalo

@Simon In VirtualBox

I'm actually pissed that I didn't save the stack trace

had just gotten home, and I wanted to play a game

Adi

PoC -> RCE github.com/fjserna/CVE-2015-7547/blob/master/…

Mark Buffalo

16:16

@RоryMcCune Thanks for this. Do you have some sort of subscription?

Rоry McCune

@MarkBuffalo nah I mostly get this stuff from twitter

Mark Buffalo

well I actually really appreciate you posting this stuff

Rоry McCune

that one was Dragos Ruiu

Mark Buffalo

more than you realize

Rоry McCune

heh I get through waaay too much twitter, HN etc, has to come in handy for something :)

Mark Buffalo

16:18

I really need to start browsing twitter, even though I utterly hate it

Adi

Alright. First step is done. Now I'm able to segfault my stuff

Rоry McCune

@Adi so I'm guessing this works on current ubuntu/debian type systems?

Mark Buffalo

@RоryMcCune think I found a RCE vuln in a java library ;x

Investigating it now

Adi

Rоry McCune

@Adi nice

@MarkBuffalo always interesting, if it's a published one you could see if you can get a CVE :)

Mark Buffalo

16:26

I've never actually bothered with submitting CVE's

maybe I should though

but now I am anxious that someone will beat me to it

Rоry McCune

@MarkBuffalo CVEs are handy if you ever want to work in the vuln. researcher world, shows experience. (I also saw a bank looking for a CISO who had CVEs....)

Mark Buffalo

Indeed

Most of the vulns I find are stuff that had already been identified, but which were the result of bad coding practices.

"why is this crashing...?" etc

Rоry McCune

bbc.co.uk/news/technology-35586446 <--android malware spreading via SMS anyone...

co-incidently apparently it won't install if the phone's language is set to russian

which means nothing of course

kalina

well that's me safe then

Ohnana

> HSTS is a TOFU protocol

Adi

16:39

@RоryMcCune Some modifications. Now got EIP control

Rоry McCune

@Adi going well then!

Adi

Surprisingly well

Most likely won't have RCE today, though.

Rоry McCune

@Adi still a good start

Adi

A lot of embedded systems don't have ASLR, so I won't even try to bypass that

Rоry McCune

heh yeah it's interesting now with IoT how many of these problems will be forever-bugs

Ohnana

16:44

I mean, when you're talking about having EIP control, you can pull a "draw the rest of the fucking owl" maneuver and still know what you're talking about :)

Adi

AAAAAAAAAAAaaaa.. I'm so excited

I need to step outside a bit

Fresh air

Rоry McCune

@Adi don't you mean 0x410x410x410x410x410x410x410x410x41 you're exited?

Ohnana

@RоryMcCune /tomato

BOOOO

Simon

The ultimate paranoid user would learn Russian to start using every single system in Russian.

AviD

or in Canadian.

Simon

16:48

The dumbass has arrived, it's time to leave.

Mark Buffalo

@RоryMcCune Hack grandma's IoT picture thing, display fabio-based images

Mark Buffalo

17:21

security.stackexchange.com/help/user-was-removed

:-O

Ohnana

@MarkBuffalo yeah that's a thing that happens sometimes

schroeder

I just lost 70 rep because a user was removed?

any way to see who left?

Mark Buffalo

17:37

Fortunately I only lost 10 rep

It took away this morning's rep-cap!

hmm... I wonder if I know who it is... dons tinfoil hat

CodesInChaos

@schroeder If a mod deleted them, it should be visible in the mod's admin history

Mark Buffalo

Nope, he's still around

He may have contacted StackExchange staff and asked for his account to be deleted for some reason

Xander

Crap, I just lost 75.

Boo.

That makes 85 so far this week.

Mark Buffalo

@Xander Two users deleted?

Xander

Scratch that. My net for the day is -75. I just lost 100. 110 on the week now.

Mark Buffalo

17:44

Wow.

What happened?

Xander

@MarkBuffalo Yeah, lost 10 from one a couple of days ago, and a 100 from the one today.

Mark Buffalo

Ouch

My heart sunk when I saw that. I thought I got banned or something

Adi

@RоryMcCune :D

Now that I've taken a break, I continue!

Xander

@MarkBuffalo @schroeder None of my recent answers have their upvote totals changed, AFAICT, so I'm thinking it's an older (or at least not brand new) user.

Mark Buffalo

yeah

And I only lost 1 point, so they hated me

:D

Xander

17:52

On the plus side, my last six answers have all been the accepted answer, so at least I've got that goin' for me.

Mark Buffalo

Which is nice

Xander

@MarkBuffalo :-)

Ohnana

0

Q: Where can I find example security testing contracts?

I'm a lawyer interested in information security, and am collecting examples of security testing agreements to compare. What are some publicly available examples?

penetration-test legal

Mark Buffalo

The fuck

Ohnana

??

Mark Buffalo

18:00

Malware detected on your phone...

Ohnana

legal is OT, right?

Mark Buffalo

Malware no longer exists on your phone...

Two popups.

Xander

Free flags

-2

Q: Kale and Swiss chard ribs are some other good

Kale and Swiss chard ribs are some other good options to get green leafy vegetables in your diet. Berries Anthocyanin is a phytochemical found naturally in many fruits and vegetables, but neuro nzt its presence is particularly high in berries. The phytochemical anthocyanin has been shown to actu...

x.509

Ohnana

swiss chard is a strange vegetable

Mark Buffalo

Lmfao

Xander

18:03

@Ohnana Legal advice is. This is not that, but still probably OT.

Mark Buffalo

Flagged

@Ohnana VTC'd as too broad to protect pentesters from lawyers

Lulz

Ohnana

0

Q: Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, how is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken. Is that established terminology though?

terminology

wat

Mark Buffalo

@Ohnana Unclear?

What is FFW? Fig Feautiful Woman?

Ohnana

@MarkBuffalo FFIW i think

Mark Buffalo

-1

Q: android client app authenticating with a server

I need help please. I am to create an android app that communicate with a server. How do I possibly use Kerberos with LDAP to implement the authentication? Or is there a better alternative? I want to create a mobile banking android app to securely communicate with a server.

android kerberos ldap

-3

Q: Calculate ALE Help Needed

I have no clues on how to answer this questions ARO = 0.1 SLE = $20m x 0.30 = $60,000 $60,000,000/10 = $6,000,000 ALE = $6,000,000 x 8 = $48,000,000

risk-management risk-analysis

wtf

@Ohnana Good job with the reviews

Ohnana

18:17

:D

I may not be able to answer questions, but i can sure as hell review the fuck out of all this trash

Mark Buffalo

I can see your reviews ;p

Ohnana

Really not that long but I took a drink of my soda and was distracted by a hot co-worker during that time. — Eddie Studer 23 mins ago

O LAWD

Mark Buffalo

That's funny though

Ohnana

@Xander do we remove passive aggressive "i googled that for you" stuff?

Mark Buffalo

I'm pretty sure lmgtfy answers are not acceptable.

Xander

18:19

@Ohnana Generally, yes. I've seen multiple LMGTFY comments deleted, for instance.

Mark Buffalo

Doesn't mean all google search links are invalid, but when you try to reference lmgtfy, it informs you that it isn't allowed

Ohnana

flegs!

0

A: Where can I find example security testing contracts?

It took me about 15 seconds to type "example of security testing contract" in google. http://www.pwcrack.com/penetration_contract.shtml Hope this helps

Mark Buffalo

0

Q: 49 Charecter hash ... unable to decrypt it . What kind of hash is it?

I have hash which is 49 charecter of length ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb Please some help me out .....

hash password-cracking

free flags

Ohnana

FLEGS EVERYWHERE

@MarkBuffalo wait really? how?

Mark Buffalo

I am a mini-moderator

Ohnana

18:22

:OOOO

yaya

Mark Buffalo

The 10k rep thing

It's really useful for helping to keep the site cleaner

It shows you going crazy in all categories, lol

Ohnana

REVIEW. ALL. THE. THINGS.

Mark Buffalo

0

A: Tracing nuisance or malicious cellphone calls

Phone service of any kind is what you the consumer pays for and the provider of these services should have to provide the customer a detailed copy of all received calls including unknown callers phone numbers to their customers. The phone provider can see and trace all incoming and out going call...

this seems very location-specific

Ohnana

it's also not an answer to the question

Mark Buffalo

I think it is an answer, but just a very broad/location specific one

@Ohnana Why are you not able to answer things?

Government secret NDA? :p

Ohnana

18:27

a lot of the questions are too technical

and the things i'm good at don't have many questions

Mark Buffalo

ah

Ohnana

there's a reason why i jumped on that linux question

Mark Buffalo

Show me teh linux question

Ohnana

43

A: Why disable root?

If you're not using Root, you're using sudo! Sudo is a great way to become root only when you need to. Root is a giant target. What's root's username? Root! I'm so smart :) Logging. Sudo has a greater command of audit logging (so that when someone uses sudo to do something silly, you can tattle...

got three badges offa that one :)

Mark Buffalo

Nice crispies

I got like 73 upvotes for my last linux question

and around the time I posted it, compared to yours, it was at about 24

So you might get to 100 soon with it!

Ohnana

18:35

:O

Mark Buffalo

ibtimes.co.uk/…

Ohnana

rekt

Mark Buffalo

@Ohnana You'd be surprised how insecure law enforcement management of personal data is

Or maybe you wouldn't be

In fact, I've seen a case where it was stored in one of the most horribly insecure ways. It included case details, incidence responses, concerns and reports that other people wrote to them, etc. And pretty much anyone could access them, even if they were run-of-the-mill. No actual separation of security concerns.

Xander

What? Police don't have good InfoSec practices, you say?

darkreading.com/attacks-breaches/…

Mark Buffalo

lmfao

Yeah, actually, it's pretty sad. It's sad because that data should be confidential, especially case data.

It's sad because it hurts innocent people when they report others to the police. Yeah, a malicious hacker could literally hack the police and run off with all the .docx, .xls, etc., reports... and find out you've ran your mouth/ratted them out

And take action against you / hide their crimes / etc.

Ohnana

18:56

@Xander i for one am shocked

Transcript for