« first day (1889 days earlier)      last day (3289 days later) » 

19:00
@Simon is that like calling a waaaahhhmbulance?
@RоryMcCune roro, I'm not 133 years old, I don't understand the reference!
@RоryMcCune I have a really good solution to web server hacks
It detects every single possible intrusion into web servers, no matter what
That's a broad claim, but... it works. Unless the attacker can break out of the environment and control the main server
In most cases, they can't do that if you have proper concern separation and auditing
Suuuuuuuuuuuuuuuuuure Markus.
@Simon pls somon, do you even urban dictionary bro urbandictionary.com/define.php?term=Waahmbulance
#Urban-Rekt
19:17
@RоryMcCune #Urban-Rektionary
Need help assembling a capture filter for Wireshark. Any volunteers?
@Iszi Sure
Describe your filter requirements
All traffic flowing to/from the local system, and either of two specific remote IPs, but exclude traffic to/from a specific port on the remote IPs only.
i.e.: If the traffic is coming to/from the specified port on the local system I want it included. But if it's to/from the specified port on the remote systems, I want it excluded.
I wouldn't be surprised if the problem is deceptively simple. I just don't spend near as much time with Wireshark (or similar tools) as I'd like.
"PS we don't do hardware/software support"
ex-dad-rekt
@Simon Buzz off. @MarkBuffalo already volunteered.
19:23
@Iszi port to be excluded?
@MarkBuffalo 443
@Iszi That's literally the worst person who could have volunteered.
I don't know the answer at all and I still would have been a better volunteerizer.
Damn. Ninja'd.
@Simon There. I un-said it. Whaddya gonna do now?
YOU CANNOT REMOVE YOUR SHAAAAME
I'm gonna unsay what I said.
UNSAID CEPTION
19:26
@Iszi (ip.src==192.168.0.0/16 and ip.dst==192.168.0.0/16) and (ip.dst==hax.nsa.gov and !(tcp.port eq 443))
hang on, let me verify this... uh....
uh, this isn't gonna work
Yeah, something didn't look right about that.
give me a second
Told ya ex-one.
Looks like the one you gave is for all traffic within a /16, inbound to a specified host, excluding all traffic on 443. WAY off.
19:28
fail less
give me a bit, I am doing a lot of things at once
And is that a capture filter or display filter? I'm looking for capture filtering, but I think the syntaxes differ?
display filter
I'll fix. few mins
20:03
So...sick...Of Apple questions.
@Xander i just upvoted one
whatcha gonna do kiddo
@Ohnana Complain some more.
...fair enough
that @Ohnana always upvoting apple questions
@Iszi they do, for some ultra-bizarre reason
@kalina yeah total fanperson
20:16
@RоryMcCune I think one comes from tcpdump with existing compiler to whatever their binary thingy is called
@Iszi Sorry, I am doing a million things at once
Berkeley Packet Filter (BPF)?
Yep
I suspect wireshark decided to make an "easier to use" filtering syntax for their UI.
@lady.doughnut <waves> you keeping an eye on @Simon , to make sure he doesn't misbehave?
@diagprov sounds probable, doesn't half cause some head scratching when using it though
@RоryMcCune Yep. BPF is compiled down to something that I think is executed in kernel on each packet to decide whether to pass it to userspace.
interestingly BPF seems like a general filtering thing, it's what's docker uses for seccomp filtering
20:21
@RоryMcCune Yep, it's not tcpdump specific. I thought it was, but it isn't.
@diagprov yeah when you mentioned it I knew it seemed familiar, then remembered from reading about seccomp-bpf
@RоryMcCune oh i'm sure he does -.-
@lady.doughnut well you only have to look at the room's pinwall to see what he's been getting up with with some of the other room users!
@RоryMcCune Tbh i hate macs. i am not a fanboy
BUT. the one question was actually intriguing
@Ohnana @AviD loves Macs.
20:23
he would
@Ohnana you can't expect me to believe that the kind of person that uses the word "Octothorpe" isn't a mac person....
YA HEAR ME @AviD YOU'RE A STUPID FANBOY SO NYEH
@Ohnana I think the word you're looking for is "hipster".
@RоryMcCune using stupidly precise words always struck me as a GNU/LINUX thing
and's it's called an OCTOTHORPE!!!
not a pound, bang, hash, NO!
"please enter the pound sign now"
is a phrase I've heard
"please press the octothorpe button"
is not
20:25
@RоryMcCune Have to be careful with this though, because I would type £.
because people are dumb
@diagprov yeah I mentally translate to hash, then just think "code comment"
@Ohnana bang
@RоryMcCune <!-- ?
@RоryMcCune --?
@RоryMcCune //?
@RоryMcCune '?
@RоryMcCune REM?
@kalina that's an awfully large selection of comment symbols from someone who's not a techie
20:27
@RоryMcCune yeah thanks to you all i'm learning new things about him. And I thought he loved dem ponies.. damn
@lady.doughnut inorite it's a shock when you find out a loved-one is a pony-hater!
@kalina I know, --? Isn't that Haskell?
@RоryMcCune Clearly a techie :)
@diagprov sql pls
@diagprov despite protestations to the opposite
@RоryMcCune Octothorpe was the term made up by the team at Bell Labs when they put the symbol on the telephone. Unfortunately for adoption, they forgot to tell anyone that is what it was called, so everyone else made up their own names. And now we have them all.
20:28
@lady.doughnut he does love ponies
@Xander lol nice!
Wait wait wait, lady.doughnut... this is not Simon's doughnut?!
@RоryMcCune no I know nothing
how to computer plz
@diagprov indeed it is
@kalina p.....l.....s
@RоryMcCune NOTHING
if 100 was the maximum number of things you could know, I know 0.000000000000001
@kalina Wait what? I heard you were a crypto nerd.
@kalina pppppppphbt
@Xander that's a bit of a lol
@kalina you're secretly MC Frontalot aren't you?
20:31
say who?
@kalina That's more than most people, whose knowledge is strictly negative.
@kalina You have almost as much rep on crypto.SE as I do.
@RоryMcCune oh dear, no
@MarkBuffalo "Hax" ? really ?
@ThomasPornin Or possibly even imaginary in some cases.
@Xander yes but that means nothing, you're a modrater and so excluded from all interesting comparisons
@kalina either is fucking with us or doesn't understand how she could be good at things
@ThomasPornin Had to give it a few random letters
@kalina YOU HAVE ENOUGH REP AS A FUCKING MODERATOR. STOP IT.
@ThomasPornin even compliments from the bear :-(
@Ohnana I'm not a moderator are you even paying attention?
20:32
@RоryMcCune That's @kalina? Nice!!
@Xander it seems likely, yeah
oh gosh
with your silliness
I'm going
@kalina off out to the bright midlands lights?
no the children are more tolerable than you guys atm
@kalina lolz, now I know you're joshing
20:34
no it's late, we wore them out and they're basically unconscious
20:46
#chatkiller
@RоryMcCune Any suggestions for that filter? Maybe I should just go RTFM.
@Iszi I'm afraid my knowledge of tcpdump/wireshark capture filters begins and ends at host x.x.x.x ...
These hackers would probably make more money by actually creating useful software. :|
I'm afraid my knowledge of tcpdump/wireshark begins and ends at tcp
They obviously have actual coding skills... and yet, they prefer to use that for highly ebil things.
20:50
or maybe you're the evil one
for taking part in capitalism
cry more socialist
"ön your device" LOL I had to scroll a bit to check that my monitor didn't develop dead pixels :)
yeah that makes sense
@TildalWave wait where?
0
A: Why are there no "disconnected" OTPs on mobile handsets?

JaimeCastellsA quick search through Google Play found three OTP generation tools: FreeOTP Authenticator; Google Authenticator; Authenticator Plus. While each of those claim to offer token generation "on your device", some may require a network connection, I can't be sure without actually using them. One reas...

I just fixed it
20:55
haha
@TildalWave why is this question open?
it asks “why doesn't X exist”, but X does exist, so how is it answerable?
@Gilles good point
@Gilles Because we don't have a "Not a real question" close reason any more.
dunno
I just saw it
@Xander "unclear what you're asking" should do
I VTCed as product recommendations
21:00
I mean, I don't want him to add more detail but it is unclear to me what the question is
There definitely are OTP applications on mobile handsets, which makes this question unanswerable. (How would you answer “Why did you stop beating your wife?”?) Stack Exchange isn't the place to collect a list of implementations. — Gilles 2 mins ago
@Gilles WTF?!
oh right that shit
jesus lord man that's really ambiguous in a bad way
@Gilles I'm not sure he'll get the "Why did you stop beating your wife?" part
@TildalWave good point, I edited
If he can answer “Why did you stop beating your wife?”, I don't care what he makes of it
nice edit
21:08
@TildalWave Reminds me, I need to set up my OTP generators again on the new phone. Thanks.
@MarkBuffalo Gave up on the super-specific filtering. Realized I don't actually need it so particular right now. Exercise I'm going through won't mind losing the chunks I'll miss.
@Iszi I can help in a bit... right now I am swamped with a lot of stuff all at once
@MarkBuffalo No prob.
There's no (easy) way to filter by time range is there? I mean, in relation to "local time" not "time since start of capture" (assuming I have not established such relation)?
wut
2
Q: Website hack attempt?

ScottI just noticed that the top line of my index.php file got changed to what's below. <?php preg_replace("\xf4\x30\41\x1f\x16\351\x42\x45"^"\xd7\30\xf\64\77\312\53\40","\373\x49\145\xa9\372\xc0\x72\331\307\320\175\237\xb4\123\51\x6c\x69\x6d\x72\302\xe1\117\x67\x86\44\xc7\217\x64\260\x31\x78\x99\x9c...

I ROFL'd
because the pic
wait, what?
21:26
WTAF
lmfao
Oh great... here come the close voters
Too late, I already repcapped
one of these days i will flag one of your answers as low quality and i will feel soo happy
gets on the floor, and gets kicked by the vote closers THUG LIFE, THUG LIFE, THUG LIFE
@Ohnana maybe ask for photo attribution / copyright
@TildalWave I found it on imgur
21:28
@TildalWave what do you mean?
@MarkBuffalo yeah sadly that doesn't mean you're allowed to use it, but I did check and it seems it's in public domain
DAMN IT
HAHAHAHHAHAHAHAHAHA
/cries
THUG LIFE, @Ohnana
21:30
also, SE should really make attribution easier and the need for it more obvious
Did you see that movie, "I Think I Love My Wife"? Well, the protagonist is in someone else's house and talking to someone else's woman... the guy comes in and threatens to beat him for being near his woman. Before he can initiate the beatdown, two cops come in and knock him over, and beat him with sticks. As he's getting beaten, he just screams, "THUG LIFE, THUG LIFE!"
@Ohnana Are my answers low quality? :(
@MarkBuffalo i mean if you have an off day and it isn't up to par
i will EAT IT
RAAAGH
@Ohnana Today is my off-day
I feel my post isn't up to par... I can't work on it at the moment
Basically, it gets to the root of the issue: eval(), but doesn't explain the million other things it's doing
@MarkBuffalo it's not a very good question, even tho I'm otherwise supportive of code analysis (not code review!) here
0
Q: Compression system with multiple passwords

Andrei Vladi'd like to know if there is any kind of compression system that works with multiple passwords, like a zip archieve with 3 passwords for example.

I mean... uh...
I want to VTC as product recommendations are off-topic, but this is so incredibly basic...
Watch @Ohnana come in and carpet bomb the question though :(
21:40
/smiles innocently
ewgewdfrgfsar43tkrglkd
to be fair, someone had close voted before me
SO.
key mash at someone else
@Ohnana I VTC'd it too... but I feel so bad. I feel like I tripped a baby and stole his donut
PURGE.
YOU MUST NOT HAVE FEELINGS FOR THE QUESTIONS
21:43
I left him a nice coment though :)
but maybe I'm too weak for Sec.Se as I'm more often on Crypto.SE :/
@SEJPM I helped too.
@MarkBuffalo Is there any place to get those standard comments?
like a nice spreadsheet?
I just typed it up
> Hi, and welcome to Security Stack Exchange! We're glad to have you here. Please be sure to [take the tour]( security.stackexchange.com/tour) and visit the [help center]( security.stackexchange.com/help)!
Just remove the space between ( security...
21:45
@MarkBuffalo this sounds sooooooo standard
there needs to be a standardized version of this comment...
I've typed it a great many times
or we should create a list of standardized (diplomatic) comments....
@MarkBuffalo use [About]/[Tour] and [Help], it'll save you some typing
@TildalWave So I can just... type [About]?
21:47
MAGIC
That's... awesome
reading the help.... actually helps people D:
And also (ask) and (answer) - with square brackets
@MarkBuffalo It's weird.
I tend to suspect a non-reproducible coincidence.
I.e. there was a DNS issue, which was solved between his two tests, or something like that.
21:54
If an answer doesn't actually answer the question but an understandable misinterpretation, should I downvote?
@SEJPM I see you.
3
@ThomasPornin this may sound a bit creepy if people had no context :P
Theoretically you base your upvotes and downvotes on usefulness, truthfulness and awesomeness of answers.
But ultimately you act as you see fit.
@SEJPM THE BEAR IS WATCHING YOU.
4
And now time to go home. Bye everybody.
21:58
@ThomasPornin Later
If you were to actually put the bear's posts in context with the starred messages, it would get even more weird
@ThomasPornin Later
@TomLeek I would be honored to be mauled by your paws.
@RоryMcCune Star wall context with @ThomasPornin's new additions tell another story... lol
@SEJPM Did you get your crypto t-shirt yet?
@bluefeet Hi
@Xander I filled out the form and was told they would be send around the 28th of January
22:06
@BarryCarlyon IT'S TIME FOR YOUR MONTHLY TWO WORDS
nothing arrived yet though :/
But maybe that's because I live in Germany and they send from USA
@SEJPM Nice! I'd have worked harder to build up rep over there earlier had I known it would get me a sweet shirt. Oh well.
@Xander Wait, how do you get a t-shirt?
@MarkBuffalo be awesome at the end of the public beta
oh damn
22:08
20
Q: Cryptography — Top User Swag!

JNatI come bearing good news!!! If your name is on one of the first two pages here, you are entitled to a little care package, as a token of our appreciation for helping shape this community into what it is today! You can expect the following items to be sent your way: A T-SHIRT! STICKERS! I'...

20
Q: Cryptography — Top User Swag!

JNatI come bearing good news!!! If your name is on one of the first two pages here, you are entitled to a little care package, as a token of our appreciation for helping shape this community into what it is today! You can expect the following items to be sent your way: A T-SHIRT! STICKERS! I'...

@SEJPM Yes, this.
TL;DR: be on the first two pages of users sorted by rep
once the site graduates or once it actually gets a design?
I wish I knew more about crypto
My knowledge is very basic
It's time to become a cryptowizard
on Crypto this was equivalent to "have ~1.1k rep in Jan '16"
@TildalWave once there's a design (because the shirt is based on it)
22:10
too easy, didn't bother :P
@SEJPM I meant when do you take the top two pages of users list
@TildalWave when the post is made
i.e. "shortly" after there's a design
yeah, that "shortly" is in dev time
We got our new design on dec 21st '15 and the SWAG post was made on Jan 12nd '16
so basically, I just look for news of beta sites soon having elections, stretch my muscle there a bit in answers, and I'll get a tee
seems wrong
nah
22:14
@MarkBuffalo Which bit?
I joined one month before our end-of-beta elections to Crypto
didn't find it before
i.e. which area of crypto are you interested in learning more about?
@diagprov As much as I can
Right now, I know what to use, when, and why... for the most part. I do not understand the underlying implementation, math, etc
@MarkBuffalo that's enough for many questions on Crypto.SE
@MarkBuffalo implementation: "don't do it yourself", nearly always fits
@MarkBuffalo maths are the easy part of crypto
22:21
@TildalWave depends on your area
GNFS and FHE math certainly isn't easy
@SEJPM as maths? that's peanuts
implications of all of that are the tricky bit
@MarkBuffalo Ok so, I'd split the crypto world in two: block ciphers, streams, and hashes and then separately public key crypto. The reason I do this is because the former is usually not heavy maths, whereas the latter, at least for understanding the maths bit, is heavy maths.
@diagprov third world: how to use crypto
For block ciphers, I recommend "the block cipher companion", an excellent book that walks you through attacking some toy ciphers. If you find that too easy, Schneier's self-study cryptanalysis course is the next step. I started this... it's hard work.
I don't think there's any particularly central resource for understanding modern hash design (@ThomasP ?). Perhaps Aumasson's "The Blake Hash Function" might be the closest (it's a rationale of "why", for Blake, an SHA3 candidate). I haven't read it.
Just read the design rationales (for hashes)
22:27
I've found that finding a way around encryption is nearly always successful
for example, get your hands on teh key
getting that key is not always difficult these days
Mostly, I just try to find a way around what I don't understand
Really depends on the context, though
"I have a shared secret on embedded devices. How can I make them securely communicate?"
could you answer that?
For public key crypto, that really depends on your level of maths. If I say, for example, what is a quotient (ring, field or group) and you're thinking "what?", it will help to understand some of the arguments used to understand the underlying maths. It's not entirely necessary, but it very much helps.
"if I encrypt my sd-card on my phone and my phone dies, can I recover the data?"
I get error code 70 when contacting google on port 443 using my own TLS implementation, why?
My current favourite general mathematics book for crypto is link.springer.com/book/10.1007%2F978-0-387-77993-5
how did the DMZ turn into a crypto.se ad from a sexchat?
5
22:38
@SEJPM is that supposed to be a trick question?
@SEJPM gee, I don't know that one.
But we should do it more often.
@Gilles the crypto ad or the sex chat?
@SEJPM the crypto ad
@Gilles that's off-topic here unless you combine it with a sex chat, which might explain the correlation
@Gilles no. That is a genuine question that has survived 13 hours without close votes. Considering our mods are very active and that one commentor is a very active user I'd say the question is OK
@diagprov dunno, I don't find the underlying maths hard, I mean, I can read it and use it as is, but cryptanalysis ... yeah, that gets what we call on space "maths whiteout"
it gets difficult to have perspective when you're in the middle of a fucking blizzard
22:43
@SEJPM hmmm, I suppose it can be interpreted in a way that's on-topic on Crypto
@SEJPM Speaking of crypto questions, I don't even know where to start with this one. The asker seems to have all kinds of wrong assumptions about how crypto works.
@Ohnana @diagprov sure, I admit to a bit of fanboyism... OF MICROSOFT.
although I do admit a touch of appreciation, if not outright admiration, for Apple and their CEO after the recent kerfuffle.
@AviD MS 4 LIFE
in fact I would probably go out and buy some Apple devices, yknow if their OS didn't suck so much.
@SEJPM sure, or until someone else makes better products.
@AviD WHAT KIND OF FANBOY ARE YOU IF YOU'RE NOT BLIND!
@SEJPM A RATIONAL ONE
22:50
@AviD ONE OF THE WORST SORT D:
@Gilles Nice.
someone actually asked me today if I was bought out by MS. Because I was running a Surface, Windows Phone, etc...
@AviD their (patch) support is better than on android, the surface is expensive but has good hardware and apple is sooooo restricitve on everything (and also ecosystems rule)
@SEJPM cryptosexchatad.
2
@SEJPM MS is also restrictive
22:52
@Gilles ?
@SEJPM its actually not crazy expensive, compared to comparable hardware.
@Gilles not like Apple...
@AviD I went for an acer convertible rather than a surface because the surface was much more expensive (and had this ugly 3:2 screen)
if I buy a general-purpose computer such as a smartphone or tablet, I want to be able to install the applications I want, to configure the network the way I want, etc.
that's called “being root”, which Apple doesn't offer, MS doesn't offer, and Google only offers on a few models
Desktop windows is not too restrictive, mobile windows is about as bad as apple.
@Gilles yeah you probably are in league with @CodesInChaos and insist on customizing the TCP stack.
22:54
@AviD Customizing the TCP stack, no. Tethering, yes.
@AviD deploy BearSSL
me, I want that part to just work and let me ignore it and get on wit me bizness.
@Gilles no problem tethering with WP...
@CodesInChaos really not. There is a process, there are (sensible) constraints, but it is not like with Apple where you need to sacrifice a male goat and three turtledoves.
@AviD ... and your first born?
@AviD I can't even install user mode software without soul selling.
@CodesInChaos on IOS?
22:57
iOS and the phone variants of windows.
why soul selling on WP?
On Android you can simply set the "allow non store software" flag. (Not as good as root, but at least something)
whoa. just lost a few dozen rep to "User was removed"
hmm and gained back a few downvotes, apparently. Bastard.
@AviD is there a loss rep cap?
@CodesInChaos ahhh okay yeah
22:58
Apple are also a pain in the backside for developers. Aside from the java thing, you can get MS products going back forever on MSDN. If your customer still uses XP, you're OK, the SP2 builds are still there.
well unless you install as dev, but yeah
Good luck getting OSX 10.7 out of Apple.
@SEJPM heh
@AviD From yesterday?
@Xander dunno. Wasnt there last night...
yeah it says yesterday
22:59
@AviD Yeah, it hit a bunch of us.
that's probably "pleasedeleteme"?

« first day (1889 days earlier)      last day (3289 days later) »