The DMZ

Rory Alsop

17:09

@Simon well I'm definitely a geek, not a nurd...so you must be wrong...something something...

Mark Buffalo

I'm a geek, I'm a nerd, I'm a... turd?

okay, that was neither funny, nor witty. and now I must go hang my head in shame

Simon

17:27

@RoryAlsop NURD

Rory Alsop

17:37

@Simon FNORRRD!

Simon

buying rep 10$ per 1k

And yes, Canadian dollars.

kalina

I'm glad this conversation died

#chatkiller

Simon

#nurddenial

kalina

I am not a nerd -.-

Rory Alsop

@kalina that's by Judas Priest, right?

Pain Killer - Judas Priest

►

close enough

kalina

17:45

-.-

Rory Alsop

This! Is! The Chat Killer!

kalina

you're all weirder than usual

or I'm less in sync

maybe I should sleep more

Ohnana

@kalina i was thinking the same thing

O'Niel

linuxmint.com is down since it got hacked. Anyone knows when it'll be back online?

Simon

Whenever they'll figure out how the bad guys got in.

O'Niel

17:53

@Simon okay, thanks.

Ohnana

and whenever they've uncurled from the fetal position

Simon

That takes some time too, indeed.

Ohnana

0

Q: exit relay how to sniff

How can I see what a user of tor browser is doing? How can I see which website he/she visited? Should I used wireshark or something else?

this question does not give me warm fuzzies

Simon

... did you see his username?

Ohnana

yes

Simon

17:55

It scares me.

Rоry McCune

@Simon you're scared of Donuts?

Simon

Only this one.

Ohnana

people are really on a "plz gib top 10" kick here

Simon

ohnuhnuh pls you left the "Should I used" in.

Ohnana

wait wut

Simon

17:59

gud ohnuhnuh, gud ohnuhnuh

Ohnana

okay it let me fix it as a minor revision

Simon

o no it's jordan almost ex vancouver future brit anti scott

schroeder

18:18

@MarkBuffalo Please review the options for your Meta question. meta.security.stackexchange.com/q/2191/6253 Your Meta question and your massive explanation of PHP de-obfuscation can be used as a canonical answer to future questions. As a second step, if people want to delve deeper, we can migrate to RE.SE.

Simon

@schroeder Are you and Markus gonna get married?

schroeder

@Simon well, it's only fair, he DID spend a lot of time thinking about my ass

Simon

Is that how most people end up getting married?

Rory Alsop

@Simon yes

Simon

o

That explains the divorce rate.

Mark Buffalo

18:27

@schroeder I accepted yur answer. Is this reviewing the options? Otherwise i can't find any options on my phone right now.

schroeder

@MarkBuffalo basically, yes - if you are satisfied that we have an approach that you think is fair and serves the community, then I wanted to make sure that the Meta question was closed in one way or another (it didn't have to be my answer)

RoraΖ

-5

Q: exit relay how to sniff

How can I see what a user of tor browser is doing? How can I see which website he/she visited? Should I use wireshark or something else?

tor sniffing

What a donut

Mark Buffalo

At a dental appointment, will see more later. I'm satisfied with both answers by you, and the other guy who gave a passionate defense

Simon

@RoraΖ Yeah ohnuhnuh linked it earlier!!!!!

Mark Buffalo

And I agree if we want to dig deeper, we can move it to RE.SE

Simon

18:30

@MarkBuffalo Are you saying that you want to dig deeper in @schroeder?

Mark Buffalo

Pervert

schroeder

@Simon he's at the dentist - I think it's "drilling" that is more on his mind

Mark Buffalo

Lol

Simon

o soz my mistake I thought you lads were butt buddies.

RoraΖ

@MarkBuffalo @schroeder I like the canonical answer. I think any "delving deeper" would only be beneficial with a more specific question.

Which then would get migrated to RE.SE

Mark Buffalo

18:34

I'm glad you like it

kalina

zzzzzzzzzz

Rоry McCune

@kalina yyyyyyy?

kalina

xxxxxxxxxx

Rоry McCune

@kalina wrong window, I think you were looking for your chat with @Simon :op

Simon

SHUT TOP

kalina

18:41

"lol" that's original, good job @RоryMcCune

Rоry McCune

@kalina hey now that setup took like 5-seconds of thought, predicting the sequence based on the response of yyyy..

kalina

we would have kept our secret relationship secret forever if it hadn't been for you meddling fogeys

Simon

I feel like I'd have to go get cleansed by a priest if she'd send me Internet kisses.

Rоry McCune

@Simon pls what did you need to do after that encounter in a club in quebec?

Simon

pLs

kalina

18:42

@Simon I just want you to get cleansed by a priest xxx

                     _     _ _
__/\__ ___ _   _  __| | __| | | ___  ___ __/\__
\    // __| | | |/ _` |/ _` | |/ _ \/ __|\    /
/_  _\ (__| |_| | (_| | (_| | |  __/\__ \/_  _\
  \/  \___|\__,_|\__,_|\__,_|_|\___||___/  \/

Rоry McCune

nice ASCII art

kalina

thanks

I hope he yolos his cleansing on twatter for all of his likes to subscribe

Rоry McCune

@kalina social media overload, except #you #forgot #the #millions #of #unecessary #hashtags

kalina

can't make everybody happy

RoraΖ

@kalina From the looks of those start that's a Jewish priest

Rоry McCune

18:51

kalina

but I do like being covered in melted cheese

8

MickLH

19:08

@kalina It's pretty ironic, this sentence itself promotes your status to "covered in melted cheese"

Iszi

Favorite quote so far today: "In-place upgrades are what Bin Laden did, IIRC."

Ohnana

@Iszi wtf?!

Iszi

@Ohnana Talking about OS upgrades.

Mark Buffalo

20:00

@Iszi You're an OS upgrade.

AviD

20:59

@kalina now you've gone and ruined my favorite line

> "I like my lasagna like I like my women - hot, saucy, and covered in melted cheese."

Cant say that ^ anymore now :-(

Ohnana

i feel like being covered in melty cheese would be painful

AviD

@Ohnana what about hot chocolate?

Ohnana

baker's chocolate?

or chocolate sauce?

sauce would be better since it's melting point is closer to body temperature

baker's chocolate would demand a higher temp and that would edge into burn territory.

MickLH

You guys are crazy, you can just add water to the cheese until the threshold for "melty" does not overlap with the threshold for "lava"

AviD

@MickLH also, different cheeses melt at different temperature.

Matthew

21:07

@MickLH Water? To cheese? Heretic!!!!!!!!

Ohnana

you can't add water to cheese. that's not how that works

AviD

that said, some cheeses are also smellier than others.

MickLH

Note to self: Cheese is a controversial topic

3

AviD

lol

Matthew

@MickLH Yeah, stick to sex, religion, and politics. Much less controversial

MickLH

21:12

Yeah but that's so boring, I mean all my catholic hookers are already voting trump like me.

Matthew

@MickLH Vote McAffee! The other insane choice!

Or possibly the other, other insane choice...

MickLH

Meh, I'm in California my vote doesn't count.

AviD

@Matthew pls, they're all insane choices, we're all waiting for the first sane one

McAffee is probably the least insane choice to make

MickLH

Guys don't worry I'll run eventually

Iszi

@AviD The guy who thinks he'll crack the San Bernardino phone in 3 weeks via social engineering?

Sorry, I think Trump's actually more sane.

AviD

21:19

@Iszi yes, that guy is the least insane choice to make.

I think it says more about the other candidates than about him.

MickLH

3 weeks? I'll crack that phone in 3 minutes with a critical hit cockslap to the screen.

2

Iszi

@MickLH Starred that just for ShitSESays.

3

Matthew

@AviD Well, yeah...

AviD

@Iszi Meta!

Matthew

They want to be president!

MickLH

21:21

Now now...

Iszi

@AviD I dunno. Trump's pretty loco, but McAfee takes it to an extra-special kind of level.

AviD

I think its about even.

at least McAffee is sensible about some topics.

Iszi

I'm voting Trump just to see him walk into Congress and fire everyone.

MickLH

hahaha oh shit how did nobody notice trump is actually the best idea

Iszi

@AviD No, he's sensible about parts of some topics. And then he veers left off into the deep end.

Matthew

21:23

I think Trump is sulking because he'd never get anywhere in UK politics with his name. It'd be like a politician called "Fart"

AviD

I am looking forward to a Trump v. McAffee debate. I would pay to see that.

Ohnana

cries into copy of constitution

AviD

@Matthew well, every time he opens his mouth...

Iszi

@Matthew What do you mean? I think anyone named "Fart" would at least be able to manage enough votes to legitimize a third political party in the U.S.

MickLH

@AviD Shhh be careful what you wish for, we're literally talking about trump for president here do you think paying for this is really so crazy relatively?

AviD

21:25

hey its not MY country ;-)

Iszi

Seriously, Trump will probably end up driving us to war with at least half-dozen different and not-insignificant international powers. But I look at the alternatives and wonder if, after the dust settles, it might actually all be worth it.

#HorrayForHyperbole

MickLH

Well we've overspent on millitary so hard for so long, I guess we have to use it somehow or else it'll go to waste

I mean, the moment some slightly better technology makes it obsolete it's basically all worthless

Iszi

@MickLH So, like... 10 years ago?

MickLH

More or less yeah, I guess as long as we target countries 10 years behind in technology it will be fine

AviD

@Iszi Maybe France will liberate us from the oppressive regime

Iszi

21:31

I forgot, which is supposed to come first - WW3 or the Eugenics Wars?

Trump would probably start one, maybe even on purpose. But McAfee's got the special kind of crazy that he'd accidentally trigger both. At the same time.

AviD

@Iszi I think its the other way around.

MickLH

Well... wouldn't the "eugenics war" automatically trigger the world war? Kinda like how the eugenics war automatically triggered the world war?

AviD

Trump is all bluster, he wouldnt even consider the need for war with another country, he just poses his demands and then makes China pay.

McAfee would go in there as Mr.Chaos and do some war just to clear out a few %ages of population.

Make there be less competition for his ho's.

Iszi

@MickLH According to Memory Alpha, the Eugenics Wars are occasionally referred to as WW3, but WW3 actually came later.

Thomas Pornin

22:17

@AviD France did that once already; it did not pay off in the long term.

AviD

well, technically, they only helped.

Twice, in fact.

People always forget about 1812.

Thomas Pornin

@AviD That's only very indirect in the second time.

AviD

Anyway, it did pay off, the favor was returned.

Thomas Pornin

France helped the US in the 1812 war only by keeping the British occupied in Europe.

AviD

Well, I guess that would be the mid-term.

Iszi

22:19

Ok, guys. Related to earlier discussions about Nmap, I decided to post a Q. Feel free to migrate to SU or wherever if it's too un-Sec.SE.

0

Q: How can I know why Nmap identified a service or OS the way it did?

Nmap uses a variety of testing methods and fingerprints to determine - or at least guess at - what services are running on each discovered port, and what operating system is running on the host. (When -sV and -O, or other appropriate options, are used.) I'm sure all of this is fairly well-documen...

nmap

Adi

Test

Thomas Pornin

@Iszi Actually, I see Trump less likely to do so than Clinton. Trump would probably be an isolationist.

Iszi

@Adi WTF dude?

Mark Buffalo

luls

Adi

Firefox users. Did your browser display a login popup?

Mark Buffalo

22:20

yup

Iszi

@Adi Aye.

AviD

@ThomasPornin well, thats kind of how it started.

Adi

What about other browsers?

Chrome shouldn't display anything

Any Safari users?

Iszi

@Adi FFX4LYFE

Seriously, what was the deal with that?

Adi

@Iszi It's a known issue from maaaaaaaaaaany years

Thomas Pornin

22:22

@AviD The 1812 war started for a lot of reasons, most of them being people in both USA and British North America not content with the previous settlement and wishing to get the US Revolution to its end (either way).

Iszi

@Adi Link?

Adi

Chrome subjects the auth dialog to same-origin policy

Mark Buffalo

I never enter anything into any auth dialogs

Adi

@Iszi I don't know, man

AviD

@ThomasPornin True, but the whole French trade thing was kinda the Archduke of 1812.

Mark Buffalo

22:22

spam sites used to do that all the time

Adi

I wrote an answer about it a 2 years ago

3

A: How to prevent popping up a login dialogue using a malicious hotlinked image and HTTP Basic Auth header?

I think I know what's happening with you. Actually, that's exactly what I do with the image in my "about me" section in my StackExchange profiles. It's a .php file that grabs some information about the visitor (IP address, browser type, whether the visitor made the smiley happy or not, etc.*). I ...

Thomas Pornin

@AviD The trigger for the war was the English policy of boarding ships at sea and forcefully enlisting any seaman that was considered to be a British subject. This included a lot of people who thought about themselves as American.

Mark Buffalo

Just read it, funny

AviD

@ThomasPornin ... which was caused by the French involvement.

Thomas Pornin

@AviD The French are the cause of everything.

AviD

22:26

Lafayette, we are here!

Adi

Have you guys seen the latest SSH vuln?

Thomas Pornin

No French was instructing the English to gather every man they could get hold on and put them in ships. In fact the French would have quite preferred it differently.

Adi

Coders though the functions takes bytes, so they gave it 128 byte thinking it's a secure long-ass key

turns out it takes bits

AviD

damn I hate when I get quotes wrong

Thomas Pornin

@Adi Do you have some link ?

AviD

22:27

@ThomasPornin heh, well thats the point, duh

Adi

@ThomasPornin access.redhat.com/security/cve/CVE-2016-0739

#totallynotabackdoor

AviD

correct me if I'm wrong, but 128 bits isnt exactly trivial either.

not quite as strong as you might like, but not exactly burteforcable in an afternoon by a 15 year old on his iPad.

Iszi

@AviD Hm. According to the doc linked in the RH advisory, it gives a "practical security of 63 bits".

Thomas Pornin

@AviD What I mean is that you could also claim that the war was triggered by the Spanish, or the Russian, or half a dozen other countries, for equally good (or bad) reasons. It would still miss the fact that the fundamental causes for the 1812 wars were almost strictly American.

AviD

@Iszi ah well. That seems to be the bigger issue here.

Thomas Pornin

22:31

@AviD But you are right that 2^63 is not exactly trivial.

AviD

@ThomasPornin Probably a clueless new president, full of bluster, wanting to make them pay for the wall.

@ThomasPornin really? I thought that is rather bruteforceable?

Thomas Pornin

@AviD It is doable but expensive. The count of involved machines will be in the thousands (or more if you want the result fast).

AviD

@ThomasPornin and if it was an offline attack, would be substanitally different?

Adi

@AviD It is an offline attack

Thomas Pornin

@AviD It is an offline attack. You sniff a connection, then you break it at your leisure.

Adi

22:35

ninja'd

Thomas Pornin

@Adi Yeah -- I see that you are now adding emphasis just the way I do.

AviD

ah I thought it was talking about connecting. I should read articles before commenting on them.

Adi

The student has become the mastör

AviD

@ThomasPornin we all try to emulate you, as best we can.

Adi

@ThomasPornin Well, given that I posted about 6 seconds before you, we can conclude that you copied the emphasis style from me :D

Mark Buffalo

22:37

@ThomasPornin Is that a euphemism?

Adi

@MarkBuffalo It can be

Mark Buffalo

@Adi WTF

lmfao

is this a joke?

Adi

@MarkBuffalo Nope

Java programmer writing C

Mark Buffalo

Yeah, this is literally the most obvious backdoor ever

...I write Java/C#, I would not do that.

Adi

@MarkBuffalo You wouldn't do what?

You wouldn't butter the smurfy predator?

Mark Buffalo

22:40

the arbitrary keysize bullshit?

Adi

@MarkBuffalo That's not the issue

Mark Buffalo

I need to see more of the code

schroeder

@Adi I'm pretty sure he would apply milk products to a cat

Adi

@MarkBuffalo If you read the rest of the code, you see it's still hardcoded

Mark Buffalo

-1 vs. 0?

Adi

22:41

The function expects the second param to be bits

The coder thought it's bytes

Mark Buffalo

\lol

Adi

So he wrote 128 thinking it would result in 1024 bit

@schroeder Enjoy more of them :D toykeeper.net/programs/mad/euphemisms

Mark Buffalo

@Adi Where's the rest of the code?

Am I supposed to infer only by this screen cap?

Thomas Pornin

@Adi In fact there is something weird, in that 128 bytes is not a "normal" fixed size for a DH private key.

If you use a fixed size, you are going to use a 256-bit (32 bytes) length.

The alternative for the terminally paranoid is to use the full group size, so that's the size of the modulus (-1 bit) for that kind of DH group.

Adi

@Thoma @Mark bugzilla.redhat.com/attachment.cgi?id=1129246

That's the full patch

Thomas Pornin

22:45

It still is more plausibly explained with incompetence than with malice.

But it takes some advanced incompetence.

Mark Buffalo

@Adi Thanks

Adi

6 mins ago, by Adi

Java programmer writing C

AviD

@ThomasPornin ohhh derp this is for DH, not AES...

Thomas Pornin

@Adi I fail to see the relation. Java is no more and no less byte-oriented as C.

AviD

@ThomasPornin I think he means the unfamiliar surroundings.

Also, Java does tend to be more byte-oriented than bit-oriented.

Adi

22:48

@ThomasPornin Literally every security-related method in Java is something like GetRandomBytes, DoSomethingToByteArray, etc.

Thomas Pornin

@AviD BUT if you were to implement DH in Java, you would use java.math.BigInteger, and the API for generating a random integer explicitly takes bits, not bytes.

Adi

@ThomasPornin Random().nextBytes()

and so on

Thomas Pornin

@Adi new BigInteger(int bitLength, Random r)

AviD

@ThomasPornin fair point, though that is relatively rare.

Adi

@ThomasPornin Okay okay. I'll correct

Not-so-good coder writing C

sigh

The French..

They keep inspecting their purple croissant

Mark Buffalo

22:51

I don't get it

not sure I want to

Adi

@MarkBuffalo It's a randomly-generated euphemism

> Verbing the adjective noun

2

AviD

@Adi that's... actually a pretty good one right there.

Adi

Playing the rusty trumpet

AviD

I would totally verb her adjective noun, ifyanowatImean

Adi

Sniffing the old dumpster

You get the idea

MickLH

22:53

Would you verb it adverbly though?

AviD

adverb the heck out of it

Scrubs - On HER Xbox

►

Iszi

23:32

@Adi Innit s'posed'ta'be trombone?

@AviD Wait... there was a Todd scene without an attempted high-five?

Seems like some laws have been broken.

Transcript for