The DMZ

Adi

13:01

@Matthew I have a bad news for you

-1 == true :(

Lighty

4

@AviD? is this you?

AviD

hehehe

Lighty

I swear, thats some shit you or @RoryAlsop would pull xD

Mark Buffalo

@Lighty One time, I recorded a crazy-as-hell message about ghosts in the forest... and played it under the bed so my cousin could hear it

He started freaking out and thought he was schizophrenic for a bit

Lighty

hehehehehe :3

Mark Buffalo

13:03

The recording mentioned his name, and stuff very few people knew about

and it demanded a sacrifice of pepsi in the center of the forest

Lighty

ohohoho, that couldnt go wrong at all

Mark Buffalo

He started freaking out big time

AviD

He does not sound smart

are you really related to @Simon?

SEJPM

@Adi confirmed. sandbox.onlinephpfunctions.com/code/…

Adi

Yep

Mark Buffalo

13:06

@AviD He's pretty smart. We were kids at the time.

nsfw

Rory Alsop

Mmmmmmmmm

SEJPM

@MarkBuffalo is this grilled @Simon?

Mark Buffalo

@SEJPM pls, this is grilled @Simon:

and by grilled, I mean deep fried. or shallow-fried?

Adi

and here's the other part of the issue

RoraΖ

@Adi Well it's written in PHP

Ohnana

13:10

@MarkBuffalo that's deep fry

Adi

If I were to give this a category, I'd say it's also a deserialization issue

Mark Buffalo

@Ohnana That doesn't look so deep to me

Ohnana

@MarkBuffalo they're submerged, it's a deep fry

Mark Buffalo

they don't look submerged to me

Ohnana

well, as much as they can be. bread products float

RoraΖ

13:11

@Adi It looks like you want a variable to be interpreted as two different types?

Well, I guess my question is why would numeric 1 ever equal the string "true"

?

SEJPM

@RoraΖ both get bool converted? both have bits set -> both are true?

Matthew

@Adi I said it might be...

M'vy

Why would "true" == 1 ?

SEJPM

@M'vy "true" == true === true == 1 ?

M'vy

Btw. $JSON_OBJ->test is bool(true). Isn't that an array ?

Mark Buffalo

13:19

looks like the hard part starts

need to document some code

M'vy

Seems like 1 == "true" -> false is by design

Simon

@Adi Dayum.

M'vy

php.net/manual/en/types.comparisons.php

1 == "php" -> false

1 == "1" is the only exception

Mark Buffalo

@M'vy Look at the Loose comparisons with == table

M'vy

@MarkBuffalo that's what I'm saying.

so it's perfectly legit to have 1 == "true" -> false

Simon

13:28

You might like this page: php.net/manual/en/types.comparisons.php

Mark Buffalo

He just linked that, luls

Simon

Oh shut top Markus.

Mark Buffalo

Shut bottom, Semon

M'vy

ninja?

in fact it seems that == comparison of 0 and string falls back to int comparison. And "something" will always evaluate as 0 unless it's a proper number

RoraΖ

@M'vy It might be the only smart thing PHP has done

M'vy

13:31

Oh no, it's trickier. 1 == "1true" -> true :)

> After some investigation, it turns out aidan from the PHP manual mentioned that any strings that do not start with a number will be converted to 0 when casted as an integer.

Hence (bool) "true" is true, (bool) 1 is true, but (int) "true" is 0

and since neither 1 or "true" is a boolean, the comparison takes the common ground which is int in this case. Not bool.

RoraΖ

This is why PHP is the second worst language in existence.

Simon

What's the first?

M'vy

first being ?

RoraΖ

Perl

M'vy

English ? (LOL)

RoraΖ

13:36

hahaha

Simon

rekt

M'vy

that was too easy

RoraΖ

Says the man typing in English

Lighty

Canadian English?

Ohnana

@M'vy :(

AviD

13:37

Microdata Corporation

Microdata Corporation was an Irvine, California-based computer company, developing hardware and operating systems to run its Reality environment. It later was taken over by its international distributor CMC Leasings, which in turn was taken over in 1983 by McDonnell Douglas Corporation, and is now part of Northgate Information Solutions. == History == The Reality name was given to Microdata's computer system and the operating system — the first version of what was later called the Pick operating system. At the time, Microdata owned rights to the Pick operating system in parallel with Dick Pick...

M'vy

@Ohnana com'on, laugh at the joke too :)

Simon

@RoraΖ Yeah because you guys are too dumb to understand French.

So we gotta get to your level of dumbness.

Rоry McCune

infosecurity-magazine.com/blogs/… <-- WTAF!

Simon

Can we get a tl;dr roro?

AviD

@M'vy hmm I tried pointing to the English programming language (yes it is)

RoraΖ

13:39

@Simon Dude I wouldn't be bragging about the French

Rоry McCune

@Simon company who sell services around PKI try to make out that amazon giving away free SSL certs is bad for security

written as a news article

RoraΖ

They should be speaking one of a dozen other languages the number of times they've been defeated in history..

Simon

@RоryMcCune loooooooooooooooooooooooooooooooooooooooooool

Rоry McCune

and not what it actually is which is a press release

AviD

@M'vy esolangs.org/wiki/~English

Mark Buffalo

13:40

@AviD vomiting

it's projectile

Simon

@RоryMcCune So what you're saying is that this Nick Hunter guy is a clown?

AviD

@RоryMcCune pls is there even a difference any more?

Mark Buffalo

This looks surprisingly a lot like VB.NET

:(

Rоry McCune

@AviD well yeah there are some decent news articles out there

@Simon I definitely don't agree with his conclusions

Mark Buffalo

@RоryMcCune He looks dishonest

AviD

13:41

as news goes, there are only like 3 or 4 that could even be called "tech journalists"

Mark Buffalo

I saw his picture and clicked the back button

Simon

I agree with Markus, he looks like a huge nurd.

But yeah, the dishonest kind of nurd.

Mark Buffalo

That's the "real estate agent looking to prey on you" look

Simon

Look at his forehead.

That's the forehead of a bad man.

Mark Buffalo

lmfao

@Simon agreeing with me. The world is ending.

M'vy

13:45

> Falsified keys and certificates would give the malicious actors an encrypted channel where they could hide their activities.

Real certificates allow that too

Rоry McCune

@M'vy yeah all his criticisms are equally applicable to paid for certs...

and with that one, you can just use self-signed certs!

M'vy

> The other major risk is that if the Amazon CA is compromised, there is no quick way to revoke compromised keys and certificates.

Revoke the root CA. Done. Ooops

AviD

@M'vy "real" certificates?? I offense at that.

Mark Buffalo

This guy has a Texas-sized forehead

AviD

these are just as real as theirs. Maybe more so.

Mark Buffalo

13:47

His forehead is so big, it foreshadows something

M'vy

@AviD yeah, yeah. You get the point.

> Be the first to comment.

hmmmmmmmmmm....

I'm sure it would be possible to link to the rule of usability

Rоry McCune

yeah automatic free SSL will improve the overall security of a lot of systems I reckon and outweigh other concerns...

Mark Buffalo

@RоryMcCune But the terrorists! My forehead! Apply directly to the forehead.

Ohnana

14:30

oldest trick in the book -- sass the free stuff so they'll buy your not-free stuff

Xander

Boo for closing this question.

2

Q: Is there something like the OWASP top 10 for BizTalk applications?

I'm familiar with the OWASP top 10, for web applications. Is there something simular for BizTalk applications?

owasp

Adi

@Xander I agree with the closure

Ohnana

@Xander why? it's a dumb question

Adi

I wouldn't say a dumb question, but it's not a very good one. If we allow these questions, we'll just get more "Is there something like OWASP Top 10 for X"?

Xander

@Ohnana No it isn't. Asking for alternatives to the OWASP Top 10 is a perfectly reasonable question for someone who is new to threat modeling.

Adi

14:36

@Xander No no no

Bad argument

He's not asking for an alternative to OWASP Top 10

He's asking us to list the top 10 security threats for BizTalk

Xander

@Adi So you're right that it certainly could be more generalized, but ignoring the "BizTalk" specificity, it's a perfectly good question.

Adi

@Xander "Is there something like OWASP Top 10?" is a completely different question

Xander

@Adi No he's not, and the fact that he accepted the answer pointing him at the CWE Top 25 demonstrates that

Ohnana

@Xander okay, "dumb" is too strong of a word. I see your point. but the "is there a list of vulns for <product>" pattern is close to a product recommendation

Adi

There's the SANS top 20

There's the ASVS (also from OWASP)

and there are many others

But he wants for BizTalk in particular

Rоry McCune

14:38

@Ohnana well questions about product security are definitely on-topic

Xander

Yes, and a good answer listing some of them and why you might use one vs another would be widely useful.

Adi

@Xander Because that's the only thing he can get

Xander

@Adi No he doesn't. Again, look at the accepted answer.

Ohnana

well, you've got a diamond. there's nothing stopping you from a reopen vote

Adi

25 secs ago, by Adi

@Xander Because that's the only thing he can get

Xander

14:39

He just used that as an illustration because that was his specific challenge at the time.

Ohnana

adi stop being a curmudgeon

Adi

@Ohnana Ha?

Rоry McCune

that is so not a product recommendation question

who closed that with that reason

Adi

@RоryMcCune Awful reason

Ohnana

@Xander i think the problem with this question is phrasing. we read it one way, and you read it another. and then the accepted answer points towards your interpretation

Adi

14:40

I agree

Also, @Xander

> a good answer listing some of them and why you might use one vs another would be widely useful.

100% agreement with you

but not to that question

Xander

@Adi If the only vulnerability classification tool you know of is the OWASP Top 10, and you're dealing with a non-Web app, it's perfectly reasonable to ask the general question in that specific form.

Adi

In canonical question, yes

Xander

@Adi, so if I edit the question to be more general, would you support re-opening?

Adi

@Xander 100%

Rоry McCune

@Xander FWIW I agree with you, could've been better worded as "what are the top security risks relating to Biztalk applications" but it's possible to derive what he's after

Ohnana

14:42

@Xander i'd reopen it

Adi

My only problem is that such questions open the door for "What is the OWASP Top 10 for X"

Rоry McCune

apart from anything else who dragged up a Q. from 3 years ago to close now...

Adi

@RоryMcCune Good motivation to improve it

Xander

@RоryMcCune Yeah, no doubt.

Adi

I agree with the closure

It sparked this discussion

Ohnana

14:43

@RоryMcCune oh lord i didn't even see that

Adi

Where we had a good result

Xander

Alright, I'll edit it tonight. If it gets re-opened, I'll answer it properly.

Mark Buffalo

15:06

@Ohnana Not exactly free, but Comcast is desperately trying to get people to reconsider Google Fiber. lol

Ohnana

@MarkBuffalo i tried to get comcast to give me service, but they refused to wire my house

had to go with a tiny local isp

i regret nothing

Mark Buffalo

...I actually had to wire my own apartment by myself

because of that reason

Rory Alsop

@RоryMcCune no decent reason, so I went with existing choice

Mark Buffalo

I rage-smashed a hole in the wall where the cable is supposed to be... and wired it. then fixed the hole

Rоry McCune

@RoryAlsop sounds like we need more reasons :)

Journeyman Geek

15:07

o0

Mark Buffalo

fortunately, the hole was pre-built with a box. I just had to rage-smash it to open it again.

@RoryAlsop my bad

but yeah, that is the same reason I did it

Adi

Okay, I feel stupid.

In this android-developers.blogspot.fi/2013/12/…

What does this mean?

> Specifically, PBKDF2WithHmacSHA1 only looks at the lower 8 bits of Java characters in passphrases on devices running Android 4.3 or below

What is "only looks at the lower 8 bits of Java characters"?

Mark Buffalo

@ThomasPornin Save us from this question.

It looks as if it's excluding important details... but I don't know enough about crypto to make a guess without looking like a fool.

Adi

@MarkBuffalo The key issue here is not really crypto

Lucas Kauffman

hai guys

Mark Buffalo

15:11

reads

Adi

@LucasKauffman Holy shit!

Where have you been?

and Hai!

Rоry McCune

@Adi singapore?

Ohnana

@Adi i think it's talking about unicode

Adi

@Ohnana Indeed it is

Ohnana

as in, it only looks at the segment of data you'd use in representing ascii

Adi

15:12

I just don't know what this "lower 8 bits of Java characters"

Mark Buffalo

ah

Adi

Ooooh

Rory Alsop

@Xander I would too

Ohnana

and everything else in the unicode representation gets truncated

Adi

@Ohnana So it ignores unicode chars?

Lucas Kauffman

15:12

@Adi different timezone :P?

Mark Buffalo

seems to involve unicode translation?

Ohnana

@Adi it chops them to ASCII size and reads that

Mark Buffalo

like some apostrophes in unicode may translate to others on a different set

Ohnana

kind of a ghetto ascii converter

so if you tried to use a unicode char before, it would chop and read it

Mark Buffalo

@Ohnana not sure how you're getting that?

Ohnana

15:13

now, it reads the whole thing

Mark Buffalo

> Beginning with Android 4.4, we have changed this implementation to use all available bits in Unicode characters

ah, ok

Ohnana

leading to different keys

Mark Buffalo

I see what you mean

Ohnana

ofc, this may not hold for all unicode characters

Mark Buffalo

yep, this makes sense now

good change

Ohnana

15:14

i'm not fluent in bit-representation for unicode sets

Adi

Yeah, that's how I reached that page

I had a file encrypted on an old phone

Can't decrypt on a newer phone

same app

same password

Ohnana

oh lord you're going to have to figure out what ascii characters it was reading

Mark Buffalo

so I think what it did is essentially this:

Ohnana

RIP adi

Mark Buffalo

myPassword1 = \u006d\u0079\u0050\u0061\u0073\u0073\u0077\u006f\u0072\u0064\u0031

so enter your former password like that, adi

and it may work :x

Adi

15:16

@Ohnana Luckily, I have a magic byte in the clear text

So I can generate two keyes

one with the old method and one with the new

Ohnana

win!

Adi

Whatever gives the correct magic, I accept it

Mark Buffalo

because when you enter the backslash u codes, they should be parsed as a string in that way... provided you can even enter that many to begin with

Simon

@DavidFreitag How possible is it to tweak NFC to send RFID?

Adi

@Simon What are you trying to do?

NFC is an RFID

M'vy

15:24

RFID can have a different freq IIRC

Simon

@Adi Send data to an RFID reader.

Adi

@M'vy HF RFID freq is NFC freq

Simon

e.g. open a door that uses RFID cards with Android.

Adi

@Simon If your phone supports HCE, then you can do that

TildalWave

@Adi ardentex.com/publications/charsets-encodings-java.pdf page 24 and onward

Adi

15:27

@Simon and, of course, your reader operates at 13.56Mhz

@Simon You basically want this developer.android.com/guide/topics/connectivity/nfc/hce.html

kalina

salut

Simon

@Adi Ya I'm reading that right now, thanks.

M'vy

salut

Rоry McCune

@kalina watcha'

Adi

@Simon To be honest, not gonna be easy

Like.. at all

Simon

15:30

@Adi Yeah, I'm not committing to anything right now.

Ohnana

troyhunt.com/2016/02/…

today is a great day for public transit

Adi

@Simon This might be helpful with the terms to look for as well reddit.com/r/hacking/comments/148nby/…

kalina

no day is a good day for public transport

even days where another car gets exploited remotely

Simon

@Adi Yeah that sounds like quite a challenge.

Ohnana

/hugs transit pass

kalina

15:35

poor transit pass

although I'm guessing the amount of random groping you receive has started going down

Ohnana

believe it or not i have been groped exactly once. at a pride event. by a gay guy.

2

very weird.

kalina

wow

when I was working I frequently ended up using the London underground

Iszi

So, this just hit me: WEP came about in '97, WPA in '03 (6 years after WEP), and WPA2 in '04 (just a year after WPA).

Here we are in 2016, around 12 years after WPA2 came about - double the time that passed between WEP and WPA. WPA2 is known to be broken in at least some ways for certain implementations - particularly in the most common mode, PSK. Where the hell's the WPA2 replacement?

Ohnana

people in philly are not very handsy at all

kalina

which was a proper nightmare

Ohnana

15:37

never seen people being touched inappropriately, and when someone jostles you, you get a grunted "yo sorry" in response

Rоry McCune

@kalina the tube is a nightmare in so many ways

Iszi

@kalina Dare I ask what an improper nightmare would be?

Ohnana

@kalina that sucks

kalina

@Iszi a not nightmare thing dressing itself up as a nightmare

Ohnana

i'd probably carry around a blunt object to crack people's fingers with after a while

kalina

15:38

the tube is a proper nightmare because it's so packed you're unsure if you're being sexually assaulted or in the way

Simon

@kalina Did you just describe yourself?

fkin_rekt_irl

Iszi

@kalina So, would that make @Simon's mom a proper or improper nightmare?

Simon

TOO LATE OSZI I ALREADY MADE THE JOKE

kalina

@Simon welcome to ignoreville

Simon

Ignoreville's cool, I wish it'd be both ways without any action on my side.

Ohnana

15:38

interestingly enough, people are more comfortable with touching me now. it's in a friendly way of course, but it's strange

nearly jumped out of my seat the first time it happened

kalina

@Iszi I'm not joining in your "your mom" silliness

Mark Buffalo

@Ohnana I got stabbed on a bus

Just randomly minding my own business, and... stabbed.

AviD

@MarkBuffalo ^ strangest euphemism of the day

2

Ohnana

@MarkBuffalo you have seen some shit dude

was it in china?

Mark Buffalo

Yeah, and it was coated with drugs

Ohnana

15:42

...

Mark Buffalo

The stabbing object

kalina

new meaning for "drug spiking"

Ohnana

sometimes i wonder if you're an elaborate bullshitter

Simon

^

Mark Buffalo

@Ohnana I wish

Simon

15:43

I've been wondering this since Markus day 2.

kalina

I have had a boyfriend take a brick to the back of the head for nothing more than asking a car parked across a junction to move

the world is plenty messed up

Mark Buffalo

Yeah, it is

@Ohnana I'd like to elaborately go into it, but it's so far-fetched, and so outlandish, even I have trouble believing exactly what happened.

Simon

Since we're all making things up: I like dogs.

Mark Buffalo

Public transit is pretty good in general in China, but sometimes you run into nutjobs... 99.9% of people are fine, though

Arperum

@Simon SO you just said you don't like dogs?

Simon

15:46

@Arperum Exactly.

kalina

who would like dogs, they shed hair everywhere

Mark Buffalo

They don't taste very good either. The meat is kind of tough

kalina

they don't understand "I'm trying to sleep"

Matthew

Hmm...

Mark Buffalo

-3

Q: PLEASE HELP ME TO LEARN AND TO BE A HACKER?

please I want to learn information security and to be a professional hacker could you tell me how can i start ? please tell me the steps that i should follow to be a hacker thanks

passwords php password-management databases banks

Simon

15:48

Matthew, you better not say that you like dogs.

Arperum

@kalina Then make sure they can't get into your bed when you are trying to sleep.

Matthew

@MarkBuffalo I just saw that

Mark Buffalo

@Matthew I want to provide an answer, "learn to program first"

or something

Simon

Did you see what he commented too?

kalina

@Arperum I do, by not having a dog

Simon

15:48

I want to tell him to shut the fuck up in the comments.

Mark Buffalo

I think he's talking to himself

Simon

@schroeder ffs dude, why do you bother editing a question that literally has 0 chance of being good?

Matthew

@MarkBuffalo Learn to use capital letters?

Simon

Just get rid of it already.

schroeder

hold on flks - I'm on it

Simon

15:50

COME ON MAN

WE'RE ON A TIMER HERE

kalina

@schroeder nope, you edited the question without fixing 99% of the problems

Mark Buffalo

@schroeder Wait. I want a gold badge for responding

schroeder

@kalina keep your pants on

Simon

@MarkBuffalo I'm instantly downvoting if you post an answer.

Arperum

@kalina That does work indeed.

kalina

15:51

@schroeder I find this offensive

Mark Buffalo

@Simon You do that anyway, without even reading the answer

Matthew

Can I be a hacker too? I want to hack Minecraft and Facebook! Please help me!

schroeder

@kalina in what way?

Mark Buffalo

:b

kalina

@schroeder your implication that my pants would be off for any reason you could control

Simon

15:51

@MarkBuffalo I haven't downvoted any of your posts you donut.

Mark Buffalo

@Simon What about Jackie Chan?

Simon

Not even.

Ohnana

@kalina what, you've never seen rage-no-pantsing?

Mark Buffalo

Poor, misunderstood Jackie Chan

Oh wow... I suddenly like you more then, @Simon.

Ohnana

actually, i think the original phrase is "keep your shirt on"

Simon

15:52

-.-

Ohnana

cuz people are like "RAAAGH I'M ANGRY THIS IS NO TIME FOR SHIRTS."

kalina

@Matthew off topic > for assistance hacking a specific system

Mark Buffalo

@schroeder I like your response

kalina

@Ohnana probably related to the incredible hulk

Mark Buffalo

@kalina gee, I wonder who that could be

Matthew

15:53

@kalina Hmm, true...

Ohnana

Schroeder is a good mod

schroeder

@kalina don't use that phrase to much, else it might lose its impact

kalina

don't encourage him

@schroeder if I was offended I wouldn't usually inform you of it

thus, impact lost

Simon

@schroeder I gotta admit that's a 10/10 answer.

schroeder

@kalina noted

kalina

15:56

as a matter of fact, the only really offending thing that happens in here is the amount of time I am misunderstood for somebody who is about to explode when I'm not, which invariably results in me elevating to that stage thus creating a self-fulfilling accusation

which one moderator has mastered

Simon

tl;dr

kalina

but he's back on ignore now

AviD

@kalina hey now, I didnt misunderstand anything

I never said anything about you getting ready to explode

Rоry McCune

@kalina ok so the default assumption should always be that you're just joshing?

AviD

okay wait, I did misunderstand a lot. but not that...

Rоry McCune

15:58

@Simon #EmbryoAttentionSpan

AviD

the whole thing was about the ongoing crapfest.

@RоryMcCune tell her I said that

Rоry McCune

@Simon 11/10 with rice?

Mark Buffalo

@AviD People were pooping in here?

kalina

@RоryMcCune if I wanted to be super serious I have a career I could contribute to, I thought I'd made it well clear that this is escapism

I'm not sadistic enough to escape to someplace I don't enjoy being

Mark Buffalo

@kalina It took me a while to get you, but now that I get you, I don't want to unget you.

2

Ohnana

15:59

@kalina that makes sense

Rоry McCune

@kalina well sometimes it's hard to tell when people are being super serious or just having fun online where body language is tricky

AviD

@MarkBuffalo verbally, yes.

kalina

@MarkBuffalo cute

3

Mark Buffalo

@AviD ah, didn't know... usually seems tame in here.

Transcript for