The DMZ

MickLH

17:22

This is your fault! :'(

Rоry McCune

18:14

@Simon OMG Fleggs

wow I turn up and @Simon drops off, was it something I said?

Mark Buffalo

18:26

sherbit.io/how-does-verizons-supercookie-work

Wtf?

Murica....

Simon

@RоryMcCune pls it was just a bad timing

(I left before you said that)

Rоry McCune

@Simon Fairy snuff

Simon

wot

Rоry McCune

@Simon (phonetic modification of "Fair Enough")

Simon

Wot

►

Rоry McCune

18:38

inb4 "You're a phonetic Modification"

Mark Buffalo

You're an inb4.

diagprov

18:50

@RоryMcCune Nah it's Friday night / afternoon

Rоry McCune

@diagprov this is true, many people out and about I'd guess

@kalina you not meant to be off duff duff duff'in it, or does that happen later?

Simon

@diagprov SHUT TOP, I'm still at work!

diagprov

Sorry Simuhn.

Rоry McCune

@Simon well you will go living in some silly timezone

Mark Buffalo

Anyone here have a preferred programming font?

I'm using Inconsolata... might want to switch it up, but I need to see different thingies. SUGGESTIONS?!

kalina

19:04

@RоryMcCune no not tonight

Rоry McCune

@MarkBuffalo Comic Sans, 'cause #YOLO

Mark Buffalo

@RоryMcCune Not gonna lie, I used to program with Comic Sans MS back in the late 90s

Rоry McCune

@MarkBuffalo wouldn't have thought you were old enough to be coding in the late 90's, you must've started young!

Mark Buffalo

coding since 14

I'm 32

kalina

old

Thomas Pornin

19:07

14 to start development is not that young.

Mark Buffalo

it was back then :b

I would've started younger, but life's hard on the rez, and nobody could afford a computer

Thomas Pornin

Ah yes, that was the bad period when personal computers were expensive.

Mark Buffalo

I used to go to the university lab and hack people

:|

From like 7-13

No, actually, 7-12

Simon

Markus, shut the hell up.

Thomas Pornin

After the golden era (from C64 to Atari ST) but before cheap PC

Simon

19:09

"hack people"

Burn, just burn.

Mark Buffalo

"hack" people

Thomas Pornin

You hack people with an ax, not a computer.

Simon

Exactly.

kalina

maybe it's like push button watch_dogs hacking

Mark Buffalo

As a really young punk, I would download tons of 'hacking' text files, print them out, and study them religiously for the next time I was able to visit the university lab

diagprov

19:11

@MarkBuffalo You want to discuss programmer fonts on a Friday night... really?

Mark Buffalo

@diagprov yes

Simon

@diagprov My favorite font is the default font.

Mark Buffalo

It was funny when I took over the school network and locked the admins out

they spent several days trying to undo what I did

Simon

... You just never stop.

Thomas Pornin

@MarkBuffalo bolet.org/bolet-7x11b.bdf

My font. Works well for me.

Simon

19:14

I clicked on the link and it logged my keys.

Mark Buffalo

@ThomasPornin Did you make this?

Thomas Pornin

@MarkBuffalo Yes.

Simon

He's so gonna use it now that he knows you made it.

diagprov

Bear Font

It's what bears use when they write code.

Thomas Pornin

It is a simple bitmap font, 7x11 pixels, inspired from the standard 7x13 "fixed" font (bold) but with a smaller height.

Mark Buffalo

19:15

@ThomasPornin Any chance I can bother you to convert to ttf? I am not able to visit any of the online converters here

Simon

looooooooooooooool knew it

Thomas Pornin

@MarkBuffalo I am not sure you can turn a bitmap font into TTF.

Simon

"I will understand all the crypto if I start using this font" - Markus, probably.

Mark Buffalo

I never said I would use it

I want to try it though

secretly wants to use it to understand all the cryptos

Thomas Pornin

@MarkBuffalo This site: fontconverter.org purports to be able to convert BDF fonts to other formats.

I have not tried it, though.

Simon

19:21

Be careful Markus, he's trying to log more of your keys.

Thomas Pornin

BDF fonts are immediately usable under X11, and I could get OS X Terminal.app to use it as well.

Mark Buffalo

ah, this one works

and it's been blocked as exfil

Simon

rekt

Mark Buffalo

joking

but it's not converting

David Freitag

@Arperum No I mean empty like no furniture no stuff no nothing

Thomas Pornin

19:25

Windows font files (.fon) are actually executable files. Keyboard layout description files are DLL. Windows can be very weird at times.

Arperum

@DavidFreitag Yea, that's not perfect :p

David Freitag

@Arperum Very echoy

Simon

@ThomasPornin "at times"

David Freitag

^

Arperum

@DavidFreitag True, why are you in a situation like that?

David Freitag

19:27

@Arperum I'm moving

Arperum

@DavidFreitag Ah.

David Freitag

New apartment is empty apart from cupboards and a few appliances

So freaking cool

Simon

nurd

Mark Buffalo

@DavidFreitag That looks awesome

David Freitag

@MarkBuffalo It's for a ridiculously high precision voltage reference.

7

Q: How many grandmas is enough grandmas?

I am currently over 450 million CpS and I now have access to the portals and time machines. I have bought, over the course of this cookie clicker game, around 150 grandmas. Considering their upgrades and number, they have provided me with a lot of cookies since they were there from the beginning...

cookie-clicker

Mark Buffalo

19:39

SSLSTRIP MITM BLOCKED OVERFLOW BUFFERED

Simon

!shutdown -h now markus

Mark Buffalo

!addban Simon newbie

diagprov

try that

Simon

@diagprov Cheers.

!sudo shutdown -h now markus

Mark Buffalo

sudo rm -rf /home/Simon/*

Matthew

19:44

Why only the contents?

Mark Buffalo

sudo rm -rf /home/Simon

@Matthew Insult to injury

David Freitag

@MarkBuffalo sudo rm -rf /

Mark Buffalo

Make him watch as the contents are removed, and then delete him so the last thing he sees is his contents being poked out

@DavidFreitag No, we're deleting Simon's belongings, then him, and destroying his world.

David Freitag

@MarkBuffalo Also "poking his contents"

Mark Buffalo

@DavidFreitag You're a poking his contents

David Freitag

19:46

@MarkBuffalo I am not

Matthew

No sexual harassment! It never ends well...

Mark Buffalo

wtf

I am all over the star wall

Simon

That's the only place where you'll ever be all over of.

Mark Buffalo

I need to think of dumber things to say to get more stars

Matthew

@MarkBuffalo "Password1 is a really good password"

David Freitag

19:49

Woo yay random texts from family

Mark Buffalo

@Matthew Ihatepasswords1!

(do not say anything about this, david)

Simon

@DavidFreitag RUUUUUUUUUUUUUUUNNNNNNNNNN

David Freitag

@Matthew My passwords are all lines from Monty Python's the Holy Grail

Mark Buffalo

updates Freitag Cracker.exe

David Freitag

@Simon Yup, filed under "ignored"

I might very well be a terrible person.

Rоry McCune

19:51

@DavidFreitag "H0lyHandgrenade1!"?

Simon

It's fine, we're all terrible.

David Freitag

@RоryMcCune 'Tis but a flesh wound!

> Have at thee!

Rоry McCune

@DavidFreitag "You're all individuals" "I'm not!"

David Freitag

@RоryMcCune Look, just because some moistened bint lobs a scimitar at you doesn't mean you wield supreme executive power

Mark Buffalo

@DavidFreitag Whycome you will ignore fam m8

David Freitag

19:53

@MarkBuffalo TBH I have no idea who the hell it was

I just know some random number started a group text with me and my sister. Something about someone's birthday

Mark Buffalo

dementia

Rоry McCune

henriwatson.com/talks/cashonly <-- if anyone's interested in Payments security (I know not the sexiest of topics) this was a really good presentation and lots of good info.

Mark Buffalo

maybe there's a girlfriend to be had

David Freitag

@RоryMcCune No way, it's totally sexy. In fact, I need a change of pants after reading that link.

Mark Buffalo

@RоryMcCune Thanks, I appreciate the mitm ssl strip blocked website.

if only I could read it

David Freitag

19:55

@MarkBuffalo I don't know about you, but I don't go looking for a girlfriend at family gatherings.

Mark Buffalo

@DavidFreitag ROFL. No, I mean, if a sister has a friend at the birthday party.

David Freitag

@MarkBuffalo Uhm. No.

Rоry McCune

@DavidFreitag impressive thing is the dude who gave it is a student, and I reckon he knows more about payments security than quite a few "banking security experts"

Simon

@MarkBuffalo Yeah sure, happens all the time, man.

Matthew

@RоryMcCune There are some good guys up there

Simon

19:55

Sometimes, I wonder if Markus is really this dumb.

Mark Buffalo

Sometimes I wonder if Simon is retarded

and then I realize it's true

Simon

flegged

Mark Buffalo

and don't have to wonder anymore

Rоry McCune

@Matthew indeed there were some interesting presentations today, although some visits for some from the dark god of demos (some D**K with wifi pinapple messed up the wireless during Derek's talk)

David Freitag

Simon

19:57

@RоryMcCune What an asshole.

Rоry McCune

@Simon absolutely, the organizers weren't impressed either, person is getting a ban from the conf. if they get caught

David Freitag

@RоryMcCune There's always someone with a wifi pineapple going to screw with everyone.

Matthew

@RоryMcCune Should bloody well think so...

Mark Buffalo

@DavidFreitag ssl mitmstripped image

Simon

@RоryMcCune I hope he gets caught.

Rоry McCune

19:58

@Simon me too

Mark Buffalo

Yeah, that's pretty lame

Simon

^ The lord of lameness thinks it's lame.

It gotta be super lame.

Rоry McCune

@DavidFreitag yeah and it might be funny at the afterparty or something, but when someone's trying to do a demo of something that needs wireless to work, it just sucks

David Freitag

@RоryMcCune what was the demo?

Rоry McCune

@DavidFreitag was doing a really interesting thing using keys extracted from the iCloud app to download iPhone backups

Mark Buffalo

20:00

um. they were able to download other people's iPhone backups?

David Freitag

@RоryMcCune They should track that guy down and do what they did in the movie "little nicky"

Mark Buffalo

also, is the iCloud an opt-in thing by default? Or can you at least opt out?

David Freitag

@MarkBuffalo Why are you worried? Do you have an iphon?

Mark Buffalo

No, thinking of buying one

Rоry McCune

@MarkBuffalo the idea is that if someone can get to a PC you use iCloud on, they can get your iPhone backups...

Mark Buffalo

20:01

@RоryMcCune oh yeah... so in other news, water is wet

Rоry McCune

@MarkBuffalo they're still better than android...

David Freitag

Freaking google.

Simon

@RоryMcCune You wanna wrestle or something old man?

Mark Buffalo

mitm overflow attack on my cds

David Freitag

@RоryMcCune Present your evidence.

Mark Buffalo

20:01

CDS stands for CONTENT DENIAL SYSTEM

Rоry McCune

@Simon pls you cannot be going to try and claim that android is a more secure platform than iOS

seriously

David Freitag

@RоryMcCune [I live at the bottom of the sea]

Rоry McCune

ya need me to go find the OS fragmentation stats and the lack of default full disk encryption

Simon

Was there something has big as the iCloud bruteforce thing on Android?

I DON'T THINK SO

Rоry McCune

plus the slow patching for security vulns due to the carrier invlolvement

David Freitag

20:03

@RоryMcCune I don't have that problem.

Simon

Me neither.

David Freitag

My carrier is Google.

Simon

Me too.

Rоry McCune

@DavidFreitag but the majority of android users do

David Freitag

@RоryMcCune I don't care about the majority of Android users.

Simon

20:03

^

David Freitag

Just like I don't care about the people who choose to use Windows XP

Simon

Dayum dovid keep going, I can just nod.

Rоry McCune

developer.android.com/about/dashboards/index.html

google stats

Android 6 uptake 1.2%

FFS

Simon

I'm the 1.2%.

David Freitag

@RоryMcCune Not Google or even Android's fault.

Rоry McCune

20:04

only 35% on 5.X

@DavidFreitag android users are still stuffed, does it matter who's fault it is?

David Freitag

@RоryMcCune Of course it does

Mark Buffalo

@RоryMcCune I have that problem on 2 devices

carrier devices

fortunately, I never store anything of value on my phones

Rоry McCune

@DavidFreitag not to the users it doesn't

hell there's new malware spreading to Android devices over SMS

David Freitag

@RоryMcCune Nobody is forcing them to get a phone on a specific carrier.

Rоry McCune

that's some scary worm level shit right there

Mark Buffalo

20:05

@RоryMcCune Stagefright 2.0?

David Freitag

@RоryMcCune Good thing I'm forever alone

Security by lonliness

Rоry McCune

@MarkBuffalo it uses stagefright + SMS , sounds like the bad guys have finally managed to get reliable exploitation on that

Simon

me2

Mark Buffalo

@RоryMcCune This happens to me while traveling the world all the time

I bring equipment to detect and analyze it

David Freitag

@RоryMcCune I honestly want this to become a serious epidemic.

Then the general populous of android users can start a class-action lawsuit against the carriers and force them into regular updates.

Then all you people who whine about shitty carriers being the problem with android can go pound sand

Mark Buffalo

20:07

I'm sure they'll just get slapped with a $2 million fine

Rоry McCune

@DavidFreitag yeah that was meant to happen with stagefright, but I have a feeling once the heat died down and people looked into the costs that it went off the boil...

Mark Buffalo

and "donate" it to one of their charities for endangered CEOs

David Freitag

@RоryMcCune Which is why I want it to get really bad

At least if the carriers agree to work with Google to push out security updates

Mark Buffalo

@RоryMcCune herein lies the problem with state-mandated backdoors

the bad guys will always find it

Rоry McCune

@MarkBuffalo ah they don't need a backdoor for Android, the vast majority of users don't enable full-disk encryption

just nab device--> do acquisition

Mark Buffalo

20:10

@RоryMcCune or wifi pineapple during a traffic stop

Simon

There's literally nothing worth encrypting in my device.

David Freitag

@RоryMcCune Honestly why do you need full disk encryption? To hide the nudes from the NSA?

Rоry McCune

@DavidFreitag how many passwords are on your phone

Mark Buffalo

@RоryMcCune But you're right. With the Android permissions model, this is exactly what happens

David Freitag

@Simon This

Rоry McCune

20:11

to all your other stuff

e-mail

facebook

etc

David Freitag

@RоryMcCune Only password on my phone is for my gmail, and it's 2fa'd up the spout

Rоry McCune

once they get your phone they have your whole digital life

Matthew

I really ought to encrypt my phone...

David Freitag

@RоryMcCune Digital life? I don't even have a real-life life...

Simon

loooooooool

Rоry McCune

20:12

@DavidFreitag you accept that you're a corner case tho'

for a lot of people it's kind of important

Mark Buffalo

@RоryMcCune is right, though

Rоry McCune

they just don't realise it

Mark Buffalo

David, Simon, and I are retards, corner-cases, socially-inept, losers, morons, etc

Simon

@RоryMcCune Then they can go on iOS and pay a shit ton of a device not worth it.

Mark Buffalo

so this doesn't apply to us

David Freitag

20:13

@RоryMcCune And you hold Android accountable for the ignorance of the mass populous?

Rоry McCune

@Simon harder to break into by default

@DavidFreitag do android do default full disk encryption?

Simon

Meanwhile, I'll be rocking my 300 bucks device which fulfils all my needs perfectly.

Rоry McCune

do apple

no and yes are the right answers there

users have no clue

so need secure defaults

Mark Buffalo

@Simon Mine is $70

Rоry McCune

do most android phones have secure enclave? does iOS?

David Freitag

20:14

Honestly I prefer not having full-disk encryption

Simon

@RоryMcCune Being clueless is not an excuse to being idiotic.

Mark Buffalo

@DavidFreitag We got an NSA lover here

@RоryMcCune agreed 100%

Simon

If you know that some sensible data is on your phone then it is your own responsibility to ensure that it is properly protected.

David Freitag

@MarkBuffalo 1: There's literally nothing on my phone but CoC, Crossy Road, 2048, and hangouts. 2: IDGAF

Mark Buffalo

@Simon this is the same mentality which made the web "difficult" for non-technical types at the beginning

David Freitag

20:15

@Simon This

Rоry McCune

ah hahaha

you're blaming the users

Simon

@DavidFreitag There's Facebook on mine. What's someone gonna do, post on there that I love weens?

Rоry McCune

for not understanding security

so we should make them all understand web security and OS security and phone security, 'cause it's their responsibility...

really......

good luck with that

Simon

@RоryMcCune Yes. What's the point of encrypting the data if the user just downloads malware?

So yes, I'm definitely blaming the users for being clueless.

Rоry McCune

@Simon yeah funny that, tell me about the iOS malware that there is again

oh wait, there isn't any

shame it's not the same for Android :op

Mark Buffalo

20:17

@RоryMcCune DROPOUTJEEP

David Freitag

@RоryMcCune Also re the secure enclave bit, those are generally built into silicon on the main CPU. That's not the problem of Android or Google, it's the CPU vendor. If Qualcomm won't put them in the CPUs there's nothing you can do about it.

Simon

@RоryMcCune I don't believe this one bit.

Rоry McCune

@Simon ok point me at the story where iOS malware lasted in their app. store for any amount of time

David Freitag

@RоryMcCune Well from the BSidesNYC talk about "mobile implants" says you're wrong

Rоry McCune

and I'll go find some android malware

@DavidFreitag targeted nation state stuff isn't something that 99.99999% of users have to worry about it

Simon

20:18

@RоryMcCune Let me link you an article about how you could browse a web page to jailbreak the phone.

Rоry McCune

I'm not saying iOS is security defect free but that the platform has better default security

Simon

(I'm not gonna do it)

Rоry McCune

@Simon pls somon that's what version of iOS

David Freitag

@RоryMcCune Still counts. You can't say there's no malware just because it isn't common. That's like saying there's no OS X malware.

Simon

@RоryMcCune Irrelevant. It happened, it can happen again.

Rоry McCune

20:20

@Simon so one platform has a real malware platform and that's the same as one that doesn't 'cause it has had some security defects (like all software)??

really

David Freitag

@RоryMcCune Do you know if there are any plans to make full-disk encryption default on Android?

Rоry McCune

@DavidFreitag it's not equivalent as you are well aware.. nation state != general attackers

Simon

@RоryMcCune I did not understand this.

However, I gotta drive home so I will end with this:

Rоry McCune

@DavidFreitag IIRC they were planning on it and then ran into perf. issues

Simon

pls

I lied, I will end with this:

Rоry McCune

20:21

@Simon this is evident :op

#rekt

David Freitag

@RоryMcCune Sure, it's not equivalent and 99.999% of the time it's not going to occur, but that doesn't mean it doesn't exist.

Simon

Yes, I agree that the default security of iOS is much better than Android but as I've always said: both platforms are good, depending on your needs.

ok bye

David Freitag

@RоryMcCune I would rather use a platform that's actually useable that needs some hardening to be secure.

Rоry McCune

@DavidFreitag sure but I'm talking about the general platform security issues, that ordinary users have to worry about, not what you need to worry about if the NSA/mossad are after you

@Simon I never said that wasn't true

@DavidFreitag sure that's a reasonable position for you to take

Mark Buffalo

how is the iPhone unusable?

Rоry McCune

20:23

hell I have an Android phone myself

David Freitag

@MarkBuffalo In the same way that OS X is unusable

Rоry McCune

for my home device

Mark Buffalo

I leave my computer online and open while abroad, and not in the hotel room

79% of the time, someone comes in and installs malware on it

and I analyze it, because I'm a fucking weirdo

Matthew

@MarkBuffalo Personally, I find the lack of an alphabetical app list a right bugger

Mark Buffalo

anyway that's why I don't use FDE

most of the time

Rоry McCune

20:36

apps.fcc.gov/oetcf/eas/reports/…

oooh new Raspberry Pi coming

with built-in wifi and Bluetooth

Mark Buffalo

Nice

Matthew

@RоryMcCune Useful - I still need to find a use for my zero...

Rоry McCune

@Matthew yeah I've got a 1 and a 2, use the 2 sometimes as a nice little low-power linux server. Once I get some more capable broadband might actually use it to host some local services.

Matthew

@RоryMcCune I've a pair of 1s, one of which is a Retropie setup, and one is a music streamer in my office, a 2, which is my media server, and a zero, which is not doing anything

David Freitag

21:07

@RоryMcCune So excited

They're finally going to do it right

But it looks like they're still using the combination USB/Ethernet chip which is a bit of a bummer

41

Q: Quack the Angry Duck

No one is quite certain what the emoticon >:U is intended to represent, but many scholars believe it looks like an angry duck. Let's assume that's the case. Task Given an integer n between 0 and 3 inclusive, print or return quack if n = 0, >:U if n = 1, U U > : U U > U U >...

code-golf ascii-art number kolmogorov-complexity

Mark Buffalo

21:27

I really want to fart

ok, farted

tell your friends

weekend time

Matthew

Save yourselves! Gas! The stench... dies

Arperum

switches to tab uhm... switches away again

2

Matthew

21:43

Hmm, ok. Decent NAS for home would be about £350 for what I need. Not too bad, I suppose

David Freitag

@Matthew Mine was much less than that. 3x 2TB Red Caviar WD drives, 64GB SSD, and FreeNAS

Plus an extra dual gigabit ethernet card for link aggregation

Matthew

@DavidFreitag Processor/ram?

David Freitag

@Matthew Motherboard is one of those AMD Kabini SoC boards with 8GB of 1600 speed DDR3

Matthew

I'm thinking a Synology DS215j, with a pair of WD Red 3Tb drives

David Freitag

Don't need something super CPU intensive unless you're doing transcoding or something. Might get a cheapo GPU if that's the case.

Matthew

21:49

£330 on ebuyer, £310 on Amazon

David Freitag

@Matthew I mean sure, you can do that, but get a mini ITX motherboard with a small case and it'll be waaay cheaper than that Synology box.

FreeNAS is pretty cool. Has builtin ZFS support as well as a DLNA server for media streaming.

Matthew

Well, the box is only about £130 - the rest if the drives

David Freitag

@Matthew Yeah that's about what it will cost for Mobo + Ram + Case + Ethernet card

It's a nice solution, I just prefer having more control.

@Matthew I would look into some of the Hitachi NAS drives. They are really good, but a bit on the pricey side.

Rоry McCune

@Matthew I've got a synology box, it's been pretty good so far, reliable and the interface is ok

Matthew

@RоryMcCune Yeah, that's what I've heard

Basically, want something I can put in, and it just works

Currently have a 1Tb USB drive which is full, and a pile of stuff that needs transferring to it!

Rоry McCune

21:59

@Matthew yeah I've been running ours for 2+ years now and we've not had much/any bother with it, runs DNS/DHCP/Filesharing just fine

Matthew

@RоryMcCune Had a few people recommend the brand

@DavidFreitag I seem to have moved on from wanting control to wanting minimal effort...

David Freitag

@Matthew If that's the case I wouldn't recommend a custom solution like I did. That Synology box or something similar is probably your best bet.

Matthew

@DavidFreitag Yeah - it's like how I used to build my own desktop PCs, but now just buy laptops

David Freitag

I pretty much try to avoid laptops at all cost unless it's absolutely necessary

Matthew

@DavidFreitag I just like lounging on a sofa to compute...

David Freitag

22:06

Omnomnom KitKat

diagprov

@RоryMcCune that payment presentation is impressive.

Rоry McCune

@diagprov yeah had some nice details that I didn't know before

diagprov

22:42

@RоryMcCune yep. I used cardpeek before for example, but I didn't really look too hard at what it was showing me. This was in my early days of smart card knowledge and actually seeing it again it is a really great tool.

I'm even more impressed he's a first year undergrad.

Anyway, weekend time :)

David Freitag

23:15

OP's post is clever use of sequencing, but also the type of "clever" that will cause your coworkers to hate you. — MtRoad 4 hours ago

David Freitag

23:32

What a beautiful project: amplifier.cd/Technische_Berichte/Spannungsreferenzen/…

Transcript for