The DMZ - 2016-02-27

« first day (1899 days earlier) ← previous day next day → last day (3279 days later) »

TildalWave

00:43

@DavidFreitag what am I looking at? looks all kinds of odd

David Freitag

@TildalWave An oven controlled voltage reference

Basically a cheapo LTZ1000A

Although I'd be willing to bet all those PCBs/components add up to around $50 which is what an LTZ1000A costs

Also: HOT DAMN IT'S COLD

24 hours ago it was 12°C, it's currently -12°C

9 hours later…

TheJulyPlot

10:19

Hi all! Do we have any Tipping Point experts, aficionados or cause users in the room?

I need someone to confirm what seams pretty obvious, but I can proceed based on my assumptions!

If I disable a single filter (that is currently set to permit all traffic), can it lead to traffic being dropped?

1 hour later…

diagprov

11:50

@AviD following on from your link, they definitely wanted German:

Posted a job on LinkedIn earlier today. One of the requirements is fluency in German. First applicant: Not fluent in German. Or English.

Tweeted by stfn42 on February 9, 2016 at 11:15 AM

Journeyman Geek

12:07

@DavidFreitag ooh

O'Niel

Is it normal that all my badges suddenly disappeared?

Journeyman Geek

12:52

not really no

Would you happen to be running edge?

Someone reported they got randomly switched to mobile mode

With that ava, I would assume not

O'Niel

13:08

I'm using Firefox, never mobile.

Rory Alsop

13:40

Very quiet in here today :-)

TildalWave

@O'Niel If you're asking if it's normal that devs fiddle with production server code and disrupt service, no, it isn't normal.

welcome to weekends on Stack Exchange :)

Rоry McCune

Get @avid there's a guy here talking about the osi model

TildalWave

lots of crap questions on the site too, there's not one of those that were in first post queue that I wouldn't vote to close

and I'm not even in a bad mood LOL

@RоryMcCune what? where?

Rоry McCune

13:55

Securi-tay talk from a student

Talking about DoS

TildalWave

gotcha... did he come to the part where he explains why it's crap?

Rоry McCune

Unfortunately not....

He's also about to run into lunch

TildalWave

I always thought that OSI is only good as a Visio template

i.e. it's fine to discuss it, maybe even build on it, but for fowk's sake don't ever use it

TildalWave

14:14

@RоryMcCune lunch time? enjoy your meal ;)

So Securi-tay is all about Roros? Link #5 on duck is a video of Roro jr.'s talk, link #4 is a video about Securi-tay which links to the elderly Roro's talk, it shows Marion talking,...

@RоryMcCune oww you're gonna talk about Docker :)

do link us up to videos when available pls

any mods here?

-2

A: What can an attacker do with Bluetooth and how should it be mitigated?

than'k for share See more: Tan chảy bộ hình nền người đẹp gợi cảm cho điện thoại

^ spam to nuke

1 hour later…

Rory Alsop

15:33

Spam nuked. Ta

TildalWave

15:52

sure ;) ty

site is dead ... and the weather is real crap here

I guess I'm gonna watch a movie...

TildalWave

16:27

@RoryAlsop still around? moar spam here security.stackexchange.com/a/115924/20074

Henry WH Hack

16:49

hello anybody here?

1 hour later…

diagprov

17:50

@RоryMcCune I should do a whole talk on memcpy. @AviD would love it.

Mark Buffalo

18:16

@diagprov we all would

diagprov

18:33

@MarkBuffalo Not as much as Ovid. You're missing a bit of the back story here...

back when Security.SE was in beta @AviD decided to answer something on SO about why programmers insist on using memcpy instead of memcpy_s.

I answered it and we had a nice little argument about it, and @RоryMcCune and some other people who are no longer in chat, like @nealmcb and @scottpack and Robert were like "OK guys chill" and that was what brought me here

TildalWave

@diagprov he did? I thought that's one of his questions here

11

Q: Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples such as memcpy, strcpy, strncpy, and more. These functions are considered unsafe since they directly...

appsec source-code linux buffer-overflow c

diagprov

@TildalWave I think he asked it on SO too

TildalWave

can't find it but that's not to say that he didn't cross-post and got nuked :)

diagprov

@TildalWave I can't remember if it there was an SO version. Actually I might just have found it on the supercollider or something.

Anyway @MarkBuffalo I am basically still trolling @AviD for that several years on :)

Also as far as I am aware, Microsoft's compiler still does not support C99 in "C" mode.

TildalWave

@diagprov why did you abandon your previous account anyway? I was a bit shocked when I realized it was you that was missing from the first page

diagprov

18:48

@TildalWave I was being followed around by a certain username comprised of two letters taking exception to everything I posted here and on crypto and basically downvoting me because I was me.

TildalWave

D.W.?

anyway yeah that's pretty bad, kinda one of the main reasons why I quit my modship

diagprov

I can neither confirm nor deny that. I've no interest in starting an argument really. My answers stand and I don't get notified every time someone fails to read them fully and starts foaming at the mouth in the comments.

TildalWave

I guess that makes sense

well, as long as you're back and feel bad for leaving us :)

diagprov

I don't really feel bad, I just like popping into chat :) Answers though are too much effort

For example by pure chance the top answer on "difference between msysgit and git for windows" was my answer written at the time, when the project itself was pretty unclear on what the difference was. There are still people foaming about how it is now inaccurate...

My view is I'm not paid to update the answer. If someone else wants to edit/clean it up, go do it, but it was 2010 or something.

Or downvote it, or vote to have it deleted, whatever. I didn't choose it to be the top rated answer.

TildalWave

no, that's good points because it'll happen more and more

and SE doesn't really have any means of dealing with that

I had my fair share of annoying comments on how something is obsolete a few years after I wrote the answer myself

also, people seem to like asking questions about things that not much is known about at the time

Thomas Pornin

19:01

@TildalWave People don't like the idea that something is not known. They prefer to believe that when they don't have some information, it is because it has been purposely hidden.

TildalWave

I don't think that's even the problem. As I see it, the problem is that such questions aren't closed. And then some of us will try to be helpful with conjecture, some will hit the spot, some won't, but the answer score will be for "this seems agreeable" instead of "this is right"

there's a line "We prefer questions that can be answered, not just discussed." when you go ask a new question.... I like it, it's the TL;DR of what is acceptable, but it doesn't seem to be always enforced

Thomas Pornin

The whole point of the upvotes and downvotes is to believe that popular consensus can yield a rough approximation of scientific truth. When you think of it this way, it becomes quite clear that it cannot work, and quite unclear how it still manages to work most of the time.

TildalWave

there was some MSE thread with request for a better answer sorting algo, can't find it now

maybe it was on SO meta and that's why I don't find it

diagprov

19:24

@TildalWave security.stackexchange.com/questions/6218/…

Took me a little while to find that specimen

Not how I'd write the answer today, but there y'are.

TildalWave

19:35

@diagprov yeah well I'm a sucker for things that are long :)

that's a lot of interesting info there, so I like it just from that perspective even tho I'm not terribly interested in the question itself

diagprov

@TildalWave user2213 was me

I should have added that bit of context

TildalWave

@diagprov yes I know, that's why I commented on post length ;)

took me a while to read it tho :)

Lamia

Hi all :D does anyone happen to know whether the new ios has a backdoor?

someone was able to remotelt access my friends iphone even after the format

TildalWave

BTW I'm guilty of many long (not necessarily long-winding tho, at least I'd like to think so :P) answers on space and I didn't really get the impression that I get upvotes because of their length ... tho equipping them with references and media to help illustrate the points will do that, on top of improving their quality

@Lamia noooooooo, of course it hasn't :)

it never had it, never will :P

Lamia

@TildalWave are u being sarcastic? :p

TildalWave

19:42

oh yes

Lamia

How can I prevent it -.-

TildalWave

the things are built in China in conditions that are only controlled for theft and making sure nobody gets paid enough, so ... you can't

Lamia

oh shit

okay I cant prevent it but what if someone got access to my iphone

I fortmatted the device and yet he was able to access it again, what is it that he still use to access my iphone even after the format

the only thing that hasnt change is the sim card, i guess :/

Thomas Pornin

@Lamia If the phone was rooted, then any sort of persistant backdoor could have been planted. "Formatting" covers user files, not the OS itself.

Lamia

@ThomasPornin it is not jailbreaked, but do you mean if the attacker rooted the device and planted a backdoor?

Thomas Pornin

19:47

@Lamia Yes.

Lamia

I am not even sure how he got access the first time, probably because of a weird application she downloaded

@ThomasPornin So what do you suggest we do ?

Thomas Pornin

@Lamia Buy a new phone.

TildalWave

:))

Lamia

oh sheeet

TildalWave

it's borked, you won't be able to fix that yourself

Thomas Pornin

19:49

You might ask Apple to reflash the firmware, but even if they accept, it is likely to cost as much as a new phone anyway.

Lamia

Is there any way I can check whether it has been rooted and a backdoor was planted ?

Thomas Pornin

I'd say that the ability of an outsider to take remote control of the phone, repeatedly, is a sure sign that something is amiss.

TildalWave

use wireshark, check what it communicates with

Thomas Pornin

Of course, in your dealings with Apple, I suggest that your problem is not really to demonstrate that the phone is compromised, but to prove that you are not the one who did it.

And for that, good luck.

TildalWave

among other options, but you don't wanna trust the breached device itself to establish that

Lamia

19:51

I am not sure what is the hacker motive, she's a normal girl lol

@ThomasPornin I am not sure I could do that, unless I get to find the attacker's source

TildalWave

I wouldn't blame anyone in particular, it can be pretty tricky to even establish what caused it

one of the worst infestations I ever had to deal with was after a kid installed a simple puzzle game

needless to say taking the kid to the gallows wouldn't have solved a thing

diagprov

@TildalWave the problem in this case was that I tried to explain why nobody had tried to do this. In a modern context, it doesn't make much sense because we have tons of RAM, but in the olden days non-pageable memory was a big deal. It is memory mapped to each process that said process cannot use.

I also tried to explain that you cannot encrypt arbitrary files with RSA. Actually you can but basically, well, I'll let Thomas explain it: crypto.stackexchange.com/a/126/29683

This is the reason RSA (or equivalent public key scheme) is used to encrypt symmetric keys, which is exactly what PGP does. Also Microsoft encrypting file system. Source for EFS: technet.microsoft.com/library/bb457116.aspx

TildalWave

20:08

yeah I know that, I'm around here for long enough to have picked up a thing or two :P

diagprov

So yeah, basically I didn't invent anything.

TildalWave

but why didn't you just flag those comments as obsolete / not constructive / whatever?

diagprov

@TildalWave I did.

TildalWave

@diagprov I did now too, appealed to whoever mod's gonna read it sense of humor too just in case other arguments won't hold :)

and yes DW is missing the point there

anyway, gotta run, laters

Rоry McCune

@roryalsop @raesene Of course he'd give a talk about Docker, hipster.

Tweeted by Pittoreski on February 27, 2016 at 6:42 PM in reply to roryalsop

^it's like @Simon is getting me mixed up with @AviD or @TerryChia

David Freitag

20:17

@RоryMcCune lol

diagprov

@RоryMcCune to be fair Docker is quite a hipster topic :P

Rоry McCune

@diagprov well on the face of it true, but all docker is, is orchestration of underlying linux stuff which is, in some cases ancient

diagprov

@RоryMcCune I know, I know, I'm joking :) I will actually be quite interested to see the slides/videos if/when they make it to the public domain.

Rоry McCune

@diagprov prezi.com/jvt9gboeh9wl/… is the slides

which aren't great without the video

fingers crossed, they'll do the vids soon , but last year they basically never released them

I've got it in for OWASP AppSecEU at the mo' and they release their vids, so will have to see if I get accepted...

diagprov

@RоryMcCune yeah, I have a slightly-less-than-vague idea of how it works so I can sort-of fill in the words I think you might have said, but the actual words would be much better.

Also that's quite a cool set of effects :)

One of my former colleagues did a similar thing, except he used opengl and c++ because he is really insane.

I think he spent more time on transition effects than on content, which is crazy when you consider his content was optimization.

@RоryMcCune Ahaah, good luck.

Rоry McCune

20:31

@diagprov yeah prezi is super-easy to use and set-up and kind of works with the way my brain operates, the really linear Powerpoint style doesn't work too well for me...

David Freitag

Yeesh so much paperwork involved with moving

I'm going to be without internet for a few days too D:

@Simon How come you haven't updated your twatter avatar? That girl looks soooo uncomfortable next to you.

Simon

@RоryMcCune I got added to the list "chamerling/docker" because of that tweet, damn it.

@DavidFreitag I don't know man but I was looking at it and thought I should change it too.

I'm not a picture guy

Rоry McCune

@Simon welcome to hipster-club @RoryAlsop got added to two docker lists today by just tweeting my handle :)

David Freitag

@Simon You should take a nice picture with @lady.doughnut and use that instead.

Rоry McCune

it's like an infectious disease or something

@Simon ooh I know you should get a Rainbow Dash plushie and take a picture with that :op

Simon

20:41

I DON'T KNOW HOW TO TAKE SELFIES

David Freitag

There's nothing sexier than when a girl talks nurdy with me.

Simon

HELP

David Freitag

@Simon So have @lady.doughnut take it

Thomas Pornin

@Simon Ask somebody else.

Simon

Fine, hang on.

David Freitag

20:44

@ThomasPornin Yeah since presumably it's difficult to hold a camera with a sock on one hand anyway

Thomas Pornin

When I am in Paris and I merely walk in the street, I often get asked by Japanese tourists to make a photo of them.

David Freitag

@ThomasPornin How important is the transfer rate of a hardware RNG? Would more be better? i.e. should I shell out for an ADC that is capable of 60M samples per second, or would a 1M do just fine?

Simon

OKAY I GOT ONE

Thomas Pornin

@DavidFreitag Cryptographically speaking, all you need is a seed of 200 bits or so, that you then use into an appropriate PRNG.

Rоry McCune

@Simon GOOD

WILL YOU STOP SPEAKING IN ALL CAPS NOW?

David Freitag

20:50

@ThomasPornin Yeah essentially you would only use it as a source of entropy. So 1MB/s is definitely more than enough?

@RоryMcCune WHAT?!

Tom Leek

UPPERCASE IS GOOD.

5

Thomas Pornin

@DavidFreitag In any software platform, you merely needs one initialization from the hardware RNG per boot, so as long as that single step takes negligible time with regards to boot time, that's fine.

David Freitag

Yeah, at 1MB/s you should be able to pull 8 bytes in a few ns plus driver init stuff

Rоry McCune

@DavidFreitag EH! SPEAK UP SONNY!

David Freitag

@RоryMcCune YOU'RE LOOKING FOR THESE SO YOU CAN HEAR RIGHT:

user image

Simon

20:54

@Pittoreski, Canada

200 tweets, 23 followers, following 166 users

@@@@@@@@@@@@@@@@@

Rоry McCune

@DavidFreitag THATS THE THING, I WONDERED WHERE I PUT THEM,

David Freitag

@Simon Nice beard son

Simon

ty son

David Freitag

@RоryMcCune DID YOU CHECK BESIDE THE SOFA?

Rоry McCune

@DavidFreitag TURNS OUT I WAS SITTING ON THEM THE WHOLE TIME!

Simon

20:56

@TomLeek OH SUP BRAH

TildalWave

@Simon spamster :P

well fuck it I took the bait

Simon

wot

TildalWave

so being lost in a heineken section of a supermarket is like beer porn in canaduh?

@Pittoreski, Canada

200 tweets, 24 followers, following 166 users

spot the difference

Simon

21:17

+1 follower?

TildalWave

of course, the one single good thing about your twatter account is that you didn't really use it in two years

you should do that more often :)

Simon

pLs

« first day (1899 days earlier) ← previous day next day → last day (3279 days later) »

Transcript for

Feb '1627

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2025 Stack Exchange Inc; legal

mobile