The DMZ

Simon

17:00

Sometimes, I wish I was American.

I could vote for Trump and watch the world burn.

Mark Buffalo

@Simon That is why I'm voting for Trump.

Simon

Very responsible choice.

TildalWave

@ThomasPornin haha yes I read that book, I was also subtly referencing several Augustine's laws :)

like

> Ninety percent of the time things will turn out worse than you expect. The other 10 percent of the time you had no right to expect so much.

or

> One-tenth of the participants produce over one-third of the output. Increasing the number of participants merely reduces the average output.

Simon

@TildalWave You read books? What a nurd.

TildalWave

@Simon yes, crazy huh?

here's one more

> Regulations grow at the same rate as weeds.

and what's most funny about it is that Augustine actually "proved" it ustream.tv/recorded/47936690

Ixrec

17:10

> Beware of bugs in the above code; I have only proved it correct, not tried it.

TildalWave

sadly, not many regulators actually know how to regulate, or what

Mark Buffalo

Overregulation is pretty bad

Complete deregulation is worse

Aaron Hall

Complete deregulation is anarchy

Minor deregulation is probably a good thing

Mark Buffalo

Pretty much

TildalWave

@AaronHall What's wrong with anarchy? You see, it works if all people are decent. The fact that we have regulations proves that they aren't.

Mark Buffalo

17:14

@TildalWave What's wrong with anarchy? Hang on...

Ixrec

simplifying and/or consolidating the regulations that are out there would probably help far more than anything else given the current mess

just to reduce the amazing administrative costs of complying with those regulations

Mark Buffalo

This is what's wrong: bbs.news.qq.com/b-1001024026/37319.htm

TildalWave

@MarkBuffalo Yes, what is wrong with it? Or have you been brainwashed into confusing it with things like ludism?

Aaron Hall

The prohibition in the US - was that a good thing or a bad thing? Did the regulations against alcohol prove people are indecent?

TildalWave

@MarkBuffalo server not found

Mark Buffalo

17:15

sec

chinahush.com/2009/10/21/amazing-pictures-pollution-in-china

This is complete deregulation in action

Pure, unbridled capitalism

TildalWave

@MarkBuffalo ah no no, that's people

Ixrec

the technical answer to "why won't free market anarchy work?" is simply "because market failures exist"

TildalWave

don't defer the problem

Ohnana

@AaronHall don't quite understand the question

Ixrec

externalities, public goods, asymmetric information, etc etc

Mark Buffalo

17:15

@TildalWave Yeah, that's people... so some regulation is needed

TildalWave

@MarkBuffalo I stand by what I said

Aaron Hall

They're talking politics in the DMZ - someone should probably go regulate that. :D

TildalWave

@MarkBuffalo It works if all people are decent. The fact that we have regulations proves that they aren't.

Ixrec

that's why this room exists, to keep the politics away from the important chatrooms

Mark Buffalo

@TildalWave Agreed

Thomas Pornin

17:16

@AaronHall Flag it if you want to see regulation at work.

Ohnana

eeehhhh let's not

Ixrec

less pessimistically: The fact that we have scarcity is why regulations are needed.

TildalWave

hahaha no, don't

Simon

@Ixrec Are you saying our chat room is not important?

Ixrec

this particular conversation does not appear to be

Mark Buffalo

17:18

wtf @ companies that sign me up for their shitty newsletters and require me to make an account/log in to unsubscribe

TildalWave

@Ixrec scarcity is just fact, you're thinking of distribution of wealth

Ixrec

I think scarcity alone is enough to do it

TildalWave

look up

there's no scarcity in space

do we make use of it?

of course not

and when we will, it will be just the same as before

Matthew

@TildalWave There is lots of scarcity in space. Just not of space. Lots of space in space.

Ixrec

I'm failing to see how this is relevant to organisms that do not live in the vacuum of space

TildalWave

17:19

ha you see, you're thinking of vacuum

Mark Buffalo

alright....................

this is getting too nerdy for me

Simon

Here we can witness nurdz arguing in their natural habitat: Internet chat rooms.

Mark Buffalo

I'm gonna go eat lunch somehow

TildalWave

space isn't vacuum

actually, that you stand where it isn't vacuum proves it

Ixrec

do you guys have something more on topic to discuss?

TildalWave

17:20

there's a lot more of this where it came from ;)

Ohnana

@Ixrec haha no

Rоry McCune

@Ixrec have you seen the room description?

TildalWave

maybe we need to regulate what's on-topic here ... oh, wait

Mark Buffalo

ok I finished lunch and now there's the temptation to eat more... much more...

Matthew

@Ixrec We have a topic?

Simon

17:23

Generally, subjects such as @AviD's incompetence are more accepted.

Mark Buffalo

@Simon AviD is quite competent

Simon

Markus, don't suck up.

Mark Buffalo

there is no need to suck up. there's nothing he can offer me! Hey AviD, get on skype, I need a favor

Xander

@MarkBuffalo I'm @AviD's new manager. If you want to talk to him on Skype, that'll be 50 bitcoin, in advance, and go ahead and make it payable to me.

Mark Buffalo

@Xander I already spent all my bitcoins on secret NSA documents, sorry :(((

Ohnana

17:27

there's a restaurant near me that accepts bitcoin

Xander

@MarkBuffalo Too bad to be you then. I guess you'll have to figure it out on your own. Let me know when you have some bitcoin.

Ohnana

0

A: Which elliptic curve should I use?

To Pornin: The "nothing up my sleeve" principle is about mathematics, not psychology. Partially is precisely that it might be "something up one's sleeve". It is psychology to posit that partial is not magiv waving. Anyway, I believe the case of possible subversion has been shown. You again, impl...

er what

TildalWave

not an answer

Ohnana

i flagged it, but it's such a weird rant

Ixrec

that feels like an excellent example of things that clearly do not answer the question yet the NaA flag will be rejected since you have to read the question to tell it doesn't answer it

TildalWave

17:33

not here, what are you talking about?

our mods can read

Mark Buffalo

lost my 2 hard-won rep points downvoting idiots today

TildalWave

can someone unpin that if something upsets you, walk away BS?

Rоry McCune

done :)

TildalWave

thanks

it was an attack vector, too easy to upset people to make them walk away, isn't it?

David Freitag

@Ohnana y = x is an elliptic curve.... right?

Ohnana

17:40

@DavidFreitag idfk

it might be

fuckin math shit

David Freitag

@Ohnana It's not.

Ohnana

@DavidFreitag oh okay

Thomas Pornin

@Ohnana To be elliptic it must be of degree 3.

Ohnana

i see, they're the disco man graphs

TildalWave

@ThomasPornin to be elliptic it has to be eccentric

all my curves are elliptic ;)

Bob Ebert

17:53

what language was this written in?

github.com/m4ttclendenen/greedy-mac/blob/master/greedy-mac.sh

Ohnana

that looks like bash shell scripting

so there's a neat trick to figure out gihub languages, go to the HEAD of the repo (click on the repo name) then click on the colored line. it shows a band chart breakdown of languages

Mark Buffalo

BASH Programming

@Ohnana I love that feature

Bob Ebert

Can't find the head

Mark Buffalo

67.6% php, 18.5% javascript, 13.9% css

Bob Ebert

ahh shell 100%

Mark Buffalo

17:58

@BobEbert Let me show you

Ohnana

@BobEbert you just click on the repo name

Mark Buffalo

there you go

Ohnana

i couldn't think of a better way to phrase it

Bob Ebert

@MarkBuffalo You got a different result?

Mark Buffalo

@BobEbert No, I was viewing another repo

David Freitag

18:13

WOOOOOOOHOOOOOOOOOOOOO!

Ohnana

@DavidFreitag WHOOOOOOOOOOOOOOO

David Freitag

Beers/Whisky on me

Simon

This sounds like a man who just got his Internet installed.

Ohnana

now that's a party

David Freitag

@Simon No not until tomorrow

Simon

18:13

o

What's the "WOOOOHOOOO" all about then?

Ohnana

comeon, what's made you so happy?

David Freitag

We just got back word from a customer we shipped one of the products I designed as a beta tester. It works PERFECTLY

Ohnana

@DavidFreitag YEAH!

Simon

Badass dude.

Mark Buffalo

@DavidFreitag Feels good!

Congratulations to your face

Ohnana

18:14

Mark Buffalo

Now you better get a raise for this

David Freitag

@MarkBuffalo we're not out of the woods yet, there's still a lot of work to be done before we can start shipping this product to actual customers

But this is extremely good news.

shit I can't delete that gif, sorry folks

Ohnana

@DavidFreitag i like it

it's mostly static and it loops so it's not that bad to look at

David Freitag

@Ohnana It's also a constant reminder of how excited I am

Mark Buffalo

you should be

you did a good job

and people recognize it....

they RECOGNIZE it

David Freitag

18:19

@StuW Yeah either that or someone thinks you're super nervous

Mark Buffalo

mumbles incoherently

David Freitag

@MarkBuffalo did you forget to take your meds again?

Mark Buffalo

mutters under his breath

David Freitag

Eugh there's a hair on my tongue and it's not mine

Xander

npr.org/sections/thetwo-way/2016/03/02/468887190/…

Mark Buffalo

18:22

@DavidFreitag This happens to me a lot.

@Xander seriously?

rubs palms together greedily

this will be easy

Xander

@MarkBuffalo Apparently so.

Mark Buffalo

ffs, you need to pass a background check first

I can do that, but that's boring

David Freitag

@MarkBuffalo You should read the fine print that says anyone who succeeds either rots in a hole in some remote jungle prison, or works for the gov't forever

Mark Buffalo

this would actually be extremely easy

I wonder how much they're offering

Simon

@DavidFreitag Sounds like both outcomes are pretty similar to me.

David Freitag

18:26

@Simon Yeah but you can't get a donut in the middle of a jungle

Xander

@MarkBuffalo Gotta pass the background check first. Maybe they'll tell you then.

Mark Buffalo

> And if you're wondering whether the hackers might disrupt a critical piece of the Department of Defense's infrastructure, the agency says that hackers will target a predetermined system that's not part of its critical operations.

lame

Simon

@DavidFreitag Very true.

Mark Buffalo

I thought they were literally inviting open haxoring

David Freitag

@MarkBuffalo ...then what the fuck is the point?

Mark Buffalo

18:26

I almost shit myself in excitement

David Freitag

@MarkBuffalo I did, and I'm at work.

Mark Buffalo

the things I was planning to do... I had it all planned out in my head

Simon

Are they offering rewards?

Or they're pretty much asking for slaves.

Mark Buffalo

yeah but this is a really boring/dumb way to do it

Simon

dumb?

How is it dumb that they don't want to risk actual prod infrastructure?

David Freitag

18:28

@Simon Not really prod more like entire critical infrastructure of the US

Simon

lulz

Iszi

Anyone else seen this? troyhunt.com/2016/02/…

Mark Buffalo

@Simon because prod is a lot different

Rоry McCune

@MarkBuffalo the bit I thought was lame was the "pre-authorised" bit so really they just want a cheap/free pen tst

Simon

Feb 24 at 15:30, by Ohnana

http://www.troyhunt.com/2016/02/controlling-vehicle-features-of-nissan.html?m=1

Mark Buffalo

18:29

@RоryMcCune Yeah, pretty much

David Freitag

@Simon It's dumb because it's not really testing anything.

Iszi

@Simon Righto.

Mark Buffalo

@DavidFreitag Exactly. The people are the problem for the most part

Simon

You're the people.

Mark Buffalo

People provide more vectors than anything else

David Freitag

18:30

They are basically testing people on shit they designed that they already know has problems

Mark Buffalo

@Iszi what the fuck

@Simon what the fuck

Iszi

@Simon If you're not testing in prod, then you're not testing. Amirite?

Mark Buffalo

white-box testing in prod is one thing

Simon

@Iszi lulz

David Freitag

@MarkBuffalo Did you hear about the same incident with Jeep? Dude got his brakes disabled on the highway

Mark Buffalo

18:31

@DavidFreitag yeah, I found out how to do it

David Freitag

@MarkBuffalo rip

Mark Buffalo

they fixed it

> GET https://[redacted].com/orchestration_1111/gdc/ACRemoteRequest.php?RegionCode=NE&‌lg=no-NO&DCMID=&VIN=SJNFAAZE0U60XXXXX&tz=Europe/Paris

lmfao

ohhhhhhhhhhhhhhhhh haaaaaaaaaaaaaaaaaaaahahahahahahahaha

Iszi

@DavidFreitag Not quite the same. Per the article, the Leaf only allows access to telemetrics and climate control. Not actual vehicle control like start/stop or driving functions.

David Freitag

@Iszi Yeah well same sort of incident.

@MarkBuffalo wut

Simon

The worst is the fact that the VIN is enumerable.

Iszi

18:34

@DavidFreitag Yeah, that was a given example of the API request to do some thing.

Xander

@Iszi Ah, heard about it on a podcast last week. More automotive derp-ery.

Simon

And if you want to target someone specifically, find his car and take a picture of his window.

Iszi

@Simon Meh, why take over some random car when you can walk out to the parking lot and get a VIN of someone you might actually know?

David Freitag

:27969287 Stop trying to fiddle with some person's car

Simon

@Iszi Yup.

David Freitag

18:35

@Iszi Or just hit them with a $5 wrench

TildalWave

@Iszi you still wouldn't be stuck in a blizzard in it would you?

Mark Buffalo

gonna go for a walk

Rоry McCune

@Iszi lulz

Iszi

Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

Rоry McCune

@MarkBuffalo look for some VIN numbers, right.

Simon

18:35

@RоryMcCune Since when are you lulzing?

That was your 9th lulz, congrats roro: chat.stackexchange.com/search?q=lulz&user=3249&room=151

David Freitag

@Iszi Also, because you have no ties to some random person. The cops might be able to find you based on who knows the person who got messed with.

Rоry McCune

@Simon ooh, I don't I'm super srs_face pentester, but I was suggesting that lulz are a motivation factor for some

Iszi

@TildalWave If you were paying attention at all, you shouldn't. Highest direct physical risk is that someone might drain the battery while you're not using the car.

Simon

@RоryMcCune I seeeeeeee.

Rоry McCune

@Simon if it's possible some dude/dudette will do it from their bedroom for the lulz/acclaim on a forum somewhere/etc /etc

Iszi

18:37

Now, highest indirect physical risk: Stalker takes the VIN of some gal he's got the hots for. Pulls telemetry data to figure out where she lives...

David Freitag

@Iszi Yes thanks for pasting the xkcd I was quoting

TildalWave

@Iszi Dude, have you checked what's the weather like up north? Imagine being stuck on the road in the middle of a blizzard, or just stuck and outside like -40 ... would you feel safe in it while some knob half way around the world plays with your AC and drains its battery? I mean it's potentially a deadly situation

Simon

batter

^_^

David Freitag

@Simon I wish someone would drain my batter ( ͜ಠ ᴥ ͜ಠ )

2

Simon

ô_ô

TildalWave

18:38

hahaha

Iszi

@TildalWave Again, just pay attention. If you know the car at all, you know how far you can go on a certain percentage of charge. If you get in the car and it doesn't have that charge plus some wiggle room, you find somewhere to charge it or just don't go - and get your arse back inside meanwhile.

Simon

Oh no, I'm getting Dell ads? I'd rather get dildo ads.

David Freitag

@Simon What about Delldo ads?

Rоry McCune

@Iszi cyber-stalky stuff is just going to get worse. I reckon the next gen of smartphones will have sub-metre GPS once they get Galileo/beidou support that + IoT stuff controlled from phones and stalker-paradise!

Simon

@DavidFreitag Meeeeh.

TildalWave

18:40

@Iszi oh sure, stay up like probably a whole night and freezing while you pay attention to all the ways your car is trying to kill you... right. You know what? I'll just drive something else

Rоry McCune

heck people are doing "smart-locks" on their house controlled from phone... if that gets pwned, well you can imagine

Iszi

@RоryMcCune Wanna get even worse? You don't even need to go into the parking lot for a VIN sometimes. Certain jurisdictions make the VIN public via court documents or even just traffic citations.

Simon

Yeah I don't like that at all, I'll keep using physical keys.

David Freitag

@RоryMcCune Yeah but at the same token pretty much every lock on a common door is pick-able sooooo...

Rоry McCune

@DavidFreitag sure but it requires geo-location to do. If you're a stalker, pwn the phone you get geo-location (know where they live) and access to lock

Simon

18:41

Those usually have a slot for a key anyway in case the electronic goes all bananas.

TildalWave

people get regularly stuck all night long on the road in blizzards, and there's little anyone can do about it... your and possibly your passengers lives depend on the car being able to provide power

Iszi

@TildalWave Oh, I most certainly agree. What I was getting at, for current owners of the affected cars, is that an attacker's capability to catastrophically impact their lives via direct control of the vehicle is extremely limited and can be largely mitigated.

Rоry McCune

with a physical lock you have to find their door and then stand there mucking about with it

David Freitag

@RоryMcCune Sure, connectivity makes it easier, I'm just saying locks really are a false sense of security. That is unless you have really good locks (and most people do not)

Iszi

Especially when compared to the friggin' Jeeps.

Simon

18:42

@RоryMcCune Yeah and as we all know, only Brits can muck about.

TildalWave

@Iszi well, I can think of an easy attack right now, and it doesn't take a genius to know what to do and when

Rоry McCune

@DavidFreitag sure not saying locks are good but that "cyber locks" make it actively worse

TildalWave

of course, I won't, but that doesn't guarantee others won't

Rоry McCune

they combine the crapness of ordinary locks, with the nice effect of pwn your phone == pwn your house

Iszi

@TildalWave If "what" is @Simon's mom, and "when" is last night... already done by many.

TildalWave

18:43

hrrr hrrr

Simon

wot

David Freitag

@RоryMcCune Especially if the API allows someone to query for potential targets

Rоry McCune

@DavidFreitag yeah and we know how good IoT companies are at API security.....

then heck just activate your "smart CCTV" cameras wait till they know you're hooked up to your VR rig

and done

Iszi

@Simon Derp. I just implied that your mom was involved in an orgy last night. And that bukkake may have taken place. Well, that last part wasn't so clearly implied before. But now it is.

David Freitag

@RоryMcCune Or cast pr0n to your chromecast when your parents are visiting

Simon

18:44

That was not a "I'm confused" wot.

Rоry McCune

@Iszi I think that's more explicit than implicit now, in more than one way

David Freitag

@Iszi The fuck is wrong with you.

Rоry McCune

@DavidFreitag yeah that's back into lulz territory tho'

Iszi

@RоryMcCune Like @Simon's mom last night too, right?

Simon

re_wot

Iszi

18:45

@DavidFreitag So many things.

Rory Alsop

NSFW - this made me laugh for nearly 10 minutes: youtube.com/watch?v=kOjUL8LwUsE&feature=youtu.be

David Freitag

@RoryAlsop How NSFW? Boobies?

Rory Alsop

@DavidFreitag nah - just swearing

Simon

RORO WHAT IS THAT NEW GRAVATAR

Rоry McCune

@RoryAlsop hey you changed your avatar!

Rory Alsop

18:46

lots opf swearing

Simon

I GOTTA GET USED TO IT NOW

FFS

Rory Alsop

oh - didn't mean to change it here - just for Deep Web

Mark Buffalo

I got some nice VINs

David Freitag

@RoryAlsop You don't see your own avatar in the bottom left-hand corner?

Rory Alsop

@DavidFreitag still showing me the previous one

Mark Buffalo

18:48

Anyone wanna buy some VINs? Please, man, I got these CHEESEBURGERS, man.

David Freitag

@RoryAlsop shouldiblamecaching.com

Rory Alsop

@DavidFreitag yes - exactly that

Mark Buffalo

@RоryMcCune yup

Iszi

@RoryAlsop Holy shit at 1:40!

David Freitag

Althought TBH it was new when I got here like 4 hours or so ago

Rory Alsop

18:49

@Iszi some of them are really bad

Mark Buffalo

@RоryMcCune uuuuuggggggggh IoT

Internet of Things is going to be the death of me

Iszi

Man, I don't think I ever realized before just how much switching the driving side can throw off your perspective on things. I'm having a hard time making sense of some of these situations without thinking too hard on 'em.

David Freitag

@MarkBuffalo Internet of Twinkies

Mark Buffalo

I hope I can live long, but not long enough to not be uploaded into some database of humanity

Iszi

Wow. "F*ing indicate!" Really? Never heard it called "indicating" before. More like, "Use your damn blinker!" or such.

David Freitag

18:52

Trains in Distress

►

Mark Buffalo

They'll probably INNER JOIN me with some weirdo.

David Freitag

@Iszi That's an english thing.

Rory Alsop

@Iszi yup - British thing

Lots of British swearing :-)

Simon

@Iszi You guys don't call it a "flasher"?

Rory Alsop

in case you ever needed to know how to do it

@Simon that's something else

Simon

18:54

o pls roro I'm not talking about ta tas

Rory Alsop

@DavidFreitag I like that one

David Freitag

@Simon Well either tater tots or dangly bits

Simon

I like dangly things.

RORO THAT'S NOT YOUR USUAL AVATAR

Iszi

@Simon Turn signal, blinker... that's about it.

Simon

@Iszi Weird. Most people will say "flasher" here, where did we get that?

Rory Alsop

18:56

@Simon but it is me

David Freitag

@Simon Reddit.

Simon

@RoryAlsop I'm not even sure :(

Iszi

@Simon Must be your French side.

Simon

@DavidFreitag wat

David Freitag

@RoryAlsop It looks like an American football player

Simon

18:56

@Iszi Most-likely, yes.

Rory Alsop

@DavidFreitag It's a Viennese ball mask

Mark Buffalo

Why is it that my flashers have always been big fat ugly women

2

Oh well

David Freitag

@RoryAlsop And you're wearing it on your face?!

Iszi

@DavidFreitag I just hit CTRL+F5 and it changed, but still nothing out of the ordinary. Back to Doktor Mayhem.

Rory Alsop

@MarkBuffalo because that's the kind of place you visit?

David Freitag

18:57

@Iszi Back to? It was Doktor Mayhem before too...

Simon

@Iszi I'm fairly sure this wasn't the exact avatar though.

Rory Alsop

@DavidFreitag hahahahaha - I just got that

David Freitag

@RoryAlsop :]

Iszi

@DavidFreitag But didn't he have a Bobba Fett mask or something?

Mark Buffalo

@RoryAlsop I've had old ladies flash me. I don't know why

Rory Alsop

18:57

@Simon In my Gravatar list I appear to have 13 different Doktor Mayhem pictures

David Freitag

@Iszi No...?

Simon

@RoryAlsop Freak.

Rory Alsop

@Iszi yes...

Simon

@Iszi That was during Christmas you donut.

David Freitag

@RoryAlsop My gravatar is full of futurama characters.

With and without santa hats.

Iszi

18:58

@Simon I blame caching. And lots of it.

Mark Buffalo

I'll be walking by, and they'll look out at the window at me... and I'll look at them... suddenly flashed by these disgusting, fat, droopy... things.

I just want to throw up

Simon

Don't be oldist.

David Freitag

@MarkBuffalo You should throw up, maybe it will teach them a lesson.

Iszi

@MarkBuffalo @RoryAlsop's balls?

Mark Buffalo

This has happened at least 3 times

...it was the same person every time though

David Freitag

18:59

@Iszi Please stop, you're just being disgusting, and not funny.

Simon

dayum dovid totally had enough of your shit

Transcript for