hey guys, may I be missing something? vbox does not recognize my mod3 (e.g. the caps lock key) being pressed. that makes working with it pretty much impossible.
@silverpenguin True, I prefer PHP over the things I know atm, but I think it's mainly shitty because the documentation was written by @Simon, but then again, there are more ways to rome, and some don't go through a firey pit of death
@Simon as a PHP developer he saves time on testing... and designing... so he has more than enough time to draw stupid pictures while writing stupid code
hey @ThomasPornin random ssl question. the ciphersuite TLS_RSA_WITH_AES_128_CBC_SHA (a.k.a. AES128-SHA in OpenSSL) . Would that be putatively vulnerable to BEAST given the mention of CBC in there, or not?
@Lighty it lets you view disassembled differences between binaries. So if you've just run Windows update, you can work out what changed and in what binaries.
However, I should also add that I don't know PHP at all. I wrote some very simple things with it 10 or so years ago and have not developed anything since (using PHP).
@JukEboX Yep it does. Django being the big name framework, but there's also Flask, things served over Tornado and all sorts of others. web.py? I have probably forgotten more than I know.
If I had to name a design flaw in PHP it would be architectural in the sense I do not want flow control/code to be mixed in with HTML pages (the UI). I don't know if it is possible to do MVC with PHP.
@JukEboX I agree with this so much, but my cousin who is a web dev with strong front end cant see what i mean he just keeps saying "but its just arrays" and then we argue again haha
And since JQuery is becoming the dominante force with design and use I am starting to decide if I want to take the time to learn it or say F it and quite web code
My impression is that PHP gets its bad rep because it has the easiest learning curve of any web dev language. You do not have to learn a framework to start using it and it is easy to find a cheap shared host to serve PHP. This means people start exposing code to the internet without the protections a framework might offer.
@Simon I should do more MVC stuff my knowledge on it is weak... in theory I know MVC well, in practice not so much... though I did build my own MVC which obviously matches only my needs
@diagprov nah you basically can, wusgi returning on the socket
The only problem with new languages is unless your job pays you the same to learn a new language / skill its hard to learn a new one... Time constraints...
The ease of PHP learning is also not necessarily a bad thing, as it helps to encourage people to program. As @silverpenguin says if it is free, it is what you can afford to learn when you are young.
BEAST works only with TLS 1.0 (not 1.1 and 1.2), and requires a client that does not have the countermeasures deployed several years ago in all browsers.
@diagprov I learnt that last week when trying to fix a python app :P I can learn things very well when I am needed to, thinking about trying to take some study leave from work to do that OSCP
@ThomasPornin indeed, I was curious 'cause testssl.sh reports ciphers as being vulnerable or not to BEAST and it reports DES-CBC3-SHA as vulnerable but not AES128-SHA (in this case both are supported) so I was wondering if it was technically wrong (i.e. if it's going to report one it should report the other)
@RоryMcCune Correct me if I'm wrong cc @ThomasPornin but CBC mode in general is vulnerable to BEAST as implemented in TLS 1.0, without any counter measures client or server side.
waiting for an email back from the HR department and 24 hours later realising you didnt add the suffix to the address.... how am I in this profession when i keep doing dumb shit
I've been writing a script to collate results from sslyze for my reporting and I was going on " if it's TLS v1.0 and CBS is mentioned it's nominally vulnerable to BEAST"
@Simon You see when i do this sort of thing I have a class for every functionality. normally getters, setters in the masses, then a seperate class of common functions but not unique
Also part of the reason I asked about testssl.sh last week is that part of exploiting beast requires you can make arbitrary requests. This works over https since javascript but I don't know if anyone has tried this over other protocols protected by TLS (@ThomasPornin any ideas?)
@diagprov It is a chosen-plaintext attack so it requires the attacker to choose the data that goes in the tunnel; but it makes sense only if there is also a secret value, that the attacker wishes to know, that also goes through the tunnel.
Hence Web browsers, because cookies and Javascript.
There are not many contexts where the victim will run code chosen by the attacker (without being immediately pwned) and allow it to send data through a SSL tunnel along with sensitive information.
@diagprov Yes, that's it. Chosen-plaintext attacks require a context of especially gullible and careless victims that collaborate to create a situation that endangers them; it took years to make it happen, with the Web and Javascript.
An important point here is that the attacker must be able to observe a SSL record, and alter its chosen data that will be at the start of the next record.
This does not map, for instance, to emails and STARTTLS
Because even if a mail server reuses an existing, open connection with TLS, it will still buffer complete emails before sending them.
Dear valued employee, after reviewing your performance against the corporate goals, I am pleased to report that you will receive an annual performance award
@Simon ... whats less heavy on the system... doing a left join to a secondary DATABASE / table with in that database... or looping through the standard mysql result array and running another statment with those said reuslts?
@AviD I said little difference not zero difference, just changes the data you get back not the logic ... obviously you can use an inner join to get full results and left joins to get results but not need anything returned from the left... I always default to left joins but I given the situation obviously i would use another
