The DMZ

Gilles

00:29

@QPaysTaxes you can do some of the non-competition CTF, like smashthestack.org

and have a look at our write-ups on meta

obviously difficulty and required knowledge varies a lot

Xander

@QPaysTaxes Here's one that's been around forever, and is very low-barrier to entry: hackthissite.org You just sign up for an account, and challenges start. I think it's a fun one to learn on without having to invest a lot of effort in getting involved.

Ohnana

@QPaysTaxes LampSecurity: sourceforge.net/projects/lampsecurity/?source=typ_redirect

@QPaysTaxes it's created by a friend of mine

a few are kinda broken but ctf4 is good

Mark Buffalo

@Ohnana neat

I got training a weird way... practice. trial, and error

it's really nice to see aggregated training like this. that's why kids are so far ahead of us :X

Ohnana

00:45

@QPaysTaxes there are published walkthroughs

so you don't need them lol

@QPaysTaxes that works too. the PDF is put together so you can read only what you need to

do yourself a favor, read the OWASP top 10 before ctf4, it'll help

Mark Buffalo

owasp.org

yeah, @Ohnana has some good advice

OWASP top 10 is great

view-source:google.com

put that in your url browser

you can view the source

or right click -> view source

if the password doesn't show up, it may be loading dynamically. therefore, you have to find it in the console, most likely

developer thing

so just search for an element that is nested

and view the source of that nested element

ah, ok

Ohnana

@MarkBuffalo :thumbs:

Mark Buffalo

@Ohnana you know what bums me out about OWASP?

before I knew about owasp, I already knew how to attack/defend against their top10 :(

so I didn't really learn anything

Ohnana

@MarkBuffalo it's a reference

David Freitag

@Ohnana Your face is a reference

Mark Buffalo

01:00

@Ohnana True, but I wanna learn more stuff

I feel like I've reached an impasse

David Freitag

@MarkBuffalo Your face reached an impasse

Mark Buffalo

@DavidFreitag Your face.

David Freitag

@MarkBuffalo Is a farcical aquatic creature. Watch out, it lobs scimitars.

Ohnana

@MarkBuffalo read blogs

some of them will make your head asplode

Mark Buffalo

yeah, I do

Mark Buffalo

01:49

:(

SmokeDispenser

06:47

morning

Matthew

Morning

SmokeDispenser

did you play unidong already?

(and yes, I'm not sure that the SE people know how that is a euphemism)

Matthew

07:02

Um?

What?

M'vy

07:16

heya

bilbo_pingouin

unikong?

Matthew

@bilbo_pingouin unibong?

M'vy

ahah ah

just looked at the thing

but don't have time to play

Matthew

What thing?

bilbo_pingouin

@Matthew unikong... ;-)

Matthew

07:24

Oh... The thing in the advert... Is it bad that I'd completely blanked that out because it was an advert?

bilbo_pingouin

it's actually a game with unicorns...

Matthew

So I see

bilbo_pingouin

I tried to play, but it doesn't accomodate well with vimperator... or so I guess

Matthew

It's quite an easy game

Rоry McCune

07:38

mornin'

AviD

ahh italicrory, things are back as they should be

crory

cory is better

kalina

@DavidFreitag oh yeah anything after the first tier of cata was easymode

AviD

okay what is up with unikong?

as in, what the hell is it?

kalina

and dragonsoul in general was stupid

AviD

I've been seeing it mentioned around

kalina

07:43

@AviD donkey kong with a unicorn

AviD

@kalina okay?

link?

kalina

do you assume I'm trolling?

AviD

@kalina honestly not sure

it could go either way at this point

kalina

65

Q: What's with the Stack Overflow UNIKONG game?

What's the deal with this new UNIKONG game on Stack Overflow? Is it some sort of ad? Is it just for fun?

AviD

though if its true, I would have gone with donkeycorn

@kalina ahhhh thanks

Rоry McCune

07:45

@AviD security.stackexchange.com top-right-hand-corner

AviD

yeah didnt notice it

kalina

I'm not sure I should be informing a moderator about the going ons around here

I would have expected you to be informed

AviD

4

Q: Is the Konami code for Unikong inaccurate?

Unikong supports the Konami code entered as ↑-↑-↓-↓-←-→-←-→-B-A-ENTER. My own memory of entering the code was that the code was ↑-↑-↓-↓-←-→-←-→-B-A-[select+start]. Was the classic Konami code just for Contra and then other games had a similarity or is my memory just that bad?

unikong

Rоry McCune

@AviD you should answer more questions :op

AviD

@RоryMcCune I ignore ads

@kalina this is how I get informed

kalina

07:46

well that's hardly appropriate.

also I'm in a shocking mood this morning and I apologize in advance, I haven't a clue why it's happened

actually I'm going to go do more sleeping nn

AviD

42

Q: Can I ride the unicorn? If not, can I kill the unicorn?

I'd like to ride the unicorn as pictured both in the ad on the right as well as in the game main menu: The unicorn seems to be an unkillable monster and I am unable to defeat it; I have to either dodge or use the photon blaster to set him back a few inches. I tried goomba stomping it, tried c...

unikong

Matthew

@AviD Those unicorn murderers on Arqade

AviD

DAMMIT I DONT HAVE TIME FOR THIS

kalina

08:04

gosh who is hammering the walls

don't they know that some people sleep during the day -.-

Matthew

@kalina I am working from home, so have my kick pedal under my desk banging in time with music....

kalina

cute but most likely not what I'm hearing

Journeyman Geek

@Matthew Like two ravens, its merely attempted murder

kalina

:28673365 you know i cant see deleted messages right

Iszi

08:19

About Unikong. Finally got around to it and I'm trying to figure out what I'm missing. It seems I've been able to collect everything in the level, but I can't trigger a progression to the next?

Nevermind. I must have been literally missing something. Just did one more run-through and it triggered when I picked up the last item.

kalina

I need coffee for my eyes

Iszi

Man, sucks to be this guy.

Journeyman Geek

On the contrary

its his chance to be a legend

Iszi

Well, that being good depends on what sort of legend we're talking about. The @ThomasPornin kind, or the @Simon's mom kind?

kalina

pls everybody knows Windows Update wasn't introduced until 9x

Journeyman Geek

08:28

the sort that are whispered in hushed tones to scare little children.

Iszi

@JourneymanGeek Oh, so the @Simon's mom kind.

Journeyman Geek

I wouldn't talk about @Simon's mom to little children, personally. Something about child protection service swat teams...

Matthew

@kalina Try ebay. Disturbingly, whilst looking for some fancy coffee for a friend's Christmas present, I discovered that you can buy special coffee for enemas. I didn't get the friend that...

Arperum

@Iszi All you need are the diamonds, the badges are optional. But increase your score.

Iszi

@Arperum s/score/rep/

Arperum

08:31

@Iszi Which is basically score.

Iszi

@Matthew Pls. Everyone knows coffee is a laxative and diuretic.

Matthew

@Iszi When inserted at the top end, yes...

Iszi

@Matthew Well, I'm not interested in taking any solids or liquids into my body through any other orifice myself.

Matthew

@Iszi Ah, so you want the gaseous coffee enema..

Iszi

@Matthew Well, gases tend to just come and go as they please.

Journeyman Geek

08:35

so do cats....

Matthew

@JourneymanGeek ouch

Iszi

@JourneymanGeek You're reminding me of that CGP Grey vid. The one where he explains that dogs are loyal companions who see you as the leader of their pack, while cats are just miniature lions who happen to share the house with you.

Journeyman Geek

>_>

Iszi

@RоryMcCune Does "cancel stars" do what I think it does? Didn't know ROs/mods had that power.

kalina

@Matthew pls no

I don't get on with ebay

after multiple failures I've just concluded to buy new rather than ebay

Arperum

08:43

@Iszi It removes stars from a post. It does not allow people who starred the message before to star it again. The removed star also counts against the daily star limit.

kalina

basically it's an "I'm an asshole" button

remember to think that whenever you click it

Arperum

I've used it exactly once. And that was to make sure someone did not get a flagban if someone who did not know the context came into the room and decided to wildly flag before checking context.

kalina

there's no low hanging fruit for me to answer today

I might just go postal and resolve this issue with my neighbor and his home improvement so I can sleep

AviD

@kalina go ride some unicorns

kalina

I don't wanna

Matthew

08:53

@AviD You can't ride the unicorn. This has been established! Keep up!

silverpenguin

you spin me right round baby right round like a record baby round round round round

kalina

I'm ridiculously drowsey and I don't want to be playing a game that I'm going to suck at in this state

SmokeDispenser

@kalina, there, have a virus-upvote;)

good morning, too.

silverpenguin

@SmokeDispenser im still sleepy :<

kalina

I don't want a virus upvote -.-

SmokeDispenser

08:55

@silverpenguin then go sleep again.

@kalina in that case... let me see if I can still reverse it.

kalina

I WOULD GO TO SLEEP BUT NEXT DOOR IS POWER TOOLING EVERYTHING

silverpenguin

@SmokeDispenser i cant, while im at work the game is in play, I have to manage my pieces and make the right moves for the most dollar

@kalina ༼つಠ益ಠ༽つ ─=≡ΣO)) pew pew

SmokeDispenser

@kalina nope. vote is locked. do whatever you like with it.

@kalina also: I hate when that happens.

AviD

@Matthew lol just tried the konami code. @RоryMcCune make sure you do that, and listen carefully!

kalina

if I had the energy to fall out of bed I'd go turn on some music and put in earplugs to simultaneously drown it out and annoy the crap out of him

SmokeDispenser

08:59

so, any eastereggs already found in unidong?

kalina

maybe I'm dying

AviD

@SmokeDispenser konami count?

SmokeDispenser

(esp. those that do not need sound)

@AviD hm?

AviD

@SmokeDispenser konami code works

SmokeDispenser

@AviD is a and b literally a and b? there's nothing happening here.

AviD

09:03

yes

enter afterwords

SmokeDispenser

nope

Matthew

@AviD No speakers...

AviD

try in the game menu

@Matthew worth it

kalina

@SmokeDispenser you know it's B A, not A B right?

Rоry McCune

@kalina is that a euphemism?

kalina

09:05

@RоryMcCune no it's not! :|

SmokeDispenser

@RоryMcCune sure it is. must be.

@kalina yeah. I just get forwarded to the badges page.

Rоry McCune

it definitely sounds like a euphemism

kalina

sounds like you have the badge link selected when you press enter

Rоry McCune

but we should get those out of the way before "anti-euphemism man" wakes up

SmokeDispenser

@RоryMcCune absolutely

@RоryMcCune you mean @Simon?

kalina

09:07

but I don't really care, I'm too busy testing if I'm able to suffocate myself by lying on my face

Rоry McCune

@SmokeDispenser yep

@kalina you should get some Bose QuietComforts

SmokeDispenser

aww, I know what happens here, I think

Rоry McCune

those are great for drowning out noise

Matthew

@kalina You can, but it's easier if you have a large weight on your head/neck

SmokeDispenser

let me try with a traditional keyboard layout enabled.

yep, that's it. SE cannot handle non-querty layouts well.

kalina

09:10

@RоryMcCune I have a pair of custom etymotic ear plugs but there is no background noise where I live so I can still hear the noise

SmokeDispenser

shog is still here. I might not say 'SE did fail to check the right keys' too loud.

@RоryMcCune are they really paying off themselves?

kalina

yeah he might ban you for complaining about bugs rather than reporting them

SmokeDispenser

@kalina BTW, I did report the area51-openID-login bug with customer support after shog meh'd my report yesterday;)

kalina

even though they're uninterested in a bug bounty so there isn't a real incentive to report any issues you find anyway

it's not negligent on our part if we don't report bugs, it's their software that they develop, that makes it their job to test it

and their liability if they fail to do so

SmokeDispenser

If I did see that right yesterday, @TildalWave was only suspended from chat, not from the sites.

Matthew

09:13

@kalina My main objection is a lack of clear details on what they'll consider bug hunting and what they'll consider hacking into our systems

kalina

suspended is suspended

@Matthew careful, you'll get accused of gaming hats during hat bash while actually testing for flaws

SmokeDispenser

@Matthew hence @RоryMcCunes meta.

M'vy

@SmokeDispenser yes, chat suspension.

6 days though :S

Rоry McCune

@SmokeDispenser well I got them as a present, but they're super awesome at cutting out background noise, it's almost spooky

SmokeDispenser

also, I'm pretty sure checking hardware key codes instead of the actual keys is a stupid mistake, but certainly not a security issue

Rоry McCune

09:16

@kalina yeah active noise cancelling is useful for that scenario, with the quiet comforts it's kind of odd, when you flick the switch things like keystroke noise just disappears

M'vy

@SmokeDispenser depends if you want to rely on meaning or position I guess

SmokeDispenser

@RоryMcCune gonna pay amazon a visit then. Maybe I award myself on the last days on the old job, since my neighbors play the piano;)

@M'vy exactly, may be intended

@M'vy but given that they fucked the hot keys up for me with that as well, I guess it's not their intend to rely on position.

(hot keys on the sites, I mean)

M'vy

did they put the hotkeys in default version ? I used to have a userscript from rebecca c. for this

SmokeDispenser

but yeah, not the only application where my keyboard layout not taken into account is a problem

@M'vy yes

@M'vy you can enable it in the preferences. But even the ? to get help does not work;)

(Because, what they probably register pressed is caps lock + h)

M'vy

It does work on my. And it's localised

SmokeDispenser

09:26

@M'vy strange.

@M'vy well, localized may not mean too much, most local layouts are qwerty-like.

M'vy

the punctuation aren't the same

? is on last letter row after n in Fr, and before shift in UK

SmokeDispenser

well, on my layout, ? does not work. So I cannot access the documentation;)

M'vy

both are shifted-mod key

SmokeDispenser

right. They might check some localized things

my '?' is mod3(caps lock) +h

and that does not work

M'vy

hm...

SmokeDispenser

09:32

using any other mod3 key (there are 3) doesn't work either, unsurprisingly

M'vy

Maybe it does not sends the correct character ? Is there different ? characters ? idk...

SmokeDispenser

well, it sends '?'

idk if that's the wrong one

is in ascii, should not cause problems.

If it was √ or κ or γτδϑϱμϱνβϑροτνκοτψκ or anything like that, I'd have second thoughts.

(yes, the layout has a plane for greek letters and mathematical symbols)

like...ℂ and even ⚥

pretty neat, but breaks some stuff:/

silverpenguin

nooooo sphere.chronosempire.org.uk/~HEx/8402

I was one move away! and i mis calculated!

Adi

09:48

Whaaaa?!

You can get a gun in the unicorn game?!

silverpenguin

wtf is this unicorn game ?

SmokeDispenser

@Adi abolutely. in, like, level 2

@silverpenguin, the 1. april game on SE

look at the site.

unidong.

Adi

@SmokeDispenser Oh. I never even tried beyond level 1

SmokeDispenser

@Adi after 3, they repeat, but the KI seems to get better

Adi

Whoa! You can make color stuff in the console!

silverpenguin

09:54

I think playing the unicorn game at work its a step to far

even for me

Adi

My boss is playing it as well, so there's that

Matthew

@SmokeDispenser KI?

Adi

@DavidFreitag Order places. Payment made. My pocket is 1800 euros lighter. Still no SSD, though.

SmokeDispenser

@Matthew the unicorn and the trolls

CodesInChaos

@Matthew AI

silverpenguin

10:11

@Adi what size SSD? what size? 1TB?

Telkitty

fellaz

silverpenguin

I won that 8402 game.

@Matthew :D

SmokeDispenser

@Matthew Oh, right, didn't think straight for a second there.

@RоryMcCune, do you have in- or over-ear quiet comforts? if over-ear: are they any good in terms of having them on for hours?

kalina

10:27

@RоryMcCune the problem with active noise cancellation is it's achieved by creating more noise, is best suited to low frequency repetitive drones and requires power

I don't need an out of phase jackhammer played into my ears to cancel an actual jackhammer

Rоry McCune

@SmokeDispenser I've got the over-ear, they do get a bit warm, but they're quite light and well balanced, so not horrible comfort-wise

kalina

and I also don't want to be at the whim of power requirements

Rоry McCune

@kalina indeed the battery on mine lasts about 35 hours of use

@kalina yeah you get a weird little bit of ear pressure when the noise cancelling kicks in

Adi

@silverpenguin verkkokauppa.com/fi/product/62678/ggmtx/…

kalina

@Adi ah, an actual upgrade

the first time you use a pc with a m2 pci ssd you'll be like :o

Adi

10:34

@kalina I think I need to be like :o for a while to afford paying for that M2 SSD

silverpenguin

@Adi oooo you work with custom hardware? I would use that for building a router of somesort e_e

Adi

@silverpenguin I work with whatever @David tells me to get. I know nothing about these stuff

silverpenguin

@Adi ahh I see where is dovid

Journeyman Geek

ooh, swanky

kalina

@Adi you will

it is a completely unreasonable difference in comparison to a normal hard disk and even a normal sata ssd (both m2 sata and actual sata)

@Adi if you're not going to get a m2 pcie ssd, at least get some form of ssd

Adi

10:46

@kalina I think it's highly likely that I'll get that M2 PCIe

Matthew

Yeah, spinning discs are good for NAS units and high volume data, but SSD is much better for day to day use

Adi

512GB should be enough for my needs

kalina

@Adi well remember you're not supposed to fill a ssd

I view ssd sizes as size*0.66

Adi

Tell me more

kalina

something about wear levelling

not my area of expertise

Adi

10:49

Mine neither

kalina

don't full disk format, don't use an OS that doesn't support TRIM, don't defrag, don't fill to capacity

Journeyman Geek

meh

disks are not that fragile

kalina

You should leave some free space on your solid-state drive or its write performance will slow down dramatically. This may be surprising, but it’s actually fairly simple to understand.

When an SSD has a lot of free space, it has a lot of empty blocks. When you go to write a file, it writes that file’s data into the empty blocks.

When an SSD has little free space, it has a lot of partially filled blocks. When you go to write a file, it will have to read the partially filled block into its cache, modify the partially-filled block with the new data, and then write it back to the hard drive. T…

Journeyman Geek

and on samsungs you can overprovision a bit for extra life

Matthew

@kalina Although they tend to have quite a bit of space built in for wear levelling nowadays, so it's not as big an issue

kalina

10:51

^ I didn't write that

Journeyman Geek

and here's a dirty little secret

quite often stuff other than nand fails

and if nand fails its predictable

the 950 is an interesting drive

it benchmarks gloriously

but is actually bottlenecked by heat

kalina

that's original

thermal throttling on a storage device?

Journeyman Geek

yup

pugetsystems.com/labs/articles/…

kalina

wow

Journeyman Geek

I'm pretty sure someone will build a tiny weeny little waterblock for it sooner or later ;)

kalina

10:59

bit of an awkward place for a water block though

between two pci slots, under a graphics card

Adi

@JourneymanGeek I'm actually okay with thermal throttling

Transcript for