The DMZ - 2018-11-15

« first day (2891 days earlier) ← previous day next day → last day (1979 days later) »

1:05 AM

@TomK. Didn't we explicitly say that cat calling is offensive and rude?

I just said it shouldn't be banned. That would be censorship.

@TomK. It's an example of an asshole who is an asshole in the name of (3rd wave) feminism. That kind of thing is not uncommon. Note that I specify 3rd wave because those kinds tend to get angry at nothing.

@TomK. The idea of 4th wave feminism isn't really well-established in feminist theory. I tend to think of it as having only 3 waves, with the 3rd wave ranging from the 90s to now. Hell, some people even claim there's a 5th wave...

@TomK. Each wave is a distinct movement. No one is condemning 1st/2nd wave feminism. It was those waves that gave women equal rights, not the 3rd.

1:29 AM

@RoryAlsop Yep, that's equality. Banning speech isn't! :P

1:43 AM

On-topic now, but why do so many people think that a TPM stores an encryption key while it is in-use, as if it removes the need for the key to exist in memory?

I just saw an answer claiming that a TPM can encrypt a filesystem and cache...

I give it 777 this so my php scripts can easily modify it. Maybe I only need 766. Don’t I? — codezombie 9 hours ago

[SCREAMS INTERNALLY]

2 hours later…

4:02 AM

reddit.com/r/talesfromtechsupport/comments/9m8fzj/…

And this is exactly why I am a blackhat.

(Long read with 5 parts, but very worth it)

tl;dr guy discovers super easy to exploit bug, gets in trouble with the government who claim that, if anyone ever exploits it, he will be at fault.

4:29 AM

> this is by far the best damn read I've ever had on TFTS and easily top 3 all-time IT stories. This had me to the edge of my seat since part 1, and while a bit technical, it's worded very friendly and I can feel the taste of nationwide meltdown in my mouth.

Have to agree.

5 hours later…

Anonymous

9:03 AM

@forest I shall read that now.

Anonymous

I put my work laptop in sleep and for some reason it's just closed everything & restarted itself.

Anonymous

I blame Windows, Windows, Windows.

9:31 AM

@forest jeez! That's...special

Anonymous

The actual events in this series took just under 3 years real time from start to finish.

Anonymous

Don't make us wait that long

Anonymous

Heheh.

9:49 AM

@J.J You read the whole thing? It's horrifying isn't it.

The sad thing is that that is not at all uncommon.

Anonymous

@forest Not yet.

ah

Anonymous

I briefly looked at the comments, I'm shifting between work & procrastination.

Anonymous

heh.

Anonymous

4 parts!?

Anonymous

9:53 AM

You cannot expect that much reading of me, I have the same level of focus as a Squirrel.

5 parts, really

Anonymous

Good point, hah.

Anonymous

I'll have to save this for later, it's too early for me to concentrate on such a thing.

Anonymous

I have horrible focus in the mornings, that's why I usually spend them in here talking s*it with @forest :p

@J.J It's actually pretty interesting. I found myself hooked.

Mostly because I wanted to know how bad the vuln was. :D

It's always amusing seeing how these pathetic companies focus on the bottom line.

Anonymous

10:15 AM

@forest Heh, I'll give it a read later.

Anonymous

I think I have to go to a customer site now.

Anonymous

sigh

Anonymous

10:26 AM

Saved!

Anonymous

Customer will do it themselves over the phone.

lol

Man I just got kicked from Tavern on the Meta for saying that killing albinos in the name of alternative medicine, or beating wives in the name of religion is wrong. O_o

This is exactly why I need to spend time to figure out how the damn chat API works.

Anonymous

FeelsBadMan.jpg

There's always that one community which is like that, with moderators who never explain what is problematic until they kick or suspend you, and finally ban you for politely asking for clarification. At least I'm not attached to that room.

Anonymous

Bad moderators are everywhere Forest.

Journeyman Geek

10:37 AM

OI

Anonymous

???

@JourneymanGeek Hey I wasn't saying anything bad about you!

You're not one of the obnoxious ones. :P

Anonymous

^^ Nor was I.

Journeyman Geek

I can see the slippery slope though

Anonymous

Really?

Journeyman Geek

10:38 AM

I still have a grudge over the guy who posted the babyeating picture....

Anonymous

I don't see any slippery slope for having the opinion that bad moderators are everywhere.

Baby eating picture? O_o

Anonymous

In my experience there are a lot of bad moderators all over the Internet.

@J.J If this were IRC, I'd shut down the room for a week. lol

Well, I would have 5 years ago at least.

Anonymous

O.o

Anonymous

10:39 AM

Why? :thinking:

Journeyman Geek

@J.J well, on SE - especially these days, mods (and ROs) have a lot of responsibility

Anonymous

@JourneymanGeek Doesn't mean there aren't some bad mods, does it?

Journeyman Geek

one very important thing with tavern on the meta is, we're literally trying to turn it (back) into a place that people feel more welcome on...

@J.J they don't last long

@JourneymanGeek What about you? Do you think calling out a moderator who is explicitly promoting wife beating is out of line?

@JourneymanGeek That just makes it easier to troll. lol

Anonymous

I never thought I would see those words Forest.

Anonymous

10:40 AM

"explicitly promoting wife beating"

Anonymous

Imagine that..

Well that's Islam.SE for you...

Journeyman Geek

@forest so... out of context....

@JourneymanGeek True, but it's more fun to put it that way.

Journeyman Geek

I'd question your goals there. If you're trying to generate drama over what's on topic...

people are going to get irate

especially with, well the recent twitter drama still in the air

10:41 AM

I only try to generate drama when I'm annoyed.

Journeyman Geek

and then you get kicked

@J.J the ro on question is someone who typically is a lot more patient than I am lol

That's why I still need to find out how to work the chat API. >_>

Journeyman Geek

@forest there's no chat API

its basically a series of terrible hacks

test

Oh god you're right.

Journeyman Geek

(there's a few, reverse engineered libraries... but one of the popular bots literally is a JS userscript that runs on a browser)

10:44 AM

ewww

I made an IRC spambot with just GNU Awk once. :P

Since IRC is so damn simple.

Journeyman Geek

There's a fairly popular python one...

@forest two things.

Rate Limiting

Anonymous

@JourneymanGeek RO?

Journeyman Geek

I sometimes hit that manually

Well obviously an IRC bot is going to make concurrent connections.

Journeyman Geek

@J.J room owner. Not a proper mod. Think of it as an IRC oper vs an admin...

Anonymous

10:45 AM

coughs

Journeyman Geek

ROs have limited powers in a room, Mods have real ultimate power (TM)

Anonymous

I don't know what those things are. I don't use IRC.

Journeyman Geek

.... get off my lawn, what are you 17 18? ;p

Anonymous

I see.

@JourneymanGeek If you're hitting it manually, you need to configure delays in your IRC client. Otherwise it's too easy to get kicked when you paste like 4 lines.

@J.J Think: a text chat protocol so simple that you could use telnet for it.

Anonymous

10:46 AM

@JourneymanGeek I wish I was still 17.

Journeyman Geek

@forest I THINK the rate limiting here scales, but I'm not sure

@JourneymanGeek It does.

Anonymous

@forest Oh I know what IRC is :D

Journeyman Geek

also its a sure way to get yourself suspended for like forever.

Anonymous

But, I don't know the terms like "oper"

10:46 AM

I mean if I were to ever spam a place like this, I'd have to use a lot more than just 5 or 10 bots lmao. Not that I plan on doing that, of course.

Anonymous

:p

Journeyman Geek

@J.J I tried not to say cinnabon ;p

@J.J IRCop, someone who's basically a god on IRC. They have access to OperServ which lets them kline (ban) people from the whole network, not just a single channel. There's op, ircop, and sysadmin. A regular op can only kick from their own channels.

Journeyman Geek

an operator basically has power over a room.

Anonymous

I see.

Anonymous

10:47 AM

Kids nowadays, we use Discord :p

Anonymous

Heh.

Journeyman Geek

a admin has power over a server, though practically those things are not actually managed by the server...

cause IRC is strange and the basic server has no high level moderation tools

The fun thing about spamming IRC is that you can highlight everyone's name, basically like @pinging every single person at once, instead of just one.

Journeyman Geek

you literally run bots with admin level powers for everything

Anonymous

Damn that must be annoying. @forest

Journeyman Geek

10:48 AM

#thatsthepoint

It can be. Some servers get more spam than others. Some rooms, too.

Anonymous

That's the one thing I hate about Discord.

Anonymous

PINGS.

Anonymous

I only like getting pings from certain people :p

Journeyman Geek

and good chat steals and builds on IRC ;p

Anonymous

10:49 AM

Discord is literally just fancy IRC.

Journeyman Geek

I personally think matrix is the new IRC

Anonymous

With voice channels.

Journeyman Geek

eww

I did that once to a room I got banned from cuz the op was a bigot, and flooded them with links to <insert horrible thing published by some Mexican cartel here> for a couple of weeks. Even got one person to vomit (supposedly).

And the crazy thing about IRC is there's really nothing you can do about it.

It's very, very open. All you need is a few hundred proxy that's not on DNSRBL.

Anonymous

@JourneymanGeek You don't have to use the voice channels, but the options are there.

Journeyman Geek

10:50 AM

@forest IRC was designed for a more innocent time

Anonymous

Think Skype + IRC + TeamSpeak.

Anonymous

That's Discord.

Journeyman Geek

actually hence needing all the *servs

@JourneymanGeek Nowadays channels can only lock themselves with +R so only registered folks can enter, which just means bots have to register.

I miss the days when you could trigger a netsplit and rename yourself to NickServ. :(

Anonymous

Too many old people here.

Anonymous

10:51 AM

I need to leave and come back in a few years...

lol

Anonymous

:p

Rizon is a nice server. Lots of anime. Also XDCC.

Anonymous

I only really use Discord for three reasons nowadays.

.

Anonymous

10:52 AM

I've been considering ditching it actually.

security.stackexchange.com/posts/197720/revisions

lols

Anonymous

Hmm?

Yet another person posting shit that needed to be redacted.

Anonymous

Oh right, yeah that happens all the time.

Anonymous

I've not used the site in so long now lmao. I really only use chat.

10:55 AM

heh

Anonymous

Look at the flat line on my profile.

Anonymous

I think I'm dead.

rip

Anonymous

Honestly, there just haven't been any interesting questions.

Anonymous

And, I lost motivation to post answers on questions I can answer.

Anonymous

10:57 AM

I lost motivation after posting this - security.stackexchange.com/questions/183418/…

Anonymous

And I think I actually got a lot of things wrong in that answer which makes me sad because I thought it was good.

11:17 AM

Lol apparently me apologizing if I had triggered some people is "playing innocent". Gotta love corrupt moderation.

Anonymous

lmao

Anonymous

Stop playing innocent Forest!

Anonymous

You know what you did...

Anonymous

Yes.. That's why I'm apologising you moron. :p

lol

I (think) rene thought I was advocating for wife beating when I had called out a moderator on another site for promoting it. So apparently I'm playing innocent by saying that's not at all what I had meant. :P

I'm 80% sure I'll get kicked again for correcting the mod's incorrect understanding.

Anonymous

11:22 AM

lmao.

IRC is much more forgiving since you can troll the living fuck out of a room and not worry about getting banned from the network. IRCops even tell room owners/moderators to just ban the person and forget about it. :D

Anonymous

Heh. I've never enjoyed trolling all that much :p

Oh man you've been missing out. It's so cathartic.

Anonymous

It just doesn't bring me any excitement.

Anonymous

I don't get it. :p

11:25 AM

There's nothing like seeing a mod abuse their power and responding by knocking them off the network or getting them banned themselves.

Since on IRC, if you send too many queries to a specific person, it fills up the server receive queue and instead of you getting kicked, the recipient of the flood of messages gets kicked. IRC is so archaic that apparently that's logical. :D

Anonymous

Hah, that's quite funny actually lmao. What are your thoughts on NCC Group, Forest?

I don't know much about them, but I know they're an established organization.

Anonymous

Hmm.

I don't think I have strong feelings about them one way or another.

Anonymous

Because I am in talks with a recruiter right now for when I pass this OSCP.

11:28 AM

Aren't they the ones who came up with .secure?

Anonymous

And the company he works for are in a direct partnership with NCC Group.

Anonymous

And... Well, I know they're reputable.

Anonymous

It looks like a fantastic place to start in InfoSec.

It could very well be. According to Wikipedia they bought Fox-IT (which is decent).

Anonymous

So basically this recruiter said, when I pass my OSCP then to contact him and he can refer me to NCC Group.

Anonymous

11:29 AM

Which is exciting! But the more I think about how close I am to buying the PWK materials, the more nervous I get :p

:P

Anonymous

I feel like you could probably sit the OSCP exam no problems Forest.

Anonymous

Well, I know you're not a pen tester but.

Anonymous

Anyway, my plan is to take the OSCP - then have a few months of no certifications so I can really get my teeth into Crypto!

Anonymous

Then back on the certification train with the OSCE.

11:32 AM

I dunno, a lot of OSCP stuff deals with things I'm not familiar in.

Web exploitation and database exploitation, in particular.

Anonymous

Ah, I see.

Anonymous

Honestly, as much as I love the OSCP material I cannot wait until I have my certification break.

Anonymous

I have been wanting to sit down and really get into Crypto for the longest time ever, but because I don't have much experience in IT I really needed the certs to get me in the door.

Anonymous

So once I pass this OSCP I am going to for sure sink my teeth into Crypto.

Anonymous

I'm going to order Bruce Scheiners books: Applied Cryptography & Cryptography Engineering.

Anonymous

11:35 AM

I've got a book called "Introduction to Mathematical Cryptography" I think I might sit Dan Boneh's OU Crypto course.

Anonymous

And I've got the Cristof Paar lectures too.

That's not a bad idea, though it is a bit dated.

The core ideas are still solid, but some specifics like antiquated modes of operation and no mention of true authenticated crypto makes it less useful for practical stuff.

Anonymous

Even if I never, ever, ever work in Crypto. It fascinates me so much.

Anonymous

Honestly, I don't think I'm academic enough/intelligent enough to work in Crypto even if I wanted to. But I really do want to learn it.

It's extremely valuable to know how it works, even if you aren't going to become a cryptographer. It's valuable to infosec in general.

Anonymous

11:38 AM

Yeah.

Anonymous

Not only that but not many people can truly say they understand it & it's just fascinating.

Indeed

Anonymous

It's so fascinating how numbers are so powerful. I'm really not an academic kid, I hated Maths, I hated English, I hated Science but I love computers, it, networking, security.

Anonymous

And even though Crypto is a pretty academic subject, something about it makes me so interested heh.

Anonymous

I really don't understand a lot of the math.

Anonymous

11:39 AM

I really struggle with math a lot.

Anonymous

But, it doesn't stop me from trying to understand the math, I'm still trying to get my head around Padding Oracle Attacks, heh.

Anonymous

And I had to watch Cristof Paars lecture on DES a couple times.

@J.J I know a lot of people who joined them and they have very good things to say about them

It's better than a lot of alternatives.

Anonymous

@RoryAlsop Hah, that's good to hear.

Anonymous

11:45 AM

I thought so.

Google is also like that in that regard, very up to date on security.

I mean Google is fucked up, but at least they don't have huge government contracts for "intelligence" bullshit, not like some other big companies.

Or the ones who suck up all the good researchers and force them to keep quiet about their discoveries (cough Apple cough).

Happy belated birthday @Arminius !

8 hours later…

8:09 PM

@J.J You should post your virtual firewall story to r/TFTS.

2 hours later…

Anonymous

10:02 PM

@forest You mean the man that couldn't simply understand he cannot plug a cable into a virtual firewall?

yeah

Anonymous

Hmm.

Anonymous

It's not really that much though, there's not a whole lot to it.

A lot of the stories there are very short.

Anonymous

I've for sure had some more interesting interactions with BT "engineers"

« first day (2891 days earlier) ← previous day next day → last day (1979 days later) »

Transcript for

Nov '1815

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile