« first day (3032 days earlier)      last day (2146 days later) » 

05:04
@MarkBuffalo The NSA could compromise endpoints yeah, but encryption? No.
@jdgregson That's not true, because AES256 uses 14 rounds whereas AES128 uses 10. Cryptanalysis that works on 10 rounds is very unlikely to make it through an extra 4 unless it's a really severe break.
@MarkBuffalo That's called a cryptanalytic attack, which allows someone to violate some security property of a cipher faster than exhaustive search. The best such attack on AES is called a biclique attack, but it only slightly reduces keyspace.
05:30
@forest Yar. I'm just guessing the dude isn't super technical about encryption.
@jdgregson What Rory said :p Paragraph 1 and 2 are separate, but similar things.
0
Q: Corelan free course / exploit development to modern exploit development

yesii_0691I am doing corelan course tutorial #2 . I am improving a lot quickly, but I would to know something about this course , I know it's based on windows xp, but I am mixing a bit with windows 7 CVE stack overflows depending on the course. I finish the part from xp and I continue with windows 7 ,but t...

lol this question is gold
05:55
Ancestry testing company: It’s our ‘moral responsibility’ to give the FBI access to your DNA http://gizmo.do/fSrXEYJ
Seriously, fuck that company.
@forest lmao
@MarkBuffalo I hope my comment on that question won't dissuade him!
I’m actually pretty okay with the whole ancestry thing.
The concept of DNA testing is fine, but giving it to the feds?
That makes my blood boil.
I mean, unless you can change the way I see it, I probably won’t change my thoughts t.
On it*
05:59
What is it you find acceptable? Giving it to the feds?
Because I have no issues with ancestry tests in general.
Yes, giving it to the feds is fine imho. Especially if it helps catch killers and bring justice to victims... or even find kidnapped kids.
:/
Yeah I'm done talking about this.
Any reason why you’d oppose it?
ah that's better
Would like to hear your perspective.
06:04
@Fermiparadox No, it's the name of an attack that allows viewing monitors through walls, though nowadays it's more broad and encompasses much more.
Surprised you haven't heard of it actually.
Van Eck phreaking is a form of eavesdropping in which special equipment is used to pick up side-band electromagnetic emissions from electronics devices that correlate to hidden signals or data for the purpose of recreating these signals or data in order to spy on the electronic device. Side-band electromagnetic radiation emissions are present in and, with the proper equipment, can be captured from keyboards, computer displays, printers, and other electronic devices. In 1985, Wim van Eck published the first unclassified technical analysis of the security risks of emanations from computer monitors...
This is one of the first papers: cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf
Yeah that’s pretty cool.
06:19
@forest So if you’ve got good reasons to oppose it, I’m all ears. Not a joke — I’m absolutely interested in your perspective.
tl;dr exposing really bad research into static analysis
06:37
Relatively unrelated to security, but do you guys have any recommendations for consumer grade multi-function printers? I'm looking for something that lasts and doesn't require a significant investment in ink. My experience so far is that the consumer printer industry is a racket and all companies, whether HP, Epson, Brother, etc, are lining up to screw consumers. I'm just wondering if there is a recent model that is less... "screw you".
Just get an ink jet printer that doesn't require any one brand of cartridges.
Laser jet printers are rigged to fail.
Ideally, get one where you can replace the ink in the carts yourself.
I usually buy a used one from my local thrift store for $10-$10, but my last one only supported WAP (not WAP2) which was significantly irritating, since I'm not about to set my network to WPA.
WAP?
Oh, WPA?
(Yeah don't use plain WPA)
I've always used a physical line to my printer.
@forest i'm not much of an infosec guy, I started playing a bit more seriously with it only recently.
Yeah, sorry, WPA. Fortunately my current/dead model doesn't force you to buy the vendor supplied cartridges. It isn't technically dead, but it just wants me to by more cyan, even though every other cartridge is working.
06:41
@jdgregson Try to repair it. That'll be your best bet.
Assuming it's not actually running low.
@Fermiparadox Ah. Yeah compromising emanations is a fascinating subject.
Being able to record keystrokes from 20 meters away due to how the matrix scan code in the keyboard microprocessor works... pretty neat.
Feds don't really use it though, since most of their victims are not very clever, letting simpler techniques work on them ("interrogation" etc), so you can ignore the hype that every other police car will have a TEMPEST machine in the trunk. :P
Pretty neat huh?
unbelievable
Although that paper is about CRT, it works (slightly differently) for LCD as well.
@forest I've thought about it. I have one cartridge of each other color left, so it's a tempting idea. I could also just buy another case of generic ink. But on the other hand, having something that supports wireless printing in a moderately secure way is also tempting. Plus if I replace it I can remove all of the motors and pumps to make robots.
06:46
I imagine a printer new enough to support WPA2 will also be rigged to fail.
Yes, certainly. Just like the smart phone industry, they want you to get a new one every 2 years.
Which doesn't make a lot of sense, since they only make money on the ink.
Also, laser jet printers watermark their documents. :P
Allows feds and other criminals to discover the serial number of the printer used.
I'm literally watching Forensic Files right now, so I'm acutely aware of that fact :P
Never saw that.
I hope it explains how damn inaccurate most forensics techniques are...
To the point of being no better than those used in witch trials.
There was one episode where they found that a few letters written by the killer were from a specific printer. I think the same thing lead to the conviction of the BTK killer. A particularly disturbing case.
06:51
Was that the guy who asked the feds if it was safe to send them a document from a floppy? And actually believed them when they said yes?
I’ve had no issues with Laser Jet printers.
I'm not sure off the top of my head, but that sounds familiar.
Do laser jets use toner?
It was something like that.
Toner is more expensive, but I do believe that they last longer.
@jdgregson Yeah.
But you should really avoid laser jets.
06:53
Yeah toner is pretty cheap. I bought one for my business... haven’t realized anything in thousands of prints.
They're designed to intentionally brick themselves after a certain number of prints.
*I'MA FIRIN MA LAZOR!"
Haven’t replaced *
So in the end, ink jet tends to be cheaper. The only time you'd need a laser printer is if you need to print a lot of documents in bulk. Ink jets are also more reliable.
It’s been running strong for years. Get yourself a nice Brother or HP laser printer.
@jdgregson I got 5 years of toner for like $50. Which is basically the cost of inkjet. The laser printers I've used have also never bricked themselves.
06:55
I miss dot matrix printers lol
Those were actually pretty cool.
I guess I have mixed feelings about laser jets because of my recent experiences. Two C-level managers in my company had he same laser jet printer. One of them has been working for the last five years, and the other had its fuser completely eat dirt. And surprise, the fuser costs 1/2 as much as the whole printer.
The cost of one inkjet*
@jdgregson Well like you said, it's basically a racket.
Inkjet is also extremely slow in general, and it's nice to be able to print a very large document (such as NDAs, contracts, SOWs, etc.) very quickly.
So if I buy 2 of them I'm good to go :P
06:56
@jdgregson How much did they pay for that laser printer?
And how big do you need it to be
What capacity, etc
Less reliable, more expensive to maintain, rigged to fail. Only downside with ink jet is that they're slower (most people don't care if it takes a little longer to print).
I'm not sure. It was acquired a few years before me.
And do you need color, or is black and white fine?
Honestly I just want a small-ish one, able to scan/copy, WPS2-capable, which won't die within two years. Capacity: doesn't matter, I don't mind adding paper.
06:59
Ok
One sec
Color is ideal.
s/WPS/WPA/ :P
WPS is a really bad feature in WPA.
Damn, not WPS, haha.
How often do you need to print?
And how fast do you need the pages?
WPA2 is fine.
07:00
I bought 2 of these. amazon.com/gp/product/B0764NWFP8
But that's black and white only
I've used dot matrix, ink jet, and laser jet and ink was by far the most reliable.
Also it doesn't wake you up trying to calibrate every day. :P
"And how fast do you need the pages?" Eventually? Hahah
@jdgregson Well do you need 20 pages per minute or is 6 per minute ok?
Really the speed doesn't matter to me. As long as it's under 10 seconds per page I'll be fine.
07:01
You don't have to buy "genuine" brother cartridges
Yeah then any old modern ink jet will be totally fine.
Hardier and more reliable, usually cheaper, smaller...
Cheaper color toner.
Anyway the color one will give you 33 pages per minute
The B&W will give you 36
GPC is the same brand of ink I bought for the ink jet.
I prefer laser because of speed and lack of having to replace cartridges every 1-2 weeks.
I've had relatively good experience with Brother, so I might go with one of those in the long run.
07:05
Yea, same.
You can also stack trays of paper on those
How much printing do you do vs. how often do you replace the toner? Also, how often do you replace the drum?
Anywhere from 50-300 pages per month. Haven't replaced anything yet...
But I'm only using a B&W :P
One recent contract was around 150 pages. :/
Actually, I've replaced the paper. Does that count?
This is the video that really upsets me about the printer industry: youtube.com/watch?v=AHX6tHdQGiQ
Anyway, thanks for the recommendations. I've gotta get to bed. Letter everyone.
Later
This is why I don't use inkjets. Later dude.
07:09
@jdgregson Laserjets are even worse. :P
But printers in general kind of suck.
Ha, "letter".
lol nice typo
Anyway, I'm out.
 
6 hours later…
Anonymous
13:08
Man, law is fascinating.
Anonymous
I keep coming up with legal questions in my head - law.stackexchange.com/questions/38820/…
13:20
sorry if i am being out of line but what is "The DMZ" chatroom for exactly?
Anonymous
It's a place which is less professional than the main site where you can discuss <insert> infosec things </insert>
ohh cool.
14:25
ok i figured it out. So when enrolling your own device with a MDM solution, you're basically creating a new "profile" (new user under accounts) which is managed by the company.

Android has several APIs to manage policies which are pushed on the device (XML defined so far i could tell). You can create your own policies if you want to (MDM), but when using a ready made MDM solution, this is all transparent as you're given usually a fancy dashboard where you can for example restrict apps, install apps, prevent copy/paste etc...
Anonymous
@HamZa Make a blog post about this~!
i am not sure about all this. When you read the Android enterprise security homepage https://www.android.com/enterprise/security/ , it gives a feeling that this is something special. I was kind of disappointed that it was actually just "android" but managed in a certain sense...
I was kind of expecting some virtualized environment or a whole separate environment but i'm no expert i guess
Anonymous
Well, that's what I use my blog for HamZa.
Anonymous
(As an excuse to research and teach/learn myself)
well i wrote one this weekend :P
https://bhamza.me/2019/03/30/Ingredients-for-effective-mobile-app-testing.html
Anonymous
14:44
Oh nice, I'll have to read it.
Anonymous
I've been thinking about moving my blog away from GitHub recently.
Anonymous
There's a lot of features I want which will be a pain on GH.
@J.J such as?
Anonymous
Well, firstly, I want a categories page (which I know I can do with clever FrontMatter, it's just a pain.)
aren't you using jekyll right now?
Anonymous
14:45
Secondly, I want to change the design of the site to be more modern/minimalist with a kind of Crypto style design.
Anonymous
Yes, I am.
Anonymous
Jekyll + GH-Pages.
i think you can do categories (tags)
might require some hacking though
Anonymous
@HamZa Yeah that's my point; too much hack work.
Anonymous
Also, I really, kinda' want to make the site look good (don't ask why, I don't know)
15:09
well it makes sense, i was looking at my blog and then thought "who's my audience?"
i think i might re-install another clean theme with light colors instead of dark.
also if you guys know any remote security positions hook me up ...
Anonymous
15:22
@HamZa Ewww light theme :p
i'm trying to build a portfolio in order to get possibly recruited
dark themes might scare people off I thought, i'm not sure though...
Anonymous
Hmm, I don't think so HamZa.
Anonymous
Your current theme might
people in this case => recruiters
Anonymous
Which is exactly why I wanted to change mine.
Anonymous
15:23
I don't think dark is a problem, the hacker theme is maybe but dark colours; I'd say not.
might ... ?
Anonymous
As long as it looks professional.
Anonymous
I'm going to switch to Minima I think.
Anonymous
With a dark blue.
@J.J exact same thought haha
Anonymous
15:24
I think a dark colour is fine.
Anonymous
Just not the hacker theme.
Anonymous
I'm a bit worried about changing theme though.
Anonymous
Do you think it will fuck my blog up?
i see, thx for the feedback
@J.J no idea :P
Anonymous
Hmm, I'm sure it will.
Anonymous
15:27
Oh actually, seen as you're here @HamZa - if I change my GH Username, do you know what will happen to my blog?
Anonymous
Because my blog uses my domain not my GH username.
Anonymous
But, I still think it'll break.
@J.J you can just edit the settings in your hosting provider and github to fix it i guess
Anonymous
Hmm.
15:57
@HamZa You need jorb?
@HamZa waves hands
@HamZa I think I just emailed you
But uh, I can only help if you're in the U.S.
@MarkBuffalo Multiple positions available? :)
I think I might start looking for a security related job sometime this year.
I turned down a bunch of offers recently and they were all remote, and they're still looking
'cause I found a better one
They all seemed like really cool companies too... so I'd just be passing out that info
@AndrolGenhald Whaddaya do?
16:16
Currently web development
ah, front/back/full stack?
full stack
Awesome. Any experience with application security?
Most of the jobs I've been looking at require some sort of certification :(
I should probably just start studying for the CISSP
I got my first 'real' infosec gig without certification by putting security wins on my resume
16:18
Most of my security experience comes from reading answers here and learning about it cause I find it fun
So I had a track record of working in security even though it wasn't my main job function for most of the time prior to the first 'real' full time infosec gig.
@AndrolGenhald CISSP is really not worth much... but it's easy to get, so you might as well
not a whole lot of real world experience unfortunately
Just work on projects. Hiring managers liked that I taught myself PHP simply because I wanted to learn about PHP security
And you can add that to your resume
There are opportunities out there if you're willing to learn... especially if you have appsec knowledge to start with.
Hiring managers want to see passion as well
Do you have any appsec experience?
OWASP Top 10, CWE Top 25, business logic stuff?
If you can go through the OWASP Top 10 and learn about the exploits and how to fix them, you'll be in good shape.
Few people care about certs over passion/experience, unless it's a govt job, then you can just get a CEH and get hired anywhere in gov.
Even if you don't meet all qualifications, you can still apply if you think you're in a decent position to do so. And whenever you "lose" an interview, spend time studying what you failed to respond to, even if it's inane.
@AndrolGenhald Most importantly... what do you want to do in security?
I'm not sure I know what I really want to do...maybe a pentesting position or something to start out
My main trouble is finding jobs, I'm not that great at the whole networking thing, and I don't see very many relevant jobs when searching on linkedin or indeed
16:32
If you wanna do pentesting, get OSCP
It's a really basic entry-level cert
But it's worthwhile
But the problem with OSCP is that it's super-light on web app pentesting. It's mostly a network pentest cert, and it doesn't include much in the way of exploiting domain controllers.
It will definitely get you an entry-level job somewhere, though.
These days, most companies seem to need web app pentesters... very few are network-related.
Anonymous
17:07
@MarkBuffalo I disagree that it's entirely/totally network pen-testing.
Anonymous
You're right in the sense that it is not very web-app based, but there is A LOT to learn from OSCP in terms of basic pen-testing skills required for a pen-test job.
Anonymous
Which is exactly why OffSec have a web-app pen-testing certification specifically.
Their OSWE is extremely basic
I have an OSCP, and it was really basic... but yes, I suppose it teaches a lot. But for web app pentesting, OSCP isn’t the way to go.
Neither is OSWE... there are better training materials out there.
I have the OSWE course. Wouldn’t recommend at all for web app pentesting.
Not gonna give spoilers, but I literally compromised every single machine in the OSCP lab in under 2 weeks, including the VLAN segments IT, Admin, Dev and the firewall. It was very very light on web app testing overall.
Don’t get me wrong, I’m not knocking OSCP (just OSWE). It was actually an impressive course, but kind of outdated. It’s definitely a good cert to get as an entry-level tester, but if you’re going to be primarily testing web apps, OSCP only becomes worth it when you get to the RCE portion, assuming the scope of the engagement actually allows you to move laterally at that point. For the tests I’ve done, that is rare unless it’s a full red team engagement.
17:48
hey guys can i get some advice too?
18:18
If you want to do web app pentesting, learn to use burp suite pro (in particular, burp repeater, the squiggly lines for fuzzing, payloads, etc) and try pentesterlab.com -- do all the exercises until you understand them. Then get certs...
Anonymous
@MarkBuffalo A new course has just been released too by them too
Anonymous
Uhhh
18:34
Yeah, like I said, learn to use burp suite
It's pretty handy :) I used to use ZAP, curl and the browser dev tools (groan), and learned burp a few years back. Best investment ever.
19:32
@MarkBuffalo sorry, i was in an area with weak wifi connection. Unfortunately i'm not based in the US...
Also it doesn't seem that i've received an email
Dang, sorry dude. Wish I could help. And yeah — mixed you up with someone else.
@MarkBuffalo it's all right, thanks
But either way, wish you were U.S.-based. Got a few friends looking too.
@MarkBuffalo Is the US-requirement due to the screening process?
I think it’s tax related. Where are you based?
Any chance of working in London?
Ah, ok. I know some folks in London looking. But yeah, I love southern climates.
That’s why I moved to Texas :P
Anonymous
19:37
I'm not being ungrateful but..
hehe i see
Anonymous
THis answer
Anonymous
IS FUCKING AWFUL
Anonymous
Oops
Anonymous
1
Q: Is it legal for me to use a PO Box as the registered address for a Limited company?

J.JI've been wondering what the legality of using a PO box as a registered address for a limited company is. I've done some research and the Royal Mail site seems to imply that it is legal for me to use a PO box in that matter. However, various other resources make claims that you cannot do it. For...

Anonymous
19:38
This answer is terrible
Anonymous
He may as well have just said
Anonymous
"no"
Anonymous
I'm sorry but he put ZERO effort into this.
Lol. I would consult a lawyer
Anonymous
I will.
Anonymous
19:40
But I asked because I thought I would get a well written answer.
Anonymous
He's not answered my questions, he's stated exactly what the site I quoted said.
Anonymous
I'd expect some kind of legal citation on his claims but nothing.
Anonymous
Oh, HAHAH,.
Anonymous
ALL HIS ANSWERS ARE LIKE THIS
Anonymous
Not to be rude but...
Anonymous
19:43
Why do people liek this bother to answer?
Anonymous
If you never write a half decent answer.
Anonymous
Why do you bother making them at all?
@J.J remember, it might not be his native language
also:
"On the Internet, nobody knows you're a dog" is an adage and meme about Internet anonymity which began as a cartoon caption by Peter Steiner and published by The New Yorker on July 5, 1993. The cartoon features two dogs: one sitting on a chair in front of a computer, speaking the caption to a second dog sitting on the floor listening to the first. As of 2013, the panel was the most reproduced cartoon from The New Yorker, and Steiner had earned over between $200,000 and $250,000 US from its reprinting. == History == Peter Steiner, a cartoonist and contributor to The New Yorker since 1979, said the...
might be a bot for all we know :_)
so don't get frustrated
Anonymous
Even still; lazy answers are just a waste of everyone's time, you don't agree?
@J.J i do agree
Anonymous
19:45
Why volunteer your time here if you're not going to actually attempt to do it well? Or just be lazy and passive-aggressive.
Anonymous
oh my god
Anonymous
this guy....
Anonymous

 Discussion between Putvi and J.J

Imported from a comment discussion on law.stackexchange.com/qu...
Anonymous
DUDE
Anonymous
Someone please confirm I'm not going insane.
Anonymous
19:56
Can I report someone for trolling? This guy cannot be serious.
Seems like a pretty lazy answer that doesn't really give me any real confidence.
I would disengage. This person is not worth your time.
Anonymous
Yeah, I'm about too.
Anonymous
Jesus. Fucking. Christ.
Anonymous
His own source says a PO box can have a physical address, so I have no idea how he's confused.
Anonymous
I've flagged his answer as low-quality.
Anonymous
20:04
He's not answered my question, merely just rephrased what I cited in the first instance.
You need a lawyer, dude. I don't make any decisions like this without consulting a lawyer.
Anonymous
Oh, I won't!
Anonymous
Don't worry about that!
Anonymous
I will consult a lawyer on this. However, I wanted someone to confirm the flaws in the article I cited and point me to some actual written & documented law not for someone to just rephrase what I already confirmed.
Hope you get what you need, man.
Anonymous
20:10
Thank you!
Anonymous
I'm sure that a commercial lawyer will be able to help me answer this right away.
Anonymous
God, I flagged his comment and there is now 3 different moderators who have viewed the channel, lmao.
In the U.S. we have registered agents. Not sure if you have those where you are.
Anonymous
No, I do not believe we do.
The registered agent basically would be the contact address of your company
So your name doesn't show up.
His suggestion that you're doing this for illegal reasons is moronic and unhelpful.
Anonymous
20:13
So; that's my whole thing right. I don't want to use my home address because well, company records are public here meaning anyone could Google my company name and get my home address.
There are many legitimate reasons to have a shell, etc.
^ Exactly.
See?
Anonymous
However, I also do not own any commercial space for example; any kind of office space, etc. So I cannot use that either.
Right, and why pay out the ass to rent a commercial space?
Consider a virtual office.
I believe you can have those in the U.K. And for some extra, they can forward mail to your home.
Anonymous
The solution I was proposing is this: buy a PO box with the Royal Mail which has a physical address, i.e - it has a house name & street name (which by the way, my citation and the article he also cited says I can do that)
You can probably bypass the PO Box thing with a virtual office.
Anonymous
20:15
But then he tells me, I cannot do that? Despite by his own citation it says the following: "This implies that within a physical address there is a physical Post Office Box service provider that can accept mail on behalf of the company."
And not worry about it at all.
Anonymous
As you can see, he's contradicted himself severly and then made out that I am breaking the law.
Anonymous
His logic = none.
Completely inappropriate for law.se.
Anonymous
20:17
Oh the funny thing; his answer was just removed.
Anonymous
I flagged it as low-quality and it was accepted.
lol
Virtual office/coworking spaces with mail-forwarding would be a really good investment if you can afford a little extra, if this works where you are. Here, it's like $40/m.
You get an official business address, can get up on google maps/apple maps/etc.
Anonymous
Yeah that was my other solution.
Anonymous
But, I've got a free consultation with an accountant on Monday evening regarding this; as I stated in the talk I had with said user, most accountancy firms allow you to use their address providing you use their services.
That's pretty nifty.
Anonymous
20:21
So I'm just going to ask them on Monday. But the question wasn't posted because I didn't know what to do, it was posted because I wanted clarification on the article I cited something he did not give me at all.
Anonymous
Hahhahaha.
Anonymous
I'm proud of that one.

« first day (3032 days earlier)      last day (2146 days later) »