@J.J Try to avoid talented hackers that don't like you.

@JourneymanGeek Chroots are not meant for security. They're often easy to bypass.

@forest I don't think I understated the amount of salt my suggestions needed to be taken with.

:p

Also, Krebs is a bully. He's not even that talented.

hmm. Linux does have proper sandboxes right?

@forest Krebs is more of a journalist and researcher than "hard" security

@JourneymanGeek Sort of. It has the LSM framework which MACs like AppArmor and SELinux use. There's also namespaces which are kinda-sorta sandboxy when used properly, and seccomp which is a syscall sandbox. You really need to use a MAC.

@J.J ^^^^^^^

Wait

The person Krebs doxxed was the cock.li guy?

Also

VC is probably not the person you'd want to fuck with.

Only reason Krebs doesn't need to worry is that VC is pretty chill.

OK finished catching up on the Twitter dox drama.

Yeah Krebs is a total dick. I support VC all the way here.

Also, I use his email. Very nice host.

@J.J Probably not from KeePass because it uses mlock(), but from whatever you gave the passwords to, yeah. A privesc would be able to recover the passwords.

So it really depends on exactly how sophisticated (and malicious) you think your users would be. If in doubt, don't use your own computer to run it. If you have to, dual boot and have your real OS using full disk encryption. Use TPM-based SRTM to verify your MBR, bootloader, and BIOS as well. That basically ensures that even ring 0 and a VM escape can't establish permanence on your box.

It's certainly possible to do it safely, just not necessarily at the same time that you're booted into another system. But generally, with a TPM to provide measured boot to mitigate bootkits and full disk encryption (ideally with authentication, e.g. LUKS2 with AES-GCM or ChaCha20-Poly1305) to prevent simply reading or modifying your other OS's partition, you can safely dual boot untrusted code.

@J.J Yes.

@JourneymanGeek Containers suck too. :P

Too much attack surface from the exposed kernel.

Would be better if you used grsecurity, of course.

@J.J Why don't just use VM?

If you are concerned about performance issues then use a light DE or a WM like i3.

I use i3 as suggested by forest (few months ago),

It's pretty nice

If you don't mind learning few keyboard bindings

@forest Who is VC?

And Krebs doxxed who?

@J.J for personal reasons?

And also what is your primary os at present?

@J.J Let me clear one thing about VM: I was talking about running a Windows as primary OS and then running Linux in a VM

were you talking the same? You don't like this?

@J.J Kali needs to be run live

Don't be one of those people

^

One doesn't simply install Kali as a primary OS

@J.J cool

@J.J Hmm that makes sense

And BTW how are the challenges on HTB?

I mean is it just pwning windows and Linux boxes?

So is it also nmaping the target, finding vulnerable versions of services, googling exploits and then metasploiting them?

Or the actual hacking techniques?

Whats the name of the law that states: A secure cryptosystem remains secure when both the ciphertext and cipher are public knowledge?

@AirCombat You mean Kerckhoff's principle?

Yes! Thank you @TomK., I had been googling this in vein using the wrong key words

you're welcome

be sure though, to use the wording correctly

the meaning of Kerckhoff's principle is: that the goal of a cryptosystem is, that it should remain secure, even though the ciphertext and the used algorithm are public. the security of a cryptosystem remains solely on a secret (for instance: key)

never said something to the opposite

:P

@daya The owner of cock.li, aka @gexcolo. He goes by VC (Vincent Canfield).

@J.J So wait are you running a VM that others connect to?

Or are you connecting to a remote HTB server?

@J.J Why they don't like you!

You seem like a likeable person. Dunno why you'd make enemies.

A couple of days ago I said something in the chat "discussion between forest and mph85". I can't see anything anymore. Have my messages been deleted? How do I find that out?

oh, I found my messages. In another chat. It's like there's a duplicate chat for the same thing with the same conversation: discussion between forest and mph85, and discussion on question by mph85

Don't even remember what the convo was about.