The DMZ - 2012-06-19

« first day (551 days earlier) ← previous day next day → last day (4319 days later) »

8:52 AM

@Aarthi huh. so it turns out that when I did write a comment, I was offline, and forget to submit it again when I was online... lucky the tab was still open :$

in short, oops.

@RoryAlsop yup, thats actually pretty much the case

@JeffFerland - for what its worth, I agree strongly with what @Rory said.

@Aarthi "so many"??? There are only 3 in total, and I'm not active there at all. Barely active on SO anymore, either.

@RoryAlsop AND PROGRAMMERS!!!

@RoryAlsop wow, you must have some angry midgets over there.

One point to note seperately, while I am of course strongly in favor of the sponsorship this year as in last, the other question is - sponsoring which chapter/project? Up to 40% of the sponsorship can be allocated to a specific one - or two, as we did last year. I think the idea of choosing a chapter/conference, and seperately a (open source) project to sponsor as part of the corporate sponsorship, is simply brilliant. — AviD 27 secs ago

2 hours later…

10:49 AM

@RoryAlsop I flagged the bob's questions, but I'm not sure it can be safely migrated as per the "don't migrate crap" policy. He really need to clarify the question first.

And thanks to SE chat devs for bringing up the @ completion. Take that, you Rories! :P

@Mvy ?

@Mvy Yeah - they are a bit on the 'low value' side aren't they

Well I can't just say @Rory cause it won't highlight anyone now

ahhhh - gotcha :-)

But there is TAB-completion For the win!

11:05 AM

I think an @Rory will actually match all the Rories - I know in TL there are a couple so I get random pings when folks are looking for otehr Rory

Hum.

Is my last mention highlighted?

@Mvy yep

11:20 AM

hm

@RoryAlsop so if do this: @Rory a whole bunch of you sods will be getting gratuitous pings?

@Rory

hahahahahahaha#

@Rory!

@RORY!!!

you rang...?

well at least I must say that your gravatars are at least different now.

@RoryAlsop ah, nothing, was just having fun at your expense.

11:45 AM

I can confirm the @rory matching all thing :o)

12:03 PM

Looks like you guys were having a Rory of a good time this morning.

Probably

@Mvy How's the writing coming?

I'm in a bit of a rush

Seems I have to close that really quickly

As well as grading my students

What's your deadline?

Hum end of next week for the writing. Thursday-Friday for exam corrections

Seems I can get the exams done for this evening, I guess

12:16 PM

What's the class?

University, 1st year, networks

@AviD Yeah, that's the universal advice I've polled from everybody, and what I did.

So is it technically focused configuring/building networks, big picture discussions on how switching works and protocol analysis, or even higher level discussions like, "This is a switch, it does switching. This is an ethernet cable, it plugs into this hole."?

Well actually, I'm correcting practical work they have done on packet tracer

Oh cool.

:w

Pay no attention to the vim behind the curtain.

12:22 PM

"Display the user mode commands and list some that seems important" what kind of a question is that? :S

I did not make the subject BTW

hehe

@Mvy Overly broad and annoying to grade?

Well I guess they got the points for any listing

I GAed 'Advanced Operating Systems', a combination Master's/4th year class. I really enjoyed that one.

1 semester and beginning of 2nd I've been teaching OS to 2nd years

I had an application that would extract their submissions, compile, then run my test cases against it.

12:24 PM

Last exam was pathetic

I deduce they are unable to think by themselves, and need to be guided all the way

I did a 45% correctness, 45% completeness, 10% style. So, as long as all the test cases worked, they automagically got at least a 90%. The other 10 was trivial.

like a "fill in the blank" exam

How hands on is the OS course?

After 2 years of preogramming, they still write me prototypes instead of function calls in C

ew

12:25 PM

@RoryPack Can you reformulate that question? I am not sure to understand this one?

You mean is it easy to teach?

Or easy to learn for them?

I'm more thinking of it from a student's perspective. How much development do they do, I suppose.

Since I did my undergrad and grad at two different schools, I ended up having to take OS at both places. I noticed a significantly different level of interactiveness between the two.

Hm, seems they have hard times to understand it. But I think they had pb with the 1st year teacher.

Or they do not care at all I don't know

They were quite slacking in all the machine exercices

at least 1st semester

My undergrad was almost entirely theoretical discussion of the concepts based on the book (was taught in a Math department). My grad (taught in an Engineering school) was very technical and involved a significant amount of programming.

@Mvy pb?

problem

ah

12:29 PM

I should care, I abbreviate without noticing it. hm

Since you're French, shouldn't the abbreviation be reversed, i.e. wouldn't problem be bp? :)

silly Rory

"No I did not need to use an IP address beacause we do not use the switch directly"

heeeee??

user image

yeah

I was having a chat with someone about something odd they saw related to switching, so I posed the question, "What does a switch do when processing a packet whose destination MAC is not in any CAM table?"

"The switch ARPs for it. Clearly."

12:35 PM

^^

I tried my best to react in a way that encourages a teachable moment.

Or the switch just get lazy and broadcast it :P

why should it care :P

My astrophysics professor was a big fan of saying, "The inherent laziness of the universe." I think it applies.

a.k.a. the inherent laziness of human in that case

hhhee

Q19 to Q20

Como?

12:40 PM

How should I grade Q20 when there is no such question?

heh

10 points off for not answering the question, and an additional 10 points off for not constructing it.

Clearly.

Clearly :P

I love that "Clearly"

Hum

the exercice is: you create a network

6 pc, 1 switch

then you ping one PC

That's going to be hard to put on paper.

Q1: how many packets are generated

I have here : "10"

O_O

/me raises hand

12:43 PM

BTW paket tracer is soooo slow

takes ages to put interfaces up

Hum, well seems a forwarded packet is a new packet.

"here is the full set of commands available :
blah blah blah
blah blah blah
--More--"

Should I write : nice try?

Now, I don't have the broadest of experiences with switching infrastructures, but I have done Cisco and have at least seen Juniper. Neither of those ever used the word "blah" as a command. I doubt any major vendors do.

Well, except maybe Checkpoint. I wouldn't put anything past their designs.

it's placeholders

whatev

cause I'm to lazy to rewrite all of them (since he screenshot it)

Excellent.

12:50 PM

SSSHHHHH!!!

you girls talk too much.

"Clearly"

@AviD Did I ever tell you that I spent about 6 months thinking you were a lady?

I'm nosedeep in my code for a measly ten minutes, come up during compiling and find OVER 50 MESSAGES??

@RoryPack hahah, no, that was @Iszi

hmm, why isznt he on autocomplete....?

@AviD I was just being a jerk to him. :) It was your use of the Tigger. My experience with Tigger fans has been limited to females.

Autocompletes for me.

status-complete

@RoryPack whaaa?? Tigger is the most manly of the pooh characters.

12:53 PM

You're a mod @RoryAlsop

Wait, nevermind, I just heard that.

@Mvy thats not @RoryAlsop, that's @RoryPack. Wrong @Rory.

argh Rory fail

dammit

you really @Rory'd that up!

:D

/me beams

You're messing with my Rory thing man!

2

12:55 PM

It's probably time for me to rename anyway. World Wide Rory Day is over

Awwwww

rename and beervatar time

oy all this @rory ing is causing lots of pings in my browser

:P

I was wondering what the noise was..

@RoryMcCune Don't blame me - it's these crazy Rories

the crazy rories as opposed to you and me .... not sure there's much of a distinction there ya know :P

gotta flag 'em all

12:57 PM

@RoryMcCune lol

Rargh I hate those attacks.

Failed my linkedIn auth twice

before remembering I had to change it recently...

It screw up with my password mnemonic system

(Keepass/LastPass FTW)

Don't like this cause you need to have your keys at hand all the time

But having to remember "Oh linkedIn was hacked X times" to get the right password is a burden too

@Mvy hahahaha - liking that evolving algorithm

Well it was not meant to be evolving

was working well before Steam got hacked, LinkedIn and others

need OTP tokens everywhere

Hum I like French and how you can make up new verbs from English.

new verb is : "pinger" from a ping + verb termination "er"

Even if it's convienient to say it orally, they should not write it imho

19 packets! MY OH MY!

1:21 PM

@Mvy you can do that in Engrish, too.

Though Hebrew is even more flexible, you can take the root of any word and put it in (almost) any of the standard forms, and even combine forms. And even for words from a different language...

^^

@AviD can we have some Hebrish examples please? This sounds cool

@RoryAlsop I have no idea how to translate that in a way that would make any sense to you

hmm... but to continue @Mvy's example - the infinitive in Hebrew is "leXXX" (where XXX is a form of the root, which is usually two sylablles and 3 letters). So one could say "lepayeng" for "to ping" (the "y" is added to force a second syllable).

^^

languages with consistent rules? Extraordinary :-)

we should get one of those...

1:33 PM

or even "apayeng otcha" for "I will ping you" ("otcha" is "to you", "aXXX" is first person future form)

man is insconsistent by nature, can not apply

@RoryAlsop hehe. I've actually said for years that AI will never truly work, because language is illogical. Until someone tries to implement an AI in Hebrew ;-)

@Mvy ah, but computers are completely consistent.

Let's talk in turing code then :P

argh !! copy paste frenzy! my eyes are bleeding seeing a full show running-config and show startup-config copied in a .doc

I should ask a bonus pay for that. Clearly, that's a too dangerous work.

1:50 PM

Hum. At the "Did you choose an IP for the switch" I got a new answer "No because switches have the default gateway as IP address"

@Mvy hahahaha. Just mark it with an "F"

we grade with numbers

[0; 20]

We should all go back to Latin and be done with it.

bibamus, moriendum est

Iszi Rory or Isznti

@RoryPack Wait, when did we decide on a day?

2:04 PM

@IsziRoryorIsznti A few decades ago.

@RoryAlsop Iam vos es narro meus lingua.

@RoryPack yknow, that used to be a lot more impressive before Google Translate.

You know, the last time I looked Google Translate didn't do Latin.

Rock!

Not a very good translation, though.

My dad tried to teach me Latin as a child. Silly boy.

Iszi Rory or Isznti

2:27 PM

Rory ergo sum.

In unrelated news, my wife shared this. You may have seen it before, but it's still pretty funny...

user image

That's pretty good

1 hour later…

3:51 PM

@IsziRoryorIsznti what do you mean by orange soda (@twitter). You mean any orange soda?

Iszi Rory or Isznti

@Mvy It's a reference to a late-'90's TV show.

oh

Iszi Rory or Isznti

@RoryPack might get it since he's in about the right age range & location...

I just had some orange soda and it made me think of that, so I was wondering if anyone else might remember.

Doesn't sound familiar. I've never much cared for orange soda.

Anyway, some orange soda are great

Iszi Rory or Isznti

3:56 PM

Kenan & Kel is an American teen comedy sitcom produced by Tollin/Robbins Productions that originally aired on Nickelodeon from July 1996 to July 2000. The show starred friends and then-All That cast members Kenan Thompson and Kel Mitchell. Sixty-Five episodes and a made-for-TV movie were produced over four seasons. The first two seasons were filmed at Nickelodeon Studios in Orlando, Florida, and the remaining two were filmed at the Nick On Sunset theater in Hollywood. Premise The show was set in Chicago, Illinois, and centered on the antics of two mischievous teenagers, Kenan Rockmore (...

I prefer root beer or cream soda

@IsziRoryorIsznti Never even heard of it.

Belgian beer is great

Russian Imperial Stout FTW!

I asked the ole lady to pick up some soda for me to contribute to the office. She came back with Sierra Mist Natural. Pretty nice actually.

And, since it's actual real sugar, doesn't leave one with a weird nasty after taste like the diets or corn syrup.

real sugar FTW

2

Pretty much, yeah.

Iszi Rory or Isznti

4:20 PM

I'm trying to decide if I want to get up early next Thursday for this: spaceflightnow.com/delta/d360/status.html I'd have to wake up around 0330 to leave the house by 0400. Launch is at 0530. It's not too often we have these go up, though.

Iszi Rory or Isznti

4:50 PM

Bah. Still 2 more days until I can change my name again.

@IsziRoryorIsznti Just can't handle this much Rory, eh?

2

Iszi Rory or Isznti

@RoryAlsop It's driving me rory.

5:16 PM

There we go. No more Rory Day.

2

Iszi Rory or Isznti

Hrm. I'm thinking about this whole UEFI Secure Boot thing. Does this mean that you need to effectively flash your BIOS-equivalent every time there's a CRL update? And, with Microsoft offering signing services for only $99 per account, is that really a huge barrier to rootkit developers?

Iszi Rory or Isznti

5:38 PM

Well, at risk of having a post closed as NC/NaRQ...

0

Q: How secure is UEFI Secure Boot, really?

I've read a few articles recently about the UEFI Secure Boot feature, and how Microsoft will be requiring it to be enabled by default on all Windows 8 certified x86 systems. In theory, it sounds like a good idea - the system will check the boot loader for integrity before every boot. However, i...

trust security-theater uefi

5:51 PM

/me sighs

Now I have to go open up SU

Iszi Rory or Isznti

@ScottPack Eh?

RE: "GHB stick"?

Oh, so I could see the edit.

Iszi Rory or Isznti

Ah.

Iszi Rory or Isznti

6:23 PM

Someone please give me a vote, here? I don't care on what, or if it's up or down. I just don't like my current score.

Sorry, I can't give you 1k rep that easily.

6:42 PM

@IsziRoryorIsznti I vote no.

whats wrong with your score?

Iszi Rory or Isznti

@AviD Nothing, now. It had a "666" in it earlier.

@IsziRoryorIsznti ahh. I see.

anyone know how I can figure out how much internet juice I (my household) sucks up on a monthly basis?

I'm looking into switching ISPs, and so far the best offer actually has a limit on the total juice per month.

till now I had unlimited, and didnt really track it.

any thoughts?

I use cacti

I thought of grabbing some reports from my router (D-Link) but that didnt seem to be much help. Unless someone knows some magic there.

@ScottPack ?

@ScottPack ah, but the problem is I havent been.

so I'm hoping for some way to find out retroactively...

Iszi Rory or Isznti

@AviD I hear bandwidth monitoring is a common feature of custom router firmwares, but that probably won't help you retroactively.

6:47 PM

Kind of hard to get instantaneous measurements of something that's already happened.

never seemed to bother me before...

This sounds like the kind of request a developer would come up with.

@ScottPack yeah, I know :(

@ScottPack lol

Iszi Rory or Isznti

I've actually been contemplating installing DD-WRT or Tomato for exactly that reason, and a few others.

hey, everything is already tracked and logged, right?? just looking for a custom report.

hmm...

@IsziRoryorIsznti have you read @JeffA's recent post?

Iszi Rory or Isznti

6:48 PM

@AviD Doesn't ring a bell, so I'm gonna say no. Link?

codinghorror.com/blog/2012/06/…

@IsziRoryorIsznti he's a tomato shill.

okay, that sounds funny. Like something out of War of The Vegetables.

Some of us don't have your problem

user image

or The Great Garden War of 2012.

do my router does display some stats, but only the total transmitted per interface - since ever, I guess, since I never reset it.

but that doesnt make sense, since it thinks I only received a measly handful of gigs.

Sometimes, depending on which interface you're looking at, the receive/transmit figures may be opposite what you think they should be.

@ScottPack huh??

ah, as in recieve == transmit.

no, I think I have it right - the transmitted is even lower.

6:53 PM

As in, they'll be swapped.

k

anyway it still wouldnt help me - how do I know per month??

dang it.

I use cacti for that.

:)

I guess one way is to just try the damn thing. worst case, I get screwed one month.

Iszi Rory or Isznti

@AviD Interesting post. I'm personally a Linksys fan, so I'll probably be sticking with x-WRT.

@AviD Better odds than marriage.

6:54 PM

@ScottPack lol

Iszi Rory or Isznti

@ScottPack Thought you were talking about some odd domain there.

just have a feeling that 50gb would be overly optimistic...

Per month?

especially in months when I download all of MSDN.

or porn.

@ScottPack yeah...

That's a lot of porn.

6:57 PM

@ScottPack yeah? think 50 gig monthly should last?

So would bacon porn meet the community standards requirement to be obscene?

not counting the porn, of course.

@ScottPack lol

@ScottPack are you saying we have a community standard requirement that things must be obscene?

Fair enough. In the States we have that whole "community standards" thing to determine whether or not something is obscene. The notion being that my neighborhood's standards may be different than yours.

@ScottPack yes, I'm familiar with the concept. I was taking advantage of the ambiguousness of your sentence, which could be interpreted as "... requirement to be obscene"

Iszi Rory or Isznti

@AviD Oh, wait... we're talking about usage caps - not overall bandwidth caps? Who are you switching to, AOL dialup?

7:02 PM

@IsziRoryorIsznti heh.

exactly.

Iszi Rory or Isznti

@ScottPack Oh, dear. I don't know if I want to try applying Rule 34 to that one.

2

most ISPs here dont have any usage caps, charge only for bandwidth - but this is a relatively new isp that is undercutting the prices greatly.

evening all

and other Rories

could be saving a lot of coin, if 50gb would be roomy enough. problem is, I have no idea.

evening first @rory

Iszi Rory or Isznti

@AviD Hrm. It would seem, as far as Sec.SE is concerned, he's actually second Rory.

Rory McCune, Scotland, United Kingdom

7.8k 1 13 33

appsec web-application network tools passwords penetration-test authentication

Rory Alsop ♦, Scotland, United Kingdom

23.4k 2 15 111

network passwords appsec web-application penetration-test cryptography encryption

...by about a month.

7:05 PM

@IsziRoryorIsznti huh. I seemed to remember it the other way around. mind is fickle, I guess.

or maybe its just the senility again, I forget.

no - Rory (1) introduced me to this site

I had vaguely heard of SE, but not anything about Area51 etc

hrm. Math is telling me I'm a dick.

no, I take that back. forgot the "s" in Mbs is "per second", not "per hour".

@AviD lol. Bad, naughty Math - should wash it's mouth out with soap

It's very embarrasing to show my late night stupidity in public this way. Please go away now.

@AviD heh - you and your late night. I've just been mowing the lawn in glorious sunshine

but then the midges came out, so I'll do the rest another day

7:13 PM

@RoryAlsop racist.

In cooler news - just updated www.metaltech.me so it has mobile and desktop versions :-)

(should be said in a Keanu Reeves "Caught my first tube today" voice

@RoryAlsop I think they prefer to be called just "short people".

@AviD hahahahaha

@RoryAlsop hehe, because mobile web programming is just as cool as undercover surfing.

Iszi Rory or Isznti

@RoryAlsop I have a feeling I should get that reference, but I don't...

7:14 PM

@IsziRoryorIsznti Point Break

@IsziRoryorIsznti I think you're a better person for not.

@AviD and Keanu's best film ever - mostly because it has Anthony Kiedis in it :-)

Oh. My. God. Gary. Fucking. Busey.

@RoryAlsop and Gary Busey too. Don't forget Gary Busey.

@AviD very true - best Busey

7:18 PM

Flea was in Back to the Futures? I had no idea.

now everyone is on another IMDB wander

@RoryAlsop gorramit

anyone have thoughts on ADSL vs Cable?

Iszi Rory or Isznti

@AviD I'm a happy cable user. Never really had reason or inclination to change.

I don't have landline telephone service, so I went with cable.

@IsziRoryorIsznti always worried about the kid down the block trying to stream all of the internet ...

7:24 PM

cable is not an option here.... :-(

I can only get 1Mb ADSL

@RoryMcCune - what do you get these days, less than half a mile away?

@RoryAlsop I will do my best to refrain from mocking you.

@AviD I get more than the provider reckons I can get, so that's a first, right?

@RoryAlsop heh, for sure.

As one can see from my usage graphs, I don't really pay any attention to what the speeds are. I think I get like 10Mbps or something

BT suggests 768k, but I get over 900k

wheeeeeeee

7:26 PM

I was stuck on very slow speeds long after most of the civilized world. only had support for above 5mbs here in the past year.

actually, that might have been 2... but now it popped up to support for 100mbs. Pricey, though.

7:53 PM

@RoryAlsop well we get 10Mb down/768Kb up on the cable and 16Mb down/3 Mb up on the ADSL

:-(

it's so weird that your cabinet hasn't been enabled

any news on when they're going to do it?

@RoryMcCune we had that for a long time - next neighborhood over had blazing fast speeds, we were creeping along. Then they decided to upgrade the whole country at once...

@RoryMcCune yes, but how consistent is that? particularly the cable.

@AviD The cable is pretty good, we have two of us working from home most days and we've only had a complete drop-out once. Evenings can slow down a bit but not too bad...

hoping to get an upgrade soon as apparently they can do 100Mb on the cable, but it's doesn't seem completely stable..

@RoryMcCune hmm. though I guess at 100 Mbs, even if it drops 50%, its still pretty freaking fast.

8:00 PM

yeah it would be pretty nice although T.B.H the 10Mb is fine most of the time. I'd actually like better upstream a lot more, would make cloud backups a viable option..

@RoryMcCune well the backup part should be running in the background, no?

Iszi Rory or Isznti

Does anyone else feel like SE should have a global policy explicitly against (and, perhaps particularly for deletion of) answers that contain or begin with phrases like "x is completely stupid"?

@AviD yeah but when I try to upload 30 GB at 750Kb/sec it takes days... and I have all the files in truecrypt volumes so every time I upload it has to do it all again (downsides of being a paranoid security type)

@RoryMcCune nope - I keep pinging them to get some response, but nothing

@RoryAlsop bummer :(

8:05 PM

@RoryMcCune ahh.

@IsziRoryorIsznti doesnt it?

oy. Why does choosing an ISP have to be so frikken complicated?

It's like the peanut butter problem all over again.

Iszi Rory or Isznti

@AviD I don't see it often, but just often enough to think that perhaps they don't - or perhaps it's not well advertised.

@IsziRoryorIsznti its right there in the faw.

FAQ

> •it is a rant disguised as a question: “______ sucks, am I right?”

okay, "sucks" is slightly different from "is completely stupid", but cmon.

Iszi Rory or Isznti

@AviD It could be argued that this addresses questions as opposed to answers...

@IsziRoryorIsznti ahh. didnt notice thats what you were referring to.

I suppose "Be nice" isnt specific enough?

anything in How to Answer?

@AviD What would you know?

8:14 PM

@ScottPack hey, I'm one of those with natural chutzpah.

@AviD nope. but at least we got that cute auto-link.

Iszi Rory or Isznti

Ever have one of those typo-prone days?

@IsziRoryorIsznti No, but then I'm also good at my job.

@IsziRoryorIsznti what's typo-porn?

4

Iszi Rory or Isznti

@AviD Another... interesting... Rule 34 candidate, I guess.

@IsziRoryorIsznti you've spent all day on that, and havent Rule 34'd it yet?

Iszi Rory or Isznti

8:28 PM

This doesn't sound like a security question to me...

0

Q: why does google maps know my location even I am connected via vpn

how does google maps determine my location? I found an article about this: http://friendlybit.com/js/geolocation-and-google-maps/ according to this article, google only uses my ip address if I am using a desktop. what I don't understand is, I am using VPN to go online. online ip checker told me...

I think maybe we should make a general guideline: "If it can go on SOFU, and not have security, it might not really belong here."

8:43 PM

That sounds more like a privacy question, which we've established would be ontopicish

Iszi Rory or Isznti

@ScottPack I'm not sure it's even that. It's asking how a certain technical function works - not how to protect against it.

9:01 PM

@IsziRoryorIsznti actually, I dont think its even that - note he didnt ask "how", he asked "why".

sounds like whinging, if you ask me.

Iszi Rory or Isznti

@AviD He asked why, then how. Sounds like he doesn't have a firm grasp of the English language. Or things like capitalization.

@AviD There. FTFY&M

9:40 PM

Hi Guys. I was just curious if anyone had any experience in setting up secure data rooms for m&a activity

9:56 PM

I think that it doesn't worth it's question at meta. There is webserver. However, web server is used more often so probably tag should be called web-server and webserver should be a synonym.

« first day (551 days earlier) ← previous day next day → last day (4319 days later) »

Transcript for

Jun '1219

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile