The DMZ

8:24 AM

Good morning, hackers and hackresses!

Say, would it be enough for a server to support TLS 1.3, and for TLS 1.2 to only support TLS_ECDHE_RSA_WITH_AES_*_GCM_SHA* and TLS_DHE_RSA_WITH_AES_*_GCM_SHA*?

The only browsers that refuse to work with this setup are IE11 on Windows Phone 8.1 prior an update and Safari 6-8.

I honestly don't even care about IE11 on Windows Phone 8.1 or Safari 6. If you are on iOS 6, you are on an obsolete OS and that's not my problem

MechMK1

8:53 AM

@RoryAlsop Both XYY and XXY chromosomes happen in about 1 : 1000 births. Deformities in the hands and upper extremities happen in about 2.7 : 1000 births. When I say "Humans have 2 hands, with 5 fingers each", this is considered a normal and accurate representation of facts. When I say "Humans can have one of two genders, male and female", it is considered highly toxic and exclusionary.

But enough said about this topic. I don't want the DMZ to devolve into endless discussions about gender and the likes

Tom K.

@MechMK1 there is not only the case of XXY and XYY chromosomes that can change what constitutes your gender indentity. To deny somebody else the freedom of expressing their identity is just not comprehensible to me

MechMK1

@TomK. I never did so. You are free to express your identity, and you have my full support in doing so. My problem constitutes other people dictating to me how I see them. And if I can't agree on a common ground, then me refusing to interact is considered "hateful". No, I'm not hateful. I don't hate these people. I just don't agree with them.

Tom K.

9:09 AM

In my opinion your statement makes absolutely no sense

Tom K.

9:22 AM

@MechMK1 btw, regarding this: you should definitely only support sha-2 as an HMAC, and can also support CBC mode if you use an Encrypt then Mac extension - which I believe should be available by now

MechMK1

9:42 AM

@TomK. Very mature indeed.

Conor Mancone

10:12 AM

@MechMK1 Yo! It's been a lot quieter around here with you gone for the past few days. Where ya been hiding?

MechMK1

@ConorMancone Just had two wisdom teeth removed, and I really wasn't feeling up to par

But I'm doing better now. I can chew again, so I can finally eat something other than cold scrambled eggs and cold soup

MechMK1

10:36 AM

I really dislike your tone on essentially windows nt framework and web standards. Which is very common in this google era. The fact is some problems the most optimal solution was discovered fairly quickly and in the 90s. The idea that because something is dated has no effect on its utility, it could still be the plain and simple solution, and people still yet again aren't getting that simple concept. Also web standards too. Like tcp, it solved a concrete finite problem back in the 80s, of a server/client bidirectional lossless logical connection. But then google ignores it, and re-invents... — marshal craft 9 mins ago

The wheel, with quick, and waists everybodys time and makes no effort to work with standards, or to reach any kind of concensus with hardware oems, software, etc. Instead hoping it can throw some 1998 intel Pentium 4s it dug out of nyc garbage dump, throw them in windows driven pcs, let uefi browser script do everything (thanks intel, Microsoft, everybody else for agreeing on uefi for google) so that google can craft out a pathetic market nest. And again lets remember that google would never of been possible if it weren't for windows, Microsoft and standards. — marshal craft 4 mins ago

What is this guy on about?

His recent track record seems less than stellar as well

MechMK1

11:27 AM

@TomK. I support SHA256 and SHA384. Why would I want to support CBC-Mode though? It is slower than GCM (with AES-NI, at least) and is not known for its security.

Conor Mancone

12:19 PM

@MechMK1 That's quite the rant. Doesn't sound like someone that it's worth getting into an argument with. There are enough fun discussion to be had, so in my experience there are plenty of times when the best option is to just ignore

MechMK1

@ConorMancone You're probably right

Conor Mancone

The internet is filled with crazy people. Then again sometimes arguing with them can be an entertaining and informative experience on its own, so do whatever you want :)

This is what we call terrible security. I genuinely wonder how many sites like this exist on the internet...

medium.com/@sresearcher039/…

MechMK1

Wow, let me read that

Also, here are some more mini photos if you are interested :D
https://imgur.com/a/8Ny2rEt

3 of mine, one from my gf

Conor Mancone

(painting)

How long have you been doing that?

They look great.

My biggest desire in life is to one day have a skill that doesn't involve a keyboard

MechMK1

12:34 PM

I've been doing that since june this year

So 4 months now. I never did anything creative before

Conor Mancone

Wow, that's pretty crazy. I don't think I could ever manage that well, but if I did I feel like it would take a few years of practice.

MechMK1

No, please don't think that

I am not "special" or "talented" in any way. All I did was watch some YouTube videos on how to do it

I also "painted" some Space Marines before, which were much smaller models. I just painted them blue, but it helped me get a feeling for the brush and the paint

Conor Mancone

I think I just figured out where schroeder got his name from?

Michael Schroeder

Michael Schroeder is an American computer scientist. His areas of research include computer security, distributed systems and operating systems and he is perhaps best known as the co-inventor of the Needham–Schroeder protocol. In 2001 he co-founded the Microsoft Research Silicon Valley lab and was the Assistant Managing Director until the lab was disbanded in 2014. == Early life and career == Schroeder was born in 1945 in Richland, Washington. He did his undergraduate work at Washington State University and went to graduate school at MIT, obtaining his PhD in 1972. Starting in 1976 he has been...

MechMK1

My favourite line regarding starting is: "When you first start painting, get yourself these three washes: Nuln Oil, Agrax Earthshade and Seraphim Sepia. They are literally liquid skill in a bottle and make everything look better."

@ConorMancone [Mysterious saxophone music plays in the background]

But if you're interested in starting miniature painting, I can give you some "low skill, high impact"-types of advice that'll help you avoid the mistakes I made. Even if it's just stuff like "Always pull your brush, never push it"

Conor Mancone

@MechMK1 Although Michael Shcroeder is still alive... /hmmmm

MechMK1

12:43 PM

I like to call him schröder just because :D

Conor Mancone

@MechMK1 My 11 year old is actually getting into painting lego mini figures, but unfortunately with a 6 month old floating around I'm a long way from having spare time.

MechMK1

@ConorMancone That's completely understandable

And painting lego minis is great. Ever considered buying miniatures to build and paint? Something visually more interesting than a lego mini?

Conor Mancone

@MechMK1 That's a good idea, not sure why it never occurred to me. I'll suggest it.

MechMK1

Is s/he into anything specific? Swordsmen, superheroes, robots, etc.?

Also many miniatures need to be assembled first, which likely needs a sharp hobby knife. Parental guidance is advised. (Possible father-child time incoming :D)

Like for example, a model like this looks impressive, has 5 parts to glue together, and isn't otherworldly expensive.

Conor Mancone

12:59 PM

@MechMK1 star wars, lol! He's obsessed. He paints star wars lego minifigures to match specific people from the various star wars tv shows. I'm sure he could find more items of interest though

MechMK1

I'm 100% confident that there are more than enough star wars miniatures

For example, there's a miniature game called "Star Wars: Legion", which has minis that look like this:

Most miniatures come in sprues though, which means that you'll need a flat-sided cutter and a hobby knife to assemble them

And the many cuts in my thumb can attest that the hobby knife is very, very sharp

Conor Mancone

1:27 PM

Huh, I really didn't think they would have star wars mini figures. I'm not sure why I thought that... may have to just get him a bunch of those for Christmas (he has some experience with hobby knives and hasn't sliced himself open yet

MechMK1

It's just a matter of time, trust me. But teaching him how to use a hobby knife is a good thing

You will likely also need to spray the miniature. Get yourself a can of black aerosol primer. If you just paint directly on the plastic, the colour will not stick well

Tom K.

hey

I'm unbanned

MechMK1

Welcome back

Mature as always :D

MechMK1

1:57 PM

3

Q: Suspicious connections coming from Firefox (possible malware)

I was playing around with Wireshark when I noticed something very suspicious: every time I open Firefox (official build from Ubuntu repos), it immediately connects to a server with an apparently random name like d2ddoduugvun08.cloudfront.net and sends some encrypted data. I couldn't find anythin...

Conor Mancone

You two are hilarious. That name reminds me of this

Boaty McBoatface

Boaty McBoatface is the lead boat of the Autosub Long-Range class of autonomous underwater vehicles (AUVs). It is used for scientific research and is carried on the research vessel RRS Sir David Attenborough. Boaty McBoatface is owned by the Natural Environment Research Council (NERC) and operated by the British Antarctic Survey (BAS). Because of its complexity and its extended range, NERC is classing it as an autosub long range autonomous vehicle. == Naming == The name Boaty McBoatface was originally proposed in a March 2016 online poll to name the ship that would eventually be named RRS Sir David...

MechMK1

Yeah, the original was funny, but the derivatives are just so boring. Memes are about creative repurposing, not just mindless repetition

I really love the creative uses of Loss. It was a meme that got so much creative use. People would rearrange books in a bookcase, write music, etc...

But recently, people just post memes titled "lol it's loss" and just in-your-face post the meme

Benoit Esnard

2:37 PM

twitter.com/hexdefined/status/1185864801261477891

3 major VPN providers compromised back in 2018

Tom K.

unbanned again

oh hey Benoit!

Benoit Esnard

Oh hey Tom! Why were you banned?

Tom K.

I was trying to make a point <:

It's not that important really

how are you? long time no see

MechMK1

@BenoitEsnard I have never been too keen on the "VPN hype". PR campaigns like "Use our product to stay safe from evil hackers" is far from technical reality and that alone disqualifies them

Imagine you'd sponsor me to talk about engine degreasers. I know nothing about that sort of thing, so how can you expect me to make a good judgement about which degreasers work well, which don't, and what kind of benefits degreasing your engine gives?

Then why would I listen to people who make skateboarding videos to sell me VPN software. How on earth would they know what it really does, what problems it's supposed to solve, etc.?

Benoit Esnard

2:53 PM

@TomK. I'm fine, what about you?

Going to London in the next few days! :D

@MechMK1 Haha, in France a lot of Youtubers are sponsored by VPN providers, and tbh it's really funny

Every single one of their videos is sponsored, so that really sounds like a joke now

Tom K.

I'm pretty okay. Job is pretty crazy right now, that's why I don't really have time for SE

or CtFs for that matter

MechMK1

@BenoitEsnard Yes, many YouTubers I watch are sponsored by NordVPN too, and it disgusts me how that company tries to scare people into buying their stuff

Conor Mancone

I need a shortcut for "VTC -> Off topic -> Questions that ask to break the security of a specific system are off topic unless..."

MechMK1

@ConorMancone [insert greasemonkey meme]

Conor Mancone

@TomK. Crazy job == job security! Although crazy job for too long == crazy person...

MechMK1

2:57 PM

"You like the internet, right? Well that means that EVIL HACKERS IU GONNA STEAL UR DATAS!!!!!! unless you buy NordVPN"

Tom K.

@MechMK1 just btw, I find it quite interesting, that you think it's immature if I do not call you by your chosen name, but do not want to use people's preferred pronouns ;)

@ConorMancone Yeah, sure. But I knew that when I got into info sec. So that's not really a relief <:

MechMK1

@TomK. Are you still going on about this?

Tom K.

Am I forbidden to say that I find things interesting? ;)

Conor Mancone

@TomK. Actually having second (last?) interview for what would be my first official info security job. Trying to transition more fully into security instead of engineering. So tell me know if my personal life will disappear, because I got 5 kids and no time for that!

Tom K.

or in other words: why wouldn't I? you didn't stop being you, did you?

MechMK1

3:01 PM

You are free to express yourself in any way you like. I just expressed my amusement that this issue touches you so deeply

Conor Mancone

@MechMK1 I don't think I read that the way you meant it... (I'm pretty sure I should just give up being human now)...

MechMK1

@ConorMancone Info Sec can be nice though, especially if you can do remote work or choose your schedule

@ConorMancone Don't worry about it :D

Tom K.

@ConorMancone well, it only does, if you let it. If that sounds kinda cliché ... it is true though. you have to work on your "work-life balance" because there's always more to do

MechMK1

@TomK. It's true though. And in the end you hear people "I wish I spent more time with my family" and never "I wish I had spent more time in the office"

Conor Mancone

@TomK. Indeed. Trying to gauge the expect work-life balance from a potential employer is high on my list during the interview process.

Tom K.

3:04 PM

@MechMK1 It touches you so deeply, that you refuse to call people by the pronoun that they wish to be called by. I just got banned twice for calling you another name. And you did not find it funny (;

Conor Mancone

@MechMK1 depends on the family...

MechMK1

@TomK. Not by my hand though. I couldn't have cared less

@ConorMancone true

Tom K.

not the point of my argument

which you are evading for 5 minutes now

MechMK1

@TomK. You implied that it somehow annoyed me. It didn't

Can you maybe state your point more clearly?

Benoit Esnard

@MechMK1 Out of curiosity, which country are you from?

@TomK. Yeah, same for me. Hopefully it will get better soon. :)

MechMK1

3:09 PM

@BenoitEsnard Austria, why?

Benoit Esnard

@MechMK1 I wasn't sure how much countries nordvpn were targeting with their ad campaign

Tom K.

Unfortunately the automated system removed it from chat. I drew a comparison, that calling someone something that this person does not want to be called can be at least annoying and maybe even hurtful. To make this more clear, I called you another name - analogous to a pronoun you would not prefer. And as I speculated you were annoyed, calling it immature.

MechMK1

@TomK. You are mistaken. Me calling you immature is not me being annoyed, it's me being amused by your, well, imaturity

@BenoitEsnard I don't think it's too far-fetched to assume they target at least the US market (given how many US YouTubers they sponsor) and the EU

Tom K.

Okay, Klaus.

@BenoitEsnard you still in webdeveloping?

Benoit Esnard

@TomK. Yes! Still using PHP. :D

Tom K.

3:13 PM

jeez, didn't you want to change at some point? <:

or are you waiting for that point in time, where PHP is the new COBOL?

Benoit Esnard

PHP is still very interesting to use imo

MechMK1

COBOL is the new COBOL and will probably be for the next decades to come

Benoit Esnard

I don't feel as efficient in the other languages as I am with PHP yet

Tom K.

you probably will never be, right? you are doing PHP for years now, aren't you?

urgh... gotta go

bye

Conor Mancone

@BenoitEsnard I'd take PHP over javascript on the backend any day. Backend javascript has got to be the worst idea anyone ever had. Although, these days its more ES6+ or Typescript, which is much more reasonable. But whoever looked at ES2015 javascript and said, "man, I wish I could use this for my backend too!" was just crazy

Benoit Esnard

3:17 PM

@TomK. Yeah, it's gonna be hard. :P But not having to look-up the documentation every 5 minutes should be enough

MechMK1

@BenoitEsnard Same with me an C#. It's my go-to for most programming problems, unless I can solve it with a bash one-liner

Benoit Esnard

@ConorMancone Back-end JS has its uses imo (chat servers for example), but if your backend has different goals, like rendering full webpages, something is wrong to me

MechMK1

for i in a b c d e f; do ./run-some-script.sh --with "some args" -h "$i" -o "${outdir}/${i}-report.txt"

Benoit Esnard

@MechMK1 Haha, of course

MechMK1

I mean, I get that some people just love to write beautiful python scripts that are maintainable and put them on GitHub and yada yada yada

But 99% of the time I just want to get shit done

Benoit Esnard

3:21 PM

Each languages has pros & cons anyway, you just need to know them, mix them with your own experience & judgement, and use the right tool which fits your needs

MechMK1

Absolutely. But my job is more to break and less to build, so I can get away with writing crude code that just needs to work once

0

A: How do you perform SQL injection on a login form that checks for email address format?

It depends on the confidence of the issue reported by burp, when the confidence is certain, a complete payload for you to reproduce it is provided, usually a sleep command. If the confidence of burp is 'tentative' that usually means the original command and the same command with a ' return diffe...

Am I wrong or does this not answer the question?

Benoit Esnard

I don't understand why the question is voted to close, this feels quite generic to me

MechMK1

The question is fine by me too.

> ...unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem.

Which in my opinion this question does.

Anyways, I'm off to paint more minis. I am seriously considering just yeeting one of the two and getting a different model

Have a good day

Benoit Esnard

Have a good day too!

I've answered the question, but imo the question in the title isn't the real problem

Hey @HamZa! :D

HamZa

@BenoitEsnard hey, how you doin?

Benoit Esnard

3:36 PM

I'm fine, what about you?

HamZa

okay-ish
too busy lately

a few weeks back i was in Melun for work
visited paris to meet a friend, and in the weekend i went to Rennes to meet 2 other friends. Occasionally also visit St-Malo, quite nice there!

Benoit Esnard

Because of work? Or personal stuff?

HamZa

mostly work
and personal since i want to improve my work environment
been trying to come up with ideas/tools/blogposts lately

Benoit Esnard

I still have to start my own blog... I'll be procrastinating a few more years I guess

That's a lof of different French cities! :o

HamZa

that's what i did too
but my friend suggested me to pick up any platform and just write, so i did
now i'm using git pages, works good

and i've been writing down random ideas in Todoist every now and then, since apparently i forget them too often :P

Benoit Esnard

3:41 PM

I'm planning on using GitHub pages, but I still need to find a good domain :P

HamZa

@BenoitEsnard i had the same problem, so i just opted for "last name (first letter)+ first name"

besnard.me <- done!

now go write :P

Benoit Esnard

Haha, that's ugly :P

I've already listed the articles I want to write about though

That's already half of the work right?

HamZa

right

Transcript for