« first day (3275 days earlier)      last day (1605 days later) » 

1:40 AM
Also:

> https://www.shodan.io/host/95.211.234.141
What's the easiest way to root you think?
 
 
5 hours later…
6:53 AM
Good morning, you absolute legends. It's me, Karl Jobst, with another episode of "MechMK1 derails the chat!"
@OakSecurity That depends on the XSD. If <tag1> is defined in the sense that it only allows a numeric ID, then <tag1> 1337 </tag1> is invalid.
 
7:22 AM
@OakSecurity Before you root anything, you need an RCE.
Look through those CVEs and find one which allows for code execution.
 
@forest Hey there
 
hey
 
how's it going?
 
Fine, but I have an embarrassing question. I have an email with a PGP signature attached. I use plain GnuPG in command line and I've only ever used inline signatures. How the hell do I verify it?
> This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
 
You mean a detached signature?
 
7:31 AM
I really don't want to read the whole RFC (they aren't relevant to this anyway).
I have the detached signature. I know how to verify detached signatures of course.
 
gpg --verify doc.sig doc
 
The problem is I don't know what "doc" should be. I know how to verify detached signatures but usually I have two files. In this case, I have an email which I can copy paste, but naturally putting the copy-pasted email into a file and verifying that results in a bad signature.
 
That is a good question...
 
It seems to me like this is something an email program with an OpenPGP plugin would handle.
 
That's why you don't put detached signatures over emails
Yes, enigmail does this
If you're unlucky, it may be over some headers too, but not over others
 
7:35 AM
> Content-Type: multipart/signed; micalg=pgp-sha256;
 
I'd say if in doubt, treat it as not verifiable and ask for a clearsign
 
Never saw that. I hate email.
 
Oh, so there is a specific part that is signed over?
 
@MechMK1 I have a draft reply written up for that if I really have to.
Well, that's from the raw email headers.
 
I hate e-mail too, because it's a frankenprotocol. With bits of shit attached all over
And every year, new extensions and such come out
 
7:36 AM
Under that and the other headers is, of course
> Content-Type: text/plain; charset=utf-8
Oh well. I'll just ask for a clearsign.
At least then the only danger is email mangling the message, and that's easy enough to correct.
 
One thing I also saw was people trying to generate GPG signatures over rich text documents (e.g. .doc files) by just copy, pasting them to notepad first and then making the signature over that
Also, if you want to entertain yourself, read the comments to this answer:
20
A: Keep password in macro

MechMK1This is a bad idea. As user mentioned in a comment, anyone with physical access can just press the assigned macro key and the password will be revealed. You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to. The macr...

 
-1 since this answer is utterly wrong: password managers are just as vulnerable to phishing as users, except the failure mode is completely automatic without user noticing; with macro keys only the user can trigger it so user knows exactly when they've inputted the password in unwanted places. It also doesn't help if users think the website is legitimate but password manager disagrees, which then the user will "fix" it, so in the end it just introduces a new point of failure. — Voile 5 hours ago
omg
I had to reply.
@MechMK1 As wrong as this guy is, he has a Touhou avatar so I can't hate him.
 
8:14 AM
@forest He is called Voile, so it's a clear reference to The Embodiment of Scarlet Devil, yet his avatar is Yuyuko is from Perfect Cherry Blossom
 
So he just likes Touhou and can't decide of EoSD or PCB is better. :P
(The answer is, of course, PCB, although EoSD with the 3rd party sprites comes close)
 
I was about to say obviously EoSD is better
But that may just be bias since it's the first Touhou game I have ever played
First mainline touhou game. Actually Scarlet Weather Rhapsody was first
 
First Touhou game I played was HRtP (though obviously not when it first came out).
So I actually played them in order, and only discovered the fandom when I hit the Windows games.
 
That was PC Engine era, wasn't it?
 
NEC PC9801, yes.
The first 5 were PC98 games. I love their music.
 
8:18 AM
I never played PC98 era touhou. To me, it was mostly Touhou 6-9
and 10.5
But man, the soundtrack...
 
I've played up to... that one with Clownpiece.
After that, personal life issues came up and I didn't have time for games.
(They still aren't resolved ;_;)
 
Man, I wish I could help :(
Though things on my end are getting better
My girlfriend is working on her insecurities, and I can tell she's taking things serious
Although she still has this irrational hatred for anything related to Japan
 
Maybe she'll realize that weeb stuff isn't really that bad. :P
damn
 
When she saw that I wrote that I liked Touhou, we were shouting at each other for hours
 
Holy shit
 
8:21 AM
Well, in her mind anything even remotely related to japan is by default degenerate
 
So by hate, you really mean hate.
 
Yes, in the actual sense of the word
 
She saw you wrote it where, here?
 
The only exception is stuff published by Studio Ghibli
Yes, here
 
So she reads your chat transcripts lol
 
8:22 AM
Yeah, which is still...well, things are the way they are
But well, I told her I listen to some japanese music and she just has to deal with it
 
I could never stand someone who invaded my privacy like that (not that I consider that I have a reasonable expectation of privacy on a public, permanently-archived chat transcript, of course)
What is it about Japan that she hates?
 
I also told her I'm occassionally on 4chan, which was also a big fight
 
Well you're on /k/ which isn't a Japanese-related board.
 
Is your gpg key still valid, then I can tell you the whole story
 
Not still valid. I'll create a new one. Link to a room to post it in?
 
8:23 AM
I'll make one
I think you got an invite
 
Send me your public key and I'll send you mine.
 
Okay, just a sec
 
(no need to sign)
 
still the same key
 
Public key sent encrypted to your public key.
 
8:31 AM
Man, now I need to remember my password :D
 
heh
I don't use a password, since it's ephemeral anyway.
It's kept in tmpfs.
 
alright, I got it
Now time to write
 
Heh - was just about to delete all Voile's nonsense and Schroeder got to it 32 seconds before me :-)
 
I was wondering when it'd get moved to chat. :P
 
Long overdue
 
8:37 AM
To be honest, I've seen worse nonsense than just a hatred for password managers.
 
Well - I was asleep, and I'm not back on full moderating duties yet...
 
For some reason, infosec seems to attract people with some very... wrong ideas.
 
Dunning-Kruger goes Info Sec basically
 
yeah
I think some people understand a fragment of something that the public doesn't, and they think they're special all of a sudden
 
Plus the high number of misconceptions around security policy.
E.g. SSH security advice (going to sudo after SSHing in instead of SSHing in as root with a public key because everyone says not to allow root SSH? Woot, not I got root because you don't understand privilege boundaries!) Etc. Cryptography has it even worse. Crypto.SE gets weirdos regularly.
Overall, I have to say this is a very fun field, even if only because of the crazies. :D
 
8:46 AM
Same here. I was so excited to get to 10k just to see the insanity
Finally done writing
Tell me if you decrypted it successfully
OpSec fails episode 7148
 
ikr
Decrypted successfully.
 
shred -x to the rescue
It's ephemeral anyways
 
Not a big deal. I just encrypt public keys because why not.
Strictly speaking, it's not even necessary given RSA is secure.
I just do it out of habit.
 
Yes, it's not a bad habit either
At least until quantum computing gets going. Any second now...
 
Crypto.SE has a lot of questions and answers about that.
tl;dr we're nowhere close yet
(but it could come at any time)
 
8:55 AM
At this point it's just speculation
 
I remember that one
 
@MechMK1 It's a fascinating subject. Right now it's very much an issue of creating qubits with sufficient cohesion that can operate for a non-negligible amount of time before decoherence.
 
OTR, my advice is to try to blacklist the hypervisor first, then patch the encryption routines in the kernel to backdoor the root user. I mean, that's like hacking 101 stuff, but everybody starts somewhere
 
There are "noisy qubits" which only require nearest-neighbor connectivity, but far more of them are required (like, 10 million rather than merely twice the modulus size).
 
8:59 AM
Man, I know far too little about quantum computing to know what's stopping progress. I don't even know what a qubit is, physically :D
 
It can be a lot of things. A trapped ion, a tangled photon, etc.
All it has to be is something that can exist in a superposition and can be manipulated.
I'm sure there's more to it, but that's my understanding.
 
Too meatspace for me
Another answer where people claim firmware to be infected
 
 
1 hour later…
10:19 AM
I just love discussions about FLAC versus MP3. One half shouts "Nooo, you can't hear a difference! Stop pretending!" while the other half shouts "I do hear a difference!"
I just use FLAC because mp3 really doesn't offer that much of a benefit to me
 
@MechMK1 There is no bigger waste of time than theoretical discussions about empirical questions that could easily be settled by a blind test.
 
@Anders Yes, the perceived "quality" advantage of FLAC can't be heard by 99.9999999% of people out there
I just like to store data as it comes off the CD. I have several terabyte of storage, so the upside of "lower storage requirement" is not really an advantage for me
 
@MechMK1 I remember there was a trend to use black marker on the thin edge around CDs. Apparently it would increase the sound quality.
But you are right, that you can't hear the difference doesn't mean FLAC is useless.
 
@Anders I don't know why it would do that. CDs store data in a digital format
If the claim would have been "reduces number of reading failures in bumpy car rides", I may have bought it
But since CD data is digital, you can either read the PCM stream in perfect quality, or not at all
 
@MechMK1 on the other hand...
 
10:30 AM
@Anders The upside of FLAC is that if you need lossy compression (e.g. to write to a mobile device), you can generate that on-the-fly
 
^^^
Its a great archival format
and space is reasonably cheap
@MechMK1 though... CDs have robust error correction and stuff
+ at the risk of being that guy
the magic markers were green
 
Yes, absolutely. And given that it's free, I can be reasonably sure that software able to decode it will be available in decades still
 
Mocking audiophile bull is a fairly established sport in my chatroom :D
 
@JourneymanGeek Off course! Black markers would be ridiculous! How silly of me. :-)
 
@JourneymanGeek Yes I know. EAC tells me whenever it had to use error correction during a rip
Also, one other advantage is editing
 
10:32 AM
Don't forget the magic rocks
 
I can edit a flac file as often as I want and it would not lose quality
 
@JourneymanGeek Magic rocks???
 
Where as if I would do the same with MP3, I would continulously apply lossy compression
 
....
Dude. How did you not know about the magic rocks?
 
Tell us the tale of the magic rocks
For I am ignorant as well
 
10:33 AM
Please educate me!
 
Oh god
machinadynamica.com/index.html on the whole is a great troll
get caught up and let me know. I have stories
 
Oh my god. This is a gold mind.
 
I found the manual and that's a ... 50 dollar network card with a branded PCB and a heatsink
and unlike MD - this is actually almost serious
 
Damn, it's as if these people wanted to be scammed
 
10 000 dollar power cables?
is a thing
its literally a PC kettle style lead with a oversleeve and a bunch of sandblastic media
 
10:37 AM
I will quit my job and start selling audio equipment.
 
Though I have to say, I hear a lot of people dabbing on Tidal. I actually used it to buy Fear Inoculum and it worked perfectly
And regarding that, I have to tell you the funniest comment I have ever read on youtube
 
Lets consider this
My country burns trash and dinosaur farts, I mean natural gas.
then sends the power through whatever cables the lowest bidder sold
to my apartment, wired with builk cable by an old chainsmoking electrician
and yet
that last 2 feet of cable apparently matters
 
@JourneymanGeek Quiet! Your critical thinking will disturb the audio waves.
 
....
I'm actually shocked no one introduced you guys to the sport of audiophile snark
Meanwhile...
I'm a little picky over my headphones (I love my FA003s and am sad they are no longer in production) - and I do actually have some dedicated audio gear.
 
Guy One writes:
> My 7-year-old daughter just listened to this track and said "Wow, those two drummers sound really great" and I said "Yeah, Danny Carey is a genius" and she was so surprized it was just one drummer. Now she's in her room and I can hear the album on repeat. So proud of her.

To that, Guy Two replies:
> Yeah, something similar happened to me. I was just listening to Pneuma, when my 3-month-old son came by and said: "You know Dad, I don't want to be *that guy*, but I think we should all give the album some time to unfold before writing overly positive or negative reviews of Fe
 
10:42 AM
but seriously, your hearing is not that good
 
@JourneymanGeek I just recently got myself a pair of WH-1000XM3 and I'm really happy with them
 
My favourite 3.5mm interconnects?
"Er... they're purple. From DX"
 
They're comfortable to wear, the battery lasts quite long and the noise cancelling is really nice
 
though I do subscribe to geek's theory of "If you can beat someone with it, and it still works, its good"
 
A good way of looking at things
But in regards to Fear Inoculum: I really like the album, especially the first half. The later songs I haven't had as much time to listen to yet, but I like what I hear so far
 
10:45 AM
Its like food ;p
Some people talk about the nuances - but I just want to have something that makes me feel happy :D
 
Absolutely. Except that food is (usually) a natural product, meaning that there are always subtle nuances
I can absolutely believe that someone can taste the difference between wine of the same region, of different years
 
sure but some folks are just so...
uhm
what's the right word
snooty over it
 
The best thing is when people claim they can hear a difference between 44khz and 88 khz
No, you can't, because your hearing only goes to 21khz AT BEST
And 44khz can replicate those signals perfectly
 
lol
the 44khz isn't dynamic range
its sample rate
 
Yes, I know. But sampling rate directly corelates to the highest frequencies that can be reproduced
 
10:49 AM
eh, a bit.
but also other stuff
 
As in?
 
well in theory, how close to analog it is
and y'all probably would get the shannon theorem better than I do
 
Yes, but let's imagine a simple sine wave with 100 hz
I would need a sample rate of at least 200 hz to be able to perfectly replicate a 100hz signal. A higher sample rate would not give me additional benefits
In signal processing, the Nyquist rate, named after Harry Nyquist, is twice the bandwidth of a bandlimited function or a bandlimited channel. This term means two different things under two different circumstances: as a lower bound for the sample rate for alias-free signal sampling (not to be confused with the Nyquist frequency, which is half the sampling rate of a discrete-time system) and as an upper bound for the symbol rate across a bandwidth-limited baseband channel such as a telegraph line or passband channel such as a limited radio frequency band or a frequency division multiplex channel...
If someone were to claim that they could hear the difference between 24 and 16 bit PCM streams, I could believe it more - even though it's probably not true
Reminds me of Colin from CSGuitar, who also likes to make fun of audiophiles with the phrase "DEM TONES BRAH"
Anyways, time for me to eat
 
11:52 AM
So, long rant. Our company's windows server (used as the work machine for all official employees via RDP) got hit by ransomware 121 days ago. This is a system that I have nothing to do with - it is managed by a contractor who is an old school windows sysadmin. Ransomware got in because of an open RDP connection and everyone used 'password' for their password
We had backups but there was still a half day when no one could work
The sysadmin "removed" the virus and called it a day. I used this opportunity to suggest we implement better security policies (password rules, VPN/firewall) and training. The sysadmin responded by setting an 8 character minimum length for passwords and requiring password rotation every 90 days.
I objected strenuously - 8 character minimum is ridiculous because it still allows 'password'. I opted for 12 character minimum and no rotation requirement, citing the NIST. I also suggested banning leaked passwords, which I knew wasn't going to happen.
He responded by setting the minimum password length to 10 and the rotation period to 120 days. The owner was clearly uninterested in further discussion and so i dropped it
Today the head of accounting showed up early to catch up on some vendor payments. His password had expired and he is unable to login, so he reached out to me. Of course I can't help him, so I reached out to the sysadmin and cc'd the owner, politely requesting assistance. I'm sure the sysadmin will respond in a few hours.
All this to say what I couldn't say in my email: I freakin' told you so :p
Sorry, had to say that somewhere :)
 
12:08 PM
Let me read that quickly
Wow, what a douche^H^H^H^H^H^H^Hn uninformed individual
 
lol
I feel bad for the head of accounting. He's the hardest working guy in the office (except the owner). He showed up early to get shit done, and instead of getting in 10 hours of work, he's going to end up with a 5 hour work day
Not that he'll just sit around. He'll find something to do, he just won't be anywhere near as productive
still no VPN. Fortunately a 10 character password will probably stop this from happening again...
 
Hopefully
But checking against a list of compromised passwords is really necessary
 
12:25 PM
This is actually the second time the company server was hit by ransomware
it's an expensive lesson to learn even once. I was surprised the owner was not a bit more serious about making some positive security changes...
Third times a charm?
 
At least you seem to have good backups
 
12:46 PM
Never underestimate the power of backups.
 
I am so tempted to write a question like "How to make backups correctly?"
But I am afraid it'd be too broad
 
1:24 PM
@ConorMancone By the way, do you want to see what I am getting for my girlfriend for christmas?
Since we spoke about that not too long ago
 
Sure!
There was a pretty decent backups question recently...
I finally had a couple good ideas for christmas presents for my wife, which I was pretty excited about. I normally have a hard time coming up with even one thing, and she loves getting good presents
 
Who doesn't? :D
 
Indeed!
 
Great, now the wobsite doesn't work
 
Ah yes, actually has a pretty good answer
3
Q: How to keep backup servers safe?

James PondI use duplicity on a few Ubuntu servers to encrypt backups and send them to a backup server, which then sends another copy to rsync.net, and then, once a week, give it or take, I download these backups to a local server. The problem I have with this is that to send these encrypted archives to th...

 
1:30 PM
That seems a pretty good solution
 
I've always been a fan of the "pull" method of backups. I remember a story about a tech company who's entire product line revolved around "100% reliable backup and disaster recovery" only to have their servers get hacked. The attacker held everything for ransom and then deleted their servers and all backups, completely destroying the entire company in one go
So my rule is: off-site backups are a must, and the production server has no access to them
@MechMK1 Let me know when it gets back up!
 
@ConorMancone Sounds like they needed some better backups :D
 
@MechMK1 That thing looks sweet. Does she play with you?
 
@ConorMancone I'm planning on getting my 850 point list done "Any second now"
Realistically, i still need to wait for christmas probably. I need my painboys and also 10 lootas
And I want to paint them all first and not afterwards
I mean, the guy I showed you is, according to the lore, strong enough to slice a tank in two
 
Only two tanks? /yawn
:)
Oh yeah, I forgot you're still in the army building process
 
1:39 PM
I prefer to paint the "More important" guys before assembling them
 
Is she going to paint that one or are you?
 
@ConorMancone She's painting Mortarion
That link is to the "lootas", which are like a heavy weapon squad
 
Sweet, I figured but you never know. It's more fun that way
So I always have to find this story (although it hides) when I think of it because there are so many unfortunate lessons to learn. This is the company that had all their data destroyed by a hacker and closed overnight
 
I mean, I could paint it, but then I'd just end up with Mortarion like I'd want him
 
@MechMK1 yeah, totally.
From the article, about the company: "Backing up data is one thing, but it is meaningless without a recovery plan, not only that a recovery plan – and one that is well-practiced and proven to work time and time again,” a cached version of their website reads. “Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced."
They did not live up to their hype, unfortunately....
 
1:43 PM
That's a
B I G
O O F
Also since we spoke about the "Lootas" before. Their weapons are literally referred to by other Orks as "Deffgunz"
 
deffgunz? as in "so loud they make you deff?"
 
No, they're called that way "becauz they kill e'rrythin' to deff!"
 
:)
Man, Mortarion is ginormous
I can't even imagine how long that would take to paint
Looks sweet
 
It really depends on how detailled you want to go
According to Warhammer TV, you can do it in 50 minutes ;)
 
lol, 50 minutes if you're an expert
 
1:49 PM
Nah, it's not possible. Shade alone needs like 30 minutes to dry
Let me show you the coolest Mortation ever
> When you want to spread the gifts of Nurgle, but you also just dropped a tab of Acid
 
That is awesome
You gotta love the eyes
 
It's absolutely surreal
This won the Golden Demon 2019 in the Category "Large Model"
One of my favourite models is actually from Warhammer: Age of Sigmar:
2018 was another good year for mortarion :D
 
For a second that first one reminded me of Cthulu (because the long robes looked like tentacles). Need a race in Warhammer 40K called "Lovecraftians"
 
@ConorMancone Well, age of sigmar is split into 4 faction groups: Order, Chaos, Death & Destruction
And most of "Death" is quite lovecraftian
 
Wouldn't surprise me - you gotta pay some homage to the classics
 
2:01 PM
Let me see who was that guy
 
@MechMK1 Although I'm a terrible person because reading your comment, all I can think about is the Walken Comma
Will forever be a classic
 
@ConorMancone Is that that weird comma that doesn't really belong but somehow it does?
 
Although I don't know if Walken is as well known on the other side of the Atlantic. I assume that Shatner is
 
age of sigmar is the WH fantasy reboot?
 
@JourneymanGeek Basically
Except your square bases are not compatible anymore, so please buy new models
 
2:26 PM
I just noticed that schroeder edited my answer to fix a typo, leaving a comment "I couldn't leave that typo alone" :D
But is "An offline password manager allows you to store your passwords in encrypted form" incorrect? Specifically "in encrypted form"?
I didn't know an article was required there
Anyways, I'm on my way home right now. I'll be available on my phone for the next 30 minutes
See y'all!
 
3:07 PM
@TomK. Oh crap, I thought I had replied. Thanks, that's nice! I'm just not a big conference goer, especially if it entails travelling, heh. And as I see it, conferences are mostly about connecting with peers, and I'm not great at that either.
 
3:48 PM
XML question
I have a workflow manager with an export feature.

I create 1 export module per line of XML export. It adds to the same document.

I can also create a header (<?xml version="1.0"?>)

But I get an issue when I send more than one document in the flow.
Since I can only put a static field (no values, unless separator, which breaks formatting) AND because there needs to be a "container" for the tags
I'm really wondering how I can do something (workaround) to make it work.
In other words, my exporter setup is line by line, with one line that does (e.g.)
<main>

and one line after all the tag lines that does
</main>
Works fine for 1 file
but if I send multiple files, it does like:
<?xml version="1.0"?>

<main>
<tag1>tag1</tag1>
<tag2>tag2</tag2>
</main>

<main>
<tag1>tag1</tag1>
<tag2>tag2</tag2>
</main>
So I was wondering if it was possible put a value, with separator, inside the XML brackets.

So I could invoke, say, the ID value of the document
TL;DR:

Is there ANY workarounds for XML brackets to have any other characters other than the root element's name?

< root >

instead of

<root>
Since I can't use values (like ID) except if I use a separator to "declare" it
For example

<tag1> ID12345 <tag1>

Will print out <tag1> whatevertheIDis </tag1>
but I need to use the value inside the brackets
 
4:51 PM
I think you'll have to explain why you need to do something weird. Your example doesn't work because you have multiple root tags (aka more than one main in the same document). The solution to that is simple: but a wrapper around that. AKA
<root>
    <main></main>
    <main></main>
</root>
But I presume there is some reason why that doesn't work?
Regarding your other question, whitespace is ignored in XML, so < root > won't do anything
but of course you can add attributes <root someattribute="yes"></root>
From what I can gather though I think your issue is that you are trying to use XML for something other than its intended purpose, which obviously isn't going to go well
 
 
2 hours later…
6:54 PM
I'm trying to use a software's CSV exporter to output an xml instead and tweak settings.

The only issue is, I don't think there's a logical way, based on the features, to make wrapper.

I have feature for "column header" which could stick the
<?xml version="1.0" encoding="UTF-8"?> on top at all times
but the way it works is, I need to create 1 export task per line
and if I send 5 documents, it loops, so, it's not an issue with CSV because there's only header that's important
all new documents processed into the flow will just add the selected fields and format into a line
until flow's finished, than it will redo for the next document
so I need to find a way, probably via a sheduler (e.g. each 15m, timed with the other system that would fetch the xml) to add 1 line with the </root> but more importantly, I need to find a way to create a secondary header for the <root> line
Because those are the trouble makers
Also, say this wasnt a problem anymore:


<?xml version="1.0" encoding="UTF-8"?>
Also, say this wasnt a problem anymore:


<?xml version="1.0" encoding="UTF-8"?>
<root>
## SPACE IS A REQUIRED SEPARATOR TO INVOKE FIELD ID
<ID attrib=" FIELDID1990 ">
<tag1>tag1</tag2>
<tag3>tag3</tag3>
</ID attrib=" FIELDID1990 ">
Is that doable?

>> </ID attrib=" FIELDID1990 ">
 
7:22 PM
No offense, but this sounds like the sort of solution that causes far more problems in the long run than it solves. So why not just read it as a CSV file?
Or do some other pre-processing?
 

« first day (3275 days earlier)      last day (1605 days later) »