The DMZ

> A sha256, sha384 or sha512 hash of scripts or styles. The use of this source consists of two portions separated by a dash: the encryption algorithm used to create the hash

encryption algorithm used to create the hash

forest

[screams internally]

MechMK1

E N C R Y P T I O N
 A L G O R I T H M

forest

Although to be very precise, the SHA-2 family of hash functions use the Davies-Meyer compression function, which internally uses a block cipher. Technically... But they're still wrong.

A. Hersean

1:03 PM

It's still better than base64 encryption (military grade).

forest

>not using double-ROT13

MechMK1

wtf why??

forest

why what

MechMK1

Why it don't work?

I am using literally the same hash as in the provided SPI

forest

Because you touch yourself at night.

MechMK1

1:06 PM

sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh

forest

(OK I'll see myself out)

A. Hersean

s/sha384-// (maybe)

MechMK1

No, you actually need to provide the algo

'<hash-algorithm>-<base64-value>'

A. Hersean

s/sha384-/SHA384-/

forest

I think it's case-insensitive isn't it?

MechMK1

1:09 PM

It's all lowercase in all other examples

A. Hersean

or s/sha384-/sha-384-/ or s/sha384-/sha2-384-/

MechMK1

I tried sha-256 now

I think Chrome just refuses to even try hashes on external elements, but why???

It still don't work

forest

Just get rid of the JS entirely.

MechMK1

It's css

and since it's just one script, I would like to make my policy style-src 'self' 'sha256-...'

Time to aks

Conor Mancone

Hello everyone! How ya'll doing today?

(I live in the south, I'm allowed to use the accent)

Oh wait, none of you are in the US and you have no idea what I'm talking about...

forest

1:19 PM

Hey, I use y'all.

Sometimes I even use all y'all!

Conor Mancone

lol!

What country are you in again forest?

forest

The land of freedom, eagles, and overwhelming corporate mendacity.

MechMK1

@ConorMancone Greetings!

I'm doing fine. I was just banned from Meta, and from the DMZ for 30 minutes :D

Conor Mancone

@forest Hmmm... why did I think you were in Europe as well?

@MechMK1 Which I'm pretty sure you enjoy :)

MechMK1

@ConorMancone Not really. I thought it was quite ridiculous

Conor Mancone

1:22 PM

Ah, well then apologies! I figured at this point in time it would practically be a badge of honor. Then again, getting banned from there is so easy we're probably not there yet...

MechMK1

@ConorMancone "I really dislike what Stack Exchange, Inc. is doing to people" - BANNED

forest

And I was banned from MSE for a year just 12 hours ago. :D

For asking why I was banned in chat for 3 hours. Lovely, huh?

MechMK1

@forest How bad would it be, hypothetically, if someone were to leak their *_secret keys in an OAuth 2 application

forest

I know literally nothing about OAuth.

Web stuff is not my forte.

MechMK1

Sadness

Conor Mancone

1:24 PM

Those are both really ridiculous... like, the boat is sitting on the ocean bottom and they're still standing on the deck trying to bail out the water....

@MechMK1 Are you talking about a certain SE employee?

forest

Did an SE employee get their credentials stolen?

Conor Mancone

I'm trying to formulate a coherent answer but unfortunately I think I just don't have enough experience there, sorry

MechMK1

@forest A certain employee published these credentials on their github account

I mean, hypothetically

forest

lel

MechMK1

@ConorMancone I sadly don't know too much about OAuth2 either

forest

1:27 PM

I know about as much about OAuth2 as I know about quantum chromodynamics.

4

A: In the CFAA, what exactly does " Intentionally accessed a protected computer without authorization" and "exceeding authorization"?

A law has to be "broad" to include a lot of possible crimes and intent of criminals and account for the good faith of non-criminals. "Intentionally access without authorization/exceed" is actually fairly specific; "intent" is the keyword. Someone making a mistake may have intent to login, but no...

>law enforcement are reasonable wrt enforcement of the CFAA

MechMK1

T O P
K E K

> that hat

forest

What about it

MechMK1

The red star on it

It could not have become more political

forest

I don't get it.

Conor Mancone

Reference to communist china, right?

I mean, I guess it could just be a reference to China...

MechMK1

1:35 PM

forest

oh lol

Conor Mancone

Oh yeah, duh, china is a yellow star

forest

That looks identical to the hat. Yeah I think that's no coincidence lol

MechMK1

Stack Exchange has the political sensitivity of a hand grenade.

Conor Mancone

What are you talking about? They are so proactive about banning people who aren't far-left, how could they possible be insensitive?

/sarcasm of course

forest

1:38 PM

>be left libertarian
>the right hates you because you are pro-choice and support marriage equality
>the left hates you because you support free speech and gun rights

MechMK1

@forest Is that a reference to the >be germany meme?

forest

Just generic greentext.

My greentext culture comes from /a/ and /g/. I have little knowledge of /pol/ or /int/.

Anonymous

Oh my.

Anonymous

I am back again.

Anonymous

Forest is still here and so is Mech.

Anonymous

1:44 PM

What happened? lol

forest

I was supposed to go to sleep.

Anonymous

Psh

Anonymous

You don't need sleep.

forest

ikr

Anonymous

You're a tree.

forest

1:44 PM

I'm an entire ecosystem, thankyouverymuch.

Anonymous

Well actually, you are a large collection of trees.

Anonymous

Hahhahahah, yes.

Anonymous

I'm trying to install stuff on my new laptop.

Anonymous

Not going well..

forest

"apt install stuff"
"dnf install stuff"
"emerge stuff"
"cd stuff-4.20 && ./configure && make && make install"

Anonymous

1:47 PM

As I said earlier, I am (not)allowed Linux, heh.

Anonymous

I wish I was.

forest

rip

Anonymous

Considering I am a full-time pen-tester, it would make sense to let me have it.

Journeyman Geek

@J.J chocolatey is a pretty sane package manager if you're allowed

Anonymous

But no.

forest

1:48 PM

Install Vbox or something.

Anonymous

I use VMWare :D

forest

VMWare is gross.

Anonymous

Yes it is. But I prefer it to Vbox.

forest

You're a strange person.

Anonymous

Just bad experiences with Vbox, I guess.

Anonymous

1:49 PM

But yes in general I am pretty strange :D

forest

Everyone knows it's KVM > Xen > Vbox > HyperV > Parallels > * > bhyve > VMWare

Anonymous

Is it bad that my work laptop is filled with memes?

Anonymous

lol

forest

Memes keep a computer healthy.

Anonymous

Hahaha, truth.

Anonymous

1:51 PM

They keep our Teams chat healthy.

Anonymous

Yes, yes I know - more Microsoft shit.

Anonymous

Believe me, I wish we were not using it.

Anonymous

I dislike Slack to be fair but it's better than Teams.

forest

Just have everyone run netcat listening on the LAN and talk to them through that.

Anonymous

lmao.

Anonymous

1:59 PM

Doing that seems like fun.

Conor Mancone

@MechMK1 so implementing a strong CSP has always been on my list, but I don't get enough time for security related concerns to make it happen. However, on the basis of your question (and the question that you linked to), I gotta ask: how much of a pain is it to actually make a CSP?

Anonymous

A big one.

forest

It can be painful for non-trivial sites.

Anonymous

I've never made one but from outside experience as a pen-tester, seems to be a huge PITA.

forest

But there are online CSP generators that can help a lot.

Anonymous

2:01 PM

Awh bless

Anonymous

There's a woman at my work, we're good friends.

Anonymous

We get lunch a lot, I am talking to her on Skype, she's not that technical.

Anonymous

But she just figured out she can use shift to make capital letters

Anonymous

And shes excited.

Anonymous

:DDDDDD

forest

2:06 PM

haha what

Anonymous

I know.

Anonymous

It's 2019, she should know.

Anonymous

But it's pretty adorable actually, she is really excited about this haha.

forest

I think I read somewhere that 30% of people don't know that ^F lets you search pages.

Anonymous

lol

forest

2:09 PM

And here I am telling people "just do ^L if you want to type in the URL bar! Don't use the mouse!"

Anonymous

Oh God, if I could eliminate the mouse for good I would.

Anonymous

The more shortcuts the better.

forest

A good tiling window manager can do that.

MechMK1

Man, constantly getting banned is getting annoying

SE, Inc. can't handle my memes

Anonymous

lol

MechMK1

2:11 PM

@ConorMancone That really depends on the website

forest

@MechMK1 Did you get banned here again?

MechMK1

If your website is extremely complex, has tons of third-party stuff attached to it, then it requires substantial time

Yes

Because of my work uniform jokes :D

forest

Oh, I was wondering why it got deleted. I thought you deleted it yourself to avoid just this.

MechMK1

No

If you see (removed) followed by 30 minutes of silence, you know why

forest

(USER WAS BANNED FOR THIS POST)

MechMK1

2:14 PM

I was only banned once from 4chan for /pol/posting in /tg/

forest

I can't count how many times I've been banned on 4chan.

Which is probably because I use proxies so I never have the same IP... but still!

MechMK1

@forest I am so often on mobile so I never have the same IP

I got banned for proxying, so I just cleaned my cookies and got a new IP and there we go again

MechMK1

2:59 PM

I hope y'all like what I knitted for this year's amazing Winterbash 2019!

MechMK1

3:11 PM

Oh no...

Anonymous

HAHHAHAHAHAHAHAHHA

Anonymous

AHAHHAHAHAHAHAH

MechMK1

Man, doing that pixel-perfect Fixedsys was hard work

Conor Mancone

@forest Didn't know about that one. I always just open a new tab instead (sometimes closing the current one) because the cursor starts in the address bar

MechMK1

@ConorMancone ^L is such an amazing shortcut

Like ^T or ^N

Anonymous

3:15 PM

Hey - any AD guru's here right now?

MechMK1

I wish

Anonymous

:(

Conor Mancone

What I really want is to be able to browse the internet exclusively with keyboard shortcuts

Anonymous

What I want is for my local admin account to work on my new fucking machine.

Conor Mancone

I never use the mouse while programming. I use lots of testing, which also doesn't require a mouse

but the second I have to check something in the browser it's like everything slows down to a snails pace because of that silly mouse

Anonymous

3:18 PM

^

Conor Mancone

I've experimented with systems that let you ditch the mouse for browsing in modern browsers, but I've never succeeded in getting them into my flow

@J.J lol, seems very unlikely, sorry :p

Anonymous

It's not workig.

Anonymous

I don't know why.

Anonymous

I can see the computer in that AD user.

Anonymous

It makes no sense.

Conor Mancone

3:19 PM

Gremlins of course

MechMK1

AD was created to sell more anti-stress medication

Just like how genders were invented by bathroom companies to sell twice as many toilets

Anonymous

This is pissing me off.

Conor Mancone

AD?

MechMK1

Active Directory

Conor Mancone

Ah. I've always avoided that like the plague, like most Microsoft products. I know absolutely nothing about it, and I plan for things to stay that way until I die.

MechMK1

3:30 PM

Same

Conor Mancone

dilbert.com/strip/1995-06-24

MechMK1

> 1995

djsmiley2k - CoW

3:42 PM

just so you're aware, someones on a flagging crusade in here

lol they can burn. BURN.

MechMK1

Everybody is mad at me :D

Looks like I'm about to be banned again

9 Flags and counting

Jesus, somebody got mad

djsmiley2k - CoW

I went and (fairly I say) rejected a few.

haters gonna hate. If they hatin, you winnin.

djsmiley2k - CoW

3:55 PM

@MechMK1 how'd you see o_O

OakSecurity

Anyone knows if it's possible to delete in all subfolders but not root folder called in a "del" command?

Or should I manually add all folders?

I have something like this:

/folder
/folder/folder1
/folder/folder2
/folder/file1.xyz

I need to delete all .xyz of Folder 1 & Folder 2 (in a single command) without touching the one from /folder/*.xyz

Conor Mancone

4:19 PM

rm -Rf /?

I mean...

Anonymous

sudo rm -rf *

Conor Mancone

rm -f ./*/*.xyz

Anonymous

Okay, I am going I apologise for my horrible self.

Anonymous

Buh bye

OakSecurity

No but that'll delete what's the initial folder though

Conor Mancone

4:20 PM

It's okay, it doesn't work anymore

Anonymous

I think it was a joke, Oak..

Anonymous

Like mine...

OakSecurity

say I do rf -rf /folder/*.xyz

Oh

haha (?)

Conor Mancone

The first one was, the second one wasn't

OakSecurity

Oh yeah

Conor Mancone

4:21 PM

./*/*.xyz should work

OakSecurity

@ConorMancone Windows can catch that?

Conor Mancone

Oh, windows? I have no idea. Linux will though

OakSecurity

Lemme try

Conor Mancone

with ./*/*.xyz the first * requires it to be in a subdirectory, so it won't delete anything in the current directory

however, it also won't recurse into directories, even with the -r flag. It will only delete *.xyz in subdirectories of the current directory (I think)

@MechMK1 yeah, I starred one of your messages this morning and it isn't in the list anymore, so sad

Although your "password" is still in the list, despite a high density of curse words... :shrug:

OakSecurity

Windows can't do "del (attrib) \ * \ *.xyz"

or with full path

<:(

MechMK1

4:44 PM

@ConorMancone Let's be honest, the problem here wasn't the amount of swear words. The problem was the mindset that I'm not responsible if people feel offended

2

And I guarantee you if schroeder or any other regular here would politely ask me to not use as many swear words, I would abide

The problem was that I am of the opinion that people don't have the right to not be offended, and someone clearly got offended by that. Ironic, isn't it?

And you may ask "But why are you writing it again, if it got you suspended?" - and that's a valid hypothetical question. The answer is simply put that I won't let anyone censor me, just because they're too scared of words on a screen.

If my fingers touching my keyboard makes people scared, then by God they should be scared, because the world has so much more horrible things to offer.

OakSecurity

I keep getting this annoying freeze on windows where my active window is selected/deselected and flinches for a second or two.

I thought my running SQL services were the culprit but it's still happening.

Very curious about if it's a malware.

MechMK1

@OakSecurity "Maybe it's malware" should not be the first conclusion you made

OakSecurity

Why

and it wasn't

MechMK1

Because it's unlikely

OakSecurity

How is it unlikely, it looks like the process associated with my current active tab/window is being used for a second or two. Regardless of the window.

Also, when I played around with Remote Admin Tools, some of them caused that.

MechMK1

4:54 PM

It's possible. Perhaps check your network?

OakSecurity

What would you suggest to monitor outbound?

(Also, I'm now realizing it might be IIS, as I'm software tech for a IIS based software)

A. Hersean

@OakSecurity I second MechMK1, don't jump to conclusions, it can only make you overlook other reasons. Look for facts and evidence, not hypothesis. You can use you gut feeling to look first in some direction, as long as you don't overlook the others: so what did your investigations of a virus showed? If it's nothing, it's time to look for something else.

It could be faulty hardware, drivers, services, background processes not registered as services, (buggy) AV, etc.

Maybe there's a way to log focus stealing events.

OakSecurity

5:17 PM

@A.Hersean When I check Task Manager as soon as my active window starts to flicker, I got Windows Explorer taking Very High power usage

which is also suspicious from my experience

(unrelated) Do you guys know if it's possible to use the [30mTEXT HERE[0m function from DOS batch to the output of a del command?

I know you can echo [32mTEXT HERE...

A. Hersean

You can try using "Process Hacker" instead of task manager: it will show you far more information on the processes.

(Even though explorer.exe is a monster with lots of threads and handles, so it can be very hard to find what's causing its behavior.)

MechMK1

@A.Hersean That's a bit like, "Just use Wireshark" (which was the advice I gave before and it was horrible)

OakSecurity

5:34 PM

Well, in all fairness I think it will indeed give me a little bit more insight

MechMK1

5:53 PM

That's a positive thing!

Transcript for