The DMZ - 2019-12-13

« first day (3284 days earlier) ← previous day next day → last day (1586 days later) »

2:36 AM

@J.J You did some Cisco stuff, right?

0

Q: Secure Erase for IOS

The topics about secure erase for IOS on this site is a bit dated. Technology has definitely changed, including the tools used for forensics. Are there any secure erase softwares or techniques that someone could use to prevent any data recovery? Overwriting the data over and over again using the ...

What kind of information does IOS record to persistent storage?

Journeyman Geek

2:55 AM

@forest if memory serves, configurations at the very least. Practically though, you could just yonk the storage and wipe that

no punintended

Yeah that's what I thought. But doesn't it use eMMC? Wiping that would be bad for it.

Journeyman Geek

The ones I've seen have CF cards

That's about as bad.

Though at least you can wipe it then destroy it.

Journeyman Geek

yup

but unlike EMMC its replacable

I don't remember IOS logging locally so its mostly network configs

and you need to explicitly commit them

Yeah stuff like NetFlow is sent over the network.

Though I imagine you'd be able to log locally to external storage if you wanted?

Journeyman Geek

2:58 AM

(its a bit like firewalld)

@forest not covered in CCNA :p

:p

oh wow

I just searched that thing they posted in the question. It's for iPhone.

Journeyman Geek

community.cisco.com/t5/networking-documents/…

Well until he replaces IOS with iOS, I'll continue to assume it's Cisco.

Journeyman Geek

seems to indicate no logging to non volatile memory

"imyfone Umate Pro" lol

Yeah he's talking about freaking iOS.

Journeyman Geek

3:17 AM

I would recommend a steamroller

I prefer a phase transition.

3:48 AM

Would it be appropriate to re-post this on Electrical Engineering?

5

Q: Recovery of EEPROM data after bulk erase operation

Is there any research into the recovery of data stored in an EEPROM after the high-voltage bulk erase (not bytewise or pagewise erase) operation? I'm wondering about typical low-capacity EEPROMs which use Fowler–Nordheim tunneling and which have a dedicated erase pin that's brought to a high volt...

It was asked a few months ago, but I feel like EE.SE would be more knowledgeable.

5 hours later…

8:47 AM

@forest @MechMK1 and others, crypto.SE is asking us to be freer in migrating crypto theory posts to them so we don't split focus. I'm not sure that we have a model that is well-defined enough to make clear decisions, but they're asking for the 2 sites to start working that out. security.meta.stackexchange.com/questions/3326/…

My decision process about migrating is: "Is this about cryptography?" => Migrate

"Is this about how to use cryptography?" => On-topic on Security.SE

@forest Absolutely, it's not like it's just a cross-post

9:01 AM

@Anders Same here

@forest When people talk about IOS, I immediately think of the Operating System of the Nintendo Wii

9:18 AM

I was just playing Hill Climb Racing 2 and got an advertisement for an online casino.

A game that's inarguably child friendly, has advertisments for casinos

9:30 AM

@MechMK1 free play or cash?

I assume cash, let me see

the difference is how many casinos bypass regulations

Looks like cash

whelp, that's a paddlin'

I mean, their website says you need to be 18+ to register, but why on earth this would be advertised to kids is beyond me

9:33 AM

66.media.tumblr.com/34ef62ba61da3eb2145349fe740709a5/…

> Advertising gambling to little kids? That, for sure, is a paddlin'

But even if this was brought up, the developers would be like "We're working together with [advertising partner]. We labelled our audience correctly, it's not our fault"

Then [advertising partner] will be like "We're so sorry that this happened. It looks like this advertisement was accidentally miscategorized. It will not happen again"

2 hours later…

11:56 AM

Gambling is fine for kids if no large amount of money is involved.

@forest I disagree with gambling in general, but that could be because my family is directly affected by gambling addiction

The problem with gambling is when it goes out of control.

Ah. This explains it: meta.stackexchange.com/questions/339664/missing-publicist-badge

Or when it's advertised as a way to make easy money, rather than as a fun game.

If you go to a casino, it should be for fun. You're paying $500 or whatever you set as your budget for the entertainment, and winning, if you win, is just a happy side-effect.

@forest Yes, but that's not how kids perceive it

12:02 PM

It's how I did when I was a kid. But it was never advertised to me from a company.

Kids should be supervised if they're gambling so they don't spend too much money.

Especially if the only thing you see in the ad is a slot machine, spouting out "BIG JACKPOT - WON $1.000.000!!!"

Yeah, that's gross.

I think kids shouldn't gamble at all

@forest If only people who gambled in a healty way gambled, and all the addicts quit, almost all gambling companies would go out of business. Addiction is the business model.

@Anders Yes, major game publishers realized the same

12:03 PM

@Anders That may be true for some of the seedier casinos, but at least the one I worked for made most of its money from regulars who could budget correctly. Then again, that was an online casino and it wasn't that big.

@MechMK1 Why not, if it's done safely without large sums of money?

@forest Because it is inherently risky behaviour, and I doubt that a kid can judge the effects

What's risky about it if nothing of value is put on the line?

I recommend the South Park episode "Freemium gaming isn't free". It cover this topic with perfect clarity.

Because of the effects it has on you later

(You know you are serious when your best source is South Park.)

12:06 PM

Freemium gaming isn't something I think of as gambling.

I'm thinking more of traditional gambling. Blackjack, poker, slots, roulette, etc.

I agree that if all gambling were about something without value, then it would be fine

I have no problem with including casino minigames into games like Fallout: New Vegas (given that it's kinda the theme)

But I consider, for example, lootboxes as gambling, especially if you have to buy themm

Ah, I get what you mean.

That kind of thing I consider to be manipulative, tricking people into gambling.

And then getting them stuck in a cycle where they have to keep paying more.

"Real" gambling, on the other hand, you go into intentionally, knowing that it's gambling.

Yes, absolutely. Because what kids want is that cool ultra-rare knife skin

Yeah that kind of thing I think is unacceptable when money (even indirectly) is involved.

Especially with kids.

I just meant that if some kid wants to play blackjack, they should be allowed to.

@forest Yes, and here I make a distinction: Does a game that is otherwise "normal" include one section that is gambling? Or is an entire game built around gambling

@forest That's completely fine by me. I used to play a bit of poker with friends when I was on holidays. All with valueless chips of course

And again, we have to differentiate games of luck and games of skill

Poker, Blackjack, etc... are all games of skill

12:10 PM

Well, poker at least.

Slot machines, roulette, etc. are games of luck

Blackjack isn't a game of skill unless you card count, and not many casinos appreciate that.

(Though they don't really care if you do it alone)

@forest You can still do that. And you can weigh your odds of the bank beating you versus you going bust

I mean, you've got a Jack and a 5. the bank has an open 8 and 2 hidden cards. You take another one?

That's not much skill.

I think I get what you mean though. It's not 100% random where an idiot and an expert are the same.

Exactly

12:13 PM

But even the best card counter can only get around a 0.3% advantage over the house.

So if kids want to play games of skill against each other, sure, I'm 100 % fine with that

Which is really nothing unless you come with a large team.

@forest I don't go to casinos, and I would describe myself as a sub-par poker player

@MechMK1 If they know that it's gambling and entered willingly.

But a bait and switch into gambling is horribly unethical.

@forest Yeah, I mean when I was on holidays and people asked "Hey, we're playing poker. You want to join?" and offered me a few chips, I knew what I was about to play

12:14 PM

@MechMK1 I'm a terrible poker player too (except video poker, but that's a scam). I prefer blackjack.

What I heavily disagree with is games of luck being added into videogames

yeah

I mean, if it's like Super Mario 64 for nintendo DS, where they had a poker minigame...fine by me, you know?

I also had no problem with the slot machines in pokemon yellow

Or the older Pokemon games with sl- beat me to it.

:D

12:15 PM

It's a shame it was removed in gen... IV and up?

Yes, in the re-releases

I know gen III had gambling.

Really? Because gen3 was the gen 1 re-release

Of course, it's not really gambling when you know that the poke roulette is in your favor. :P

Yes, and if you look at the impact it has on the game, it's nothing

12:17 PM

Gen III included Ruby/Sapphire/Emerald, not just Leaf Green et al.

You can get I think one pokemon and some TMs, that's it

It's not like gambling was deeply intervoven into the game design

TMs, vitamins, plush dolls. I mean, they get you money if you sell them, but not a whole lot.

Money was never really a concern in those games though

You got quite a lot through regular play

Yeah. I maxed out on money so often that I have to buy vitamins and other high-value items when they're half off and keep them in my inventory. :D

Which also highlights proportionality: How much does a game push you towards gambling?

12:19 PM

Very little. It's just one little building in one town, and it's entirely optional.

Do you have to play slot machines every 5 minutes? Or is it a one-off minigame?

Take New Vegas for example: There is one casino in Freeside, and 4 casinos in New Vegas. I think there might be some others too, but these are the ones that come to me

And all you could get was some money - and at that stage of the game, you ususally has so much money you just did it for the fun of it

But those aren't bait and switch, unlike freemium games.

Yes, absolutely. I mean "Vegas" was literally in the title of the game

It's a game that centers around Las Vegas, how could it not contain gambling?

And furthermore, New Vegas was not centered around kids

I don't let my kid play games where money is ever involved for this very reason.

Man, the days where a game was a one-off purchase are gone

12:23 PM

This is why I pirate everything. :P

You know what would be funny? Making a game for kids and putting in some lottery system, where you can spend some minuscule amount of in-game money on a lottery ticket, and you would just never win

@forest As for piracy, let me find a quick comic I'm sure you'd enjoy

Kids need to be taught fiscal responsibility.

Before they're indoctrinated by consumerist advertisements and other fallout from rampant capitalism.

I can see that with my girlfriend

Her parents never gave her any pocket money, and when she began working, they took everything she earned away from her

wow

"to make up for the costs she made over time"

12:26 PM

lol

"What, you thought rent was free in this house? You've got two decades to pay off, buddy!"

stonetoss.com/comic/rated-arrr

hah

No literally. That was their argument: "Do you have any idea how much your food and diapers costed when you were a baby?"

O_o

Imagine how greedy you need to be to steal from your own daughter, as soon as she earns any money herself

12:27 PM

Good way to find yourself without someone to take care of you when you're going to a nursing home. It's an investment. If raising a kid is a chore, you shouldn't have kids.

Yes, that's basically what is happening

"But dear, you have to help me."

I mean, I get it if you're living paycheck to paycheck and you really, truly need money.

But that just sounds like greed to me.

I have a meme for that, just a second :D

"But dear, you have to help me! I'm your mother! It's your obligation!"

user image

kek

The völkisch Chad meme is my favourite meme this month

12:33 PM

I've been too busy this month for most memes.

I've been quite busy too, but I always find some minutes to meme

Because let's be honest, there is no better propaganda than memes

meme warfare

Quite literally yes

MSM: Political Correctness up the arse
Memes: `when you kill ***s lmao bottom text`

I miss when MSM had real investigative journalism.

Back when the word "journalism" didn't leave a bad taste in my mouth.

I don't know who said that, but I recall someone saying "It's journalism when someone gets offended by it. Everything else is just PR"

12:41 PM

That's good.

It's pretty much true

Man, let me quickly find that one clip

I can't watch videos.

Aww, too bad

It was about local news stations, about a hundred, which all copy-pasted the same text

How they all fight "fake news" and "misinformation campaigns"

wow

I hate all the "fake news" complaints.

Cries of lügenpresse.

99% of the time, what is meant by "fake news" is "opposing political views".

"You see, our world view is obviously correct, so anything that opposes it must therefore be fake"

@forest :^)

12:48 PM

hue

I'm of the opinion that all news is fake news, regardless of party.

give me a second to find it

Fox News is just as biased as CNN. Brietbart has as big an agenda as Huffington Post.

Both sides of the same coin

And yet liberals say that Fox News is all lies, and conservatives say CNN is all lies.

twitter.com/SteveFranssen/status/980225137403314176

Just have a look at that clip if you can

@forest Both are correct. MSM is all lies.

12:51 PM

But the implication that the side they believe in tells the truth is where the problem is.

The problem is the idea that there are two sides, and only two sides

What happens if those two sides are both against you?

twitter.com/AIPAC/status/1187721114983849990

I love this tweet so damn much. Just because of who made it, and what it says.

Heh, nearly all the comments on that Tweet are against them.

I wonder why

> This Tweet is from an account that no longer exists.

0

A: Please don't refer to 2019 as 'a great year'

Winter Bash was always supposed to Lighten up the mood and bring tarffic in holiday period.

But is it good tarffic or bad tarffic?

^- "Would you please stop complaining about Stack Exchange, Inc.? I'm getting tired of it and I would rather not think about what is happening"

Someone really predicted everything that is happening accurately: SE, Inc. is literally just trying to wait it out

People would get tired of hearing about SE, Inc. and would instead lash out at the people complaining

It works.

Every.
Single.
Time.

1:04 PM

Sure, but more and more people are learning about this event.

(And everything related to this horrible welcoming initiative)

The welcome wagon was a shitshow

the pronoun wagon was a shitshow too

And the funniest thing is that the pronoun wagon hurt the people it was supposed to help the most

0

A: Please don't refer to 2019 as 'a great year'

Hello how are you doing today my name is jung from china I have something important to tell you Please get back to me in my emailbox I have some business to do with you please contact me in my email Your message will be highly appreciated [haeinjung101@gmail.com]

The spam is amazing :D

The name "john john" is even better

The name's John.
John John.

I kind of want to email him...

See if I can string him along.

Same here

The problem is, it's incredibly hard to pretend to be gullible while wasting time

Just a well-written response will usually get ignored

I dunno, I've scammed scammers before.

Something more akin to "Hello, I saw the message you wrote on Stackexchange. You said you had some business to do with me? What kind of business?"?

@forest I once set up an e-mail address for that purpose, but I never really had the time to do it

1:13 PM

I often use my main email just because these kinds of spammers generally aren't from lists.

"Hello i am doing well today my name is jack from usa I want to hear your important thing you want to tell me Please get back to me in my emailbox I want some business to do with you please respond me in my email Your message will be highly appreciated"

What I don't get is why so many people think scammers are idiots

Most of them are not

These scammers are.

All the scammers that I've talked to who have gmail accounts are.

probably the more sophisticated ones are not

2:12 PM

lol, this probably won't be new to most of the people here but it was new to me. Someone posted this link in an answer:

github.com/…

2

I had no idea you could search github like that...

@ConorMancone Oh good lord! That is equally hillarious and terrifying.

Winner!

	defined('DB_SERVER') ? null : define("DB_SERVER", "localhost");
	defined('DB_USER')   ? null : define("DB_USER", "root");
	defined('DB_PASS')   ? null : define("DB_PASS", "p@55w0rd");
	defined('DB_NAME')   ? null : define("DB_NAME", "mfi-prod");

Never in a thousand years would I have guessed that someone might use password for their password but replace some letters with numbers and/or special characters. If only they hadn't posted that on github, no one ever would have guessed it in a million years!

Might just as well put it up on GitHub at that stage.

Yup, suppose so!

@ConorMancone Jesus...

That's not very dev ops of them :D

2:17 PM

Ouch, this one is really the winner...

defined('DB_PASS') ? null : define("DB_PASS", "UJWT9G3Q8LZQTENDL97MAM1ZI");
defined('SALT') ? null : define("SALT", "c2060e1bFXXDf063bdc7IU0GIb");
//defined('DB_USER') ? null : define("DB_USER", "root");
//defined('DB_PASS') ? null : define("DB_PASS", "root");
$adminTitle = "KU Quiz - 2016 - Kingston University London";

Also includes the salt (presumably) used for their passwords, and you can tell exactly where it was used...

Anyway, I really have to get back to work now - busy day

Question number one on the Quiz: What is our root password?

lol, so painful...

Man, I feel bad for them

:suddenly wonders if they have a bug bounty program:

(doesn't actually have time though so anyone else is welcome to run with that thought if they want)

Too busy, sadly

Protip: If you ever struggle to imagine how someone could not know something about InfoSec, or struggle with basic concepts, read something about a field you have absolutely no knowledge in.

3

A: "recommended that CLK begin toggling within 150 ms ... to ensure long-term reliability of the device" -- why?

If tristate bus contention can occur, the shoot thru energy temperature rise would be of the same amount of time. It seems the power on reset is not enough.

> tristate bus contention

> shoot thru energy temperature

8 hours later…

10:51 PM

This Video Is Sponsored By ███ VPN

:D

« first day (3284 days earlier) ← previous day next day → last day (1586 days later) »

Transcript for

Dec '1913

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile