The DMZ

Anonymous

8:11 AM

Thanks.

Anonymous

I've contacted the vendor, fairly trivial bugs but.

Anonymous

A CVE is a CVE!

Anonymous

8:55 AM

Vendor just asked me what tools I used to find the bugs, I was like "my brain..." :D

Journeyman Geek

9:46 AM

"I could tell you but then I would need to wipe your memory, and then kill you"

Anonymous

I hope I get a CVE out of this.

Anonymous

This product is really terrible.

Anonymous

I get the feeling that they won't want any kind of public disclosure.

Anonymous

Although I will say, I am not entirely sure how I go about getting a CVE, hopefully the vendor can help me with that.

MechMK1

10:15 AM

@J.J This reminds me of a meme

$user image$

I wonder what the most elaborate proof possible is in this case.

@ConorMancone PHP being PHP again, eh?

Also of interest:

5

Q: How to help people who may suffer from Paranoia?

I am a very active member of the Information Security Stack Exchange site. Every now and then, I come across people who I believe may suffer from paranoia. They believe that "someone" is out to get them, and use techno-babble to make themselves sound legitimate. Here is an example post: How t...

abnormal-psychology

25

Q: Why do Germans dislike Trump so much and consider him so dangerous?

From Pew surveys, Trump seems quite unpopular in (continental) Europe; in 2019 he seems to poll lowest in Germany even among that group: Also, a more recent (dpa) poll focused on Germans' opinions: Germans were asked who was more dangerous: North Korea's leader Kim Jong Un, Chinese Preside...

united-states donald-trump germany polling

You know what upsets me? That every time Trump is mentioned, you keep hearing "He's literally like Hitler", which is demonstrably untrue.

And I don't even like Trump. He's absolutely incompetent and the least trustworthy politician I have ever seen.

But this Trump-bashing is such a pointless circlejerk.

"Hey, hey guy! Guys! Hey guys! Orange man bad! BWAHAHAHAHAHAHAHAHAHA!!! DRUUUUUMPFFFF!!!! ORANGE MAN DRUUUUUUUMMMPPPFFFFFFF!"

Is this the state of political discourse in the US?

If people want to criticize Trump over his behavior or policies, that's perfectly reasonable. But please do so over actual policies, not over hypotheticals or just blatant "But he's dangerous!"

I recall when he got elected and people were like "He's a fascist! He'll put every single one of us into concentration camps!" and years later they are still shouting the exact same thing

For example, in regards to the California Water Crisis, Trump criticized California State Officials of denying California farmers access to water, in order "to protect a certain kind of three-inch fish".

Saying "I oppose Trump's position on this topic, because it shows ignorance towards environmental topics and a general lack of understanding of environmental protection" is different than "Orange Man BAAAAAAD!!!!"

And you know what, Trump is an idiot, but he also did some good things. Like for example, he had a big influence on the peace discussions between North and South Korea, according to both Moon Jae-in and Kim Jong-un

You can't tell me that this isn't a positive thing

Conor Mancone

10:52 AM

@MechMK1 I'm blaming this one on CentOS. I need libcurl to have HTTP2 support and had no problem when managing the server directly. However, I'm moving everything to kubernetes. The base dockerfile I picked for PHP was built on CentOS and I was having a terrible time getting the dependencies properly installed

I switched to the official PHP docker file and it turns out it came with HTTP2 support built in to libcurl, so now I'm wondering why I didn't just do that in the first place (it's also debian based so I'm having much less trouble setting the rest up)

@MechMK1 That is literally the state of political discourse in the US

MechMK1

@ConorMancone I don't have any experience with CentOS, so I'll just say you're right and CentOS is shit

Conor Mancone

I've said this before and I'll say this again, because I think it summarizes the state of political discourse in the US: in the presidential debates last time they literally argued about who had the biggest penis

MechMK1

@ConorMancone This is so sad. Alexa, play Despacito

Conor Mancone

/game over

MechMK1

@ConorMancone That at least explains why Hillary didn't win.

Conor Mancone

10:54 AM

It's all downhill from here

@MechMK1 What are you talking about? She has a bigger penis than all the other candidates

My favorite quote ever (although not actually said by Betty White)

goodreads.com/quotes/…

MechMK1

@ConorMancone It's true though

Reminds me of some Cyanide and Happiness comic

Let me find it

Conor Mancone

So ever since I switched to Ubuntu 18 I noticed something new. To login as the mysql root user I have to actually be logged in as a root account on the machine itself. What's up with that? I was super confused the first time I discovered this and basically only logged in by accident (because I figured I had forgotten the password and logged in as root to reset the mysql root password)

I realize that's a terribly broad question, but that's why I'm here and not asking on the main site :p

Journeyman Geek

@ConorMancone hm

I have a theory but let me check

mysql     2260  0.1  1.5 1445912 249252 ?      Ssl  Feb18  12:06 /usr/sbin/mysq d
geek     32386  0.0  0.0  12940   892 pts/0    S+   11:07   0:00 grep --color=auto mysql

ERROR 1045 (28000): Access denied for user 'geek'@'localhost' (using password: NO)

hmm

Conor Mancone

I have a suspicion too...

select User,plugin from user;
+------------------+-----------------------+
| User             | plugin                |
+------------------+-----------------------+
| root             | auth_socket           |
| mysql.session    | mysql_native_password |
| mysql.sys        | mysql_native_password |
| debian-sys-maint | mysql_native_password |
| mygrations       | mysql_native_password |
+------------------+-----------------------+

I'm guessing this is a result of the auth_socket plugin and that the setup process changed in ubuntu 18

Journeyman Geek

11:10 AM

erf

I am brainfarting over switching to mysql

Conor Mancone

Oh wait, I think ubuntu 18 was the first time I didn't get prompted for a root password during installation. I wonder if it creates the root user with the auth_socket now instead of asking for a password and I just didn't notice

Journeyman Geek

I was going to say user permissions

hm

stackoverflow.com/questions/50112414/… hmm

that confirms it

MechMK1

"mygrations"?

Conor Mancone

Oh yeah, that's it. The auth_socket plugin restricts you to having a matching username, does not require a password, and also implicitly disallows remote login

MechMK1

Shouldn't that be spelled "migrations"?

Or is the "my" because "MySQL"?

Journeyman Geek

11:13 AM

._.

Conor Mancone

@MechMK1 That was me playing around with my python migrations project. The "my" is because in python: s/^(.)i/\1y/

MechMK1

Ah, I get it

Conor Mancone

Although works for Mysql too...

MechMK1

Damn I like your RegEx now

It's written so well

MechMK1

11:38 AM

3

A: index.html integrity

Is it possible? Yes, in theory, it is possible to define a checksum for the index page of a website. If browser vendors wanted to support such a thing, it could definitely be done. Similar mechanisms for SRI and CSP already exist. However... It doesn't make any sense. /index.html pages used to...

Man, I feel bad for this guy

Super dumb question: How would an adult take a certified IQ test these days?

Something like the WAIS-IV or such

Conor Mancone

1:17 PM

@MechMK1 Why do you feel bad for him?

MechMK1

@ConorMancone Because he is so convinced of his idea

But it's just not a good idea

Conor Mancone

You just described all of human history :)

I responded to your comment on my answer, but I'm bringing it here because I'm now super confused

You can buy amazon gift cards on ebay but they cost more than the face value

How in the world does that make sense? Who buys those and why?

MechMK1

@ConorMancone That is a good question. I honestly don't know

But the scam is as follows:

I scam you and say you need to pay X amount of money in gift cards

And the gift cards are often stuff like paysafe cards, amazon gift cards, paypal gift cards, and quite surprizingly, steam gift cards

So if I am the scammer and I am a real epic gamer, then 50€ of Steam Gift cards are just as valuable to me as 50€ cash

As for why they are more expensive than face value, that's a good question

I suppose it could have to do with foreign currency?

Conor Mancone

@MechMK1 Oh yeah, I suppose all those things are useful in-and-of themselves. I had the idea stuck in my head that the end-goal was cash, and not for direct use.

MechMK1

I mean, you could turn it into cash, but then ask yourself, what do you do with that cash?

You buy stuff

And if the stuff you buy is on amazon, then a gift-card is actually more anonymous than cash

Conor Mancone

1:32 PM

@MechMK1 I'm amused that it never even occurred to me that someone might be perfectly happy just using the gift cards and not converting them to cash/bank account

MechMK1

@ConorMancone That's why I said if my goal is to buy stuff, 50€ gift cards are as good as 50€ cash

Gift cards are just there to be a scam anyways

Conor Mancone

1:46 PM

@MechMK1 (going back in time). Indeed, it amuses me that the top answer, a top comment on the question, and the top comment on the top answer both basically received lots of upvotes for the "Trump is Hitler" comparison. It's even more hilarious because Trump isn't even right wing.

There was a question that hit the HNQ about whether a picture with Trump was real, because he was playing golf with a bunch of left-wing people

MechMK1

This entire alarmism is bullshit

Conor Mancone

Everyone seems to forget that Trump could have just as easily ran as a left-wing candidate. Historically he's been very bi-partisan and probably even left-leaning

I genuinely don't understand why he decided to run as a Republican

MechMK1

he admitted himself that he considers himself more democrat than republican

Conor Mancone

And yet now he's an ultra-right wing Hitler clone?

This world is so crazy I wouldn't believe it if it wasn't true

MechMK1

To quote him "Economy seems to do better during democractic presidents. It shouldn't be like that, but it seems to be"

@ConorMancone You know why? Because everything is Hitler these days

You disagree with modern neo-liberalism, you're hitler

Conor Mancone

1:49 PM

@MechMK1 You're hitler for saying that.

MechMK1

You want your wife to stay at home and take care of the kids? Hitler

You have the slightest notion of national pride and identity? Hitler

You dislike someone who is part of the LGBT community? Hitler

You prefer your white child to date someone else who is white? Hitler

Conor Mancone

@MechMK1 That also means he's bad at economics. The legislature has more control over the economy than the president, and even then there is a big lag between changes in regulation and changes in the economy. Attributing improvements in the economy to the president in office at the time is a fallacious argument from the get-go.

MechMK1

None of these things, literally none of them, have anything even remotely to do with Hitler

@ConorMancone You don't really expect Trump to care about the truth or validity of any of his statements?

Conor Mancone

@MechMK1 No, but it bugs me because it is a very common political argument over here

MechMK1

@ConorMancone You could either go all in and challenge their beliefs, or you can just let them speak

Are you ready for the problem with all of democracy?

People have such good lives, they don't care at all about politics. Not in the slightest bit.

Conor Mancone

1:52 PM

@MechMK1 Democracy is a terrible idea. I said it and meant it. I'm now Hitler

(I exaggerate slightly, but continue)

MechMK1

@ConorMancone It's not that Democracy is a bad idea. Democracy can work, but it requires large amounts of the population to care

And they just don't

I asked a few people in my neighborhood who they voted for, and why

Conor Mancone

@MechMK1 The term you're looking for there is a "Republic"

MechMK1

Some wouldn't tell me, and that's fine

Conor Mancone

Ironically the US is supposed to be a republic, not a democracy

anyway, not trying to interrupt you

MechMK1

But you wanna know what I got as answers? I voted for that party because: "My dad always voted for that party", "I attended a rally and they seemed like nice people", "They bought me a beer", "That guy is so handsome" and, my personal favourite, "I just like the color of their party"

Conor Mancone

1:55 PM

That's not actually the reasons people gave, right?

MechMK1

It is

Conor Mancone

I actually wouldn't have guess it was that bad. I'm used to people who at least have actual reasons, even if I disagree or think they are bad...

Then again my "sampling" may not be a good representation of most...

MechMK1

"My dad always voted for that party" at least has some sliver of reasoning

Given that if you are part of a working class family, then your parents are probably also working class and vote for a party that supports the working class

But "that guy is so handsome"...i mean, holy fucking shit

You know what, I'd actually want Hitler to come back and start WWIII, just so people would shut the fuck up and stop comparing everything they don't like to Hitler.

Conor Mancone

@MechMK1 Welcome to the long, never ending line of people who shake their first at the world around them while they watch it fall apart at the seams.

I've been in that club for a while. I officially designate you a member

Arise, sir MechMK1!

MechMK1

You know, I had quite a wild ride, politically

I used to be very left-wing, very liberal

Conor Mancone

2:00 PM

Now tell me why php isn't talking in my new Docker image...

@MechMK1 You were born in Europe, comes with the territory

MechMK1

@ConorMancone DNS

Conor Mancone

:p

@MechMK1 That's actually a great answer (although not the case here)

MechMK1

Yeah, I used to be of this opinion that we should let everyone do their thing

Very naive, but I mean what did I know when I was 16? Fucking nothing

Then the refugee crisis started, and our country changed

More and more immigrants were on the street. You could hear reports daily, how immigrants attacked people, raped women, etc...

I thought to myself "That's not right. We need to do something"

But the more these reports came, the more people started to defend immigrants, and called those people demanding action or at least concequences to those involved, racists

A 15 year old kid dropkicked a 60 year old women in the back, after she had told him to clean his room

What punishment did he get? None. In fact, he got special protection so he wouldn't feel "unsafe"

Fire Quacker

@MechMK1 Relevant comic: gocomics.com/nonsequitur/2000/03/26

MechMK1

You would wish that 60 year old had gotten some protection

Then was the famous NYE in germany, where immigrants sexually harassed hundreds of women

What did the media do? They blamed the women

Videos came up of immigrants kicking a woman in the back down the stairs of a subway station for no apparent reason

Public outrage ensured, but nothing happened. No, that's not true. Politics denounced those who were upset as bigoted neo-nazis

It was at this time that I started to become more right-wing

Funny, how this "scare" tactic "speak up and you're right-wing" turned people right-wing

I got more involved with politics, especially with the identitarian movements in Europe

And if I had to label myself, I'd use the term Identitarian

Conor Mancone

2:08 PM

@MechMK1 The wiki article about identiatrians basically calls them rascist, xenophobic, nazis. So... about what you'd expect...

MechMK1

@ConorMancone Do you want to know the principles of the identitarian movement of Austria?

They're "native" and "open to the world"

Conor Mancone

It's funny because the idea that, "People with completely different cultural backgrounds may not fit well into eachother's country" really shouldn't be that controversial, but saying that is the quickest way to get yourself labeled as a racist nazi.

MechMK1

They say "Nativism means for us, that the mountains, forests and lakes of our home are as much a part of us as the ringing of the chuch bells every sunday, the traditional processions with their music and the unique dialects, beautiful clothing and ancient traditions. If we give up our home, then we give up ourselves. It also means for us, that we orient ourselves to the everyday life. We have enough of bold projects and modern ideologies, which brought our home to the edge of ruin.

Conor Mancone

If my entire family just got up and moved to Saudi Arabia it would be a complete disaster. It would be a terrible fit for my family and my neighbors. And that's fine.

MechMK1

we disavow that the "higher ups" make up fantasies like multi-culturalism behind locked doors, which we then have to live out for them"

Conor Mancone

2:13 PM

They are welcome to run their country however they want

MechMK1

@ConorMancone Yes, absolutely.

So, how do you think about the Identitarian take on Nativism?

Conor Mancone

A little bit too over the top :) but very relate-able.

MechMK1

The second big principle is being open to the world: "Just as important for us is being open to the world. We're open towards new ideas and developments and we engage ourselves for Freedom of Expression, Demonstration and the Press as basis of a functioning Democracy. Were everyone is of the exact same opinion, there is mostly being lied, says an old proverb. As such, we deny every form of racism.

We recognize other cultures as different and see the many facets of humanity as valuable in and of itself. We don't want one world culture and no one world state, in which every person thinks and lives the same, but instead the preservation of originality and uniqueness - of individuals, as much as peoples as a whole."

Now, having read this, do you consider that these two ideals are "racist", "xenophobic" or "basically nazis"?

Perhaps "authenticity" is better than "originality".

Conor Mancone

2:30 PM

That one especially is very well put. Of course you can't expect wikipedia to label such a movement as anything other than racist nazis.

MechMK1

Yeah, basically anything that opposes globalist monoculture must be racist

They also demand being able to debate without fear: "It has to stop, that people lose their job or are threatened, just because they express their opinion! We need to be able to debate fearlessly over the future of our home"

Or their views on family: "We Austrians are dying out, because we don't have enough children. We demand more child- and family-friendly politics, so that our people can still exist in the future"

Conor Mancone

@MechMK1 That's both important and ironic. After all the fears of a population explosion, a shrinking population is actually one of the biggest issues that most of the modern world is facing

and it will only get worse in the future

/doing my part

MechMK1

@ConorMancone Yeah, actually true

So I guess, since you didn't already call my employer and demanded me being fired, you're a nazi now

Welcome to the club, my friend

Conor Mancone

lol!

MechMK1

Though, it's not a very exclusive club as you can guess

Conor Mancone

2:43 PM

It's one of the fastest growing clubs in the world!

I'm pretty sure my kubernetes issue is very mundane, but to verify I'm waiting for docker to build my image locally

Then I will test it out locally

and if that works I'll push it up to the kubernetes cluster to see if my changes identify the problem

unfortunately that takes 10 minutes to build/push/update/deploy

That makes debugging this a very slow process...

aka: SLLOOOOWWWWWW day at work

MechMK1

Man, I wish I knew more about Docker to be able to help

Conor Mancone

Works locally!

MechMK1

Like "Yeah, it's actually super easy, barely an inconvenience. All you need to do is call docker with the --fix-all-bugs flag"

Conor Mancone

I don't actually think that docker or kubernetes are the issue

:)

MechMK1

Oh my god, I actually have a report where the customer fixed nothing except an information disclosure about the web server running

Conor Mancone

2:46 PM

I like docker a lot, and I've found kubernetes to be very helpful. The latter though definitely has a crazy learning curve

Docker was pretty straight forward to learn though

Sounds about right

MechMK1

Guys, this was a meme. Not actual security advice!

Conor Mancone

You forgot the other part of the math: that was the easy part to fix. The other ones were too hard

MechMK1

Yeah, I can't discuss what the other vulns are (given that they are still there)

But damn...

The Spy - Congratulations, You're a Failure

►

Conor Mancone

My deployment pipeline ran in exactly the time it took me to get caffeine. My life is now complete

@MechMK1 How about some CVSS scores then? How bad was it?!

MechMK1

@ConorMancone The system has assimilated you successfully

@ConorMancone Sorry, can't give any infos on this

Conor Mancone

2:57 PM

And I have now confirmed that nothing is wrong with Kubernetes at all. Something in the very core of my application is just broken with this new server configuration, and causing it to fail to log its errors and instead hang

Not the best failure mode...

MechMK1

@ConorMancone Time for a MVCE that just logs errors and does nothing

Conor Mancone

@MechMK1 It's because I have the logging system send it off to an external logging service, but for testing I also use the testing server as the external logging service. Therefore when things really break it effectively starts an infinite loop of doom.

I just pointed the error logs elsewhere and now I know exactly what the issue is (I forgot a dependency).

MechMK1

Noice

I mean, not that you forgot that, but that you found it

Conor Mancone

This isn't the first time that I have ran into the issue where my self-referential logs cause problems, but it happens so rarely that I've never gotten around to fixing it

MechMK1

Just write it into an issue tracker and forget about it

Conor Mancone

3:04 PM

@MechMK1 Hilarious because it's true

MechMK1

// TODO: #561830
//
// Logging doesn't function if the application has an error

Fire Quacker

3:23 PM

Am I using the correct terminology at the start of this answer? security.stackexchange.com/a/226473/129883

I'm kind of drawing a blank on what that should be called

(Also, shameless self-promotion :D)

MechMK1

@FireQuacker Seems fine to me

Fire Quacker

Okay, thanks

I'm still annoyed. I've never found an actual XSS in the wild. All I ever seem to find are ways to do silly things with contact forms.

Like, it's injecting something, but it's still just email

MechMK1

@FireQuacker You mean, on some production websites?

Or during a pentest?

Fire Quacker

Well, I was counting this answer :P

But I did find one in a production website and reported it

MechMK1

Well, that's good. I found some XSS too, but it's always a bet

Anonymous

3:58 PM

@MechMK1 I like that meme.

Conor Mancone

8:52 PM

Man, the comments here will probably get cleaned up soon but they are hilarious.

I've haven't seen so much "other-side bashing" in a while

4

Q: Why did Berlin freeze the rent prices as opposed to letting the market set the price?

This EuroNews article tells us about the Berlin freezing of rent prices: Berlin is freezing the rents of 1.5 million apartments for the next five years starting this Sunday in a controversial move to control the exploding costs that have forced many to move outside Germany's capital cit...

economy local-government berlin

Some quotes just because

> Free market fails constantly, regularly and spectacularly. Governments have to correct those failures with interventions, otherwise poor people suffer. Americans appear to believe that poor people are not people and thus not worthy of any help, such sentiment is not common in Europe.

> an additional point is what failure are you punishing. Should people born to poor families, who have been malnourished during their childhood, denied access to healthcare and a higher education, be punished for failing to be born in a rich family with enough money to properly feed them, provide all medical treatment available and pay for college? I think in the US the general opinion is that the answer is yes

> Right-wingers are not known for paying attention to history. (Unless it's the history of a left-wing plan going wrong, in which case they can conveniently generalize it to show that all left-wing plans will go wrong)

> Here is a general rule of thumb for interpreting right-wing comments: whatever the right accuses the left of doing, the right is doing. However, the converse is usually not true.

I'm glad I'm not one of those idiotic, poor-hating, right-wingers. They must all be Nazis

ThoriumBR

I usually say that nobody pays attention to history... so the right does wrong as always, left does wrong as always...

the far-right AND the far-left are equally dangerous... the middle ground is better, even if it usually does not achieve anything, it's better than atrocities achieved by the far sides...

Transcript for