The DMZ

Anthony

00:11

@ConorMancone just recently passed the security certification last month and it was pretty damn hard. Got to really know the architecture well and the shared responsibility model

Conor, would you say the AWS solution architect cert is useful for someone working in cybersecurity? How so?

Tom K.

08:10

sgaxe.com

finally another enclave vuln

MechMK1

09:02

People have the weirdest vulnerability names

In like a decade we'll have vulns like Return of the Ą̛̗̜̳̟͚̽̑̆́̋ͅṉ̺͓ͨ́̊̏̈͛́͞č͓̤͕̼̮̞̲ͤ́͠ĩ̫̰̠̘̂̅͗̍̀̚e̮͍̖̖͊̏͜n̢̻͓͚̘͔̝̟̼̈͐ͭ̈́̓̔ṱ̵͎ͨͨͥ͛̓͟͞ ̸̪̞̪̇̆̀ͩ̚͞Ȯ̸͕͉̖̭̝̣̀ͬ̌͌ͮ̄̕n̶̲̙̣̘̺̪̹̍̃ͭé̱̞̃

When I watched the Mona Lisa image, I was like "No fucking way"

CPUs are royally fucked, aren't they?

Conor Mancone

09:21

@Anthony It just depends on your role. If you are a penetration tester or red teamer: no, it won't be very useful at all. If you're more in the DevSecOps side of things then it will be quite useful, since your job (presumably) has a lot of focus on architecture and securing cloud resources

@MechMK1 Wouldn't surprise me. To be clear, I'm making this up as I go along but it sounds good: CPUs are like the ultimate "internal" website. The manufacturers have been assuming for decades that no one would ever poke around inside them, but now it turns out that everyone wants to and they are figuring out that, this entire time, the manufacturers have been making it up as they go along :)

MechMK1

09:33

Well, everybody assumed that on your CPU, only your code would run. Until the cloud became a thing

Tom K.

09:43

@MechMK1 I think it's widely understood, that CPU vulns will be published on and on for years

MechMK1

It makes me wonder if the way CPUs are designed in general (speculative execution, etc.) are just insecure, and if there needs to be a massive change in CPU design

Or if we're in a "generally secure pattern" and just need to iron out the kinks

Tom K.

therefore security of data that is processed within an application that is running on shared ressources has to be achieved through other controls than those given to users by CPU manufacturers

Conor Mancone

@MechMK1 Based on all the vulnerabilities it doesn't sound like that's the case. I'd vote for "needs massive change in CPU design". Then again I'm not even remotely an expert in this area, and I haven't paid too much attention to this class of vulnerabilities either.

Tom K.

both statements are correct

everyday users and SaaS providers won't have to care about these kind of vulnerabilities, that's why things are "generally secure"

but in the long run, processor architecture and instruction sets will have to change, so that even applications that process high value data can use shared ressources

John Zhau

A professor told us we have to implement complex search & sort algorithms on complex data structures like trees in C++ by hand on paper for our next exam.

Each algorithm is >50 lines of C++

all written by hand on paper

If that's not a "FUCK YOU" I don't know what is...

Tom K.

09:55

oof... writing code on paper..

MechMK1

10:16

Whenever I had to write code on paper, it was always pseudo code

reed

@JohnZhau, anybody ask him the purpose of that task? It's definitely going to be more difficult for him to check as well. Does he want you to avoid being helped by any IDEs?

MechMK1

@reed Some professors also like to intimidate students prior to the exam, so they study like madmen. The actual exam will be easier

Possibly

MechMK1

11:08

I can highly recommend this burp extension: portswigger.net/bappstore/d938ed20acbe4cd9889aa06bd23ba7e1

MechMK1

12:34

I wonder...aren't all the people protesting right now, peacefully or not, exposing themselves to COVID-19?

Conor Mancone

@MechMK1 You're not the only person wondering that...

reed

probably. But at the moment nobody knows how covid infections really work... Everyday there's a new study that contradicts an old study, about how covid can spread

MechMK1

I find that highly strange. Two married people sit on a bench in a public park, and they get fined for violating COVID-19 safety guidelines. Hundreds of people stand infront of a Police station to protest against the police, and that is perfectly fine

reed

In my country it looks like it's disappearing, despite the fact a lot of people are now gathering together, bars and restaurants are now open, etc.

MechMK1

Same here. We have a 93.5% recovery rate, and a 3.9% fatality rate

Out of 8.8 million people, only 17.000 were infected

That's 0.0002%

Our politicians talked about one COVID-19 death per family "on average"

reed

12:48

But how do you know how many people have actually been infected? The number of infected people you see in the news is actually the number of tested people who were infected. In my country, they are starting to test people at random to be able to get a statistically reasonable estimate

MechMK1

Hold up, my math was wrong

Actual infection rate is 1.9%

And lethality is 0.008%

So if one were to assume actually 10 times as many people were infected, we'd be at roughly 20% of the population, which I think is doubtful

For the past weeks, I've seen more and more people outside, in restaurants, etc...

And we don't see a "second wave" yet

ThoriumBR

13:15

@MechMK1 if by "family" they consider everyone sharing the same surname, they are correct.

Conor Mancone

@reed If someone showed up at my door and wanted to test me for Covid, they would have to extract the blood sample using "involuntary" means.

MechMK1

@ThoriumBR Not too difficult since like 50% of people are called Gruber

@ConorMancone I would tend to agree. If someone offered a random COVID-19 test, I would politely decline. If someone were to demand a random COVID-19 test...oh boy, this is not going to end well

Conor Mancone

This is one of those cases where "over my dead body" may be more literal than figurative...

reed

if I'm not mistaken, the latest news here say that only 25% of people that were called for the statistical tests, refused

no wait, only 25% agreed

I think I would accept. I'm pretty sure I haven't caught the virus, but I'd be curious anyway. Why wouldn't you guys want to participate in the survey? I'm curious

ThoriumBR

I am sure I didn't catch it either... I am on home office since before the outbreak here. I spent 3 days working on a client, but it was me and a datacenter full of computers and I was the only human on the whole room... me and a dozen support personal on the entire building

my kids are always at home, classes suspended, and my wife works full time at home

but I would do the survey... why not?

Conor Mancone

13:49

You guys are apparently much more trusting of your government than I am. Although, let's frame it a different way and look at this from the principle of least privileges. Why should the government know whether or not I ever had the disease? It's one thing to find out for myself. It's another thing for someone else to find out for me.

ThoriumBR

it's more a statistical thing... I worked on the census 2 decades ago, and some people complained that the full detailed question booklet weren't asked to them, as they had a disability, a special case, or something like that. we explained that we were using statistical analysis to come up with data.

so if the government tests 5% of the population, and half are infected, they can extrapolate to the rest of the population, and lockdown a neighborhood and not the entire city, for example

I don't trust my government that much, but in this case is a public interest. If on my city the infection rate is climbing, the government must know to move resources here before all the cases explode and the hospitals are overrun... on the other hand, if the rates are falling fast, they can move resources away.

MechMK1

I doubt that many government these days genuinely care about the population, or if they ever actually did

ThoriumBR

off course they don't, but if you think that dead people don't vote and don't pay taxes, and sick people wastes money, it makes sense...

for them, we are all sheep... sick and dead sheep does not give profit

MechMK1

But neither do they vote for your political opponents. One could even argue that an outbreak in areas predominantly voting for the political opposition would be beneficial

Do I believe politicians would systematically let people die if it would improve their chances of being voted into office again? Of course I do.

ThoriumBR

but when people are alive, they pay taxes.

@MechMK1 sure! they want the votes no matter what... but I seriously doubt people would vote for anyone that let people die on purpose.

MechMK1

13:59

And when they are dead, they don't cost anything to maintain

of course, you wouldn't just let them die. You'd find other excuses why you do the thing that you do, excuses that sound good

ThoriumBR

@MechMK1 alive people bring profit all the time they are alive. dead people only when they buy the coffin and the grave...

MechMK1

Yes, but that's not what I meant. Certain groups cost quite a lot, such as the chronically ill, chain smokers, etc...

Or at least, they would, if the US government would care about healthcare

ThoriumBR

alive people pay taxes on rent, or on property. on food, on power, on internet access, on all government forms, on education, on medicine, porn, whatever... no people, no money

@MechMK1 the US is an aberration. I have some friends there, and the prices on everything are outrageous... medicine that here costs USD 4 costs a thousand there. price hike of 1000% on some medicine are common... WTH?

here the government broke the patents of medicine that the lab increased the price way too much, and did it systematically and prices went down. we still pay heavy taxes on medicine, and are one of a few places were medicine is heavily taxed, but you can usually pay for it. in the US an ultrasonic testing costs half a month's wages

here costs 5% of a month's wages or less

MechMK1

Here in austria we have a regulation that if medication costs more than 2% of your yearly income, you get the difference from the government

And the government also ensures that medication for such patients (e.g. the elderly) are not artificially made more expensive

reed

14:20

The reason why it's important to have those statistics is that then we can understand the role of asymptomatic infected people. If it turns out only 1% of the population has been infected, then the risk is potentially still very high (all this chaos for 1% of the people). But if it turns out 20% of the people have actually been infected, then the coronavirus is much less dangerous than it has been depicted

ThoriumBR

here some medication (high blood pressure, diabetes, and some others) are free. public health services covers most of the issues, covers emergency care, but a routine check must be scheduled half a year away, if you get phisycally in the queue very early in the morning

a couple years ago I went to schedule a checkup for my mom, I got in the queue 3AM, and I was the second to last to be granted one, 3 months from them... I saw people getting there 3:30AM and getting home with nothing. sad thing is that you only know if you got accepted 9AM when they opened.

MechMK1

The vast majority of medication here actually only costs a flat amount, the rest is paid for by the healthcare. Only if you need something very specific or such you need to pay privately (or if the medication is cheaper to buy privately than the flat sum would be)

ThoriumBR

14:36

here my younger boy have an allergy, the milk he needs to drink costs A LOT, and it's all from my pocket. we would take 12 cans per month, the government "all I can do is 3... for 45 days. take it or leave it"

4 cans costs a month's minimal wages... thank God I makemore than the minimal

Tom K.

@MechMK1 It seems like some governments do care about their people (thinking)

ThoriumBR

later I convinced the doctor, the nutritionist, the secretary of the department... and they gave me more...

MechMK1

@TomK. The austrian government definitely cares more than the US government

Tom K.

well... the incumbent definitely doesn't care and will never care

Conor Mancone

@TomK. Is that a Trump reference? Normally that would be my guess, but everyone is in different countries (and I know you guys are "neighbors") so I can't tell if I'm just missing something...

ThoriumBR

14:42

lobby should be illegal... pressure from corporations changes everything. no matter what 200 million people want, a fat corporate check changes everything

Tom K.

yeah, talking about your incumbent

MechMK1

@ThoriumBR I 100% agree

Tom K.

@ThoriumBR this indeed sounds horrible :(

Conor Mancone

I don't disagree. Unfortunately the issue is more institutional than that. His opponent in the last election cared equally little. Both candidates cared about nothing but their own personal advancement

ThoriumBR

government should care about us, not the corporations... but we don't live in that land

I like the Icelandic system... when the government wanted to bailout the banks, people gathered together, let the banks fail, and replaced the government

Tom K.

14:44

@ConorMancone Agreed on the institutional matter. The whole system in the US is just fucked up (electoral college, gerrymandering, the whole senate setup), and sure, Clinton wasn't Obama, but she was still vilified to an extreme extent that wasn't justified

Conor Mancone

@ThoriumBR The trouble comes from two issues: human nature and centralization of power. As long as the government is in a position where it can "move" billions of dollars in any given direction, there will be people that take advantage of that fact for their own benefit. Whether it is corporations that benefit, or a small group of powerful people, or the government in general: as long as there is a strong concentration of power, then someone will take advantage of that to the hurt of others

ThoriumBR

but you can do that on a small country... with 250M people in a country the size of a continent, not much...

MechMK1

>that wasn't justified
>not justified

Excuse me while I recover from laughing wholeheartedly

Tom K.

@ConorMancone France has a rather centralized system and is faring pretty well. I think it's not that binary.

Conor Mancone

@TomK. It's my own fault for bringing this up, but I strongly disagree. The US is much better off with the Clinton's gone. Bill was a serial sexual harasser and (almost certainly) a rapist. His wife didn't just stand by him but actively destroyed the lives and reputations of her husbands' victims in an attempt to protect their own power

Tom K.

14:47

@ConorMancone Bill Clinton is a horrible man, agreed.

Conor Mancone

Hillary was almost as bad for women as Trump is. The two candidates were, for all intents and purposes, identical. The only difference was who they wanted to use their position to benefit

ThoriumBR

the US system is really difficult to understand. I mean, I can understand but makes no sense. almost half the country will vote Democrats no matter the candidate, the other almost half will vote Republican no matter what... and a few people change everything... you vote for the party not the person. you lose by one vote, or lose by thousands, and that's the same...

Tom K.

yeah, the system is just bonkers

Conor Mancone

But anyway, I'm going to get all riled up, when I really have some work I need to finish. I think I'm getting into a habit of stirring up trouble and then leaving. I'm not actually doing it on purpose, I promise :) My new job is just much busier than my old...

MechMK1

@TomK. What is required for a healthcare system to work is for the general public to buy into the idea that they pay for other people, and that therefore, other people pay for them. That makes their "personal choice" no longer their personal choice. Healthy lifestyle is no longer a "choice", but a requirement in the public interest

@ConorMancone No worries, you learned that from me

Tom K.

14:49

But comparing HRC to Trump is just not fair in any shape or form

ThoriumBR

and you move districts around to put everyone that would vote against you together in a way that the other party loses by a few votes on 10 places and wins a landslide on 9, and you win...

Tom K.

well.. comparing sure, but saying they are the same

MechMK1

@TomK. You're right, I think Hillary is actually worse. Trump is an incompetent retard, and Hillary is competent and very, very, VERY evil

Tom K.

could you refrain from using "retard" as an insult? that would be great

Fire Quacker

@ThoriumBR Well, to be fair, it's nowhere close to the whole country voting... So 1/4 votes Democrat no matter what and 1/4 votes Republican no matter what and the rest don't vote.

MechMK1

14:51

Substitute whichever word you think fits best, both you and I know exactly what I mean

Tom K.

That's not the point.

ThoriumBR

it's the "Sofia's Choice"... any choice is bad on a different way... either way you get hurt

Tom K.

And... why exactly is Hillary "very, very, VERY evil"?

MechMK1

To quote Connor:
> His wife didn't just stand by him but actively destroyed the lives and reputations of her husbands' victims in an attempt to protect their own power

I think systematically destroying the lives and reputations of your husband's rape victims is considered an evil act

Anyways, I have to go as well. It's 17 in a bit and I still have to buy groceries

Take care, and have a nice evening!

Tom K.

Trump is alleged of sexual assault two dozen times. There are multiple stories of him having stories buried together with his rich friends.

So... this is Trump himself.. and not Trump's wife.

MechMK1

14:54

@TomK. Shocking, it's almost as if both candidates in this political race were the shitstains of humanity

ThoriumBR

as I said, neither one is good... both are evil in different ways... and half the country will be sad anyway.

Tom K.

What is worse, murdering someone with a gun, or buying the gun for that person?

Conor Mancone

Nothing in this is very controversial, but frames the discussion.

theatlantic.com/politics/archive/2017/11/what-hillary-knew/…

Tom K.

You said HRC is worse than Trump. Show me some evidence..

ThoriumBR

I use to say that politics are like soccer fans: your team is always the best, the other teams cheated, and no matter what you think, the team does not care about you.

MechMK1

14:56

@TomK. I'll come back to that on friday. As I said, I have to go home

Tom K.

Sure...

Conor Mancone

@TomK. Obviously doing the murder, but let me rephrase that for you: which is worse, murdering someone or helping cover up the murder? Sure, the former is worse, but both will land you in jail for a long time and both are terrible. Did Hillary sexually harass people? No. Did she destroy the lives of women her husband sexually harassed? Does that make her as bad as Donald Trump? Maybe note quite, but the difference is negligible in my book.

Fire Quacker

Football War

The Football War (Spanish: La guerra del fútbol; colloquial: Soccer War or the Hundred Hours' War also known as 100 Hour War) was a brief war fought between El Salvador and Honduras in 1969. Existing tensions between the two countries coincided with rioting during a 1970 FIFA World Cup qualifier. The war began on 14 July 1969, when the Salvadoran military launched an attack against Honduras. The Organization of American States (OAS) negotiated a cease-fire on the night of 18 July (hence "100 Hour War"), which took full effect on 20 July. Salvadoran troops were withdrawn in early August. =...

Tom K.

Psssh... do you know what destroys a life? Getting raped.

I'm not saying she's great or that she's the best or whatever

I'm just saying, there were two options and she was clearly the better option.

Now the US is living in this new normal where every day there's a new low. But this just would not exist. There would be real "first world problems" to care about with HRC and not this kind of BS that you are experiencing now

Do you honestly think, that HRC would've let her AG clear peaceful protesters to do a photo-op?

Not in a million years.. but with Trump. Yeah, of course, because that's how fucked up things are right now

It's like with the frog in boiling water. Everything changed relatively slowly (and not even that slowly) and now it's become indistinguishable from the past.

reed

17:34

This guy asked about an XSS challenge: security.stackexchange.com/questions/233059/xss-on-script-src , and he was told it's a "very easy" CTF. I took a look at it, and it doesn't look "very easy" to me, although of course I'm a noob and I don't have enough experience with exploiting stuff (or even JS or PHP). But since I spent some time on it, now I'm curious.

reed

17:48

I'm not trying to compete in the challenge, I'm just curious. The code is very short (both JS and PHP). It would be very easy if there wasn't a 10-char limit for the $key, or if $callback wasn't restricted to [a-z0-9.]. Also the text in $result (and the fact it gets JSON encoded) somehow gets in the way.

Always Confused

Hi

I have posted an information security question

security.stackexchange.com/questions/233076/…

reed

Hi @AlwaysConfused, I just saw your question. What I know is that banks have ways to detect frauds, give refunds, they have insurance, etc. Nevertheless you should not give your CC data to everybody, especially to untrusted merchants in foreign countries

Always Confused

Ok

Should I give such code to Microsoft or Apple?

So the answer basically depends upon the bank?

What will happen when the merchant will attempt to draw money without my knowledge and/or consent?

@reed Thanks for your response

ThoriumBR

@AlwaysConfused they won't... Or the card issuer will sue them to oblivion, deny charges, make them live hell...

never mess with visa or mastercard...

Always Confused

Ok

Fire Quacker

18:03

@reed Well, this guy said it took a lot of engineering: twitter.com/Abdulahhusam/status/1270395070714445827

Always Confused

Ok thanks

And what if the cardholder can not keep a constant check over bank details statuses? or cannot report a possible unsolicited transaction?

I am so novice

about

online transactions

that it bewilders me

ThoriumBR

if someone charges your card and you don't see, it's on you.. but most people check their cards, and report...

Always Confused

Oh thats complicated

ThoriumBR

card issuers have very sophisticated anti-fraud systems that can detect if a purchase was not likely the user and call you when they detect something strange

Always Confused

Ok

ThoriumBR

18:10

my card issuer called me once I went to a city 500km from home, and 5 min after I purchased something, they called me to ask if that was ok

Always Confused

So they detect after the transaction, not *prior to transaction?

ThoriumBR

they called me multiple times this year, every time I bought something not in my profile, they would call me

Always Confused

@ThoriumBR Ok

ThoriumBR

@AlwaysConfused yes, after the purchase. if it wasn't me, they would cancel my card, issue another one, charge-back the merchant and file a criminal report against who used my card

Always Confused

Does State bank of India have similar mechanism?

ThoriumBR

18:12

most of the time the criminal will not be caught and the merchant foots the lost

Always Confused

Ok

ThoriumBR

@AlwaysConfused on cases of fraud, you the card holder will not be charged

Always Confused

Ok

ThoriumBR

you are the priority, the merchant had to make sure the one making the purchase is the owner. if they accepted a stolen one, they will keep the loss

the card issuer will protect you, and throw anyone under the bus

Always Confused

Ok

Does Netbanking requires same mechanism (Credit cards)?

I think netbanking is a safer alternative. is it?

Why companies does not ask for netbanking then?

Fire Quacker

20:38

@reed Here's another tweet related to the challenge: twitter.com/terjanq/status/1270269636576231425

I honestly don't know if they're joking or not

reed

@FireQuacker, they are probably kidding, to avoid giving hints

Transcript for