The DMZ

John Zhau

02:11

Looking back at your own questions from when you were new to SE, how do you feel?

meagar

03:02

@JohnZhau I've only asked about 10 questions in 11 years, and I think they all still stand the test of time

MechMK1

08:03

@reed I don't mind questions regarding things that can be used for illicit purposes, such as "How can a buffer overflow lead to RCE?" but what I do consider off-topic are questions that clearly show OP wants to use that knowledge for illicit purposes.

The question in question - no pun intended - was rather obvious that OP wants to do something illicit. And the fact that he went on a bit of a rant when I told him blackhat questions get no support shows me that he is a bit pissed off and not asking for "professional" advice

And even better, his question begins with "if i reach millions of computers with my own program, creating a botnet" - that doesn't exactly make me feel like he is an AV vendor trying to detect botnets.

MechMK1

08:55

@JohnZhau I feel my first questions were shit and they're only slightly less shit now

Conor Mancone

09:12

Yo!

@MechMK1 On the opposite side of the spectrum are the questions where the OP Is all "I have permission to do this!" or "I'm just learning, I'm not going to use this to hack anyone" questions. I presume that such people are being honest when they say that, but I still find such declarations amusing. I mean, it turns out that the internet is full of people who lie. Do you really expect me to believe you because you said so :)

Although I agree that it mainly comes down to how someone asks. The things that make a question well written have nothing to do with whether or not the underlying question is blackhat or whitehat, so in general I expect you shouldn't be able to tell.

But if someone comes by and has an attitude of "I need help so I can hack this company!" I'll probably downvote and move on

@reed In this case I would have VTC as too broad. Because it is, regardless of whether it is whitehat or blackhat. Having three questions in the title is a bit of a give away there...

MechMK1

@ConorMancone I'd say it all comes down to how exactly the question is phrased? If someone asks about how to exploit a specific vulnerability, and they give enough details to not fall into the off-topic trap, then I honestly believe when someone says "I'm doing this in the scope of a pentest" or "I'm doing this in the scope of a vulnerability lab"

But questions regarding the creation of malware are a bit on knive's edge. The more theoretical the question is, the more likely I am to believe someone they're just trying to understand malware. On the other hand, the more "practical" it is, the more likely I am to believe they're trying to make malware

A question like "How do botnets disguise communication to a central Command and Control server?" seem theoretical enough. "How can I disguise the communication to my Command and Control server?"...not so much.

Also, I have a question, but I am not sure if it's a dupe. The Yubikey Nano is designed to be left inside the device. Doesn't that completely defeat the purpose of a second factor if used for local authentication?

Conor Mancone

I think the part that matters the most to me is just the question quality. In your example I wouldn't even give it much thought: I'd just answer the question if I knew (and was interested). If for some reason I was suspicious that they meant mischief I would probably move on, although we don't actually have a close reason for "we don't help people hack things"

@MechMK1 That would be my conclusion, but I've never given those much thought (only used a Yubikey once or twice), so maybe I'm missing something?

MechMK1

It would still be just as secure for any online account

But many online accounts are really weird when it comes to 2FA

Google, for example, gives you the option to "remember this device", so you don't need 2FA anymore

Twitter doesn't allow you to use a security key unless you either install their app on your phone or link your phone number

Conor Mancone

09:28

That was one of my thoughts, although I'm not quite sure how it balances out in the end. There are some competing "gotchas":
1. If the website remembers you forever anyway then having the Yubikey plugged in forever is no less secure than you already are
2. Except that is not true because if you have an ecrypted drive and lock your machine, your active sessions are safe if your computer is stolen. In that case having your Yubikey plugged in forever gives a local thief access to your 2FA
3. However that doesn't help them anyway, because a local thief would still need to steal your username/…

Thinking about it some more: The main use case of 2FA is to protect against leaked credentials. The advantage of yubikeys over things like SMS or even TOTP is that a smart phishing page can steal SMS or TOTP codes. Yubikeys are restricted to a given domain, so cannot be phished. Therefore, perhaps the main use case of Yubikeys is protecting against online phishing attacks, in which case leaving it permanently plugged in is perfectly reasonable

MechMK1

I don't even know how to phrase my question.

"What is the risk of having a 2FA key permanently plugged into my device?"

MechMK1

09:49

I have an interesting thought experiment:

If my semi-permanently inserted YubiKey offers protection for my online accounts, but no protection against theft, couldn't laptop and smartphone manufacturers add a U2F key into my mobile devices?

Conor Mancone

@MechMK1 That's not crazy. It might get flagged as too broad, but it might not. In my brain I'd be wondering "Does having a 2FA key permanently plugged in defeat the purpose of having one?"

MechMK1

@ConorMancone I'd say no, because my password can still be compromised without the account itself being compromised

Conor Mancone

@MechMK1 If I'm properly understanding the use-case for U2F keys, then that isn't actually a crazy idea. I would add just one layer of security: your phone has to be unlocked for the J2F key to work

MechMK1

@ConorMancone Yes, of course. But it seems like it might actually work. And if the UX becomes good enough, then tying long-term sessions to devices may become more secure

Like, you could have a refresh_token, but only use it together with the 2FA key

And the 2FA key is your device

Conor Mancone

@MechMK1 To be clear, the U2F key on the device would only work for resources accessed through the phone?

MechMK1

09:58

Yeah. I mean, perhaps there is some weird fringe benefit of using your phone as a 2FA key on your PC, but I think it's not something a lot of people would use

Though...how would you access the account on a device without 2FA support?

I think such a system could only really work if it became "standard" for all devices, e.g. all modern motherboards would come with a 2FA key, just like how TPMs are slowly becoming standard

Tom K.

@ThoriumBR having worked for and in lower tier public administration, I can tell you, that's pretty much the standard - although sill horrifying

@MechMK1 btw, you wanted to come to this

MechMK1

10:14

@TomK. Yes indeed. Since we were just having such a lovely talk about security, it'd be a shame not to immediately swing back to politics, right?

Tom K.

sure, whenever you feel it's the right time

just a friendly reminder

MechMK1

No worries, I did not forget

So specifically regarding HRC, we had her e-Mail dump (which occurred since she conducted government business on her private e-Mail server), which contained some very spicy details regarding unspecified "wetwork" business

@schroeder Hello there, lovely to see you here!

schroeder

howdy!

Conor Mancone

Oh yeah, I forgot about the HRC discussion yesterday

Tom K.

hola

MechMK1

10:17

@ConorMancone Wouldn't have wanted to have it without me, would you?

Conor Mancone

I'm making a personal rule where I won't ever vote for more than one candidate with the same last name as a previous candidate...

@MechMK1 Indeed!

Nepotism is a real thing in US politics and it shouldn't be...

MechMK1

Yes, absolutely, regardless of political party. No Kennedys, no Clintons, no Bushs

Conor Mancone

I don't want to see the names "Clinton", "Trump", "Bush", or "Obama" again in my lifetime...

MechMK1

Though I would wager another Washington would probably do more good than harm in these times

Conor Mancone

Definitely not Kennedy...

They can rotate back in after a century...

MechMK1

10:19

@schroeder Also thanks for editing the question. I was not sure if I should have added an image

schroeder

@ConorMancone oh those poor "Smiths"...

Tom K.

so that's why HRC is worse than Trump, because she has the same name as her husband who was president years before her. But Trump who installed his daughter and his son in law in the white house, and whose sons are heavily invested in the GOP doesn't participte in Nepotism?

schroeder

Meh, nepotism is a bad thing. But growing up around the political machine does give one insight and effectiveness in operating the machine.

Conor Mancone

@schroeder :) Last name here is just a stand in for family relationship. I wouldn't apply the rule to two completely unrelated Smiths

schroeder

HRC had an incredible amount of experience and is qualified. Arguably more so than her husband (I'm not a HRC voter)

Conor Mancone

10:21

@schroeder There is some truth to that, and some amount of nepotism in any industry is inevitable

Tom K.

not to mention that HRC was senator of New York and secretary of state and had her own political career

MechMK1

@schroeder My argument is that while HRC is inarguably more experienced and qualified than Trump, she is in my opinion magnitudes more corrupt than Trump. I personally see Trump like a little toddler, who doesn't know what he is doing and just enjoys doing bad things because it provokes a reaction from his parents.

Tom K.

he is still enforcing a massive right wing policy programme in the united states, although he might seem like a crazy person

Conor Mancone

@TomK. I can't help but think that you insist on misunderstanding my views. I never said that HRC is worse than Trump. I have said that Trump is likely "worse" in all regards. My point is only that she is by no means innocent or a good candidate. She was, without question, well aware of her husband's sex crimes and continued to not just standby him and support him but actively destroy the careers of his victims when they tried to speak up.

Tom K.

while enriching himself and his family on a crazy scale

MechMK1

10:24

@TomK. I don't see right-wing policy as a bad thing per se, though I do consider his personal enrichment reprehensible

Conor Mancone

Is she as bad as the men who actually victimize women? No. But should she be considered "the woman's candidate"? Absolutely not.

Tom K.

@ConorMancone You didn't say that, no. I'm not referring to you when I'm asking that. ;)

@ConorMancone I agree with the point you are making here.

MechMK1

I did refer to HRC as worse than Trump, and I stick to it. I still consider that an incompetent and corrupt politician is not as bad as a competent and corrupt politician.

Because the more competent you are, and the deeper your ties into the political underground go, the more you can exploit the system for your own benefit.

Tom K.

@MechMK1 In what ways is Trump corrupt: US military forces had to stay in Trump hotels and resorts, secret service has to pay money to stay at mar a lago, diplomats and other envoys of foreign states can book rooms in Trump tower for ludicrous prices - and do not stay there

Conor Mancone

@MechMK1 I would agree with that sentiment in general, but I don't know enough about the specifics to take a strong stance for the two people in question. I have seen lots of rumors about the kind of corruption that HRC participated in, and while I tend to suspect the accusations are accurate, I don't know enough myself to conclude for sure. In my book she is already a terrible candidate that I would never vote for anyway, so it doesn't really matter

Tom K.

10:29

Trump Tower in Moscow, infrastructure projects in Saudi Arabia and China... yadda yadda yadda

Conor Mancone

My overall impression of both is that their main concern is increasing their own wealth and influence, but I don't know enough specifics about them to conclude much more than that.

MechMK1

@TomK. That doesn't really counter my point in any way. I know Trump is corrupt. Everybody knows.

Conor Mancone

Although HRC has one thing going for her: she retired. That era of US politics seems to finally be coming to a close, and we're all better off for it

Tom K.

You are saying HRC is more or equally corrupt than Trump is, but you are showing zero evidence.

Conor Mancone

I still find it strange that Trump decided to go GOP. He could have just as easily run as a Democrat. I would have thought that would be more his style...

MechMK1

10:31

@TomK. Like the Uranium One "controversy", you mean?

@ConorMancone Didn't he once run as a democrat candidate?

Conor Mancone

@MechMK1 I remember a great skeptics question related to this... (wonder if I can find it)

MechMK1

According to Wikipedia:

> Trump's political party affiliation changed numerous times. He registered as a Republican in Manhattan in 1987, switched to the Reform Party in 1999, the Democratic Party in 2001, and back to the Republican Party in 2009.

Conor Mancone

That was easy:

31

Q: Is this picture of Trump, Bloomberg, and Clinton playing golf real?

Picture reads "it's big club and you ain't in it", and has Rudy Giuliani, Donald Trump, Michael Bloomberg, and Clinton. That's quite similar to this tweet of the same Image without the caption by Glenn Greenwald

Tom K.

@MechMK1 right, it's a controversy..

Conor Mancone

I interpreted this question as, "Trump is such a staunch republican, there's no way he would hang out with Democrats, right???". Sorry: that is not an accurate understanding of Trump

I think he would have run for whatever party gave him the best chance of winning. He's smart enough that he chose well...

MechMK1

10:34

@TomK. And you think that there is nothing to it? Investigations are still active as of today, and I highly doubt they would still be active if there was nothing to it

@ConorMancone Trump isn't even a republican

He's just a shitposter

Tom K.

Yeah, it's not like Bill Barr is known to fabricate fake investigations or drop an investigation if needed..
But even if, then there's are 1 story - which I don't know the details of - but Trump has 100 stories.

@MechMK1 If you are a shitposter, you shouldn't run for president..

then there are "the emails", a topic which has been widely discussed. HRC was before two (?) committees, answered questions for 10 hours and no wrongdoing has been found.

MechMK1

@TomK. I wouldn't, though my political platform, if I would decide to still run, would involve legalizing marijuana, psilocybin, lsd, machine guns and .50 BMG rifles; requiring teaching students how to properly conduct a phone call and write an e-Mail, require every student to watch "The Matrix" and "Pulp Fiction", and make public littering punishable by public whipping

Tom K.

"cool"

what an edgy thing to say

MechMK1

I think too many teenagers don't know how to write a proper e-Mail, and that needs to change

Tom K.

you are my grandpa and a libertarian at the same time

MechMK1

10:39

I assume your grandpa also enjoys The Matrix and Pulp Fiction?

Conor Mancone

@TomK. That sounds like the best compliment ever. Then again I'm a libertarian and also 50% grumpy old man...

Tom K.

no, but he complains about teenagers a lot

"the state shouldn't interfere in my choices!"

MechMK1

I would rather put the blame on the education system, which does very little to educate on relevant skills. We still go by the "You won't have a calculator on your hand at all times" doctrine

Tom K.

"the state should interefere in the choices of teenagers, because they can't write a god-darn email!"

MechMK1

If you consider writing a bad e-Mail a "choice", sure. They can choose to write a bad e-Mail. But in order to choose, you need to have the ability to also write a good e-Mail

It's not much of a choice if you only know one way

For example, when I went to school, I was taught how to write a formal letter on a typewriter. This was absolutely obsolete, and a complete waste of everybody's time

Tom K.

10:43

have you ever thought about the possibility of you being wrong?

MechMK1

@TomK. I don't need to, you do that for me.

If instead I was taught how to phrase and format a decent professional e-Mail, a lot more people would have learned a more valuable practical skill

Tom K.

the worst emails I get are from seniors and from people who think they know everything. the nicest and kindest emails are from juniors and young people who are just starting out.

MechMK1

I believe you. A lot of seniors just don't care about proper form anymore. However, when I get an e-Mail that literally starts with "Yo, what's up?" in a professional context, then I feel like someone failed

And, while I cannot say for sure, I doubt that it was a senior addressing me like that

Tom K.

mabe they just want to be friends?

or think that you are the same age as you?

or thought you were someone else?

or wanted to make a joke?

or maybe want to make work a little less pain in the ass?

MechMK1

@TomK. if I would have exchanged dozens of e-mails with said person, it would have been different. However, when my e-Mail was addressed like "Sehr geehrter Herr <last name>" and he replies with "Yo, wie läufts?", I feel like that's not proper discourse

Tom K.

10:48

all these emails that start with:
"Dear ladies and gentlemen,
may I bring the following item to your attention:.."

dude.. relax

MechMK1

Relax in which way?

Tom K.

I'm talking about the hypothetical person that writes "Sehr geehrte Herr"

in this case .. you?

MechMK1

I think in a professional context, especially with a stranger, one can expect being addressed politely

There's a difference between speaking to a professional contact and my bro on teamspeak

Tom K.

sure

but there's a difference between work and a funeral, isn't there?

MechMK1

How is it like a funeral to address a stranger politely?

Tom K.

10:51

I don't want to put a stick up my ass every time I write an email

but - of course - I understand there are different flavors and people want to get adressed differently

MechMK1

I don't. In fact, addressing people in a polite and friendly way isn't difficult at all for me

schroeder

@TomK. HAHAHA, don't work in the UK, then. Whoooo boy!

Tom K.

@schroeder hahaha

schroeder

Not just sticks but different kinds of sticks with layers of nuance. Been here 4 years and still haven't worked it all out

MechMK1

And if I have spoken to a person several times, and they want to offer a more informal tone, I would happily agree and be more informal. But formal and polite is the default tone in a professional environment in my opinion

Tom K.

10:53

all I want to say, you shouldn't - or at least I wouldn't - get all worked up, if someone adressed me in an "improper" way

MechMK1

I don't get worked up about it, nor would I ever "correct" someone on it (which would be very impolite to do anyways), but I think my part about it

Tom K.

@schroeder yah, I heard that the UK has a very different work environment

weirdly the british infosec community seems to be rather active

schroeder

I ended an email to colleagues with "Regards" instead of "Kind regards" and people called me up to tell me to calm down. I still don't know why I need to have an ending salutation at all...

Tom K.

lol

MechMK1

@schroeder "Mit freundlichen Grüßen" is the de-facto standard for an ending salutation

"Hochachtungsvoll" is...damn, I don't even know anyone where I would use that. Too polite for anyone

Tom K.

10:56

Internal signature ->
"Viele Grüße
Tom"

no last name, nothing else

MechMK1

Yeah, internally I just use "Lg," unless I write to the CEO or such

schroeder

@MechMK1 standard endings are fine. You can template that. But here, oh no, you need to consider and use just the correct forms of greeting and endings, and you cause problems if you get it wrong. And there is no guide ...

Tom K.

wtf

schroeder

ikr?

MechMK1

@schroeder German is a lot simpler in that regard, since these two beginnings and endings are pretty much default for 99% of communication

Tom K.

10:57

lemme guess, you work in government?

schroeder

@MechMK1 as is the case in North America.

@TomK. nope

Tom K.

weeeeird

schroeder

yep

MechMK1

"Sehr geehrte Damen und Herren" (Dear Ladies and Gentlemen) if you don't know who you are addressing and "Sehr geehrte/r Frau/Herr (Dr./Mag./etc.)" if you know who you're addressing

Some people with a doctor insist on being referred to by their title

Others don't care

Tom K.

@MechMK1 haha, those people (8

schroeder

10:59

hehe - I work with a lot of universities. The Drs care

MechMK1

@TomK. In all honesty, if someone goes through the trouble of writing a doctor thesis, I can go through the trouble of writing "Dr." or "Doktor"

schroeder

@MechMK1 ditto

MechMK1

my professor in accounting had a lot of titles. Prof. Dr. Mag., etc...

schroeder

but in my circles, they do not always identify themselves as "Dr." -- you have to know

and if you get it wrong ...

MechMK1

@schroeder Hopefully you can at least look it up

schroeder

11:01

it's all kinds of fucked up

MechMK1

My accounting professor never used his titles on any document, except on his drivers license. He said "If your titles are longer than your name, and the police stops you, they speak quite differently to you"

@schroeder Yeah. Though the worst offenders in my opinion are the Magisters and Magistras

schroeder

2 months after moving here, I described the culture as "Downton Abbey with cellphones". Oh, the classism. And they truly believe they put their classism behind them.

MechMK1

No matter how simple a form is, they will fill it out wrong, while then telling you that it must be your fault.

schroeder

lol

MechMK1

@schroeder "No no, i would never think I am better than one of those plebs who don't even have a PhD"

A simple form, asking for your first name, last name, employee id, phone number, bank account number and what kind of parking tariff you would like to have

schroeder

11:04

@MechMK1 yeah, that's it

except extend that throughout the culture, not just the universities

MechMK1

In the field "Employee ID", there was already: The car license plate, the phone number of their spouse, the phone number of the IT hotline from a sticker on their desktop, the room number of their office and, my personal favourite, the number of the parking spot they would like to have

schroeder

LOL

yeah, that sounds familiar

MechMK1

Whenever I see someone do something exceptionally dumb in an expensive car, I automatically say "Must be a Magister"

schroeder

lol

MechMK1

I mean, I absolutely believe that these people know their stuff in their area of expertise (or at least, I want to believe that), but being unable to fill out a clearly labelled form, even with fill-out instructions...that's a big oof from me

Though one thing that I really dislike is when some Dr.s and Mag.s believe the rules don't apply to them because of their status. For example, in order to park in the employee garage, you need to put a transponder on the inside of the windshield. This transponder is put on there with an adhesive foil.

And tons and tons of Dr.s and Mag.s were like "No I don't like seeing this on my windshield. Can't we put it on a piece of clear plastic so I can put it away?"

"no, it's designed that way so people can't use any car and actually have to use the car they registered."

"That's unacceptable! There must be another way"

MechMK1

11:57

1

Q: Essential / popular TAXII feeds

TAXII feeds are a great addition to a monitoring solution such as a SIEM. However, to my knowledge, there are only three distinct openly available providers: Hail A TAXII OTX Limo What other threat feeds based on TAXII/STIX are available?

siem ioc

Is this on-topic? It seems like a product/service recommendation to me

Conor Mancone

@TomK. You know what I get worked up over? When people misspell my name when responding to an email from me, because between my email address and my name (which I always sign on the bottom) they should know exactly how to spell my name!

Specifically my first name: it's an uncommon spelling of a common name. I never expect people to spell it right if they just hear it, but it's ridiculous to misspell someone's name when they have already spelled it for you

Tom K.

@ConorMancone Oh, come on Connnor!

Conor Mancone

(to be fair, I don't actually get worked up over it - just mildly irritated)

lol :)

Tom K.

yeah, I get that. that's just.. kinda rude

Conor Mancone

Although I'm also the kind of person who will copy-and-paste international names to make sure that I get all the accented characters correct

schroeder

12:05

@MechMK1 falls under "what product/service does X?"

Conor Mancone

I've gotten some weird ones to: Connor (not a surprise), Conner (kinda weird), Conr (I think that person just doesn't know how to spell) and Corner (I mean, come on!). I also get Hunter a lot when it is over the phone

MechMK1

@ConorMancone I am 100% sure that I at least once have called you Connor and I'm sorry

Conor Mancone

@schroeder That's hilarious (well, it wouldn't be if it happened to me)

If you did I wouldn't have noticed or cared. Completely different!

@schroeder That was not my experience (I have a PhD in the sciences and so spent a lot of time with Drs). Although we always made fun of liberal arts professors and said that they always wanted to be called "Dr", because when you have a meaningless degree it's that much more important to get everything you can out of it

90% of the people I knew though didn't care about the title. I'm sure thought that YMMV. (I'm not actually sure Drs in the soft sciences care more about being called "Dr", but that is the story we stuck with anyway)

Tom K.

3 of my best friends have PhDs and do everything to hide it, because it would be extremely embarassing to be seen as someone who wants to be seen as someone, who gets adressed with the title

one of them is a professor and only tell people - when they ask what this person does for a living - that they "teach at a college".

Conor Mancone

My PhD is not relevant to my work, so it pretty much never comes up. I only bring it out when it is helpful (mainly just job applications when it is at all relevant). I do hang my diplomas up in my office though. It took a decade to get them all, so I figure I might as well do something with them.

Tom K.

12:15

okay, radical topic switch, if I may

here's a work conundrum:
There's a senior colleague who gave a project to me. I firmly evaluated the project goals and wrote up a 3-page thing with a TL;DR that says "The project goals do not work with the chosen methodology and in the circumstances. This project should be abandoned".
The senior answered saying:
"Hi Tom
**You can't be serious!**
I told you, if you have questions, ask me first!
**This is unacceptable**"

My answer:
"Hey,
I'm sorry if I missed something, let's talk tomorrow (today)."

Conor Mancone

My college actually had a BOGO program for my undergrad work, so I actually have 4 degrees. I point this out mainly because I think a BOGO for a bachelor's degree is hilarious

Tom K.

no answer, no meeting set, no call. should I engage?

Conor Mancone

@TomK. Where did you share your findings?

Tom K.

in a pdf attached to the email

Conor Mancone

But, with other people or just with the colleague?

Tom K.

12:17

sent to the senior and another person who initiated the project

Conor Mancone

Okay

MechMK1

@TomK. I'd say yes. A call, perhaps with a request to make a meeting. 30-60 minutes or such, depending on the scope, to discuss your findings.

Conor Mancone

When you say, "Gave the project to me", as in asked for an evaluation, or "Okay Tom, you need to be charge of this now"

Tom K.

@ConorMancone the latter

but when I have to be in charge of something, I have to evaluate it first

Conor Mancone

If it was assigned to me then I would probably just bring it up with whoever is responsible for prioritizing my work. "Hi [line manager or whatever], I'm supposed to be working on this project. I reviewed it and I think we should just let it die. Here are my conclusions. Do you want me to actually work on this thing?"

Tom K.

12:21

so... yeah.. dunno

Conor Mancone

I usually try not to ruffle the feather's of my coworker, but if the coworker in question is no longer responsible for the service then it doesn't really matter what their opinion is

Tom K.

interesting

schroeder

@ConorMancone I deal with Admin Drs, not academic/research Drs ... Most research Drs I know don't give a crap. But if they run a uni ...

Conor Mancone

So if they didn't reach out to me again I might leave it, but I might reach out simply to see if I could help them move past their irritation at me.

Tom K.

so yeah, we have this matrix organization here, and this person is only responsible for some of my skill-specific assignments

I like your approach

but it could be seen as a bad move as well, because I'm kinda going over this person's head

while just calling them and clearing things up might be easier

or just ignoring everything.... (this project ist honestly just so stupid)

Conor Mancone

12:25

@TomK. That sort of thing is always the tricky part, and that definitely wasn't a consideration in my suggestion, so...

Tom K.

why I'm hesitant @MechMK1 about your sugesstion, is the tone of the email, there were several parts that were just in bold! like the "You can't be serious!". I mean.. wtf?

that's what keeps me from having a 1on1 meeting

MechMK1

@TomK. I understand your hesitation, but I think a personal discussion may actually be in your favour. People are more hesitant to be openly hostile in person, and on a phonecall or an e-Mail. It's easier to be angry to text on your screen or a voice on a phone than to a person standing across you.

Tom K.

ah yeah, shoulda been more clear: it would of course be via skype/zoom/whatever

but I think your logic still applies

MechMK1

Ah yes, I forgot that most meetings are still via conference call.

Still, if I were in your situation, I'd ask for a meeting to get some clarification and perhaps explain my reasoning

Tom K.

okay, I think I will probably take both your approaches. Talk to my line manager first, then talk to the senior - and maybe have some additional arguments in the backpoint

MechMK1

12:32

Good luck with that. I hope you can get it resolved in a productive way

Tom K.

ty

MechMK1

I just bought 60 packs of Nissin Demae Ramen Sesame Flavour

I am going to die from a heart attack, aren't I?

schroeder

@MechMK1 yep

MechMK1

What if I eat those 60 noodles over the course of 2 years? That's one pack every 12 days or so

Conor Mancone

I'm thinking the salt levels will spike your blood pressure and give you a stroke. Anyone who is pulling for a heart attack: want to put odds on it?

MechMK1

12:41

Plus knowing my girlfriend she'll probably eat half of it anyways, even though she doesn't like sesame flavour

Conor Mancone

I've recently developed a love affair with sesame

MechMK1

@ConorMancone I'll bet 100 € on my survival for the next 2 years. Should I die, ask my accountant for the money

@ConorMancone Sesame is amazing!

Conor Mancone

Tahini based dressings, sesame bagels, roasted sesame seeds on dishes.... yum....

MechMK1

It doesn't matter if it fucks up my teeth. Sesame is still healthier than meth.

0

Q: Asymmetric encryption that preserves the plaintext size

I'm looking for an asymmetric encryption algorithm that preserves the size of the thong in clear text. The encrypted file must not be longer than the plaintext file and must not contain any special characters. Do you have any ideas?

encryption

"string" => "thong" is my new favorite translation hickup.

2

MechMK1

13:00

Reminds me of "To a non-programmer, string and thread refer to the same thing."

2

I forgot where I picked that up though

schroeder

@MechMK1 it took me a minute of parsing, but I think that's what was meant

MechMK1

@schroeder I assumed "thong" was some kind of cryptographic thing I haven't heard of. But your translation to string makes more sense

ThoriumBR

I would never guess "thong" was "string"

schroeder

@ThoriumBR that just means your wardrobe is not as interesting as mine.

3

ThoriumBR

like @MechMK1 I was thinking about a crypto structure that I never heard of... people gives strange names to things

thinking about my wife's wardrobe it makes more sense

Tom K.

13:17

@ConorMancone if you are into Tahini, I recommend can Ottolenghi cookbooks. they are full of recipes with extra tahini sauce on top

on topic: googleprojectzero.blogspot.com/2020/06/…

MechMK1

14:01

@schroeder I would like to unsubscribe from this mental image.

schroeder

lol

MechMK1

EU has a right to be forgotten, but not a right to forget.

:D

schroeder

lol

MechMK1

Quick, I need motivation to write a report in the next hour that I should have finished on wednesday already

Journeyman Geek

14:20

@MechMK1 unfortunately a IOT shock collar would take too long to ship.... :D

MechMK1

@JourneymanGeek As soon as my head turns right to look at the DMZ I'd be shocked?

Hmm, that sounds like it could work

Journeyman Geek

Its IOT. its reasonably likely it'll get hacked so who knows

Tom K.

okay, @ConorMancone your approach went okay-ish. my line manager brought the senior into the call after I explained the situation to him and then moderated a weirdly tense 3-person call.

MechMK1

14:40

Ah yes, the truxican standoff. I hope you came to an agreeable conclusion

Tom K.

14:54

not sure, the senior kinda implicitly told my line manager that I'm having trouble figuring out, what the project goals are and whatnot, so basically saying: Tom isn't competent enough, that's why he handled this the wrong way

true management skills you'd expect from someone with seniority

no engagement on a technical level from their side, no real arguments

I'm leaving this place soon, so, I just want to get this over with

MechMK1

Ah, I was wondering if this was already on your new job or not

Fire Quacker

16:00

Is Windows Defender recommended for SOHO/SMB?

The Norton subscription at the office is expiring soon and apparently it's up to me to figure out what to replace it with.

Tom K.

from what I hear defender is quite good

but as with all AV solutions nowadays: it's only really good if you use the version that has a cloud connection

the question you should be asking yourself: do you need an AV application?

Fire Quacker

That is the definitely a good question

Most of the users aren't tech-savvy. But there are certain types of industry-specific legacy applications that they need to use.

As in, they have to download software from non HTTPS websites

There's been one BEC since I've been around, and possibly one before (I can't remember).

Tom K.

BEC?

Fire Quacker

Business Email Compromise

One of the executives started getting replies from people asking him about a weird email he was sending out.

ThoriumBR

16:20

BEC is a very lucrative scam...

in its various forms... a Russian gang, IIRC, compromised lots of execute's emails and basically ran an insider trading operation

and sold the information

Conor Mancone

18:25

@TomK. Why are they giving you a new project to be responsible for when you are leaving? That's a terrible idea... Presumably they will just have to re-train someone else on it after you leave.

ThoriumBR

19:20

@ConorMancone maybe the project is finishing, or they want to abandon the project and toss it at Tom because when he leaves, they can tell the client they will need to start over, because Tom left with all data, and it will cost more and take more time...

Transcript for