The DMZ

4:02 AM

A certain server is exposing its log files. A single file is huge and later events are at the bottom. Is there a good was to just download the bottom part of the files or do I have to download whole files to check the logs?

ThoriumBR

try the HTTP Range header

you can try downloading from 500M, then from 1G, them from 2G, until you receive 0 bytes and know that the file is not 10G... go reducing the range until you get something usable

curl -r is your friend

MechMK1

11:27 AM

I have appeared

ThoriumBR

12:19 PM

morning meeting...

MechMK1

The best kind

"So if you look...at this...*yaaaawn*...excuse me"

ThoriumBR

I had 5h sleep this night, like the previous 3...

I wake up 20 minutes before the meeting, and let the computer all set the night before

good thing I don't need to be on camera

MechMK1

I hate meetings where I have to be on camera

Like, who the fuck would want to look at my ugly face? Plus, I like walking around the room on meetings

ThoriumBR

my workaround: sit with the back to a bright window

webcam will try to compensate the exposure and you will be so dark you cannot be seem

nobody will bother looking at you

or in night meetings, shutdown every single light. your face will be like a giant light bulb

MechMK1

12:40 PM

Luckily nobody asks me to

or I just say my webcam isn't working

They won't make me put on pants

Anonymous

1:01 PM

@ThoriumBR Yeah I know how very little sleep feels.

Anonymous

I ended up falling asleep after a roughly 76 hour insomnia episode.

Anonymous

It was really, really awesome.

MechMK1

Oh dear

2

A: Is it impossible to have a PDF file execute a command without abusing any exploits?

Adobe Reader allows javascript in PDF to be interpreted (initially to allow features like form validation). You can manually edit your PDF in notepad++ to add scripts in javascript. One time I made a phishing campaign exercise based on this usecase. The script asked for a login password in a form...

"Yeah sure, here is a PDF if you want to know more"

Anonymous

Yeah it was horrific.

ThoriumBR

1:18 PM

you can do that with a text file with this contents:
"forward this text to every contact, then go to My Documents, delete everything, reboot"

MechMK1

@ThoriumBR like the guy who went to /g/ and said he had a tech problem and a guy told him to delete several registry keys and then reboot

Of course, his computer would not boot anmore

And he flipped his shit

ThoriumBR

some people are evil

MechMK1

I consider it practical advice

ThoriumBR

I saw a guy ask for help because his php code wasn't connecting to the database, and pasted the connection string....

MechMK1

"Don't do random stuff on your computer just because a stranger told you so"

Noooooooo

ThoriumBR

1:20 PM

people dropped his database in 2 minutes

MechMK1

Wait it was public too!??!?!ß

ThoriumBR

yes, it was public... but it was 10 years ago...

MechMK1

Jesus...

I recall when people would include [img src="C:\Users\..."] in forum posts

And then say "Well it displays for me"

ThoriumBR

he got a server with public ip, no firewall, and mysql on port 3306

MechMK1

I think the only way to really educate people in some regards is to demonstrate what happens if they dont listen

ThoriumBR

1:22 PM

I usually edit questions on the forum when people put the entire domain, usernames and things like that...

MechMK1

you know what's funny? There are legit IPv4 addresses reserved to be used in technical documentation

198.51.100.0/24 and 203.0.113.0/24

Also 192.0.2.0/24

Sometimes I wonder if the IETF was smoking crack

"Ayy, let's make some real fake IP addresses you can use in documentation, so people will know they're fake"
"Oh, so like 0.0.0.1 or such?"
"nah mate, 198.51.100.0...fuck it, let's make it 256 addresses."
"Isn't that a bit much?"
"Yeah, you're right. Let's make it 768 addresses"
"...I don't---"
"And 16 million addresses refer to localhost now"

ThoriumBR

1:39 PM

yes, an entire /8 for localhost is a little overkill

nightmarish user experience... I am required to rate my knowledge on 300+ skills, and the page I need to navigate is 20 pages long... to rate every skill it navigates to another page using javascript, so no way to open in new tab. when I rate my knowledge and save, it gets back to THE TOP of the page and I have to remember where I was and return there...

just list all 300 skills on the same page with radio buttons to me to choose!

it takes me more time to find the next skill than to filling the form

MechMK1

2:01 PM

I hate such forms

I should fill out one as well

ThoriumBR

and some skills are SO basic that, man... I literally had one asking if I know how to write!

there are a skill for "cloning guest"... man, that's ONE command! you either never heard of it, and it's a zero, or you know the basics of the hipervisor and it's a 5... there's no "I kinda know the command to clone a guest" or "I know how to clone one, but need help to clone 4"

MechMK1

@ThoriumBR The best form fail I have ever seen is an application form where you had to enter your race, and if you selected "Caucasian", it replied "Incorrect answer"

ThoriumBR

hahaha

I saw a form with Gender: Female or Adult

MechMK1

Don't get me wrong, I'm 99% sure it was just a misconfiguration (probably code copied from some sort of exam example), but damn is it bad optics

@ThoriumBR I had that with Gender: Male, Female, Other, Asian.

ThoriumBR

aff

I see those all the time on 9gag and reddit

300+ skills, it takes me 30 seconds to get in, select, click back, and find the next...

I am spending 2.5 HOURS on this! my manager will have to promote me...

MechMK1

2:10 PM

I have to do a similar thing, but the problem is that they did not split it by department

ThoriumBR

I guess my "filling forms" skills will be "master level"

MechMK1

So I have to answer everything in regards to sales, marketing, HR, etc....

ThoriumBR

like here... I have "Advise on Network Security" and "Build trust" and "Perform executive interviews"...

I have to interview the next VP of marketing, later I need to fix the vlan mess, and cook the cake for the break on the meeting where I explain why it's advisable to trust your colleagues...

MechMK1

Bruh.....

ThoriumBR

it's all here... marketing, HR, technical on every branch (network, security, infra, database, coding), "soft skills"... and I need to fill each one

put a 1 on each one at least (1- I believe I heard something about it) or your skills meter will be at 100 and your colleagues are at 350...

MechMK1

2:17 PM

How pointless

Conor Mancone

@MechMK1 What's the localhost subnet?

I've apparently never heard of this before...

Are you talking about 10.0.0/8?

MechMK1

@ConorMancone 127.0.0.0/8

No joke, btw

ThoriumBR

127.0.0.0/8

MechMK1

So it does not matter whether or not you connect to 127.0.0.1, 127.0.0.2 or 127.25.182.74 it all connects to localhost

0

Q: Track code from Github public repos

I just started working in a small IT company and I work as a web developer. Now, I am still getting familiar with old projects and just found out that my previous developer has created all Github repos as public repos. So, everything he did for the company, during the company time, was in public ...

github

What would you do in this situation? I mean, likely seems like a breach of contract

Derpy

2:34 PM

Afternoon.

I was just looking for you, @MechMK1 :P

MechMK1

@Derpy Oh, why so?

Derpy

Since I know you like gatcha mechanics a lot...

MechMK1

"like", yeah :D

Derpy

I wanted to share you a link from a currently ongoing talk in another room.

MechMK1

Sure thing

Derpy

2:36 PM

in Not a bar, but plays one on TV, 19 hours ago, by Derpy

How to make Animal Crossing Pocket Camp less cozy with an update that on the surface seems to make the game more cozy

Start here and have fun....

MechMK1

When did psychological manipulation become so prevalent in games?

I say while paying way too much money to have Minamoto-no-Raikou in FGO

Derpy

Just a warning. That room is one of the most "cozy" rooms on the network, by this I mean that it is not the case to be too much explicit there. Consider that room PEGI 7

MechMK1

Oh I won't write there

The DMZ is basically the only room I go to

The Tavern is....god I hate that place

Derpy

@MechMK1 well, I realized you probably would love the story as soon as I mentioned "free loot boxes but you have to pay for the key"

I think you told me that story in the first place.

MechMK1

Games love guilt-tripping non-premium players, don't they?

ThoriumBR

2:41 PM

I used to lurk on Comms Room years ago... now I only have time to DMZ

MechMK1

I'm in the DMZ because I can say the N-word without getting 30

Conor Mancone

@ThoriumBR I had no idea that 127 reserved an 8. I have always just used 127.0.0.1...

MechMK1

I honestly think the DMZ is the most politically incorrect room in the network

@ConorMancone There are other uses for the other localhosts

For example, if you have two applications that bind to the same port

so you can bind to 127.0.0.2:8080 for example

Conor Mancone

@MechMK1 Sneaky! I never would have thought of that... MUWAHAHA

@MechMK1 I'm not very familiar with other rooms in the network, but I'm glad this one plays fast and loose with the rules

MechMK1

@ConorMancone I needed that for burp once, because some application would bind to localhost

ThoriumBR

2:45 PM

so you can have around 1,048,560,000,000 open ports!

Conor Mancone

On a controversial note, everyone in my city got an emergency alert on our phones at 8:15 telling us that we had a 9pm curfew and to "go home now"

sigh....

MechMK1

And burp WOULD NOT ALLOW ME to intercept to localhost

But, I could bind it to 127.0.0.2

Conor Mancone

Silly burp....

MechMK1

@ConorMancone Reply with "yes dad"

ThoriumBR

and that not counting the 169.254 subnet...

Conor Mancone

2:46 PM

This is unfortunately local news...

usatoday.com/story/news/nation/2020/09/24/…

@MechMK1 I'm this close to switching to a linux phone instead of Android/iOS

MechMK1

@ConorMancone Oh dear

Did you see the video of the white guys shouting "FUCK YOU, BLACK LIVES MATTER" at that black guy in his car who was trying to get to work?

ThoriumBR

here we don't need the govnt to tell you to go home after 9pm...

MechMK1

He got out of the car and yelled "You're protesting the wrong person" and they kept shouting

Conor Mancone

lol, no, but I might need to see that one

MechMK1

let me find it

Conor Mancone

2:49 PM

I was already at home and almost in bed, but I was temped to get dressed and go somewhere because stuff like that ticks me off bad

MechMK1

Oh no it was a woman

twitter.com/ElijahSchaffer/status/1308965151639572481

@ConorMancone Yeah, it's like who the fuck are they to tell you where you are allowed to go

THIS IS AMERICA, GOD DAMNIT!

Conor Mancone

Just... wow....

MechMK1

Yeah, it's almost as if these people protest simply to protest, but without any reason behind it

Imagine being a black woman, and a white guy shouts "FUCK YOU, BLACK LIVES MATTER!" in your face as you get home from work.

Fucking surreal

Derpy

@MechMK1 this update... I think they outdid themselves. The mechanics are so evil that it must have required a lot of work to think out.

See the "we will make you waste the keys before you realize those were keys to get the real good items"

MechMK1

@Derpy What?

Derpy

2:57 PM

@MechMK1 you only read the first post I linked? :P

Read the next ones.

Short version: on day one of the update, everyone was given 10 free gifts to give out to friends. So... everyone used up those gifts and sent them to different people.

On day two, everyone was given a RARE gift that has a 100% chance to contain a better item (a cookie - aka a lootbox. So basically gifts are lootboxes that you send someone so that they may be lucky and find another lootbox inside.)

BUT.... to be able to send the RARE gift to someone, you first need to send 10 gift to that specific player.

.... Remember the 10 free gifts from the day before? To be able to send the RARE gift, you needed to send those to a specific person instead of diluting them on multiple players.

But ... that was told you only on day TWO. After you probably already gave them out.

MechMK1

3:13 PM

What a scumbag move

Holy shit

Rory Alsop

@MechMK1 no. If we see that, you will get kicked

@ConorMancone we still will stop things. If folks don't abide by our basic rules, mods from all over will swarm, and then the rules get much stricter

so... keeping at a sensible level avoids harsher controls

MechMK1

@RoryAlsop I actually quoted it, as I didn't say it, I talked about it

Rory Alsop

@MechMK1 yes - I see that

thank you

MechMK1

I just like to misrepresent the facts to say I said it, because I am childish :D

Rory Alsop

@MechMK1 you like to know where the boundaries are...so you can play with stepping over them a little? ;-P

MechMK1

3:21 PM

@RoryAlsop Like any little kid does, right?

Rory Alsop

@MechMK1 ...

yeah

MechMK1

I mean, last time after I came home from the shooting range, I took a nap and then ate icecream

Rory Alsop

@MechMK1 that's all wrong! Should be ice cream before nap...

MechMK1

Should be, yeah, then I could have played videogames longer

I don't want to write this report, I want to play Risk of Rain 2........

Conor Mancone

@RoryAlsop Indeed, and don't get me wrong - I'm all for that. Basic courtesy and respect should always reign supreme. But it's nice to be able to talk about controversial and unrelated topics (aka modern politics) without immediately getting yelled at.

MechMK1

3:31 PM

>controversial and unrelated topics

This app doesn't allow users to change their password. Is that normal?

Is there a good reason to do that? I mean, except if authentication is done elsewhere

Conor Mancone

@MechMK1 Yawn, sooo boring... I'm going to go hang out somewhere else...

MechMK1

Noooo, I promise I will talk about conspiracy theories soon

Conor Mancone

zzzzzzzz zzzzzzzzzzzzzzz zzzzzzzzzzzzzzzzzzzzzzz

Rory Alsop

3:49 PM

please don't

MechMK1

I wouldn't

Conor is just teasing me

Everybody is so serious in recent days, I wonder why

Twitter is banning a lot of accounts in the last 2 days

Rory Alsop

@MechMK1 probably long overdue - their bot detection has been slowly improving, but they are terrible at removing those who are just there to spout hate and to incite violence

MechMK1

Hey, my friends aren't bots :D

Rory Alsop

lol

MechMK1

And if they are...well, we passed the turing test :D

And the thing about "hate" is that there is a bit of a double standard going on. I reported a post where someone said "We should just round up all the white people and shoot them" and twitter said nop,e that's okay in their books

Like...I don't know, that just doesn't seem right to me

Rory Alsop

3:54 PM

@MechMK1 that should be taken down - even just according to their rules

MechMK1

@RoryAlsop Of course, when you see stuff like that, it's easy to accuse Twitter of being biased

And to be fair, I too think they are biased

Rory Alsop

@MechMK1 they are biased in favour of controversy, encouraging extreme views, and of trying too hard to allow "free speech"

MechMK1

Are we talking about the same Twitter? :DDDDD

I think that their decisions are more or less arbitrary

Rory Alsop

all social media, as far as I can see

MechMK1

I have the theory that they simply employ an alogorithm that decides whether or not a post should be removed or not

And that results in them not really having any concrete rules as to what is allowed and what is not

The AI decides, and nobody knows how that works

Rory Alsop

3:58 PM

@MechMK1 absolutely - but the algorithms are incredibly badly trained

MechMK1

Indeed!

I mean, I got banned for doing the "I'l bash ye fookin' 'ead in I swear on mi mum" meme

Like, any human being, in that context, would have understood that it was a joke and not a threat

probably because the person I talked to laughed at it, and I laughed at it with him

but 3 days later "Nope, permabanned for threats of violence"

Rory Alsop

@MechMK1 and yet it misses the real problem

I saw someone temporarily banned for suggesting trump was "yeeted into the sun"

again - a joke, obviously

maybe that should be part of the Turing test

MechMK1

Yeah, and it should be treated as such

Indeed. I mean, I may have a bit of an extreme view, but I think platforms like Twitter, which have such an influence on how the human population communicates, should be Freedom of Speech absolutists, and give people the tools to shape what they see and not see

Muting people, blocking people, muting keywords

Like, if you think that you don't ever want to see any posts that contain words like "nigger", no matter in which context they may be, you should be able to mute them - i.e. any tweet containing that word would simply not appear for you

Anyways, it's late for me, I got to go now and clean up my dirty apartment

The dishes are overdue

And to be fair the floor probably too

Have a good one, lads and lasses

Rory Alsop

@MechMK1 you too

Conor Mancone

7:21 PM

@MechMK1 lol!

ThoriumBR

@ConorMancone we passed the turing test guys!

Conor Mancone