The DMZ

12:06 AM

And the sign said? Long haired Fugging people, need not apply, I guess.

1:59 AM

@MechMK1 I don't know why, but when I saw this video, I thought "Meck is the one who could make this..."
https://img-9gag-fun.9cache.com/photo/azmpW3Z_460svav1.mp4

MechMK1

10:02 AM

@ThoriumBR Yup, germany

They say germans don't have fun - they do, it's just weird

@reed What happened to your QR code

@JourneymanGeek You know what they should have done? Sold fake signs

Like, make a tourism business out of it

People go to Fucking, take a picture of the fucking sign, buy a little fucking sign, go to a nice fucking restaurant

I was there too, they don't even have a restaurant. They have nothing

They could have made such a nice tourism gig out of this, but for some reason they don't want to

Also why do some avatars not render for me?

Specifically those from Gravatar?

ThoriumBR

10:32 AM

the tourism route would be profitable...

they could even explore the curious name and create a themed attractions, like the sex museum of netherlands (I guess...

sometimes you find opportunity on the trash, sometimes you trash the opportunity

Conor Mancone

10:50 AM

@reed I definitely don't know for sure, but more often that not if you go to view the chat your icon will get added to the room even if you don't actually chat. As a result people may have their icons there even if they've never actually chatted.

I usually drop in at least once a day, even if I don't end up having time to chat, so my icon usually ends up in the list. However I never actually "leave this room", so I'm sure my icon just hangs out. My guess is that there are always 8 ghost icons and an icon only falls out once a new person joins. As a result, how long ghosts stick around depends on how busy the room is.

Conor Mancone

11:50 AM

@MechMK1 When you get banned from Twitter you get auto banned from gravatar!

This guy wants three separate passwords to use his computer:

0

Q: On a single user laptop does it make sense to have a separte password for root and the user?

I have a laptop on which I'm the only user. While installing the laptop I was wondering why I should choose a different password for the root account and user account. My reasoning is: The change of finding a valid password doubles if the user and root have different passwords. Of course the sal...

I picture him as being the cryptonerd from this XKCD

Actual actual reality: nobody cares about his secrets. (Also, I would be hard-pressed to find that wrench for $5.)

reed

12:11 PM

@MechMK1 My QR code didn't look cool enough, I needed something more colorful.

@ConorMancone Actually, I'm still undecided what to do on my next installation. I thought of having separate accounts (user and root), but I'm not sure if I'd better just concentrate more on separation using virtual machines

Either way, having good security is always going to be a PITA

Conor Mancone

12:33 PM

I use my same password for the user account (who is also a sudoer, so basically the same password for the admin account) and for hardware encryption. It is an unguessable password which I never tell anyone, so I don't see any advantage in having separate passwords for these things.

Elie Saad

@reed in almost all recent setups, root doesn't have a password, it's only escalated to from a privileged user.
I'd suggest just your user (sudo) and a user for remote needs that isn't powerful and sudo.

I've seen more people get unusable system because they forget their hardware encryption passwords it's hilarious :')

Conor Mancone

@ElieSaad That would be a good way to do it, although it's been a long time since I've had to grant remote access to my personal laptop.

@ElieSaad Yeah, if you have a separate admin password but forget it you are fine - there are plenty of ways to backup, and you can even just re-install the OS on top and reset the admin password that way without having to delete your personal data and configuration. Forget the password for your harddrive encryption though and you're completely screwed the next time you restart

reed

1:07 PM

At the moment, I have a strong password for HDD encryption, then a "normal" password for login (user). I have sudo with full privileges (common in desktop environments). In my next setup, I was thinking of separating privileges (that is, my user with almost no privileges, and admin/root for administration). Switching users should be done in some "secure" way (I guess with a "SysRq" key?)

The reason why I'd like separate privileges is to mitigate the threat of an infection, although I'm not sure if, instead of trying to mitigate it this way, I'd better just focus on mitigating it by using separate virtual machines for separate tasks

I'll have to think about it

Conor Mancone

1:47 PM

@reed You're talking Windows, right? With linux and mac you have to enter the admin password to do anything serious for a sudoers account, so comprise in a user account with sudoer access isn't any more dangerous than compromise on an only-user account, I think. However, I'm not sure if the situation is different for windows

As a result VMs are probably a more effective measure for protecting against viruses

reed

2:15 PM

@ConorMancone No, I use Linux. The problem is that an account with all sudo capabilities, no matter how strong the password is, is trivial to exploit to infect the whole machine. If privileges are separate and the admin/root account is accessed in secure ways, infecting the whole system requires a privilege escalation exploit. But as I said, I'm not sure if I'd gain much from this, also considering this well known "fundamental law" given by xkcd:

Before you say anything, no, I know not to leave my computer sitting out logged in to all my accounts. I have it set up so after a few minutes of inactivity it automatically switches to my brother's.

so maybe I'd better concentrate on finding a handy way to manage several VMs

Elie Saad

2:59 PM

Can I ask about your threat model? The tasks you're thinking of? Why not containers? Why not SElinux and separate users for the tasks at hand. "What" is going to infect the whole machine? Too many question marks, knowing that applications are sandboxed as well.

@ConorMancone a fun encounter with a lot of people, when asked what ticked them to learn security, was "I lost my root user, and I got locked out, it felt so nice getting it back".

MechMK1

@ConorMancone It's only on my work PC though. On my private PC it works

Same browser, everything

Conor Mancone

4:10 PM

Well this is a first for me...

0

Q: does cascading router increase security

My traffic goes trough 6 routeurs in cascade. Internet <--> Router lvl1 (192.168.1.1) <---> Rtlvl2 (192.168.2.1) <---> RtLvl3(192.168.3.1) <--> RtLvl4 <--> RtLvl5 <--> RtLvl6 (192.168.6.1) <--> My PC (192.168.6.2) Each router is of a different trademark with a different Firmware (German, american...

router firmware

MechMK1

4:21 PM

I just got 6 flags :D

Did someone flag me or did the Math chat get out of hand again

0

A: Chrome allow insecure localhost

It's most likely fine. There are a few situations in which you want to communicate with localhost using HTTPS - such as running a local webserver for web development purposes or some other service that offers a web interface. The way to do it "properly" is to generate a self-signed certificate, s...

Does that answer make sense and contribute something that Mike's answer doesn't? If not, I'll delete it again.

reed

@ConorMancone I might be wrong, but I feel that having lots of routers for no real reason is going to be useless. I mean, if the PC has no open ports, what are all the routers protecting? If it has one open port (say, 80), don't all routers need to forward traffic for that port? So I feel that multiple firewalls are useless

also because if the network stack is vulnerable, I bet you are going to be screwed anyway

A. Hersean

4:47 PM

If one router is vulnerable to an attack (as in the "synful knock" attack), a second one could either prevent it if it's before the vulnerable router, or prevent the attack to spread in the subnet's machines if the router is after the vulnerable one. Assuming they act as firewalls.

But it's a prevention against a very narrow range of attacks.

The routers, acting as firewalls, protects not just the computers in the subnet, but also the printers, IP cameras, crappy IOT things, NAS, etc.

Elie Saad

@ConorMancone loved the comment in there, brought down their whole security measures :p

Setting several systems for the same use case is most of the times a door for trouble, just like HTTP smuggling. Adding one more web server won't hurt

reed

@ElieSaad I don't know, infections in general, I'll have to think about that. Basically I believe that infections can happen, even to experts, because infections happen everywhere all the time. So it must be considered a threat, and some mitigations should be necessary

Elie Saad

Now having a WAF, followed by a load balancer, then by the web server is a bit different, as each is a different layer, and they shouldn't be playing on the same frequency (layer) so to say, but to do that you need an expert of each, and to have them sit together ....

@reed of course, but at what cost, and what does that cost present in terms of threats, of having easier time to manage your system, etc. Won't it make things a bit more complicated? Infections aren't just gonna do a 0-day and grab everything. If an infection happened, they'll need your password to do sudo measures, for example. Knowing what you're facing will help secure you, instead of just throwing rocks at it

Conor Mancone

5:29 PM

@MechMK1 Yup, I think it is a great answer

MechMK1

5:40 PM

Thanks

I expected a lot worse from the Math chat room :D

Conor Mancone

8:13 PM

I saw the chat flag icons but I missed the actual flags/comments themselves. Hopefully I'll catch up on the shenanigans of those math geeks next time :(

plonk

10:51 PM

Hi! I wonder if security.stackexchange.com/questions/241406/… is on-topic here or whether it should go to unix.stackexchange.com

reed

11:37 PM

@plonk, I might be wrong, but it doesn't sound like a security question. Not sure which community would be the most appropriate though

plonk

@reed I think unix sounds like it would fit. Maybe someone should migrate it there?

Transcript for