The DMZ

Conor Mancone

01:40

I'm having trouble tracking down a question for a friend! It is the one where someone is stuck arguing with a (PCI?) Auditor who is just a moron.

The auditor wants him to provide a list of user passwords so that he can determine if they are sufficiently strong, wants access to machines, etc... The person asking the question had previously refused and the auditor is accusing threatening to "fail" and says it is because the OP doesn't know what he is doing and doesn't know how to provide these things, and is using "security" as an excuse. Ring a bell for anyone? It may not be on security.stackexchange.com..

ThoriumBR

tell your friend to ask the auditor where in the PCI certification rules is that he needs to provide the passwords

and it the auditor insists, report him

MechMK1

01:54

2407

Q: Our security auditor is an idiot. How do I give him the information he wants?

A security auditor for our servers has demanded the following within two weeks: A list of current usernames and plain-text passwords for all user accounts on all servers A list of all password changes for the past six months, again in plain-text A list of "every file added to the server from re...

@ConorMancone Enjoy

Conor Mancone

10:52

@MechMK1 Thanks!

My friend took a job with the US government (the military even) as a researcher (his training is in aeronautics), and it is making him miserable

He's been there for 5 months and has gotten nothing done because the IT team has things locked down so badly in the name of "security" that he literally can't work

For context, his researches focuses on space equipment, orbits, etc... and the work computer they gave him came with Microsoft Word and Outlook. "Sure boss, let me get that for you, Microsoft Word is the perfect tool for calculating orbital intersections!"

He requested some software he can use to do actual work 5 months ago and still hasn't gotten it

The thing that really ticked him off is when the IT guy told him that it was safer to use Wifi than ethernet, and that ethernet should be avoided at all costs.

At that point in time he called me and was like, "Either this dude is crazy, or I'm crazy, and I need to know which"

He wanted to know what he could say to convince the guy that he's a moron, to which my answer was, "Nothing you say will ever convince him that he's wrong", and I wanted to send him that article

Only in the government...

MechMK1

11:16

@ConorMancone Unfortunately, you are correct

People who have unreasonable opinions cannot be convinced with reason.

Also fun fact: I memed too hard and got kicked off twitter yet again

Conor Mancone

@MechMK1 meme's are dangerous. I'm sure Twitter made the right call :)

Gina Carano memed too hard and got kicked off of Star Wars finally

theverge.com/platform/amp/2021/2/10/22277540/…

These things will always bug me. If I can enjoy movies that have Gweneth Paltrow in them without asking for her to be fired for the ridiculous things she constantly says, then there really isn't any reason to fire Gina

MechMK1

Wasn't she the one who said "I believe nothing natural can ever harm you"?

Gwyneth Paltrow's Goop - JonTron

►

Oh yes, that ___t

Conor Mancone

11:32

If she was saying these things on purpose she would have the best standup act ever

google.com/amp/s/amp.news.com.au/entertainment/celebrity-life/…

Normally I would caution that it is easy to take things out of context for articles like that, but when they are so many that are so bad, the only real conclusion is that the person is completely out of touch with reality

But hey, what do I care? She played Pepper Potts well and I don't have to talk to her in real life

MechMK1

Wow, she really is a cunt

I don't even need to censor it now

Conor Mancone

You come across (online comments) about yourself and about your friends, and it’s a very dehumanising thing,” she said. “It’s almost like, how in war, you go through this bloody dehumanising thing and then something is defined out of it

MechMK1

Yeah "almost" carries the whole fucking sentence

Just how taking a shit is almost like performing a brain surgery

These two are not connected in any way, but they're like almost the same

Conor Mancone

Lol! This is the only way a Friday should start - with lots and lots of laughing

MechMK1

I call someone a cunt and suddenly the people rush to the DMZ :D

But no seriously, she's just as much a rich cunt like paris hilton

Who claimed that her name "never gave her any advantages" and that she's "made it all herself"

Who also made such insightful comments as "Stop being poor"

I swear to God if these people would just collectively shut the fuck up for a decade or two the world wouldn't be worse off

Conor Mancone

11:39

I apparently missed Paris Hilton when she was a thing, and it doesn't sound like I missed anything important.

Alas, I have a 2 year old demanding my attention...

MechMK1

Enjoy!

reed

@ConorMancone That's very weird. Isn't there a supervisor or someone they can complain to? I thought the US military was supposed to be very efficient, pragmatic, cool like I see in movies. The situation you described would be typical of my country, not yours, LOL

MechMK1

@reed See marieclaire.com/beauty/a35350683/…

This is a trend I see so often in the modern world:
"I want to be part of this, but I hate how it is, so I want to change it"

I see it in video games, I see it on TV shows, I see it in manga and anime...

For example, american studios bought the rights to some japanese anime and simply changed the whole fucking script because they didn't like the original script

Left is the original translation, right is the "offical dub"

For context: Lucoa was walking around like this before:

reed

@MechMK1 That's understandable, I guess that has been true in every context in human history

MechMK1

This has nothing to do with translation or localization (e.g. rephrasing something so that it becomes understandable for someone outside a culture). I have no problem with 巫女 being translated as "priestess", since that will make it easier to understand for people who know nothing about Shintou

@reed I'll use MOBA games as an example: I really like the idea of them, but I know I don't have the time or patience to play hundreds and hundreds of games which I know I will lose and not enjoy in the slightest before I can expect to even begin enjoying the game.

Imagine if I would sign up to DotA or LoL and demanded them to change the whole fucking game just to appeal more to me

No, just no!

Because if I am honest, I don't enjoy MOBA games. If I did, I would just play them. I enjoy the idea of being good at MOBA games.

And so I would demand them to change the game and water it down so that anyone who doesn't want to put in the effort to get good could "be good"

But you wouldn't be good at MOBA games, you'd be good at a game which desperately tries to keep the skill ceiling so low that people who would be willing to spend hundreds and hundreds of hours to get good cannot get better than those who just play casually

And that's a game that is doomed to fail!

That's why Chess is held in high regards, and Snakes and Ladders is not.

If I hate how MOBA games are, then I should not play MOBA games.
If I hate how Kobayashi-san no Dragon Maid portrays Lucoa, then I should just watch something else.
If I hate how being part of the military requires me to stop being a beauty queen, then I should just not join the military.

reed

11:54

I'm not saying if it is right or wrong, I'm just saying that I believe such phenomenons have always existed, that is, people trying to change what they don't like. Sometimes even in ridiculous ways, other times even using violence, etc. Sometimes things will improve, other times will be ruined or destroyed.

MechMK1

There is such a vast cultural variety out there, infinitely many ideas to be explored, and yet people cannot focus on what they enjoy and instead need to focus on what they hate.

@reed It is just a completely pointless endeavour

You saw it happen to Star Wars too. How many people do you know who have good opinions of the sequels?

Wait, this reminds me of a comic

Journeyman Geek

@ConorMancone Sounds like gov IT :D

MechMK1

If you join a "space" and your immediate first reaction is a desire to change that space, then perhaps you should just find a different space. Not just for the sake of the people who are already comfortable with that space but also for yourself. Actually, changing something that many people already enjoy, just for the sake of you being able to enjoy, is an incredibly selfish act. It implies that your short-lived whims matter more to you than the long-term enjoyment of everyone else.

Journeyman Geek

@MechMK1 In my experience...

Quite a lot of the time, those people don't join the space at all :D

MechMK1

@JourneymanGeek And that's okay.

Journeyman Geek

12:00

then want it changed. Like twitter :D

MechMK1

That's not okay anymore

Journeyman Geek

That said points at the no vulgarities rule on SE :D

MechMK1

Ah, rules, schmules as I say :D

Journeyman Geek

Q-bert doth approve. TPTB doth not.

AH, but see, you're expecting the way things work to adapt to your worldview

:D

MechMK1

I'm trying to behave

Journeyman Geek

12:02

Then some guy who just found search flags you SIX MONTHS LATER

(this totally happens)

MechMK1

I don't know for sure, but I have a suspicion that out of all the people who regularly join the DMZ, I am the one who was suspended the most often

And yes, I know - it even happened to me

The chat even asked me to rate the validity of my own flags

Naturally, I agreed :D

Journeyman Geek

:D

Good! So if anything happens its your fault :D

MechMK1

It always is :D

reed

English language: you can't say the C-word, yet you can say "country"

Journeyman Geek

It is... classic

reed

12:04

this doesn't happen in other languages (not in mine at least)

MechMK1

Same thing in German. You can't say "Arsch", but you can say "Nachbarschaft"

reed

that is, if there is a really bad word, you won't find other common words that include it

MechMK1

Or "Barsch"

There is also "sniggering" and "niggardly"

Which both are completely benign words

reed

I suppose this is more likely to happen in languages that have less syllables in each word. Mine has more syllables on average

MechMK1

"Word" is a difficult concept in German, since you can just chain them to gether

"Nachbar" (neighbor)
"Nachbarschaft" (neighborhood)
"Nachbarschaftsstreitigkeit" (neighborhood dispute)
Continue ad infinitum

Journeyman Geek

12:08

"That's a 500 page complaint!" "Volume 1....its one word.... there's another 200 in the truck"

MechMK1

"I tried to keep the word count low"

If you wanted, you could structure a german sentence in a way that it becomes virtually unreadable. Which is why "word count" is...a dubious metric at best

Like Lines of Code, actually

Conor Mancone

12:27

@reed he had to escalate quite high up the management chain before he finally got someone with authority to come tell the IT department "just do [this one thing that only solved part of his problems]". Sounds like IT guy was grumpy about it but agreed (but hasn't actually done it yet)

He says there are two kinds of people at his office: those who cave to the demands of IT and have very little productivity as a result, and those who break the rules, get stuff done, but introduce real vulnerabilities as a result. Fun times!

MechMK1

AviD's Rule of Usability

nobody

0

Q: Are the any computer malware or spyware that need a system reboot so that they can function properly?

Are there any malware, or spyware that needs a forced system reboot to work correctly? Because whenever a major security update or release for Windows comes out, or if I zero out my disks and install a totally fresh copy of Windows, there is always a power cut where I live. To me, it seems someth...

malware operating-systems spyware rootkits

How more paranoid can you get?

MechMK1

I recommend building fresh hardware from scratch every day

nobody

Yeah and don't forget that you have to use freshly mined silicon for it

Otherwise, all your efforts are futile

Journeyman Geek

@MechMK1 from silicon you mined, smelted, purified and fabbed yourself...

out of designs you yourself made

MechMK1

12:40

That is true

Or you know, just stop this computer nonsense

Journeyman Geek

resistors are sus, wind your own out of wire you mined, purified and drew yourself

@MechMK1 WHAT ABOUT MALICOUS CODE IN MY JAQUARD MILL?

nobody

@MechMK1 Ah that's a way more viable option

MechMK1

Yeah, just don't computer

Journeyman Geek

@schroeder Yeap, the power cuts happen only when I clean install an operating system (like after zeroing out the drive and installing everything fresh) or if I receive a major security OS update. That is why I am suspicious. — JackBixuis 6 mins ago

MechMK1

Computers were a mistake.

Journeyman Geek

12:41

I invoke michens.

nobody

@JourneymanGeek What's that?

Journeyman Geek

usenix.org/system/files/1401_08-12_mickens.pdf

3

Yes, its a PDF. No, I don't know if there's a better format. Yes, its worth it

> I cannot live my life in fear because someone named
PhreakusMaximus at DefConHat 2014 showed that you can
induce peanut allergies at a distance using an SMS message
and a lock of your victim’s hair.

> If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them.

nobody

@JourneymanGeek Lol, love this.

Journeyman Geek

If you have an adversary powerful enough to turn your power grid off and on, so you don't reinstall...

they're showing off

MechMK1

Ah yes, the Mossad

Journeyman Geek

12:45

If they wanted to read your data, they'd just stick a chip in your eyeball when you're awake.

MechMK1

One of the few organizations that can just openly murder people and nobody cares

Journeyman Geek

@MechMK1 they do do it with a little more style than say, the saudis.

@MechMK1 TBF - they also WANT people to know it was them in lots of cases...

(also. that's a work of humour, lets take it for what it is ;) )

MechMK1

Oh yes, it's true

The good thing is my brand is so established, I don't even need to say what I want to say - it's all implied

Journeyman Geek

Or more precisely - there's threats your security model cannot actually be expected against

Like invisible pink elephants.

MechMK1

I'm honestly a bit disappointed in fedposts recently

Like a dude in mask posting "It's time we get Trump back into office. Grab you guns and meet me at <place>

Like...do the feds not have a better budget or...?

Journeyman Geek

12:53

hmm

Something about goldfish in small wooden casks...

MechMK1

At least the McDonald's advertisements get better

Journeyman Geek

Mythbusters - Shooting Fish in A Barrel

►

Here's a perfect example....

reed

14:01

@nobody It's actually easy to power off a machine, without hacking the power grid. You just need to disconnect the wires that lead to the target building, or pay someone to do so.

that question was insane though

Journeyman Geek

14:16

....

It got worse

@reed pay a kid to walk over to the power meter and flip the breaker. :D

MechMK1

15:10

-1

A: How can I give users access to thier data without requiring any authentication?

Either you base64 the dir for the text (Authenticate) Or you chrgrp and chmod the dir for the accessibility (Authorization)

The fuck are people smoking

Fire Quacker

15:22

@MechMK1 It's got to take talent to be wrong on so many levels

MechMK1

Just chmod for accessibility, jeez

It's so obvious

Conor Mancone

16:18

@MechMK1 lol!

It's true though - if you chmod your web directory to 000 then your data will be secure

MechMK1

@ConorMancone Unless my web server running as root is compromised

nobody

@ConorMancone But you get zero accessibility ;)

which is what OP says we should use chmod for

ThoriumBR

I just discovered I was the victim of identity theft... someone got my data from a HUGE leak (200M identities leaked from Serasa Experian), and opened an account at a bank

I was browsing the news and saw something about a service from our central bank that monitors when people open an account with your data, got there to check and they had one

I called the bank, asked them to freeze the account and got to the bank. fortunately they had just activated the account and did nothing else. no money borrowed, no credit cards issues, no cheques, nothing. they closed the account and banned the cell phone used to access the bank app.

MechMK1

16:37

Nice

Well, as nice as things can be in this situation

ThoriumBR

but I discovered that there's an account in another bank opened 8 months ago in my name too, and I will have to get there on Monday...

reed

17:25

This is the most difficult question ever here

0

Q: Cause I am Curios Frame - Segment is Preflight=Obj+Header

How Linux knows the pre-sequence numbers/checksum and segment \br For Example : \x6f\x70\x3d\x50\x41\x4d\x3a\x61\x75\x74\x68\x65\x6e\x74\x69\x63\x61\x74\x69\x6f\x6e\x20\x67\x72\x61\x6e\x74\x6f\x72\x73\x3d\x3f OS App/Segment - Network/Fragmentation/Seq You see they are seq, to raw(IP) fragmentat...

network-access-control chacha20

I wonder if anybody has any idea what he's talking about. It almost looks like bot-generated gibberish to me

Note he's the same guy that MechMK1 said must be smoking something good

MechMK1

19:40

Fucking hell

Transcript for