The DMZ

our president is anti-vax, he said he would not care if you took the vaccine and turned into an alligator, that you have to be responsible for your own safety if you decide to take it, and so on...

daya

Bangladesh and Mynamaar too

and many other countries

@ThoriumBR alligator? lol

yeah I had heard that news

here, situation is completely different, govt is even spending huge amounts of money in advertisement to ensure people that vaccines are reliable and safe

because many people were spreading rumours

and fortunately no negative effects of vaccines are observed till now

ThoriumBR

the worst case scenario on the vaccine is high fever and a trip to the hospital, and some long term effects... the worst case on the covid is death

daya

right

ThoriumBR

1:01 PM

and it does not help that some health workers here are pretending to inject the vaccine but don't... it was caught on video several cases of this, and a couple nurses are in prison because of that

and I am left wondering "why the heck someone paid to vaccinate you will stuck a needle on your arm and not press the syringe to give you the vaccine?"

giving an injection is as basic for a nurse as typing on the keyboard is to us

daya

@ThoriumBR that's very disgusting

ThoriumBR

and makes no sense

daya

I sometimes really wonder how China controlled the infection despite being the most populated country in the world, I mean the virus was originated from there and got spread all over the world

They never told anything properly to the world

ThoriumBR

they didn't... that's why it spread. and statistics lie. our own, China's, yours, every single statistic out there lies

daya

that might me true, as China have only 89k+ cases that's is simply unbelievable

Anonymous

1:16 PM

Relying on other people to complete projects is the most infuriating thing ever.

Anonymous

Just let me do everything, ffs. I know what I'm doing. I'd rather just go outside of my job description than wait around for people to stop being incompetent.

Anonymous

It is so frustrating.

ThoriumBR

@J-- it's something on my top-10 too...

daya

Hi J--

Anonymous

I don't even care if the task is outside my job description.

Anonymous

1:17 PM

Just let me do it myself. I don't care. I'll work extra hours if I have to.

Anonymous

I hate waiting for others when it is my project that it is essentially my fault if it takes too long.

Anonymous

And hey @daya long time no see

daya

yeah, It has been more than a year

how are you?

Anonymous

I'm good, thanks. A little stressed but other than that, okay. Yourself?

daya

I an good too, thanks

Anonymous

1:21 PM

Nice :)

daya

so, did you got the job as pentester?

Anonymous

Hah, yes.

Anonymous

I've been a pen-tester for... A year and a few months.

daya

Nice!

Anonymous

Heh, yeah. I didn't realise it was that long.

Anonymous

1:23 PM

Now I think about it, I did stop using this site once I became a pen-tester, really.

daya

hmm because of limited time

Anonymous

Yeah, also I kinda' lost motivation to write answers.

daya

I will try into some entry level pentesting jobs after completing my grad

Anonymous

What is your course on?

daya

B.Tech Comp Sci

Anonymous

1:28 PM

Ah, okay.

daya

Getting job as a fresher in security is too difficult here

ThoriumBR

and I am here, doing a course on encryption, and the material confuses the IV with the salt...

Anonymous

Well, just bought my OSED materials.

Anonymous

Time to spend every waking hour smashing stacks and getting frustrated by confusion.

daya

Almost all of them req. min 2-3 yrs exp

Anonymous

1:30 PM

I got lucky...

daya

Although I know development too but I am not much interested in that kind of job

Anonymous

Damn, that's annoying. I cannot start this course until 7th march at fucking 1am.

Anonymous

1am..

daya

but yeah you have to end up with something

Anonymous

I used to write code when I was younger. But not anymore, really.

Anonymous

1:32 PM

Too boring,.

daya

@J-- cool, yeah it is very confusing at starting, but it will become easier with time

Anonymous

Well, I already started studying for OSCE which was the old course.

daya

I did little bin exp before particularly protostar

Anonymous

I started studying for that ages ago. So I have a huge advantage. It has just been a while.

Anonymous

So, I've forgotten a decent chunk of the material. But whatever. I don't do anything except study anyways so I'll be fine.

daya

1:34 PM

yeah that' true, it happens all the time we tend to forget things

but it will take less time to recall

Anonymous

Yup.

Anonymous

I was going to do the OSCE but then they decided to update the course so I just decided to wait.

Anonymous

I've been putting this off a bit but I just bought it so.

daya

@ThoriumBR IV?

ThoriumBR

initialization vector

daya

1:36 PM

ah, okay

ThoriumBR

you use a random IV so you can encrypt the same data with the same key multiple times, and the cyphertext will be different

so if an enemy compromises one message, he have no way to know that a second message is the same. and helps make cryptanalysis more difficult... but that is no salting

salting is to hash, not to encrypt

Anonymous

That reminds me, my books should come today.

Anonymous

SO excited.

daya

@ThoriumBR are you really doing an entire course on encryption? I mean you could have just learned it from free resources available on internet

ThoriumBR

I have to complete the course to be able to take the test that I am sure i will pass without the course

Anonymous

1:40 PM

I'm assuming he wants to learn it on a more mathematical level...

ThoriumBR

so I let the video playing on mute and background, and skimmed the presentation only to see what they are talking about

and realized I will HAVE TO study the presentation to learn the misconceptions that surely will be on the test

so if they call the IV "a salt", that's what I will have to answer

daya

@ThoriumBR ah, so is it your current job requirement?

ThoriumBR

it's not math level, it's the high level concepts: what's a key, what's cyphertext, who built enigma...

Anonymous

Oh right.

ThoriumBR

it's for "corporate credits"... and to be able to put "cyber security l33333t master" on my mail signature

daya

1:44 PM

ah

That's annoying but yeah you have to do it to become 1337 haX0r

ThoriumBR

I usually let the videos play on the back, put a reminder for getting the last 20 seconds so I can click next, and go to the test. If I score 75% or less I have to retake the test (I have 3 chances), so I would watch the videos, but the last 5 courses I didn't even needed the material

it's annoying for us, but the management have to know who knows what, and those nonsense (for me) is necessary. I cannot "self certify" that I know a lot on security, and they need some way to evaluate that

daya

totally agreed

ThoriumBR

so when a project demands a security analyst, they look at their tables and select the l33t hax0r that is available

daya

that's just happens literally everywhere

ThoriumBR

sometimes I can go straight to the test, but some don't and I have to do that...

daya

1:48 PM

they judge you by certs

Anonymous

^ welcome to management in cybersec

Anonymous

and most fields...

ThoriumBR

judging by the certs isn't the best way, but it's more accurate than judging you by your resume

Anonymous

Yeah, unfortunately it is hard to find a balance.

daya

same with me, few entry level jobs I see require CEH and I really don't want to do that useless expensive cert

Anonymous

1:50 PM

Judging only on certs for example is a disaster waiting to happen.

ThoriumBR

one guy here in Brazil put "Minister of Something" and got a job at a master's course...

Anonymous

But not judging at all on certs is equally as bad.

Anonymous

Finding a middle ground isn't an easy thing at all.

ThoriumBR

I like the "this is the requirements. what would you do" type of test

you will be a pentester? I will give you an IP address, and a week. reach me next week with a report...

Anonymous

Personally I think a layered approach is good.

ThoriumBR

1:52 PM

you're a infrastructure engineer? I need a webserver, database, analytics, firewall, and that's the credentials for our aws account. use as much as you need...

daya

yep that's how hiring should be done

Anonymous

Conversation -> Technical Questions -> Technical Assessment -> In Person interview.

daya

but that rarely happens

ThoriumBR

and use the creds to judge if you will take seriously the guy applying

Journeyman Geek

lol

Anonymous

1:52 PM

It is a long process, sure. But it is fair.

Anonymous

@ThoriumBR Exactly :D

Anonymous

Of course, no stage should be the end all or be all.

Journeyman Geek

you may never actually talk to someone with real technical skills until you get hired

Anonymous

If you fail the assessment it doesn't mean you should never get the job.

Anonymous

But I think it is an important part of the process.

ThoriumBR

1:53 PM

there is a certification company named brainbench, it had a "all you can eat certifications this month" once...

Anonymous

Coming from a network engineering background, the amount of cheats that run rampant.

ThoriumBR

I took like 14 certs in a month...

Anonymous

An assessment is super important.

ThoriumBR

I even got a master certification in Portuguese!

it's even on my resume...

I had a manager that said "certification means you can pass a test, your resume means you can write about, but if you talk to my engineers and they will know if you are lying"

daya

@ThoriumBR lol I just realized Brazil's national language is Portugese

Journeyman Geek

1:55 PM

You didn't think it was spanish I hope

ThoriumBR

the company said "you need x certifications", so I got those... they didin't told me obvious ones would not count...

daya

Whenever I heard of portugal it's always associated with Ronaldo

(not a huge fan of football)

ThoriumBR

everyone thinks we speak Spanish... on the Americas, except of the US, Canada, Belize and 2 Guianas, everyone else speaks Spanish

daya

@JourneymanGeek I didn't

I thought it was "Brazillian" lol

ThoriumBR

so there's like 25 Spanish speaking guys, and Brazil and 3 countries nobody knew about, and Canada and the US that I assume people know about...

we are the largest Portuguese speaking country in the world, and people from Portugal get mad when you have to select the language on any site and the Brazilian flag is there, not theirs

I assume the Englishmen feels the same with the US flag

I saw once a joke:
<British Flag>: English
<US Flag>: English, simplified

daya

1:59 PM

lol

Anonymous

lol

daya

In India there are 22 different languages and every state has their own language

Anonymous

^ password cracking must be a nightmare...

ThoriumBR

the wordlists should be huuuuge

daya

@J-- yep, standard wordlists don't work

Anonymous

2:02 PM

Figures :D

daya

basically languages change every 10-20 kms because of so much diversity

19500 dialects

but majority of people speak and understand Hindi

(at least in North)

ThoriumBR

2:17 PM

"performance increased of up to 2x"
increase against what? "up to" means nothing. I can say I will increase my productivity "up to 2000%" and increase 0.0001% and be correct

Journeyman Geek

3:31 PM

@J-- tbh, most people don't have/use native keyboards

I use transliteration for typing in tamil usually

Anonymous

Oh.

Anonymous

I didn't know that.

Journeyman Geek

they exist but there's like

4-5 different standards...

for tamil keyboards

before ~~ASCII~~ unicode was common, you'd even have specific fonts for specific systems

en.wikipedia.org/wiki/… was the 'first' standard I guess

ThoriumBR

interesting...

nobody

3:58 PM

@JourneymanGeek That actually complicates things even more. Because you can transliterate the same thing in multiple ways.

daya

@JourneymanGeek yeah but for passwords only English characters are accepted AFAIK so a huge wordlist can be used

Journeyman Geek

@daya that in theory is an artificial restriction

and would kuthraibaatriserisulaani be better than "horse battery correct staple"?

(well a sulaani is a small nail but I can't remember proper tamil for battery or staple)

daya

@JourneymanGeek definitely yes

Journeyman Geek

or since yanno its modern times...

an on screen keyboard?

daya

so you are south Indo-Singaporean :P?

Journeyman Geek

4:11 PM

culture, language and country can be somewhat of a mix :D

daya

yep

Journeyman Geek

I mean within say the tamil culture, there's regional, religious and other variations

which may reflect in spoken language

the same is probably true of other linguistic groups

daya

Yep, that's just everywhere in India, different dialects

Anonymous

5:24 PM

Well, OSED course locked in.

Anonymous

7th March @ 12:00am.

Anonymous

60 days of pure pwnage required by me, heh.

Leif Willerts

5:36 PM

@J-- Yup, you found the real argument against European-style language standardization academies: they make people's passwords easier to guess :D

Anonymous

@LeifWillerts :D indeed!

ThoriumBR

5:58 PM

that's why I use a password manager

or I could mix English, Portuguese and Spanish words... take that, bruteforcers

English words, Spanish pontuation and Portuguese diacritics...

Fire Quacker

6:40 PM

I know a person who trained his dog to respond to commands Cherokee, just in case

Anonymous

7:19 PM

I am reading through the syllabus for the OSED and I am scared. There is SO much content.

Journeyman Geek

@FireQuacker something like that is a plot point of person of interest

ThoriumBR

8:09 PM

@J-- better than "I am paying so much for THAT?"

Anonymous

@ThoriumBR Hah, true :D

Anonymous

I am going to have to study really, really, hard for this one. Just based on how much content there is.

ThoriumBR

your brain will enlarge a little after that

Anonymous

I hope so :d

Anonymous

I get my materials in like a week so I have some time to mentally prepare

Anonymous

8:12 PM

and prepare in general..

Anonymous

8:32 PM

Wow this conversation I'm reading hurts my head...

Anonymous

SO much.

Anne Batch

11:01 PM

Hello everyone

Transcript for