« first day (3726 days earlier)      last day (1154 days later) » 

10:04 AM
I have not used Kali's DE for a long time, I just use i3 wm which is very lightweight as suggested by forest a long time ago here
 
 
5 hours later…
Anonymous
3:02 PM
@daya Meh. I spin VMs up and down a lot. I have a laptop specifically for hacking which isn't running Kali. But I am using my main host for this course so it was just easier to spin up a Kali VM in all honesty.
 
Anonymous
Since it is a Windows Userland course anyways, I'll mostly be RDP'd into Windows boxes so it doesn't particularly matter what I use.
 
4:50 PM
@J-- I was too talking about VM only
@J-- Hmm, makes sense
 
Anonymous
I mean, yeah I could use something way more lightweight than Kali. But as I said, most hacking I do is on a laptop which isn't running Kali anyways.
 
Anonymous
But for this, way easier to use my main PC.
 
Do you guys really find kali useful? Or is kali mostly a script kiddie thing?
 
Anonymous
It is just fast.
 
Anonymous
It has almost every tool you could possibly need. So that is useful.
 
5:01 PM
@J-- lol, I think there is miscommunication, What I said is I use Kali but with a wm and not with the default DE
 
Anonymous
But in general, I don't use it often anymore. When I first started, I used it.
 
Anonymous
But these days, not so much. I have a hacking laptop which runs a different distro with tools built into it.
 
Anonymous
My work machine has a VM of the same vain... My main PC the same, just use a variety of different VMs.
 
@nobody Not strictly required for hacking but yeah most people use it
 
Anonymous
The only nice thing about Kali is that you can spin it up in like 5 minutes and have every tool you could really need.
 
5:03 PM
yeah there are just 12-15 most used tools I guess
Otherwise there are hundreds of tools which are never really used
 
Anonymous
Yeah, there are a lot of tools which you'd never use. Hence the reason I don't run it on a dedicated machine.
 
Anonymous
Totally inefficient.
 
yup nobody runs that on a dedicated machine
most people use VM or in just live mode
 
Anonymous
Yeah, but honestly.
 
Anonymous
This community focuses FAR too much on what tools they use.
 
Anonymous
5:08 PM
"Oh don't use that OS use this "
 
Anonymous
"dont use that tool use this"
 
Anonymous
It honestly doesn't make a difference.
 
Anonymous
Using ubuntu with tools installed over Kali won't make you a better hacker.
 
Anonymous
It doesn't mean anything. It is a totally meaningless argument to have.
 
true, You can do hacking on a server running any Linux variant with just tmux installed and no GUI at all
 
5:09 PM
When I first got interested in security and stuff, a couple of people told me that I should totally install kali if I ever wanted to hack anything. Its the first step for every hacker. So I installed it on a separate partition. And then quickly figured out that all this hype about kali was just because it was easy to copy paste stuff from the internet on it
Which wasn't what I was interested in doing
 
Anonymous
Yeah this is the thing nobody, everyone will tell you something different "use this", "no you should use that because of x reason".
 
Anonymous
End of the day, use what OS you like, use what tools you like, focus on your skill not your tooling.
 
Anonymous
I really hate this whole notion that you need to use X thing to be hacker. Pure nonsense.
 
And now I see that most of the tools can actually be installed on windows too
 
Anonymous
It takes away from what is actually important which is your brain.
 
Anonymous
5:11 PM
Yeah, they actually can!
 
Anonymous
Not that I recommend Windows for all this, but with WSL enabled it makes it very plausible to be on Windows.
 
@J-- Anybody who says that I automatically assume is a skiddei now
 
Anonymous
Says what?
 
You need X to be a hacker
 
Anonymous
Oh right, yeah.
 
Anonymous
5:12 PM
Yeah, it is nonsense.
 
Anonymous
This community is filled with purists and elitists.
 
Anonymous
Which is why people are STILL having this meaningless argument on what tools to use.
 
Anonymous
5:29 PM
Question: does anyone else believe/agree that to be a parent you should have to get a permit (per child) from an independent, non-profit organisation/federation with elected members via a series of parental skill assessments, mental assessments, financial assessments and any other assessments which would have a bearing on ability to parent?
 
Anonymous
In-fact, would be really interested to know your opinion @forest since you know, you're actually a parent.
 
5:47 PM
@J-- You mean you want to make choosing to have your own kids illegal? Well, what if this organization ends up having a disproportionate number of extremists/racists in it? People who think only their own race should live on. I mean if you give someone the power, eventually it will be abused.
 
Anonymous
I don't want to make it illegal. I want a due process that can hopefully be used as a way of preemptively preventing cases of abuse.
 
Anonymous
I am WELL aware that power gets abused which is where I have a massive dilemma. I hate limiting personal freedoms. But this is the one time where I feel like there needs to be this kind of system.
 
Anonymous
In the current system, unless abuse is reported the child is assumed to be looked after. There are simply not enough resources to check on every child.
 
Anonymous
That is a TERRIBLE system. In that system the only person who can really report the abuse are the people doing the abusing.
 
Hmmm... makes some sense. But I'm not a fan of giving the governments the power to selectively breed their population. It won't end well.
 
Anonymous
5:52 PM
Not governments, no. Absolutely not governments.
 
Anonymous
Governments should have zero involvement in my idea.
 
Eventually, it will be governments
 
Anonymous
Yeah, that is my fear.
 
Anonymous
Which is exactly why this is so tough for me to try and... Think about. Or how to avoid that or what to do.
 
Anonymous
The current answer is our current system which is... Do nothing until we know it is happening. This is not a sufficient or fair system.
 
5:54 PM
Plus your system will probably not stop all abuse anyways.
 
Anonymous
Of course it won't.
 
Anonymous
The law doesn't stop all crime.
 
Anonymous
We still have it.
 
Anonymous
The police don't stop all crime, we still have police.
 
They only stop the crime they want to :)
 
Anonymous
5:55 PM
Sure. I don't disagree.
 
Anonymous
But your comment is suggesting that there is no point doing it because it won't stop all abuse, which while I cannot disagree with it. It is not a decision I can accept as being the correct one.
 
Anonymous
If your comment doesn't suggest that, my apologies. Just how it reads.
 
Anonymous
Also as a side note to this...
 
Anonymous
Do you think this solution would be more... Commonly regarded IF genocides similar to the one from the Nazi party didn't take place?
 
Anonymous
You mentioned one of your reasoning's as being racism, I assume that also includes xenophobia, etc. So... Perhaps that is why I don't see much around "my" idea.
 
5:58 PM
@J-- Yup
@J-- Well, I just don't like this because of my perception of current governments
 
Anonymous
Oh, I totally understand that.
 
Anonymous
I myself totally distrust my own government (and many others). I often do not feel safe in my own country because of my government, I fully understand that viewpoint. It isn't something I could disagree with.
 
Anonymous
I also cannot disagree with you that eventually it would likely end up government controlled or influenced. It could also lead to more abuse... I mean, look at the BBC and the childrens programs that they kinda' kicked off in the UK.
 
Anonymous
All that did was get pedophiles to become children's presenters. It created a situation for abuse. A system like this could very well do that in a similar vain.
 
Anonymous
But I also cannot allow myself to believe our current system is a better one.
 
6:01 PM
Yeah probably it isn't
Maybe we should educate people to be better parents instead?
 
Anonymous
Agreed. My system would include something like that.
 
Anonymous
But it would have to be mandatory because if not then the abusers would never show up.
 
Yeah
 
Anonymous
I also believe that is a very good solution and something as society we should absolutely strive for.
 
If you can make sure your system will never be abused, I will go with it :)
Otherwise no
 
Anonymous
6:03 PM
Unfortunately, I think such a requirement is unlikely to ever be met.
 
Anonymous
As with most things in this world. Governments have such a tight grip on everything by now... We're too late to be free of them.
 
Wait, I have to do some work. I guess I'll back in 15 mins
 
Anonymous
Okay :D
 
8:35 PM
Hey
How's it going?
 
Anonymous
Hey.
 
Anonymous
I am getting destroyed at chess.
 
Anonymous
I've been playing this game for a month and I genuinely cannot improve.
 
Anonymous
I just don't think my brain is designed for pattern recognition.
 
Anonymous
Anything which involves this kinda skill I am like a 3 year old child
 
Anonymous
8:41 PM
How about you?
 
I'm sure you'll improve
Getting better at Sudoku
Learning techniques like directed pairs, naked pairs, hidden pairs, etc...
 
Anonymous
Nice. See, I keep doing puzzles because it is arguably the fastest way to improve at pattern recognition.
 
Anonymous
I can solve puzzles at like 1100 elo but as soon as I play a game, even at 600-800 elo I get fucking stomped.
 
Anonymous
It is really quite frustrating.
 
Anonymous
I want to do more sudoku as well, fun game.
 
8:43 PM
I love how those "pattern recognition puzzles" are 75% just XOR
 
Anonymous
Yeah, they are pretty easy until like 1000+ elo. They become a lot more challenging then.
 
Anonymous
I just struggle to play vs other people so much. They make one good move and I just confuse myself with patterns.
 
Anonymous
Its odd because I have supposedly a freakish memory.
 
Anonymous
But not when it comes to thijngs like this
 
Anonymous
apparently.
 
Anonymous
11:19 PM
How I feel when studying anything cryptography related -> youtube.com/watch?v=3Fn36l_z3WY
 
11:37 PM
@J-- No. That's a great way for any powerful actor to influence who gets to have children.
 
@forest If you're [part of a group you dislike], you just lack the skills to be a proper parent.
 
Anonymous
@forest Yeah, that is probably the biggest argument against such a system. The one I resonate with the most, anyways.
 
It's a necessary evil to let people who suck raise kids.
 
Even if you don't want to act maliciously, you already see how fucking biased everyone is.
 
Anonymous
@forest Yeah, feels that way... Makes me sad though.
 
11:41 PM
Also
3
A: Recovery of EEPROM data after bulk erase operation

b degnansummary If you decap the dies, you can. The pads exist but are not bonded but available. The reason that you can get the information is that the timers that are used to inject and tunnel the floating gates do not push the data hard against the voltage rails. If the hardware supported a "tunnel...

 
Anonymous
Such a great system.
 
This is awesome. I can't believe I got such an authoritative answer.
tl;dr empirically tested: flash memory can be recovered after erase.
This may include HDD/SSD SED, mobile device TEE, TPM secrets, etc.
 
Anonymous
Wow.
 
Anonymous
That's fucking awesome.
 
Anonymous
Not to mention that it took over a year to get the answer, that must feel nice :D
 
11:42 PM
Same
Holy shit what a great answer
 
@J-- A guy from The Side Channel (Crypto.SE's chat) who has a PhD in electrical engineering and works with this sort of stuff gave the answer. It an amazing stroke of luck.
Not many people actually perform a test in a legit laboratory to answer a question on SE.
2
Especially not a question so relevant to information security.
 
Anonymous
This community really has an insanely high knowledge ceiling. It never fails to amaze me.
 
Anonymous
Just so impressive.
 
I don't often give bounties, but I think I'll give a big one to this answer.
 
You mean you don't write a thesis on every answer you write, just to get 1 upvote and not even an accepted answer?
Pfffff, plebs really
 
Anonymous
11:44 PM
And testing something in a lab to answer a damn question is just :D
 
Anonymous
@MechMK1 HAHAHAHHAHA :D
 
1 upvote and a comment from op "thanks"
 
in The Side Channel, Feb 23 at 2:19, by b degnan
btw, Forest, I'm going to see if I can get an answer for you for infosec from a FLASH IC that I have here. I'll see how long I have to tunnel it until I cannot see the offsets.
Simple as that.
 
The man has connections
I'm just a shitposting pleb in comparison
@J-- Also that one question from yesterday made it to HNQ
 
Anonymous
Every community requires shitposters and very smart people alike, Mech :D
 
Anonymous
11:46 PM
Heh. I figured it would. Was a good question!
 
I know exactly which category I belong to
 
Anonymous
Did anyone give a decent answer yet? I guess they did.
 
Anonymous
lmfao :D
 
Rare picture of MechMK1 pentesting a web application
 
Anonymous
11:47 PM
Hahahahahaha :D
 
Anonymous
Surely if it was a web-app in that photo there would be an additional set of shapes in-front of it, you know, the WAF.
 
Anonymous
Not sure about you but, these days every website I test has fucking Cloudflare.
 
Nah, we ask them to disable that shit
Otherwise it'd get too complicated for me
 
Anonymous
We mostly have it off.
 
Anonymous
But sometimes people refuse.
 
Anonymous
11:50 PM
That makes me so mad.
 
Anonymous
Running a fucking scan with 2 threads.
 
Anonymous
spits
 
CF is good in theory.
They promote very strong cryptography (they actually care about how long session tickets last!).
But the real issue is that they're so damn centralized.
 
@forest True
 
Anonymous
CF does protect against a rather vast array of things. Just very annoying to test a site when they won't turn it off.
 
11:51 PM
Just recently I saw a customer who had TLS 1.3 enabled
Fucking surreal
They had only a very limited set of ciphers enabled
 
Well TLS 1.3 only has a limited set of ciphers, period. They did it intentionally.
 
Anonymous
But soon I will be rid of sites!
 
Anonymous
I cannot wait.
 
Anonymous
60~ days till I don't have to pretend to care about web app security.
 
A couple of AES ciphers (GCM and CCM, I believe), and ChaCha20-Poly1305.
And only like one curve for ECDHE (I think), and some fixed groups for "legacy" DHE.
 
11:52 PM
Yup
 
Anonymous
I really like CFs captcha system!
 
And ECDHE
 
Anonymous
That is super nice.
 
Anonymous
Super useful.
 
CF's captcha (ReCaptcha) sells that info to the US military.
 
Anonymous
11:53 PM
That is less good.
 
Anonymous
But from a security perspective.
 
Allows them to work on autonomous drones that can target people without human input.
 
Anonymous
Having that available to you.
 
So we internet people are part of supervised ML training to create a set of billions.
 
Anonymous
Is super nice.
 
Anonymous
11:54 PM
Like we had an issue with a login endpoint getting smashed because we didn't implement captcha ourselves
 
Anonymous
but we paid for cloudflare so literally just turned it on, setup the redirect on captcha success
 
Anonymous
30 second fix. No code required.
 
> Please mark all the squares containing enemy combatants.
 
Anonymous
^ lmfao :D
 
They also have the potential to do heavy biometric fingerprinting.
If they don't do that already.
 
Anonymous
11:56 PM
@forest Are there any services left which aren't being used for ulterior motives that usually involve power and destruction of privacy and personal freedoms? :(
 
Who would have guessed that a large tech corp could mis-use their power for even more dystopia?
 
Anonymous
Yeah...
 
@J-- Yeah there are. Lemme see if I can find it.
It's called like nCaptcha or something.
 
@J-- Yeah, I offer that service. Write me an e-mail and I'll reply with an off-color joke
I call it RaaS
 
Anonymous
@forest I was talking about more in general but I would be interested to look at that captcha system :D
 
Anonymous
11:57 PM
@MechMK1 Hahhahahahahahaha :D
 
Huh, wait... pcmag.com/news/…
Do they not use ReCaptcha anymore?
 
Anonymous
Oh.
 
Anonymous
No, they don't actually! Pretty sure.
 
Nice
 
Anonymous
I now remember reading an article similar to this one.
 
11:58 PM
That's good.
 
Anonymous
Yeah, that is good.
 
That makes me happy. My hatred for Cloudflare went down a notch.
I think they're still way too centralized and are a juicy target for nation states, though.
 
Anonymous
Heh. Yeah, we use Cloudflare extensively.
 
Anonymous
We pretty much got rid of Akamai. Replaced it with Cloudflare.
 

« first day (3726 days earlier)      last day (1154 days later) »