The DMZ

A. Hersean

7:57 AM

@FireQuacker It's not normal, but it appears to be common from what I've seen.

MechMK1

8:29 AM

@FireQuacker Unfortunately, yes

A lot of phone apps aren't written by security folks, and often times, invalid certificates lead to exceptions

And you know what programmers do when they see exceptions they don't understand but don't seem to cause any issues?

Correct, just log them and carry on.

I can't really think of a way to convey to a programmer that this is a really dumb thing to do.

nobody

8:54 AM

@MechMK1 Why can they even do that? Shouldn't all the functions that ever need to validate a certificate exit when they see an invalid certificate without completing whatever it was supposed to do?

So if the a programmer needs to download a resource, they are going to do something like download("resource"), then the certificate validation part should be done by the download() function, no?

And if the certificate was invalid, just terminate the connection and not download anything

MechMK1

@nobody No, they first establish a HTTPS connection, and that's when the certificate is being validated

If they re-use the same object, then they only need to do that once

Or they make a helper function, which logs every invalid attempt

You know, to get rid of that stupid exception that keeps breaking the app in the test environment

nobody

@MechMK1 what?

So, a new HTTPS connection is established, and no validation occurs, simply because they are using the same object?

MechMK1

@nobody Since its the same host, yeah

Or, as I said, make a helper function:

nobody

Well I guess the problem here is that the right way to do something isn't also the easiest way

MechMK1

2

Q: ignore ssl errors in DefaultHttpClient

Im searching for a possibility to ignore all ssl errors (eg. not trusted) in a default httpclient. I've seen lots of solutions here, but i alwas have to import a specific certificate an add it to the trustmanager or it is for HttpsUrlConnection instad of DefaultHttpClient. My used webrequests are...

10k views :D

nobody

9:01 AM

shit, that's crazy

MechMK1

@nobody The problem is that developers and security people have two extremely different views on this

nobody

I get it now, you need to get rid of the errors for testing, but then they just keep it that way

A. Hersean

You know when you browse on a website with an expired certificate and you have the option to continue nevertheless? That's the same, the question being asked by a raised exception instead. And like everybody, they click on "continue" by ignoring the exception an carrying on.

MechMK1

A developer sees this as "that one annoying thing that keeps preventing the app from working"

Whereas security folks see it as "that one incredibly useful thing that prevents your data from being stolen"

As a security person, your reaction to certificate errors would be "Display an error and stop the connection"

But "don't do what the user wants the app to do" isn't what developers want to do

The reasoning is "If our users can't use our app to do what they want to do, they will go to the competition"

nobody

Well atleast the developers keep us in business

MechMK1

9:04 AM

nobody

If my own data was guaranteed to never be compromised by these things, I wouldn't complain about them

MechMK1

That's why I told my developer friends that it's okay to trust client data, roll their own crypto and ignore any certificate warnings.

> So you know, just trust your client data. You wrote the client, right? So it's guaranteed to be okay. And for cryptography, definitely invent your own algorithm and make sure to keep it secret, so attackers will never be able to crack it. And certificate warnings? Pfff, they're just warnings, right? Who cares about warnings.

nobody

10:09 AM

schneier.com/blog/archives/2021/04/…

This is weird. How do I know that the FBI doesn't drop their own backdoor while removing the chinese one?

MechMK1

10:48 AM

You don't.

Journeyman Geek

oh they wouldn't

they'd get the NSA to do it

Anonymous

11:14 AM

@JourneymanGeek Ah okay.

Anonymous

Afternoon, by the way.

MechMK1

11:49 AM

The Tumblr-4chan Wars

►

Beautiful :'D

Anonymous

Hahahaha :D

MechMK1

The perpetually offended versus the perpetually offensive

Anonymous

I am not even sure offended is a strong enough word to describe those people anymore.

Anonymous

There needs 40 adjectives in front of it.

MechMK1

Wait, I need to find something

twitter.com/gramscifag69

This fucking bio

Fun exercises with tumblrinas is telling them that self-diagnosis of mental illnesses isn't the same as having an actual diagnosis from a medical professional

Anonymous

12:04 PM

Why do people think being mentally is a badge?

Anonymous

It isn't.

Anonymous

What the fuck is this shit?\

Anonymous

Jesus.

MechMK1

@J-- It's quite obvious, isn't it?

Anonymous

Grow up. Shit makes me SO mad.

Anonymous

12:05 PM

It's not fun. It isn't a badge. It isn't nothing. It's terrible.

Anonymous

I'm actually tilted.

Anonymous

SOme people are fucking...

MechMK1

Step 1.) Create an ideology that puts disadvantaged people on a pedestal.
Step 2.) Perpetually claim that non-disadvantaged people have no right to express themselves or to be heard, because they "oppress disadvantaged people".
Step 3.) People suffering from mental illness are more disadvantaged than those who do not suffer from mental illness.

See how it's all coming together?

Anonymous

"HAH LOOK AT ME I CALL MYSELF FUCKED UP ON SOCIAL MEDIA HURR DUR"

MechMK1

More like "I am mentally ill, so my opinion is worth more than yours"

Anonymous

12:07 PM

Yeah people that do this can fuck off.

Anonymous

Mental illness isn't a fucking bargaining chip.

MechMK1

Plus they use it as an excuse to just be horrible people

Anonymous

It isn't a badge of honor.

Anonymous

It's nothing more than what it is.

Anonymous

A MENTAL ILLNESS.

MechMK1

12:07 PM

When being called out on their horrible behavior, they use their self-diagnosed mental illness as an excuse.

Anonymous

these people can just get in the bin

Anonymous

Oh, I know.

Anonymous

I don't disagree with you.

Anonymous

They do it a lot, I've seen it. It's absolutely stupid.

Anonymous

Because if they say something wrong: "im mentally ill"

MechMK1

12:08 PM

There is actually a bit more of a sinister reason behind it

Anonymous

If they get called out: "bullying someone whos mentally ill"

Anonymous

If they kill someone: "well im mentally ill"

MechMK1

Exactly, it becomes an all-deflecting shield

Would you like to know another reason why they do it?

Anonymous

Sure.

MechMK1

Social isolation and social dependency.

Selling someone a fake cure for a real illness isn't a good scam. Once the cure shows not to work, the game is up. A much better scam is to sell a healthy person a fake illness, for which you claim to have the cure.

First of all, look at the age group for all these people

They're all teenagers and young adults

Or, the vast majority of them are.

Anonymous

12:11 PM

I mean, the main issue I have is that it just completely negates anything I (or other mentally ill people) have experienced.

Anonymous

But oftentimes, these people are too fucking selfish to care about that.

MechMK1

A lot of people in that age group have problems, stemming from hormonal changes, social changes, having to become more independent, etc....

Anonymous

I mean, I am in that age group, also.

MechMK1

I think I'm saying the truth when I say that a lot of teenagers and young adults have problems they didn't have when they were kids still.

Anonymous

But I can say with absolute certainty that 90% of what I experienced was not due to hormones.

MechMK1

12:12 PM

@J-- Statements made about a group don't necessarily need to be true about every individual in the group.

@J-- But you had problems too, right?

Anonymous

So these clowns who use fake mental illness as an excuse just make others experience valueless and meaningless.

Anonymous

its wrong,.

MechMK1

The point I'm trying to get at, being a teenager is a difficult time for many

And when they get in touch with the wrong people, they might tell them things like "Look, your problems are obviously the result of an undiagnosed mental illness"

Anonymous

Oh, that for sure happens, no doubt.

Anonymous

I've seen it happen. It is also a real problem.

MechMK1

12:14 PM

You have mood swings? Obviously bipolar disorder.
You struggle in school? Obviously ADHD.
You feel sad or demotivated sometimes? Obviously depression.

The list goes on and on and on.

Anonymous

But from my perspective the real evil part is faking an illness that other people actually have in order to game the system of blame.

Anonymous

It isn't a badge.

MechMK1

@J-- I don't believe people consciously fake it

Anonymous

Oh, I do.

MechMK1

I think they delude themselves into believing they have it

Anonymous

12:14 PM

I absolutely do believe people do it on purpose because it works.

Anonymous

Not most, but a few.

Anonymous

I believe most, like you say, delude themselves.

MechMK1

Okay, I should say some do, but I believe some also do it by deluding themselves

Anonymous

But I do believe there are people out there who see how claiming something you don't have can benefit you greatly.\

MechMK1

There is another sinister concept at work

Anonymous

12:15 PM

These are the people that put it in their bio^\

Anonymous

they use it as a badge

MechMK1

And that is "accepting an illness as being part of you"

Anonymous

and it makes me fucking LIVID.

nobody

Yeah I've seen some people admit they faked ADHD and that sort of things

MechMK1

Yes, exactly. I agree with you fully

What I'm trying to get at is that some people are being told that having a mental illness is "part of their identity"

As in "Don't say you suffer from ADHD, be positive and say you live with ADHD"

They're being told that being mentally ill is actually really good

And that it shouldn't be seen as a sickness

There was a case where a baby was born deaf, and the doctors could restore its hearing

nobody

12:17 PM

@MechMK1 Well it shouldn't

MechMK1

People online were LIVID, saying they deprived the baby of its "identity as a deaf person"

Anonymous

This is what I am saying about these clowns that want it to be a badge.

MechMK1

Because, you know, not having an illness means "depriving someone of something"

Anonymous

It isn't a badge. It's horrible. There is a difference between accepting it and fucking displaying it like some kinda' fucking certificate.

Anonymous

"I PASSED SELF HARM CLASS"

MechMK1

12:18 PM

But once you start going into that mindset, it becomes a self-perpetuating cycle

Anonymous

Its RETARDED.

MechMK1

Look, I don't know for sure if I have depression or not. I never spoke with a doctor about it

But I'm pretty confident normal people don't have suicidal thoughts every single day of their life

If someone offered me a button I could push to not have those thoughts, do you think I'd push it?

Abso-fuckiung-lutely I would!

It's fucking awful to have to live with that shit

This isn't "part of my personality", it's a fucking sickness that I have and that I would rather not have if I had the choice

Anonymous

Yeah, I agree.

nobody

@MechMK1 Well thinking of yourself as mentally ill doesn't help

MechMK1

But once people delude themselves into believing that "depression is part of who they are", they consciously resist all efforts to counteract it, as in their mind, they would begin erasing themselves

Anonymous

12:20 PM

I don't consider my depression nor my autism to be part of my personality either, that would be absolutely stupid.

MechMK1

@nobody In all honesty, I would say it absolutely helps

Anonymous

It isn't a character trait. I am not an MMO class.

MechMK1

Because it definitely isn't normal

Just because I'm ill doesn't mean I don't have to take responsibility for my actions

nobody

Well if you spend all day thinking "I'm just a depressed wreck" you'll just feel more depressed

MechMK1

I don't do that

Anonymous

12:21 PM

Anyway, I don't want to say more because I know for a fact that some clowns are going to read it and think shit like: "THIS GUY CLEARLY DOESN'T CARE ABOUT SICK PEOPLE"

Anonymous

"UGH HE HATES MENTALLY ILL PEOPLE"

MechMK1

But "acknowledging you have a problem" isn't the same as "believing you're just a depressed wreck"

Anonymous

TL;DR - almost every one is a clown.

MechMK1

@J-- Welcome to the clown world

nobody

@MechMK1 Well that's what I meant to... sorry I am bad at communicating

Anonymous

12:23 PM

:D

Anonymous

I could say something really controversial which I am sure you would agree with, Mech.

MechMK1

@nobody Your failure to communicate seems to stem from a mixture of BPD, ADD, ADHD, SGX, BBQ, BFG and possibly ROFL

Anonymous

But, I won't...

Anonymous

AH FUCK IT.

MechMK1

@J-- DEWIT

nobody

12:24 PM

@MechMK1 It probably is. I don't care.

MechMK1

Aww, I was wondering if nobody cares

Anonymous

3.

Anonymous

2...

Anonymous

1....

MechMK1

@J-- Based

Anonymous

12:24 PM

deleted.

Anonymous

that's all i'll say on that matter.

MechMK1

To answer your question:

Anonymous

Yeah. Shit pisses me off. Again, it undermines the people who are that and don't use it in that way.

MechMK1

I do believe that a significant percentage of said group exhibit the traits you described.

Anonymous

It ruins it for everyone, it is absolutely retarded to do it.

Anonymous

12:25 PM

But they are so selfish they don't give a fuck.

MechMK1

And furthermore, I believe that a significant percentage of said group claim to belong to said group because it's "trendy" among young people.

To bring in a personal anecdote: I have not once met a member of said group, who wasn't "made of glass", figuratively speaking, and who wouldn't completely crumble under the slightest criticism.

And I am not talking about questioning their identity or belonging to said group - I am talking about any kind of criticism, valid or invalid, personal or in regards to their work.

Anonymous

Yeah, I have a rather similar experience.

Anonymous

But to be completely fair, I believe that most people are like that in general.

MechMK1

In fact, one character trait I have noticed among a significant number of people in said group show a strong bias towards vindictive behaviour.

Anonymous

I don't think it's exclusive to that group, I think a vast majority of people in the world cannot take any form of criticism, even constructive.

MechMK1

12:29 PM

As well as a strong desire to control the language and ideology used by their peers

@J-- Perhaps that is true.

Anonymous

Anyway, if I comment more this will only lead to someone trying to dox me or some shit.

MechMK1

Though I would argue there is a difference between someone getting defensive when being criticized, and someone having an absolute breakdown when being criticized.

Anonymous

So I just won't.

Anonymous

People can read the chat without us seeing them so whats the fucking point.

Anonymous

Ties nicely with the criticism thing, really.

Anonymous

12:31 PM

i have learned the hard way on this topic.

MechMK1

Ironically, the fact that those characteristics make it pretty obvious who we are talking about only proves that point.

Anonymous

people will attempt to destroy you if you say ONE thing that upsets them

Anonymous

and by destory i mean

MechMK1

Yes

I know

Anonymous

get you fired. get you homeless. everything.

Anonymous

12:31 PM

its bonkers.

MechMK1

And you wonder why people hate them...

Support for their group among "young people" has plummeted in recent years. Makes you wonder why...

Is it because of the evil far-right propaganda? Is it because of Trump?

Or, could it be their own behavior, which people have become sick of?

Have you ever heard of Vaush?

Anonymous

I have.

MechMK1

I generally disagree with him.

Almost everything he says.

Anonymous

Isn't that the guy everyone calls a pedophile?

Anonymous

Although I have never found any evidence that he is...

MechMK1

12:33 PM

Because he constantly defends child porn

Anonymous

Oh Jesus...

MechMK1

Like seriously, every single stream he says child porn should be legal

Anonymous

Well, he's a clown.

MechMK1

"I have yet to hear a compelling moral or legal argument as to why child pornography should be illegal" - Vaush

Anonymous

But his he a pedophile for having a thought? No.

Anonymous

12:34 PM

I absolutely do not agree with thought crime.

Anonymous

Also, defending a right to something doesn't mean you partake in it.

MechMK1

But I agree with one statement he made. He said "She and He are basically the same word, written the same, sounding the same, meaning almost the same thing. I've misgendered a lot of people by accident, and every single one was fine with it, except _____ people. They go fucking ballistic and trying to ruin your life over it"

Anonymous

Yeah, it is the last part which resonates the most.

MechMK1

@J-- I'm not saying he is, but if I consistently claimed that rape should be legal, you'd probably think I'm a horrible person

Anonymous

"trying to ruin your life over it".

Anonymous

12:36 PM

That part, that part is fucking insane that it is so true.

MechMK1

You saw it here on SE too

Anonymous

@MechMK1 Oh, I know you're not.

Anonymous

I am talking about the people that call him that.

MechMK1

Misgender someone, get publicly shamed by a big company

@J-- I'm not saying he possesses child porn, but I wouldn't be surprised if he did

I mean, the fact that he keeps defending it, keeps bringing it up EVERY stream...

Anonymous

Yeah, I get that.

MechMK1

12:37 PM

Like, it wouldn't be a big deal if he made the comparison once, if he said "If this should be legal, then that would mean that should be legal too"

But every stream? That hints at some personal investment in the topic

Anonymous

Yeah, I mean, that is strange.

MechMK1

And his discord messages

Where he argued multiple times that he'd rape children

Anonymous

Jesus...

MechMK1

Or his arguments that in an "ideal society" the age of consent should be lowered below 12

Is it proof? No.
Is it suspicious as fuck? YES.

:D

Anonymous

lol.

MechMK1

12:40 PM

Anyways, I think Vaush is a fucking cunt

Anonymous

Yeah, agreed.

MechMK1

But I agree on his position regarding the group of people we spoke about before

Anonymous

He isn't wrong about groups trying to ruin your life though.

MechMK1

Also, have you heard about the "super straight" thing?

Anonymous

They do. They will. They can.

Anonymous

12:42 PM

But as I said, I don't think it is really exclusive these days. I think a lot of groups try this shit. I think a lot of people in general have the mentality of: "you offended me? now im gonna fucking hit you, get you fired, fuck your wife in the ass, kill your children, take your house, murder you, dump you in the ocean, piss on the sea where i dumped you, kill your wife, rape your mum, murder your dad"

Anonymous

All because you called them an idiot

Anonymous

Thats my experience with people anyways

Anonymous

fucking bonkers

Anonymous

This is pretty much why I stopped arguing with people on the internet.

MechMK1

It starts in school

Anonymous

12:48 PM

It always ends in someone them trying to fucking... fuck you over.

MechMK1

Do you have any idea how often girls hit me because I said something that offended them?

And they always got away with it.

What does that teach them? "It's perfectly reasonable to use violence to express my discontent with someone"

Anonymous

Yeah, well, double standards is another problem entirely. They exist absolutely everywhere and if you call them out then you're a bad person.

MechMK1

Teachers keep saying "She's a girl, she can't hurt you"
NIGGA THAT AINT THE FUCKKING POINT NOW INNIT?

Anonymous

See, that's another problem as well.

Anonymous

"She's a girl, she can't hurt you."

Anonymous

12:49 PM

First of all, that is absolutely false

MechMK1

Oh yes, she absolutely can

But it's about the principle

Anonymous

Second of all, that implies girls are weak. Except if a man said that, he'd be called a sexist and lose his house.

MechMK1

"Girls can use violence, boys cannot."

Anonymous

Society can just go fuck itself.

MechMK1

"it's okay if a woman hits a man"

"It's okay if a woman abuses a man"

Anonymous

12:50 PM

I lost all faith in it long ago.

MechMK1

It all stems from this mindset

"If you are the "lesser" person, you can do whatever you want"

And trust me, this mindset of "women are weak" absolutely implies they're not even to men

"It would be unfair if the same rules would apply to them, so they get preferential treatment"

That literally implies they are lesser beings

Anonymous

I think a lot of this shit stems from how self interested everyone has become.

MechMK1

Fucking hell

Anonymous

As years go on people are more and more only interested in themselves.

Anonymous

It spawns a lot of this shit.

Anonymous

12:51 PM

Most people have no sense of care for anyone else except themselves.

Anonymous

That person can't eat? That's their fault, I can.

Anonymous

That person lost this right? Too bad, I didn't.

Anonymous

That person called me an idiot? Well I don't like that so I'm going to hit them.

Anonymous

Oh they hit me back? Now I'm calling the police.

MechMK1

True

Can I ask an honest question?

Anonymous

12:52 PM

Sure.

MechMK1

Do you believe the terms "blacklist" and "whitelist" are racist?

Anonymous

No.

MechMK1

Good.

Anonymous

Why would anyone think that?

MechMK1

Because of "black" and "white" obviously

Anonymous

12:53 PM

Is binary racist now too?

Anonymous

On and off also?

ThoriumBR

me neither...

Anonymous

I guess when displays are turned off, they can't be black anymore, right?

ThoriumBR

I was reading on slashdot the "war raged on racist terms on IT"... man, what?

MechMK1

Someone once marked me saying "It is recommended to use a whitelist approach instead of a blacklist approach" as saying this has "racist conotations"

Anonymous

12:53 PM

That's racist. How dare you.\

Anonymous

Jesus.

MechMK1

Oh fuck yeah, uncle Adolf would be proud of me

Anonymous

No more TVs on standby guys

Anonymous

fucking racists

Anonymous

all of you. :D

MechMK1

12:54 PM

They can suck my nuts with their "allowlist" and "denylist"

@J-- Yes.

ThoriumBR

a list implies some on that list are more privileged than the others... that's segragationism

Anonymous

People spend far too much time being offended for others rather than aiming to solve problems which are actually real.

MechMK1

"Protecting your data from attackers is privilege. They might need your data more than you."

Literally an excuse for armed robbery I've heard by the way.

ThoriumBR

and who said the data is yours?

Anonymous

I have no issue with people robbing banks to be fair, Mech. As long as they do it when the bank is closed.

Anonymous

12:56 PM

Take as much money out of that bitch as you want.

Anonymous

The bank don't need any more.

MechMK1

Our data!

> Союз нерушимый республик свободных
> Сплотила навеки Великая Русь.
> Да здравствует созданный волей народов
> Единый, могучий Советский Союз!

nobody

Of course its googles

Its not yours

Anonymous

It never was yours.

Anonymous

It's always been Googles.

ThoriumBR

12:57 PM

@J-- I have... it makes their insurance go up, and the price of their services go up, the mortgages interest go up... it hurts us, not the bank...

MechMK1

"Wait, it's all Googles?"
[cocks gun] "Always has been"

ThoriumBR

the bank never loses

Anonymous

@ThoriumBR I wasn't entirely serious.

Anonymous

But you're not wrong.

Anonymous

I recognise that if the bank were to get robbed we'd still be paying the difference.

MechMK1

12:57 PM

Agh fuck, the DMZ is so nihilistic again

Anonymous

They are too big to ever take an actual loss.\

MechMK1

Anonymous

lol.

ThoriumBR

@J-- and my irony/sarcasm detector is an underperformer

MechMK1

"What's your biggest strength?"
"The fact that my own death is certain"

Anonymous

12:59 PM

heh.

MechMK1

Wait

Anonymous

Anyway, back to ASLR bypass for me.

Transcript for