The DMZ

11:02 AM

@J-- I have problems with Teams almost every day. It is the least reliable of all the collaboration apps I use

@J-- I pay 50% tax in UK and I hate where it goes under the Tory gov. I'd happily move almost anywhere... but I'm waiting to see if Scotland does gain independence from England. That may change things a bit

Anonymous

I pay 40% and likewise I hate that it goes under the Tory government.

Rory Alsop

@J-- Scotland will :-)

Anonymous

But my point was that if I moved to Germany I'd be paying even more than 40% for less salary and I still wouldn't see any benefits to paying such a high amount.

Rory Alsop

@J-- yeah, but to be honest, I like the support they give to the EU's weaker countries (I am a believer that the stronger should help the weak)

Anonymous

I mean, I am just against high personal income tax in general.

Anonymous

11:07 AM

I think companies should cover the difference but capitalism disagrees with me.

Anonymous

So, what can I do, other than move to a country with a lower income tax.

Anonymous

I am all for helping out weaker countries, I have no issue with that at all. What I have an issue with is massive corporations making billions per year and me needing to pay 40% of my earnings because they don't want to pay an extra 10% when they make 30 billion and I make 50,000.

Anonymous

I will never change my stance on that, it is absolutely fucking retarded.

Anonymous

NOBODY needs 30 billion a year.

Rory Alsop

@J-- agreed - you've seen the graphs of wealth disparity since the 1970's, right?

Anonymous

11:10 AM

I should note, I am not saying I don't make a lot of money, I do, and I am grateful for it.

Rory Alsop

The US ones are nuts - 3 men own as much as the bottom 50% of all Americans

Anonymous

But if you're going to try and tell me that I should pay a higher percentage simply because large companies don't want to then you're a fucking imbecile.

Anonymous

Oh yeah, I have.

Rory Alsop

The UK is pretty bad too though

Anonymous

It's absolutely bonkers.

Anonymous

11:11 AM

I hate it, it makes my piss boil.

Anonymous

I am not anti-tax, I am just anti high personal income tax and anti my taxes getting wasted.

Rory Alsop

@J-- I mean, I'm reasonably well off (despite my mortgage worrying me all the time) and I get paid well, but really, when a company is profitable, should the CEO really get £20M more a year? Or should the workers each get a 5% pay rise maybe? I know where I'd put the value

Anonymous

Yeah, sadly a large majority of the world (even poorer people) disagree with us.

Anonymous

I genuinely know people who make less than 25,000 a year and still vote tory.

Anonymous

i mean when you trick the poor into voting for the rich, what hope do you have?

Anonymous

11:13 AM

none.

Rory Alsop

@J-- Agreed. If we can't change how capitalism works at the top, I often feel the only way we (as normal humans) can change anything is really by boycotting companies that shaft their workers too bad. Like not using Amazon is a good one. Find the product you like on Amazon, then go to the vendor and buy it direct.

Often the same price to you, but they get all of it rather than have Amazon's cut taken

I know - it's a tiny step

but one of the things I try

Anonymous

Yeah, likewise.

Anonymous

The issue is that again, even poor people don't see it like this.

Rory Alsop

Along with paying more for products from companies that are ethical (not because they told me in their email signatures :-)

Anonymous

They place their entire value, their life in these companies.

Anonymous

11:15 AM

They just don't care enough to... Care.

Anonymous

It's sad. But it is the world that has been created by society by allowing this shit to go on for so long.

Rory Alsop

@J-- yep - and that PR spin by the large corporate powers through main media is unbeatable

unfortunately

Anonymous

Exactly.

Anonymous

It's really, really... Just... Depressing.

Anonymous

It's all one big game of who can stack the most numbers on a screen so they can have the biggest dick. It's just sad.

Anonymous

11:16 AM

And I can't do anythjing about it but do my best and bitch and complain

Rory Alsop

]I am very pessimistic about the future my kids are going to live in. The only force I think that will cause change for the better (maybe) is the inevitable climate catastrophe

Anonymous

But then you get absolute degenerates who try and tell me i cant complain because i earn a lot

Anonymous

so the question is... am i part of the problem?

Anonymous

i likely am...

Anonymous

i dont need 50,000 a year.

Anonymous

11:17 AM

so perhaps i shoukld be giving it all away...

Rory Alsop

@J-- As part of the west, we definitely are, however we can still do our best to not support the problem

Anonymous

@RoryAlsop Yeah, likewise here. Well, minus the kids part. I don't believe in bringing anymore people into the world but, pessimistic about the future, for sure.

Anonymous

Honestly, I gave up all hope for everything a long time ago.

Anonymous

I am just going to exist and do what I think is right until I die.

Anonymous

/shrug

Anonymous

11:20 AM

If I bitch and moan someone will bitch and moan about me bitching and moaning.

Anonymous

If I don't bitch and moan someone will bitch and moan about me not bitching and moaning.

Anonymous

If I do something someone will complain about me doing it. If I don't someone will complain about me not doing anything.

Anonymous

You literally cannot win.

Anonymous

It is really easy to see why so many people have become so selfish

Anonymous

i cant really blame them

nobody

11:23 AM

Well I'm beginning to think third world countries aren't all that bad after all

Anonymous

Hahahahah. I have considered it also.

Anonymous

In the wise words of Biggie: "mo money, mo problems".

Anonymous

But also: "less money, mo problems".

Anonymous

And also: "no money, mo problems".

nobody

yes we should just abolish money

Anonymous

11:25 AM

The one positive in this sea of negative is that, at least it is none of our jobs to deal with all this shit.

Anonymous

I mean, some people have to spend every day of their lives thinking about a solution for all of this bullshit.

Anonymous

Can you imagine being one of those people? I'd kill myself.

nobody

Do they?

Anonymous

It is literally just all negative. There is no good answer, no good solution.

nobody

Just get rid of society, go back to hunting and gathering

Anonymous

11:26 AM

Hahahaha.

nobody

Everybody takes care of themselves

Anonymous

Yeah that is one proposed solution.

Anonymous

Not sure it is a good one, though.

Anonymous

It doesn't favour people with disabilities at all.

Anonymous

There is a certain simplicity to ultra capitalism, isn't there.

Anonymous

11:29 AM

I mean, if you go to as extreme as capitalism goes it really is just: "Everyone take care of themselves".

Anonymous

And the problem of people with disabilities I just mentioned? "They aren't my problem that is natural selection at work".

Anonymous

What about people from third world countries? "Not my problem I was born in America".

Anonymous

It really is very... Simple.

nobody

@J-- Except, some people are left without a chance to take care of themselves.

Anonymous

Yes but like I just said.

Anonymous

11:30 AM

Under the extremist of capitalism systems.

Anonymous

We don't care.

Anonymous

Of course, that also implies you have not a single fucking millimeter of moral fiber

nobody

@J-- Eventually, natural selection will eliminate those with moral fibers

Anonymous

Yeah, seems that way doesn't it.

Anonymous

"Caring only makes you weak."

nobody

11:33 AM

And I'll be glad to leave the world too

Anonymous

Yeah, likewise.

Anonymous

I mean, I am not even saying that from a position I would have said that from a few months ago. I am really happy to be alive (as opposed to before) but I also cannot wait to die.

Anonymous

It sounds really contradictory and it doesn't make a lot of sense. But I think if you also see the issues with the world then it is possible to see that sentence does make complete sense.

nobody

^ Exactly. Happy to be alive but also ready to leave

Anonymous

Haha, exactly.

Anonymous

11:37 AM

Until then I am going to keep smashing stacks and getting racks.

Anonymous

My new favourite slogan, especially once I finish this course and get a huge payrise and become even more greedy - hahaahah fuck the poor!

Anonymous

^ sarcasm...

nobody

Hopefully I'll be able to start learning to smash stacks in maybe a couple of years

Until then, I have nothing to do

Anonymous

You should! It is a lot of fun.

Anonymous

I really like stuff that is just really complicated and rage inducing.

nobody

11:39 AM

What things do you need to know to start learning binary exploitation?

Anonymous

Because when I finally complete it I feel like I climbed to the peak of Everest.

Anonymous

Hmm, good question. I think it helps a lot to know a fair few bits around programming. I mean, you don't NEED to know a lot, but certainly the basics of programming and just how code works in general.

Anonymous

Knowing Python will help a lot for building exploits.

Anonymous

Knowing C will help a lot for application logic.

nobody

@J-- Python? I thought this didn't involve any high level languages

Anonymous

11:41 AM

Then of course, ASM. You'll really need to understand that if you wanna learn how to bypass DEP, ASLR, etc. That is where strong ASM knowledge comes in handy.

Anonymous

Well, you need to build your exploits in SOMETHING.

Anonymous

Python is REALLY nice for building exploits in.

Anonymous

SO knowing python basics helps a lot.

nobody

uh okay

Anonymous

You don't need to know a lot, just the basics. How to work with bytes and stuff like that.

nobody

11:41 AM

I already know python basics

Anonymous

And other than that, some basic IT stuff and that's it.

nobody

So now I have to start C

Anonymous

It won't be easy, don't get me wrong.

nobody

then ASM

@J-- I don't expect to be

Anonymous

But I wouldn't say you need to be some kind of wizard to get started.

nobody

11:42 AM

If it was, more people would be doing it

Anonymous

It's just going to be really tough. But with some basic general programming knowledge and IT knowledge

Anonymous

and a lot of determination

Anonymous

you can pretty much just jump right in

Anonymous

this is a good start, two seconds.

Anonymous

opensecuritytraining.info/IntroX86.html

nobody

11:43 AM

My biggest problem would be my short attention span I guess

@J-- Thanks!

Just the sort of thing I was looking for

Anonymous

11:58 AM

You're welcome.

Anonymous

That course does go into rather a lot of detail, probably more than you actually need. The most important thing to understand in all of it (with the exception of the individual instructions) is how conditional branching works. It is really important to binex.

Anonymous

But as far as a basic stack overflow goes, it is way less scary than it seems. The tricky part comes when you have to bypass security mitigations, that is when it gets a bit more assembly heavy.

MechMK1

Can I ask a dumb question?

When you pentest a web application, you can have a look at the OWASP WSTG to get a rough overview of what you should test. As in, if you cover all the points, you can be reasonably sure you covered the most common attack vectors.

Is there anything comparable for code reviews?

As in, check for these things, etc...?

Would that be a legitimate question on the main site?

Anonymous

I think that is actually a good question.

Anonymous

My honest answer is; I have no clue if there is such a thing.

Anonymous

12:10 PM

I would assume there is but I doubt it is that popular if it does exist.

Journeyman Geek

> Is there anything comparable for code reviews?

hmm

As a resource recommendation question I suspect no

If you're asking for a high level overview of what this could look like....

you might accidentally get an answer

MechMK1

"Do you know which guide I should use?" Nah, sod off
"Can you write a guide for me?" Yeah sure thing bro

Journeyman Geek

@MechMK1 or "How do I learn to fish?" is ok. "What are good resources for learning to fish?" not ok, even if the answer to 2 can be 1

MechMK1

> Question closed as too broad

Conor Mancone

12:43 PM

@MechMK1 Does a list of acronyms count?

MechMK1

@ConorMancone Yeah

Conor Mancone

DRY, SRP, IoC

Solved!

(yeah, sorry, I'm not actually being helpful)

"Adherence to code standards" is probably the most important thing

MechMK1

Don't repeat yourself, Single Responsibility Principle and Inversion of...

Conor Mancone

Control

MechMK1

Okay

Seems simple enough

Journeyman Geek

12:44 PM

assuming the code standards are sensible? :D

Conor Mancone

Adherence to code standards is the most important thing except that it should be automated. If you don't have git hooks/pipelines that automatically enforce your code standards, then your business is doomed to failure

I'm only being like 25% sarcastic on that last one...

MechMK1

I get what you mean

Conor Mancone

Oh, also, naming conventions!

Anytime I've let a bad variable/function name slip through code review, it's come back to bite me later and I regretted it

Never, never, never accept crappy names

MechMK1

But I can't really check for that in a 1.000.000 LoC project for which I have 10 days to review

0

Q: Can a company claim they acted in good faith in this situation?

Let's assume that Hacker Corp. offers a penetration testing service to other businesses, and ACME Corp. contacts Hacker Corp. to conduct a penetration test for some internal testing. Hacker Corp. requires ACME Corp. to sign a "Permission to Attack" document, which outlines that Hacker Corp. is al...

Just a question out of pure curiousity

What if my PtA was signed just by a random IT guy, because he failed to forward it to the right people in time?

Can the pentesters still claim that they acted in good faith?

Journeyman Geek

You really need a lawyer for that

MechMK1

12:54 PM

This isn't a situation that I'm in

It's purely hypothetical

And "It depends on these here factors" is a good enough answer for me

Journeyman Geek

I mean, even hypothetically, its messy

I'd say part of due dillegence and pre-attack research is knowing who needs to sign it

MechMK1

But how would I know, realistically?

Journeyman Geek

You're going to hack someone. I mean, at some point wouldn't you go "wait, who is this guy?"

MechMK1

If a PtA is just signed by "illegible name"

No, I mean, the company itself wanted to contract us

Journeyman Geek

usually there's also a name and date printed in such things

MechMK1

12:57 PM

Say the head of IT does all the talk with the sales department, and then both companies hand it off to someone else

Like the pentest company hands it off to one of their pentesters, and the customer company hands it off to one of their IT employees

But the IT employee of the customer forgets to hand the PtA to the CTO (or whoever is responsible) in time, and ends up signing it himself

Journeyman Geek

So essentially a comedy of errors?

and no one on your side confirmed who signed it?

MechMK1

Exactly

We get the PtA with just the note "Here is the signed PtA" and someone just has a look at it, seeing "Oh yeah, there is a signature"

But without anyone of the pentesters verifying who signed it, and if said person has the required permissions to be allowed signing it

Because frankly, how would I know?

Conor Mancone

@MechMK1 You can't perform a code review on a 1,000,000 line project in 10 days

MechMK1

@ConorMancone Tell that to the customer who ordered one :D

Journeyman Geek

So - there's a few things. Its usually not as simple as one signature

there's typically a tender, contracts and so on

and the tender would include things like scope of work and what you're allowed to do and where you're allowed to go

So it wouldn't be 'just' the PTA

granted, people mess up :D

MechMK1

1:12 PM

Of course, yeah. There'd be a multitude of things

But say the pentest company actually adhered to all the things discussed in the scoping call, etc...

Journeyman Geek

And you have paperwork for everything but that? You're probably good

but if you took down the network and they lost money

someone messed up

Conor Mancone

2:46 PM

@MechMK1 Is it literally a code review? Like, "what is the code quality in this project"? Or is it a security focused code review? Because it sounds like you're dealing with a "standard" code review, and yeah, that's a lot for 10 days

Anonymous

Jesus, 10 days for a million lines of code?

Anonymous

I mean I am sure you could review it, but properly? Jesus... Not a chance.

Anonymous

What's a review? :D

Anonymous

That many lines it'd be even shorter than a skim.

Anonymous

lmfao.

Anonymous

2:51 PM

Anyway @MechMK1 chop chop. I want that report on my desk no later than the 26th, because weekends don't exist at this place!

Anonymous

(Your 10 days includes reporting time by the way, what are you some kind of pussy?) :D

Conor Mancone

@J-- That was exactly my thought! 10 days to review a millions lines of code is really at most 8 working days, if even, because a report like that does not write itself on its own

Anonymous

Yeah that just sounds completely unrealistic... I mean, I guess it depends what they mean by a review but under the standard English definition, I cannot imagine that many lines being at all feasible...

Anonymous

Even if you had 3 people that's still 33,333 lines a day each for 10 days. That is an insane amount of code to verify that it is "secure".

Conor Mancone

4:53 PM

Why is this a thing?

techrepublic.com/google-amp/article/…

From the article:

In your never-ending quest to secure your Linux servers, you've probably found a lot of times the breaches happen through SSH. No matter how secure it is, it can still be cracked. That's why you might need to consider setting up a tarpit for that service.

This makes no sense to me. In 20 years I've literally never had a breach happen through SSH. All you have to do is disable password-based login and keep it up-to-date. SSH is, IMO, literally the easiest service ever to keep secure.

ThoriumBR

I like to create a tarpit to waste attacker's time

Conor Mancone

Even if it wasn't though, I don't see why launching another service would help. Seems like one more avenue of failure

@ThoriumBR That reason I can accept!

I'm always up for messing with people who deserve it :)

But: "Use a tarpit to protect your SSH service"? Makes no sense

ThoriumBR

5:23 PM

makes no sense at all

it's clickbait

Rory Alsop

6:42 PM

@MechMK1 Have you looked at the Checkmarx tooling - I have integrated it with companies' code workflow, and it provides much of what you'd want by default.

ThoriumBR

downloading Digital Combat Simulator World... let's see how bad my thinkpad t430 handles this

downloading 120gb at 1mbps... it will take a while

33h left... I probably can play something on the last hours of the weekend...

Conor Mancone

@RoryAlsop We actually use that - it won't get you helpful results on such a large code base that quickly.

nobody

8:46 PM

I feel tempted to add an answer to this question. Should I?

Transcript for