The DMZ

Journeyman Geek

6:12 AM

@J-- superuser.com/questions/1642853/… might be up your alley if you want a little SU rep for some reason :D

MechMK1

8:19 AM

@ConorMancone Yeah, saw that yesterday. Just some poor kid copying some 2002 "How to make a login in PHP" tutorial

MechMK1

8:55 AM

4

Q: Is anyone familiar with this notation for a drive letter in windows H:35\?

Resource Monitor in Windows 10 is showing me this syntax for a drive that has no drive letter but is mounted to a directory on my C drive. It is being shown under Disk Activity in Resource Monitor as: H:35\somedir\blahblah Of course trying to access it under this pathname give the error of invali...

Anonymous

10:05 AM

@JourneymanGeek Heh :D I actually deleted all my StackEx accounts with the exception of this one and Crypto.SE!

Anonymous

But thank you.

MechMK1

10:33 AM

So, how've you folks been holding up?

Anonymous

I'm good thanks!

Anonymous

Stressed. But it's cool. What about you?

MechMK1

Just a bit stressed because my food is late and I have a meeting coming up soon

Aside from that pretty well

Anonymous

That's super annoying, yeah.

Anonymous

I'm hungry too.

MechMK1

10:40 AM

At least my delivery is already on the way now

Anonymous

What are you getting?

MechMK1

Anonymous

Damn, what is that?

Anonymous

I've never seen that or I am just dumb.

MechMK1

Calf breast filled with dumpling

Anonymous

10:49 AM

Damn, looks pretty tasty.

reed

1:11 PM

the word dumpling is weird, it's half way between a dump and something dangling

in fact, I thought a dumpling was a small piece of crap

And I might not be the only one thinking that, since Urban dictionary has a less popular definition that says: Minature turds that usually require a second flushing due to their bouyancy

unrelated security paranoia: have you guys ever thought that when you compute a checksum, you are actually computing the checksum of the file stored in RAM, and when writing or checking it you might still be processing data from the RAM, due to OS chaches?

MechMK1

Replace "dump" with "shit" and you'll laugh every time you'll shit a process' memory to a file.

reed

1:32 PM

Example of the cache problem: you have a file that you want to save somewhere else, together with a checksum. The OS reads the file from the HDD, the file gets corrupted while being read or while in RAM (apparently bit flips in memory aren't extremely rare). You then compute the checksum of a corrupt file. You move the file, but what you are moving is the corrupt cached file

so you end up with a corrupt file, and a matching checksum, thinking everything is ok

Journeyman Geek

@reed if you're that worried, that's what ECC is for no?

reed

to spot the difference, you would have to flush the cache, which isn't really easy as far as I know, unless you fill the RAM or restart the OS.

@JourneymanGeek yeah, I guess

MechMK1

Intel desktop CPUs won't work with ECC ram AFAIK

extremetech.com/computing/…

Journeyman Geek

@MechMK1 yup :D

MechMK1

Intel are awful

And AMD isn't better

Computers are awful

reed

1:37 PM

computers are provided AS IS

Journeyman Geek

lol

looks around

reed

I always find that line funny, it's a nice joke to think that our society is based on something that, most of the times, is provided AS IS

Journeyman Geek

Unless everything is soldered in place uhhh

I don't think there's anything on my desk right now that's 'as is'

MechMK1

What does that even mean?

Like

For something to be "provided as is"

reed

I'm sure nuclear power plants have servers that, when you log in, greet you with "blah blah blah is provided AS IS"

MechMK1

1:39 PM

0

Q: Spawning child processes from root using runuser command

I am working as an intern for an online coding platform startup (similar to LeetCode or HackerRank). The backend is written in Nodejs. Instead of running the code in a sandbox of some sort, the lead dev decided to execute the submitted code using a child process spawned from the main process, whi...

linux ubuntu privilege-escalation system-compromise node.js

Can anyone see the impending doom approaching?

reed

executing user-submitted code on your server, without any kind of sandbox or VM? Nah, what could go wrong, it's totally safe

MechMK1

As root, nonetheless

reed

the most important thing is that the project goes online fast, if the sys admin isn't available right now, have the smart guy in the office do it instead

in case of trouble, just ask on SE. Easy!

MechMK1

"look, we have a deadline here, okay?"

>tfw that was literally a meeting I had 2 hours ago

reed

a deadline is a line beyond which a project is going to die? Welcome to the jungle baby, you're gonna dieeee

I imagine this guy uploading the app, or opening ports, whatever, to finally make the project go live... while listening to "welcome to the jungle"

MechMK1

1:53 PM

Not the project, but the people involved

Look out, the manager has a shotgun!

@reed No joke, I listen to "The Only Thing They Fear Is You" as I log into the system I'm supposed to test

djsmiley2kStaysInside

At a old place, once had the CTO order we made a pre-prod system public, because he couldn't be bothered to sign into the VPN to demo it to a customer

it happened

by the time he got to demo'ing it

it'd been defaced

xD

MechMK1

reed

@djsmiley2kStaysInside what, being targeted so fast? Either it was a really crappy system (like no login implemented at all, or extremely vulnerable unpatched software), or the system was already a target and someone was waiting for the second it would go online

unrelated question: if you guys had to encrypt a file (symmetrically) on Linux, what would you do? AFAIK the two options are Openssl and GPG, although some recommend GPG. The problem is that both of them don't provide decent key-derivation functions by default if you want to use a password

MechMK1

2:12 PM

@reed I'd tend to go with gpg, yeah

reed

I guess the best solution is to use GPG, increasing the KDF rounds as much as possible (but there's a limit which isn't very high), or use a separate method to derive a key from a password (but which? By default on linux, without installing other crap)

MechMK1

And a key derivation function isn't as important as a good passphrase

If your passphrase is baton pointed coasting disengage lilac turret supreme yeet then KDF does not matter

reed

that's 8 words, yeah, lots of entropy anyway

then we should also remember that if we have password managers, who cares about remembering passwords

so I guess the rounds provided by GPG are more than enough anyway

MechMK1

@reed Yes, I would agee

reed

right, thanks

MechMK1

2:16 PM

Also don't forget to delete the unencrypted copies

That...happened

Not going to name any names there

reed

LOL, yeah. It's funny to think that encrypting a file isn't enough, nobody ever mentions we should also delete the original

djsmiley2kStaysInside

@reed really crappy in this case I think - no auth and much default type passwords.

haha

reed

@djsmiley2kStaysInside but defacing is a pretty lame attack, I mean, it's often a joke (so maybe the attacker was someone in your own company?) A more serious attacker would have planted some malware and left it there for later

MechMK1

@reed I mean, a lot of infosec kids are also massive shitposters

I would totally hack a website to deface it, just to put something funny there, like a manifesto that you should return your local shopping cart

If you really want to go all in, hack the registration form to require customers to upload pictures of their genitals "for verification purposes"

reed

I have a very criminal mind, I would not waste a vulnerability just for some lame defacing

OTOH I'm not a criminal either, so if I find a vuln I just take some notes for "later", a later time that probably never comes

MechMK1

2:32 PM

I'm not a criminal, I'm just a shitposter

And the thought of some confused 50 year olds uploading pictures of their dicks as age verification is hilarious

Even more the face of the sysadmin who wonders why the web server backup has a directory labelled "dicks" with countless pictures of penises on there

reed

if I just wanted to have "fun", I guess I would inject some code on the website to generate "weird" bugs, sometimes, at random. Like injecting swearwords somewhere, but after you reload the page they are gone.

MechMK1

@reed Oh yes, I love it

My dream would be to hack a page of the german government and distribute national socialist ideology through it

The biggest fucking shitpost of all time

reed

I think it would be a "gaslighting" technique, or something else I don't remember (what do you call bugs that are too hard to reproduce because they are inconsistent? Like partial failures, then it works again)

MechMK1

@reed heisenbugs

Gaslighting is something completely different

Gaslighting is a technique abusers use to try and convince their target that they are insane and cannot trust the things they see and hear anymore.

reed

ok, so we could say that heisenbugs might gaslight you, LOL

MechMK1

2:36 PM

Maybe, yeah

reed

even though they are not people

MechMK1

Also, if you want to be an asshole, inject this into random header files:

reed

that was the concept but yeah, heisenbugs was the term

MechMK1

#define true (rand() % 100 < 98)

Anonymous

Ugh.

MechMK1

2:38 PM

Or, my favourite:

Anonymous

I can't focus.

Anonymous

So annoying.

reed

me neither, I should go for a ride, but I'm procrastinating the procrastination

MechMK1

#define ; ;

The left is a semicolon, the right is a greek question mark

Anonymous

Yeah I am very much doing that too, reed.

Anonymous

2:39 PM

might just take another modafinil

Anonymous

but youre supposed to wait 12 hours between each 200mg so

Anonymous

its only been like

Anonymous

5

reed

@MechMK1 that's cool, lol

MechMK1

Awww, ; can't be a macro name

Anonymous

2:42 PM

Do you know what pisses me off?

Anonymous

Why is it every time I take modafinil

Anonymous

I get so fcousd on everything

Anonymous

BUT MY WORK

MechMK1

Though feel free to inject a custom keymap that prints ; when you press ;

@J-- Take everything else except Modafinil then

Anonymous

Might have to see what coke is like for work performance :^)

Anonymous

2:43 PM

I say work, I mean study. I have the day off.

reed

drugs aren't the answer. Well, unless you sell drugs. Then yeah, they are pretty much the answer

Anonymous

I am also exaggerating. Modafinil often helps me study.

Anonymous

But today I just feel like reading pages of nonsense about random nonsense.

Anonymous

I don't know why.

Anonymous

Burn out, maybe... It has been like 50 something days on this course now. I am getting a little tired.

Anonymous

2:46 PM

It is definitely burn out. And anxiety.

Anonymous

I am not looking forward to this exam.

Anonymous

I procrastinate a lot when I get anxious. I know that for a fact, even if I do not like to admit it.

Anonymous

I am very much someone who is like: "if i dont do it i cant fail"

Anonymous

Because I really hate failing.

Journeyman Geek

@J-- lol

that's me

Anonymous

2:47 PM

And I know im going to fail this

Anonymous

and so if i dont do it at all then at least i didnt fail

Anonymous

@JourneymanGeek yeah it sucks...

Anonymous

I haven't figured out how to deal with it yet...

reed

my thought is more like "It's very hard, I need to concentrate too much, and I don't even know if it's worth it after all. Is this the real purpose of my life?" Then I procrastinate

Journeyman Geek

@J-- I'm about 4 levels of procrastination in

reed

2:49 PM

so I end up doing stuff only when I really HAVE too, which is always too late

MechMK1

I am too lazy to even procrastinate in the DMZ

I am off work already, but I am too lazy to shut down my work laptop and move to my gaming PC

Anonymous

@reed I for sure don't suffer with that, well, very rarely.

Anonymous

I just procrastinate when I feel like I'm not gonna do well.

Anonymous

BEcause the thought of me being bad at something that is computer related is... awful.

Anonymous

I am bad at EVERYTHING else in life

Anonymous

2:50 PM

SO being bad at this is not something I like to imagine

Anonymous

^ what a fucking stupid problem to have like actually

Journeyman Geek

@J-- lol. I do some stuff that people are like "whoaaaa?"

And I can't code

not everyone is good at everything

Anonymous

I know that, but I am not expecting to be good at everything.

Anonymous

What I mean is, I am bad at everything in life that doesn't involve a computer.

Anonymous

So the idea of me failing something to do with tech just makes me wanna die inside.

Anonymous

2:52 PM

Especially something I really enjoy or care about

Anonymous

TL;DR: im a sore loser :D

Anonymous

And then I procrastinate for hours on end to try and escape the idea that I could fail. then i fail anyway for not trying hard enough lul

reed

failing is the standard in tech, I gues

Anonymous

Yeah, that is why I believe that it is totally stupid for me to believe I can never fail.

reed

the halting problem can't be solved, but the bug problem can: "Does this program have bugs?" The answer is always yes

Anonymous

2:55 PM

Or never wanting to fail.

MechMK1

Did your comment just have a bug?

Anonymous

:D ^

MechMK1

Your too

reed

@MechMK1, exactly, I wrote "yet" instead of "yes"

funny, the answer to the bug problem had a bug. And it wasn't a joke, it wasn't on purpose! OMG

MechMK1

My bug is that my markov chain got stuck and now the only answers I can give to something are "based" or "cringe"

Anonymous

2:56 PM

hahahahahahahhahahahahahahah

MechMK1

"We've already received the PtA document and we're waiting for the CTO to sign it"
"Based"
"What?"

Anonymous

That reminds me of the time I replied to my boss with a Twitch emote.

Anonymous

As in, I said a Twitch emote to something he said to me in a real life conversation.

Anonymous

For those wondering: "POGGERS".

Journeyman Geek

@MechMK1 the one the Janitor actually signed?

reed

2:58 PM

Uncaught Cringe at line 125: function mysql_query() is cringe and will be removed in version 2

Anonymous

This is POGGERS.

Anonymous

At least I didn't say BOOBA to a female in real life, yet.

Anonymous

Probably get sectioned...

MechMK1

@JourneymanGeek "The PTA was signed by our cough cough"

@J-- I may or may not have used the term "milkies" before

Anonymous

2:59 PM

Hahhahahahahahahahaha

Anonymous

Oh no.

Anonymous

In a really bad way or a somewhat explainable way?

MechMK1

What am I meant to do?

Anonymous

Yeah, I can't blame you.

MechMK1

A boy needs his mommy milkies

Anonymous

3:00 PM

I think that word in my head every time I see some, you know.

Anonymous

It's like a natural reaction for me to shout BOOBA.

Anonymous

I just don't do it out loud. Not yet at least :D

MechMK1

"Your milkies seem heavy, ma'am. May I hold them for you?"

Such a stupid joke but I giggle like a kid every time

Anonymous

Hahahahahahahhaha

Anonymous

Is that your pick up line?

Anonymous

3:02 PM

Might steal it...

MechMK1

>pick up line

Implying I speak to people IRL

reed

can I ask a quick unrelated question: when you have to spin up a VM to test something, what do you usually do? Use your usual up-to-date VM and take a snapshot, so you can restore it after you're done? Or create a VM copy? (which takes longer). I just wonder how you "manage" your VMs whenever you need one

MechMK1

>unrelated question

You mean a question not related to big mommy milkies?

Sorry, those are off topic in the DMZ now

Anonymous

lul :D

reed

unrelated to anything, lol

MechMK1

3:03 PM

unrelated to milkies

@reed In all seriousness, I have on VM per customer project, just spin up my template, update it, then copy

Anonymous

I lost.

Anonymous

KEKW

Journeyman Geek

@reed the problem with snapshots is - well if you use the same VM for different things it gets messy

so... I'd spend the time and space initially for a new VM copy

Anonymous

I genuinely think I might be one of the only people who doesn't use snapshots...

Anonymous

3:05 PM

I just make new VMs, am I weird?

Journeyman Geek

and use snapshots for point in time 'saves' if I am going to so something that takes time to fix

MechMK1

Honestly, it doesn't really matter

This feeling that "you're doing it wrong" is just in your head

If it works, it works.

Journeyman Geek

@MechMK1 cause we're all going to die?

oh that too

MechMK1

@JourneymanGeek Both.

Our mortality is an undeniable fact.

Journeyman Geek

@MechMK1 oh, less 'wrong' than 'this is one reason why this approach should be considered'

reed

3:06 PM

I see, it's more or less what I do, I tend to make copies. However it might be a pain to maintain several VMs, so I thought someone was using something else (like maybe Vagrant?)

Journeyman Geek

@J-- oh for backups its nice

Anonymous

I just back up the entire VM?

Journeyman Geek

I have an automated system for snapshotting and backing up my 'production' containers :D

Anonymous

I mean, uses more space I guess but...

Anonymous

Storage is cheap...

Anonymous

3:07 PM

So who gives a fuc.

MechMK1

@JourneymanGeek Look, if snapshots work for you, then they work. if you prefer full copies, that's fine too. If you have some process where you can fork an up-to-date OS image, go for it.

Journeyman Geek

@J-- for now. Until chia farming starts.

Anonymous

:D#

Journeyman Geek

@MechMK1 that too. Hence talking about when one approach makes sense

MechMK1

But this nagging feeling that everyone else is doing it "properly" and only you're hacking along halfheartedly is counterproductive

Journeyman Geek

3:08 PM

I mean if you're super organised, you can do a single VM with a branching tree of snapshots....

MechMK1

@JourneymanGeek Do any of the people here fit the description "super organized"?

Journeyman Geek

@MechMK1 I'm not judging.

reed

especially when you find out that those doing it "properly" are constantly changing their definition of "properly" and switch technology every other day

Journeyman Geek

But yes 'whatever works' is good

Understanding the benefits of each approach is also good.

As is cheese.

MechMK1

Help, I set my white balance wrong and suddenly everyone is screaming at each other about whether they've been to Colorado.

It just felt very related

Anonymous

3:09 PM

lol

MechMK1

Also I've never been to Colorado

Anonymous

Me neither.

Anonymous

I don't think I'd enjoy it there much, doesn't seem a lot to do other than smoke weed.

reed

I don't know the difference between Colorado and Eldorado

MechMK1

One has icehockey

Journeyman Geek

3:11 PM

There's a road to one.

MechMK1

Also there's been a bomb scare in my city

Some dude was on a train and yelled he's gonna blow everyone up

But he didn't

Fucking poser

Anonymous

Jesus.

Anonymous

Do they know why yet?

Anonymous

Not that they will reveal the actual reason... I doubt.

MechMK1

Probably mental illness

I mean, the lockdown got many people to their breaking point

I can see why someone would do this as a "cry for help"

reed

3:14 PM

or maybe a bug in the bomb

Anonymous

Yeah, a very good point.

Journeyman Geek

or depending on the country

could be an attempt to suicide by cop, or get arrested.

Anonymous

Oh @JourneymanGeek

Anonymous

I got my taobao mouse mat!

Anonymous

Pretty okay.

Journeyman Geek

3:15 PM

._.

MechMK1

I don't know if there even was a bomb

Anonymous

The printing goes onto the stitching in a few places, slightly annoyed by that

Anonymous

but the design is cool

Journeyman Geek

glares at the aliexpress vendor who hasn't shipped my new mini pc yet

MechMK1

Also given how incompetent our cops are, attempting suicide by cop will likely end in death of old age.

Anonymous

3:16 PM

I would like it better if the print didn't go into the edges.

Anonymous

@MechMK1 lol

Journeyman Geek

I think they're playing the silly buggers game of a fake tracking ID, then when they actually ship it giving a new one

Anonymous

Yeah, a few companies have done that to me before... ^

Anonymous

JESUS HOW MANY TIMES

Anonymous

CNA THEY USE THE WORD FORMATTED STRING

Anonymous

3:18 PM

IN A SENTENCE

Journeyman Geek

and the cheap cables I ordered 2 days later has reached me before the thing that's supposed to be sent via courier... which hasn't even been shipped yet.

Anonymous

IF I CAN FORMAT STRING MY FORMAT STRING MAYBE I CAN USE A FORMAT STRING TO FORMAT STRING THE STRING AND THEN THE FORMAT STRING WILL HAVE FORMATTED THE FORMAT STRING AND WE WIN WITH A FORMAT STRING, YOU FORMAT STRING.

Anonymous

I can't be bothered today. I am gonna lose it.

Anonymous

Anyone ever have those days where you just feel like breaking a bunch of shit or just me?

MechMK1

I feel like I can push J's buttons just by saying fmtstr

Anonymous

3:23 PM

Yeah, you actually could.

Anonymous

I'm at boiling point :D

Anonymous

fuck it.

Anonymous

another 200mg of modafinil

Anonymous

whatr coulkd possibly go wrong

Anonymous

other than a resting bpm of 180

MechMK1

3:29 PM

Death.

Anonymous

Well, at least I wouldn't have to worry about this exam anymore, right? :D

Anonymous

NODDERS

Anonymous

IM BURNED OUT AS FUCK

MechMK1

Maybe take a nap?

Anonymous

I fucked up my whole sleep schedule I have hardly been awake that long.

Anonymous

3:39 PM

I can just feel the burn out like...

Anonymous

I don't know how to explain it.

Anonymous

I am reading stuff I was really interested in like no less than 7 days ago.

Anonymous

Now I'm reading it and all I can think is.. "fuck this".

Anonymous

i need to get some other hobbies man

Anonymous

fuck

MechMK1

3:42 PM

That's why I have a guitar

Just play metal

Be heavy as fuck

Anonymous

This is the issue I have; I am not interested in anything else, not really.

MechMK1

Well, I invest my money like a true connoisseur: More waifu pillows

Anonymous

hahaha :D

MechMK1

So, time to play vidya, so the dark thoughts don't settle in

Have a good one, my friends

Anonymous

Goodnight, Friend.

Anonymous

7:06 PM

Im going fucking insane dude

Anonymous

life advice: have something you enjoy other than the computer

3

Transcript for