« first day (3842 days earlier)      last day (1026 days later) » 

7:55 AM
Mooooorning :S
 
 
2 hours later…
9:27 AM
there's too much crap in linux distros
useful tools, popular software, countless little libraries... and who's going to maintain all that? And how? I guess the probability that the FBI, the NSA, the Chinese government, the Russian Government, already have some "maintainers" in several repositories or projects is pretty high
I hope I'm just paranoid, but lately I've been thinking that a supply-chain attack on most Linux distros would not be difficult, and sooner or later it's going to happen
 
9:48 AM
only as much as closed source tho
open source isn't magically more secure
it's more secure, because you have the option of looking into it
 
open source can potentially be more secure, but in practice it depends (quantity and quality of eyeballs)
 
It's not that hard to become a security maintainer of Debian.
So, to become a package maintainer... should be even easier
@reed It's not being paranoid, it's being careful by trying to foresee the future
That's healthy, even if you are (hopefully) wrong
 
yeah, because I'm not talking about being conspiracy theories, supply-chain attacks do happen and maybe they'll be the best option in the future. Exploiting vulns with all the layers of containerization and security features that we keep on adding, might become more and more difficult. Supply chain attacks, on the other hand, allow the attacker to execute code directly, by exploiting organizational issues and trust issues
In a whole OS, there are probably several weakest links. Just a few days ago, I discovered that VLC in Ubuntu's repos is not up to date with security patches (I also asked a question), and that's very worrying, no matter if the package is in "universe" or not
 
10:13 AM
Thing is, you likely don't need to exploit the supply chain in opensource really
you only need to find the bugs (and not report them)
So sadly, part of the security of open source comes down to 'how much funding do you have'
 
10:42 AM
0
Q: Why aren't governments taking steps to make end-user products more secure in terms of IT security?

FestplatteObviously some manufacturers do not care too much about making their products secure and the vulnerabilities, if any, are only found by volunteer hackers, it at all - for example in IoT products. Most end users cannot take (advanced) protective measures or perform security audits to protect their...

Because this shit worked so well for cookies
 
I commented there with a concept I read about some time ago
 
Besides, a ton of politicians are not exactly "tech-literate"
I simply don't trust someone who doesn't know the difference between a browser and an operating system to make reasonable decisions about information security.
 
apparently the IT field is considered to be more complex than the others, and no one judge dares to blame programmers for their mistakes. So a "bug" is no big deal, sometimes even if somebody dies or could die
 
It reminds me of the deadly programming error in a radiotherapy machine
Do you know which one I am talking about?
 
yes, I heard about it
 
10:46 AM
I think it depends on the level of fuck-up and intentionality
 
I don't think there are many products on the market that are provided "as is". In IT though, we are basically building a world on top of "as is"
 
What does "as is" even mean?
 
I guess it means "the way it is, accept it, whatever it does"
 
Isn't that pretty much for everything?
Fun Fact: Word becomes unusable if you open a document which has a reviewed change on a table of content
 
I don't know, but I think not. Lots of products have regulations, otherwise they can't be sold legally. Software on the other hand, if provided "as is", it's even without any guarantee that is it "fit for purpose" (I guess that's what is written in licenses)
I might be wrong, but I'm pretty convinced that there's something obviously different (and wrong) in how software is developed and distributed, compared to other products in other fields
 
10:54 AM
I know here in Austria that a product sold must have at minimum the features a "reasonable person" would expect it to have. So for example, if you bought a phone, you would expect to be able to make phonecalls with it or charge it.
 
yes, and in theory that should apply to software too, that's why I suspect most licenses where they mention the "as is" paragraph, are actually invalid
 
I suspect most EULAs are actually invalid, but nobody challenges them in court
Then again, software is complex
Allow me to make an example:
Imagine there is a calculator app that you use, okay?
And it comes with a pow() function
But for some reason, taking something to the 19th power, the result is incorrect
Someone uses the application, unknowingly gets an incorrect result, and the result is some disaster
The user then sues the developer, and the developer reveals their sourcecode
 
If a freelance makes a website with WordPress, they are actually using software provided "as is". The result is that the freelance is responsible for providing a "decent website", and if something goes wrong (WP has vunls, etc.) in the end it's the freelancer's fault for trusting WordPress. WP's developers on the other hand, don't care at all
 
And it's just return pow(inputBase, inputPower);
So the developers claim that their application makes use of their framework's pow() function, and that they did everything correctly
So then the blame begins to shift around to the framework, which may be open-source with a ton of developers, weird edge-cases that were undocumented, etc...
Who is to blame in the end? It's just a weird bug nobody could have reasonably seen
 
yeah, sounds like an interesting example. Who's to blame?
I suspect, in real life, the blame goes to the professional who did the wrong calculation using the buggy software
because they used a software that could have had bugs, and didn't make sure the calculations were right by double checking, etc.
so in the end software is crap and we should not trust it. But we are heading to a future where the whole world is based on IT. So the future will be crap
LOL
 
11:04 AM
>the future will be crap

Could have told you that from the beginning
But I honestly doubt that the person making the calculation could be charged with anything. After all, it is unreasonable to assume that someone could calculate 7821^19 in their head or on paper.
And if two calculator applications happen to use the same faulty framework underneath, then they would print the same result.
 
wait, I found another product, other than software, that is provided "as is"
Covid vaccines, LOL
 
Yeah, which is why I am not taking it
But don't you DARE question that the vaccine is the best thing ever
Seriously, look at videos of people dancing and celebrating the vaccine
It's like a fucking cult
 
I got vaccinated the other day, only my arm hurts a bit, nothing else. With Pfizer, first dose though
 
Also 7821^19 = 93,752,624,006,297,204,552,232,395,318,766,179,348,470,406,797,252,715,330,200,049,358,843,760,981
@reed I hope you don't get any side effects from the second dose either
By the way, the number above is slightly wrong
 
@MechMK1 Yeah, but the problem is (and something I'm sometimes afraid of), if you use "popular software", maybe produced by some company, you might be able to justify your choice. But what if you tell the judge: "I used FooCalculator installed from the FooLinux repo, it's the best Linux trust me"
 
11:09 AM
Then the question depends on what a "reasonable person" would do
If you used a software that was "common" - by whatever measurement - in the industry you are working in, then you're probably safe.
 
reasonable people use Windows or Mac, get vaccinated, and maybe also go to church.
 
I had a discussion about this recently, about how many firearms a "reasonable person" would be able to own.
For example, if you're a hunter, it's not unreasonable to own different guns depending on the game you're hunting
.223 or .308 for buck, 12ga for hogs, 20ga for pheasant, etc...
So 4 or 5 guns would be "reasonable"
However, for an anti-gun person, even 1 gun may seem "unreasonable"; if you believe that "no person should own a gun"
Which is why I believe the term "reasonable" only makes sense on non-political topics.
 
Not all software is sold as is
 
A reasonable person could assume that a pair of headphones would be able to play music.
 
Certain software is certified etc.
 
11:15 AM
Why the fuck do companies not include a press kit? Or at least have an SVG version of their logo on their website?
Shitty 200 x 70 px logos
 
11:29 AM
morning guys!
 
Oh my god
 
I will take the vaccine as soon as it's available for me, probably mid-September. I know it's provided "as is", but my corporate VPN runs on UDP and it's better than no VPN
 
I am just qa'ing a report
And the admin user provided is called Jonathan Joestar
Reminds me of a pentest I did in January this year, where I did some shopping platform and the default product was the Lucky Star DVD collection
Weebs everywhere
 
11:45 AM
just moved to a new city, going on google maps to see local bakeries recommendations and 95% of the comments on all bakeries are a single word: "top"
and would be nice if "sort by" had "word count"...
 
Some software are not provided "as is", because the impact of a fault would be too high. For examples: autopilot in planes, "autopilot" in automated subways, control software in nuclear power plants, some satellites, and any piece of software certified by CC EAL 6 or 7.
2
 
even some vehicular software
the ECU, the transmission control software, ABS...
 
The Chernobyl disaster happened because of a bug in the plugin for controlling the reactor temperature. It was a Firefox plugin called "Easy Core Temperature"
They tried to update it, but the update process got stuck, so they decided to go get the files directly from GitHub
however the version on GitHub contained ads to support the plugin creators. When they tried to check the temperature of the reactor, an ad popped up and covered part of the screen where the temperature was written. And the popup wouldn't close by clicking on the x symbol, because of a bug
Ok, it didn't go that way. But that's what would have happened if nuclear power plants had common software
 
12:02 PM
I was told the error was because they had to click "Accept Cookies" before the plugin could check the temperature and send alerts, but the server was headless...
0
Q: Is it OK to save user passwords into plaintext?

user260338Basically i want to easy recover user passwords if required i hash them into database using bcrypt but I tried backup non hashed passwords into a plain text file (*txt) not accesible over internet, Is that correct and secure? I'm using secure password for vps remote desktop, i use i dont think th...

stupid question of the day? week? month?
 
12:20 PM
Ask a stupid question, feel stupid for a few minutes.
Don't ask a stupid question, remain stupid forever.
2
 
"Hello, can I talk with the database admin at Stack Exchange? I forgot my password, I need it to log in to my bank, it's urgent"
 
12:46 PM
@MechMK1 Makes me wonder, what's the reasonable amount of guns for a serial killer or a rebel or something?
 
or a drug dealer...
here a drug dealer got caught with a couple restricted guns, and in his defense he said he has to protect himself against the other drug dealers, in this words...
 
@nobody Depends on whether or not they rebel against something I like or dislike.
@ThoriumBR Fun Fact: You are allowed to use illegal weapons for self-defense.
As in, it still counts as self-defense, even if you use a machinegun. You will still be tried for possession of an illegal weapon though.
 
1:05 PM
here you are not... and some of the guns he had were exclusive for the military during service...
 
I find that weird.
 
self defense during a shootout for controlling a drug selling point does not count
 
If someone threatened to kill me, then it should not matter what weapon I use to defend myself, even if I am not legally allowed to use that weapon. It doesn't change the circumstances of the act of self-defense.
@ThoriumBR I would agree. The reason why I was defending myself was because I was committing a crime.
I would not argue that someone who robbed someone and shot them was acting in "self-defense" because the person he robbed had a gun to defend themselves.
 
you could grab whatever has at hand to defend yourself, of course, but he had the guns on his home and car when cops "interviewed" him...
 
But for instance, imagine two people threatened you with guns. One drops their gun, you pick it up and use it to shoot the other person. You still used a firearm you were not legally allowed to possess.
It doesn't change the fact that you acted in self-defense through no unlawful action of your own.
 
1:09 PM
I misstated myself... you are not allowed to possess an illegal firearm to protect yourself in case someone threatens yourself, but when your life is at risk, you can defend yourself with whatever you have at hand
 
Correct
Of course, you're not "allowed to own" an illegal firearm here either
 
he had a stockpile of guns, some illegal, because he was at war and stated just that
 
But if you "happen to come across one" during an instance of self-defense, it does not change the nature of self-defense.
 
do you guys know of an auto-responder bot for whatsapp that parses the message you received and send an automated message?
 
Unfortunately, no
There has been a case here in the 80s with two biker gangs
Where one gang attacked the other, and a member of the defending gang used a sawed-off shotgun to fatally shoot two people.
 
1:11 PM
I was shopping for an ISP on Monday, and one provider keeps spamming me "do you need internet? we have great packages!" messages all the time but they don't have coverage here...
 
Persecution claimed that it was not self-defense, since he was inciting the attack. The defense claimed that the angle of the projectiles, entering from the bottom and exiting through the skull, as well as the wounds all over the defendant from being attacked with chains, suggested that he was laying on the floor and being attacked with chains, which constituted a deadly attack.
The defendant won the case, ruling the shooting a "self-defense with deadly outcome". He was still prosecuted for possession of a class A firearm without the required permit.
 
it's a complicated situation both for the dead and the survivor
 
I'd say if you roll up to someone's home with chains with the intention of killing him, then you have to expect that said person will object to said killing with deadly force.
In simpler terms: "Fuck around, find out."
 
agree
 
And I will be honest: It doesn't change anything for the two dead people if the firearm the defendant used was an illegal sawed-off shotgun or a legal pistol.
 
1:24 PM
or bare hands
 
Correct.
The intention of using deadly force was obvious.
Beating someone on the head with a heavy chain while they're laying on the ground displays a clear intention to kill.
 
2:22 PM
I will build my own bot...
and will auto-respond to every message selling me internet
 
I don’t even understand the point of banning certain firearms and not others
@ThoriumBR Messages on the internet selling you internet?
 
yep
 
Actually someone should build a good AI chatbot designed to engage people trying to sell stuff and waste their time
 
they message you for upselling you a new plan
that's the next step
 
Telcos message us here too, but it’s only sms.
 
2:29 PM
here I only get phishing on sms
 
they don't also call?
 
they dont call... takes more time
 
here it's common to get phone calls, asking you to invest money (some financial scam or something I guess)
 
you can send sms to a million people by yourself, you cannot call a hundred people by yourself
 
also, phone companies call to offer better internet plans, etc.
 
2:31 PM
almost every phishing sms scam is to you to access a site and enter banking password
 
@ThoriumBR I assume you have a bot to do that every time?
 
I once had scripts filling their databases with junk
 
Sad that I don’t get spam
 
but now I just report tem to cloudflare, as almost every of them are behind cloudflare
 
2:44 PM
I just learned that python doesn't exist
it's either python2 or python3
then there are packages called "python-is-python2" and "python-is-python3", to install an alias
 
bot ready... I've just tested and it works nicely
 
the not-so-funny thing is that I just noticed that Oracle VirtualBox, when you install it, is going to install python2 (which is not maintained anymore). Why? Because it requires any python, but Ubuntu's python is "python-is-python2", which is going to install python2
 
@reed It does in debian
 
sent myself the message they send me, and the bot answered the same second... next step is not hardcode the trigger words and reply message, and put on a json file
 
@ThoriumBR, you might add a random delay before the answer
 
2:51 PM
there's no need... I just want to let them know I won't be a client because they don't have coverage here
so I don't have to type the same message time and time again
 
@ThoriumBR, can I ask how you coded that? What language, where it runs
 
and if the same person keeps sending me the same message, I may send back several dozen variations of the same message telling that I am not interested, at random intervals
nodejs, runs locally, spawns a whatsapp web on chrome and runs puppeteer behind the scenes
const fs = require('fs');
const SESSION_FILE_PATH = './session.json';
let sessionData;
if(fs.existsSync(SESSION_FILE_PATH)) {
    sessionData = require(SESSION_FILE_PATH);
}

const qrcode = require('qrcode-terminal');
const { Client } = require('whatsapp-web.js');
const client = new Client({
        puppeteer: { headless: false },
        session: sessionData
        });

client.on('qr', qr => {
    qrcode.generate(qr, {small: true});
});

client.on('authenticated', (session) => {
    sessionData = session;
you need npm i whatsapp-web.js and npm i qrcode-terminal before
when you run it, it starts whatsapp web on a chrome window, you pair it with your phone, and it's done... it will save the session for you, so you don't need to pair again the next time you run it
the object message contains all data from the message, and you can scan the message.body for keywords, and use message.reply to send data back
I didn't really coded it, I just grabbed the example, tailored it just a little, and ran it
 
sorry, but you said you received SMS messages... or did you mean whatsapp messages?
 
whatsapp messages
sms messages would take a little more effort
 
no, maybe nobody said that, and by nobody I mean nobody
ok, so you reply to whatsapp messages, cool
 
3:03 PM
yep! now I will read the spammy messages I got, create a pattern, an answer, and create a json file or delimited text file with the patterns and answers...
 
3:24 PM
I'm pissed off, VirtualBox still requires python2 for some reason, and python2 has reached its end of life
 
3:51 PM
the first rule of spam, is don't reply to spam
@reed get a updated version
 
@djsmiley2kStaysInside, the most updated versions of Oracle Virtualbox require python2
that is the problem
 
> tim@MushaV3 ~ $ equery g virtualbox | grep python
[ 1] dev-lang/python-3.8.10_p2
[ 1] dev-lang/python-exec-2.4.6-r4
[ 1] dev-lang/python-3.8.10_p2
[ 1] dev-lang/python-exec-2.4.6-r4
[ 1] dev-lang/python-3.9.5_p2
[ 1] dev-lang/python-3.8.10_p2
[ 1] dev-lang/python-exec-2.4.6-r4
[ 1] dev-lang/python-3.9.5_p2
tim@MushaV3 ~ $
Nope.
 
how did you install that virtualbox, and what version is that? I downloaded the latest deb from the official website, decompress the archive, and inside I can read: python (<< 2.8), python (>= 2.7), python:any (>= 2.6.6-7~)
If I add the repository from virtualbox, the same happens: it wants to install python2. Only if I install the (older) version provided by the Ubuntu repos, then python2 won't be installed
 
It's gentoo, it's built from source.
 
ok, then that's definitely the reason
in fact, I don't believe VirtualBox really requires python2, but the devs are compiling it that way
 
 
4 hours later…
8:03 PM
Stackoverflow, except that the company gets to accept answers as far as I understand
 
8:14 PM
the marketing folks are still high on crack then
 
lol
 

« first day (3842 days earlier)      last day (1026 days later) »