« first day (3905 days earlier)      last day (1273 days later) » 

10:49
that model makes little sense for iot. iot won't stream lots of data, so a cheap 4g dongle with a data simcard covers almost every single case. Remote areas without cell coverage don't have many customers for them either.
it would be good for areas with a lot of foot traffic and no free or cheap wifi, otherwise people will just use the free wifi available. with almost every mall having some kind of free-ish wifi, that reduces the market for them
so I don't think this project is financially viable, and that reason alone is enough for me to bet against them
they may entice enough people with the promise of making money on connectivity, but they will make money on bitcoin, pay a fraction to the user. And the user will pay more on power than receive on BTC
and the ROI on those boxes will surely be more than an year, so there's a lot of upfront costs that will hopefully pay themselves in 2 years or more.
Hello everyone.
hi there
Has anyone considered how GDPR impacts the collection and indexing data breaches for the purposes of Threat Intelligence?
that will be a good challenge
For example, systems that parse breach data so you can detect if your org has been exposed. Does GPDR make this difficult to do?
11:04
I don't think so... you are processing "public" data
I suppose it comes down to "if PII is public is it still covered under GDPR?"
"‘[P]ersonal data’ means any information relating to an identified or identifiable natural person (‘data subject’)."
Looking at this I do not think if the data is public or not impacts the definition of what is 'personal data' ico.org.uk/for-organisations/guide-to-data-protection/…
maybe one for a question the board
what I mean is: if you are parsing public data and that data isn't yours, so the owner of the data is in trouble... if you parse that data and the data is yours, you were already in trouble before parsing the data
if we parse the data..even if it isn't ours would have not become processes of that data at that point anyway? "processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller."
11:29
no, you are the processor of the data if there's a relationship between you and the data owner
The one thing I hate the most about PHP is type juggling
No other "mainstream" language gives you two strings, lets you compare then, and then compares them AS NUMBERS
Ask any language if the string "0xAAAA" is equal to the string "43690" and it will say no, they differ in length, or no, the first character is different.
so who would be the owner? Linkedin lost a lot of data, this has been dumped. Linkedin is the controller. Say I collect the data as part of threat intel gathering. Do I become the controller, or am I now effectively in possession of stolen goods?
But not PHP!
In PHP, both strings are converted to an integer first and compared as integers
INSANE
@TheJulyPlot That depends on what you mean by "collecting breach data"
11:36
@MechMK1 now PHP have types!
collecting data dumps parsing it and indexing it
@TheJulyPlot As in, the actual data from a data breach (including passwords, credit cards, etc...)?
@ThoriumBR PHP always had types. The way they handle types is just brain dead
@MechMK1 yeah all of that.
11:37
let me retract that...
potentially very sensitive PII
@TheJulyPlot I'm not sure if you're even permitted to collect that. After all, the data owner never gave you permission
I heard somewhere that in PHP 8 you could do something like int $a = 0 and it would not accept $a = 'foo' later
but looks like it didn't made into PHP 8 yet
@MechMK1 yes this is what I am wondering. There a number of vendors that already do offer a service that does this.
@TheJulyPlot Legitimate vendors, which sell you credit card information of people, who did not consent to this?
11:39
@MechMK1 is handling this data effectively handling stolen goods?
@ThoriumBR The problem is, by nature of it being PHP, it is tacked on and not at the core of the design
And we all know: If it's optional, no one does it
no not CC details, but email addrs, hashed passwords, cleartext passwords
@MechMK1 I always started my VB6 programs with Option Explicit
@TheJulyPlot Well, there is a HUGE difference between a list of hashed passwords and a list of creditcards
@ThoriumBR You did. 99 others didn't.
in fact.....if someone is selling CC details on a crime forum and posts a sample that sample may be collected by a crawler.
11:41
99? I bet 999 or more
I'm not saying it's impossible to write good PHP code. I'm saying that ugly and broken PHP code is the default.
@TheJulyPlot Let's take HIBP as an example: They too have a database of breached passwords
@MechMK1 it's because is very easy to kinda learn and hammer down code and it works
Google even uses this or a similar database to warn you if one of your passwords have been breached
so up to CC data is possible..if not the set intent of the intel provider
@ThoriumBR "works" :D
@TheJulyPlot This becomes a question of "legitimate interest", which is more of a legal term
This question all in all seems a better fit for Law actually
11:43
@MechMK1 a better example would be Dehashed, which shows you the details of the breaches.
@TheJulyPlot As I said, I'm not a lawyer, so I can't really tell on what legal basis these services operate on
if you set your house on fire to warm yourself, it worked
side effects ignored...
@ThoriumBR You see, the issue is that PHP clings so hard to compatibility, so they try to break the least amount of code with each major version
Which is something I don't get at all. When a new major release comes out, like PHP 8 or Python 3 - feel free to break ALL compatibility
You have a chance to right all wrongs, to fix your standard library, etc..
Take it!
that would create a problem like python2/python3 conundrum
python2 was supposed to be deprecated LONG LONG ago but devs refuse to embrace python3
Yes, I know
Changing major things about your programming language always leads to problems
11:48
I have corporate tools written in Python2 that refuse to work at all in python3 and I had to compile python2 from source one of those days
But the problems already existed from the moment the language was "designed", which PHP never was
It just grew
PHP has no rhyme or reason to it
It merely exists
if you use date() on PHP without setting the timezone you get a warning that this is deprecated and will not work in a next version... I get this error since always and it still works.
mark something to deprecate, and DEPRECATE them on the next 2 versions
PHP is a very weird language... some functions are copy-paste of C (fopen, fwrite, fsock_open), others look like Java, others look like functions someone wrote to type less code (filegetcontents, fileputcontents)...
you can mix procedural programming with objects... it's a mess
Yes, it's a mishmash with no clear design philosophy
but it's surprisingly fast for an interpreted language
Possibly
The issue is that all of this mishmash could have been avoided
11:53
I was rewriting some nodejs API in PHP because I don't like to load 100mb of things to run an API
the main loop on the NodeJS was close to 500ms, and got it to 2ms in PHP...
if someone optimized the nodejs code, it could get a performance boost, but I don't believe it would get to 10ms
I don't like JS either
I guess I just don't like web languages
and even if it did got to 10ms, it means PHP would be 500% faster
Javascript is just client side PHP....
Or PHP is server-side Javascript?
I meant server-side JS
Like on Node
I don't like Node either
I still haven't wrapped my mind around the entire Promise thing
half my code works, half don't and I have to rewrite it inside those then() constructs and it feels ugly and kludgy... so I revert to PHP
12:12
Promises are basically just async code
The best explanation is a junkfood place
When you place your order, you get a "promise". You pay immediately, but you don't get your food immediately.
Then, later, at some time in the future, your food is ready and the promise is fulfilled - the food or data you wanted is here.
Or, if an error occurs (ice cream machine broke), you need some error-handling logic
yeah, and that creates all sorts of inconveniences: getUserPassword->then(connectToDatabase->then(retrievePassword->then(comparePassword->then(userLoggedIn))))
Not sure if there isn't a more elegant way of doing this
there are: callbacks... but that creates another whole can of mess
and I watched a couple hours of videos about and still cannot write good async code in nodejs
I just use trial and error whenever I need to write async code
And copy/paste from SO
13:19
those mandatory "security training" are a joke... the correct way to finish your work day is "shutdown the computer so it can receive security updates"
yeah, sure... a shutdown computer can keep working.
Security trainings aren't about security, they're about ticking a checkbox on some auditor's list that they did trainings
I realized that long ago... and it makes me sad.
I have to check the "use complex capitals-symbols-numbers password" and "never write passwords anywhere" to pass
I only memorize the unlock password for my HDD, the master password for the password manager, and my login password because I cannot easily open the password manager before login
I could bypass that, but it's faster to memorize a new password every 3 months
kids complaining on reddit against someone that managed to kill Defender while leaving Defender running, but you need SYSTEM for that... people forget that getting access is only half the job, maintaining access is the other half
13:41
I usually just assess applications, so I don't need to worry about sys stuff
I'm a sysadmin managing several dozen large systems with different passwords on each one
security training done. 94% because I don't agree that Strpny3# is a good password. it's too short, it's difficult to remember, low entropy. it was a good password 20 years ago, when MD5 hashing was a thing
14:05
You know what's a good password? R3memberThatTheCoffeeHereTastesLikeD!rt
Long, easy to remember and all 4 character classes (mainly for systems that enforce this
No i actually like it better with the parenthesis open
It creates a sense of unease
hehe...
a good one is <script src='fi.sh/9Cjf.js'></script>
I don't know if fi.sh is a valid domain, but would be a killer one
:DDDDDDD
I just looked
It's a valid domain, but for sale
yep, just found out too
"Why would I want to use words instead of random letters?"
"Because there are more words than letters in the english dictionary"
14:29
someone upvoted me for a POST/GET security from last year... OP asks the question, 8 people answer, and he says everyone is wrong...
@MechMK1 I don't see any rangers in that password...
@FireQuacker What do you mean?
Passwords must have one character from each of the following classes: fighter, thief, ranger, priest
@FireQuacker and an alignment of chaotic neutral or better?
@CaffeineAddiction Passwords must be good
Also, passwords must be strong, so no low level characters
14:40
@FireQuacker so chaotic good?
Yeah, that should work
Actually, they should only be chaotic, because random makes them harder to guess
How can I create a chat room for someone who asked a question but is too low rep to speak in the DMZ?
Okay, apparently it works already :D
you need rep to talk in DMZ?
I think, but it's something like 20 rep
Fuck, wrong chat :D
15:37
0
Q: How to completely restrict Steam in Linux to defend against remote zero day exploits?

OneAndOnlyMy question is, how can i completely restrict Steam's processes and modules to only have access to what they suppose to, and not be able to do anything malicious, for example running bin/sh or accessing files that it shouldn't? Basically, even if steam has a zero day exploit and an attacker can g...

i just dont even
guy downvoted me and said that he can write a "windows driver" to solve his problem ... he just doesnt know how to do it for linux
how a hardware driver would restrict steam from communicating with or exploiting the rest of the system is beyond me ... this guy knows things!!!
write a windows driver for Linux? that would work...
> I can easily do this in windows by writing a driver and restricting steam's process and its drivers(obviously 1% of attacks will still go through because of its driver, but i can block 99%), how can i achieve it in Linux?
just the everything
the windows driver part
the 1% vs 99% part
my mind is blown
@CaffeineAddiction This dude basically just wants to brag
"Look how smart I am"
 
1 hour later…
16:41
./facepalm ... kernel mode driver. Dude wants to write a rootkit because its "simpler" that buying a new box and isolating it in a diff network

« first day (3905 days earlier)      last day (1273 days later) »