The DMZ

Rory Alsop

18:01

@Iszi excellent - what are the Arqade specific pieces?

Iszi

@RoryAlsop Just one - a mousepad.

Actually, I'm pretty sure Arqade and IT Security are the only ones where I got a site-specific piece.

Rory Alsop

in The Comms Room, 32 secs ago, by Scott Pack

@WesleyDavid So I'm more awesome than The Onion? F yeah!

hahahahaha

@Iszi I have high hopes for outdoors SE

Iszi

I was really hoping for a dice bag or tower on Role-playing Games.

Rory Alsop

@Iszi talking of: kickstarter.com/projects/jamiechambers/building-an-elder-god

Iszi

@RoryAlsop Cool. I wish I had more funds, and "management approval", to throw at Kickstarters like those.

xce

18:06

The Onion <- one of my top sources of news

tends to publish stories 1 year before they happen

Rory Alsop

@xce clever - I like that

Iszi

@xce That would be even more amusing if you actually could give examples.

Andrew Smith

IMHO I think I have discovered some hidden feature in this chat

IMHO it's very unsecure feature

xce

are you looking for a disclosure contact?

Andrew Smith

yes!

but first I need test victim

xce

18:12

haha not me please

Iszi

@xce Not gonna bite on the "give examples"? I was really hoping you had some.

xce

@Iszi, well I said it because I've thought that reading some of the old articles, but I don't remember any the instances

Rory Alsop

18:39

@AviD - think you should pop up an OWASP ad banner on the community ads page:

11

Q: Community Promotion Ads - 2H 2011

What in the Wide, Wide World of Sports is Going On Here? TL;DR -- put images and links in the answers. If they get voted up enough, they will appear on the main site as community promotion ads. But whyyyyyyy? This is a method for the community to control what gets promoted to visitors on the s...

Iszi

@RoryAlsop Yeah, what are we doing about getting a 2H 2012 thread or having that one retitled anyway?

Rory Alsop

@Iszi - I quite liked your Backtrack one - worth asking on their forums whether they would be okay with us using their logo to link to them. Can't imagine they'd be upset with a security site linking to them :-)

@Iszi I see @Rebecca is on it - so we'll find out soon

zwerdlds

Hi all,
I am scoping a project and need a secure web-based login/account creation platform. Preferably in a Linux stack

All I need is some SQL support for the users tables and some sort of server-side scripting a-la PHP or Ruby or Node.JS. Everything except the user-acct stuff will be handled by hand-rolled pages. Does anyone have any suggestions?

I've already looked at drupal but it's overkill on the CMS side, and too difficult to create custom pages.

Scott Pack

@RoryAlsop I agree, I think getting them would be good. I also doubt they would say no, but we should at least ask. :)

Jeff Ferland

@zwerdlds I don't think any of us are in a position to evaluate whether software is suitable for you and reasonably secure from a chat room.

Rory Alsop

18:48

@ScottPack @Iszi - I have asked, so lets see what they say. Also asked it they would prefer to design one themselves, or let us do it.

Scott Pack

Code reviews are hard.

zwerdlds

@JeffFerland Not looking for an evaluation, just looking for suggestions on what to look at.

Jeff Ferland

@zwerdlds What does it pair with? Something like OpenID?

zwerdlds

@JeffFerland We're starting from scratch so OpenID would be fine.

Iszi

@RoryAlsop Thanks. I'd like to see them design one, really.

@RoryAlsop Thanks for jumping on that. Been meaning to get to it. Mind posting a link so we can check in on it?

xce

19:00

@zwerdlds, openid seems great (haven't studied it) but there's a simple lib you can use gitorious.org/lightopenid

zwerdlds

@xce very cool. this is exactly what i was looking for. in the interest of diversity, got any other suggestions?

xce

The whole point of Tor is to be anonymous, but users get facebook accounts with often their full name and address on it, and then log in insecurelly.

^ this I don't understand

also posted wrong thing first lol

why would people log in to facebook using a proxy ?

Jeff Ferland

55 minutes until somebody gets a diamond...

zwerdlds

@xce work restrictions mostly

xce

oh right!

that's really obvious in retrospect

what's a diamond?

zwerdlds

19:04

lol

xce

oh, moderator privs

Andrew Smith

19:35

hi, I am just doing test DDoS to test resilience of my network -

xce

@AndrewSmith, lol

I was about to ask if that was you

Andrew Smith

I am doing UDP flood with VLC - I have "Mars Attacks" movie and I am sending it to port 53 on DNS server and to the non-existing ip number on the network

so far so good ;-)

xce

haha

Andrew Smith

tommorow I'll test with polynomial if he agrees

Scott Pack

Allegedly someone knocked out a power cable in the DC.

Andrew Smith

19:36

I have his ip from this chat, it's enough to paste the picture and ip pops out

xce

how do you have ip from the chat

oh I see

Andrew Smith

if you paste the picture from external URL, it is automatically loaded without clicking!!!

ALL YOUR NETWORK BELONGS TO ME

;-)

xce

so it does..

Andrew Smith

I have really good firewalls - 3 levels :P

Waita sec

OK here you got - you can see your ip

/me = l33t h4x0rr

Lucas Kauffman

god mint y do you always start breaking into pieces after a month

Andrew Smith

19:42

now I can blackmail u properly ;-)

;-) :-)

this has to be fixed!!!!!!!!!!!!!!!!

ASAP!

Lucas Kauffman

how the...

Scott Pack

@LucasKauffman It looks like an auto-generated image. So when your browser requests it they add the originating IP from the HTTP header to the bottom.

@LucasKauffman Meaning, your display shows your IP, mine shows mine, etc.

Lucas Kauffman

ah I see, I thought everything pasted got uploaded to imgur?

Scott Pack

@LucasKauffman Looks like a more relaxing version of icanhazip or whatismyip.

Andrew Smith

moco-sux.net63.net/palm-sig.jpg

when you paste the link, it's get loaded without clocking, just add http in front of it

Scott Pack

19:46

@LucasKauffman Only if you select upload. If you past in a one-boxable item, such as an image file, it effectively hotlinks.

Andrew Smith

it doesnt process image, which is LAME

it links and opens directly

Lucas Kauffman

nifty

Scott Pack

So, in short, it operates exactly like every other linked image on the Internet.

AviD

@ScottPack, what he said over there in the place.

Andrew Smith

Well I would say, that this is not the website, but chat on the website, which suffers from chat-wars

And revealing ip number is highly risky as it's known since irc was born

Considering highly skilled individuals arguing here, ip numbers should be PROTECTED

By 2012, for SURE

AviD

19:51

Less than 10 minutes to go!

Good luck to all the worthy candidates. And to @Iszi.

I kid, I kid.

Andrew Smith

0

Q: Dynamic picture that displays the visitors IP address?

I see this a lot now, jpg files displaying your IP address. To you of course, not to others, they would see their own For example: How is this even possible? If this is possible, would it be possible to log an IP into a MySQL database from the picture as well? Is my IP getting logged when I vi...

ip-address jpg

Here it was fixed

On SO

But not on chat...

So you can gather specific people

who are in chat at the moment

And you can see who is coming and who is logging

hence you can match networks to nicknames

and DDoS in any case is possible

u got the idea, huh

this way you can potentially knock off by DDoS specific ppl

just like it used to be on irc

No it's not fixed on SO either, but on chat it's serious bug, because u can identify ppl

hence it's a major dataleak

Also, it's possible to trick it even further, and drop an exploit with some rubbish content

for example, it should be easy to trigger vlc exploit

by using header content-type - one for SO, one for the users, so it's even in <img>, when you click it, it opens something else

and knocks your browser out ... or runs the exploit...

google.com/test.wmv

google.com/test.mp4

google.com/test.exe

google.com/test.bat

google.com/test.vbs

AviD

here we go....

Scott Pack

drumrolls

AviD

cymbals

cowbell

more cowbell

Scott Pack

MOAR COWBELL

Gilles

19:59

triangle

Scott Pack

crunch crunch crunch crunch

Jeff Ferland

Ok, who is it?!

Gilles

@JeffFerland congratulations

AviD

WELL???

@Gilles you lie

no results yet

Scott Pack

crunch crunch crunch crunch

They must have the intern working an adding machine.

AviD

20:02

ohh maan

not cool

Gilles

@AviD the ballots show Jeff to be the winner

AviD

looks like bert pulled the plug on the abacus.

who's bert?

Jeff Ferland

Im on my phone, can't download file to check

AviD

@Gilles I remain dubious, until I see the official results.

Gilles

@AviD and the official winner is... Richard Daley???

AviD

20:04

until then, I will bid @JeffFerland a tentative CONGRATULATIONS!! welcome to the diamond club.

the rest of you candidates can suck it.

oof commmee OONNN!! we need another moderator already, we're drowning in flags!

Scott Pack

Congrats @JeffFerland. Do us proud, big boy.

AviD

in slightly other news, we had over 130 voters this time. So we're all winners, I guess.

Lucas Kauffman

@JeffFerland congratulations

AviD

except for the other candidates, who lost, so as previously stated, can suck it.

Scott Pack

I'm telling mom!

AviD

20:09

heh

she didnt even vote for you.

Scott Pack

Figures.

Lucas Kauffman

@ScottPack also a bit of gratz to you and @Iszi and @polymional

AviD

@LucasKauffman anybody that installed the app wanna post the breakdowns?

Lucas Kauffman

what app?

Scott Pack

After 6 rounds it was Jeff, Scott, Iszi.

Gilles

20:12

@AviD pastebin.com/CRgt1zkp

AviD

@LucasKauffman and I second that, even without seeing the results - gratz to all you who do the work even without the diamonds. Thanks.

@Gilles cheers!

@LucasKauffman howd you see the results...?

Lucas Kauffman

@AviD I didn't just wanted to support all the people that tried

AviD

I didnt say all that tried - to them I left a hearty "suck it".

Scott Pack

I think he's commenting on the fact that by sheer accident you picked the top 4 positions, in order. :)

AviD

I'm talking about doing all the semi-mod work, without the "recognition"

and the pay, of course.

Lucas Kauffman

20:15

@AviD You mad tiger

Scott Pack

So, if the timing of our nominations/elections/THC were any indication I look forward to @JeffFerland getting his diamond sometime the second week of September.

AviD

@ScottPack really?? it takes 2 weeks??

Lucas Kauffman

well that's how I also voted

AviD

why not semi-immediately.

Gilles

@AviD I think it's manual

AviD

20:16

@LucasKauffman hmmm.... no one actually voted for @JeffFerland, how did he win??

What is this, Italy??

Scott Pack

Chicago.

Gilles

@ScottPack this joke is so 14 minutes ago

Lucas Kauffman

@AviD @JeffFerland there better be a lot of Bunga Bunga stackexchange parties if what @AviD is saying is true

AviD

@LucasKauffman no... sadly havent been to even one yet :(

Scott Pack

@JeffFerland @Iszi sends his congrats!

AviD

20:28

@ScottPack @JeffFerland I agree with @ScottPack about agreeing with @Iszi about congratulating you!

Thomas Pornin

@AviD You agree that @Iszi sent his congratulations through @ScottPack, or you agree that @ScottPack may transfer @Iszi's congratulations to @JeffFerland ?

Andrew Smith

ph34r m455 pwn

;-)

Jeff Ferland is a winner?

AviD

@ThomasPornin indeed I do.

further, I too agree that @ScottPack agrees with @Iszi, regarding said relayed sentiment.

Thomas Pornin

@AviD I agree to that, but I point out that it is an inference; it is not explicit that @ScottPack would agree with us when we agree that @ScottPack agrees with @Iszi.

That's too much agreement for one day. I agree with myself that I should go home.

AviD

@ThomasPornin I agree with that.

Scott Pack

20:36

/me feels dizzy

Thomas Pornin

Bye, people. Let's leave @Jeff revel in his new powers.

Scott Pack

@ThomasPornin SEI still hasn't run the election yet.

Thomas Pornin

@ScottPack So @Jeff is only a PM (as Putative Moderator) ?

Anyway, see ya later.

AviD

Moderator Emeritus?

wait, that doesnt mean what I thought it does.

not that I tend to have a lot of use for academionomy, but isnt there a term for a professor that was not "offically" granted that title yet?

Scott Pack

@AviD In the US Professor is used as a ranked title, so not really. We do use the term ABD to refer to a PhD candidate who has completed all requirements except defense.

AviD

20:45

@ScottPack ah, yeah, that

yup, it works - "All But Diamond".

> " @JeffFerland - Moderator ABD "

Andrew Smith

►

ecommerce in 1969

Scott Pack

@AviD In truth it would be All But Dissertation, but yeah, diamond works too. It's more of an informal thing as opposed to official.

Iszi

Congrats @JeffFerland! Guess that last-minute campaigning paid off, eh?

Scott Pack

There are gobs of reasons someone might end up not defending, even though they do the rest of the doctoral program. So it's also not terribly unusual to meet someone whose terminal degree is, effectively ADB.

AviD

@Iszi that, and all of his sockpuppets.

Iszi

20:49

@ScottPack Thanks for relaying the results, and relaying my congrats.

AviD

@ScottPack and is that still considered PHD?

Jeff Ferland

@AviD It takes time to build rep on every unique account!

Scott Pack

@AviD Negative. It's only considered a PhD if you defend and are hooded.

Jeff Ferland

Now that I'm back from my lunch date... yay!

AviD

@ScottPack well there ya go

Scott Pack

20:49

@JeffFerland Congrats bub.

Jeff Ferland

@ScottPack Thank you!

Scott Pack

Now we just need to wait a week for someone at SEI to remember our election ended for them to run the numbers and you to get hooded!

AviD

@JeffFerland Congratulations! Party's over. Get to work.

Iszi

@AviD Someone's gotta track that meme down and add it to the list.

AviD

Heeeere's your flag.

@Iszi Shockingly, I believe it started with @ScottPack not agreeing with me.

@ScottPack hang on...

Scott Pack

20:52

Probably.

AviD

@Aarthi @Aarthi come outhi wherever you @aarthi... :D

Iszi

@AviD Ah, right. It was an agreement-by-proxy method to avoid showing direct agreement.

Aarthi

@AviD shhhhhh they're working on it

AviD

we have need of your special skillz.

Aarthi

oh?

Jeff Ferland

20:53

@AviD What are you talking about? I just grabbed my first beer!

AviD

@Aarthi yeah, that

thanks!

shhh

@JeffFerland best not to handle the flags till after your third beer.

4

Scott Pack

@JeffFerland Your LinkedIn is out of date, and your picture is terrible.

Jeff Ferland

@ScottPack Yup, yup. I guess I'll add that to the list.

Scott Pack

tsk tsk

You get Intarwebs access on Thursday, right?

Jeff Ferland

@ScottPack Friday.

AviD

20:58

@ScottPack so's your face.

Jeff Ferland

Of course, I might go play in the woods before really using it.

Being holiday weekend and all.

AviD

@JeffFerland NO! Bad mod!

Rory Alsop

@JeffFerland congrats new mod

Jeff Ferland

Feels good to know I'm in the club! Also, business cards :D

Scott Pack

And a 128GB water proof flash drive!

Rory Alsop

21:00

oh, is @Jeff going to be bad mod. I'm still good mod, right :-)

AviD

@JeffFerland Wooot!

Rory Alsop

@ScottPack they are very cool

AviD

@RoryAlsop wait wait, does that make me ugly mod??

Scott Pack

Hey, @Jeff Won!

Rory Alsop

hahahaha

apparently it was rather close - I haven't run the STV app thing yet, but so it seems

AviD

21:01

@ScottPack its official! Official Congratulations to @JeffFerland!!

Rory Alsop

security.stackexchange.com/election/2

Jeff Ferland

Eh, apparently it's not legal until I get my lawyer to read the damn clicky contract...

AviD

to be fair and anticlimactic, it wasnt very surprising results.

Gilles

@RoryAlsop no, Jeff had almost twice as many votes as the nearest contender

Scott Pack

@RoryAlsop Not as close as you might think. Jeff was in the nearly double 2nd.

Jeff Ferland

21:02

I wasn't confident... I thought @ScottPack had a real chance of taking it.

Scott Pack

@JeffFerland Yeah, I wasn't sure either, but I was expecting it to be a lot closer.

Rory Alsop

@Gilles ahhh

Scott Pack

@RoryAlsop pastebin.com/CRgt1zkp

Rory Alsop

well - condolences to everyone else who ran.

Scott Pack

Meh, I'm just happy that jerk @Iszi didn't get it. Man would that be terrible.

3

Rory Alsop

21:07

lol

AviD

all candidates are within 1 place of where I would have guessed.

@ScottPack sorry brawh

sympathy family hug

Rory Alsop

If we'd had 2 that would have been pretty close for the 2nd place

Scott Pack

Quittin time. Have a lovely evening gents.

Jeff Ferland

Hmm... I just handled my own flag from before the election.

Scott Pack

wut

Oo! Do a test flag and see if you can handle it?

AviD

21:14

@JeffFerland heh. do you get points for that?

hey, why isnt your name blue?

I think you need to logout/back in.

Jeff Ferland

@AviD Yup. I marked it helpful.... though I didn't follow through on it.

AviD

@JeffFerland lol

shoulda flagged another few dozen. could have given yourself a badge.

Scott Pack

@JeffFerland Good man. Official SEI guidance is that all flags, if generated in what is understood to be good faith, are supposed to be marked as helpful.

Rory Alsop

@ScottPack :-)

Hendrik Brummermann

21:26

@AviD he is blue for me. Perhaps you need to do the relogging?

AviD

@HendrikBrummermann or, a simple refresh. thanks :$

@JeffFerland you look blue

Jeff Ferland

I feel blue.

Hendrik Brummermann

Hm, i wonder if that phrase has the same meaning in English.

Rory Alsop

@HendrikBrummermann what is it auf Deutsch?

Hendrik Brummermann

someone who drank too much alcohol.

Rory Alsop

21:30

@HendrikBrummermann ahh - no, in English it just is used to mean a bit depressed or down

as in "I got the blues"

Scott Pack

Or, less commonly, sexually frustrated.

Also, hey @Hendrik. Haven't seen you in a while.

AviD

@ScottPack you look blue. Because of the previous two statements.

Scott Pack

Well, one of them maybe.

Thomas Pornin

22:18

@JeffFerland In French, "blue" translate to "bleu", which, besides being a colour, is also a slang term for "beginner".

Scott Pack

23:11

@Thomas In English we use 'green' to mean new.

I assume green is referring to new growth on woody plants. Do you the history of blue?

Gilles

@ScottPack new military recruits from the country who arrived wearing traditional blue coats, according to TLF II.C.2

Andrew Smith

are u not afraid of sitting here with browser exposed? :-) I have my browser running from account in windows, and on the same user session, but without administrator, hence it works no problem, because it doesnt catch java viruses

Gilles

1

Q: Digital signature Libreoffice

I successfully managed to make use of digital signatures in Libreoffice Writer by following flatmtn.com/creating-pkcs12-certificates But now I want to use a digital certificate from eToken/smart card and not from the mozilla keystore directory. How can I achieve this?

openoffice signature

^^^^ not suggesting to migrate, just advertising the question since someone here might know

Scott Pack

@Gilles Ah, that makes quite a lot of sense.

Andrew Smith

LOL pkcs12 is weird

why not x509?

Scott Pack

23:23

@Gilles As expected, Google Translate brutalized that page.

Gilles

@ScottPack ouch, yes, it's a dictionary, with plenty of abbreviations, nominal sentences, a mixture of definitions and examples...

Andrew Smith

Green means new in many languages in europe

Scott Pack

@Gilles When Chrome popped the Translate button, I clicked it with a sense of sadistic glee to see how terrible the result would be.

Transcript for