The DMZ

AviD

00:08

this is hysterical - collegehumor.com/video/6862303/my-elf-girlfriend-sex-talk. For those that like elves, and those that like sex talk.

So, basically, EVERYBODY.

Lucas Kauffman

04:52

@Rory ah very nice :D

Scott Pack

05:12

@RoryAlsop Congratulations! Sounds like you're pretty excited.

CodesInChaos

09:44

One of my pet peeves is people recommending key-sizes without distinguishing confidentiality and authentication, which IMO have pretty different requirements.

Sadaluk

10:22

@Rory you're moving jobs again? Congrats! :)

AviD

@Sadaluk he's a jobwhore :)

or maybe it has to do with the huge ~~gov't bailout~~ bonuses from a couple years ago...

Rory Alsop

10:45

Cheers guys. @AviD- don't think bonuses are at those levels any more! This just seems like a very good role and is a positive career step.

Rory McCune

that's what he tells you all. Really is the opportunity to work at the nice shiney RBS head office , with it's own shops and a staff restaurant that you'd actually want to eat in that lured him in I reckon :op

AviD

@RoryAlsop heheh, was kidding. Besides, I dont think they gave the bonuses to the professionals, only to the top management and board....

@RoryMcCune Right. I'm sure the chance to check out and verify the security for one of the biggest banks in the world, holds no professional interest for him whatsoever. :)

Rory McCune

@AviD compared to shiney offices and good food... nah

back when I worked for RBS we used to get the site-to-site bus over there on a Friday for lunch

@AviD BTW did you see the information about the windows RT jailbreak

AviD

@RoryMcCune no?

Rory McCune

still under development but looks like they'll have it complete soon, so running unsigned desktop code will be possible

basically someone found a way to use a debugger to remove the signing requirement

AviD

10:58

hmm. okay, that's cool... I guess.

Rory McCune

well means things like putty are possible

plus any other open source stuff that can get re-compiled for the platform

AviD

Sure, lets fight all these silly security requirements, they just get in the way of us trashing our machine.

Or, I dunno... maybe we could get it signed?

Rory McCune

heh well it's not for 95% of users but handy if you want to do more technical stuff with it

Terry Chia

@RoryMcCune soon? I read that it was at a very early stage and you have to run that exploit every single time you want to use it.

Sounds like a long way to go imo.

Rory McCune

unfortunately MS have said no non-MS desktop apps on RT AFAIK

@TerryChia yeah so it's a tethered jailbreak for now, AFAIK once you've run it your fine till reboot

AviD

11:00

well, sure. But 95% of those that will use it, will have no clue what they're doing, but just be proud of being Independant, Different, and Fighting back at The Man.

just like jailbreaks on other devices.

Kinda hipster-ish.

Terry Chia

@AviD Isn't that reason enough? :P

AviD

@TerryChia sorry, I forgot the snarkquotes.

Rory McCune

@AviD possibly but then that's just the same as the jailbreak community with every platform :)

AviD

@RoryMcCune exactly :)

Rory McCune

this is the thread where most of the action seems to be happening forum.xda-developers.com/showthread.php?t=1885399

Sadaluk

11:02

@AviD Yeah. I brought myself a signing certificate just because my driver work... well it just makes sense and it isn't all that expensive.

Rory McCune

TBH I reckon MS should have just made it a paid option "unlocked" mode that you buy and sign-up to that fact that if you break it, it's your problem not theirs

AviD

in truth, I will actually be mostly fine with that restriction (yknow, when I can afford the surface). Otherwise, I would just go for the pro.

I plan on having a usage pattern that would not be affected by this, and would actually benefit from it.

Rory McCune

yeah same reason I don't jailbreak my phone or iPad, I like the added security and keep technical work for real computers

Sadaluk

I suspect most people's usage pattern benefits from signature enforcement. Much less chance of letting in the bad stuff.

AviD

@RoryMcCune right. and as we've discussed, I plan on setting up to do the technical stuff remotely on the RT via rdp.

@Sadaluk not just that.

the whole windows store experience and such, makes it much easier to swap out hardware as needed. native apps are always a bother.

if most of your data is in the cloud, then apps and configs are the only things that need to be ported on upgrade / switch whatever.

Rory McCune

11:06

@AviD yeah I really like app stores from that perspective, so much nicer than trying to find serial numbers and installation files...

AviD

and I think thats part of where MS is going with this. RT is lightweight, makes it all about the user - the hardware can be switched easily.

supposedly when you sign in on a new device, it syncs all your store apps automatically.

Rory McCune

yep it's like tablet computing for business, so I hope it'll be successful

AviD

bbl, gotta pick up the kid. wont make her commute by herself in this rain....

Rory Alsop

11:23

@AviD- have been checking out their security for the last five years. I know them pretty well:-)

But as @rorym says, they have good facilities including a gym on site... might get fit in time for that Tough Mudder thing...

AviD

12:29

@RoryAlsop I figured as much. Still, being an outside consultant / auditor is just not the same.

Rory McCune

@AviD yeah as an outsider you don't have all the "fun" of really getting involved in the company politics :op

AviD

@RoryMcCune hehe, yeah!

actually I think the biggest thing missing is ownership.

Rory McCune

true that one cuts both ways, as a consultant you miss out on being able to push something through, but on the other hand your less likely to be carrying the can if it all goes horribly wrong...

Scott Pack

If?

AviD

@ScottPack I think the "if" in these big corporates usually has to do more with one's personal marketing skills - that is, if you can spin it right, nothing is ever "wrong".

I've certainly seen some horrible failures touted as great successes.

Thomas Pornin

13:30

@CodesInChaos Yeah, but it is OK to recommend using the bigger of the two indiscriminately. You can tolerate smaller keys for authentication, but it is rarely necessary to have smaller keys for authentication.

CodesInChaos

13:46

While I'd like people to use 256 bit ECC for everything, that doesn't seem realistic for now

For example with SSL I strongly prefer ECDH-RSA with P256 and RSA 1024 over RSA with 2048 bit keys

Lucas Kauffman

why is that @CodesInChaos

@RoryAlsop is that where you chase a cheese?

CodesInChaos

Higher confidentiality and forward secrecy combined with sufficient authentication

vs. medium confidentiality, no forward secrecy and authentication that's unnecessarily slow.

Lucas Kauffman

Is it also as widely supported?

lets keep IE6 out of scope

CodesInChaos

FF and Chrome support it, Opera doesn't

no idea which version of Windows/IE you need

Iszi

Heh. I wonder if this guy has played Munchkin...

Lucas Kauffman

13:52

ah too bad, Opera is my favorite browser

CodesInChaos

Mine too, but their lack of ECC support is sad

Lucas Kauffman

It's funny, most of the people I know that use Opera are German

lynks

wow blackhat is expensive... :(

Lucas Kauffman

@lynks that's why you make your company pay for it

and you throw in terms like business continuity, cloud and market leading in your request

lynks

and of course "synergy"

Terry Chia

14:01

@lynks can't forget the synergy.

Lucas Kauffman

operational excellence

lynks

unfortunately i am part of one of those hipster start-ups that can't afford anything

Terry Chia

> Morality.dll kept throwing exceptions, so I just commented it out. Seems to work fine.

6

cracked.com/blog/…

makerofthings7

15:24

@AviD very funny!

Rory McCune

15:42

ya know I was looking at the General StackExchange Stats (stackexchange.com/sites?view=list#percentanswered) and I reckon we might be the only technical site with 100% answer rate (well depending on whether you count user experience as technical or not...)

Polynomial

@RoryMcCune and the only site with more users than ours that has a 100% answer rate is English Language

Rory McCune

it's a good record, some of the sites are pretty low in terms of percent answered..

Polynomial

we get 9k hits a day :o

6.25 per minute

so more than one every ten seconds, not bad at all.

15 questions per day, too. way more than anyone else, apart from EL&U

Rory McCune

then again imagine trying to keep up on stackoverflow, they get 5200 questions a day!

I'd say they really need to try and break that site down a bit, surely that's unmanageable

Polynomial

they have a lot of mods and a lot of tags

otoh, it's a damn good stress test for various technological and managerial processes

Scott Pack

16:07

@AviD Marketing? Assholes.

Lucas Kauffman

16:18

@RoryMcCune It's really hard to get answers on SF, even for easier questions, because people just don't see them passing anymore

Rory McCune

@LucasKauffman yeah that was what I was thinking when I was saying they might want to break it up a bit, perhaps by language (e.g. ruby.stackoverflow.com, java.stackoverflow.com etc)

Lucas Kauffman

that's a great idea, you should put it up one meta.SO

even if it's just tag filtering

Terry Chia

@LucasKauffman And get burned alive.

Lucas Kauffman

@RoryMcCune You have my sword!

right I'm going to publish some pre-challenges to prepare for the ctf

Iszi

23 hours ago, by Scott Pack

status-declined-too-useful

Rory McCune

16:28

@LucasKauffman unfortuntely I'd guess that @TerryChia is right about the burned alive piece :)

Stack Exchange

Blog - Stack Exchange: Podcast #40 – Random Musings (Plus a Suprise Guest)

Alex Miller on January 10, 2013

You’re listening to the Stack Exchange Podcast #40 (We apologize to everyone who expected Wil Wheaton last week) Your hosts are David Fullerton, Jay Hanlon, and Joel Spolsky. We also have a surprise special guest: Britton Payne(?), professor of Copyright, Trademark, and Emerging Technologies at Fordham University. He knows a lot of things about software patent law, so we grabbed him as he walked by the studio to talk to us.

About 15 years ago, Congress passed the Digital Millennium Copyright Act to create some useful guidelines for the new digital landscape. We talk about what actually happens with the DMCA takedown notices, including loophole issues that Joel has discovered. …

Lucas Kauffman

@RoryMcCune That's what Frodo had to challenge as well and he ended up quite alright (except being mentally challenged)

Rory McCune

yeah but I don't have any eagles to fly me straight over Mount doom so I can just drop the equivalent of the ring in :op

Lucas Kauffman

16

Q: A Security Stackexchange CTF team

Updates: Added first challenge to prepare Preparing Challenges: This is the first challenge to prepare, it's very easy and requires some very basic crypto and scripting skills. What you need to do is to complete the blowfish level 1 of smash the stack. Go to ssh [email protected]...

discussion

@RoryMcCune no worries @RoryMcCune we a @ScottPack for that!

Scott Pack

@LucasKauffman Wait, what?

Rory McCune

16:39

I'm not sure if he's conflating you with an eagle or this is some complex scrubs joke ...

Terry Chia

@LucasKauffman Perhaps you should have the challenge in an answer instead? It would make it easier to look for instead of just cluttering the question.

Polynomial

@RoryMcCune EEEEEEEGUUUL!

Lucas Kauffman

@TerryChia That's actually a valid and good idea

I shall edit my question!

Polynomial

am I the only one that can't get to SmashTheStack's web server for BLOWFISH?

smashthestack.org/wargames/blowfish

just hangs for me

Lucas Kauffman

@Polynomial yea it's broken

is the ssh down again?

Polynomial

16:42

no idea.

Lucas Kauffman

they had some problems

yea the web server has been broken for ages

Polynomial

DNS resolves, but no ping response

Lucas Kauffman

you just need to ssh into their server and you will have the first challenge

Polynomial

might be blocking ICMP (ugh...) but it could just be down

Lucas Kauffman

I just sshed into it

Polynomial

16:43

oh, yup, it's up

stupid ICMP blocking

SSH-2.0-OpenSSH_5.1p1 Debian-4

;)

not got an SSH daemon on this box.

erm

SSH client*

0

Q: Setting up ASP.NET web application on internet for first time; Are these security measures enough?

I have a web application running on IIS 7 in offices on LAN and I wish to upload it to hosting space on (Godaddy) because I like it to be used in my other offices (other cities). This application uses asp.net membership provider for user authentication and the data is gets validated from front a...

.net asp.net sql-server

I can see this becoming a game of whack-a-mole.

Lucas Kauffman

@Polynomial I'll give you the question

lynks

@LucasKauffman if you had picked io.smashthestack.org I could just sit back and do nothing up to about level 20. You just had to pick the one I haven't looked at before :P

Polynomial

@LucasKauffman hmm?

Lucas Kauffman

Here is the Level2 password: GungJnfRnfl
But it's encrypted with a simple substitution cipher.
Decrypt it and log in as level2.

that's it

Polynomial

lol

I hate those kinds of questions.

Lucas Kauffman

16:46

@lynks yea I just wanted to piss you of D:

lynks

attack the 3 letter word i would say

Lucas Kauffman

:D

Polynomial

"here's some ciphertext, go decrypt it!"

and agreed

Jeff Ferland

Reddit line of the morning: Remember how in Halo you could hop in a warthog and fire that machine gun for hours without running out of ammo? I'm pretty sure my first girlfriend remembers that, too.

Polynomial

3 letter word is probably the most obvious

lynks

16:48

it isn't and

at least, if it is it isn't super simple

Polynomial

yeah, figured as much

Lucas Kauffman

It actually was simple

simpler than I thought

lynks

pwnt

@Polynomial in your face :P

Polynomial

I think I've already got most of it

lynks

bah

Polynomial

16:51

6 down, 5 to go :P

lynks

I actually tried all numbers up to 13. Should really always go there first. I did have a script to do this for all 26, even had it match against a simple dictionary to highlight the one it thought was the most likely.

Lucas Kauffman

@lynks I just did all 26 and then just read the output

It would probably take longer for me to find a dictionary :p

lynks

:P i have loads you can have

this is also useful simonsingh.net/The_Black_Chamber/caesar.html

Polynomial

got it

:P

and yeah, it was.

threw myself off at first by trying to make it more complex than it needed to be

lynks

@LucasKauffman is level 2 pastable? or does it require an executable

Polynomial

16:56

I prefer the executable stuff.

lynks

yeah io was awesome

i still have a bunch of passwords somwhere, assuming the havent changed them...

Polynomial

I keep meaning to do a really basic CTF for binary reversing

for beginners

makerofthings7

@CodesInChaos What hash algorithm do you prefer with these: For example with SSL I strongly prefer ECDH-RSA with P256 and RSA 1024 over RSA with 2048 bit keys

lynks

have you hit io.smashthestack? iirc it starts out pretty easy

past about level 10 and it's an evenings work per challenge

Lucas Kauffman

@lynks I haven't looked at challenge two yet :( haven't had time yet

lynks

17:00

@LucasKauffman :P np

CodesInChaos

17:16

@makerofthings7 Doesn't really matter. MACs fall in the "authentication" category, and even HMAC-MD5 is still secure enough for that today. Guess SHA-256 for key-derivation and GCM as MAC would be ideal.

makerofthings7

@CodesInChaos I was mainly thinking of client compatibility... (SHA1 vs SHA2)... what is best in your experience? Did SHA2 work on Opera?

.. or does SHA2 in this context not apply to a TLS/ HTTPS session?

tylerl

I've actually been thinking of building a set of CTF-for-web-developers challenges based on the OWASP top 10. Dead-simple for security pros to go through, but useful for security-unaware programmers so that they can learn security by breaking it.

The challenge isn't building the problem set, it's coming up with the right amount of hand-holding so that they actually complete each task, but learn something in the process....

Thomas Pornin

17:36

@makerofthings7 SHA-2 applies to TLS, depending on the version. SSL 3.0, TLS 1.0 and TLS 1.1 use a combination of MD5 and SHA-1 internally, and (usually) HMAC/SHA-1 for integrity. With TLS 1.2, the hash function is configurable through the cipher suite, but in practice it is SHA-256 everywhere.

CodesInChaos

17:55

For me the part that really matters is ECDHE>DHE>non forward secret suites

Opera supports DHE, but it seems to cause performance problems for the server in some cases. But since I don't run any SSL servers myself, I don't have any practical experience with that matter

makerofthings7

I'm creating a MSFT CA based on ECDSA P256. I'm not sure if that is ECDHE or DHE or what the difference is.

Lucas Kauffman

Ffs traffic jam :(

CodesInChaos

(EC)DHE create a new keypair for each connection

So if the private key associated with your certificate leaks, your conversations still can't be decrypted

You can use (EC)DHE together with any kind of certificate

makerofthings7

18:10

This is my GUI for reference: i.sstatic.net/4BTHL.png

CodesInChaos

For the certificate I'd still use RSA for compatibility

Lucas Kauffman

@code can you configure that side by side with regulars ssl/tls?

CodesInChaos

While using a standard RSA certificate you can configure ECDHE_RSA support in your server

so firefox+chrome will use those suite

I believe that's what gmail does

makerofthings7

@CodesInChaos OK I see... the CA cert selection != what is used in the TLS session (and negotiated during TLS session construction)

CodesInChaos

The cert is used for authentication with all suites, and for confidentiality in plain RSA suites

googleonlinesecurity.blogspot.de/2011/11/…

makerofthings7

18:14

So authentication means "your server X and I'm browser Y (perhaps with or without a client cert)"?

CodesInChaos

Authentication is saying "I'm authorized to serve example.com, and here's my certificate to prove it"

Plain RSA suites prove that by decrypting a client chosen key

which then doubles as the key used to encrypt the connection

ECDHE_RSA suites generate a new elliptic curve key, sign it with their RSA key and then use that EC key to negotiate a key to encrypt the connection

Thomas Pornin

@CodesInChaos You still need the certificate to be fit for signatures. A RSA, DSA or ECDSA key is fine, but the certificate can include extensions which forbid use for signing (Key Usage extension without the digitalSignature flag).

makerofthings7

So I suppose I'm trying to reconcile best practices (most secure) for Browser / TLS sessions versus the CA infrastructure that is constructed prior to the webserver getting the certificate to-be-negotiated (as you describe ECDH-RSA with P256 is pretty good)

CodesInChaos

If you use only an ECDSA certificate, your site can't communicate with opera at all, and configuring multiple certificates seems hard.

Digital Fire

Good Afternoon/Morning Folks

CodesInChaos

18:21

firefox doesn't seem to support DSA certs

so it looks like RSA certs are still the way to go

i.e. use ECDHE_RSA as preferred suites, then DHE_RSA if the performance hit is acceptable, and plain RSA as fallback

FF seems to support DSA certs, but they're called DSS in SSL terminology, and it doesn't support mixing them with ECDHE, so RSA is still the best choice

makerofthings7

RSA for the PKI with a key length of 2048?

.. and perhaps RSA1024 or ECDH P256 for the TLS 1.0 session?

CodesInChaos

might be a bit of overkill.

RSA1024 for the server, and RSA2048 for the CAs sounds fine

Though I'd probably go up to 1280 for the server

But personally I don't think the key strength used for authentication is that important, as long as it's at least RSA 1024

makerofthings7

Would it be true to say that the PKI configuration has a much less impact on a user's perceived performance than the TLS encryption between a browser and a web server?

CodesInChaos

I'm not an expert on that. But it shouldn't affect server load.

Only the size of the server's key and the ciphersuite affect the server load

makerofthings7

(... or browser / mobile device performance ?)

CodesInChaos

18:33

Measure it, but I doubt it matters

makerofthings7

Yup, I'm standing up several CAs to test on various browsers, but am still fielding out what I need to test. This is helpful

CodesInChaos

My knowledge of SSL is largely theoretical

Thomas Pornin

@makerofthings7 Size of the server key can have an impact if the server processes an awful lot of new connections per second. But a simple PC core can already do hundreds of those per second, even with a 2048-bit RSA key, so this effect will be hard to demonstrate.

If you are Amazon or Ebay, you will have to care about these issues

but not really otherwise. Just use a 2048-bit RSA key.

CodesInChaos

My recommendation is to configure ECDHE_RSA as preferred suites, and otherwise not worry too much unless you have numbers to prove it's an issue

makerofthings7

@ThomasPornin So key size is more of a server issue than client issue for CPU cycles? (assuming cryptographic support in the client)

Thomas Pornin

18:36

@makerofthings7 If using a plain RSA cipher suite (no DHE or ECDHE), then it will work everywhere and will be fast even for tiny clients (e.g. 33 MHz ARM7 processors)

If using a DHE suite, then tiny clients may experience some extra delays (up to a few seconds for 2048-bit DH parameters). But merely small clients will not notice it.

"Small" meaning "at least 200 MHz"

Smartphones and tablets are "medium" and are more than fast enough to totally ignore all these issues.

ECDHE is lighter on CPU resources than DHE, but not many SSL implementations support it yet.

makerofthings7

@ThomasPornin Is ECDHE supported in PKI? I don't think I see it in this list: i.sstatic.net/4BTHL.png

Thomas Pornin

@makerofthings7 ECDHE is done at the SSL level; this is out of reach of the PKI

With DHE and ECDHE, the server has a certificate fit for signature, with a RSA or DSA or ECDSA or whatever key in it.

The SSL server then generate a (transient) Diffie-Hellman (or ECDH) key pair, signs the public part with the server private key, and sends that to the client as a SSL ServerKeyExchange message.

A "TLS_DHE_RSA" cipher suite means: "the server has a RSA key pair, and uses it for signatures; the SSL/TLS connection will do a key exchange with Diffie-Hellman; the server signs his half of the DH key exchange with his RSA key"

What you must take care of, on the CA, is to configure the "Key Usage" extension in the certificate you wiltl issue to the server: that extension must include the "digitalSignature" flag (alternatively, don't put any Key Usage extension at all, but the presence of this extension is the default with Microsoft's CA).

Iszi

@ThomasPornin Guessing you might like today's Numberphile:

►

Too bad they haven't posted the explanation of how it was broken, yet.

Oh, and this comment is great:

> So if there's an argument about whether mathematics is any use to society, and a proponent of mathematics brings out the Enigma machine, is that Godwin's law in action?

Thomas Pornin

@Iszi I refrain from looking at videos from work, because that would mean downloading them over my 3G quota, which is not big.

Iszi

@ThomasPornin Ah. Well, it's pretty much an overview of how the Enigma Machine works and an explanation of the maths behind its key strength.

Thomas Pornin

18:50

@Iszi There is also a lot of info there:

Cryptanalysis of the Enigma

Cryptanalysis of the Enigma enabled the western Allies in World War II to read substantial amounts of secret Morse-coded radio communications of the Axis powers that had been enciphered using Enigma machines. This yielded military intelligence which, along with that from other decrypted Axis radio and teleprinter transmissions, was given the codename Ultra. This was considered by western Supreme Allied Commander Dwight D. Eisenhower to have been "decisive" to the Allied victory. The Enigma machines were a family of portable cipher machines with rotor scramblers. Good operating procedures,...

But I guess that moving pictures are just better.

Iszi

@ThomasPornin I'm sure. But I like the way James Grime explains things.

makerofthings7

On the phone with a Citrix Netscaler engineer and he says that Perfect Forward Secrecy applies to VPNs and never seen it applied to HTTPS/TLS

.. even if DH is used on the device

IPSec and IKE work with DH .... though

<correction> he found docs that allow for DH on the netscaler... they are hard to find.

support.citrix.com/proddocs/topic/netscaler-ssl-92/…

CodesInChaos

19:53

gmail uses ECDHE to provide forward secrecy

Iszi

20:42

@AviD My wife came across that one yesterday, too. Love TBBT! They won a People's Choice last night, by the way.

Lucas Kauffman

Ed scudid bought one

tylerl

20:55

So... it has come to this...

2

[root@web1 /]# grep -Iirl hacked /home/*/public_html/

Sordid state of affairs.

Gilles

worse: when the admin/webmaster considers sed -i s/hacked// **/* to be a good enough fix

Scott Pack

Ladies.

Gilles

and laddies?

Lucas Kauffman

@Scott 'mam

Scott Pack

21:16

@LucasKauffman So what were you on about earlier?

So, even though she's sitting here with a 102.5F fever the little one still plugs her ears and averts her eyes when Kenickie and Rizzo start making out in the back of his beater.

Gilles

21:34

blowfish.smackthestash.org is down. Has one of you guys been DoSing it?

Sadaluk

@Gilles smackthestash itself is down here.

been down for about an hour.

I gave up trying to find what I was looking for and instead I prepped my bootloader environment to test my homebrew kernel...!

AviD

@Sadaluk "homebrew kernel"...? You're a masochist.

Sadaluk

@AviD Well...

AviD

Do you pay women to spank you?

Sadaluk

No...

AviD

21:45

or is this all just part of a "learning experiment"...

Gilles

@AviD s/pay/get paid by/

AviD

hehe

@Gilles well, I've never been to France.

Gilles

I get paid to write a kernel, not to get spanked

Sadaluk

@AviD learning experiment. Y'know, like the one where you said "rebuild process monitor"?! (That's actually making much more progress. I can do IO filtering, I can walk the list of loaded drivers, processes, system handles etc... just need to get that info back to userland atm)

AviD

@Gilles ohhh. That makes more sense.

Sadaluk

21:47

Yeah and at the risk of seriously punning, it's not that hard (sorry) to write a kernel. It's hard to make it do anything remotely useful, but that's another matter.

AviD

@Sadaluk hahaha, wow. I didnt say "rebuild it", I said "if you have the knowledge to hypothetically build something like that"....

Sadaluk

@AviD Yeah well

AviD

@Sadaluk oh sure. At uni we all had to write a barebones kernel.

I found it to be a stupid, yet enlightening, excercise.

Sadaluk

I suppose you did only say "could you". Well, the answer is now "yes, yes I can".

AviD

@Sadaluk I guess you never really know, until you know.

Well, now you know.

Sadaluk

21:50

@AviD yep. I've no great ambitions for my project. Just want to have a play with intel-vt really. To do that, I either need to break the linux kernel, or I need something simpler.

I opted for simpler.

As in design simpler. KVM, or Xen, are both quite complex.

I also might have a go with rings other than 0/3 in my kernel e.g. 1 and 2.

AviD

intel-vt and simpler dont usually appear in the same sentence, unless its in reverse order and separated by "than".

Sadaluk

And generally try stuff out, security related things.

@AviD Pah. It's easy to set up a vm once you're in a position to enter the vmm! It's just that it only emulates the cpu, so you have to do the hardware.

The vmm I think will be simple to write. All the rest of it? Nope. V hard.

AviD

So one of the lessons I'd learned from the kernel-writing excercise, was that I had no interest in writing kernels. Ever.

Sadaluk

Haha yeah. Well, the way I see it people either try to write a kernel or a compiler. I've no real interest in compilers, plus they're in danger of being useful/usable. Couldn't have that!

AviD

Don't get me wrong, it is absolutely great stuff to know, I think every programmer should be forced to go through it at least once, to better appreciate what he's building on, not to mention actually understand how a computer system really works.

It's just that I dont want to be involved in that.

@Sadaluk a huge part of writing a compiler is lexical analysis and code parsing. Boring for most people.

Sadaluk

21:56

@AviD Exactly. Yawn. Kernels on the other hand... joke, joke!

AviD

hehe. right.

Sadaluk

The process monitor thingy is probably more fun because it involves a bit of working out how windows does its thing.

Plus, when it's a bit more stable I might be able to actually give it to other people!

AviD

since then I've had the dubious pleasure of having to dive into the kernel - via debugging or source - not the parts I've enjoyed the most, but definitely challenging. I at least took pleasure in knowing that I didn't need to write the damn thing.

@Sadaluk cool. any features not present in the original?

Sadaluk

@AviD Yeah, well - one thing I will say is that my kernel does not TYPEDEF EVERYTHING!

AviD

oo, how about expose it all via powershell...?

Sadaluk

21:59

Actually y'know I bloody love powershell. I had to learn it for research at work and I'm sold!

@AviD No not yet. I'm sort-of combining the procexp like features with procmon ones, because one driver can do both.

I think, but am not sure, that my walking the loaded drivers might be a new feature.

Unfortunately at present I'm walking undocumented structs without any kind of locking... so I need to work that one out.

Or things might get hairy.

@AviD do you use powershell frequently? I'm imagining it

'd actually make a pretty good audit tool.

Since you can just collect everything up in a script.

AviD

@Sadaluk I'm not sure, but I think I remember seeing that in on of those tools.

Sadaluk

@AviD DeviceTree does a pretty thorough job of it.

AviD

@Sadaluk no too often, no.

only know it superficially, its on my list to get to know much better. When I have the time :S

@Sadaluk @RoryMcCune's faerywife is giving a talk about exactly that.

Sadaluk

22:14

@AviD some of these might help: bitbucket.org/arv/scripts/src/23fe6ec5375c/windows?at=master

The add-signature one actually comes from the powershell docs.

Also, you need to know about execution policies: technet.microsoft.com/en-us/library/ee176961.aspx

Otherwise nothing you write actually runs :(

AviD

cheers. now I just need some time....

Sadaluk

@AviD Yep, always the issue.

I had a work mandate to "understand" powershell, plus my current work involves quite long delays, so I've had time to play.

AviD

sadly, its not quite at the top of my priorities....

Sadaluk

Oh the other thing I'd say is definitely use the ISE. It makes life much easier plus it has tab completion and intellisense and other magic. The ordinary I-am-a-blue-cmd-exe isn't so good for writing scripts.

Gilles

22:56

what's our canonical answer (undoubtedly by the bear) explaining how 2^128 is a big number and one does not just brute force 2^128 possibilities?

come to think of it, this must have been asked here or on Cryptography already?

2

Q: is it possible to create a file given an md5 hash

I know this is a strange question, and I know that md5sum is nearly impossible to break... but I'm just wondering if someone here knows if it is possible to recreate a file given it's md5sum hash? I mean, not necessarily the same file as the original but a file that would equate to the same md5s...

md5sum

besides it's not really on-topic on U&L

Thomas Pornin

23:29

34

A: Amount of simple operations that is safely out of reach for all humanity?

As a starting point, we will consider that each elementary operation implies a minimal expense of energy; Laundauer's principle sets that limit at 0.0178 eV, which is 2.85*10-21 J. On the other hand, the total mass of the Solar system, if converted in its entirety to energy, would yield about 1.8...

1

Q: reverse of md5sum

This might be out of ignorance, I apologize, but how complex of a problem might it be to generate a file of size N whose md5sum is X? For example, ls -l wczasp.rb -rwxrwxrwx 1 master master 7273877 2011-01-30 17:13 wczasp.rb md5sum wczasp.rb acf3602b5eb9a2db3e365d3043682faf wczasp.rb ...

hash md5 preimage-resistance 2nd-preimage-resistance

Scott Pack

23:58

@Sadaluk Carlos Perez has been getting all hot about powershell.

Transcript for