The DMZ

« first day (773 days earlier) ← previous day next day → last day (4405 days later) »

Lucas Kauffman

08:54

morning

1 hour later…

Polynomial

10:09

mornin;

Polynomial

10:46

►

TIME TO RAVE

Lucas Kauffman

10:59

LOL

Polynomial

I lol'd so hard ^

Lucas Kauffman

does anyone play league of legends on here?

Polynomial

nope. I'm an SC2 guy, and therefore am bound by loyalty to never play LoL.

Lucas Kauffman

11:19

@Polynomial I see you want a korean girlfriend?

Polynomial

@LucasKauffman Nah, I'll just marry StarTails Bomber.

or IdrA... I like 'em cranky.

AviD

11:41

this is beautiful - buzzfeed.com/daves4/dumbest-things-ever-said-on-the-internet.

especially the facepalm medley at the end.

Polynomial

That was a painful read.

I almost punched the wall when I saw the "Me and spac. From star wars." one

AviD

heh. geek troll.

the ones not understanding what 2012 is, got me more.

Polynomial

yeah, that was like... wat.

AviD

merkin's are stoopid

Lucas Kauffman

11:57

@AviD You tellin' merkin's are stoopid, you must be one of them natsie lovin' muslim

Polynomial

@LucasKauffman YER TAKIN 'WAY ARRR GURNS!? DATS BREKKIN MA FREE SPEECHES!

Lucas Kauffman

THEY TOOK ARR JOBS!

Polynomial

DEYTURKAJERRRRRBS!

DEY BROKEH JAW? DAY TOOKIS DAWG!

Lucas Kauffman

DURKA DURKA MOHAMED JIHAD!

Polynomial

12:55

haha, I forgot about that one

HAK SHERPA SHERPA, MUHAMMED JIHAD!

DURKA DURKA, ABAKALA! SHERPA JIHAD!

1 hour later…

CodesInChaos

13:56

Not a fan of host proof security @Polynomial?

Lucas Kauffman

14:48

@Polynomial I shall be needing a podcast to keep me entertained 2-3 hours, any suggestions (sec related)

2 hours later…

Polynomial

16:42

@LucasKauffman grab one of the ISD podcast episodes and a random Exotic Liability one

that should cover you for 2-3 hours

Scott Pack

16:56

I got a little annoyed with ISD. It felt like they were trying to cram about 20 minutes worth of content into an hour, and they released daily.

Lucas Kauffman

@Polynomial ty

Scott Pack

@LucasKauffman If you're interested, here's my full list of subscribed podcasts. google.com/reader/bundle/…

Most of them are not information security related, but some are

noob1992

17:16

what is this room about ?

Thomas Pornin

@LucasKauffman I might be an out-of-touch remnant of an archaic era, but have you considered reading a book as an alternative ?

Books don't run out of battery

and they operate even in locations where 3G signal strength is low

@noob1992 Apparently, this room is about eating and drinking the body elements of individuals called Rory, but in a safe way.

Or so I infer from the tags on the upper right corner of the present window.

Time to eat, btw. See ya people.

CodesInChaos

Looks like today is "disagree with Polynomial" day for me.

three times already

noob1992

Does this room talk about start trek

CodesInChaos

technically that fits Mos Eisley better, despite the universe mismatch

noob1992

Has anyone found any vulnerabilities on stackoverflow ?

CodesInChaos

17:26

Nothing major. Just a dozen remote code execution zero days.

noob1992

Is directory traversal still used ?

CodesInChaos

only by noobs

noob1992

What are the most recent trends one should be looking for ?

So I'm guessing different sql injection is the most common type of attacks

CodesInChaos

18:00

guess being careful about orbital nukes wouldn't hurt

noob1992

sql and xss are the more common ones. But is directory traversal still used ?

Polynomial

18:29

Aren't you the guy that came on here the other day asking how to hack StackOverflow?

I do hope you realise that "security testing" (looking for security bugs) in a site without permission is considered a form of attack, which is illegal in most countries.

Which you can and, as several governments have demonstrated recently, will get prosecuted for.

CodesInChaos

Not a fan of secure distributed hosting @Polynomial?

Seems pretty useful to me

Or just not a fan of capability based security?

Polynomial

I just don't see the use-case for encrypting on the CDN server and decrypting via JavaScript.

perhaps encrypting the entire CDN instance in a TC system volume.

CodesInChaos

You encrypt before uploading to the CDN obviously

Polynomial

obviously.

but considering anyone from the CDN could just go sign up to the site and get the key, it doesn't seem useful.

CodesInChaos

not if the site is localhost

Polynomial

18:40

huh?

then why would you need a CDN at that point?

if it's not performance critical (e.g. admin panel that the CDN owners can't just sign up to) then what's the point of sticking the data on a CDN?

CodesInChaos

because any server not under my physical control is not mine

and keeping a server in my closet has kind of bad bandwidth

Polynomial

I'm not convinced. The system is only as trustworthy as its administrator.

CodesInChaos

hm? That's why the only system I trust is my local system

and not the server where the files are hosted

Polynomial

I'm lost now. What's the use-case?

CodesInChaos

backup is an obvious one

Polynomial

18:42

if it's only ever used on localhost, there's no network traffic, so why put it on a CDN?

CodesInChaos

keeping your files easily accessible from anywhere is another

Polynomial

if it's a backup, then why use JavaScript and a CDN rather than a backup service with more ideal crypto?

CodesInChaos

nobody said javascript

browser feature is much cooler

Polynomial

either way.

also doesn't stop the CDN from destroying the data

or replacing your data with other (potentially incriminating) data

CodesInChaos

I notice that. I don't notice a server silently spying on my data

Polynomial

18:44

if you don't trust the CDN, don't give them any data, encrypted or otherwise.

I honestly don't see the use-case. There are much better ways to do secure backup.

CodesInChaos

So what's the alternative? Closet server?

Having your files available from anywhere is nice

Polynomial

yes, it's called Dropbox

CodesInChaos

and dropbox is so secure. Not

and requires a client

Polynomial

it's better since they did 2FA

CodesInChaos

2FA helps, how? Dropbox can still read my files

Polynomial

18:46

there are dropbox clients for practically all platforms.

er... I didn't think that was the case any more.

CodesInChaos

Unless they use secure client side encryption now

where the files are encrypted with the user's password

Polynomial

I'm sure they changed their system so that the data is encrypted client-side with a password-derived key, except for files that have public links.

CodesInChaos

they finally did?

Polynomial

besides, what about BackBlaze and various other backup systems?

BackBlaze definitely does do encrypted backups. even my ISP does that.

you could also stick a TC volume on DropBox, since they upload file changes via binary diff.

not as elegant, but an option.

CodesInChaos

combining the accessiblity of simple browser access

with secure encryption is cool

Polynomial

18:49

yes, I agree there, that would be good.

if done correctly.

Lucas Kauffman

19:47

@ThomasPornin Well the problem is that reading a book while driving a car is rather hard...

@ThomasPornin and I actually do read books :p

CodesInChaos

books? You're so 18th century guys

Lucas Kauffman

20:04

@CodesInChaos more like hipsters

Lucas Kauffman

20:24

I'm missing out on top gear :(

Rory Alsop

@LucasKauffman SKY+

Lucas Kauffman

@RoryAlsop I'm at a hotel

Rory Alsop

@LucasKauffman iPlayer on your laptop? :-)

AviD

@LucasKauffman @RoryAlsop he's implying that getting MILFed trumps even top gear.

but that doesnt mean he doesnt miss it.

Lucas Kauffman

@RoryAlsop everybody keeps telling me to get iplayer, but does that work outside the UK?

ah it is

let me download the app

Rory Alsop

20:29

@LucasKauffman in some locations you may need to proxy...but google will tell you a range of them :-)

@AviD what a great phrase - don't think I have ever heard it before :-)

AviD

@RoryAlsop "trumps"? ;-)

@RoryAlsop anyway, for folks like us, MILF is another word for "my wife"...

Rory Alsop

@AviD hahahahahaha

@AviD sure, yeah, right :-)

I mean - yes

AviD

hehehehe, I'm telling Mrs.Alsop! ;-)

btw @Adnan - I'm still browsing SATW... quite entertaining, and educational.

Scott Pack

20:47

@AviD I whole heartedly support and/or endorse this claim.

« first day (773 days earlier) ← previous day next day → last day (4405 days later) »

all rooms

Transcript for

Jan26

Jan '1327

Jan28

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC