« first day (775 days earlier)      last day (4403 days later) » 

15:02
@RoryAlsop being the repwhore that bear is, I bet he regrets writing it by alternate bear instead of bear-primary.
@AviD wait, Tom Leek is a secondary account of The Bear?
that seems... odd.
@Polynomial I NEVER SAID THAT.
@Polynomial It is documented in the Sec.SE-meme meta question.
Yes, Bear #2 is me too.
I should revive him a bit.
@Polynomial it's okay by SE under a handful of conditions:
they don't upvote each other
15:08
@RoryAlsop And they don't vote for the same question or answer either
they don't post answers on the same question for purposes of gaining undue rep
and what @ThomasPornin said
For that matter, bear #2 does not vote at all
and generally separation/segregation is maintained
@ThomasPornin that's the ideal scenario - keeps it easy
@Polynomial What makes you believe that Tom Leek is not my primary account ?
@ThomasPornin hahahahaha
it's all a conspiracy!
15:10
@ThomasPornin the fact that he starts shouting anytime he walks in the room?
@ThomasPornin Porn-in sounds so much better.
hmm, markdown doesn't work that way.
@ThomasPornin lol
@TerryChia I'm sure he's never heard that one before.
@ThomasPornin any particular reason why you actually have a second account?
@Polynomial Really, it is just for showing off.
@Polynomial Showing off of course. Having one account with 70k rep doesn't look as good as two accounts in the top 10% of the site.
15:14
@ThomasPornin I thought you were conducting a psychological experiment
:-)
@RoryAlsop Also.
I never limit myself to a single goal
For instance, when the site became big enough to get goodies, I got two servings (two Sec.SE T-shirts and so on)
@ThomasPornin hehehehe - clever. I am trying the same thing, but with different t-shirts from different sites
(also the water bottles from bicycles.SE were pretty cool)
@RoryAlsop so, what about some goodie that is site-specific for sec.se. any ideas??
I liked that lockpick idea, even though it would be mostly useless to me other than a fun toy.
a mini-flashlight, as cute as it is, just isn't the same thing.
lockpicks for Sec.SE seems like a good idea, unless postage issues occur.
@AviD there just aren't that many things that would be doable as a cheap item.
Lockpicks are probably the only obvious one
otherwise you get into licences for sec software
15:23
@Polynomial no, SEI refused that based on apparent legality issues.
training, perhaps
@AviD that was the thought
@AviD they have a workaround, which is to send a voucher - don't they @Poly
@RoryAlsop I need a license for IDA. hint hint
indeed
15:23
@TerryChia lol - dunno what you think I can do about it :-)
@TerryChia good luck with that.
yeah an ida pro licence would go down pretty well :P
@RoryAlsop yeeaaah, but thats not the same thing. I'm not talking about a one-off prize, I'm talking about site-branded swag.
@lynks (how much are those again)
@AviD branded cases for tablets/laptops perhaps
@lynks so would... YOUR MOM!!
15:24
@RoryAlsop I think they're about $4000
@Polynomial whew
@RoryAlsop nice, but not relevant.
@RoryAlsop that'd be nice.
nah, 900 euros
@AviD I know - but think about what we do - what is there that is relevant that is also an item of swag
15:25
I thought IDA Pro + Hex Rays was $4k
@RoryAlsop yeah, exactly....
sec.se t-shirts? I'd buy that.
@RoryAlsop check out gelaskin, they do a great job of custom laptop skins
I know this isn't an easily solved problem, just from looking at the swag you get at RSA/Infosec?BSides etc
@Tinned_Tuna we have those already. we ship them to cons.
15:25
and, as was discussed before, what "we" do is such a wide range of things here.
@Tinned_Tuna currently we do ship t-shirts, pens, torches, stickers, business cards (sort of)
@Tinned_Tuna and, they're gorgeous, IMO.
some of my favorite tshirts.
yeah, I have two now and they're sooooooooo nice :D
cons ?
unfortunately the SE shop doesn't do sales any more - but they are very good at sending stuff through for conferences
@Tinned_Tuna cons = conferences
15:26
ah
no, we send shirts to all inmates at your local prison.
I still have a fair few pens - but they are just SE branded, not Sec.SE
That sounds awesome. I'll get them from there :-p
I use my SE pen at work :)
@AviD they are nice, aren't they. Lovely material
15:28
@RoryAlsop incredibly soft, and lightweight too. they rock.
did I tell you about the time I got accosted in the mall because I was wearing a sec.se shirt? She wanted to know how I got it, she's on site all the time.
I managed to give out the last of my swag pack at Securi-Tay - to speakers, and to 2 folks who asked good questions
@AviD oh nice one. did you get her username?
@AviD / @RoryAlsop where do you get them -- other than conferences then?
@Polynomial heh, no... (the wife was with me! ;-) )
15:28
still one of my favourite tshirts: img.hottopic.com/is/image/HotTopic/264413_hi?$270x406$
actually I think she said she's on Stack Overflow, and I was wearing a general SE one, not sec.se...
@Tinned_Tuna a lot of us got swag from the Sec.SE community competition a while back, and a few of us go to the same conferences
@Tinned_Tuna conferences, high-user gift pack, moderator gift pack, and... I think there was another one.
@AviD you get a small pack for standing in an election
one of those was an SE shirt, not sec.se, and one of the sec.se shirts actually turned out to be too small :-(
15:30
and there is the con swag request process
@RoryAlsop ah right. one for being pro-tem, and another for the election.
@RoryAlsop yeah i got that one. it's a SE shirt and some stickers.
aww, so I can't just throw money at you and hope for a shirt? :-(
@Tinned_Tuna If I had any left from that pack it wouldn't have required money - well, maybe a beer
@Tinned_Tuna I don't think any of us objects to you throwing money at us. The shirt is a little tricky though.
15:31
that reminds me - need to request a B-Sides con swag pack
@RoryAlsop for BSL?
@RoryAlsop @Polynomial BTW do you guys know when the talk voting is closing for that?
@Polynomial yep - unless you have already done that?
@RoryMcCune no idea. they usually leave it until about a fortnight before the con
@RoryAlsop nope, I'll leave it to you :)
In case anyone wants to help me with authentication in MVC... Just hit a wall: programmers.stackexchange.com/q/185173/175
15:33
I'm really hoping my talk gets voted in for BSL.
I'd love to speak there, especially after how well it went at Securi-Tay.
@Polynomial it is good fun, and as you have practiced it at Securi-Tay, I'd assume this time you'll get the hat right :-)
@RoryAlsop yes, that hat will definitely be on this time.
especially since a lot of attendees will know of The Hat.
@Polynomial are you bringing a hammer?
@RoryAlsop I'm tempted to bring one and smash up a WRT614 on-stage.
@makerofthings7 I will try to answer that tonight.
15:35
@Polynomial doooooo eeeeeeeet
@Polynomial That sounds like fun.
actually played around with MVC a fair bit lately, as per my usual I went in deep... :-)
hopefully the health and safety killjoys don't ruin it
but I need time to formulate a proper answer.
@AviD Awesome
15:35
I'm also planning on doing a live demo this time, with a BusPirate
@makerofthings7 shouldnt that be on SO, though, not progs?
@AviD yeah, it looks like an SO question to me.
though tbf I never did quite grok the difference.
the original definition made more sense to me.
@AviD programmers is about software architecture and design patterns.
SO is about actual programming
which makes the name rather stupid
now, it seems development WITH code -> SO; development WITHOUT code -> P.SE.
arbitrary separation, if you ask me.
15:38
pretty much
i have never posted on programmers, and never been migrated to it
@Polynomial that is still such bread and butter to SO.
@lynks Only have 1 answer on there.
Which is also security related.
there just SO MANY questions on so without code. and so many about architecture.
it was better when workplace stuff was on topic there
15:40
there are a lot of progammer-related activities that are not about the actual development, but are part of the process.
though Workplace.SE is much better to be separate anyway
e.g. source control, build process, etc.
that would make sense to put on p.se. leave the arch/DP to so.
SO needs splitting into language families imo, or at least just split off web (css, js, jquery, etc), that would half the load on SO
@lynks but then you're running into issues with languages like Python / Java / C# which work on non-web and web.
@lynks But that would half the traffic to SO itself, which IIRC is the main moneymaker for SEI.
15:42
there is a special place in hell for people who make websites with java
@lynks you mean JSP? or Java applets?
because there's a big difference.
@lynks Hey, I am writing a website with python at the moment. I love python but doing web dev with it is annoying as hell.
@lynks is it the special place where they have to hear the screams from the place for PHP programmers?
@Polynomial i was thinking of applets, but jsp is an evil too.
@Polynomial what happens at cross-language boundaries if SO is split by language?
15:44
@AviD php gets such a bad rap. treat it like a non-oo language and it falls together quite well imo
@Tinned_Tuna exactly. you can't split SO like that.
@Tinned_Tuna the really interesting, not-TL questions are all irrelevant of language.
can we at least split it into 'proper languages' and 'hipster stuff'
@lynks s/non-oo/non-/
@lynks s/falls together/falls apart/
@lynks heh, ymean like PHP? ;-)
The good (and bad) thing about PHP is that it is very easy for novice programmers to start writing websites.
15:46
@AviD php may be terrible, poorly structured, broken, no types, etc. but hipster i think it is not. compare it to rails.
yeah, CargoCult.SE - node.js / MongoDB / socket.io / HTML5 Canvas / RoR
@Polynomial no, I think node.js should be in its own special place.
@AviD You mean like hell?
but yeah, I can see what you mean about RoR and hipsters. /cc @RoryMcCune ;-)
fucking node.js, probably the dumbest idea for a server-side technology ever.
it's JavaScript. on the server.
15:47
@Polynomial and that includes PHP. :D
(but just barely)
I'm not a big fan of js, but what's the big problem?
@AviD Oy, I liked RoR before it was cool ..... oh damn I'm a hipster...
2
@RoryMcCune RoR is cool? I guess I missed that memo. :P
@AviD so rails and php are out, what do you write linux web stuff in?
15:48
@TerryChia actually, yes it is. well, popular, anyway.
@TerryChia depends on where you hang out, the hacker news crowd like it
it is actually pretty clean, and mostly makes a lot of sense.
@lynks HTML.
(lolz)
@lynks heh. never said rails is out, btw.
15:49
but I mostly stick to building on Windows. For a variety of reasons.
Meh, give me decent documentation and I can work with anything.
@Polynomial real hackers write html dynamically. a skilled vim user can emulate a complex php session in real time.
Rails is good in a lot of ways and lets some classes of app. get developed quickly and nicely. The current batch of security problems are a (I think) a consequence of their liking for cool features, and flexibility, and perhaps not thinking through all the consequences...
@lynks A really skilled sed user can emulate ASP.NET
One reason I'm really enjoying Google App Engine atm. The documentation is clear and concise.
15:51
@lynks we're writing web stuff in Java here.
@lynks Real hackers write websites with assembly.
@lynks I've heard good stuff about Python, and Groovy.
@TerryChia I write mine with notepad
@Tinned_Tuna JAAAARVAAAAA :[
@Polynomial tl;dr.
15:51
@Tinned_Tuna You hipster, you.
@TerryChia dont touch any IBM APIs.
@Polynomial ? Java is hipster now?
but I really need to learn html5 and proper CSS - for my main website I have resorted to a WIX hosted Flash site (I know - I'll go sit in the corner...)
I'm being a total hypocrite anyway, our front end is rails, our back end (my world) is a big pile of java.
@TerryChia Real hackers don't write websites ; they radiate awesomeness and let peons do the actual editing.
4
15:52
@TerryChia push eax; shr edx, 4; call webserver; <- done! :D
@Polynomial shr?
@RoryAlsop I wanted to flag this as offensive, but the "you are a moderator" message scared me. Even more than the Flash.
@lynks bitwise shift right.
real hackers run a MySpace page.
@Polynomial ahh rgr, why didn't i know that...
also known as division by 16
15:53
@RoryAlsop <shudder> flash
@ThomasPornin assuming it's actually an int, and not something else :P
e.g. packed x87 float
shr on that would be bad voodoo though
@Polynomial If it is in %edx it is a 32-bit integer, whether it likes it or not
Also, shr would be for division by 16 of an unsigned int.
@AviD I know, I know - I only had half an hour
@ThomasPornin Ugh, you and your AT&T syntax. Ain't nobody got time fo dat!
intel syntax vs at&t, vim vs emacs. for the nth time, i feel compelled to post this;
15:56
Dun-dun-dun-dun-dun-dun-dun-dun-dun-dun-BWAAAAAAAAAAAAAAAAARP
(inception)
WOW!!!!
emacs users are clearly the splinter group focused on loops
@lynks I'd have thought that'd be Haskell.
$action = $_GET['action'];
$action();
tail recursion and all that
@Adnan isn't that a (really stupid) way of doing RPC?
15:57
loop not too popular in haskell I guess. Too unfunctional
@Polynomial Well, that's the point: Haskell people don't loop; looping is for iterative people
They use recursion
@ThomasPornin under the hood it's still a loop ;)
@Polynomial This is an actual code from a live server!
@Adnan :|
@Polynomial Under the hood it is all a Turing machine anyway
15:58
@Adnan What now?
what happens when you call a string in php?
@CodesInChaos if it's the name of a function, it calls it
great idea
but no params here, it seems
but you could call php_info()
@Polynomial Actually, it depends on your implementation whether or not haskell performing tail recursion can be called a 'loop'
the effect should be the same, but it depends what it's doing :-p
16:00
@Tinned_Tuna does it do things in a repeated fashion? if so, it's a loop ;)
Alright, that's it!! This is by far the best thing I've ever worked on
There's a /config directory that has config.php and config.php.bak
http://IP/config/config.php.bak
I'm starting to suspect that this is a DVWA installation
@Polynomial The main thing in Haskell is lazy evaluation. It is not really a case of looping, more something like: "yeah, I could loop here forever, but I won't"
@ThomasPornin heh, that's one way to look at it
Right, bed. You folks have a good day.
@Adnan ahh backup files, love it when a text editor makes a config.php.bak or config.php~, and someone ftps the lot :P
16:07
that's what ignore files are for
@CodesInChaos i have worked in places that still ftp whole directories to push things live.
there are insane people, yes
hey, they keep us employed :P
@Adnan could be although I've seen this sort of thing quite a bit on tests (indeed including today...)
@RoryMcCune True, this isn't the first I come across thing like this.
I think it's good that they at least have the self-awareness to see that they're suffering from bad security practices, enough to order a security audit.
I respect that in companies.
16:15
@Adnan Never heard of DVWA - thanks for the link
@Adnan that is often caused by regulation, or some other form of CYA.
First see if they actually do anything about the results.
@makerofthings7 Most welcome! I've used it in security-related course. Great tool to demonstrate things to students.
Especially the hard, hurting changes....
@Adnan it's good, though I've come to prefer google gruyere. Mostly for the zero setup time.
@Polynomial dont know about haskell, but back in uni one of the assignments was to show that tail recursion (in prolog) was not equivalent to a loop.
@AviD After the awesome answers in my security audit report question I decided to include lots of business language in the executive summary.
course for the life of me I cannot recall how this was done.
@Adnan excellent idea. might not help though.
I should read that through sometime, see if I have anything to add.
16:20
@AviD that would be great
but I would presume that @RoryMcCune's answer is pretty much complete....
the "business language" is one thing that I always had to fight to drill into my junior consultant's heads. Not sure how good it worked.
well, must have helped something, quite a few of my students went on to respectable jobs in the industry.
I'll probably ask our money guys for help on that
whups, gots to go. Laters.
Later
17:05
running out of ideas for making a vulnerable linux vmi
@lynks Probably I misunderstood you, but why not use DVL‌​?
@Adnan this is for an upcoming lan, i thought id host a ctf too. everyone knows dvl inside out, and the enjoyment for me is making the challenge.
Oh I see
17:21
im going to throw a poorly encrypted password list somewhere to simulate bad admin. the defending team can just delete it, but it will contain ssh passwords for sudo users until they do. but what sort of crypto scheme to use...
Sounds like a fun challenge
@Adnan i have taken the idea from DefCon, each team gets the same VM, which they must keep alive. ('alive' is determined every 30 seconds or so by a central c&c server, which will do things like login, interact with programs, visit websites etc)
the point is, that all the services that the c&c server uses start out vulnerable. defenders must patch them, while making sure the c&c server still determines that they are alive.
all the while breaking into other team's vms.
Damn! This is awesome!
so after the alloted time, each team gets an 'uptime' score, a 'pwnage' score (for capturing oponents flags) and such like that...
so one example i have; c&c logs in as 'carter' pw: 'carter'.
c&c runs ~/update <random string>, which is a (very) vulnerable exe, and is also setuid root.
update drops the random string into a text file in some other user's home folder. which the c&c logs in to check. if the strings match, the server has passed the 'alive' test.
to patch it, the defenders would need to recompile the program not to be vulnerable
also make it setuid of the other user, rather than root, which it does not need.
ya know, things like that :P
jrg
jrg
what the heck is gost.
a friend is rolling his own password stuff using it - i've never heard of it, the wikipedia page flew over my head. :P
17:40
russian hash
or was it cipher?
jrg
jrg
is he being smart about it? or should i really get up in arms about him rolling his own.
who knows. Password hashing is pretty easy. Make it slow, one-way and salt it.
But without details it's hard to tell
Password hashing is one of the few places where a homebrew system(assuming it's building on a decent hash) has pretty good chances of being secure.
@jrg "GOST" is an umbrella term in Russia for a set of standards
There is a GOST block cipher, and also a GOST hash function
The hash function internally uses the block cipher
The GOST block cipher, defined in the standard GOST 28147-89, is a Soviet and Russian government standard symmetric key block cipher. Also based on this block cipher is the GOST hash function. Developed in the 1970s, the standard had been marked "Top Secret" and then downgraded to "Secret" in 1990. Shortly after the dissolution of the USSR, it was declassified and it was released to the public in 1994. GOST 28147 was a Soviet alternative to the United States standard algorithm, DES. Thus, the two are very similar in structure. The algorithm GOST has a 64-bit block size and a key length...
The GOST hash function, defined in the standards GOST R 34.11-94 and GOST 34.311-95, is a 256-bit cryptographic hash function. It was initially defined in the Russian national standard GOST R 34.11-94 Information Technology - Cryptographic Information Security - Hash Function. The equivalent standard used by other member-states of the CIS is GOST 34.311-95. The hash function is based on the GOST block cipher. Algorithm GOST processes a variable-length message into a fixed-length output of 256 bits. The input message is broken up into chunks of 256-bit blocks (eight 32-bit little endian ...
Both have a few non-critical weaknesses. Using them for encryption or password hashing is not wrong per se.
Of course, password hashing requires a bit more (as @CodesInChaos says)
What would be wrong is believing that using GOST mystically increases security.
17:57
@ThomasPornin Make that: What would be wrong is believing that using anything mystically increases security.
i.e.: Some things may indeed increase security, but there is rarely (if ever) anything mystical about it - the mechanisms should be well understood and not just blindly accepted.
@Iszi I cannot formally guarantee the inefficiency of engraving a pentagram on the servers.
3
Some things may mystically increase security.
Cryptography is just not one of these things.
@ThomasPornin personally i place a copy of the Necronomicon wrapped in a piece of a shawl of the mad Arab upon our firewall. Hasn't failed yet.
proof by example, qed.
jrg
jrg
I guess the developer in me is just in pain because he made a remark about "I don't want to bother making other peoples code work with mine". I kind of want to tell him to go build his own processor to avoid writing code that depends on other peoples. :-P
18:25
@ThomasPornin and there you go writing the better explanation of my explanation... have an upvote, ya bastard. :)
@jrg You people what with your Not Invented Heres and your Extensible Protocols.
well in many cases making third party libs work with your code is more work than doing it yourself
19:20
is anyone able to recommend any good books on malware analysis/reverse engineering?
19:56
You get a -1 penalty for downvoting an answer, but not for voting to delete the answer.
The message is clear, I think: BUUUUUUURRRRNNNN !!!
@ThomasPornin I highly dislike being penalized for expressing that an answer is incorrect.
@ThomasPornin A particular answer you need help with?
@ThomasPornin done
@RoryAlsop Damn.
20:10
Is this allowed?
heh - was looking at the screen at the exact moment that popped up
0
A: How to get info on company , company owned sites etc...?

grauwulfI'm a big fan of Robtex dot com. Share and enjoy.

@David well, it is a site that does what the OP asked...
bit of a rubbish answer though
@RoryAlsop didnt know if product/site recommendations were allowed over here
@David generally no
but that site has a selection of tools so probably is a correct answer, and the question is relevant to scoping out a security test...
20:14
well, that was a shit day.
thankfully I've got the rest of the week off.
@Polynomial pants
@Polynomial yay
@Polynomial I'm sorry. You just broke my give-a-damn.
@RoryAlsop GOOD. LAW HAS PREVAILED.
right, thats me for the day, have a nice evening gentlemen.
@Iszi It ain't as cushy as it sounds.
anyway, I'm in a foul mood, so I'm gonna go drink beer and eat crappy food.
20:20
@Polynomial Eating good food might improve your mood, though.
@ThomasPornin That's the goal. If I don't cheer myself up somehow, I'm going to snap and go all "Columbine" on someone.
@Polynomial Crap. Everyone hide, Feds are on the way to watch us now. Why'd you have to do that, really?
and the people who instigated my bad mood aren't around to receive the brunt of it, so I'll end up taking it out on people that I actually like.
@Iszi Would make for a good soundbite on the news, wouldn't it?
21:00
@ThomasPornin that shouldnt be voted, that should be flagged.
grabs the hammer's attention faster.
@AviD I voted for delete.Bear #2 flagged.
@ThomasPornin good teamwork, you two.
@AviD THANK YOU.
heh. two browsers open?
sock.
@Polynomial that word always makes me laugh.
@AviD I only open one browser.
Bear #2 also opens a browser, not the same
But just one browser per persona.
21:05
:7885023 hahaha, I saw that!!
We share the keyboard, it creates contention.
@ThomasPornin ever have a race condition?
@AviD RACIST !
my sister, who is not the sharpest apple on the block, is very sensitive about her husband being from a [racially specific background]. I was asking him once about his new job, and expressed a congratulatory note on how cushy it sounded.
cushy, is a word in hebrew that is a racially insensitive slur, applicable to jungle bunnies.
Needless to say, she exploded at me, started cursing me out in front of our parents, who sat there bewildered together with me. Took a while to figure it out.
It is hard to find words which do not have a second meaning as a racial slur.
21:10
@TomLeek heh. funny.
@ThomasPornin true, if you include all languages and slangs.
it was just a very funny situation.
She, of course, did not want to admit that she did not know the word.
TBF, it was just as likely that I would have been making a racially insensitive comment. But it happened to be the one time I was saying something nice.
@TomLeek Ahh - it's good to have your CAPS-LOCK'y self back :-)
@ThomasPornin It is hard to find words which do not have a second meaning as a racial slur... or innuendo
@makerofthings7 that second part is known as Joey's Law.
Why joey's law?
21:26
hahahah
in YOUR endo
"Cyber worrior" sounds like an excellent job title
@CodesInChaos someone who worries about the cybes?
it's a euphemism for a WoW junkie
someone who uses a computer to affect his worrying.
@CodesInChaos ah, someone who doesnt bother worrying about real life at all.
21:45
@Tinned_Tuna ohh maan, just reading that PHP rant now. Fantastic.
Think I may have read it before, or I've seen that quirky toolbox analogy before.
@Iszi - I agree with you on the two answers you commented on - they don't answer the question. I'm all outta votes for the day though...
4
Q: How to get info on company , company owned sites etc...?

user1203028I wanted to know how can I get info on what sites are owned by certain company.I need it for bug bounty programs. For example how can I find what sites are owned by paypal company, like what sites have paypal in it's web address etc... Thanks

@RoryAlsop DAFUQ? How does a mod run out of votes?
Oh... you mean down-votes.
@Iszi you still only get however many it is on questions and answers then you are done
22:03
@RoryAlsop s/you are done/you get a badge/
@Tinned_Tuna @lynks @Adnan re PHP wars...
actually makes PHP sound like a good thing, somehow.
Then I realized the dirty secret: Udemy, the site that built that infographic, actually appears in the row of "Sites built using it" under PHP. So, they want to make themselves look good. :-)
I was also interested in the datapoint that most companies are looking for good programmers in PHP.
Good programmers don't use PHP, that's why they're so hard to find!

« first day (775 days earlier)      last day (4403 days later) »