The DMZ

CodesInChaos

19:00

which typecasts to make implicit is an interesting question

Rory McCune

@ThomasPornin yep I think there's a lot of it going on in web app frameworks/db's that web app devs will never see so don't know to avoid. Why I usually tell them to assume all the other code is crap. Unfortunately defence in depth is hard work..

Thomas Pornin

@Polynomial Well, it is not nice, but this simulates a power failure, which happens (and it does so without the electric shocks, so the hardware does not suffer). A good OS ought to resist that. Even Linux has used journalling filesystems for the last decade (at least).

CodesInChaos

but running applications might contain unsaved data

Polynomial

^

CodesInChaos

ok, implicit cast from string to int that ignores parsing errors, is bad

Jeff Ferland

19:02

Key generation made easy: python -c 'print open("/dev/urandom", "r").read(20).encode("hex")'

Iszi

@ThomasPornin ...plus, anyone bothering to flash the BIOS should know better than to do so while other applications are running in the first place.

lynks

@JeffFerland ok, thats it. im learning python.

Thomas Pornin

@Iszi Well, yes, that sums it up. If you reflash the BIOS while expecting the machine to remain up with multiple applications, then you are either overly optimistic, or you should step away from the machine right away because you are about to kill it.

Jeff Ferland

Hmm, I realize now that I should have submitted a talk to BSidesLondon

Rory McCune

one other v. cool python thing (loathe as I am to admit it) python -m SimpleHTTPServer . serves the current directory as a web server

Thomas Pornin

19:05

@RoryMcCune With sub-directories browsing ?

CodesInChaos

any language where 0=="A" returns true is broken

Rory McCune

@ThomasPornin hmm haven't tried that, was just using for exploiting RFI stuff

Thomas Pornin

OpenSSL can do that (for an HTTPS server, of course) but it always looked like a security hole to me

36

Q: What does "0 but true" mean in Perl?

Can someone explain what exactly the string "0 but true" means in Perl? As far as I understand, it equals zero in an integer comparison, but evaluates to true when used as a boolean. Is this correct? Is this a normal behavior of the language or is this a special string treated as a special case i...

Rory McCune

@ThomasPornin just checked and yep it does

Thomas Pornin

@RoryMcCune So this one-liner python invocation could be put in a shell script named "pleasehackme.py"

CodesInChaos

19:08

@ThomasPornin sanity is for the weak

lynks

@RoryMcCune yeah that python mini httpd is awesome, i actually use it for copying files to a windows machine sometimes.

its depressing that it is easier than ftp

Iszi

Back on the topic of our migration options...

in The Assembly, 1 min ago, by Anna Lear

@Iszi Sorry, been a busy week. I'll try to look at it today or tomorrow. Yell at me on Friday if you don't hear back by then. :)

CodesInChaos

Which options do you want?

Rory McCune

@ThomasPornin yep :)

lynks

can we have a migrate to google option? :P --> lmgtfy.com/?q=question%20title

2

Iszi

19:18

@CodesInChaos I really don't care at this point, as long as they make some sort of sense. Right now, it's just really bothersome that we've had five Meta threads about it and practically no solid response from SEI either committing to resolve it or deferring it until a particular, and yet-unreached, milestone is hit.

I think the response I got from Anna, via mention of the issue in comments on another site's Meta, is perhaps the most positive one we've had yet. Then again, I haven't seen the TL conversations our mods have had with SEI.

Iszi

19:35

Well, the laptop just got in. And she's already asking me to do a clean install because of crap/bloat-ware.

gforce89

how can u pay for winblows when u buy a laptop. i just cant understand this............

lynks

19:56

@gforce89 hmm?

Ninefingers

21:09

I doth hath a question for you all. Wherefore art the place of collaboration for the right and honourable ctf team? So that I am verily informed to be ready for the appointed time?

Iszi

@JeffFerland Mind unlocking that question? I was working on an answer and planning to edit it to something better.

Jeff Ferland

@Iszi k

Gilles

@Ninefingers > We now have an IRC channel! Join us in #SecSE-CTF on Freenode: chat.freenode.net:6667

that question is seriously unreadable

needs editing wink wink nudge nudge

Ninefingers

@Gilles Ah yes, thankye kindly. I should have started reading in the obvious place.

Gilles

@Ninefingers I only found that because I checked that question's changelog recently

oh hey, you've cycled back to your old name

what's the avatar for?

Ninefingers

21:18

@Gilles Yeah. Well why not. It's the best name I could thing of. My avatar is what you get if you type $\mathbb{C}$ i.e. it's the complex field. I just choose random things for avatars normally, whatever comes to mind. The previous one was actually a delta symbol that was part of another image, but the editing had gone badly wrong.

It looked kinda cool in a bad sort of way, so I kept it.

Jeff Ferland

21:32

I predict this will get on the supercollider and become stupidly popular:

1

Q: Why are vulnerabilities and lack of security possible in computers?

I have heard about computer vulnerabilities, virus, malware, etc. Why are these threats possible? Why can`t the computer just do the things it is supposed to? Why does malware exist instead of programs with a constructive purpose beyond doing damage and violating the law. Why are computers used ...

malware

Scott Pack

wow

Jeff Ferland

I cleaned it up a bit just now.

... and pre-emptive protection.

Scott Pack

That's usually the best kind.

Rory Alsop

@gforce89 What do you mean? I think for the laptops I have had with windows on, it was free (included in the price of the laptop.)

Ninefingers

@JeffFerland Along with ridiculously over-upvoted everythings.

Jeff Ferland

21:42

@Ninefingers Get your answers in now ;)

Rory Alsop

@JeffFerland awwww - do we have to?

Jeff Ferland

The repevator is taking off whether you're on it or not!

3

Iszi

@JeffFerland I think, between your cleanup and a few answers, we've done a fairly good job of salvaging it.

Jeff Ferland

@Iszi o/\o

Iszi

I'll say it again: I wish we could up-vote edits and mod actions.

Tom Leek

21:46

@JeffFerland DONE.

Jeff Ferland

... and as always, the only real winner is the Siamese (Canadian) Bear.

@Iszi You can send me beer.

Iszi

@JeffFerland Heh. Next time you're in my area, we'll have to get together for some.

Would be nice to have an excuse to go here again: frankandsteins.com

Ninefingers

22:02

@JeffFerland Oh I'm on it. Cue pedant attack for my answer.

Also, I am on IRC. EURRRGGHHH!

@JeffF on the chat room thing, did you talk to the SE staff about private rooms? When I wanted one for crypto I had to ask quite nicely as they're not keen on it.

I assume you did, but, just asking.

Also:

This is what using IRC is like. youtube.com/watch?feature=player_embedded&v=O2rGTXHvPCQ

Iszi

22:18

@Ninefingers I'm not sure I'd say "speaking l33t" is "so hot".

Ninefingers

@Iszi Have you got to the bit where they actually speak leet? It just looks like junk to me.

Jeff Ferland

@Ninefingers ... ish....

Iszi

On a semi-related topic: I think that whenever you're served an ad that's longer than the video you're trying to watch, someone at YouTube should die.

Ninefingers

@JeffFerland It'll probably be ok. Basically Shog told me no moderation must happen in private rooms non mods have access to - where basically discussing whether a question should be closed or not is moderation. This is because the only private moderation should be mod2mod for the sensitive stuff. So provided we stick to the topic of CTFs it will be ok, but it might not be a bad idea to ask.

I know this because I asked in a chatcast thing about private rooms and was told no, so I asked really nicely via email.

Jeff Ferland

@Ninefingers Well, I asked in TL with bold letters. That nobody jumped all over it is good enough for me.

Ninefingers

22:24

@JeffFerland that probably counts as ok then :)

I imagine the volume of TL has only gone up since I left, so yeah you'd hear about it if it was a bad thing.

Gilles

22:36

@JeffFerland I'm pretty sure noone noticed

(except me, and I've already told you what I think)

@JeffFerland @LucasKauffman @Polynomial Would the chatroom become public after the event?

I think that could make it acceptable in the eye of SE

Jeff Ferland

@Gilles Yes

Gilles

though you'd still have to talk them into it

Jeff Ferland

Ω

Gilles

I really recommend that you get the ok. If you don't, they might summarily make the room public

1

Q: Apache boot without asking for passwd

So I'm maintaining a server which has a verified SSL certificate setup, however there is a password on the private key and so whenever apache is reboot, we get a message asking for the password. This isn't a major issue, but becomes one when you reboot the machine! When this happens, it will hang...

security apache password ssl reboot

Ninefingers

Yeah, I had to ask really nicely for crypto. Oh one of the other provisos was that I freeze the room when we didn't need it so the window for unsupervised usage was minimal.

Gilles

22:39

@Gilles looks fine, but one of you guys might disagree

Ninefingers

I'm not sure about:

1

Q: Windows App Store security

It seems like most companies now a days, give you a crappy laptop with some version of Windows on it that allows you to access the internet (sometimes they block YouTube, Facebook, etc.), comes with Microsoft Office, Microsoft Outlook, and whatever internal software they use for their particular ...

corporate-policy windows-8 windows-vista

There's a question in there, but I don't think it's relevant to us?

The answer is interesting, mind.

Transcript for