« first day (854 days earlier)      last day (4324 days later) » 

16:00
@TildalWave Hiding things in binaries isn't any better than hiding things in scripts.
@AviD Correct. Sorry again, I was wrong.
@lynks yeah that's what they want you to believe
@Adnan I didn't mean to keep passwords in a compiled code, I meant you're free to use any other authentication methods there are, while in scripted languages you depend on libraries that are available
@Adnan strings *binary file*
@TildalWave Actually, I remember having the same conversation with you.
16:01
@Adnan how for example do you use a smartcard in PHP as a way to store a key to your database?
@TildalWave Same with compiled languages. You depend on libraries.
@Adnan I can write my own libraries, not in PHP
@TildalWave I don't know, I've never used it. There might be a way.
@TildalWave There's actually a PHP library that lets you call native APIs.
@RoryMcCune you have believed the lies of your alien master too long now old friend.
16:01
@TildalWave so you could interface with a smart card lib
@TildalWave Everybody can write their own libraries in whatever language they want.
I think there's one for COM objects too on Windows.
@TildalWave Most scripted languages have a way to call on native code.
I know python does for sure.
@Adnan how do you write drivers in PHP?
@TildalWave Ah.. I don't know, there might be a way.
16:02
@lynks ya know if you think about it resistance really refers to resisting change kind of like the luddites... you don't want to be a luddite do you ?
@TildalWave You don't.
@Adnan well I wouldn't want to know of it then :P
@TildalWave But what's that got to do with security?
It's quite silly to compare interpreted and compiled languages like that.
(you technically could write a kernel-mode PHP interpreter)
16:03
@Polynomial Thank you!
it would be the most horrible thing ever conceived, but... still possible!
@Polynomial options ;) real life dictates different approaches and when you depend on external libraries rather than be able to write your own when needed, you're often sacrificing security too
@Polynomial now I had to go check it out on TripIt.
@Polynomial How about writing a OS in PHP? I bet that will be worse.
yeah it was Hampstead... not as north as I'd remembered.
16:04
@TildalWave What the what?! With all languages you depend on libraries.
Let's see you use AES in Java without any library.
@TildalWave So by using an operating system you're sacrificing security too?
@Adnan @ThomasPornin.
write everything from the ground up in asm!
just because you use import instead of include doesn't mean you're getting better security.
bootloader with a HTTPD
16:05
@Adnan lord, I hope not.
@Adnan not sure what you mean by libraries here... of course, but I obviously meant third-party libraries not your own
@TerryChia That you couldn't do. You'd need a bootloader (asm) and some kind of bootstrap to a script engine.
@TerryChia plus PHP has no event callbacks or syncronisation methods, or threading support. so you'd need to massively extend the language just to handle interrupts.
@TildalWave I bet that 99.99% of libraries used by developers aren't their own.
@TildalWave Define 3rd party.
@RoryMcCune I think more along the lines of combine/freeman, or france/nazi germany, see the resistance are always the good guys :P
16:06
@Polynomial sometimes you are actually... it's all a tradeoff innit? LOL
@Adnan I use my own libraries probably on a 50/50 with third party libs.
@lynks cmon, really? Rebellion / Empire??? Duh.
@TildalWave No. Writing your app on bare metal would lead to the Java problem. try to do everything in a massive framework and end up fighting fires constantly.
@lynks You're a nice guy, I like you, nothing personal, but I don't believe that.
@AviD ahh thats true.
16:07
@Polynomial ok not the best term either but you're flooding me with pings here... in this sense, not having source code and control over versions
@Adnan meh, believe what you like.
Also. About half the Doctor Who episodes (I'm working my way thru them :D) are about some alien race that promises a better world just by taking it over and killing everybody. You gonna trust them??
@TildalWave So I shouldn't use the Visual C++ runtimes, kernel32.dll, user32.dll, a properly reviewed SSL lib, etc?
Why are you all constantly mentioning Java? As if Java has anything to do with security. I never touched it personally
@TildalWave Java is an example of a framework that is literally too big to manage properly from a security perspective
16:09
munches popcorn
@lynks 50/50 sounds unbelievable. Unless your libraries are largely built on other libraries. Is that the case?
@Polynomial didn't imply what you should (or shouldn't) ;)
I bet @ScottPack is thinking "Fucking programmers".
4
@TerryChia Java Java Java JAVA JAVA JAVA!!
@TildalWave they're 3rd party libs. you didn't imply it, you explicitly said it.
16:09
It's like the late 90's all over again...
So I'm eating a noodle soup and the only utensil I have is a spork. Let's see how bad this can be.
@TerryChia hehe that made me chuckle
@Adnan of course, all libraries are built on others. unless you write your own HAL and kernel modules, everything is one library on top of another.
@TerryChia indeed! LOL fuck... me!
@lynks Okay, then I apologize. I think I misunderstood you.
16:10
@lynks It's turtles all the way down!
@Polynomial then an apology is in order... poor choice of words
Or, @RoryMcCune would have me say, It's Kermits all the way down!
@AviD I don't like turtles.
@AviD turtles all the way down, with some copper and muttering engineers at the bottom.
@Adnan They taste fairly good.
16:11
@Adnan you.... DONT like turtles??? :-0
I have at my disposal a single instrument that's both a terrible spoon and a terrible fork being used to eat pho.
@AviD exactly :) althought it was @RoryAlsop who got me onto the green/right side...
@TerryChia Never tried them. Tried alligators once, but not turtles.
I think @ScottPack dislikes being ignored.
Come on everyone, let's give him some attention.
16:12
Meh. I'm just complaining. I don't really care if nobody cares.
@ScottPack What's that instrument?
@AviD I like turtles!
I can complain into an empty room just as well as I can complain to a full room.
@lynks again you're letting their indoctrination get to you, that's the way they want you to think. It's like the "democratic peoples republic of korea" the name doesn't really correlate to the reality :op
16:13
@AviD I don't trust turtles. They're old! In their age they must've learned how to lie pretty well.
@RoryMcCune then again, if the XM is affecting your brain patterns, and controlling the way you think - how would you know any different?
@AviD ah true but remember there is no reality, only perception :)
@AviD The same could be said for the Resistance. By their very nature they're infusing themselves with just as much XM.
@RoryMcCune Our scanner system for giving badges to people at Arms this year has been given an internal project name
"Client Login Identification Technology"
2
@Adnan The Turtle is dead. He can't help us anymore.
16:14
@ScottPack WHAT"S THAT INSTRUMENT?
A spork or a foon is a hybrid form of cutlery taking the form of a spoon-like shallow scoop with three or four fork . Spork-like utensils, such as the terrapin fork or ice cream fork, have been manufactured since the late 19th century; patents for spork-like designs date back to at least 1874, and the word "spork" was registered as a trademark in the US and the UK decades later. They are used by fast food restaurants, schools, prisons, the military, and backpackers. The spork is a portmanteau word combining spoon and fork. Similarly, the word foon is a blend of fork and spoon. The wor...
@Adnan A penis.
@Polynomial Thank you, already have two.
@Adnan That's what she... wait what?
@ScottPack ah see, if you had a bad fork AND a bad spoon, you could flip them around and use them as chopsticks. One spork that is both a bad fork and a bad spoon, is uselesser.
16:15
@ScottPack What the hell?! I honestly always thought it's something they talk about in the movies. Is that real?!
@Adnan Sporks are a standard implement in most British takeaways.
@Polynomial I actually own a wholly satanic utensil - a spork with a sharpened and serrated edge.
@AviD That's the first xkcd I've seen in ages that I haven't immediately recognised.
I pulled them from the vending area in the lobby. They used to stock forms and spoons, now just sporks.
16:17
@lynks See, that lessens the sporkyness. Sporks are meant to be as useless as possible.
@Polynomial I've never seen or touched one.. The spork!
@Adnan That's what she said.
@ScottPack I would think forms would be pretty near useless as an eating utensil.
@AviD Especially HTML forms.
@Polynomial Aawwwh! How cute! I'll create another situation just for that just for you
16:18
I eat with a <div>.
2
On a <table>.
@Polynomial How does it fit in your mouth?
and when I'm really hungry, I use a <span> wrapped inside a <div>
I prefer to use tr for all my work.
@Adnan Too easy.
@Polynomial You <span> all of it?
16:19
If I'm doing a bbq, I put out a <marquee>.
that's right, I went retro-HTML ;)
Anybody want to get on this one or should I accept the bear's answers?
3
Q: What's an attack's 'computational complexity'?

AdnanRecently I was writing a business-language report about MD5. In my search a found a paper by Yu Sasaki and Kazumaro Aoki explaining their 2123.4 pre-image attack on MD5. I know that it has something with the feasibility (or in some cases, even the possibility) of an attack, but I don't have a so...

@Polynomial you have no <style>!
@Polynomial so you've totally hacked it and can get me a couple of badges, right ?!?
@ScottPack icwatudidthar.
@RoryMcCune If you want some badges I can see what I can sort. You know plenty of people here.
16:21
@Polynomial <marquee> is so underused in modern web design.
@Polynomial just kidding mainly, looks like we're going to be hectic when we're down with the workshop and my talk and meeting people :) Currently burning 8 USBs with Kali Linux for the workshop
@Polynomial I remember the time I did go they had some really nice schwag
<blink><marquee>Herro</marquee></blink>
6
@ScottPack I've taken to using Marquee for HTML injection PoC's... it's awesome that it still works
@ScottPack the html of the gods.
I mean who uses <marquee> other than ironically
16:22
@ScottPack Jesus! What have you done?!
So, what you're telling me, is that marquee is the html equivalent to PBR and skinny jeans?
@RoryMcCune yikes.
@RoryMcCune there are actually ARE some horrible sites that do still use it.
@Polynomial had to do a custom ISO for some reason they didn't make persistence a menu option... also meant I could replace gnome with LXDE
My reaction of course, is "STEP AWAY FROM THE COMPUTER!"
16:25
@AviD RLY? I know there's some oooollllld stuff out there but marquee was horrible in 1998
@RoryMcCune Kali is pretty unstable in my experience, so it's a good job you've got lots of copies :)
@Polynomial well all we'll be doing is booting it up and running nmap and a browser to access nessus, so <fingers crossed> it should be ok :)
fairynuff
i just had to see it for real, unfortunately blink doesnt seem to work in chrome these days 88.198.7.235
If I get time this weekend I may redo them as lubuntu
16:26
well I hope it all goes well :)
@lynks quick file a bug report! that's an outrageous lack of respect for old HTML tags
see if you can find me at the end of the day so we can grab a beer
@Polynomial are you talking about BSides?
@Polynomial we're demo'ing at the weekend :) yeah beers at the end of the day are likely to be in order :)
Also my talk is on main track after Stephen Bonner, so no pressure there at all....
16:28
@lynks tried in FF, Opera, IE... no luck there either
maybe it should be <bling> for your server?
@RoryMcCune hehe, I'll check the schedule on the day, not sure what I'm gonna go watch
there are a few I've seen that looked cool
@Polynomial well my one is just a re-worked version of the Securi-Tay one I did so I wouldn't bother if I were you.... TBH I'm still surprised that they accepted it, let alone put it on the main track
must be more interest in this kind of stuff than I thought....
ahhh i would love to head down and buy you chaps a beer, but i couldnt get the time off :(
whats next after bsides london?
@TildalWave my server is pretty awesome, I'll try <swag>
heh, you guys were just talking about this the other day... securityreactions.tumblr.com/post/48273945381/…
Is anyone here named Martin??
@lynks well for me Scottish Ruby conf :). but on the general security path, OWASP Europe is in august and then Brucon and 44con are september
16:39
@RoryMcCune thanks, my new years resolution was to start heading to conferences, I shall have a look.
Ah it's conference time again? I'll be at syscan next week. :)
@lynks OWASP Europe is understandably pretty web app focused. 44con and brucon are quite research/hacker-type focused from what I've seen (oh and beer they both focus on beer a lot)
@RoryMcCune rgr
@RoryMcCune Heh I was talking to a senior guy, about some of CSO's typical security challenges. He kept talking about BYOB... Was almost a shame to correct him.
@AviD Bring Your Own Boobies?
16:43
heh, are you really that young? ;-)
@AviD LOL
:For other uses, see BYOB (disambiguation). BYOB or BYO is an initialism meant to stand for "bring your own bottle," "bring your own beer" or "bring your own booze." BYOB is often placed on an invitation to indicate that the host will not be providing alcohol and that guests are welcome to bring their own. Some business establishments may allow patrons to bring their own bottle, subject to fees or membership conditions. Etymology The term is cited by some online sources to have been used first in the early 1970s to mean "bring your own bottle", although in present day it is just as likel...
@AviD heh.
I actually got that... especially since it's in reply to @RoryMcCune's line about beer.
@AviD i dont get it, what did he mean to say?
@lynks BYOD.
16:44
Bring your own device (BYOD) (also called bring your own technology (BYOT), bring your own phone (BYOP), and bring your own PC (BYOPC)) means the policy of permitting employees to bring personally owned mobile devices (laptops, tablets, and smart phones) to their workplace, and use those devices to access privileged company information and applications. The term is also used to describe the same practice applied to students using personally owned devices in education settings. [http://malleehome.com/?p=184 Bring Your Own Technology (BYOT) on maleehome.com] BYOD is making significant inroad...
....
You seriously haven heard of that term?
@AviD aha...no i think he was right the first time
cmon, git wit teh buzzwords, maaan!
@lynks hehe
well yeah, if your employees tend to BYOB too much, your products might wind up DOA.
@AviD my BLT drive is always going AWOL.
I am reminded of that line from Good Morning Vietnam... lemme see if I still got it:
16:46
@TerryChia I've heard Boobies!!!
I'd love my work to be BYOB
@Adnan Aren't you more of a cacti guy?
I'd stock the bookshelf behind me...
> Seeing as the VP is such a VIP, shouldnt we keep the BT on the QT, if the VC find out he'll be MIA and we'll all be put on KP.
@Tinned_Tuna in the right startup, you wouldnt need to...
@Tinned_Tuna Your work places distributes boobs?!
16:47
@Adnan nope, I'm hoping for beer at work
Sitting at restaurant opposite venue - having haggis nachos
Mmmmmmm
@Adnan nooo... BYO means "bring your own", as in they DON'T give them out...
@TerryChia Doesn't matter what kind of guy you are. Everybody likes boobs.
@RoryAlsop worlds collide.
@AviD He said "I'd love my work to be BYOB"
16:48
@RoryAlsop that... sounds... AWWWWESOMMEE!!!
@RoryAlsop that sounds... off-putting.
@Adnan "bring your own", as in THEY dont.
@AviD Jesus! Let me explain
He said "I'd love my work to be BYOB". So his work place you don't bring your own boobs. So, comically, it leads one to believe that his work place distributes boobs.
Just like with Bring Your Own Booze bars
@Tinned_Tuna Move to Finland!
@Polynomial Unless you rewrite it all by yourself (pruning out a few unnecessary things).
@Adnan tempting...
if only I spoke a word of finnish...
16:50
@Tinned_Tuna What?! Finns speak? As far as I know, they don't.
@Adnan they do, just not to you.
@Tinned_Tuna Plus, all you need to know is "Hei".
@Adnan what's that even mean?
@Tinned_Tuna Really?! What do you think it means?
16:51
@Adnan "Hi" ?
@Tinned_Tuna Yup! Now you know Finnish!
@Adnan ohhhh. Ok, you think he was saying he would like a place where they DONT distribute? as opposed to being ALLOWED to bring your own.
Okay, now I understand. You're a moron.
:D
@AviD Finally!
they DON'T distribute beer in my office, but being encouraged to bring my own beer (a.k.a. BYOB) would be nice
16:52
hehe
I don't know if there's anything against it...
apart from the, you know, incredible unprofessionalism :-p
@Tinned_Tuna .... but not as awesome as not NEEDING to, because they buy it for you.
@AviD Thus, Finland!
Or at least, my project manager!
@Tinned_Tuna unprofessional?? Have you never heard of Ballmer Peak?
@AviD indeed.
@AviD haha, it's too narrow for me to attempt to hit :-p
16:54
@AviD I never stayed there for more than 5 seconds
@Tinned_Tuna That's what SHE said! ;-)
@Adnan So I hear... :P
@AviD dang...
@AviD God damn it!
@AviD Boy, you are just killing it tonight.
16:55
two in one! woot!
@TerryChia That's what SHE said!!
@AviD heh.
cmon, you guys make it too easy.
@RoryAlsop what venue are you sitting opposite? Venue for what?
@AviD That's what he said.
oh!
heh
16:56
@Adnan that's what she said!
Today's Questionable Content is too good :-p
@Tinned_Tuna gig venue
@Tinned_Tuna Damn! Hadn't checked in ages
ahh okies
Heh. I'll go sleep now. Looking forward to reading the transcript tomorrow.
16:57
@TerryChia Night!
@TerryChia good night, and may lady luck smile upon thee!
@Tinned_Tuna Indeed. His followup question implies "yes".
haha, I know ^.^
I must however, fetch dinner.
@ScottPack OT, you think it's OK to put lamb lettuce in burgers? I'm out of other salads
@rory oh right! I forgot, I did see that on assbook.
FACEbook.
Good luck!
@Rory do you already have your makeup on?
17:05
@AviD nope , not planning to go out tonight so I thought I wouldn't bother
@rorym lol, I did mean @rorya...
@AviD I guessed, but given that you were ambiguously rory'ing again....
On my phone so it's not as easy...
Then again, @adnan puts on makeup for a quiet night at home... ;-)
@rorym yeah I know, I deserved that.
@TildalWave wut?
@TildalWave Do you mean as a filler inside the burger or on a burger?
@ScottPack filler... not sure if it's gonna screw with the taste... it's not really baby spinach
17:10
@TildalWave I have no idea. I've never heard of it. I'm reading the wikipedias
Oh, the wife and I were wondering what rapunzel, as a leafy green, was.
@ScottPack it's not too bitter so that's a plus... but I never tried it
@TildalWave I don't see any problem putting herbs in burgers. I would make sure to chop it up. You don't want it to risk throwing off the structural integrity of the patty.
@ScottPack yup that's how I do it... chop fine like garlic or onion... I'll try, let you know how it came out
@TildalWave killer.
A couple of years ago I make some fantastic burgers using lamb. I mixed the meat with feta, minced garlic, and a bit of parsley. Good stuff.
17:45
@ScottPack Im going to try that one out
18:12
afternoon
@ScottPack that sounds delicious will try it one day ... i made the patty, looks good smells good... threw in some chives for good measure, now the buns are in the owen... movie starts in about half an hour :)
...gonna have me a proper couch potato evening Al Bundy would be proud of me :) laters!
@TildalWave then make sure your hand is down your pants.
4
18:31
ok, so is it creepy that I'm already getting malware e-mails purporting to be from my sister's married name when she was married less than a week from when they started?
go go gadget Facebook
18:51
Guys, as far as you know. Do Anti-viruses implement whitelists? (I'm not asking about the possibility of adding a program to the antivirus's whitelist. I'm wondering whether they come from the vendor with a whitelist).
The reason for my question is this answer
1
A: How can Antivirus differentiate between a Trojan and a normal remote desktop application software?

Dr.ÜAfaik based on whitelisted signatures. I hazard a guess based on Teamviewr (they like to know pretty much about the manufacturer of the AV).

It doesn't make sense at all. The whole idea of an antivirus to blacklisting, right?
LAWL:
@ScottPack Idealism and a positive outlook are enlightment traits. It's the common youthful rebellious streak that gets some folks sidetracked by the luddite resistance. That's what NIA is banking on, and sadly they've duped lots of folks into fighting for them (THE MAN!)... The enlightened are exploring the reality of XM since we need to understand it to advance and protect ourselves from whoever / whatever.
19:08
@Adnan It's a question of view point. You might expect an antivirus from Harlem to use a whitelist.
19:30
@Iszi I like the NRA
@Adnan I don't think you need to like or dislike the NRA to find the humor in that conversation.
@Iszi Oh don't get me wrong, that was indeed funny.
I have a confession. I have no idea how to use Microsoft Access. I have no idea what it does or how it does it. All I know it has something to do with databases.
19:53
@Adnan Some would argue it's not a real database. But it's probably better than Excel. I'm more or less in the same boat as you, though. I know of it, and I've touched it once or twice, but I don't really know much about it.
@Iszi Better than Excel is debateable
but yes, Access is MS's attempt to compete with FoxPro and when they couldn't, they bought FoxPro and dismembered it, put some bits in Access and continued to sell Access
problem with FoxPro is people thought it was an application language
when it was just a glorified reporting and analysis tool
and similarly, people's mistake with Access was thinking it was anything other than bloated and overweight
now the best bet for what Access is used for is SSIS and SSRS
@Iszi Excel has many legitimate uses. It is often misused as a database, but it still a great tool for other uses.
Access, on the other hand, has only one legitimate use (other than being a target for snark):
Hmm, hang on, I'm having trouble thinking of one.
@AviD The same can be said of access, well atleast the misused as a database bit. Perhaps not the part about other great uses
First thought is students, but there are still better options for that.
people who need a DB, don't understand what a DB is and don't know any better than to use what comes with Office
or used to
19:59
Second thought is non-tech people, like my mother, who want to have the benefit of a database without being techy. But again, it misses that mark too.
@AJHenderson exactly. But then, they wouldnt really know how to use that, either.
@Adnan in other news, why do you make said confession? If it's security related, just say, no, it's horribly dangerous and walk away
I'm pretty sure they were thinking of security when they made access and said "how can we make sure it can't be secured"
@AviD It's got some wizards doesn't it
sure their DB looks like an excel spreadsheet
@AJHenderson hmm I guess thats true
but they can tell their non-tech buddies about their cool "databook" that they have
so a semi-techy person would be able to use it. My dad would have trouble with the wizards too.
and get them to go get Access too
20:03
@AJHenderson contrarily, I am embarrased to say that I used to know Access quite well.
@AviD BTW did you know that MS have actually been doing some reasonably cool stuff with Access recently. You can publish an access database onto a sharepoint site
and then it's accessible over the website
and.....?
@AviD That's ok, I was a FoxPro developer for several years
@AJHenderson as was I.
and my last job before my current was working off DosFox
with their parent company using access
though atleast for that they brought me in to try and get off FoxPro
20:07
well, we used Foxpro as the "database" (i.e. a bunch of datafiles in that oh so special format), never actually used the foxpro language.
@AviD well if you want a fast way to design a web accessible database it's not necessarily a bad way to do it :)
@RoryMcCune BLASPHEMY!!
wait, how does it deal with multiple simulatneous users...?
@AviD or security
@AviD dunno but I'm guessing it might put the database end onto SQL server and then present the forms via sharepoint...
btw you could do some pretty awesome database-like stuff just using sharepoint, you dont need access....
@RoryMcCune ah, so it doesnt actually use the access live?
kind of an import situation?
20:09
@AviD don't think so, it's more the missus that's been playing with it at the moment but I get the impression that it converts/imports the access database into sharepoint...
that actually could be cool - use access as a kind of development environment (granted its much simpler than actual development) and have sharepoint transform that.
@AviD yeah that sounds like what they're aiming for, will be interesting to see how well it works in practice :)
well then, they should stop pushing in office to home users.
Call it "Sharepoint Database Development Kit". Or something.
20:48
@AviD How about Sharepoint Huge Information Toolkit
and in honor of SSIS and SSRS it can go by initials
naw, too sucky.
How about: Sharepoint Client Report Environment for Windows?
Sharepoint Tools Used by People Interested in Databases
@TerryChia and here I thought that's what my wife was thinking
sorry, know that one was late, but I just noticed the stared comment
@AviD It can be used as a front end for SQL Server, which is nice for less-technical business folk.
@Xander again, if done right, there are better solutions.
Like Excel. which can also be used as a front end to SQL server.
@AviD But Access gives you forms, which makes it a ligher weight option than SharePoint/InfoPath
@AviD Excel/PowerPivot is certainly the better option for reporting.
Right. And I'm not even talking about actually developing an actual program using actual code.
@ScottPack lol, nice
Your last sentence resulted in a parse error.
Your English isn't PCRE parseable.
21:07
@ScottPack is the "code" part throwing you off?
or making you throw up....?
Too many actuallys and not enough likes.
@ScottPack guaranteed 5 likes.
21:25
@Adnan The whole idea of an antivirus is to produce random false positives, scaring users into renewing its license.
2

« first day (854 days earlier)      last day (4324 days later) »