« first day (855 days earlier)      last day (2344 days later) » 
00:00 - 20:0020:00 - 23:00

12:01 AM
anyway, I'll try it tomorrow.
 
@AviD Do you have HT enabled or anything fun like that?
 
@D3C4FF HT, sure
TBT, no
wait, what do you mean "fun"? Do you shut HT off?
 
Yeah, if you shut HT off watch your temps drop :P
 
sure, and performance. Right?
though right now I'm not worried about the temps...
 
12:24 AM
@AviD Well, the point is you can find good stable voltages/settings, and reduce power draw, then whenyou see how high you go, you can re-enabled HT, it shouldn't cause any instability but power+heat will be up, so you'll need to cool it adequately
 
@D3C4FF hmm interesting. I guess that would make sense for extremeOC, though probably not so much for my high-not-extreme OC...
definitely not for my moderate OC.
though I'm thinking of setting up the turbo boost on top of the x43...
if I have the headroom, might as well, right? it wont push it if its too hot.
thats assuming my chip is still alive and well...
 
12:44 AM
@AviD I usually leave 'turbo boost' disabled personally
just incase it suddenly bumping the multi does something strange...
 
sure, with high overclocks you dont have spare headroom, but perhaps with the lower speeds, it might make sense...
whatever, not doing anything till I see the chip works right...
 
Well. This does not bode well. It was starting to feel somewhat warm in the house, so I went to turn on the AC. It appears as though the compressor isn't kicking on.
 
1:25 AM
@ScottPack. Ugh. Ours went out last summer. Not fun. At least you're catching it early, before the heat of the summer.
 
 
1 hour later…
2:31 AM
No. Doubt. Our bedrooms are built into the roofline. The south facing unshaded roofline. I don't see how they managed pre-AC.
The annoying thing is that it was working yesterday. I really hope it's a relay or capacitor. I'm not sure I can stomach a new compressor.
 
 
2 hours later…
4:20 AM
 
4:57 AM
@AviD with turbo you're enabling it to clock individual cores higher when others are not in use, meaning you'd be getting a lot of heat on a really small space... that's tough to cool down, so it's suggested that you disable turbo. Also, it's a bit sporadic since it's only tested for nominal speeds and I believe that the multipliers it uses can make it really unstable. I would advice against it.
@AviD Another thing to consider is also that the mobo is faulty. I wouldn't bet against it, since you had strange problems since the start (better stability at higher OC)
But I highly doubt that you permanently damaged your CPU, not with the OC you were doing (unless the heatsink isn't properly attached to it... then all is possible)
Anyway, I was actually dreaming of that mocking that I was on the receiving end of after giving my opinion on compiled code vs. interpreted languages security. Thought of another case for the former, if anyone is interested in pulling down my pants again and giving me some from behind... just tell me when to drop the soap :)) :P
 
@TildalWave @Adnan.
 
@TerryChia ouch buthurt! :)))
 
5:32 AM
<blink><marquee>Does this really work?</marquee></blink>
Sadly no
 
Bloody hell I can't get to any reviews on SO... even got one of those glad that you're paying attention tests doh!
 
@TildalWave I can't get any votes on SU -_-
 
@D3C4FF Why not? It's dead? Or you're the victim of the usual hit and run questions?
 
@TildalWave Not sure, couple of hit and runs, no-one wants to upvote my questions either? shrugs
 
@D3C4FF It's SU.
 
5:45 AM
@D3C4FF added my +1 on that Synergy question because it's good and valid... but I can't go through others any faster not to trip over the serial voting check
At 1335 on both Sec.SE and SO now... made one edit here, waiting for the accept... need another on SO
 
@TildalWave Approved, you need 1 more.
 
@TerryChia hmm I see no change in rep... and I made one more with ample change (added tons to formatting and links)
 
@TildalWave Whats the 'serial voting' check?
 
@D3C4FF If for example I went on your profile page and opened your questions/answers from there to vote on them, the system would detect serial upvoting and reverse them. It's also doing other checks to prevent it, but the ones from profile page as a referral are the most obvious ones. I.e. if you vote on mostly a single individual's posts, or vote too fast without taking the time to actually read it... stuff like that
 
@TildalWave Interesting, makes sense!
 
5:57 AM
@TildalWave You need 2 people to approve a suggested edit.
 
@TerryChia oh cheers! didn't know that... so each time I edit I bug either two high ranking users or a mod? wheeey there's more perks to it than I initially thought hehe
I want my two 1337s now... but then 3000 here I come :)
user image
2
 
6:18 AM
Awesome! :D
 
6:30 AM
@D3C4FF yo is this DNS spam.looptech.com.au familiar to you? had it in my access logs with referrer from my profile here... I was thinking, who do I know in Oz that would put spam in their DNS name... thought of you 1st LOL
 
6:42 AM
@D3C4FF BTW... Remove the overflow:hidden; from Styles_System1.css, line 259 ;) Some of the contents on the main page are hidden under another DIV... either that, or change the style for the table after it to width: 581px;... someone messed it up there :P
1
A: Organization like OWASP for network security?

Rory McCuneIf you're looking for the equivalent of OWASP for network security then I'd suggest that testing methodologies like OSSTMM or PTES (although PTES is still rather incomplete), are a good place to look for information. However as you say both of those will have a very large amount of information i...

@RoryMcCune PTES would be less incomplete if they didn't crop their diagrams like this one LOL
 
@TildalWave FWIW I think PTES is dead as a dodo these days the last substantive updates to it were last year. shame really it was quite a good idea..
 
@RoryMcCune Shame indeed. I still find it useful tho, especially for the diagrams and nice explanations to them. Organizing things around is with PT more of a challenge than the tests themselves sometimes are IMO
when I say organizing... I mean also reporting on findings obviously. That's where PTES comes quite handy with nearly copy/paste-able structure that then just needs actual test results... I wasn't involved with many pentests tho, so it's just my impression really
not many pentesters here tho... I expect most were consumed by UK and Germany :)
@RoryMcCune Out of curiosity, how many different versions do you include in your reports? I've only glimpsed through reports for management and mostly worked on the ones for devs, but the differences were huge
 
7:13 AM
@TildalWave well we typically pass out one report with a management section at the beginning (short and high-level) and then a detail section in the middle (goes into what was tested and found) and then a "slides" section at the back which just summarizes each of the vulns found...
so it can be a bit repetitious but then things like Dradis can help automate some of it..
 
@RoryMcCune You do follow-ups as standard? Or that depends on the client? I imagine it's suggested and probably a standard practice with bigger customers, but what about the smaller dev teams? If you even do those?
 
@TildalWave TBH we very rarely get asked to do follow-ups which is a shame. I did one the other week where I did a workshop on web app security and talked through the findings for the devs
but that was the first one I've done in over a year.
 
7:56 AM
1
A: What is the difference between Exploit and Payload?

TildalWaveI prepared an easier to read version of the diagram (I believe). It's following same basic principles the @D3C4FF's excelent answer does. I was tempted to go with his analogy first, but I thought it wouldn't be appropriate due to recent events and for the current global political climate. The t...

I've added a bit more description why I think it's a suitable analogy. Obviously some didn't get it... I honestly hope it's not simply a case of them using too reflective displays LOL
@RoryMcCune That's a shame yup. What's the general feedback you get for your VAs? Are your clients overwhelmed by your reports, or they actually knew what to expect, or even gave suggestions?
@RoryMcCune There's probably some consulting going on even before they sign the contract,... I guess what I'm asking is if you negotiate to what detail you should go, or you have packages and then decide on pricing and timeframe terms based on project complexity? Or a bit of both?
 
 
2 hours later…
9:33 AM
@TildalWave VAs are weird. In a lot of cases I think people are having them done purely for compliance purposes, so we'll see the exact same findings repeatedly
@TildalWave well I don't see a lot of the pre-sales stuff all the time, but a lot of it is trying to find out why they want the test as much as what they're looking to cover. Ideally people want the test to improve their security, so that's the best case as you can give guidance on fixing stuff. Other times it's contractual/compliance and then it can become a point of getting as much done as possible within their budget which tends to be fixed.
 
9:46 AM
@RoryMcCune I glimpsed through your webpage and have a few suggestions. You mentioned now compliance testing, so maybe it wouldn't be a bad idea to include what certification compliance testing you offer (maybe references too). And maybe in the stuff section also what certification they have? I only went there curious about what you said BTW, I'm not a certification freak or spying on you :P You've already shared the contents of your car's booth with the rest of the world anyway LOL
 
@TildalWave heh, no worries, all that stuff is as public as the contents of my car boot :) Most of the stuff we do at the moment is 3rd party (we work for other testing companies) so references are a little tricky, although we've had a couple recently. good point though I should put compliancy content up there to help with search traffic.
 
@RoryMcCune Watching that why pentesting must die video now, the title caught my attention LOL ;)
 
@TildalWave well ya know attention seeking sounding titles are good for getting people into presentations :)
 
10:05 AM
@RoryMcCune some good points there at the yes but can I crash it? about what PT actually is, possibly the simplest explanation I've ever heard (minus the accent LOL)
 
10:20 AM
HI!
 
@TildalWave yeah I do tend to sound overly scottish when speaking...
 
@RoryMcCune neah I don't have problems understanding... just teasing ;) BTW... that brownish liquid you're drinking... could that be the source of your accent? :P
Looks like a posh single malt
3/4 pint daily allowance for married with children LOL
 
@TildalWave heh unfortunately nothing so nice. at a guess it'll be coffee or diet coke :)
 
Heh - posh single malt
 
10:28 AM
@TildalWave ahh club mate :)
Club-Mate () is a caffeinated carbonated mate-extract beverage made by the Loscher Brewery (Brauerei Loscher) near Münchsteinach, Germany, which originated in 1924. Club-Mate has a relatively high caffeine content (20 mg per 100 ml), low sugar content (50 g/kg), and low calories (20 per 100 ml of beverage), compared to other beverages such as cola and other energy drinks. Club-Mate is available in 0.33 and 0.5 litre bottles. History Geola Beverages of Dietenhofen, Germany originally formulated and marketed Club-Mate under the name Sekt-Bronte. The drink was only known regionally unti...
 
@RoryMcCune hehe yup just wiki-ed too
 
@rorym had fun last night. I now have an enlightened sticker on my guitar, and after the gig I popped off 8 portals on my way home
 
@RoryAlsop w00 I'm still waiting for any of the portals round here to get approved...
BTW did you hear that we have a smurf in the DMZ
 
Wonder if both of us submitting the same portals will speed anything up. Who is the smurf?
 
@RoryAlsop its @lynks . I was trying to persuade him to see the errors of his ways last night...
not sure on the portals. I have a feeling they're swamped but still it would be nice to see some progress from them...
 
10:55 AM
@TildalWave Is that you?
@TerryChia Well, somebody has to do it.
 
@Adnan no it's @RoryMC
 
@TildalWave Get out of here!
 
@Adnan c'mon you've never watched any of his presentations?
 
@TildalWave Jesus! The way that sounds!
@RoryMcCune @RoryAlsop What's with you security guys?! Do you ever get old? Should I start pen. testing to throttle my aging process?
 
@Adnan well it's either the security or the good scots diet :)
 
11:01 AM
@Adnan they're Scots they'll put it down to good genes and cultural background
Ah yeah LOL ... 2 seconds too late
 
@RoryMcCune So what do you eat? What do you drink? Beside the blood of babies
 
@Adnan Haggis and Irn-Bru
 
@Adnan shiiit that made me nearly choke to death in laughter.. .where the f* do you get these? LOL @ blood of babies
 
@RoryAlsop Jesus Christ! I shouldn't have Googled Haggist! What the hell is that?!
 
@Adnan haggis *)
 
11:05 AM
@TildalWave Well, it's a universally proven facts that Rorys are into Metal music, and we all know that head bangers worship Satan and drink babies' blood.
How do explain the everlasting youth then?
 
@Adnan not blood of virgins?
 
@TildalWave Looks like something my ex's mom would cook.
@TildalWave You see, I'm not too keen to the "blood of virgins" thing. It sounds so.. ummm.. I can't explain it.
 
@Adnan rare?
 
You know which girls are the best?
Lebanese girls.
@TildalWave This is actually very interesting. More answers on SO, yet the same rep and less badges.
 
@Adnan hit and run questions ;)
 
11:10 AM
@TildalWave and Lebanese girls.
 
@Adnan I get this distinct feeling I'm supposed to ask why?
 
I get the impression people vote less on SO.
 
@TildalWave You just can't resist their majestic presence.
 
@AntonyVennard Nono. You just have not found the really stupid, reptrain type questions.
 
6806
A: Why is processing a sorted array faster than an unsorted array?

MysticialYou are the victim of branch prediction fail. What is Branch Prediction? Consider a railroad junction: Image by Mecanismo, from Wikimedia Commons: http://commons.wikimedia.org/wiki/File:Entroncamento_do_Transpraia.JPG Now for the sake of argument, suppose this is back in the 1800s - before...

like this?
 
11:12 AM
@TerryChia possibly. It could also be that there is much more content, so the chances of a Q reptraining are low. But there was some research done into voting in tags and I think haskell came out as the tag to be in for votes/answer.
 
@TildalWave Nah, that answer actually looks quite good.
 
@TildalWave @TerryChia This contributes to my theory; "An answer that begins with a picture will have a high number of votes"
 
@TerryChia well it is, but not THAT much better than most with 5 up votes are
 
There was a really stupid one on the supercollider a few months ago. Can't remember the title.
 
Case and point.
 
11:14 AM
@Adnan why don't you ever do this with answers of others? :P never mind
 
@Adnan You are missing some freehand circles in those pictures.
 
@TildalWave It's called shameless self-plugging.
3
No dirty thoughts @TerryChia and @AviD
 
@Adnan With a cactus?
I think the cactus thing deserves a spot on the meme question.
 
@TerryChia Usually, with a cactus dipped in vodka, at night. But you can use whatever makes you comfortable.
 
@Adnan so you actually ordered some of those items @ScottPack suggested you get off Amazon?
 
11:16 AM
9 hours till the CTF starts FYI.
I'll be sleeping at that time but those that are awake can and should go ahead and start. :)
Link and account details are pinned in the other chat room.
 
@TerryChia we'll need you later to collect the prize ;)
 
@TerryChia Actually, the original cactus incident is attributed to the user DiH
 
1445
Q: How can I get query string values?

EminIs there a plugin-less way of retrieving query string values via jQuery (or without)? If so, how, and if not what plugin do you recommend?

@TerryChia this one seems to fit the description well enough
 
@TerryChia I'll be awake and (possibly) awake enough to do the CTF. Will start and post what I'm doing in the room.
 
@Adnan Dunno for @RoryMcCune (tho possibly because he associates with @RoryAlsop), but @RoryAlsop looks young because he's so old that his appearances run into the integer overflow (the - sign only shows in the mirror reflection, though).
7
 
11:32 AM
I can't say this enough, man, I love Cryptocat
 
11:45 AM
@TildalWave hahahahaha
Haggis - it's like a sausage, only better. You can use it in place of mince to make haggis lasagne, or as a topping for haggis pizza. You can have it for breakfast, lunch, (and/or) dinner
 
@RoryAlsop That pizza looks Scottish for more reasons than just being a haggis version of pizza Bolognese LOL the crust is wiiiiideeeee and no cheese on it! You probably don't get many Italian tourists, huh? :)))
 
@TildalWave nah, that's just a pic I found online. The ones you get in Asda are filled to the brim :-)
 
@RoryAlsop just teasing ;) I make one mean pizza tho, if you're ever down our woods, you're invited ;)
 
@TildalWave definitely - I am a massive pizza fan. Generally where other bands would drink/take drugs etc between soundcheck and playing - we go find a good Italian restaurant :-)
 
11:59 AM
hahahaha
nice @Terry
 
12:13 PM
Hard Mode
 
Haggis in the morning, haggis in the evening, haggis at suppertime. When you've got some haggis you can have haggis at any time!
 
Haggis in the bedroom.
 
@Terry I can do you a better image when I get on a computer.
 
@Polynomial ew
 
@ScottPack The first thought that popped into my head - Llama Pizza.
 
12:16 PM
@TerryChia and fuzzy alpaca pizza
 
@RoryAlsop What? Nothing turns a lady on more than shredded animal organs!
 
@Polynomial .... o...kayyyyy
 
@RoryAlsop That surprises me coming from a Scot.
 
@TerryChia my dating technique never included the Lady Gaga technique...
 
@RoryAlsop Whatever happened to her? She seems to have dropped out of the news recently.
 
@TerryChia dunno - I only ever liked a couple of things about her - edible clothing, and her stage craft. I'm not really that into pop music (cos I'm a fogey)
 
@ScottPack heh.
@RoryAlsop I'm not really into pop music either, and I'm the opposite of a fogey.
 
@TerryChia If John could get his hands on some he just might. He doesn't like to do odd things for the purpose of being odd, but he does try to do things unusual that taste yummy.
Oh, the systems guys in here should probably look at this.
 
@ScottPack nice.
I do agree that troubleshooting selinux errors can be a major frustration.
 
12:28 PM
@TerryChia Yeah, he pretty much summed up my feelings in his first post.
@TerryChia It's more about retraining your debugging process.
$THING doesn't seem to be working, is $THING running? Yes. Does $THINGS logs list any obvious failures? No. Are there any denies in /var/log/audit/audit.log?
 
I really need to look deeper into selinux. Ugh, another thing on my very long todo list.
 
A few months ago an update to Fedora 18 ended up breaking the security contexts on /etc/hostname.
Simply by changing my debugging process to allow for selinux it took me about 30 minutes to diagnose and fix.
It was as simple as issuing a restorecon, so the fix took seconds, but the debugging wasn't that much harder.
 
@ScottPack I hated trying to to it before I really understood restorecon
 
@RoryAlsop The policies, these days, are pretty spot on. But yeah, between the policies being good and restorecon to fix issues...there's 90% of the problem solved right there.
 
12:56 PM
@RoryAlsop @ScottPack How much data does Ingress use? I'm probably gonna play it with my phone tethered to my tablet but I don't want to burst my data cap.
 
It's pretty continuous but not terrible. It'll depend quite a bit on how much you play.
My data usage, since I got my invite, has been about 50MB for the Ingress app
That's been since about March 26th
 
@ScottPack Ahh, that's very manageable.
Battery is probably gonna be my main hurdle.
 
Quite right. The other day I had Ingress running for about 45 minutes and burned through 60% of my battery.
 
@TerryChia The max I managed in one month was 1.5Gb, and that was using the IITC browser a lot. Get one of the battery packs I mentioned - 12000mAh is a lot!
 
@RoryAlsop Is this on your Desire?
I've only got the stock 1230mAh. The GPS on this thing is very nearly a short to ground.
 
1:16 PM
@ScottPack have an S3
the battery pack is an external one from amazon - give two usb slots at 1 and 2 amp
 
@RoryAlsop When did you upgrade?
 
A floating Sheldon appears.
 
@ScottPack January time, ish
 
Ah. My contract is up in October, I figure I'll be upgrading then.
 
@ScottPack The S3 is awesomely robust, comes with the tools to easily use alternate builds, excellent battery life and a really good gps
my mate just got the htc 1 and it seems almost as good
 
1:31 PM
What's up @ScottPack. I got Snort working pretty well and also remembered now to use -D to see what was going on. Had some rule errors.
 
@Travis That happens sometimes. If you're including a signature that doesn't parse then snortd crashes on startup. Pretty lame if you ask me.
I would rather it throw an error message, skip that one, and continue on.
I've come into work with several dozen alarms because Sourcefire fucked up a rule.
 
@ScottPack See, now you need to rewrite snort.
 
That should happen less frequently now. They used to use a different versioning scheme internally than externally.
 
@ScottPack Yep! Just moves right along and spawns the process though. At least output something lol. I'm trying to refine one particular alert. It comes up when Adobe tries to run an update and I've found the rule but I'm not sure if I can do an exception
 
Just recently they converged the version numbers so they'll match up.
So you want to ignore that signature for a specific host
 
1:34 PM
No, because adobe is using akamai. Basically I need the payload signature to ignore Adobe or something like that
Crap..didn't mean to hit enter
 
That's...trickier. Whitelisting a signature for a host is built in
You're wanting to modify the signature.
 
@Travis - you can edit and delete your recent chat posts
 
It's...odd.
So, whenever snort processes a packet it processes it against every signature that would make sense for that packet.
It internally builds out an array of all of the alerts that fire.
Then it logs the first alert that fired.
 
@RoryAlsop Thanks!
 
0
Q: Is changing the default port more secure?

Henry LeeA lot of discussion I see suggests that changing default ports for services is just "security by obscurity" and is easily defeated by scanning for open ports. My question is this, though, if the port is changed to a random port, yes an attacker knows it's open, but do they know what service is ...

Definitely a dupe of something.
I remember arguing about it with someone on here.
 
1:37 PM
@ScottPack So would it be a rule or something else?
 
Technically, there is some prioritization, but not much. Largely it was one of those decisions that was designed in for future proofing, but wasn't ever really fully utilized.
@Travis The best think you could do is rewrite the signature that's firing and tweak it so it doesn't fire on your use case.
 
Ah, found it.
 
@TerryChia I'm gonna say this
23
Q: Should I change the default SSH port on linux servers?

sharp12345Is there any advantage in changing the SSH port, I've seen people do that, but I can't seem to find the reason why. If you have a strong password and/or a certificate, is it useful for anything? Edit: I should also mention that I am using iptables rules to limit brute forcing attacks, only 5 l...

 
@ScottPack yep, found that one and vtc-ed.
 
The one you posted is a more general case, but the answers are the same
Good. I got a kick ass answer on that one. :)
 
1:39 PM
@TerryChia My answer would be not really. Whatcha think?
 
@Travis My viewpoint is that it is indeed just obscuring the target and won't deter any semi-determined attacker.
 
@Travis It depends on your use case.
@Travis I'd say go read the answers on the one I posted and see what you think.
 
A few people around here brought up a decent point that it cuts down on the automated bruteforce type attacks you find on the internet and can help to somewhat reduce the noise on your logs.
So, weigh that against having your users remember an obscure port number.
 
@ScottPack It's a very vague rule. Just looks for content of PE|00 00| saying that a portable EXE file was detected. Not smart enough yet to come up with a solution on how to block everything but adobe
Will the signatures work chronologically like if I do a pass first for the adobe and alert for the current sig?
@ScottPack: Good info in that SSH port article. Very relevant for sure. I can't upvote until I get 15 rep on there though :(
 
@Travis It might be worthwhile to just disable, then. Or, perhaps, not not fire an alert on akamai boxes.
@Travis Not really.
So, the reason snortd takes so long to start is that it's processing all of the signatures and building out a big state table/decision tree like data structure.
So the order in which the rules are processed depends more on how they're constructed.
 
1:49 PM
@ScottPack Holy crap, that's ridiculously large for a simple "humor" image. Even if it were serious, it's still vastly larger-than-life!
 
Some types of signatures are prioritized.
 
Just disable it for now. It only triggered for Adobe anyway
 
For instance, a suppression rule is such that the signature will still be processed, but it won't produce an alert.
Rule tuning is a bitch.
 
Yep! I wrote a shell script (instead of using oinkmaster) that will pull and process rule files from Emerging Threats and Bleedingsnort.
 
@TerryChia God damn it! You should have a normal avatar. For a second I thought that was you.
@TerryChia Looking nice with your guitar, eh? facebook.com/terry.chia.73
 
1:53 PM
@Adnan Sadly, I'm not that old.
 
@TerryChia Which leaves us with young Chia Terry facebook.com/chia.terry.3
 
@Adnan Closer.. but no. ;)
Why are you stalking me?
 
@Travis All the cool kids used PulledPork these days.
 
@TerryChia If I were stalking you, you wouldn't know. Mwahahahaha!
@ScottPack I'm thinking of ways to sexualize that term "PulledPork". I couldn't come up with any.
 
@Adnan That would be sacrilege.
 
1:57 PM
@ScottPack I've got that too.
 
@Adnan I think @Polynomial mentioned shredded meat products earlier...
 
@Adnan Want to pull on my pork?
 
@TerryChia I think I found your facebook
@Travis At a certain point with children and mariaige all you can hope is that someone will.
 
One day
 
@Travis PulledPork will pull down the newer SharedObject rules, oinkmaster can't process those. You can also use regexes in your PP config to modify a signatures when you update. So you actually can locally modify a shipped rule and still update.
 
2:01 PM
I never knew that SecureID was based on PKCS#1 v1.5!
this is entirely new information!
 
hmmmm - not sure this is really needed. What do you guys think?
0
Q: Area 51 Security Review Proposal

UndoStack Overflow has Code Review. UX is about to have Design Review. So what do we need? Security Review. Someone needs to start a proposal to make such a site happen.

 
@RoryAlsop the legal issues are potentially crippling for such a site
 
ayup
 
@Polynomial This.
 
surely someone could do something malicious and claim it was an authorised test
 
2:02 PM
I figured rather than weigh in heavy handed as a mod, I'd wait until you guys had had a go :-)
 
@TerryChia Oh yeah, this is definitely your facebook. I see all your shitty bands.
 
Go write that on the discussion page.
 
@ScottPack I'm guessing I need to really read the documentation in depth of PulledPork. I have it just doing the VRT rules
 
@ScottPack Stalker. ><
 
@TerryChia Meh, I'm bored. My kid's been sick the past couple of days. So I'm sitting at home drinking coffee watching Sesame Street.
Watching Grover explain paleontologist is funny.
2
@Travis It's better in some ways, worse in others.
 
2:04 PM
@ScottPack I'm using Barnyard2/Snorby to view alerts. How do you handle non-translated SID's that aren't located in the SID map for barnyard?
 
@Travis Pullpork will generate a new sidmap as part of it's update process.
 
Yep, my script that does that using the script in the contrib folder of snort. Just doesn't seem like it is getting it for all (like that adobe one)
 
@Travis That's definitely a problem I have. I'm pulling in a few dozen rules that we've written in-house or from groups/mailing lists I'm on.
 
@RoryAlsop Not a good idea, I'll even say it's a bad idea.
 
@Adnan agreed
 
2:07 PM
I see it as useless fragmentation
Not a very compelling argument either. "SO has Code Review so clearly sec.se needs Security Review."
 
Code Review is usually about small pieces of code and general ideas.
Reviewing the security model of company, for example, is a whole different story.
You can't really make judgement based on a 10-line question.
 
@TerryChia I like Ben and Jerry's too.
 
0
Q: Serious issues around Security Review

PolynomialProposal: Security Review As far as I can tell, this proposal essentially amounts to asking StackExchange citizens to perform a penetration test on live sites. I can see several serious issues with this: It may be difficult to verify that the OP is: The actual owner or representative of the ...

 
What's the security review?
 
it's an Area51 proposal
 
2:19 PM
Oh
@ScottPack Oddly I just grepped my SID map file and the one that isn't translated is in there...
 
@Travis You may need to restart barnyard
@Travis It only reads the sid.map on startup.
Also, if Snorby is doing any kind of internal tracking, it may have already created an internal entry for that signature ID and mapped it back to the invalid name.
 
@ScottPack Maybe. I did restart barnyard. I'll do it again just to see.
 
We're run into the latter problem with our SIEM. It creates a new log message record in it's own signature database every time it sees a new kind of log message, but it's keyed off the SID (for snort) and the message field doesn't get updated.
So what I ended up doing was configuring my snort puppet module to restart barnyard if the rules get updated.
 
2:35 PM
You and puppet :)
 
I just kill -9 the process and execute my rc.local file to start it all
If I could remember about 10 years ago I might know how to search and auto kill the process and run then restart snort/barnyard :)(
Or just not be lazy and Google it
 
What distro?
 
2:55 PM
ubuntu 12.04
 
Freaking upstart
probably service barnyard2 restart
 
3:37 PM
@ThomasPornin He is promoting his own product.
(In reference to this answer)
0
A: Are there any free static analysis tools for C# / .NET code

Andrew ThompsonNot Free, bu the best static analysis tool for C# on the market is Parasoft's dotTest http://www.parasoft.com/jsp/products/dottest.jsp

 
@Xander I did wonder, especially as I didn't really think the parasoft tool was security focused...
 
@RoryMcCune Given the presentation of the answer, and the fact that the Sec.SE account was all new, it was quite probable.
 
@ThomasPornin true true
 
I just finished watching Swordfish. Amusing how hollywood thinks hacking is like.
 
It's a particularly poor example :P
the film is poor, that is. not the example.
 
3:51 PM
@Polynomial Well, I was bored so I figured I'll check out what hollywood is smoking.
 
some crazy shit, clearly.
 
Go back and watch The Net.
 
@Polynomial Have you been answering much questions this month? Or is that 1.5k latent rep?
I have been quite active this month and I'm still 300 short of you.
 
latent mainly.
I had a couple of active days
 
Damn, you are getting as bad as The Bear now.
 
4:09 PM
 
4:30 PM
@Terry, no that is exactly how we do pen testing. We all have TVRs and Halle Berrys
3
 
@RoryAlsop Damn, I want a Halle Berry.
 
@TerryChia How else do you think we get motivated?
 
5:02 PM
morning
 
5:12 PM
I'm sure it will be seen pretty soon, but I was able to confirm security.stackexchange.com/questions/25031/… as self promotion from a PR article with his contact info
 
@Polynomial Yes, weren't there naked women in it. Hackers never see boobs
completely unrealistic
it was also my biggest problem with the movie hackers, they were otherwise spot on
 
@AJHenderson and @Xander - thanks. Binned!
 
@AJHenderson I wanted to be a real hacker :(
 
5:30 PM
@AJHenderson It's amusing really to watch it again after growing up and realizing that whitehats don't fly through the cyberspaces of their own computer systems with high speed VR glasses.
 
6:13 PM
@RoryAlsop Did you convert an answer to comments yesterday, on that question ?
5
Q: Is it appropriate to use haveged as a source of entropy on virtual machines?

NicWhile looking for solutions to entropy pool depletion on virtual machines, I came across an interesting project called haveged, which is based on the HAVEGE algorithm (HArdware Volatile Entropy Gathering and Expansion). It makes a pretty fantastic claim. HAVEGE is a random number generator th...

Because the answerer did it again.
 
6:58 PM
@ThomasPornin Maybe it was one of those random things? :) "It is not due to timer drift, but the aggregation of the asynchronous behaviors in a modern processor" doesn't read as true random to me. If the RNG is determined by fluctuation in code execution time, then what happens to it when you run two or more of these in parallel? Is f(1->N)[0,1] mod N = RND? Maybe I'm missing something, but I'm not so sure it maintains the randomness with high N.
 
@TildalWave Well, there is randomness, and there is unpredictability.
Apparently, the RNG feeds itself on the exact timing of some operations which may take a variable time depending on "a lot of factors"
mostly cache misses, TLB misses, and branch prediction
If several such entropy harvesters run in parallel, it is likely that the values they obtain will not be independent of each other.
In particular, if the attacker can run some code of his own on the machine, and the processor uses hyperthreading, then the attacker can more or less obtain the same kind of value as the entropy harvester
i.e. the harvester will indeed obtain values which are more or less random (in a physical sense) but the attacker will get the same, which means that the attacker can still "predict" them (a posteriori prediction, which still counts as an attack if the attacker does not get to see the PRNG output)
it seems that the HAVEGE designers are not completely aware of the difference between randomness and unpredictability, the latter being crucial to security (e.g. if you use the PRNG to generate a RSA key)
 
7:13 PM
@ThomasPornin That was my initial thoughts when I was reading that reply. I didn't delve deeper into it, because... well it's Friday evening LOL... but what you describe seems exactly to be the problem with it. But not just that it isn't random (i.e. it is unpredictable, but not random), I fear that the resolution of the function isn't infinite either, meaning you can overload it to return predictable results. How random it is, when it depends on execution time, but you can control this? It isn't.
@ThomasPornin Still, I'm not sure what you meant with answerer did it again? You gather it should be converted to a comment again? Or were you just surprised that his earlier answer was converted? (I didn't see it before this alleged conversion to a comment, but seems rather strange to me - never seen it before on a post that at least attempts on answering the question)
 
@TildalWave The guy first post an answer, which consisted of comments on the other two answers. Some mod converted the answer into comments (mods can do that). Apparently, he was not happy with the conversion, and reposted an answer. I wanted to make the mod (supposedly @Rory the Old) aware of it, so as he should decide whether this requires mod action again.
On that specific subject, I don't have a definite answer. Answers-which-should-be-comments are bad answers, but I am quite happy with leaving bad answers just be bad answers, without any mod action to erase them.
 
@ThomasPornin Oh then it was justified. This latter post seems OK to me, albeit a bit strange to explain the difference between HAVAGE and havaged, say that he's working on havaged, then only deal with how HAVAGE works internally. But it is in a form of an answer, maybe just the first comment in it isn't really needed. (I'll just edit it to remove the first paragraph and a few typos, then we'll see what mods will think of it)
 
7:29 PM
@TildalWave When you do edits, non-mod reviewers (e.g. me) can handle it, too
 
@ThomasPornin yes, if I get things correctly, two are needed to approve edits then... I'll re-read it as well to check for errors/typos ... shouldn't take a minute ;)
 
@TildalWave Yes... it is a bit weird, though: my edits don't need approval, but I cannot approve the edit of someone else all by my own.
Editing without needing approval from reviewers is granted when you get 2k reputation; it is not a very exclusive power.
 
@ThomasPornin Oh darn, I just realized I'll get +2 rep on the edit, if it's approved. That means I won't have 1337 rep any more :(
 
@TildalWave Then just work a bit to 13337, then.
 
@ThomasPornin It's not a race when you can't win it, so that might take a while ;) And it's a CTF night
 
7:39 PM
@ThomasP - it looks like his previous answer was split up into a range of comments. I'm not sure how to do that - quite a useful tool.
Re the answer, I think @Tildal's edit sounds the way to go. Probably not mod needed
 
@RoryAlsop While you are there, could you have a look at the site stats ? It seems to me that this week has been especially slow.
 
@ThomasPornin anyway, my next rep target is at 7017 ... the roof, the roof, the roof is on fire ;))
 
00:00 - 20:0020:00 - 23:00

« first day (855 days earlier)      last day (2344 days later) »