The DMZ

Scott Pack

01:10

@MMavipc I don't know about where you are but I think it's been a few decades since that happened.

TildalWave

01:30

Wow I got to mention Orwell in one of my answers :) I hope that says exactly (but subtle enough) what I think of the question asked LOL

@ScottPack it happened in 1984 :)))

Scott Pack

@TildalWave Hipster.

TildalWave

@ScottPack hehe... bottoms up! :)

Scott Pack

Speaking of, i think may finish off this box of shiraz tonight.

TildalWave

@ScottPack Oh you're slow... wasn't it like... Wednesday of thereabout when you opened it?

Scott Pack

@TildalWave Nah. A box usually lasts about a week in this house.

TildalWave

01:38

@ScottPack not really sure how much a box holds down your parts of the woods... we're talking of 2 litres? (that's roughly 4 pints btw)

I'm contemplating opening some Scotch now... but nobody to join me, maybe a shot before bed time :)

Scott Pack

Most boxes hold 3 litres, some 3.75 (4 bottles or 5).

I used up the last of my bourbon last weekend. Haven't picked anything else up.

TildalWave

@ScottPack Oh that's one motherload of sweetness then :) They're usually 2 or 2.5l here.

Scott Pack

@TildalWave We can actually get pretty reasonable wine in boxes these days too. Nothing fantastic, but Yellow Tail grade is expected.

TildalWave

01:54

@ScottPack You work in uni... what other exam fraud prevention methods/systems are there? I really wanted to reply to that question, and I think I covered it well enough why I think his ideas will fail, but I have this distinct feeling there's more to add to that later part with my suggestions how to go about it

Scott Pack

que?

TildalWave

5

Q: Candidate authentication in large scale assessment

First of all, I'd like to apologize beforehand if the questions I am about to ask are not really suitable for this site. I could not think of any other category to post under. Right, here goes. We're building an offline assessment exam center as part of our internship. That's the company's lingo...

This question... it was bugging me since I read it

@ScottPack Yellow tail is actually darn fine for what it sells for IMHO

And it goes with BBQ

Some Chilean wines are also mighty fine for the asking price, I especially like some of their Sauvignons

Scott Pack

Their reds are pretty good. As I recall I find their Pinot Grigio is a bit too sweet and the Riesling too bitter.

Which also work out to be my preferred.

Wow, that's a lot of text.

@TildalWave Believe it or not, I've not had to really deal with that stuff.

TildalWave

@ScottPack We have big wine tradition here also, but mostly quite heavy wines like Merlot and our local but similar variations of it - Refosco and especially Terrano (I used Italian names so you can at least partially read it like they're supposed to sound LOL)... anyway, they tend to be heavy, so I often buy easier wines from elewhere

@ScottPack I believe you, sure... and it's something that would rarely change anyway, so you would have one system that's been tested through a long period of time and since the uni is still there - it works ;)

Scott Pack

Most of the time when I'm drinking wine it's relaxing in front of the TV. I need significantly less weight to a beverage when it's not competing.

TildalWave

02:03

@ScottPack I only drink it socially and sometimes a glass next to a dish... but since I prefer reds, they're not really suitable for quantity abuse... not with my stomach LOL

Scott Pack

@TildalWave Or the next morning. Nothing quite like a red to dry you out.

TildalWave

@ScottPack Last I was stupid enough to drown in red was thankfully in my student years, but I still vividly remember the thirst I had some mornings... I literally thought there's not enough of water coming through the pipes... not nice indeed. I only get wasted on rare occasions now anyway, but if I plan on drinking more than a few glasses, it'll be either beer, whiskey or bourbon... ha, that reminds me of one song actually

►

TildalWave

02:26

oh great now I've ended up listening to redneck drinking anthems ... need to open a bottle then

Scott Pack

Yeah, that was your first mistake

So I got tired of how loud the media center in our living room is.

I thought to myself, "Self, you have a G4 PPC MacMini sitting unused on the shelf downstairs. That thing's pretty quiet."

Bummer: XMBCBuntu doesn't have a PPC port.

However, Ubuntu does, and it shouldn't be that hard to build a minimal ubuntu install into a frontend.

TildalWave

02:48

@ScottPack I just use headphones :P

Had some wireless ones before, but they didn't provide fidelity I was used to so I switched back to my Sennheisers... needless to say I'm now used to walking around freely and I pull the jack out of amp every 15 minutes LOL

My cat doesn't mind tho... has something shiny and moving to attack :)

Griffin

04:18

HOW LONG ARE PRIVATE KEYS? WEBSITE HOW LONG?

D3C4FF

@Griffin about this 8===============================D Long.

4

Griffin

40 digits?

D3C4FF

@Griffin Why not 80?

Griffin

Why not you tell me the average length? I mean for you it's small but I'm talking for normal people.

2

Terry Chia

@D3C4FF Stop or you will get @Adnan excited.

2

D3C4FF

04:21

@Griffin I think your mistaking my sarcasm for answers.

2

@Griffin You didn't ask a question -that makes sense-.

Key size

In cryptography, key size or key length is the size measured in bits of the key used in a cryptographic algorithm (such as a cipher). An algorithm's key length is distinct from its cryptographic security, which is a logarithmic measure of the fastest known computational attack on the algorithm, also measured in bits. The security of an algorithm cannot exceed its key length (since any algorithm can be cracked by brute force), but it can be smaller. For example, Triple DES has a key size of 168 bits but provides at most 112 bits of security, since an attack of complexity 2112 is known. This...

Terry Chia

@Griffin Heck, obligatory THAT"S WHAT SHE SAID!

Griffin

I love being a she....

D3C4FF

@TerryChia Hahaha

Well, now that i've made the first penis reference for today, I think its breakfast time!

2

mmmm.... sausages...

TildalWave

Interesting that you'd be talking of key sizes... I haven't seen The Bear around so I dared speculate on one question. I'll be probably butt raped for it in a few hours time by reindeer he sends after me, but hey what the hell, we only live once :)

Terry Chia

@TildalWave YOLO BITCH!

TildalWave

04:36

@TerryChia oy mind your keyboard! :P

@TerryChia you any good at crypto theory?

Terry Chia

@TildalWave About the complete opposite of The Bear I'd say.

TildalWave

@TerryChia Good! Then you would have no idea how right or wrong I might be with my answer... go upvote! :)))

j/k, rather go answer this one:

0

Q: Should cookies that contain non sensitive information be encrypted?

I'm in the process of creating a website and uses cookies to track user login. The only bit of information I store in this cookie is the users username. Should I be encrypting the username even though it isn't sensitive information such as a password? I've noticed other sites which use cookies...

cookies

Don't forget to mention HttpOnly! ;)

daybreak here, time to hit the pillows before I melt on sunlight :) cheerio!

AviD

05:46

@TildalWave Classic. reminded me of it too :-)

@Gilles re the CTF post - very nice. But - shouldnt those be blog posts? they're not really a non-narq q...

@D3C4FF I still need your help with the GPU OC... but it will have to wait.

For now - I'm off to da beach, b**ch! VACAY BABAY!!

2

D3C4FF

06:20

@AviD No worries, i'll be online and able to assist tomorrow onwards

@AviD Where you heading to?

MMavipc

@AviD west coast best coast

Terry Chia

07:25

@AviD You didn't bring your hardware to the beach? You lack dedication.

Lucas Kauffman

08:06

@Ladadadada I got a reply on my email:

Hi Lucas,

Sorry for the delay in replying to you, I have only just got back from China.

Texts are 4-character alphanumeric and tied to a specific phone number.

In order to spoof access you would need to know both the phone and the pin for the particular door you're looking to open, and know the Lockitron door has SMS access enabled.

Keep in mind that brute forcing SMS messages isn't like brute forcing a password file - processing latency is 1-5 seconds and has to go through a number of intermediary services which log and have the potential to rate limit attempts.

Terry Chia

@LucasKauffman Ah, that's much better.

Ladadadada

@LucasKauffman Didn't know about the owner receiving an SMS. I wonder if everything is sent over the Wifi or if it has a GSM module in there as well.

Lucas Kauffman

@Ladadadada It's over wifi probably

Ladadadada

The whole SMS thing is still a password sent in the clear, even if you have to know the correct source number and the PIN and everything gets logged.

Lucas Kauffman

@Ladadadada indeed so in the event you get to snif sms messages

you could get in

Ladadadada

08:15

I do find myself wondering if any potential thief would go to this effort when there are often much easier ways into a house.

Terry Chia

I think it is more likely the thief would simply smash the door down than sniff sms messages.

Lucas Kauffman

@Ladadadada agreed, if you want to sniff text messages you need some really really good engineering and electronics skills

anyway Im off for a run :)

Ladadadada

A guy broke in to my parents place by placing both hands on the kitchen window and pushing it up just high enough that it could slide past the latch.

No high-tech skills required. :-P

ManishEarth

09:13

This made me facepalm (hope I've interpreted it correctly)

0

Q: Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in transit. But still an attacker can perform a brute-force attack against the hash; And i think m...

passwords javascript brute-force client-side rsa

Gilles

09:49

@AviD feel free to make a blog post. I don't see why meta wouldn't be non-unsuitable for ctf reports

CodesInChaos

10:06

@Gilles too many negatives

ManishEarth

10:17

@Gilles Meta is more of an internal entity, the blog is good for actually publishing stuff

Gilles

10:53

@CodesInChaos I wasn't trying not to avoid mismatching AviD's style

@ManishEarth So? This is about Sec.SE's participation in a contest, how is it inappropriate for meta?

ManishEarth

@Gilles non inappropriate

just imo makes more sense on a blog

Blog: supposed to be read by outsiders

Meta: Not

After all, if you can reach a wider audience with this, it's more publicity for you folks

Gilles

@ManishEarth if you want to make a blog post, feel free. CC BY-SA and all that

ManishEarth

ah

I was basically saying that it makes more sense to just post directly on the blog

minor detail though :)

Terry Chia

11:59

@ManishEarth Oh my gawd.

facepalm

ManishEarth

"I don't want to use HTTPS. But I'd like to do client side encryption. No, still don't want to use HTTPS."

@TerryChia I wonder what the words "client side" do to you folks when uttered in the same sentence as "encrypt"

Terry Chia

@ManishEarth Depends. Pentester: "FUCK YES!" Security Engineer(or whatever defensive role): "Oh god no...."

ManishEarth

@TerryChia ah lol

Terry Chia

@ManishEarth Regarding your question about MITM. I don't think there are any technical challenges that will allow a passive-only MITM attack. Maybe someone will prove us wrong.

ManishEarth

@TerryChia yeah, thought so

Terry Chia

12:03

There are some good reasons not to go active MITM though, such as being harder to detect.

ManishEarth

If I can get the packets I can spoof 'em as well

@TerryChia of course

lol

Lucas Kauffman

Lol

lynks

for those who missed it: alhazred.net

Terry Chia

@lynks Heh, I pinned that message on the other room. :)

lynks

@TerryChia ahh groovy thanks :) we can use it as a secse ctf thing at some point if you like.

Terry Chia

12:12

@lynks Haven't actually set it up yet on my system, but wouldn't it be difficult to use that online?

It appears to be more suitable to the "in the room" type CTF.

ManishEarth

@TerryChia besides, aren't ctf problems supposed to be secret before the competition?

lynks

@TerryChia yep thats certainly how it was designed. I meant more as an individual task, like when people were working through io.sts on their own and sharing tips.

ManishEarth

Did I just see Pornin get a downvote? O_0

lynks

who downvoted the bear

ManishEarth

-1

A: Are there any situations when one can only mount a passive MITM?

Passive-only attack scenarios tend to be rather specialized. Mostly, they involve radio links; the attacker can play with a homemade reception antenna, but is not rich enough to build an emitter which can drown out the genuine signal. This rarely applies to the Internet; this is more relevant to ...

lynks

12:20

some grotesque individual no doubt

ManishEarth

Is the answer wrong?

I am O_0

lynks

if i was being picky, i might say the answer is a little hurried and lacking depth, but not worthy of a downvote

D3C4FF

13:03

0

Q: Is there any malicious reason to block CRLs?

I've noticed that in order to 'illegally' crack certain applications, it is necessary to patch the host file to stop communication. I've found that with several applications there are entries that don't match the rest. These entries seem to patch the certificate revocation lists (CRL) for Verisi...

certificate-revocation cracking

Anyone?

Terry Chia

@D3C4FF Because they dislike Verisign. Obviously ;)

D3C4FF

@TerryChia xD

Terry Chia

13:20

0

Q: CTRL+ALT+DEL Login - Rationale behind it?

Maybe a rather noobish question: Why on Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) CTRL+ALT+DEL is required at login, before the password can be typed in? From usability point of view it's a bad idea, adding an extra step in getting access. So does it improve s...

authentication windows password-management

Copy paste answers ftw!

In my defense, I can't close as dupe of a question on another site. ;)

Scott Pack

@TildalWave That's not much helpful when the wife and I are sitting on the couch, or all three of us are watching a movie.

Thomas Pornin

@lynks It is Sunday. I have better (and worse) things to do on a Sunday.

Scott Pack

@TerryChia I've had it explained to me why it isn't really all that useful anymore. I just can't remember the reasons.

Thomas Pornin

("Worse" means making about 40 slides to explain what a PKI is. "Better" means simply looking at my cat basking in the Sun rays on an ideally placed bed.)

Terry Chia

@ThomasPornin Raw, medium or well done?

Thomas Pornin

13:31

@TerryChia Everything a cat does, it does it well. That's the definition of a cat.

Terry Chia

MY EYES!

Scott Pack

@TerryChia Could be worse. It be be Yvette's Bridal

And poop, it no longer exists.

TO THE TIME MACHINE!!

web.archive.org/web/20120305225639/http://…

Terry Chia

@ScottPack Holy WTF!

Scott Pack

yeah...

Terry Chia

I absolutely suck at design and I can do a better job...

D3C4FF

13:39

@ScottPack HOLY SHIT DICKS

Apple pie. Please click here.

Link unrelated.

Death to all humans

.___.

Terry Chia

Well, just broke 1.5k for the month. Wheeee~

Rory McCune

13:51

quality shot of @polynomial here webtrickery.com/2013_BSides_Teaser/scaled/…

12

Terry Chia

@RoryMcCune Hahaha nice one!

That needs to be pinned.

Ladadadada

Wait... Polynomial doesn't look like his avatar?

Terry Chia

@AviD, @RoryAlsop.

@RoryMcCune Ah, forgot you were room owner. :P

Rory McCune

@TerryChia yeah Scott added me in a moment of weakness and hasn't removed me yet :)

Rory Alsop

@RoryMcCune nice V as well

who is that with the cap?

Terry Chia

13:54

@RoryMcCune Well, remove him before he removes you!

Rory McCune

@RoryAlsop not too sure who that dude is

Rory Alsop

@RoryMcCune fair enough :-) So many folks I totally failed to meet up with - my fault for failing to get back in time for afterparty tickets

Rory McCune

@RoryAlsop there's more shots here webtrickery.com/2013_BSides_Teaser from (twitter) @W1bble

Rory Alsop

yay - I can see me in pic 1

I went outside to get decent signal

Rory McCune

@RoryAlsop ah yeah the T-shirt is a give away

Thomas Pornin

14:00

@RoryMcCune Who are these people ? They look like computer geeks.

Rory McCune

@ThomasPornin they're the kind of people who turn up to mid-week security conferences :)

Rory Alsop

@ThomasPornin hahaha

@RoryM - who's the zombie hunter girl?

that's another one for Claire's stats on women in Infosec

Rory McCune

@RoryAlsop see there's another dunno from me exposing how few people I had time to meet at the con. We had 2 women in our workshop which isn't bad (relatively speaking for infosec) out of a attendance of 16

Rory Alsop

@RoryMcCune that's better than the con average - nice one!

Scott Pack

So 1 in 8? I wonder what our numbers added for IT here. I suspects it's that or better.

Terry Chia

15:04

That ctrl-alt-del got to the top of the supercollider!

Congrats @Adnan!

Adnan

@TerryChia Things I'll never be able to understand.

My answer is no better than yours or Thomas', but still got it's the most voted.

I don't get it

Terry Chia

@Adnan The rep gods smiled on you today.

Adnan

@RoryMcCune Which one is @Poly?

ManishEarth

@Adnan the guys with the donut I think

Terry Chia

@ManishEarth Yup, donut guy.

Adnan

15:13

@TerryChia But there must be some explanation! For now, you're so close to introduce your Chia Question Rep-Training Theorem. We must also know what makes an answer the #1 coach in the train.

Thomas Pornin

@Adnan It's a chaotic system.

Adnan

@ManishEarth That's not at all what I expected.

Thomas Pornin

All other things being equal, the first answer to appear tends to get most upvotes

Adnan

@ThomasPornin Which is Terry's

Thomas Pornin

I mean, first to appear on the screen

In the beginning, order is random

When one gets an upvote before the others, it stays on top, and gets more upvotes

which is a positive feedback and reinforces its position

Adnan

15:16

@ThomasPornin An unintentional self-fulfilling prophecy

@Thomas I'll tell myself it's my sexy avatar.

Terry Chia

It helps that your answer got the first upvote. @Adnan.

Adnan

@TerryChia Ha! Strange, I though I gave you the first upvote, 2 seconds later I did the same to Thomas' answer

@TerryChia Probably didn't update for me at the time.

ManishEarth

@Adnan your right ear looks pointy/elfin in the grav

that's why

:P

Adnan

@ManishEarth That's probably it. Your move @Terry. Upload a picture of yours with a pointy ear.

ManishEarth

Terry Chia

15:28

@ManishEarth hahaha!

@ManishEarth Done.

Adnan

15:46

Watch out, bitches! I've just got my Close Hammer on! I'm coming for your questions and nothing can stop me!!

Except mods

and other users who cast a "Leave Open" vote.

but nothing else!

Terry Chia

@Adnan 3k rep? That's soooooo last year!

;)

Adnan

@TerryChia Young and mean!

Terry Chia

@Adnan hahaha! congrats tho! it gets a bit stale after 3k.

Adnan

@TerryChia Oh! You really changed the avatar! Naiice!

Anybody watched Death Note?

Terry Chia

@Adnan Only about a hundred times.

Adnan

15:56

@TerryChia I've started on Friday, I'm now at S01E17

@TerryChia It's a great show and all, but there's something that really irritates me. Everybody seems to have abnormal thinking and really ultra-human insight.

Terry Chia

@Adnan Ahh you are watching the anime? I only read the manga and watched the movies.

Adnan

@TerryChia Movies?! Ha?!

There are movies?!

Terry Chia

Death Note (film)

is a series of two live-action Japanese films released in 2006 and a spin-off released on February 9, 2008. The two movies are based on the Death Note manga (and later anime) series by Tsugumi Ohba and Takeshi Obata. The films primarily center on a university student who decides to rid the world of evil with the help of a supernatural notebook that kills anyone whose name is written in it. The two films were directed by Shūsuke Kaneko, produced by Nippon Television, and distributed by Warner Bros. Pictures Japan. A spin-off film directed by Hideo Nakata, titled ', was released on Febr...

Adnan

@TerryChia Hmm.. that must be watched after the Anime.

@TerryChia I'll say something, but please don't be mad. Before you said "I only read the manga and watched the movies." I really thought that Anime and Manga are the same.

Terry Chia

@Adnan You read manga and watch anime.

Manga: mangareader.net/113/death-note.html

CodesInChaos

16:28

@TerryChia Who cares? Just call it comic and get it over with :P

ManishEarth

@CodesInChaos scandalized

@TerryChia I once wrote a PHP script that assembled mangareader comics into pdfs. Fun :)

CodesInChaos

iih

php

Adnan

@CodesInChaos Don't!

ManishEarth

Yes, at the time that was the only language that I was confident I could quickly whip up a scraper in

I found an easy PDF library for php and used it

CodesInChaos

wrote my share of php as well. But damn, it's an ugly language

Adnan

16:34

I'm proud of this comment! :D

"It is impossible to press all of Ctrl, Alt and Del at the same time with a single hand" Here's yours truly doing it: i.imgur.com/FktS4Iy.jpg — Adnan 25 secs ago

CodesInChaos

try it on a german keyboard

(ok I think it'll still work, but technically there is no right alt on a German keyboard)

Adnan

@CodesInChaos Same on my keyboard. But my default is always the English layout.

It's Alt Gr

CodesInChaos

I'd expect Ctrl+Alt+Del to bypass the layout completely

should test that, but too lazy

Adnan

@CodesInChaos Please please please test it!

@CodesInChaos I forgot about my work laptop (it has Windows). I tested it, you seem to be correct.

TildalWave

17:20

@ScottPack ah that's another matter then, I assumed you meant it's too loud when you're listening to it on your own and not wanting to disturb others in the house. But I still don't quite get it tho, when you say it's too loud, what's the problem with lowering the volume? :O

hey @Adnan wink wink ;)

2

Q: A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization (PDF), Googled thoroughly, and now I want to implement a working exploit of a .NET Remoting servic...

exploit .net

this one put a bounty on it... nearly all rep he had

Scott Pack

17:42

@Adnan First off, your keyboard is grody. Dude. Wash that thing. Second, how on earth do you type proper words with so many wonky ass letters on it?

@TildalWave The computer itself produces loud sounds. It's not a very well designed system from a thermal standpoint.

@Adnan Third, if I had a camera with me right now I would take a picture of myself doing it with just two fingers.

Adnan

@ScottPack First, you're right, it's very dirty. But I didn't that you can just wash a keyboard.

Second, how can you express yourself without the vowels Ä Ö Å ?!

Third,

Thomas Pornin

@Adnan You can wash a keyboard; it's using it afterwards which can be tricky.

6

Scott Pack

@Adnan In the good ole days you could put those things in the top shelf of your dishwasher and Bob's your uncle.

These days your best bet is to pop off each key, watch those in sudsy water, let them dry thoroughly, and use rubbing alcohol and q-tips to clean the drip tray.

@Adnan I think mine is probably less error prone.

Adnan

►

TildalWave

@Adnan how can you express yourself WITH the vowels Ä Ö Å ?!

Adnan

17:52

@TildalWave I refer you to the video above you

TildalWave

@Adnan it's no Hüsker Dü tho :P

Scott Pack

@Adnan Ah, see, we don't need those vowels. Our current vowels adequately express those sounds.

TildalWave

@Adnan Actually, can't you write ä as ae? Not sure for the other two tho

Å is equal to what? AO?

Scott Pack

@TildalWave Based on that video it would be 'oh'.

Specifically I think the "Ä Ö Å" would be "I uh oh". Or, at least, that's how it sounds to me.

Adnan

@ScottPack Ä is the a in bad

Scott Pack

17:58

Ah, ok. So more like ah

TildalWave

@ScottPack I was only learning German and they have umlauts (and sharp s) that can be substituted with the same letter followed by e IIRC, so ä = ae, ö = oe,... at least that's how I remember it

Scott Pack

You also have to keep in mind that I come from the American south where the noun "I" is pronounced more like your "Ä".

Adnan

@ScottPack Oh yeah, one of our classmates is from somewhere in the south, it's funny when he says "I was doing that"

It sounds like: ÄÄ wöz duin thät"

Or at least that's how I remember it

Scott Pack

@Adnan I don't have much of that accent, but the two things I do have trouble shedding are the long I and dropping the 'g' on words ending in 'ing'.

Adnan

@TildalWave Yup, as far as I know they're the same.

"Adnan's has more street cred" I don't like the way that sounds

TildalWave

18:07

@Adnan: You used three whole fingers? Here's a picture of me doing it with just two fingers on one hand! i.imgur.com/mcxnanl.jpg — Scott Pack 18 mins ago

2

Star this fast ^

While we're counting fingers, who used to have a nick here as ninefingers? Was that Anthony?

Adnan

@TildalWave Correct.

Scott Pack

@Adnan By which he means yours is pretty grungy so therefore harder used.

Adnan

@ScottPack Mine is super easy to use, all the girls say that!

TildalWave

I read it as a compliment too

@Adnan all one of them?

Scott Pack

To be fair, the dude wasn't strictly wrong. That key combo was originally intended to be used exclusively for debugging during development and because on the specific keyboard they used in-house it was impossible to hit using one hand.

Adnan

18:12

@TildalWave and you had to dot it!

Scott Pack

TildalWave

@Adnan not sure I get this one :?

@ScottPack that's from IBM's XTs right? Great keyboards actually

Scott Pack

@TildalWave KACHUNK KACHUNK

Adnan

@TildalWave It means "Did you really have to say that?". Indicating that you're right, there's only one, but you embarrassed me by saying it to everybody while I was trying to hide it.

In comedic manner of course

@ScottPack But it has nothing to do with the question

TildalWave

@Adnan men experienced with women would tend to approve that, and you need not feel ashamed in front of the others ;)

Adnan

18:16

If I ask "Can Windows Firewall drop ICMP traffic?" and someone answers "The earth rotates around the sun"

I mean he's correct.

TildalWave

if you need more than one you're not doing it right

Scott Pack

@Adnan I have an answer you should read before asking that question you anarchist.

Adnan

@TildalWave NO no no.. I'm not ashamed or complaining. The sentence isn't true to begin with. It was all in the spirit of The DMZ

@TildalWave Oh trust me, I am doing it right.

TildalWave

@Adnan you know I do get a few things now and then... I know... hard to believe :P ;)

Adnan

Jesus! I'm thinking about reading these transcripts in my 40s.

TildalWave

18:26

@Adnan by then you'll be probably able to upload it directly into your visual cortex and switch to @Rory mode. Just make sure you firewall the @AviD port # 1337 to prevent XKCD injection attacks and other unpleasantries

Adnan

@ScottPack That's actually a very good guess, it's exactly 20 years

(minus 2 months, but doesn't matter)

Scott Pack

Rory Alsop

19:21

@CodesInChaos for those in the know - I'm related to Cam Kennedy by marriage, and Grant Morrison likes Metaltech... we like the 'cartoons'

CodesInChaos

I just like provoking people a bit :P

Rory Alsop

@CodesInChaos heh - I still call them comics, rather than illustrated novels or whatever

@Adnan They are obviously super-awesome in your 40s - because they are just the same as when you were younger, but you feel cooler saying them.

I'm so cool I spent 25 minutes adding Cyberlox to my stage mask ... :-)

Down wid da kids, me!

ManishEarth

Hey, is the null-terminated string SSL vulnerability still there in major browsers?

CodesInChaos

null terminated strings are one of the greatest inventions ever

ManishEarth

@CodesInChaos For pentesters?

Adnan

19:33

@CodesInChaos Nonsense! Pascal FTW!!!

CodesInChaos

@Adnan Pascal encourages good code. No RCE fun :(

ManishEarth

@CodesInChaos RCE=RE=Reverse Engineering?

8 hours ago, by Terry Chia

@ManishEarth Depends. Pentester: "FUCK YES!" Security Engineer(or whatever defensive role): "Oh god no...."

Adnan

@ManishEarth To answer your question, no. All major browsers have patched that one.

ManishEarth

@Adnan yay

thanks

CodesInChaos

remote code execution

Rory Alsop

19:35

@ManishEarth I think firefox 1.0.3 was about the last I remember seeing

ManishEarth

Seemed obvious, but I wanted to make sure before I submitted a post with it

CodesInChaos

@ManishEarth disagree with that one. Client side is the only place where you can encrypt securely

Never trust the server!

ManishEarth

@CodesInChaos Of course

Servers are completely unworthy

Servers are the bastard children of Linus Torvald's legacy

CodesInChaos

Not completely, only concerning some aspects. In particular confidentiality.

ManishEarth

@CodesInChaos (just checking) you're kidding here, right? :)

(sorry, been studying math, brain on slow mode)

CodesInChaos

19:38

no I'm not kidding.

ManishEarth

?

CodesInChaos

just a different threat model.

ManishEarth

???

CodesInChaos

as a user the only computer I control is my own.

So I need to encrypt all my communications/data on the client end-to-end

without giving servers the ability to decrypt

ManishEarth

ah I see

different ball game

We were talking about this:

2

Q: Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in transit. But still an attacker can perform a brute-force attack against the hash; And i think m...

passwords javascript brute-force client-side rsa

CodesInChaos

19:40

that's broken in pretty much any threat model

ManishEarth

@CodesInChaos yep

CodesInChaos

I have some plans for designing more secure javascript client side crypto

where an evil server leaves clear entries of its betrayal in decentralized logs

but it'd need significant changes to browsers

ManishEarth

@CodesInChaos Yeah, you'd need a trust system for the clients

Gilles

2

Q: Configuring Apache to Require a Client Certificate

I want to implement mutual authentication (two - way ) with apache web server. References : 1.Failed to sign CSR with the CA root key 2.Firefox error message when adding client certificate signed by CA after many steps : Configuring Apache 2.0 SSL to accept https by editing ssl.conf . C...

apache authentication error certificates

ManishEarth

nice

Rory Alsop

20:28

I do like this answer. It's a bit more config-y than usual for this site, but really helpful for someone wanting to set up a CA:

2

A: Configure SSL Mutual (Two-way) Authentication

There is a handy script distributed alongside openssl, CA.sh to do most of this stuff. Its location is distribution specific. In Debian and derivatives you can locate it using: # apt-file search CA.sh openssl: /usr/lib/ssl/misc/CA.sh And RedHat and derivatives the (approximate) equiva...

TildalWave

21:00

Bloody hell! What are the chances that someone would be enquiring about why some draft W3C specification doesn't work on a particular browser on the exact date the specification in question updates its status AND the code samples already reflect the new header names, while the browser of the same company wasn't updated yet? It's been in the making for two years, and the question comes in today? WT*? LOL

Rory Alsop

@TildalWave heh

TildalWave

@RoryAlsop heh indeed, I felt like digging for a flag in some forensic challenge LOL

MMavipc

22:41

Got invited to this: nylf.org/ns/about.cfm I have a feeling that it's just a college trying to increase it's admissions though. What do you think?

looked it up, everyone gets a letter

Xander

23:23

@MMavipc That takes me back. I was invited when I was in high school as well, but didn't go because I couldn't afford it. (Looks like it's roughly the same price today as it was 20 years ago, and it was only 3 days then, not 5...Don't know how that works.) I did have a buddy who went, but when he came back, all he talked about were the girls he met, so I don't know much about the quality of the sessions or the tours.

MMavipc

lol

@D3C4FF mmavipcre.blogspot.com/2013/04/plaidctf-securereader.html

D3C4FF

23:52

@MMavipc how's it?

Want me to add that to the answers post?

MMavipc

@D3C4FF I'm good, you? and yeah, add it to the post please

Transcript for