The DMZ

Adnan

14:12

@RoryAlsop Bounty-whoring has proven to effective. I've just earned my first bounty!

Scott Pack

@RoryAlsop Moonshiners are fun people to know.

user2309720

@RoryAlsop so can we say that going for info. sec. as for master will give you more freedom to choose either to stick with this field or join the forensic folks,this is not likely to happen if it's the other way around,right?

as I understood so far that info. sec. is helpful for forensic more than what forensic will help for info. sec. dude

Rory Alsop

14:33

Infosec is a very wide field. Forensics is a sub-field within Infosec, so focusing on it may limit you. The important thing is to build a career plan based on what you want to do/enjoy...

user2309720

@RoryAlsop yes exactly it's all what you enjoy but sometimes you wouldn't get that so here comes the trouble

Rory Alsop

@user2309720 relistically, aim for what you enjoy or are good at - ideally both at once, but those 2 are likely to give you useful goals. You can accept a terrible role if it directly leads to your aspirational role

TildalWave

@Adnan could you please also mention in that answer that it depends on the environment and if he needs support for unattended logins (say on server reboot) that won't work... OP doesn't mention jack all about the setup, which makes it vague

Tinned_Tuna

How do you flag a question for closure due to duplication?

TildalWave

1

Q: Is it possible to encrypt a virtual machine using virtualbox?

Is it possible to encrypt a virtual machine using virtualbox, and not leave accessible to the users of the machine where it hosted, and not allow any file to be extracted it with some program ?

this one?

Adnan

14:44

@Tinned_Tuna Flag->It doesn't belong here-> Duplicate

user2309720

@RoryAlsop correct there's must be a sacrifice to reach your dreams and achieve your goals.. I fell a bit lost coz I haven't even but my future plan so far it's seems vague

@RoryAlsop, @LucasKauffman but I really appreciate it for you dudes it was a nice talk

learnt some thing

:)

I should come here quite often to meet awesome dudes and learn from you thanks

Rory Alsop

@user2309720 not really. Some goals require no sacrifice, so it's not good to start expecting that.

Iszi

@user2309720 If you want to "meet awesome dudes" you should have @ScottPack introduce you to his favorite Bears.

Rory Alsop

@Iszi heh

@Iszi

friend

:-)

Terry Chia

@RoryAlsop Is that a meme now?

user2309720

14:50

@RoryAlsop I mean this one "You can accept a terrible role if it directly leads to your aspirational role" is true

@Iszi I don't understand you

Adnan

@TildalWave Agreed. It's really difficult to give a good answer with the current information (or rather, lack of)

Rory Alsop

@user2309720 sure. But is not always needed. It is just an option.

TildalWave

@Adnan I commented asking for clarification, but flagged it as NARQ for the moment until that's clarified

Iszi

@user2309720 Few do.

Adnan

@TerryChia Well, it should be.

user2309720

14:53

@RoryAlsop yup that's right..

Adnan

@Tinned_Tuna Check @Xander's comment. The issue appears even more complicated. I think I'll delete my answer.

TildalWave

@Adnan neah leave it, but stop bothering so much until OP actually starts too ;)

Adnan

@TildalWave Well, I've turned it into a Community Wiki. Any upvotes I'll get will feel a bit unethical, as my "answer" doesn't really solve the OP's problem

Xander

@TildalWave Yah, good point in your comment. Didn't catch what you were trying to get at.

AviD

anybody feel like helping this guy find his question?

-3

Q: Extra/Special Security for Financial Web Apps?

I found this answer http://security.stackexchange.com/a/17999/24408. It's a great answer, but aside from the finance industry specific processes like settling & clearing, the database/server/frontend security is what's recommended for all: Don't use any third-party hosting/shared hosting/VPS/d...

web-application banks financial

looks like he needs some help, but I cant dig in with him right now...

Adnan

15:12

@TildalWave Good catch on the Google dupe

TildalWave

@Adnan I'm on a roll :))

Adnan

@Tildal Have you played with the Data Explorer before?

TildalWave

@Adnan a bit yes, what do you need?

Adnan

15:29

@TildalWave A little issue, but was resolved quickly. I was trying to find how many abandoned accounts with +1000 rep we have on Sec.SE.

@Tildal ouuuh! Nice touch with the edit link.

TildalWave

@Adnan what are the numbers?

Terry Chia

@Adnan You will be surprised at the number of users with a decent amount of rep with only a single question.

Damn reptrains.

Scott Pack

So I'm finding myself in a situation where I need to create a pivot table where I'm summarizing values by median instead of average. Fuckers.

Terry Chia

@ScottPack There's probably a python library for that. ;)

Scott Pack

@TerryChia Pivot tables don't let you summarize by median or mode.

Terry Chia

15:37

@ScottPack heh, i'm just dissing you because of your python dislike.

TildalWave

@Adnan Useful, it's listing shorthand links and similar... easy to do then, you type [edit] ;)

Scott Pack

@TerryChia I'm sure python has lots of cool features, I just can't get past some of the syntax.

Rory Alsop

15:51

oh - any one else think this is mostly offtopic, with a small security question hidden in there as his least important issue

1

Q: What are the tradeoffs in cost, effort, and value in moving a database server to a virtualized DMZ environment?

I am quite new to the DMZ concept and working on a project as part of my master thesis where Remote access is required for the Development environment. However, there is a functional requirement for minimum latecy in the connection since video playing slow or getting stuck is not acceptable. So I...

virtualization remote-desktop

Adnan

@Tildal and @Terry Here's the query. I've optimized it a bit to look for users (who haven't logged in this year yet) with at least 5 upvoted answers

TildalWave

@Adnan right, I'm endorsing your for SQL! :P

Adnan

@TildalWave Well, to be honest, I'd endorse myself just because of the styling :D

I'm obsessed with styling SQL.

Rory Alsop

@Adnan is that a hair product?

Adnan

@RoryAlsop hehehe. Luckily, I don't use hair products.

I only use that 2 in 1 (body wash and shampoo) all heterosexual bachelors use.

Rory Alsop

15:55

@Adnan what, soap?

Adnan

@RoryAlsop But actually, as a mod, I think the results my interest you. You have some users with 2, 3, 6k who haven't logged on since 2012

Rory Alsop

:-P

TildalWave

@Adnan should I endorse you for that too?

Adnan

@RoryAlsop I use that heavy soap, but that's only for the important areas.

Rory Alsop

@Adnan I'll need to see why Toby went away - I know him IRL anyway

@Adnan lol

and Marc Wickenden

TildalWave

15:57

@Adnan some might be stuck on the M1 still

Adnan

@TildalWave Hmm.. if I get a CV that has has a shampoo-usage skill on it, I'd definitely ask the guy for an interview.. at least a Skype interview.

Xander

@RoryAlsop Yup. That's a SF question.

TildalWave

@Adnan I meant SOAP

SOAP

SOAP, originally defined as Simple Object Access Protocol, is a protocol specification for exchanging structured information in the implementation of Web Services in computer networks. It relies on XML Information Set for its message format, and usually relies on other Application Layer protocols, most notably Hypertext Transfer Protocol (HTTP) or Simple Mail Transfer Protocol (SMTP), for message negotiation and transmission. Characteristics SOAP can form the foundation layer of a web services protocol stack, providing a basic messaging framework upon which web services can be built. Th...

Adnan

@TildalWave Oh.. that..

ewwwww

Rory McCune

@TildalWave It's somewhat Ironic that SOAP is a dirty word in most IT circles

4

TildalWave

16:08

@RoryMcCune to those that dropped it it is :)) but yeah, pretty useless when you can write your own such protocol in 2 minutes

Adnan

@RoryMcCune *nodding with satisfied agreement*

TildalWave

@RoryMcCune You have any presentation videos from bsides already, or links to them? I don't see any updates on the official page.

And the title is tempting too: Pen Test Automation - Helping you get to the pub on time :))

Rory McCune

@TildalWave AFAIK I don't think they're up yet.

not sure what the latest is there but I haven't seen an update in a while...

TildalWave

@RoryMcCune yup it's not updated at all since I last checked it... is your b-sides presentation much different to the Securi-Tay one that was also about pen test automation?

Rory McCune

@TildalWave it's basically the same preso, redeveloped in Prezi and expanded a bit :)

Waiting to see the one I did for Scottish Ruby Conf go up, 'cause it seemed to go down well with the audience, so I need to watch the video to see what I did right :)

Adnan

16:45

Bummer! I was trying to see who are the users with the most viewed profiles on Sec.SE, and I ran into the same bug as this

18

Q: User views on Data Explorer is wrong or extremely out-of-date

I noticed that the Users.Views field for every single active user is extremely out of date. It is even zero/missing for some (not too new) users. Example: http://data.stackexchange.com/stackoverflow/query/110401/user-profile-views?UserId=335858 http://stackoverflow.com/users/335858/dasblinken...

bug data-explorer views

TildalWave

17:08

@Adnan If you're really that bored (understandable due to lack of any good questions), why not try and think of a question that will give us something to ponder on? I've tried with that skimmer question and it worked for a day or so, I think it pushes users in our direction which might result in more good questions (well, hopefully LOL) ;)

lynks

17:40

@TildalWave an eavesdropper could crack the single-iteration sha256 quite easily (they have almost everything in it already), and get their hands on the bcrypt hash. They could then compute new credentials without ever needing to crack the bcrypt. My solution was going to be to rub some RSA on it, but in the end I just went with bumping the sha256 up to 4096 iterations.

TildalWave

@lynks yeah well you see that's what I thought you were already doing when you wrote sha256 and then bcrypt in the same line :P

David

18:15

hey bros, long time no chat!

Xander

@David Howdy! Sup?

David

@Xander done w/ finals!

and back to work now lol =(

Adnan

18:36

@David What do you work?

David

@Adnan What do I work...?

Computar

Adnan

@David Computar is goud wowrk

David

@Adnan computar slave tho =(

Xander

@David Congrats!

David

@Adnan also im outta here june 21

Adnan

18:51

@David Out of where?

David

@Adnan my job

Adnan

@David Getting a new one?

David

@Adnan nope. summer school conflicts, then moving cities for school

Adnan

@David Very interesting, you're 23 but you write with a very young soul.

@David Do you think it's a good idea, David? I mean, with this economy, having a decent IT job isn't that easy.

David

@Adnan huh?

@Adnan and yes, need my degree

Adnan

18:56

@David Well, I wish you the best of luck.

TildalWave

@Adnan - LOL wanted to comment but it didn't fit. Didn't see your comment there before I started either, and sometimes, the answer is simply that there is no answer. It will be moved to Super User anyway as it's off-topic here. ;) — TildalWave 1 min ago

David

@Adnan thx, i cant wait to move! been living w/ my parents for 23 years lol

Adnan

@David Well, the first few years don't really count as you needed someone to change your diapers and move food to your mouth.

David

i'm actually SUPER worried about college lol

i just got a D in a class, and still have to send final transcripts

Adnan

@TildalWave I'm still not able to leave that chat room Aww!

David

19:00

hoping they dont reject me

TildalWave

@Adnan aww! hehe

David

emailed my teacher, as im pretty sure me getting a D is not possible, based on my own calculations

very impatiently awaiting reply from him

TildalWave

@Adnan have you tried joining another room, then leaving "aww" then leaving that other room too? maybe it's just having problems creating a new state in database or "something"

Adnan

@TildalWave Luckily still no gang raping at Meta.SO

TildalWave

@Adnan because it's a bug report, not a feature request... try requesting it as a "feature that actually works" and see your post get -100 in under a minute LOL

@Adnan Wanna remove that "mental -1 comment"? It's gonna end up on SU when a mod sees it... I'm afraid they won't get it there ;)

Alternatively, convert you comment to a question and we mutually tap our backs for providing answers to a question that has none :))

Scott Pack

19:10

@Adnan So you're awfully satisfied with dropping SOAP?

5

Adnan

@ScottPack I heard that after dropping SOAP, you need to REST your backend.

6

Scott Pack

Adnan

@ScottPack Indeed, that was a good one.

Iszi

As long as we're on the topic of double-entendres (then again, when are we not?) y'all should tell your girlfriends/wives "Diamonds rain on Uranus".

http://www.howtogeek.com/trivia/on-which-planet-does-it-rain-diamonds/

TildalWave

If it's machine washable, you can drop SOAP for AJAX

Adnan

19:15

@TildalWave Done. Now handle yours.

TildalWave

@Adnan you didn't convert your comment to an answer so I can "tap your back" :P

Adnan

@TildalWave Well, it'd be upvoted, and I'll be getting rep for a non-answer. I think I've already explained that I'm not a big fan of that.

TildalWave

@Adnan sure sure... but it's for SU, not here... your rep moves with the question ;)

@Adnan I've flagged it already for migration, and I assume the other one out of currently two is yours? On migration, chances are (depending on mod's mood) your comment will be removed, but it won't be as an answer ;)

Adnan

@TildalWave Yeah, I flagged it as OT as well

TildalWave

@Adnan Funny, but I can't find a duplicate on SU... the closest I could find is this one:

4

Q: How to decrypt Windows 7 encrypted files

I have a flash drive and on this flash drive I have a folder. In Windows explorer, I right clicked on the folder and went to properties. I then clicked the advanced button and there is a check box there that says "Encrypt Contents to Secure data". I clicked this box and hit OK. Windows then encry...

windows-7 encryption decryption

But it's about using encrypted files where certificate isn't missing

OK OK that's with a scent of lame ... how about this one? >

Iszi

19:34

@TildalWave Dunno what's more awesome - that shirt, or the girl for wearing it?

Scott Pack

Makes you wonder what she looks like not sucking in her belly, fully inflating her lungs, and shoving out her chest.

TildalWave

if there was only a way to inject style="background-color:rgba(255,255,255,0);" to it, huh? ;))

Adnan

20:13

@ScottPack Well said

Xander

22:40

I have to admit, it gives me a bit of a chuckle when I see salespeople endorsed for things like "SaaS" on LinkedIn.

TildalWave

@Adnan I believe you meant to write key derivation function and not key diversion function?

TildalWave

23:07

@Adnan You're living dangerously, you're only 15 rep points behind The Big Bear for the month!

TildalWave

23:19

Not a single Sec.SE question on the first three pages of the SuperCollider :(

Transcript for