The DMZ

TildalWave

00:27

0

Q: can c++ login & send queries to mysql in pieces?

lynks showed me (invented?) a way to make sure that a complete login or encryption key may never be stored in RAM unencrypted if a login or query can be sent to the database in pieces. First, is c++ & mysql capable of doing this? If so, how? Second, will mysql store these strings in memory une...

@lynks your plans are foiled

TildalWave

00:45

@RoryMcCune then there's also these: en.wikipedia.org/wiki/Reserved_IP_addresses that's at least 300M IPv4 addresses that IANA is sitting on for whichever reasons

Gilles

@TildalWave he's also posted several questions on Unix & Linux

the more we tell him that he doesn't understand what he's doing, the more he insists on exotic security theatre

TildalWave

@Gilles Well I don't even know where to start answering his questions, this latest one for example is so trivial to do I don't have words to describe it, it's ... well, what kids do with LEGOs... take a small block, assemble a few of these together... viola - a castle. And what in heaven's name is the question if C++ can do this? How do you answer that without being sarcastic even?

Gilles

Having seen your recent questions on IT Security and Unix & Linux, I can tell that you do not understand what you are doing. None of what you're trying to do makes any difference to the security of your system. I recommend that you stop trying for now, read a good book on security (such as Security Engineering), and re-read the answers that I and others wrote. You are trying to defend against an intruder with a lock on the door, under the assumption that the intruder has the house keys — that just doesn't work. — Gilles 39 secs ago

TildalWave

@Gilles Oh cheers for that! :)

Gilles

01:16

(To other readers: yes, there are processors that encrypt RAM on the fly. But Sulla isn't using one. You find this in some high-security embedded devices, not on servers. They are not relevant to the context of this question.) — Gilles 11 mins ago

@Gilles ty for introducing me to processors that encrypt ram! — Sulla 5 mins ago

:(

TildalWave

@Gilles I just shot my brains out reading this

Gilles

and I didn't even mention the Linux patch to keep keys in the processor cache, which could be relevant to some of his questions, but not to his overall security model (where the attacker has access to the persistent storage containing the keys anyway, so a RAM dump is overkill)

TildalWave

@Gilles Have you tried directing him to Steve Gibson's Research Corp.? He seems to be better fitted to troll there. He might even get answers he's hoping for :)

lynks

01:31

this is all very saddening

TildalWave

02:06

0

A: Can unencrypted keys & logins be kept out of program memory?

Apparently, there is a poor man's encrypted RAM. TRESOR Actually, the steps to install this on linux are easy as it seems to have already been done with ubuntu

You were saying? :)))

I don't want to open yet another can of worms here, but where do you plan on storing these encryption keys to later load them into CPU's internal cache memory? You're stuck in a loop here with this chain of questions, and none will provide security you're after on an untrusted box! Whatever you do, you'll return to this same vantage point, you're just taking it the longest way around of realizing this that I've ever witnessed. — TildalWave 33 secs ago

adding my 2 cents... man he's tiring

Terry Chia

@RoryA, @AviD Can either of you make the CTF room private?

@TildalWave I'm just ignoring him at this point.

Sad thing is that some of his questions actually have some merit.

TildalWave

02:23

@TerryChia Well yes but all of it together is an utter mess and he just resists in getting it he won't be able to do what he wants on some collocated standard box with some cheap provider he's been saying he'd like to host his solution on

@TerryChia why already? CTF is in 2 days

Terry Chia

@TildalWave No harm doing it slightly earlier in case we forget

@TildalWave I think the only plausible solution to his problems now is "Magic unicorns".

TildalWave

@TerryChia ah so we're done recruiting? I thought maybe we could get a few new hands in... I've been thinking of asking @HamZa if he stops by

You don't have encryption problems, what you've been describing in other questions related to this one, you have first and foremost trust problems. There's no encryption in the world that can enforce trust. While it may require less of it in certain schemes, we're only talking of eliminating trust in the middleman, not end points in a linear chain of trust. The only way to eliminate required trust in one of your end points is to not require it in the first place. You won't be able to do that, when basic premise is the end point is untrusted, and you insist in requiring it. — TildalWave 1 min ago

Terry Chia

@TildalWave Someone can always add people in if they are interested. They can always ask in here anyway.

But yeah, just a reminder for the mods. I don't care if they private it today or in 2 days really. :P

TildalWave

@TerryChia ah true, forgot that... it's late/early ;)

Terry Chia

@TildalWave Man you have the patience of a saint. You should run for mod in the next election.

TildalWave

02:39

@TerryChia I wish that was true actually... it might appear so, but that's mostly because I now only deal with as much as I can handle... becoming a mod means you have to deal with as much as others can't handle, which might be a bit too much for me, frankly ;)

Terry Chia

@TildalWave Then you can go all @AviD on them.

TBH the flag load on Sec.SE probably isn't bad.

It's just dealing with the one or two idiots once in a while.

Plus many of the recent closures aren't modhammers. Pretty nice actually.

TildalWave

@TerryChia hehehe that's the main seller for the position yup :) tho, I don't think mods we have can't handle it already and they do a good job too IMO... I think it's more worth paying attention to which users that do exhibit site self-evaluation skills should be better supported by our voting to finally reach 3k where they can help more on that front... yes, I'm thinking of @Xander here that I wish he was 3k user already, but there are some new ones too that seem quite down to Earth

@TildalWave woops, forgot @ on my last one. anyways, i totally agree that the central issue is trust, but it is my 1 true constraint. it looks like i'm at the near end of the practical rope, as i'm sure that i would not be able to program anything workable past tresor. it looks like i'll be playing keep away for a long time... — Sulla 12 mins ago

@lynks thought that ^ might cheer you up ;)

D3C4FF

05:57

@AviD Use a RasPi with XBMC and a usb HDD? Or is that not what you meant

@TildalWave Went well, it was only a short one, i had a nap, then got back into it. No SQLi but plenty of things that broke the application in the end.

I would have liked some more time to test and a wider scope, but oh well.

Back to trying to set up my newest firewall :P

Adnan

@D3C4FF What is it?

D3C4FF

@Adnan paloaltonetworks.com/products/platforms/PA-500.html

Adnan

06:14

@D3C4FF Oh yeah! We have a PA firewall, though I don't know which model. I hear they're pretty smart.

D3C4FF

@Adnan They're gangster :D

A bit pricey.

But they're solid

my only complaint, the UI is shit slow and making changes requires a 'comit' which takes between 5-20 minutes

._.

Adnan

I remember when our sysadmin was testing the SSL inspection

He deployed the fake certificates using Group Policy

Luckily I had Certificate Patrol installed on my browser

D3C4FF

@Adnan Yeah it does a pretty solid job at that, i'm quite fond of the traffic analysis

I haven't found a way around it, so i thought i'd buy one, try find a way

Adnan

@D3C4FF If you're whitelisting protocols, of course it's gonna be really difficult to bypass it, which is the case in most corporate environments.

D3C4FF

@Adnan Indeed. But usually tunneling applications works (like tor over HTTP/over bridges etc) but not with this thing

Adnan

06:24

@D3C4FF Yeah, after our discussion the other day, I played with our backup firewall. Turns out it looks inside the HTTP request, it sees that you're not exactly sending normal plaintext as the request's payload, so it flags the connection.

Luckily, it's against our policy to strip SSL traffic, and that SSL inspection was just a test by the sysadmin.

D3C4FF

@Adnan Clever hey? :P

@Adnan Yeah, very few compaines actually SSL intercept

Also, other PA drawback.

NOISY AS SHITTING BRICKS.

Adnan

@D3C4FF That's why you have a soundproof server room :D

D3C4FF

@Adnan Yeah, my warehouse doesn't yet have one of those... >_>

Adnan

@D3C4FF Indeed. Actually, since that day, I started working on a way to bypass it. I think it'd work, soon I'll start coding it with a friend.

D3C4FF

@Adnan Cool, let me know if you get around it! I keep bumping into them during pen-tests which gets annoying :P

AviD

06:33

@TerryChia hehe, did you just verb me? I think you just verbed me.

Though I admit I'm not sure what you meant. The only thing I can think of, would be better described as @ScottPack'ing them.

@TildalWave that is incredibly well put. Though to be honest there are enough mods, compared to the level of flag activity, that any one mod has plenty of backup.

@D3C4FF hehe.... surely those could also be shut off? or at least, have its power pulled.

@D3C4FF isn't that always the case?

@Adnan oh you poor naive little boy.

Adnan

@AviD What?

AviD

@Adnan s/which is the case/which should be the case/

D3C4FF

@AviD Solar Panels to backup-batteries?

They draw a pathetically small amount of power.

Adnan

@D3C4FF It's actually pretty simple. Let me know what you think about it.

D3C4FF

@Adnan Send me a link and i'll happily check it

Adnan

06:42

@D3C4FF You Bas64 the encrypted traffic, and you replace each pair of characters with a word from the English dictionary (2 or 3 chars), your tunnelling server would use the same lookup table and do the opposite. Those English words are sent as a payload in the HTTP request. That would create some overhead, but, nevertheless, it could possibly bypass it.

IMO, I don't think it would be possible for a firewall doing DPI to differentiate that from normal traffic.

I'm hoping to find a way to make that reusable. It could be added as a "plugin" to obfuscated-openssh for example.

D3C4FF

@Adnan But i reckon if it doesn't see a header of something it recognises, it'll drop it

But yes, i doubt it base64 decodes the traffic

D3C4FF

07:16

Zomg. Fibre channel switches and a stack of cables :D :D :D :D

Winning

And LC connectors!

Score.

Adnan

@D3C4FF ¿Inglés, señor?

D3C4FF

@Adnan Yo no hablo español.

I found a couple of these: upload.wikimedia.org/wikipedia/commons/0/0d/…

Adnan

@D3C4FF Sweet!

D3C4FF

Yeah :D

Less EM leaking out of MY building :P

less EMI as well i guess...

Terry Chia

07:34

@AviD Well, @Scott doesn't have mod powers. :P

So you are the closest fit.

Lucas Kauffman

@rorym can I talk to you about CREST?

Adnan

@LucasKauffman Oh, I'd love to know about that as well.

D3C4FF

08:07

Anyone here do boating?

Adnan

08:17

@D3C4FF Euphemism?

or actual boating?

D3C4FF

@Adnan Actual boating. On water, in boats.

Lucas Kauffman

@Polynomial have you done CREST?

also have you been sleeping lately?

Adnan

@D3C4FF Oh, then I'm of no use in this area. Every now and then I go fishing on a friend's boat, but that's as far as my experience goes.

D3C4FF

@Adnan I have questions about flares :P

Adnan

@D3C4FF Those rescue signal things?

D3C4FF

08:25

@Adnan Yeah, the ones people let off at the soccer etc.

Adnan

@D3C4FF What about them?

@D3C4FF I have some experience with tactical flares.

D3C4FF

Well, i wana know A) what happens when they 'expire' (how exactly do pyrotechnics expire??) and B) how can i dismantle them?

C) can i still used expired flares safely? (not for safety)

Adnan

@D3C4FF A) I have no idea. B) Here we send them to the city's boating club and, in turn, they send them to an official explosives disposal facility. C) I have used an expired flare gun (one and a half years out of date) and it worked normally. I wouldn't advise it though.

AviD

@TerryChia nyeah nyeah, @Scott's not mod, nyeah nyeah. :P

@Scott Seriously, man, sorry you didnt win on SF....

D3C4FF

@Adnan i don't want to dispose of, i want to dismantle just to see how they work :P

AviD

08:36

@Adnan gotta love the motorboats.

@Adnan B) is boring! just shoot them off....

D3C4FF

@AviD Exactly!

Adnan

@D3C4FF I hope you take that in the same friendly way I mean it. I appreciate curiosity, it is what makes us find new things, new solutions, it's just an amazing thing. This, however, is just stupid.

AviD

when I was in the army, they discovered that a whole lot of ordinance - tens of thousands of shells - were expiring. So we did an experiment.... IS it possible to level a mountain from 30 KM away??

@Adnan NOT if he does it while holding it in his teeth, its not!

D3C4FF

@Adnan Well, in Australia, there's not many legal pyrotechnics, they outlawed fireworks in all states a few years ago and now its extremely difficult. I'm curious to see if i can use the flares for anything else. Aside from that, i've got a fair amount of experience in both pyrotechnics and chemistry. Plus most of the required safety gear.

Hence why re-purposing expired flares would be of interest to me

@AviD Bit hard to do with a face-shield :P

Adnan

@AviD What kind of shells?

AviD

08:41

@Adnan 175 mm

Rory Alsop

@D3C4FF - I used to teach at a sailing school - what do you need to know?

D3C4FF

@AviD More importantly, what was the result :P

@RoryAlsop Well, i want to know what actually expires in a flare? Does it mean its unstable, or does it just mean it may/may not light?

What does expiry actually mean?

AviD

@D3C4FF yeah, actually it did go down a few cm, and the top of the mountain was not as round as it used to be....

oh yeah, and the terrorist base in the mountain was also evacuated. so there's that.

D3C4FF

@AviD Lulz. I would have like to do military service, but to much time required to do it :(

Rory Alsop

Hahaha - Not sure that is a boating question...reckon it's a pyrotechnics/explosives question, so @AviD may have much better experience than I

AviD

08:44

best non-classified pic I could find....

Rory Alsop

Realistically it is less likely to light, so presents a personal risk to you

Is that you @avid

Terry Chia

@RoryAlsop Is there anything you have not tried before?

D3C4FF

@RoryAlsop Yeah, if used in the context of personal safety?

AviD

@RoryAlsop of course you did. If there is any awesome activity, or extreme sport, not only did @Rory try it out, he damn well taught the stuff.

@RoryAlsop ha, no.... Bing Images....

Terry Chia

@AviD I guess being a hundred years old gives you plenty of time to try new stuff eh? ;)

AviD

08:46

@TerryChia @RoryAlsop is like the goddamn Highlander.

Rory Alsop

A million things still to do @Terry - but once you get to my age ... There has been time to try a lot. Plus, it helps having an ex-fighter pilot, polar explorer for a father. He encouraged all sorts of nonsense.

Lucas Kauffman

@RoryAlsop same here, I think I was the only kid who was encouraged by his parents to start skydiving at age 16

@RoryAlsop do you know about CREST :p?

Rory Alsop

Hahaha - yes, a bit. I was on the CREST board for a couple of years. More from an organisational perspective though - I wouldn't pass the exam. @rorym is the guy for that end of things.

AviD

@LucasKauffman I think he helped define it.

Lucas Kauffman

@RoryAlsop ah ideal, does CREST provide training or only an exam?

Rory Alsop

08:57

Oh, @D3C4FF - I removed your 'google it' comment. I agreed with it in principle, but it was snarky enough it got a 'rude' flag.

Lucas Kauffman

yea I'm going to ask away once RoryM arrives here

AviD

does it make sense to use an HSM for symmetric encryption / HMAC only? (no asymetric keypairs...)?

@RoryAlsop so did your "this is not a security question comment"... ;-)

sometimes a user just needs that extra bit of snark... especially when the answer which is a direct quote completely answers the question.

Rory Alsop

CREST itself provides the exam, but there are CREST-approved training courses, where the provider has been validated and the course meets requirements.

Lucas Kauffman

aha

Terry Chia

Ouch, 7 days timeline to push a fix for critical vulnerabilities. googleonlinesecurity.blogspot.ch/2013/05/…

Rory Alsop

08:58

@AviD - yes, I thought I'd leave that one rather than abuse my mod powers and dismiss it:-)

AviD

@RoryAlsop heh, it was pretty ridiculous. I would like to flag the flagger...

Rory Alsop

@Lucas - I think there is a list of approved providers on the website - crest-approved.org

AviD

@RoryAlsop isnt EY one of them...?

In Israel PWC is the CISSP representative...

Rory Alsop

Oh @AviD - did we decide my closing the crypto was a mistake?

Lucas Kauffman

@RoryAlsop ah nce

AviD

09:03

@RoryAlsop hmm, dunno. I saw @Gilles point, but I'm strongly ambivalent about it.

Rory Alsop

EY is an approved test company, yes. Not a training company.

Haha - strongly ambivalent

AviD

I probably would not have closed it, but dont feel strongly enough about it to reopen it.

Rory Alsop

@lucas - crest-approved.org/training_partners.html

AviD

I do think a historical lock would be a good halfway solution. I think closing is too final / about-to-be-deleted, and it really is content we should have here.

Lucas Kauffman

@RoryAlsop thanks will send them an email

AviD

09:06

@RoryAlsop yup, I'm doing that.

@LucasKauffman isnt CREST a UK-only thing...?

tylerl

amazon.com/Survival-Seed-Vault-Easy---grow/dp/B0051OA7QC

Think of children. Think of the children and buy a seed vault so you can plant a goddamn VICTORY GARDEN after the nuclear zombie winter apocolypse.

(just gonna leave that one right here...)

AviD

ohhh.... kaaaaay....

Terry Chia

@tylerl But does it play Crysis?

tylerl

hell if i know

but ... VICTORY. Also, PATRIOT. I think "guns" belongs in there somewhere too.

Lucas Kauffman

09:21

@AviD I think so, it's because we might have future engagements in the UK that they want a few testers here to be certified

Rory Alsop

And CREST in progress towards US, South Africa and other countries

Polynomial

to whoever asked, no I haven't done CREST

not yet anyway. it's on the cards for next year I think.

Rory Alsop

Will you get it sponsored through work?

Polynomial

yes.

Rory Alsop

Excellent

Polynomial

09:25

man I am so hung over :/

went to a Science Museum lates event last night as part of a Reddit LSC meetup

"The Science of Sexuality". Ended up mainly being a pub quiz and drinking session.

we were "Team 6oz Anus Beef Burger (Add Cheese For £1)"

Rory Alsop

@AviD - historical lock works for me. If you are on a pc can you do that? I am on a smartphone...

AviD

@RoryAlsop done did it.

Rory Alsop

Eeeeexcellent

(Insert pic of evil caterpillar here)

AviD

70

Q: Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to have these mistakes. The intent of this question is to identify and list what not to do with a gi...

cryptography encryption .net java

@Polynomial is that supposed to be "Anus Beef Burger".....??

or did you mean "Angus"....

Polynomial

it's supposed to be Anus.

AviD

09:30

and what IS an Anus Burger??

Polynomial

the menu had the Angus burger and we tweaked it.

and it became our team name

AviD

that is all kinds of horrible.

Polynomial

sadly we didn't win, so we didn't get to hear him read the team name out

Rory Alsop

But probably edible - it was on one of those celebrity jungle reality shows, I'm sure

Polynomial

ha

I don't want to know which creature has an anus that weighs 6oz.

D3C4FF

09:36

@RoryAlsop No issue :)

AviD

09:47

@Polynomial I've met some salesmen that would count.

s/has a/is a/

Lucas Kauffman

@Polynomial now you made me crave for a nice angus steak

AviD

@LucasKauffman anus steak.

NOBODY VOTE FOR @THOMAS! HE HAS A PERFECT PALINDROME!

Terry Chia

@AviD heh, your question had a downvote, fixed that for you. :P

AviD

huh? why would that get downvoted? Do people not like HSMs...??

but really, @TerryChia was there anything not clear in the q?

Terry Chia

@AviD nope, it's a good one. i think they probably mistook it for a product recommendation question.

AviD

09:55

I thought I made that very clear.

Terry Chia

@AviD Probably a TL;DR reaction.

AviD

hope I made it clearer now.

@TerryChia yeah? okay fine then. Didnt think it was long at all, except maybe for the examples...

D3C4FF

@AviD Its clear, but it is a pretty broad question... I'm curious to know the answers as well though :)

AviD

@TerryChia actually, it was probably a mis-click - it was corrected now to an upclick. yay for 5 rep!

@D3C4FF I think the scenario is broad (purposely so), but the question is very specific.

much like the other product evaluation questions, as we were discussing the other day...

Tinned_Tuna

@AviD, it's not perfect; the comma is off-centre.

D3C4FF

10:04

@AviD Nope that was my extra upvote. Someone un-downvoted your question :P

Tinned_Tuna

he needs 833,338 really...

AviD

@Tinned_Tuna hehe... I was looking at it numerically only, of course...

D3C4FF

@Tinned_Tuna Agreed.

AviD

casted it automatically to an int.

Though for @Thomas's case, we should probably use a long.

Tinned_Tuna

Owch, type unsafety. Not a good look ;-)

AviD

10:06

damn, somebody upvoted him. Well, maybe he'll be tempted to come back and answer my HSM question.

Polynomial

10:19

@AviD or a long long if you wanna be ANSI about it ;)

AviD

@Polynomial then I would go for System.Int64. Why would you assume I was in C?

Polynomial

I didn't assume, I mandated!

AviD

C# > C++ !!

... given the right set of circumstances and scenarios, of course.

Tinned_Tuna

meh, just java.lang.Long :-p

Terry Chia

@AviD Javascript >>>> all. Bow before the hipsters.

AviD

10:25

@TerryChia only if it's on the server.

or was that a double-bitwise-shift?

Terry Chia

@AviD heh.

Rory Alsop

@rorym - did you see this article on ror attacks: rss.feedsportal.com/c/32569/f/491736/s/2c8f2399/l/…

Adnan

@AviD Knitting needle > C7 assault rifle. Given the right set of circumstances and scenarios

AviD

10:41

@Adnan haha, okaaaaay....

way to be completely objective, there.

Adnan

@AviD So I've actually started setting up my new Laptop

AviD

with a knitting needle??

Adnan

@AviD Windows 7 setup presented me with 4 language choices. Finnish, Swedish, English, and Hebrew.

I didn't know that Hebrew is famous up in the North

AviD

@Adnan why 7?

@Adnan huh. that IS odd.

Adnan

@AviD Indeed. I was a bit surprised.

AviD

10:43

unless it was pirated by an Israeli....

I assume you went for the hebrew option?

Adnan

@AviD Well, I can pronounce the letters, but I have no idea what they mean.

AviD

yknow its not just language - everything is right-to-left, instead of left-to-right.

Adnan

@AviD I know I know.

AviD

at least I dont htink they do anymore what Win98 did - even the X button was on the left, and start button on the right.... I hated that.

@Adnan you should get a tattoo.

Adnan

@AviD Not a big a fan.

@AviD Even the freaking Desktop icons are inverted.

AviD

10:49

too much for me.

Adnan

10:59

I really wanna know, what does Jenny do?

0

Q: Does Chrome OS Allow Executable Files?

My company has some real security issues and I am wondering if using Chrome OS can be some solution to my problem. Typical Windows computers seems all to vulnerable to attacks from malicious images and websites which download keylogger software and remote access systems. From my understanding, ...

windows malware antimalware chrome

Polynomial

@Adnan No idea.

I think it's a pretty interesting question though. Not for its intent, but for its implications.

It's foraging into the realms of security on non-general-purpose computers.

Adnan

@Polynomial Looking at her questions, I'm afraid she's the security person in her company.

This is really scary.

Polynomial

She might be responsible for security. Doesn't mean she's a security professional.

That's a common thing in many businesses. Get the sysadmin to do security.

Terry Chia

@Adnan Does Chrome OS uses a linux kernel? Interesting. Didn't know that and was too lazy to google it. :P

Adnan

@TerryChia Yup. You can install Bash, write scripts, run executables, and pretty much anything you want.

@Terry You need to jailbreak (yes, jailbreak) it to install Bash, but I'm not sure if jailbreak is needed to run executables

AviD

11:14

@Polynomial or the office manager.

@Adnan I am more curious, how in hell are those desktops configured, that they allow any random website to download keylogger software and remote access systems??

(I assume she meant also install, not just download a file... )

Adnan

@AviD She has no idea what she's talking about. Just check her other questions. She probably heard about some evil image malware and now she's freaking out.

Adnan

11:34

I found that if you wanna get an answer upvoted, just downvote it.

Terry Chia

@Adnan Interesting..

@Adnan STOP GAMING THE SYSTEM DAMMIT!

3

Adnan

I disrespect counter voting.

Jesus Christ!! Again with the infected Facebook images!

Very helpful, thanks. We have some issues where our team uses Facebook (we are a small social media company). When visiting some Facebook Pages, infected images are loaded and viruses downloaded to the computers. If my team uses virtual machines access Facebook, resenting to an image after each use, could this help combat the attacks? We run political pages which are being attacked intentionally. — Jenny 31 secs ago

@Lucas Is that an SSL setup?

If yes, then what logs are you talking about? Any proxies/reverse proxies between the user and the server cannot even see the GET parameters to log them. The only places where the token is logged is on the two ends of the SSL connection.

Logged on the user's end (History, for example) happens after the link is clicked. Logging on the server's end carries no risk (if you don't trust the place where the SSL traffic is decrypted, then there are bigger problems)

Gilles

11:55

what encrypted swap did you go with? is the swap a ram drive? what do you think of cryptkeeper? — Sulla 8 hours ago

is the swap a ram drive?

IS THE SWAP A RAM DRIVE?

2

security isn't the only thing this guy is out of his depth about

AviD

@Adnan usually, if you have a reverse proxy, thats where you will be terminating the TLS...

@Gilles but how awesome would that be??

Adnan

@AviD Usually, that reverse proxy either belongs to you or to an entity you trust.

@AviD Else, why would you use SSL then anyway?

AviD

oh of course, I agree about that part. I was just nitpicking.

Adnan

Checking your kid's laptop to find some really sick porn, then you ask him/her about it. They tell you "Uhh ummm.. I was on Facebook.. then ummm.. I opened some page.. and some infected image was loaded, then the virus installed that porn"

Then you come to Sec.SE and ask about it

Here's something interesting. After the first boot, I noticed that I cannot find IE icon anywhere, then suddenly a window opened, telling me to choose a browser to install.

Nice to see Microsoft obeying EU laws.

Terry Chia

12:13

@Adnan heh. they got fined a while back from delaying it's implementation iirc.

Lucas Kauffman

12:24

@Adnan I ask questions like that because I prefer to be safe than sorry

Adnan

@LucasKauffman I must've explained incorrectly. I didn't mean you shouldn't ask the question, I just expressed my discomfort telling you that. Because usually it's the other way around, I ask you guys and you have the answers.

Terry Chia

@Adnan hey don't think like that! you are awesome!

Unlike @AviD.

:P

Adnan

@TerryChia We're all awesome.

Terry Chia

@AviD You just got some Bear knowledge on your HSM question.

Xander

12:49

@Adnan A three-quarters of a billion dollar fine tends to inspire a compliant spirit.

Adnan

@TerryChia I guess now @Lucas is upset.

You need to send him some bewbies

Terry Chia

@Adnan Sure.

@LucasKauffman encrypted-tbn3.gstatic.com/…

Adnan

@TerryChia Jesus Christ!!

Lucas Kauffman

@TerryChia EEW EEW EEW

NSFW!

Terry Chia

@LucasKauffman That's why it isn't oneboxed. :P

AviD

12:55

@Adnan EU laws are stoopid.

Adnan

@LucasKauffman Not safe for anything!

Scott Pack

@AviD wut?

Terry Chia

But yeah.. that was the first image that came out when I google "Man boobs".

Scott Pack

@TerryChia He's rather furry.

Lucas Kauffman

@TerryChia why in GOD's name

AviD

12:56

@TerryChia oo, gonn' go read it all up now.

Adnan

@TerryChia At least your link was HTTPS

Lucas Kauffman

would you google man boobs?

Terry Chia

@AviD Hey don't say that. Think of how much money they made going after American companies for random stuff?

@LucasKauffman It's all @Adnan's fault! He said you wanted boobs! :P

Tinned_Tuna

Bah, found vulnerability in a company's systems, disclosed to them and was asked not to write it up even once it's fixed. Where's the fun in that? :-p

AviD

@TerryChia ... that doesnt even make sense.

Adnan

12:57

@AviD I disagree. At least I can safely use an ATM.

AviD

to be fair, the US DoJ also did the same thing, even though it was blatantly illegal.

@Adnan oh yeah, actually that is awesome. Even if the law is poorly implemented and defined.

Adnan

@TerryChia The breasts he likes, not the one ones you like.

AviD

@Tinned_Tuna the fun is in writing it up anyway. "asked", right? maybe try to keep it vaguely anonymous.

Adnan

@AviD Yeah, there's no way they'd suspect him.

Terry Chia

0

Q: Router password vs MAC filtering?

I just bought a Galaxy S4, and it didn't connect to the WIFI in my house (I have a 14$ router). After a bit of testing, I've decided to leave my connection open without a password, but added the devices manually to the whitelisted MAC addresses. Is that safer than having a regular password, th...

passwords access-control routing mac-address

Cute.

Tinned_Tuna

12:59

maybe, but still, I'd rather stay on their good side :-p

Adnan

@TerryChia I want to answer it, but..

Transcript for