The DMZ

Adnan

01:00

Adnan.keepAlive();

Simon

01:36

System.gc(Adnan);

Oh my god, I just logged into my bank account with this chat open. There goes my money.

Adnan

02:26

@Simon I think this will happen very soon

Simon

@Adnan AKA you're gonna go to bed? Hehe

Adnan

@Simon I don't have a bed here. I think I'll stay up until the lunch break (in 6 hours) and then just go home to get some sleep.

Simon

@Adnan Are you at work?

Adnan

@Simon yup

Simon

@Adnan Pulled an all-nighter?

Adnan

02:33

@Simon Yes. The second in a row.

Simon

@Adnan Damn, hello paycheck.

Adnan

02:54

@Simon 50% of the power keeping me up comes from that thought.

D3C4FF

@Adnan Whats the other 50%?

BDSM fetish?

Adnan

@D3C4FF I kind of like the company and like the project manager. A word was given to the customer, and I must finish before the deadline.

Adnan

03:14

@D3C4FF For that, you need to Google Image "vihta". It's the Finnish justification for BDSM in the sauna.

Simon

@Adnan What's your position in the company?

Adnan

@Simon Well, that's kind of a difficult question. The official title should be Software Developer

But that title would both overstate my programming abilities and understate my other-stuff abilities.

Simon

03:41

@Adnan Nice, it does sound like a great title though.

Stack Exchange

04:02

Xander

05:59

C'mon now, it's Monday morning for most of you guys. When does this place wake up?

Adnan

@Xander A better question is when does Adnan sleep.

Xander

@Adnan The answer would seem to be: not frequently or for long, at least as of late. :-)

Adnan

@Xander I'm really planning to continue the same streak and see how long I can stay up. It'd be interesting.

I'm mainly interested in my breaking point. When will I just collapse?

Xander

@Adnan I did that when I was younger. In college, and again in my late 20s. It's definitely worth it, as an experiment, but I'm too old for that kind of fun now. You'll have to report back with your findings.

Oh, and don't die. gamespot.com/news/gamer-dies-after-diablo-iii-marathon-6387472

Adnan

06:17

@Xander So how long did you last?

Xander

@Adnan It's been too long, so don't recall exactly, but the last time I tried it, it was around 50 hours. I was writing code the whole time. My primary take away was that even if you can stay away for that long, you can't write good code.

Adnan

@Xander Well, that won't be a problem for me. I can't write good code anyway.

Xander

Oh, and you smell bad. At least I do. I stunk like a dead horse after setting at a desk for two days straight.

Thankfully, I was single and working from home at the time, so there was nobody around to care.

ManishEarth

Btw, CTF solutions are up

6

Q: DEF CON CTF 2013 qualifiers: 15–17 June

DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 UTC, and will last 48 hours until Sunday, 17th of June at 00:00 UTC (so midnight to midnight throughout the weekend). Web stuff won’t just be simple baby’s first SQLi this time. It’ll be hard, it’ll be related to r...

@Adnan Y U NO CTF?

Adnan

@ManishEarth A- I suck, B- Absolutely no time. The little free time that I get I use it for food, sleep, and sex.

D3C4FF

06:46

@Adnan Why dont you just penetrate computer systems instead?

Will penetrate for food

ManishEarth

@Adnan I can say with authority that I suck more: I still solved 1 challenge on my own and 2 more in collaboration

AviD

07:14

@Adnan that's what she wanted to know.

@Adnan you should look into the uberman cycle, or at least some form of polyphasic sleep schedule.

Polyphasic sleep

Polyphasic sleep, a term coined by early 20th-century psychologist J.S. Szymanski, refers to the practice of sleeping multiple times in a 24-hour period—usually more than two, in contrast to biphasic sleep (twice per day) or monophasic sleep (once per day). It does not imply any particular sleep schedule. The circadian rhythm disorder known as irregular sleep-wake syndrome is an example of polyphasic sleep in humans. Polyphasic sleep is common in many animals, and is believed to be the ancestral sleep state. The term polyphasic sleep is also used by an online community that experiments with...

if you have to stay up, at least take 20minute naps every few hours.

and dont try driving...

D3C4FF

@AviD Seconded :)

Xander

07:38

@AviD Spam flagged.

-1

A: What servers or clients are immune to related-domain cookie attacks? (*.example.com)

Domain name is something that helps in searching a website. It is a way to reach to website. Domain name is something that helps in making a website popular. Website plays a very important role in business these days. Without website it is impossible to reach out to the world. Website can be sear...

AviD

@Xander spam handled.

Xander

@AviD Thank you sir. That's what I call speedy service. :-)

AviD

@Xander thaaaaat's what she said. Dammit.

Xander

@AviD LOL...I suspected that might be on it's way.

AviD

@Xander that's what she said!!

Xander

07:41

@AviD Fixed it. ;-)

AviD

lol, thanks, make me look like an idiot ;-)

I thought we were going to go on like this for a while... I feel like it ended prematurely.

;-)

Xander

@AviD Hey, I used the wrong form of "its" in my haste, so I look like just as big an idiot

AviD

hahaha

Xander

@AviD That's what she said!

All right, there you go. ;-)

Lucas Kauffman

08:21

Woop woop wind tunnel time

AviD

08:45

what do turtles eat?

been hearing some noises out back.... turns out a turtle come to visit, been scratching at the back door. Now its hiding behind the hose.

real wildlife here, eh...

►

Rory Alsop

11:54

Possibly afternoon - I've been De-synced ask weekend

Morning all. I'm back!

ManishEarth

@RoryAlsop y u no ctf!

Also, welcome back!

Terry Chia

@RoryAlsop How many pings did you have? :P

Antony Vennard

12:13

Hello.

Rory Alsop

12:48

Many. Many. Many pings.

No ctf because I was watching QotSA, Alice in Chains, Rammstein, UFO, Nekrogoblikon, Turisas, Mastodon, Iron Maiden... and many more

@Poly - you would definitely enjoy Nekrogoblikon!

Terry Chia

@RoryAlsop I think about half of it is that jerk @AviD dissing your age.

Simon

Morning gents.

Hennes

Good afternoon Simon

Also, no gals here. Or was that a "gents (m/f)" :-)

Terry Chia

@Hennes No girls here except for @Iszi.

Simon

I got lazy, I usually type ladies & gents.

Hennes

12:57

That is just wrong. I realise that we might not get a 50/50 divide, ut with 10 active people there should be a few.

otoh, it might be wise for those to pretend to be guys since the internet has lots of stupid people.

Ladadadada

Are we going to have to send Scott Pack around to test everyone?

Simon

I don't know but he's definitely the right person to do it.

Terry Chia

@Ladadadada I think we are going to need SE to sponsor the air tickets. Some of us live pretty far apart.

Maybe make a meta.SO question about it?

ManishEarth

@TerryChia meta.SecSE

Blog - Stack Exchange: Supporting Community Conferences

Jeff Atwood on August 03, 2011

One fun way to promote your community is to consider what upcoming conferences, seminars, conventions, events, or meetups appeal to your community and represent an opportunity to attract new, high quality users who love this stuff as much as we do!

There are a bunch of ways the community team can support your events; to date we’ve done the following.

One simple method of promoting your community is to have a one-page color flyer available to hand out to interested folks at events. We’ve created a few of these already, both for public sites and for beta sites: …

Terry Chia

@ManishEarth That can work.

Do our site moderators agree? @AviD @RoryAlsop @JeffF.

ManishEarth

13:08

And poke mods to ping comm team

What conf is this?

Terry Chia

8 mins ago, by Ladadadada

Are we going to have to send Scott Pack around to test everyone?

Oh cmon, you thought I was serious?

ManishEarth

I didn't know what you folks were talking about :P

I thought it was a conference

oops :P

AviD

@ManishEarth Gender Verification Party! Bring your PGP keys!

ManishEarth

lol

AviD

wotcha @RoryA

you read all those pings already?

@TerryChia hey, 4 years is a big deal! Or something like that...

Simon

13:12

@AviD Are you from Tennessee? 'Cause you're the only ten I see.

AviD

@Simon ouch.

Terry Chia

@AviD I think I'm gonna put together an answer for the meme's question. Any idea when it originated?

AviD

@TerryChia what?

Terry Chia

@AviD @RoryAlsop's age.

Simon

@AviD One day, I will use this pick-up line for real.

AviD

13:14

@TerryChia loooooong time ago. isnt there a memeanswer there already?

Terry Chia

@AviD Not specifically about the age part.

Simon

@AviD Of course it was a long time ago, he's old...

Scott Pack

G'day Bruces and Sheilas.

AviD

@Bruce!

Simon

Morning Americano.

Scott Pack

13:18

Shush you! I am not watered down espresso.

Simon

@ScottPack You're definitely the right man to check out the gender of SE members.

Scott Pack

So's your face?

TildalWave

6

Q: DEF CON CTF 2013 qualifiers: 15–17 June (ended, including write-ups!)

DEF CON CTF 2013 qualifiers will start on Saturday, 15th of June 2013 at 00:00 UTC, and will last 48 hours until Sunday, 17th of June at 00:00 UTC (so midnight to midnight throughout the weekend). Web stuff won’t just be simple baby’s first SQLi this time. It’ll be hard, it’ll be related to r...

discussion ctf

if anyone is interested in write-ups ;)

ManishEarth

I'm interested in the RE ones

Already read yours :P

Simon

@ScottPack Why do you always have to hurt my feelings?

TildalWave

13:24

@Simon didn't follow, but that's relatively redundant question for @ScottPack :P

Terry Chia

There ya go:

0

A: The Memes of IT Security

Meme: @RoryAlsop's age. Originator: @RoryAlsop. He was here before any of us. Cultural Height: 1391 BCE Background: @RoryAlsop is one of the older guys that hangs out in The DMZ. Some of the younger guys started making fun of his age especially when he started reminiscing about the good old d...

Scott Pack

@Simon I'm sorry baby. I only hurt you cuz I'm afraid of losing you.

TildalWave

@TerryChia there's quite some memes missing there, wanna add a few? or should we make a new post on memes of DMZ?

Terry Chia

@TildalWave Just add them to the question. :P

Simon

@ScottPack <3

Terry Chia

13:26

I think "Mellon" just about qualifies.

TildalWave

@ScottPack That's so John Lennon-ish of you

AviD

@Simon did he... press your buttons? ;-)

2

Scott Pack

@TildalWave More Bobby Brown

AviD

@TerryChia dammit, half that post was my comments... ;-)

TildalWave

@ScottPack Oh, thought it's the Jealous Guy in you :)

AviD

13:27

(most of them stolen from carlin)

Terry Chia

@AviD I had to document them somewhere. ;)

Simon

@AviD Awwwwww yeaaaaaaah

TildalWave

@TerryChia c'mon I had some good ones for that too

Terry Chia

@TildalWave Add them in. ;)

Rory Alsop

They have been rather good. They got me over to SF for b-sides and RSA in 2011. Not sure whether they'd do that for Scott to gender-check everyone. I think we work more on the Web of Trust idea. I can verify other Rorys, @poly, @avid and a couple of others, @rorym has a couple more. In time I'm sure we can validate the entire community (getting everyone with a Rory number of 4 or less would be cool)

TildalWave

13:30

@TerryChia when I find some LOL

Scott Pack

Does the Rory matter when calculating one's Rory number?

Terry Chia

@ScottPack The Rory always matters.

Scott Pack

Because, frankly, I don't care which Rory buys me a Manhattan.

TildalWave

13:43

@TerryChia added I few I could find, only one of mine tho

I like that tag link... 0 questions tagged older than @RoryAlsop :))

AviD

yknow, at some point @RoryAlsop will get fed up with these types of jokes.

And then @RoryAlsop will get out of his rocking chair and chase us with his walking stick.

5

ManishEarth

►

Y'all have prolly already seen this, though

Terry Chia

@ManishEarth Yup. :)

Hennes

Heh, I am still doing my baby first steps.
Trying to figure out how cache poisoning works with HTTP splitting.

Rory Alsop

@scott - you're on.

@avid - nah, by that stage I'll have a servant to do that for me:-)

AviD

13:58

@Hennes oh yeah, thats not as simple as most web attacks.

Hennes

It is the second lesson in webgoat.

AviD

I've noticed that the bit that often gets left out, and thus confuses, is that whereas the usual layout is victim -> webserver <- attacker, with HRS you need to remember that there is a proxy in between, and that is where the attack is mounted.

(or rather, between the proxy and the webserver.)

Hennes

Yeah. I did not figure that out yesterday after midnight.

owasp.org/index.php/Cache_Poisoning

AviD

it is a very indirected attack, it does require some abstract level of thinking.

Hennes

As I understand it (possibly wrong!):
1) Clear the cache in the proxy (pagma: nocache)
2) Request a document using http splitting to insert a last modified in the future
proxy remembers the last modified in the future

then do something with a 304 not changed

AviD

14:05

well, yeah kinda, but you skipped over the actual splitting part.

point is, attacker requests page from a.com, splits it so that the bage from b.com is cached on the proxy for a.com. the last-modified is just details.

Hennes

(URI encoded ofcourse)

Somevalue%0A%0D%0AContent-Length%3A%200%0A%0AHTTP%2F1.1%20200%20OK%0ALast-Modified%3A%20Mon%2C%2027%20Oct%202070%2012%3A00%3A00%20GMT%0AContent-Type%3A%20text%2Fhtml%0AContent-Length%3A%2034%0A%0A%3Chtml%3EPage%20from%20the%20future%3C%2Fhtml%3E

SomevalueBR
Content-Length: 0

HTTP/1.1 200 OK
Last-Modified: Mon, 27 Oct 2070 12:00:00 GMT
Content-Type: text/html
Content-Length: 34

<html>Page from the future</html>

AviD

from then on, whenever someone requests a.com, the b.com is fetched from cache.

Hennes

I am sending this value as a language selection in an unvereified input field:

AviD

gorrammit. Does anyone here have experience configuring AD CertServices?

specifially autoenrollment.

Simon

0

Q: is it possible to sniff email content inside network?

I am working in a IT company.I am using LAN for all internet activities.I send some email from my personal gmail account .My network administrator sniffed all email i send from LAN and he shows the email to me. I am sure no software installed my system and i used https to send email.How network a...

email sniffer

It has to be a software installed on the system, right?

TildalWave

14:27

@Hennes not sure if that was intended for me, but with cache poisoning I usually wonder the opposite... cache is extremely difficult to invalidate properly, if the requests/responses are structured... I was working on my code (to cache stuff, not to abuse it) probably for half a year on and off, and I'm still not sure it's always safe

I mean sure it's easy to invalidate it safe... you just don't use it much then :)

Simon

@Adnan If I had a million dollars, I'd buy your love.

I love your answer.

Scott Pack

14:47

@RoryAlsop I missed International Rory Day! I'm so very sorry. :(

Rory Alsop

14:57

@scott ;-p

Scott Pack

I just realized what day today was.

ManishEarth

Do @Rory and @Rory share a birthday?

Simon

@RoryAlsop You owned Subaru's and never blew-up an engine?

ManishEarth

(today?)

wait I prolly can find out myself

Huh, they don't

Antony Vennard

@ScottPack There's an international Rory day?

ManishEarth

15:01

@RoryAlsop happy birthday btw :)

Scott Pack

@AntonyVennard Of course. How else can we appropriately extol the virtues of our Scottish Overlords.

5

ManishEarth

@AntonyVennard Apparently @RoryAlsop's birthday is International Rory day

Terry Chia

@RoryAlsop Damn, happy birthday! You are what, 900 this year?

Antony Vennard

When 900 years old you are, look as good, you will not (Yoda)

Simon

@TerryChia That was last year.

Antony Vennard

15:03

►

Terry Chia

@AntonyVennard Cmon, do you really need to attribute that quote?

ManishEarth

Rory Alsop, Scotland, United Kingdom

2k 7 21

astronomy planets rocket sun gravity moon earth

Check his age

Antony Vennard

@TerryChia Yes. For some people (Rory), Yoda is one of those newfangled ideas us youth have.

Terry Chia

@ManishEarth hehe

@AntonyVennard Nah, I think they grew up together.

ManishEarth

System doesn't seem fond of him :P

Rory Alsop

15:07

Never blew up an engine @simon. Clutches, brakes, yes, but the engines are sold up to about 500bhp. They only get flaky above that, or with NOx

And thanks guys- yes, am officially the answer to life the universe and everything! Just for traditions sake I wore the same leather jacket I wore on my 21st birthday, when I went to see Guns n Roses, Soundgarden and Faith No More.

Simon

@RoryAlsop I see. Every single STi/WRX here seems to not go past 200k km. I'm still looking to buy a 2.5 RS but I'm not sure if I should get one with ~180k km. I'll definitely get a compression and a leakdown test though.

Rory Alsop

@Terry - the cheek of you youngsters. Tut

Scott Pack

@RoryAlsop You're all hot for Empeg, right?

Antony Vennard

@RoryAlsop Happy Birthday!

TildalWave

@Polymorphin I'm unaware of any equivalent addon for Google Chrome. Perhaps others know something. — Adnan 24 mins ago

@Adnan - I've been searching for something similar for Chrome just a good week ago - no luck :(

@RoryAlsop hehe good old days eh? Happy birthday!

Scott Pack

15:19

Incidentally: blog.feedly.com/2013/06/17/…

TildalWave

@Adnan - If you don't mind, that end of first paragraph is IMO a bit awkwardly written. Most commonly such transparent proxies / routers / whatever would still serve perfectly legitimate pages, just replacing the certificate to make whatever they're intended to do actually doable... but sure, you wouldn't know if it's also replacing something else than just certificates

Rory Alsop

@simon - where you based? In UK try Litchfield in the Midlands. That's where I got my slightly silly forester sti.

Simon

@RoryAlsop Canada :P

Rory Alsop

@scott - Oh yes. You know it? Best car stereo yet invented.

Scott Pack

@RoryAlsop A co-worker wants what amounts to be a Android based stereo/media server for his car. Empeg was the only thing I could really think of that was similar.

Rory Alsop

15:25

Well, it's a full featured debian, but yeah. Empegbbs.com is the place to go - there is a for sale section on the board

I have the now - one on SSDs, one for my office and one with two half terabyte drives for my main collection

@simon - dunno what the import market is like there:-)

Simon

@RoryAlsop I should be able to get a semi-clean one with ~180k km for 4k. But I really hope the motor won't blow up after a few months. I'd love to do some snow lapping this winter.

Rory Alsop

Yeah. Check the turbo and head gasket for signs of being abused. And look at the service history for clutch replacements, possibly expect two replacements by that age.

Terry Chia

@ScottPack Thanks for the heads up.

Simon

@RoryAlsop 2.5 RS is N/A so I'm fine. I don't really wanna get a turbo because I bet it's gonna end up costing a lot. Head gasket is definitely their prime weakness. 2 clutch replacements? I didn't know that, thanks.

Rory Alsop

Certainly up until the 05 or 06 you'd expect a replacement between 75 and 95k. The clutch is really only weak spot.

They got updated a bit more recently

Most of mine have been turbos. It is quite cheap to get 500bhp with a turbo

Simon

15:38

I'm aiming for the 04-05 model so I'll definitely need to look into that. I'd rather get a clutch job done than a tranny/engine one though.

Don't you need to forge the engine at like 400?

Oh, brake horsepower, probably even less than 400, no?

AviD

only thing worse than when nothing works and you don't have a clue why, is when all of a sudden everything starts to work again but you don't have a clue why.

not worse, better.

Rory Alsop

@simon, no. The engine block itself needs nothing at that level. To go from 300 to 400 is mostly ECU, inlet and exhaust flow

Scott Pack

@AviD I think that depends heavily on what's counting on you getting it working.

AviD

@ScottPack yeah, exactly. on the one hand - if it aint broke, dont fix it.

Simon

@RoryAlsop Man, 500 bhp on an AWD is serious business.

AviD

15:42

on the other hand, since you dont know why it started working right, you dont really know it aint broke, but you dont want to break it again.

Scott Pack

@AviD It's a rather unsettling feeling.

Rory Alsop

@simon - mine still has a small way to go before I hit 500, but I like the fact it is still my daily commute and can take the whole family camping off road:-)

@avid - agreed. Need root cause to be confident it is fixed

Simon

@RoryAlsop Gotta love Subaru :)

@RoryAlsop Any maintenance I should do as soon as I get it? So far in my list I have: oil change, spark plugs, fuel filter. Maybe a coolant flush?

Rory Alsop

16:06

They will be the main engine ones. Would get a good look at brakes and shocks (sti shocks can get a bit worn) and maybe check strut brace points

Simon

Ok, thanks.

There's a 02 with 230k kms for sale for 2.9k. It might be suicidal to get one with that many kms though.

Rory Alsop

Take it for a good hoon anyway. See how solid it feels. I recently sold my old 00 with 180k on it for a few hundred quid. Structurally it was fine, it just needed a couple of grand to replace all the worn bits, so you may find it could be okay. Check everything on it though:-)

Simon

16:23

@RoryAlsop Definitely. There's a tuning shop not too far away from where I live that specializes in Subarus. I've been there a few times with a friend of mine who has a tuned 2011 STi and they know their stuff. I'd get it inspected there.

Lucas Kauffman

16:41

fucks sake think I bruised a rib

Rory Alsop

You weren't down the front at Rammstein too were you @Lucas?

Lucas Kauffman

@RoryAlsop nope I was at 3500 ft when my canopy decided to decelerate me from 136 mph to 20 in 0.5 of a second :(

(normally this takes up to 5 seconds)

Rory Alsop

Oooooof

Lucas Kauffman

that's what I said

Rory Alsop

That slows down the opening

How come it went so fast, thought you had that regulator thing

Lucas Kauffman

16:56

don't know, maybe I didn't decelerate enough before opening, I've had it once before

that took out my shoulder for 4 weeks

I packed it myself and didn't do it any different than normally

Scott Pack

@LucasKauffman Too bad it was the canopy and not the platform.

Lucas Kauffman

@ScottPack I love you too.

yesterday, by AviD

Everyone here would do well to remember the 1st rule of StackExchange: BE NICE.

Scott Pack

How was that not nice?

And when have I ever been not nice outside of chat?

I CALL SHENANIGANS!

Lucas Kauffman

17:12

@ScottPack I have not met you out of chat

Rory Alsop

We're folks being not nice while I was AFK? Willlook at transcript once back home. Only another hour or so on trains. ..

Scott Pack

@RoryAlsop I think @LucasKauffman was whining about my sudden stop comment. I think he's just missed me.

Simon

One does not simply miss @ScottPack.

Scott Pack

Here you go. Now try again.

memegenerator.net/One-Does-Not-Simply-A

Simon

3

Scott Pack

17:24

Better

Rory Alsop

17:40

Lovely:-)

David

18:09

Woo, my last week of work!

Simon

18:20

Yesterday, I received my new credit card because my other one expired. I was so happy when I saw the PayPass icon on it, woohoo! Sigh.

Jeff Ferland

@RoryAlsop You have a 500 bhp car? ^.^

That explains the speeding tickets.

Hey, anybody coming to DEFCON this year?

4

Rory McCune

18:57

wow, so this is possibly the worst piece of security I've ever seen. There's a hosting panel application called zamfoo (commercial software) which to upgrade, you go to an unencrypted form on their website, fill in your root credentials for your server and they login and upgrade it! zamfoo.com/updatezamfoo is the form

Simon

We do not store any passwords, account or host information and this code set is checked on a daily basis for any potential compromises.

See, it's really secure!

Xander

@RoryMcCune Yeah, that's crazy.

Rory McCune

yeah that and I saw that page from this thread webhostingtalk.com/showthread.php?t=1275572 where the vendor threatens security researchers who were trying to help him

amazing that people like that can make money off software

Hennes

@David Heh. I am counting down to an interview and hopefully my first day of work. (well, first in a while, not first ever). Now at T -42h

Simon

@RoryMcCune Do you agree with what the OP is doing? (Releasing vulnerabilities to the public)

Rory McCune

19:08

@Simon well he seems to be following fairly responsible disclosure procedures (and indeed by the end of the thread hadn't released it from what I read someone else found the vuln.)

ideally I'd say that researchers should never have to release PoC's, vendors should fix things in a reasonable time

unfortunately where vendors choose not do do that experience has shown that PoC's speed things up

Simon

@RoryMcCune True. I've only gone through the first 2 pages so far.

Rory McCune

so unltimately there's a fine balance which gets called "responsible disclosure"

Simon

He probably got scared of the lawsuit.

Rory McCune

I've heard that Google have recently moved to a 7 day model for releasing things they find.

@Simon possibly but I doubt it, vulnerability/PoC disclosure is protected as far as I understand it, there's not been a successful prosecution for it that I'm aware of.

otherwise the metasploit guys would be in a lot of trouble :)

Simon

@RoryMcCune I see. But to make sure I understood correctly: if an application mentions that you cannot conduct any tests, wouldn't the PoC make it illegal?

Rory McCune

19:15

@Simon well it could be a breach of Terms of Use, so they could revoke your license but I doubt it's a criminal offence...

Simon

@RoryMcCune Interesting, thanks.

David

@Hennes nice

i'm only part time, so its just 3 days (15 hours)

Hennes

I am on sabatical (for 2 years now, I intended 1 year)

But getting a fun new job is hard these days

However I seem to have found two. The T-42h hours in the 3rd interview with one.

The week after I got a second interview as junior security consoltent job

Which is stuff I am not yet good in.

Hence the 3-6 hours / day behind webgoat.

David

hehe

consultant* =P

Rory Alsop

@jefff - I don't use it to go very fast unless I am on a track. But it gets to speed very very quickly. It's motorbike quick acceleration. And it isn't 500bhp yet...

David

19:21

might wanna make sure thats spelled right on your resume @Hennes ;)

Rory McCune

@simon BTW from reddit.com/r/netsec/comments/1ggu3p/… apparently the 'exploit' is GET /cgi-bin/zamfoo/blah?date=this_runs_as_root

Simon

@RoryMcCune That's it? Oh god...

Rory McCune

@Simon sounds like it, if that's true I can see why the researchers were so annoyed at him not fixing it

that's pretty trivial..

Hennes

I know. I used to call them insultants

But the firm looks nice. Good people working there.

And the job looks interesting.

Simon

@RoryMcCune So basically, it's a kind of injection. Wow.

Rory Alsop

19:24

@rorym - that is spectacular

...ly bad

Rory McCune

yeah that vuln and that upgrade manner suprised even me and I thought I'd seen a fair amount of bad security over the years...

Simon

I agree that 2 weeks should be plenty of time to fix it.

Simon

19:40

The first breach costs you an arm.... Where does this quote come from?

Lucas Kauffman

mmm tempted to run a google dork

but that would be illegal :(

Simon

googles what a google dork is

Interesting.

Scott Pack

@Simon Me.

Simon

@ScottPack Oh you.

Scott Pack

3

Simon

19:46

Haha

Lucas Kauffman

I'm watching this documentary about the battle of marjah, 5 year old smoking cigarettes telling american soldiers they are motherfuckers and that he is bad ass and not afraid of the Taliban. This kid should have its own meme

@JeffFerland I'm visiting @Terry then, but I've got two colleagues coming in

Scott Pack

Simon

I think I'm gonna launch a website to manage Scott Pack's fans. It will be known as the Official Scott Pack Fan Club.

The account ID 1 will be Scott Pack and SQL injection will be possible. Therefore, everyone will be able to know what it feels like to be @ScottPack for a brief moment.

Scott Pack

@RoryAlsop As a hiring manager would an applicant disclosing on their resume that they have a fan club be seen as a boon or a detriment?

Transcript for