The Base Camp

« first day (994 days earlier) ← previous day next day → last day (3778 days later) »

WedaPashi

02:46

@Everything: haha.. I was so amazed to see how odd some guys can be

@soph: Hi there. I ain't working today, but I am online :D :P

@Rory: Don't ya sleep? :O

4 hours later…

Rory Alsop

06:40

@WedaPashi morning - yeah. Luckily only need about 4 hours so was up late with the fallout from the Poodle vulnerability

'Poodle' - who names a vulnerability Poodle?

Aravona

06:55

Morning

@Rory Padding Oracle On Downgraded Legacy Encryption

They made those words up clearly to fit Poodle lol

That's going to be an interesting comment to my boss, 'are we affected by poodle?'

I had to sort our servers for heartbleed and shellshock, but this seems to be a client based issue over same networks?

Rory Alsop

@Aravona I was pushing to call it Ursus Major, as one of our guys on Security SE called it correctly before google published (and his avatar is a large bear)

Q: SSL3 "Poodle" Vulnerability

Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one. What is the Poodle vulnerability? I use [product/browser]. Am I affected? Is [product] vulnerable to t...

that's the canonical q

and Thomas' answer is non technical enough even for me

Simple solution for this one - disable SSL v3

Aravona

@Rory yeah I'm just reading about it on Wired

Rory Alsop

07:18

Thomas did that for CRIME and BEAST as well. He did point out that if researchers are going to tease about a vuln they are fair game :-)

Aravona

Lol

I think I'm going to bake a cake tonight

requiem

hah... I'm stealing this one: "Cryptographic attacks are neat, but they involve more effort than exploiting the bottomless well of user's gullibility."

Aravona

@Requiem lol

Rory Alsop

my favourite:

> If you do not install the patches then Níðhöggr will devour your spleen.

Aravona

Lol!

Liam

08:21

Morning all!

Couple of days off

lovely

Sub cneifion arete ^

Aravona

@Liam awesome!

Liam

If I google poodle vulnerability I get this....

o_O

Aravona

Lol, goodness google...

Rory Alsop

@Liam Yeah ... don't do that ;-)

just follow Sec.SE link above for the general case

this Ubuntu link is good:

Q: How do I patch/workaround SSLv3 POODLE vulnerability (CVE-2014-3566)?

After BEAST, Heartbleed now I've heard about a new vulnerability in SSL/TLS called POODLE. How do I protect myself against being exploited? Are only servers or also clients affected? Is this OpenSSL/GnuTLS specific? Please just show me examples on how to fix it.

security ssl tls

Liam

08:50

TBH @RoryAlsop, I don't know what it is...infrastructure shiz

Rory Alsop

@Liam ok

Aravona

@Rory my ubuntu servers have sslv3 enabled, but they're bitnami servers so I've no clue where to disable it?

It's apache but there are a whole bunch of httpd files, including httpd-ssl.conf

Todays gonna be a long day >.<

followed instructions and... can still connect. Definitely a long day lol.

Rory Alsop

09:14

@Aravona Hmm - I don't know bitnami

Aravona

@Rory they move things to be all over the place - so I've requested on their forum how to disable sslv3

they make good pre-installed packages, this was wordpress

but now I am wondering, since its ubuntu 12.04 if I should update it to 14.04 as 12.10 is no longer supported...

I guess I will have to wait for a response from them lol.

Rory Alsop

@Aravona generally that is a good thing, yes. The majority of these vulnerabilities are mitigated by keeping up to date with versions and patches as you can

Some of the guidance we have given out is that customers can help protect themselves by turning off SSLv3 in their browser.

(For some customers this will require upgrading from eg IEv4!!!)

Aravona

@Rory yeah, the browser companies are not going to support it and move away from sslv3 in their products as well I've read

I'm happy to update, not happy to do so without a server snapshot first.

Rory Alsop

@Aravona FF has a fix, and Google is making it as easy as possible in Chrome

Aravona

@Rory thata good. I am sure I will sort my servers when the IT guy is back from holiday

Liam

10:08

I gave up trying to keep on top of hardware when our hardware people started changing stuff without telling me. "Well if your going to do that it's your problem from now on"

Aravona

Lol.

I've updated OpenSSL again to the october build.... Since we had Aprils build and whilst it's in use it might as well be up to date... Now just want to upgrade ubuntu and disable SSLv3

Though we don't currently use a https connection one these servers I want to still be up to date and in a supported ubuntu

4 hours later…

soph-e

14:04

blog.jimmychin.com/2014/10/… this is nuts!

Liam

@soph-e #bestjobever

Rory Alsop

14:58

@soph-e sweaty palms. Free solo 5.12 . . . 2000ft to the valley floor . . . NOPE!

soph-e

15:25

@rory but hey it was all worth it, the video they made out of it is outstanding ;)

WedaPashi

Hello everyone!

Rory Alsop

@soph-e I haven't seen the video. Will try to find it this evening

In fact - I have been here far too long today. Time to go. Seeya!

WedaPashi

@soph: Hi there

Liam

15:45

Oh you just remeined me @RoryAlsop. Was watching this the other day and it reminded me of our conversation on sweaty palm videos

►

I nearly cried out when he slipped. Mans got bigger balls than me....

WedaPashi

Did ya see this?

►

Liam

@WedaPashi I did actually

I've been up there. It's all a bit staged. I think he's from Skye originally

WedaPashi

That looks a greattt place

Liam

@WedaPashi The Cullin ridge

WedaPashi

Lovely place

@liam: And, nice video that you have just shared.

Liam

15:53

@WedaPashi That's Officially the hardest confirmed climb in the UK. E11

WedaPashi

@Liam: Oh, thats great. He appears to be moving so well on the wall

Liam

@WedaPashi He's also one of the best climbers in the UK

WedaPashi

#Superhuman :D

2 hours later…

Rory Alsop

17:46

@Liam that pinch at 1:05 - yeek

ooooh - good drop

EverythingRightPlace

hi folks

Rory Alsop

@EverythingRightPlace afternoon

soph-e

@rory youtube.com/watch?v=PmYl9gP2rK8 this is the alex honnold free soloing Heaven video

EverythingRightPlace

afternoon??

I am on my feet for over 14 hours oO

soph-e

@ever and I just started my day ;)

then again, for me the day starts around noon...

Rory Alsop

17:51

@EverythingRightPlace so far only 13 for me

@soph-e nice

EverythingRightPlace

@soph bloody envious

nice pic @Liam

what is it exactly? :D

danny macaskill going in the mountains? wow he never stops getting even more awesome :D

Rory Alsop

@EverythingRightPlace watch the video - and the 'making of' video

even just standing on the top of the Innaccessible Pinnacle is bad enough. He does it astride his bike

1 hour later…

EverythingRightPlace

18:58

Up to 21 dead hikers in the Himalayas. They got surprised by an early winter storm. They just brought in in the biggest Newscast here.

« first day (994 days earlier) ← previous day next day → last day (3778 days later) »

all rooms

Transcript for

Oct14

Oct '1415

Oct16

Nothing running?

trail-wolves

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC