« first day (921 days earlier)      last day (2684 days later) » 

12:38 AM
 
 
1 hour later…
1:38 AM
I don't think that's a drinking game. I think that's a recipe for "How to get alcohol poisoning."
 
While this is only slightly related...I will occasionally say the word "Once" in a rather deep breathy voice just to annoy Katie.
 
2:32 AM
@ScottPack Katie is such a lucky girl.
Do you think she realizes how lucky she is?
 
Unlikely.
 
2:48 AM
Yo yo yo!
Anyone here know anything about botnets?
 
That's....a rather broad question.
Rather akin to asking, "Anyone here know anything about fire?"
 
@ScottPack ha ha, how does someone discover a botnet?
 
Usually either accidentally or on purpose.
 
@ScottPack i get that, but how? Do you see strange packets? Overflow of some kind?
 
3:06 AM
It would honestly depend pretty heavily on the intent and purpose of the person doing the discovery.
Some researchers do their damnedest to get something infected and then monitor the communications. Some may actually hire our botnet nodes
 
@ScottPack ah, and when someone says I took over a botnet, they mean they just hacked into the C&C server?
@ScottPack cool.... and creepy...
 
Were I to identify a botnet it would probably be by identifying an infected machine and doing network analysis.
@coding_corgi Usually it's more DNS sink holing. Figure out what the CNC is and take over it's DNS record somehow.
 
@ScottPack DNS? WTF is that? Ive hear of it but...
 
I somehow take your A record and point it at my DNS name.
 
@ScottPack uhhhh, wah?
 
3:11 AM
Petition the registrar, wait for it to lapse and put in my registration first, etc.
 
@ScottPack Thanks, so it's through DNS? Okay, ill go take over one now,
;D
I'm out
Hasta la vista!
 
Bless. That'll be fun to see the results of.
 
 
3 hours later…
6:22 AM
 
6:41 AM
4
Q: What are the purposes of these security policies?

hushhushI work at an IBM lab and there are some security policies that I do not understand the point of. When I ask why we do them my boss simply says it's policy and avoids answering the question. We must keep empty drawers locked When we leave work we must lock up writeable media We must lock any not...

Why is this question on the first page of the SuperCollider?
Slow day on SE?
 
7:22 AM
@ScottPack Damn coders, dont even know DNS.
sorry to see I missed the @scottsnarkfest.
 
7:42 AM
@AviD Throw this over to network engineering? security.stackexchange.com/questions/37922/…
 
@TerryChia done.
 
7:57 AM
Busy this morning @AviD? You seem to have the front page sewn up :-)
 
@RoryAlsop do I? oops. doing some tag clean up...
like eg .
gonna merge that with , but first I have to take out the ones that mean something else...
I still think moderators should be able to edit without a pagebump...
I think we need a Summer of Tag Cleanup project...
any takers?
maybe I'll meta it later...
 
8:14 AM
I think it has been requested a few times - not sure why we don't get bump free cleanups
 
8:55 AM
@AviD Meta it. That's the standard procedure. Propose a preliminary list of tags to be burninated, and as the community comments, you can add/remove tags as necessary. After a while, ping a comm team member
 
@ManishEarth ah, no, what I'm talking about is a real spring cleaning. I dont have the list of tags, we need to walk through them all.
 
@AviD Yeah, sure, so don't start with a preliminary list of tags
 
for example, we have 3 pages of single-use tags. most of them should be removed.
also dont need comm team, they get cleaned up when they're not in use.
 
Oh, comm team is for mass burninations
 
there are also quite a few tags that are overused and misused.
 
8:57 AM
A quick query ought to get you a list of tags sorted by use
 
@ManishEarth no, for the most part we need to go one by one, at most we can dump a filtered tag as a synonym.
 
muzak plays
 
Plinky inky pinky plink
 
@ManishEarth umm.... duh?
 
(That was Muzak)
 
8:58 AM
Oh :p
Didn't know they added pagination to that
 
But dont want to buy, sell, or manufacture anything.
(That was Cusak)
 
I like the way we get improvements just subtly and quietly added
Oh dear @avid
 
@RoryAlsop heehee
@ManishEarth wow, thats been around a LONG time.
 
Not for /new
And it's still not there :P
 
ah, true. I click that seldom enough that /new isnt relevant...
also just because its been around for a while, doesnt mean its a good tag.
 
9:01 AM
It's actually a good way to find crap tags
new tags=crap
 
@ManishEarth not necessarily.... sure, they should be reviewed, especially if they are by relatively new users, but a lot of the new tags are good, or potentially good.
 
Of course, but usually they're crap :P
 
even single-use tags arent necessarily bad. it's their potential that matters - single use from this month, might get used a lot more - single use from last year, unlikely.
yknow what.... COFFEE TIME.
think I'll go for the Kenyan today.
 
@AviD what does kenyan taste like?
 
I went for - a coffee whose flavour is perfectly hidden by the vanilla syrup. As usual
 
9:05 AM
> sweet with honey, a vibrant wine-like acidity, with hints of fruit.
 
Although I have to admit I just ordered a tassimo for my wife. She appears to be taking over my caffeine addiction quite well
 
> deep fruit tones of currants and berries, an essence of grapefruit and a penetrating complexity of flavor that reveals itself slowly from first sip to last.
@RoryAlsop lol
@LucasKauffman its funny, I find these descriptions to be very hoity toity, like wine snobs sommelliers, but drinking it a lot of times it really does make sense.
it is a lot brighter than some other coffees, not quite honey but relatively in that direction. vaguely fruity/berry-ish. not as dark and heavy as say, columbian.
 
@AviD do you actually taste all those flavors?
 
@LucasKauffman well not as much as all that, but I definitely see difference between other coffees.
 
When I used to run a wine cellar, I just used to ask the customer what wines they liked, and then suggest wines they would probably also like. None of that snobby 'hint of badgers sett, with floaty Tarmac overtones' stuff
 
9:09 AM
@RoryAlsop hehe
but yeah, even without being hoity toity, some people can really appreciate the differences, and the subtleties, of different wines.
Other people mock them.
 
Definitely
To both statements
I really do appreciate the differences in wine, whisky and cheese - but not much else works for me to that sort of level
 
the guy that runs the boutique I get my coffee from is a REAL freak.
 
@RoryAlsop did you ever drink a Saint Petrus ?
 
@AviD Like @Adnan?
 
he has a 5000$ machine, and if its set to the wrong bean, soaks the grinds a few seconds too long or puts the water with the wrong pressure, he can really tell the difference.
It just tastes wrong to him.
 
9:12 AM
@AviD wtf
 
Wow
 
tbf, if you drink whisky in a wine glass, or at the wrong temperature, or you didnt let the wine breath long enough - you would know from the taste, wouldnt you?
 
with wine definitely
 
Yep
 
actually, on second thought... see @RoryAlsop's reply below :))
 
9:14 AM
Blasphemy!
 
@TildalWave coffee is when I'm working ^^
 
@RoryAlsop didn't put it right
 
@TildalWave hehe, really, in this room? cmooon son.
 
dunno... I'm sure there's been nice studies about it
 
As eating and drinking are essential, making them very enjoyable is quite a nice idea
 
9:16 AM
@AviD he's right, it did read all wrong
 
Breathing is essential too - and it does make a difference breathing highland air, or city centre air...
 
@TildalWave its one part sensitivity to differences from perfection, from experience, and one part cognitive awareness and understanding of the process.
@RoryAlsop oh yes absolutely. unfortunately its too damn hot to open the windows here right now.
 
@RoryAlsop have you read some short story (would be in sci-fi stuff prolly) where the guy was interviewing God, asking him why he stays on our planet? Might have even been called Interview with God, but I honestly don't remember the title... anyway, God replied he just loves the concept of enjoying foods and drinks, and is something that even him, as a creator, hit him by surprise
 
Same here - it keeps getting up over 20 degrees. That's pretty hot when you have evolved to cope with scotland
@tildal - not sure. It rings bells but nothing concrete
 
@TildalWave Ask on Scifi.SE. :P
 
9:19 AM
@RoryAlsop It would be pretty old, maybe 20 years ago
 
@RoryAlsop lol... that would be beautiful here. We're talking over 30C now...
@TildalWave I think that was a George Carlin bit...
 
@TerryChia meh I could prolly find it if I was bothered to
 
a bit sacrilegious, if you're a Catholic....
 
@AviD doubt it, but yes he has some similar stuff
 
9:33 AM
@TerryChia Nobody is as freaky as I am.
For some reason, I'm not able to stop listening to this. It's so catchy
First time I heard it on Fox news.
 
Haven above, eh. Gotta love speelin mistooks
Any of you folks know how much the CEH exam costs. Building a cert and training plan for my team
Oh, nvm - found it
 
9:49 AM
@RoryAlsop how much does the cert cost?
 
10:00 AM
@RoryAlsop CEH? Tsk! ;)
 
I know, it isn't one of the top list, but we might let one of our juniors sit it. Only $600 all in
 
@RoryAlsop Please please please share!
I'd love to read something professionally crafted like that
(if possible to share, of course)
 
Mostly focusing on CRISC, CISM, CISSP, PRINCE2 as these are applicable certs across industry (remember I have a risk focus in this new role, not purely security)
 
@RoryAlsop 600 USD isn't a lot
 
Shareability - hmmm. Will see. Probably can share the very high level bit
 
10:03 AM
IIRC you actually have to refresh the CEH cert every few years now right? That's kinda retarded for an entry level cert.
 
@TerryChia it's the same with CCNA
well if you can call CCNA an entry exam
 
I wouldn't expect refresh - if they are good, let them think about CREST. If not focusing on pen testing then get them onto CISSP or CISM.
 
@RoryAlsop OSCP :p
 
Good point @lucas
 
@RoryAlsop That's a damn reasonable price
 
10:05 AM
It can be even less if done in bulk, and through certain approved providers
And taken fully online, rather than in person
 
also the certification?
 
@LucasKauffman I wouldn't. :P
I'm probably going for the RHCE cert soon.
 
@TerryChia is that like LPIC for RHEL?
 
@LucasKauffman Probably. The entry level cert from redhat is the RHCSA which I already got. RHCE is one level up.
 
I'm watching this guy who purposely injects himself with snake venom
 
10:25 AM
Got to love vice magazine
 
@LucasKauffman Why is he doing that?
 
@Adnan he thinks it makes him younger, immune to diseases, high and allows him to skateboard with the movement a snake makes
 
@LucasKauffman Makes perfect sense
 
@LucasKauffman Hey, maybe you stumbled on to @RoryAlsop's secret to eternal life!
 
@TerryChia who knows :p
 
11:04 AM
Erm...
 
> You've earned the "Nice Question" badge for Why aren't infinite-depth wildcard certificates allowed?. See your profile.
I don't need no stinkin' badges, I want an ANSWER!
 
@ManishEarth You need The Bear.
 
Funny thing about DNS wildcards, if you have *.example.com, www.foo.example.com will work, but if you also add foo.example.com, www.foo.example.com stops working.
 
Huh
I never got that bit about www.
 
@Poly Do external USB hubs behave differently from root hubs?
 
11:10 AM
no, they're all identical.
 
You would need to add *.foo.example.com to keep the old behaviour.
 
@Polynomial Well then I'm pretty sure I'm correct.
 
For example, I have *.iitb.ac.in set as my proxy ignore, however, www.iitb.ac.in still is pushed through the proxy (but a.b.iitb.ac.in is not)
 
keep in mind that root hubs are just the ones connected to (or inside) your chipset
 
@Polynomial Yes, I'm aware of that.
 
11:11 AM
how so? an external device could only sniff the traffic addressed to itself or a sub-device.
 
@Polynomial Well, then I guess I'm wrong.
But what could explain the ability to do that mirroring thing? (we can absolutely exclude cheating by using some software)
 
mirroring thing?
ah, it could be that the two devices were designed to do that
and that they both explicitly set their own address
but that requires cooperation of the second device
otherwise you'd get sync error
 
@Polynomial Only one of the devices was provided by demonstrator. The other USB stick was provided by a member of the evaluation committee.
 
that's... bizarre.
are we absolutely sure there was no driver software involved/
'cos that sounds highly fishy.
 
@Polynomial and my whole understanding of USB was based on the presentation that guy gave.
 
11:18 AM
@Adnan Actually, after looking into it a little more in detail, it appears you might be right. There's a bit of a gap in the spec over it.
essentially it looks like the control packets are broadcast
but the data packets aren't, by default at least
however there's nothing to stop a device from transmitting broadcast data packets
so I'd guess what was happening is one device would select itself as master, the host would send unicast data to that device, and the device would re-broadcast the data to the other (slave) device.
 
@Polynomial Hmmm.. that would make sense. I'm currently trying to contact the guy to ask to give me the presentation. Hopefully there would be more info there
 
my understanding is that horizontal broadcast is perfectly acceptable and doesn't require special arbitration from the host
so you can do really fast data transfer between devices on the same host
I'm not a USB expert, but that's my understanding of it from reading the spec and some related articles.
and knowing how other asymmetric bus protocols work at the hardware level
 
@Polynomial I tried to search about this for some time, I couldn't find anything. You're right, the specs are kind of vague in this area.
But then again, when have any kind of specs weren't vague?
 
11:40 AM
Hey, how much HDD space does Kali need?
 
> A minimum of 8 GB disk space for the Kali Linux install.
I usually load up 32GB VMs in case I want to install other tools/have some other stuff on it.
 
@ManishEarth Unless you're just using it as a quick test of the new stuff, I'd recommend sticking to BT5.
Kali is pretty unstable.
 
@Polynomial ah, I see. I just wanted to test it
I also need a linux install, thought it would be a good idea :P
 
@Polynomial Do you have any specific complaints as of now? Have not been keeping up with Kali's progress recently. (Been doing a little bit too much coding for my taste).
 
Only for a week
 
11:48 AM
@ManishEarth Just load ubuntu/fedora if it doesn't need to be security specific. :P
 
@TerryChia But I want to play!
Also, Ubuntu requires ~15 GB
 
@TerryChia full OS dies after upgrade, many issues with package management breaking things, can't customise menu (doing so makes it disappear)
 
@ManishEarth What about this then? ponyos.org
@ManishEarth Go Arch Linux.
@Polynomial Ahh... That first one is a bummer.
 
@TerryChia X11 crashes sometimes, GDK3 gets corrupt config periodically due to some weird scripts they run in the background too
@ManishEarth Debian minimal?
 
@TerryChia Was thinking of puppy linux too.
 
11:50 AM
> I mean, it has ponies *and* massive security
holes! What's not to like?

In all seriousness I accept the fact that the OS isn't meant to be
secure in any way and I have essentially wasted 24 hours of my life
horsing around with it.
Heh!
 
-1
Q: How easy is to track someone exploting a XSS vulnerability?

yzTIf one of the common uses of XSS is to steal cookies which will be sent to the attacker's server, isn't it so easy to identify the attacker? This is not like a SQLi for example which you can exploit using VPNs and proxy chains. In this case you have to provide a URL that you can control for retr...

nc?
 
Thing is, I'm behind a proxy, and I have this huge script I've written that manages proxy settings
But it only works on ubuntu-like entities
 
@LucasKauffman Not a particularly good question, but doesn't deserved to be closed imo.
 
(Debian minimal may work)
 
@ManishEarth GENTOO
or LFS
 
11:51 AM
@ManishEarth Ubuntu-like meaning debian based or...?
 
@TerryChia Yeah
 
@ManishEarth whatabout Mint, it's debian/ubuntu based (you can choose) and it uses the MATE gui
 
needz APT among other things
gentoo was another idea
oh right ive seen mint
 
@LucasKauffman Yeah Mint is awesome as well.
 
@ManishEarth you don't want gentoo
 
11:53 AM
Really simple to use - nice intro to linux for the non-power users.
 
(btw i'm not new to linux, just that my main laptop has conked and I'm trying to make do with an old XP)
 
@ManishEarth You should be shot if you hang out here and have absolutely no Linux experience at all. :P
Lubuntu is really nice if you need something simple to setup and very lightweight.
 
@TerryChia since you are a RHEL engineer to be, do you use their desktop linux?
 
I have my parents using it on a 8~ year old machine.
 
@TerryChia lubuntu=LXDE? My friend was trying it
 
11:56 AM
@LucasKauffman Fedora? Naaah. I run Windows as my host. :( I play way too much games and I'm lazy to run a dual boot setup.
 
I don't care about setup simplicity, I'm pretty experienced with making dual boots (I've dual booted ~300 Win+Ubuntu installs this year)
 
@ManishEarth Yup. Frankly ubuntu is the only linux distro that hasn't pissed me off with driver issues for desktop.
 
I tried Fedora, didn't like it
 
@LucasKauffman Ohh nope. TBH I can't see myself recommending the RHEL-based distros for desktops.
 
11:58 AM
@TerryChia Yep. I could also install Chromium OS: The Internet is what I really need, but the crosh prompt is annoying. And I can't set it up in my room, there's no way to set static IPs during that period
 
12:35 PM
@AviD I was a little tipsy at that point. What can I say.
 
12:45 PM
I was using Fedora as a linux desktop. I never had any driver issues, though. I've never liked how Ubuntu's general theme is so much, "It's cool, we got this. You go facebook with your grandkids."
 
1:10 PM
Mutters.
Not knowing javascript is annoying when you are looking for <iframe src="javascript:alert('This is your alert.'"> </iframe> as a username.
 
@TerryChia I run Fedora on a daily basis. It's okay. I've got some DVD playback issues at the moment, but that's not Fedora's area (the packages to do it are from rpmfusion).
 
The only real problems I had with Fedora were all around multi monitor with my old Geforce 7300.
 
1:33 PM
So this is nice.
I just learned that network authentication is really not as complicated as everyone thinks.
 
@AviD What does everyone think?
 
According to this .jsp file, all you have to do, is encode your domain name, your username, and preface is all with "NTLM" in the Authorization HTTP header. And you're done!
the cryptographic protocols are really just fluff, anyway.
 
HOLY SHIT!!!
They killed everybody!! Everybody is dead!! How are they gonna continue the next season with this?!
 
@Adnan Make new people
 
@ManishEarth They might have as well killed the hottest one, Ygritte.
 
1:41 PM
@ManishEarth she tried that, and they killed her too!
@Adnan yeah, isnt she though? :P
Hot redhead with a scottish accent.... reminds us of Amy Pond.
 
@AviD Oh definitely. The most attractive female character in the whole series. IMO, of course.
 
@Adnan hahaha, you're limiting that statement to females only?? ;-)
you have a thing for Loras?
 
@AviD HAH!
 
@AviD Who's that?
Do you mean Loras?
 
Maybe Jon Snow...
@Adnan (yes. Shuddup.)
 
1:46 PM
@AviD God damn it! Now I'm sitting here Googling pics of Ygritte
 
I'm just disappointed that we never got to see that thing Jon Snow does to her with his tongue.
 
.... O....Kay...
 
@AviD Why do you wanna see that?
 
@RoryAlsop ah, the alphabet trick? ;-)
 
@AviD Best one.. 8
 
1:49 PM
Dude, I'm trying to concentrate here...have been interviewing all day
:-)
 
But what I really wanted to know is what Podrick did to the ladies in the brothel that they didn't take the money.
 
WHAT DID PODRICK DO?!!!
 
@RoryAlsop haha, oyyy.... thats tough.
 
Hmmm.. apparently I'm not the only one asking that question
I think I'll send an email to George Martin about it
 
1:54 PM
Morning! Why do I sleep 7 hours when I can sleep longer than that?
 
@Adnan Come on man, don't distract the guy any further. He has two more damn books to finish!
@Simon Because you wanted to talk with @ScottPack.
 
@TerryChia It might be it. However, now, I just realized that he doesn't share the love I have for him. I think it's time to let him go.
 
@TerryChia Of course @Simon wanted to talk to me
 
@Simon There ya go, @Adnan is waiting for you.
 
@TerryChia but but but but.. I should know! I mean.. come on!
 
1:56 PM
@Adnan Hello :)
 
@Simon Heillo
 
Mellons
2
 
@RoryAlsop Go back to handling interviews!
Soon we'll start talking about bewbies. You don't wanna hear that
 
Ach - I'm done now. Only 28 other impossible things to do before teatime
 
But I know @Lucas does
 
1:59 PM
@Adnan A wild @LucasKauffman appears in 5.. 4.. 3..
@Adnan DAMMIT!
 
@TerryChia Ahaaaa!!! IN YOUR FACE!
@TerryChia Holy shit! 1 second difference!
 

« first day (921 days earlier)      last day (2684 days later) »