The DMZ

Ohnana

13:00

yeah, and i either have to pick bullshit speakers for their gender or listen to someone whinge about how there's no women

Simon

@Ohnana o lawd

If you're asking publicly for speakers and no women applied, are you supposed to create a woman?

Rоry McCune

@Ohnana yeah that's a sucky choice, but if you have put in the effort you'd know they were whining without cause

HamZa

0

Q: Boston Key Party CTF 2016 - 04 March 2016 at 22 pm UTC, lasts 48 hours

Let's participate at Boston Key Party CTF 2016. The CTF will begin on 04 March 2016 22:00 UTC and ends on 06 March 2016, 22:00 UTC. As usual, we will play as team sec.se. The team communicates through the CTF team chatroom.

2

Ohnana

@RоryMcCune doesn't matter, it's a college campus

also, the women in computing society is working with us, but no one wants to speak

pllssss step outside of your comfort zone

Rоry McCune

@Ohnana surely if you say "we invited x women speakers specifically, and unfortunately they weren't able to make it" and ask for other ideas, that leaves you in a decent position

@Ohnana rookie tracks are good for that

B-Sides london has a rookie track and matches rookies up with mentors

it's billed as first time speakers so there's less pressure

Ohnana

13:04

at this point i just want to have a traditional conf go well

kalina

@Ohnana comfort zone is the best place to be

Rоry McCune

@Ohnana yeah if it's the first conf. run the goal is to get a win under the belt then look to develop on future runs

AviD

@Ohnana no good female speakers?

Ohnana

i just don't want to deal with whiny newspaper op-eds

AviD

what about bringing up new ones?

Ohnana

13:05

@AviD i asked 10 people, 3 committed and bailed

the other 10 were managers or inept

kalina

that's 13

Ohnana

out of 20, 7 declined, 3 dashed, 10 were unsuitable

AviD

@Ohnana ouch

Ohnana

yeah, eternal sadness

and my keynote had to bail on me :(

AviD

@Ohnana you should have asked @Simon, he could just put on a wig and a skirt.

then you'd have 11 unsuitable. :P

Ohnana

13:07

quite.

Simon

Sure, I would also constantly take selfies and post them on instagram during the talk.

Ohnana

i think i would football tackle you halfway through

AviD

@Simon ooh @RоryMcCune you should try that next time.

kalina

disturbing

AviD

unless @Simon was implying thats what all women do.

Simon

13:08

@AviD I knew you were gonna say that.

Rоry McCune

@Ohnana geez, sorry to hear, sounds like you had some awful luck there :(

AviD

@Ohnana cant resist a guy in a skirt?

Simon

I hope you will burn in hell for a day when you die.

kalina

@AviD who takes selfies

AviD

@Ohnana wow, major fail.

Rоry McCune

13:08

@Simon and you could call yourself Simone

kalina

@Simon just for a day?

Ohnana

well, the people who were in charge of getting a date/room fucked up on me and changed the date

Rоry McCune

@Ohnana ughhhh

Ohnana

apparently everyone in the universe has something to do on the new day

AviD

@Ohnana whyyyy

Simon

13:09

@RоryMcCune That's too easy, what about Simonia?

kalina

quality planning you have going on there

Ohnana

@kalina i know T_T

everything i'm responsible for is going splendidly

kalina

this is why further in advance = winning

Rоry McCune

@kalina they also should've booked you for the after-party!

kalina

pls

Ohnana

13:12

the after party will be me sitting in a chair and breathing into a paper bag

kalina

oh, so many potential euphemisms

Mark Buffalo

@Ohnana awww, don't be so mean to yourself. I wouldn't brown bag you.

Ohnana

wait what

kalina

of course @MarkBuffalo jumps in with something like that

Simon

I don't think he understands what the purpose of a paper bag is.

Mark Buffalo

13:13

wait... did I misunderstand?

kalina

do you really think that is appropriate bantering?

AviD

@RоryMcCune OH EMM GEE I NEED TO DO THIS FOR APPSECIL!!!

Simon

@AviD Oh shut up, you'd be the first one to go to the booth and ask "play some real music".

AviD

sure, but thats not the point

kalina

and what would the point be?

Ohnana

13:17

i am so confused

Mark Buffalo

@Ohnana Me too.

Simon

I'm not yet I'm supposed to be the dumbass here.

3

You guys are disappointing.

kalina

"speaking of disappointing"

Ohnana

lmao i looked that up on urban dictionary

AviD

@Simon thats what your mom said!

kalina

13:19

@Ohnana yeah...

AviD

@Ohnana dammit now you made me go look it up, thats awful

Simon

@ThomasPornin PORNU GET UP, WORKING FROM HOME IS NOT AN EXCUSE TO SLEEP IN

AviD

@Simon right, working from home means naps during the day.

kalina

@Simon spoken like somebody with an inflexible day job

Simon

@kalina I can come in at any time, work from home whenever I want.

kalina

13:21

working from home means you can wake up in the morning, write off the entire day, go back to bed and then work during the night if you wanted to

Simon

So, did you say something?

Hell, I could have taken the day off today.

kalina

woo grats

Ohnana

@AviD i mean it's a lot nicer than a lot of things on UD

kalina

"off" is my default state and then upon awakening I decide if I want to be productive or not.

you were saying?

Simon

We were talking about me, why did the discussion go back to you?

AviD

13:22

@Simon would anyone know the difference?

kalina

ARE YOU TRYING TO PROVOKE ME INTO WRESTLING?!

I will not do it.

Simon

No, my back hurts.

I cannot wrestle anyone.

Rоry McCune

@Simon you should be more careful with your donut

Simon

@Adi allo

kalina

aww poor back hurts because you're getting old

Rory Alsop

13:23

@RоryMcCune a speaker from last night's gig called off, then on then off 4 days before conf. Eventually turned up on the night, but with no commas at all for that 4 days... Annoyed more than a few people.

kalina

@AviD probably not

Rоry McCune

@RoryAlsop that's lame. I've offered to be an explicit backup speaker at some conf's just to try and reduce the organizers stress levels :)

kalina

@AviD maybe it would be quieter perhaps

Simon

I got my freaking headphones on 24/7.

I don't make a damn noise.

Rory Alsop

@RоryMcCune you'd never guess who it was...

AviD

13:25

@RоryMcCune oo thats a pretty cool idea. should start implementing that.

Rоry McCune

@RoryAlsop ..him was it...

Adi

@Simon 'sup, homie?

Rоry McCune

ah well no surprise there then

Rory Alsop

Yup

Simon

@Adi NM, you?

Ohnana

13:25

@RoryAlsop holy fucking hell i would have told them to leave

AviD

@RoryAlsop cmooooon now we're all in suspense

Rory Alsop

With 150 attendees, from all the banks and usual suspects

Rоry McCune

@AviD yeah get someone who's has some talks to hand and doesn't mind doing something impromptu :)

Adi

@Simon Oll kuut in te huut.

Rory Alsop

@AviD technically known as not a Rory

Rоry McCune

13:26

@RoryAlsop with any hope it'll give people pause before booking someone with that rep. again :)

Rory Alsop

@RоryMcCune I wasn't organising this one, but there was a lot of scurrying around

AviD

@RoryAlsop ahhh okay I know who that is. but wow....

Simon

@Adi wot

Rory Alsop

I nearly ended up doing my talk I did on Friday again

Adi

@Simon Finnish pronunciation of "All good in the hood"

Simon

13:27

@RoryAlsop WAS IT @RoraΖ?!?

@Adi Oh, noice!

AviD

starting to understand what happened all those years ago ;-)

Rory Alsop

Lol

Matthew

@AviD I don't! Who was it?!

AviD

never you mind

Simon

Wow, look at all this mod privilege.

They're discussing about someone and we're not allowed know who.

kalina

13:29

@Simon "we're not allowed to tell us who"?

AviD

nothing to with mods, and nothing to do with me - you can feel free to ask yon scottish roros.

Simon

That was a clusteuuuuuur.

Matthew

@Simon Well, we could talk about people they don't know...

Simon

@Matthew Like who?

Matthew

Did you hear about what that guy did, at that thing? It was disgraceful!

Simon

13:31

@Matthew OH MY GOD THAT WAS SO SURREAL

kalina

I can't believe he did that thing!

Matthew

@Simon You know, that guy! Yeah, that's the one

AviD

huh, according to this, sec.se gets more spam than most sites. 3rd highest of SE sites... (plus SO, SU, and Meta.se).....

3

A: How much spam traffic does this site get?

I'll expand on the comments by S.L. Barth and Ferrybig. Here is the list of 100 most recent spam posts (with a few false positives mixed in), as reported by SmokeDetector bot. According to it, the average is about 5 spam posts per day: more during the business days, fewer during the weekend. (The...

kalina

basically you're not really useful for anything other than spam

AviD

> There are Big Five sites with lion's share of spam: SO, SU, Drupal, AU, and Meta. After that, there is everybody else - and Information Security is the top of that group.

kalina

13:32

unsurprised that AU is in the top 5

RoraΖ

@Simon Hey i'm a legit rory, The other rory's say so

Simon

@RoraΖ Do they?

kalina

100% legit rory

AviD

@RoraΖ picture of you in a kilt. Now.

kalina

@AviD whatever floats your boat

AviD

13:35

@kalina Picture of you in a boat?

Lighty

OI

@AviD

Simon

And I'm the creep.

kalina

in or on?

Lighty

where do bug reports go

Matthew

I'm impressed with the difference detector here: security.stackexchange.com/review/reopen/70784

AviD

13:36

Last time I was on a boat, I was thrown up on. 4 times.

kalina

@Lighty depends on the severity

RoraΖ

@Simon I was roried, otherwise I wouldn't have tagged myself as such

AviD

@kalina in a boat? on a boat? I really dont know.

Lighty

@kalina GUI bullshit not working

AviD

does it matter what kind of boat it is?

kalina

13:36

@Lighty meta.se

Simon

@RoraΖ You could be an extreme roro wannabe.

Lighty

@kalina Just as a question?

kalina

@AviD no but it matters whether I've been destroyed and turned into a boat in some manner

RoraΖ

@Simon That would be so un-Rory like

kalina

@Lighty yes with sufficient enough detail to not get downvoted and red freehand circles liberally

AviD

13:37

@kalina as a boat.

Simon

@RoraΖ pls

RoraΖ

@kalina You can change form?

kalina

@AviD I'm not really large enough to cosplay a boat

maybe you need @Simon's mom

AviD

@kalina that would be a big boat

kalina

I'm sorry @Simon, I couldn't resist

Simon

13:39

Apologize to my mom, not me.

kalina

I'm sorry @Simon's mom

I know you can hear me

since you're everywhere

...due to being so large

-.-

Lighty

Maybe @Simon could cosplay as a boat...

Simon

I'M 154.2 POUNDS

HamZa

So much traffic here...

Simon

IS THAT BOAT WEIGHT MATERIAL?

Lighty

13:40

thats

69kg

154.2 pounds is 69kg

hehehehehehehe

Simon

( ͡° ͜ʖ ͡°)

Lighty

I weigh about the same

less prolly

65kg last time I checked xd

Im a toothpick

Lamia

@Adi Hey you. :p

Simon

Maybe you could be a celery then.

kalina

skinny guys with no muscle mass /sigh

Lighty

13:43

@kalina I'm working on the muscle mass

Simon

I'll make sure to remember that the next time you say men are assholes.

Lighty

I have a very legit excuse why I'm not working out atm...

kalina

@Simon men are assholes

Simon

@Lighty Me too: I'm too lazy.

Stu W

im about 65kg too

Simon

13:43

@StuW Brag about it.

Lamia

I am analysing some network logs, does anyone have a short way of filtering AD queries? :p

Stu W

OSCP and diy are more important than the gym atm lol

Lighty

Actually, don;t brag about it, it's unhealthy xD

Simon

@Lamia I'm assuming AD is binded to a certain port?

HamZa

@StuW a balanced life is more important

Stu W

13:44

It probably is unhealthy :)

Lamia

@Simon netbios?

Rоry McCune

@StuW heh another UK based tester

Lamia

Okay

Rоry McCune

at this rate we can change the name of this forum to "UK testers , and a couple of others"

HamZa

hehe

Simon

13:45

@Lamia What about it?

Stu W

@RoryMcCune I work for your employer too :p

Simon

@Lamia Are you looking for LDAP queries?

If so: wiki.wireshark.org/LDAP

Rоry McCune

@StuW well I wondered with the handle... that makes 4 of us

Simon

Look at you nurdz all working at the same place.

Lamia

@Simon I am actually trying to find out if it was used, thanks

kalina

13:48

@Simon but... but... you said this immediately after linking something to do with Wireshark...

Simon

I'll be a nurd the day I'll obtain my OSCP cert.

kalina

you've been a nurd for a long time before that

still enjoying Hearthstone?

Matthew

@RоryMcCune This can be the new internal chat room!

Rоry McCune

@Matthew that would be amusing

M'vy

We're invaded!

kalina

14:01

it's fine, let them think they're taking over and then I'll bring the fire and cleanse this place

Rоry McCune

metavision.com <-- another AR challenger enters the arena $949 for the dev kit

deed02392

what are people's dreams for virtual reality?

Mark Buffalo

@RоryMcCune
> Unique Meta 2’s unique neuroscience-driven interface design

"neuroscience-driven" sounds like a marketing buzz word for, "we hired a neuroscientist to 'okay' something we designed"

Looks awesome, though

Terry Chia

@deed02392 An MMORPG.

deed02392

@TerryChia nice, but I meant more in terms of experience

Terry Chia

14:15

:P

deed02392

for example I want an omnidirectional tread-mill

Thomas Pornin

@MarkBuffalo @Simon would say that with that helmet on your head, you mostly look like a nurd.

deed02392

and force feedback

and obviously full body tracking :P

Stu W

says it is based on unity engine
*waits for headset based on Unreal / serious sam / quakeII *

Mark Buffalo

@ThomasPornin Reminds me of an old Star Wars: Galaxies helmet

Chitin, I believe

theguardian.com/technology/2016/mar/01/…

deed02392

14:17

we either need neural linking or a full body exoskeleton

Mark Buffalo

> Comey, a well-respected figure in Congress, likened impenetrable digital encryption used to protect customer’s privacy such as that of Apple to a “vicious guard dog”. “We’re asking Apple to take the vicious guard dog away and let us pick the lock,” Comey said. “It’s not their job to watch out for public safety. That’s our job.”

Matthew

@deed02392 You want programmers to link directly to your brain? After you've done security assessments? Are you insane?!

5

Mark Buffalo

Shut up, Comey.*

> “The logic of encryption will bring us to a place in the not too distant future where all of our conversations and all our papers and effects are entirely private,” Comey said.

No shit! That's the fucking point!

Matthew

@MarkBuffalo Sounds excellent to me!

I have an idea. Security services can have access to exactly the information that all MPs are willing to provide to the public in unredacted form

Ixrec

even I think that's a bit too far

deed02392

14:27

@Matthew hell yeah

Mark Buffalo

@Ixrec You think what is too far?

Ixrec

what Matthew said

Mark Buffalo

@Ixrec You must be a spook!

Ixrec

heh

Mark Buffalo

equips tinfoil hat

Matthew

14:28

@Ixrec I don't know - any MP goes into a meeting which isn't public knowledge, it means that all members of the public are allowed to go into meetings that aren't security service knowledge. They don't publish whatever they say in the bedroom to their partner, security services can't listen to bedroom talk!

Arperum

enters room and sees tinfoil hats What's going on today?

3

Lighty

@Arperum SCREEEEEEEEEEEECHES

Arperum

@Lighty pats Where did the evil lizardman touch you?

Lighty

@Arperum butt ;(

Stu W

stu w equips tinfoil hat (+5) paranoia (-5) trust

Ohnana

14:31

@Arperum ᕙ( ͡° ͜ʖ ͡°)ᕗ

Arperum

@Lighty Isn't that generally an alien thing to do?

Mark Buffalo

@Matthew We should be able to know what goes on in their bedrooms

It should be a matter of public knowledge

Lighty

@Arperum nods ;(

Mark Buffalo

After all, when we have our hacked phones in our bedrooms, they can listen in

takes off tinfoil hat

Lighty

evil lizardman put a tinfoil had in my but

Stu W

14:32

lie back and think of rule 34

Mark Buffalo

googles rule 34

Arperum

slowly backs away

Mark Buffalo

@StuW WHAT THE FUUUUUUUUUUUUUUCK

Stu W

@MarkBuffalo urbandictionary.com/define.php?term=Rule+34

Ohnana

@StuW UM?!

Mark Buffalo

14:34

Yeah, I googled it...

AT WORK

Rоry McCune

@MarkBuffalo never google rule 34

Mark Buffalo

My boss is going to come in and beat me with his belt

Rоry McCune

at work, home, on the bus... just don't do it

Ixrec

incidentally, my impression of the security v privacy debate is that no one seems to know of an option in between "NSA has 100% access to everyone's data" and "the terrorists have perfect secrecy too", are there any proposals out there that might create a middle ground option?

Mark Buffalo

@RоryMcCune "I know that now." - Jack / Subject Zero

Arperum

14:35

@MarkBuffalo does not want to think about rule 34 implications

Ohnana

@Ixrec well, the USA has a thing where you get a judge to grant you permission to search

CodesInChaos

@MarkBuffalo Even if we somehow manage to fix computer security, that seems still unlikely. Microphones and cameras are already pretty small. Insect sized drones might not be too far off. etc. There are still plenty of ways to pull off targeted surveillance.

Ohnana

that's a decent middle ground, as long as the burden of proof is heavy enough

Mark Buffalo

@CodesInChaos Yeah, that's true.

Ohnana

"he went on this website" not good enough "he posted pro-terroristic threats for months and made a direct threat" yeah sure.

Mark Buffalo

14:36

@Ohnana Except Judges have been signing off on warrants for no reason in a lot of cases

CodesInChaos

And of course outside your home there will be plenty of targeted cameras as well.

Ixrec

@Ohnana if we had a technical solution to "you can only search phones that you got warrants for" then that would be great

Ohnana

@MarkBuffalo which is why the burden of proof has to be higher

Ixrec

but isn't the whole point of the recent Apple case that we do not have such a solution?

Mark Buffalo

@Ohnana I used to troll extreme right-wingers online, with a friend.

Like they were the 'start a revolution' type

You don't want to know how that ended up

Ohnana

14:37

@Ixrec i mean, they searched it as best they could

it's like trying to read a burnt paper, it's not there, you're not getting it, move on with the investigation

Lighty

@MarkBuffalo you idiot :')

welcome to the internet

where nothing is truly sfw

Mark Buffalo

@Lighty luls

Matthew

@Ixrec What would a middle ground be?

M'vy

@MarkBuffalo newb

When in doubt, prefer Wikipedia :)

Mark Buffalo

;-]

Matthew

14:41

@Ixrec Either encryption works, and no-one but the intended recipient can see the contents, or it doesn't work, and a known entity can definitely see the contents, and other entities might be able to see the contents, but you can't prove it either way

Mark Buffalo

@M'vy When in doubt, use my phone :p

M'vy

@MarkBuffalo works too

Stu W

@Matthew or it may have worked and no-one can see the contents - not even the intended recipient

Mark Buffalo

If I don't know what something is in this room, I will use my phone to look it up

Stu W

sorry guys - thought that was common knowledge :)

Rоry McCune

14:44

@StuW it's ok @MarkBuffalo makes these mistakes regularly :P

Mark Buffalo

@RоryMcCune I came dangerously close to buying an iPad yesterday.

Matthew

@StuW I dispute that would count as working. I would contend that would be "file shredding" rather than "encryption"

Rоry McCune

never google stuff from a chat room on a work PC

Mark Buffalo

@RоryMcCune To be fair (c'mon, throw me a bone here... NO euphemism intended), we were talking about paranoia things, so I thought rule 34 was some kind of tinfoil rule.

Stu W

@Matthew true :)

CodesInChaos

14:45

@Matthew I think there are various trade-offs along that line. For example allowing passive decryption vs active interception, audit trails, secret sharing to require multiple cooperating entities,...

Ohnana

you're so innocent and cute

Matthew

@MarkBuffalo Nah, that's rule 69

Rоry McCune

@MarkBuffalo see goes to show need to have that tinfoil hat on at all times, or You'll end up like a "Lemon Party"

Mark Buffalo

@RоryMcCune What is a Lemon Party?

Hang on, I'm opening google.

Lighty

@MarkBuffalo DO NOT

ABORT

@MarkBuffalo ABORT AT ONCE

Rоry McCune

14:46

@Lighty it's ok I think he knows that one

CodesInChaos

But the big problem is how you force the user to use a backdoored device. Especially in this age of globalization, where each country would like its own backdoor.

Lighty

@RоryMcCune We can't take the chance

Stu W

Lighty

@StuW Dear god..

Mark Buffalo

...what I have just witnessed

Rоry McCune

14:48

@Lighty well @AviD did once go to that site after it was mentioned in here (and I even warned him not to)

Mark Buffalo

hmm, need to bookmark this site for later.

Matthew

@CodesInChaos They only work for the legitimate backdooring parties though. If you are a bad guy, you still have access, potentially, with no safeguards. I have no faith that the details of such backdoors would be protected well enough

Mark Buffalo

@Matthew This is how, over the years, I've had free-reign in some places :-]

Simon

@ThomasPornin Aw, you even spelled it right!

Matthew

The key thing about doors is that they allow anyone through, once they're open. And these are huge targets to anyone who wants to make a lot of money. Not saying it would be easy to exploit them, just that if you design in a way in, you can't control who uses it in the long term

Mark Buffalo

14:53

@Matthew All you really need is the leaked use-case documents for those backdoors

It practically tells you how to do it

Ixrec

that's pretty much what I meant, is there any hope of ever inventing a "door" that only allowed some pre-designed authorities through?

CodesInChaos

What you need to exploit a backdoor is the private key associated with that backdoor. Which should at minimum be stored in non exportable form in a HSM.

Mark Buffalo

@Ixrec Usually they can be protected with keys... but once you get those keys... heh. Just HEH.

kalina

who would have thought, you can protect back doors with keys

you can protect front doors with keys as well

and windows

Mark Buffalo

Or you might find a fail safe built into the key checking process: a run-of-the-mill buffer overflow/rce.

CodesInChaos

14:56

Reversing the software won't help, since it only embeds the public-key.

Mark Buffalo

No, reversing the software helps

kalina

oh, @MarkBuffalo and @CodesInChaos are having a disagreement

gets popcorn

Mark Buffalo

There are often fail-safes built-in

CodesInChaos

@MarkBuffalo How? Consider PGP style messaging where the client always adds NSA_PUBLIC_KEY as another recipient. The only way to exploit that backdoor is by knowing NSA_PRIVATE_KEY.

Mark Buffalo

Or private_key.length + buffalo overflow

Dude.

CodesInChaos

14:59

That system is still quite fragile (passive sniffing, no audits, no forward secrecy, etc.) but it's basically secure.

Assuming your definition of secure allows for the NSA reading your emails.

Mark Buffalo

@CodesInChaos These days, most intrusions come from the inside

Matthew

@CodesInChaos And how does this help against the problems that the NSA/GCHQ are claiming it will? Why would actual bad people use this?

Transcript for