Does anyone know how the x86 microarchitecture (specifically Intel and AMD) deal with reads and writes to the debug registers dr0 through dr3? Like does it touch the microcode sequencer or do anything else that could cause overhead?

Oh no a computer virus!

Hahaha

Really creative though

@daya Sites like YouTube will not work, but you can use programs to download from the site (and many, many other video sites) using youtube-dl.

As someone who has JS disabled on the vast, vast majority of sites, I can say that I pretty much never have problems. When I do, it's usually just downloading a video that youtube-dl doesn't support, in which case it's often as easy as view-source: and searching for the string .mp4 and downloading the video directly.

I actually find the web is easier to navigate, since when I turn JS on for most sites (which I had to do when using someone else's computer recently), there are so god damn many ads and intrusive popups and gigantic frames asking me about cookies and whether I want to sign up to some bullshit...

@forest Hmm, I would try this

Yeah I don't use torrent sites that I'm not familiar with. In general I don't use public trackers that don't have a very good track record (I use private trackers when I need).

@forest Indeed, they are fucking annoying

@forest Well, It was on piratebay, pretty familiar. no?

Good Evening Josh :P

Well TPB has some crappy ads. If I have to use TPB, I download via the infohash.

I can only provide supoot for money in Bitcoic.

lmao

You should have replied in a stereotypical voice "life is pain".

Just wondering, why italics didn't worked in my above chat comments, this has happened many times!

lmao

@daya Did you do _blahblah_?

test

but why this didn't work?

Weird!

@J.J But It sometimes doesn't work for me as you can see in above chat comments

Anyway, from now I will always use _ _ instead of * *

But it is not really bad in my experience

Don't worry, SO people are usually pretty dumb.

The quality of questions there is often low.

So who cares how elitist they are?

You run strace on it yet?

I do

Not with Python though.

@J.J Yeah, it happened to me many times tbh, like I was banging my head for about 2 hours on a program where I wrote if (condition) as if (condition); making the if statement useless! And I even asked it on SO and they told me I made a silly mistake(I was blind to see that semicolon)

I gotta go

You wanna know the most evil payload for malware? Have it scan for all files that end in .c or .cpp and replace semicolons with unicode homoglyphs.

Agreed.

Did you try attaching it to gdb as I suggested?

It should be easy to find it that way.

If you build the binary yourself with debugging enabled, it will be able to know the line of source code and can bring up that line if you point it to a dir containing the source.

So you can certainly compile it so that you not only see the asm, but also see the C code line by line, which is really nice because then you can see the contents of each variable, the arguments a function is given, etc.

(You build it with debugging with -g)

I think I mentioned the book "The Art of Debugging"? It's good.

Do you know anything about assembly? Like at least the basic instructions (mov, test, etc), the register sets, flags, things like that?

You should try making a simple assembly program, like a client and server that communicate via TCP or UDP (as if they were both netcat). It'd be simple to do.

As well as bringing you through the basics like calling conventions and the like.

It's not super deep. And it really helps. :P

heh

There's nothing wrong with that.

I've never done professional pentesting, but it looks really neat.

threadreaderapp.com/thread/1063423110513418240.html

An amusing article on an experience with pentesting. ^

And once you get a foothold, so much more opens up.

I mean, security can be hard. It requires a totally different way of thinking from most tasks. But once you get into it, everything else in infosec seems so much easier.

No such thing.

I mean, if you pass OSCP and get a job, it means you know your shit.

If what doesn't? If you don't pass it?

I mean in the grand scheme of things, you won't. There will always be people who understand worlds more than you do. But that's a good thing, it means there's more to learn. I mean sure, you can't expect to be the next Brad Spengler or pump out bug reports like Jann Horn, but you'll still be useful. (Well, who knows, maybe you will!)

All you have to do to succeed in infosec is know more than the people who hire you (who hire you specifically because they don't know anything about infosec).

The other thing about security is that, unlike some other jobs, you never stop learning. Someone with 10 years experience knows more than someone with 5, someone with 20 knows more than someone with 10. There's absolutely no way that, by the time you have 10 years of experience, you'll think that you won't know shit.

Skill is not determined by knowledge / age.

Even if you start at 30, by the time you're 50 you'll have 20 years experience.

If you're persistent, you will. :P

One thing that helped me when I worried about how much I know is to consult my past self. I ask, what if I met myself from 5 years ago... How much would that person think I had grown. I realize that, if I had seen my current self 5 years ago, I'd think I was a genius. I can only expect that it'll be the same way, 5 years from know.

@J.J 5 years ago, how much of what you know now did you know?

Then what about 3 years ago?

And now?

In 3 years, you'll look back at your current self and realize that you improved as much. You'll always be improving. I mean 3 years is a lot of time.

If you managed to learn a lot about networking in just 3 years, then you can't possibly be stupid enough to not learn a whole lot more in 3 years from now. And yeah, procrastination can be an issue, but if you find your job or what you're researching interesting, you will always be improving.

I get those kinds of fears too. I mean, I may look like I know a good bit about security, but I always think to myself, what if it's just that I seem that way to others? What if I really don't know that much? After all, there's so much I don't know... But when I look at how I was 5 years ago, I realize that I have been improving.

The thing about worrying is that it's always the smartest people who worry. :P

It's not just a saying. It's an established fact that, the smarter people are, the more they worry about little things. Even if it's something small or irrational, a worrier is someone whose mind is constantly at work. If they're not working on a problem that's taking mental effort, their minds will default to trying to think about the future and thinking about what bad can happen. It's a good sign if you worry. :P

It means you weren't born as some optimistic idiot who never think things go wrong.

You know more than I did at your age.

Well nothing wrong with that. It's not like you stopped being able to learn.

It'd be a problem if you stayed up playing games well into your 20s doing nothing else.

But spending a couple school years? That's normal.

School does have the nasty tendency to make people feel dumb.

But the thing is, school doesn't rate how smart you are. It rates how well you can pay attention to monotonous speeches and pointless exercises.

Another thing about intelligence is that the smarter people are, the more likely they are to consider themselves dumb. The dumber people are, the more likely they are to consider themselves smart. :P

I mean you may not consider yourself a genius, but I honestly was impressed when I learned you were only 17 and yet not only was interested in networking, but actually knew quite a bit about it.

This probably just sounds like a pep talk but it's completely true. From an outside observer's perspective, I think you are definitely going to succeed.

Lies, you'll always be 17. You cannot age. Not in the DMZ.

Yeah most teenagers are impulsive little rats. lol

Well it's true!

Lmao I can't believe someone said that.

It's like they never saw an emo before.

lmao wow

Oh shit, didn't notice the time. I gotta go.

Was nice talking with you!

@J.J I have the opposite issue :-)

@J.J I have been in security for nearly 20 years (18 specifically in infosec) and I have no CVE's or bug reports to my name. I think I have been pretty successful in improving security for a few hundred companies, and helping many people develop in the industry

github.com/Bo0oM/PHP_imap_open_exploit

@J.J you'll find contributing will do far more for your status than focusing on status alone... Just sayin'

@J.J choose your employers well, and you'll find some really really care

I'm guessing you have not had good experiences, but trust me, even some large companies care personally. Many care financially

For consultancies, the only value may be the staff. It makes good financial sense to look after them

Security consultancy also needs the technical nerd in the dark corner

Absolutely! Otherwise what do you speak to your clients about?