« first day (815 days earlier)      last day (2675 days later) » 

6:01 PM
Would Xen work on Raspberry Pi ? I don't find much conclusive data on the Web.
@Ninefingers Mmh, deserves investigation.
@ThomasPornin That said, as I understand it ARM have added new hypervisor opcodes to their processors. I know there's a big effort underway at the moment to add support for this to Linux/KVM, so I assume there's a similar effort for Xen. Might be worth seeing what the status of this ...
... with regards to whether or not the rasberry pi ships or will ship with these chipsets.
@Ninefingers There was some work going on last summer, but I did not find fresh news.
@ThomasPornin I watch the linux-kvm mailing list. It sounds in progress at the moment.
6:12 PM
I was toying with the idea of a raspberry Pi cluster (say, a dozen of them to get things started), and using them to host a few dozen Xen-powered VM (with possibilities to migrate VM across the network) looked cool.
@ThomasPornin I'm not sure what the IO capabilities would be like - I think that's probably the biggest problem with virtualisation. For example, if you have a smartcard-type embedded storage built in that only supports a fixed number of writes before it dies, to the point projects like pfsense ship special builds for it which reduce writes to disk.
@ThomasPornin Well, this conversation is definitely 10x more interesting than the analysis assignment I am currently doing (yawn).
@Ninefingers A Raspberry Pi boots from a SD card, but it also has 100baseT ethernet. In a cluster environment, I would first try to store actual data on a network server (e.g. with NFS)
@ThomasPornin That'd work. Would be an interesting project to build for certain.
Is there an objective for this, beyond having a dozen little widget sized things running a "cloud"?
@Ninefingers Well, isn't that sufficient ?
Yes, it is mostly for the "cool" value. And learning.
@ThomasPornin Of course, but I just wondered if there was a bigger plan in mind?
6:21 PM
@Ninefingers Yep, saw that this morning.
@ThomasPornin If they can manage that, I reckon you must be able to go from there and install Xen. It can't be that hard to install. Might involve patching the kernel and recompiling, but that's not impossible provided you're prepared to match to a potentially older kernel version.
For example, the PaX patches are often against older kernels, so to use them you need to build said old kernel, not the latest and greatest.
Which reminds me, I must have a go with the PaX patches again.
@ThomasPornin By the way, out of interest do you think Schneier's Block Cipher Cryptanalysis course is a good way to learn about the topic?
Been meaning to ask that for about two months now!
@Ninefingers I don't know, I have never read it.
My own introduction to cryptography, though, was implementing linear cryptanalysis on DES (reduced to 8 rounds)
@ThomasPornin It is basically a list of papers to read and exercises to try - see schneier.com/paper-self-study.html. I have many of the papers now, and I almost have a working version of feal to test against. I just wondered if this was likely to be educational. I suspect it will, but, never hurts to ask an expert.
I was provided with Matsui's article, Schneier's "Applied Cryptography" for the description of DES, and the Biham-Shamir book on differential cryptanalysis for the correct description of DES (that damned Bruce got one permutation backwards).
@ThomasPornin Haha, the last thing you need is a bad algorithm description or test vector. I got myself rather confused with Salsa20 a few weeks ago because of the whole endianness thing.
6:36 PM
I think actually implementing an attack is the most efficient way to understand the gist of it.
@ThomasPornin In the same way reading maths is great, but until you try to solve problems you don't learn all that much I guess?
@Ninefingers In a way. But for computers, you need to get the practical details, which articles usually do not cover.
@ThomasPornin Hmm ok. Well, this week I am going to implement feal in haskell (because I can, not for any other reason) and then I am going to (try to) break it.
mmh, Raspberry Pi resellers appear to be out of stock for now.
Why does Google Chrome suggest that my C# code is in Czech ?
Amusing: translation from C#-as-Czech into English apparently involves moving words and other signs around, so that "} else {" becomes "Else {}".
reminds me of MSDN being "helpful" machine translating its articles to German
6:49 PM
@CodesInChaos They aren't always that helpful in English, tbh.
The Win32 articles usually are, the .net ones typically not
@CodesInChaos I agree, although the driver stuff can be mixed, particularly if you're entering areas That Are Not Documented (tm) so stop trying to use them.
The .net docs often look like they're created by ghostdoc
documenting a property Foo Foo{get;set;} as "Gets or sets the Foo" is so helpful MS...
Microsoft has apparently switched to the "document by blog" fashion
@ScottPack Yaaay!! Thank you thank you!
6:54 PM
@CodesInChaos The worst part is that they used to be better. Somewhere around the release of .Net 2.0 they went way downhill.
Win32 is an ugly API with nice docs, and .net is a nice API with useless docs
@ThomasPornin Very true.
One of my pet-peeves is not documenting what they use as default argument on overloads with fewer parameters
Q: Simple solution to XSS

Cedric MartinI've got an idea as to how to defeat XSS so simple that it may work and was wondering if anybody had already done something similar. The goal here is not efficiency but security. In other words I don't care about trading bandwith for security. My idea would be to serve every single character i...

wow just wow
@ThomasPornin wouldnt it be cool if Google Translate could switch between C# and VB? Or Java or...
@CodesInChaos LOL...Yeah, that's kind of important information.
6:58 PM
@CodesInChaos Blame the tech writers who do not understand the code.
@AviD there are auto-translators between C# and VB.net
@AviD VB is not cool.
@CodesInChaos An outrageous claim! I mean, what is wrong with in/out parameters in whatever order you feel like, typedefing away pointer symbols, typedefing everything into upper case, typedefing all your sizes into different names and then using them totally inconsistently and so on?
@ThomasPornin Of course not. But I was actually thinking the other way around.
@CodesInChaos and they suck. Suck hard.
@CodesInChaos that annoys me, but it is usually clear, even if not explicit.
@AviD how so? I didn't use them much, but looked fine to me
7:01 PM
@RoryMcCune interesting. So, I was half-right... what is this proprietary thing?
looked like HDMI in the pics...
@CodesInChaos well, for one thing - you cant straight compile the output. Which would be a basic test, the simplest requirement.
and thats not even getting into semantic sugar.
tbf, most auto-generated code is usually poor. But I would still expect it to compile, even if it is ugly.
you're actually better off compiling, then decompiling from MSIL.
One of those surprised me by changing the size constant of an array creation expression
apparently VB.net doesn't use the array size for that
7:32 PM
I answered a question and it it's now on the SuperCollider. It will soon get some traffic and I don't want to be epically embarrassed. So does anybody see anything wrong with it so I can try to correct it?
@Adnan Looks accurate to me.
God I love cops
@LucasKauffman The show, or the people working in law enforcement?
7:48 PM
@Xander The show
well both probably
@LucasKauffman Good guy Lucas
The only police I don't like is the Mossos D'esquadra in spain
those guys are real douchebags
@Adnan while it doesnt look wrong to me, what is odd is that browsers are not supposed to send the current HTTPS URL in the Referer header when redirecting to an HTTP URL.
I'm sure Google knows better than I, but I doubt it.
@AviD Any reference for that?
@LucasKauffman I've worked in the Israeli Police (IT dept) for about 3 years. While most of them are good guys (if a bit "police-headed") there are some units - such as the "crowd control" units" - that are real bastards.
@Adnan nah, just the RFC.
> Clients SHOULD NOT include a Referer header field in a (non-secure) HTTP request if the referring page was transferred with a secure protocol.
8:01 PM
@AviD Agreed.
@Adnan also in the wikipedia page you linked to:
> If a website is accessed from a HTTP Secure (HTTPS) connection and a link points to anywhere except another secure location, then the referer field is not sent.[
Okay, I think there's a misunderstanding here. Allow to explain
sounds reasonable to me
I would have used the same rule
except perhaps sending the domain but not the rest of the url
In both cases (ads and normal search results) the browser (the client) is working properly
But, in both cases, you're going to the destination website through Google (so they can track the results you're clicking)
Since you're using their service, they're free to attack whatever headers they want
It's in their best interest to tell their advertisers about your search query
"through Google" means a redirect, right? I.e. the clicked URL takes you to Google, and they 302 you back to the advertiser. Right?
8:06 PM
@AviD It appears so
so at which point does the browser attach the Referer header?
let me check
I've Googled "test"
I assume all those URLs are on HTTPS.
and this is the link to the first result
@Avid @Adnan Yup, if you use www.google.com, and no, if you use encrypted.google.com
8:07 PM
note: I'm using HTTPS
Also how would google control the referer header - its attached automatically (or not) by the browser itself?
@Adnan on www or encrypted?
Just ran a live test in Firefox and Fiddler
@AviD https://google.com
When I clicked on an ad on www.google.com
Same ad on encrypted.google.com
Y U NO LET READ?? :-((
8:10 PM
Trying again:
@AviD yea same with mossos, they pulled me over with my friend when I was 16 at 1200 clock at night telling us we took cockaine
they hit me in the head
@AviD Their redirect page have something like header("Referrer: $strippedReferrerURL");
Less irrelevent data this time, and no cookies. :-)
Referer: google.com/…
while they were searching me
That was www.google.com
8:11 PM
@Xander https?
And no referer header at all when I used encrypted.google.com
@Xander both on HTTPS?
Yes, both times HTTPS on Google, redirecting to HTTP
so why was the referer header there on https//www??
@Xander Then yes, same results when I tested
8:12 PM
I see now.
wait a sec, @Xander you said Firefox? @Adnan what browser did you use?
@AviD I tested with Chrome and Firefox
Using Wireshark
@Xander see what now?
From www, the last hop is an HTTP request to Google before they redirect you off to the advertiser.
@Xander let me guess, they either set a 3rd party cookie (which contains the referer), or they concatenate the referer at the end of the URL?
8:14 PM
From HTTPS www.google.com, there's first a redirect to HTTP googleadservices.com before the redirect you to the advertiser's site.
@Xander ahh, close enough.
@Xander Yup, same here
Still, kinda dodgy - you're on HTTPS, but they feel all kinds of free to switch you silently to an internal HTTP URL...
Basically, they force the referer to be sent to the advertiser, getting around 15.1.3.
Not quite evil, but a bit smelly.
@AviD I guess in this case revenue trumps correctness.
Luckily their slogan is "Do no evil", not "Don't be smelly".
8:18 PM
@AviD LOL...And from what I've heard, they've quietly disappeared that motto in any case. Didn't like being expected to live up to it in the end, I guess.
@Xander While I like quite a bit of their software, I never considered them non-evil.
@AviD I agree, on both counts.
@Xander Still running Fiddler?
@Adnan Not capturing at the moment, but yeah, it's still up.
@Xander Give this[https://duckduckgo.com/?q=test] a try
8:22 PM
@Adnan K, one sec.
anyway, bottom line - www. redirects you to an HTTP launchpage, whereas encrypted. does not, regardless of HTTPS-ishness?
@Adnan if you wanna aim for epicness, you should modify your answer to take all that into account. Prevent nitpicking arseholes like myself from considering your answer to be off.
@AviD encrypted is always HTTPS
@Adnan yes, but the point is it does not redirect to HTTP launchpage, whereas www does, even if www is HTTPS.
Is that correct?
Evening. @avid - just wasted ten minutes of my life reading that. Summary is 'I should be ranked up there along with these other geniuses. I am just misunderstood' and to summarise that : I have not learned anything. ..
@AviD wait wait, let me read your question a couple times first
8:25 PM
@Adnan heh, sure
@RoryAlsop hehe, oy. I didnt bother, I skimmed it.
@Adnan that's what I got from the DuckDuckGo request.
There was a few hours over the weekend where I thought he might be getting it, and I was so pleased with myself.
@Xander I can't tell what happens with the referrer when you click a result
@Xander On Wireshark, everything is cool. I just wanted another eye
8:27 PM
@Adnan Ah! Ok. You didn't mention that. I need to adjust the test case and run it again. :-)
@AviD Correct
and in the ecrypted.google case, it redirect to an HTTPS launchpage
@Adnan so thats the detail you should add to your answer, for bear-level epicness.
@Adnan Yup, no funny business here. It's a straight HTTPS to HTTP redirect, no referer sent.
@Xander Great! DuckDuckGo is working its way up to be my default search engine.
@Adnan is that just for ads, or for any search result?
8:30 PM
@AviD If you, or @Xander, want to add it, you can add answer or edit. I don't want to go into much details.
@Adnan You should see the same thing when you click on Google results. It's only the ads they mess around with, allegedly. I didn't test that though.
@Xander feel like testing Bing...? ;-)
I really need a good ads supplyer
anyone got suggestions besides adsense?
@AviD LOL! It's be fun, I know, but I really should get some work done this afternoon. :-)
@Xander @AviD No. There's still HTTPS->HTTP redirect happens (even normal search results).
8:32 PM
@Adnan But they don't append your search terms to it, right?
@Xander No
@AviD, actually, I'll edit the answer.
@Adnan heh. Go Bears!
@Adnan Ok, that's in line with what I'd expect.
@Xander What's confusing is why not use HTTPS->HTTPS->HTTP/s redirect?
Why are they doing HTTPS->HTTP->HTTP/s?
In the case of https://www.google.com of course
@Adnan in order to be able to force the browser to include the Referer header.
8:37 PM
@Adnan Because they want the site that's getting the traffic to know that it came from Google. They also want those sites to buy advertising in order to get the search terms that caused them to get the traffic. encrypted.google.com is just a tool that I expected they offer grudgingly to people who can find it to actually expect them to do things correctly.
If it was HTTPS->HTTPS->HTTP/s it wouldnt be there.
@Adnan They're a very profitable company because they've been able to show people that they're a huge source of traffic. No referer == much harder to tell.
Duuudes! Allow me to explain
Google says, when you use https://www.google.com and you click a normal search result (non-ad) they will not send the search query to that website.
In this case, yes, you're right. They do it (the HTTPS->HTTP->HTTP/s thing) to tell the websites the visit is from Google
Damn! Sorry guys, now I see what you're saying and what I'm saying. I just misunderstood both of you.
Thanks @Xander and @AviD
@Adnan No worries. In case it's non-obvious; the Listen Subscriptions list are my podcast subscriptions. All of them, not just technical or professional.
@AviD I'll rewrite the whole answer. Can't find a way to edit this information in
8:46 PM
@Adnan I think an addendum would suffice. It's pretty good and accurate information that you have, it's just missing that one nitpicky piece. Most people would not be bothered by it.
Especially those pulled in by the collider... :D
sounds like @ThomasPornin... :D
Hey, @AviD, all the recent drama got you a badge ! Isn't it swell ?
@ThomasPornin really? missed that.
You apparently got "analytical"
ahh, the about page one.
9:01 PM
"analytical" is for the FAQ; the one for the about page is "informed"
@ThomasPornin ah yeah, well I popped em both.
@Xander Can you please confirm the following for me?
"While using `ecnrypted.google.com`, if you click on a normal search result, the website will have no idea where you're coming from"
Is that correct?
@Adnan Yes, that's correct. When I click on an organic search result, no referer header is sent at all.
@Xander Do you think that using Fiddler for this purpose have any advantage over Wireshark?
@Adnan That is confirmed, rather. I did just try it, I'm not assuming. :-)
9:08 PM
@Xander, because I'm always getting the same results as you, using Wireshark.
@AviD Do mods have separate badges, like "first ban"? :p
@Adnan It's less noisy by default, and it has HTTP specific tools which I like and use pretty regularly. I hate Wireshark. I only break it out when I have to do non-HTTP nastiness. Last time it was to hunt down Kerberos issues on a client's network.
@Adnan shouldnt make much difference, one is a transparent proxy the other is a passive sniffer. Either way the traffic should be the same.
@LucasKauffman hehe, sadly no. Besides I popped that cherry a long time ago...
@Xander there is that. but for correctness, it would be the same.
@Adnan I use Fiddler nearly daily. I can craft REST requests, and whatever else I need and run them right there.
@Xander for HTTP, Fiddler rules.
9:10 PM
@Adnan Yeah, they'll give you exactly the same data/results.
@AviD Definitely.
@Xander Thanks. I use Fiddler at work, for security-related tasks (injecting SQL in the user agent, for example). Since I'm still new at this, I had to be sure.
@Adnan Yup, your assumption is correct.
Ahhh.. much better
A: What is the difference between https://google.com and https://encrypted.google.com?

AdnanAccording to Google, the difference is with handling referrer information when clicking on an ad. After a note from AviD and with the help of Xander we conducted some tests and here are the results 1. Clicking on an ad: https://google.com : Google will take you to an HTTP redirection page whe...

Q: What should someone learn to get into IT Security?

TwinbornI want to learn about security. How to monitor systems, mobile devices, computers etc. What sort of stuff do I need to research to get into my own devices and monitor/change things, be fluent in Linux systems and code? Thanks

kill it
with fire
@Adnan excellent.
9:15 PM
@Adnan Nice! I'd upvote it, but I already did, so I can't.
@LucasKauffman find me a dupe.
One should learn IT Security to get into IT Security. — Adnan 25 secs ago
it is quite narqish, and shows complete boorishness and confusion, but I'd rather point him at a real question.
@AviD I think most of the dupes have been closed as not-a-real-question for being too broad.
90% of his question is about topics which are only tangentially related to his real question.
9:19 PM
@ThomasPornin I love that movie!
@ThomasPornin the funny thing about the matrix is that the exploits used are actually real
@LucasKauffman ... up to the point where hacking turns into punching people who wear formal suits, of course.
its always a good day when you spend an hour talking to John Romero about how awesome quake and doom were
@ThomasPornin wait, that's not real? That was the main reason I got into infosec...
9:22 PM
@LucasKauffman I don't remember any exploits in the movie?
at least not in any detail
Actually, there's no need to.
@lynks Matrix?
it was the openssh vulnerability
The only "real" "hacking" I've seen in a movie.
don't remember any hacking from matrix
@CodesInChaos It was in the second movie, near the end.
9:24 PM
only watched the first one
But a much more classic reference is "War games", of course.
I posted the freaking screenshot!
@Adnan ahh the good old 'reset root password' command. handy that.
@lynks Duuuude! She used sshnuke (some imaginary exploit)
@Adnan heh yeah i just looked a bit closer :P
9:27 PM
@ThomasPornin I love that movie too. Not as exciting as Matrix, but you can't go wrong with an antagonist named after a hamburger.
Actual port scan, attempting an exploit on the running service, actual commands. That's brilliant!
Have you seen the movie Hackers?
@Adnan No. Watched the first 15 minutes or so, and it was so terrible, I had to cease and desist.
@Adnan probably, but I don't remember anything
but I think it made no sense what-so-ever
They "hack" by flying simulated First-person spaceship through some computer chips with some bunnies eating carrots or cookies
@Adnan we used to watch hackers like once a month :P
9:30 PM
Compared to that, the scene from Matrix is an IT security class.
i can quote the whole film verbatim
@lynks Where do you get your stash?
@Adnan stash?
I've always felt that Swordfish had just about the most over the top depiction of "hacking" in the history of film.
@lynks I assume you need to be pretty high to watch it every month.
9:32 PM
@Adnan with the security group at uni, it was just a tradition :P
@lynks Oh yeah yeah. I also go every week with the "security group at uni" and watch some Charlie Chaplin before going to some club.
Jesus! Why do I say these things! This is a public chat! I have a link to my SE profile in my CV!
@LucasKauffman am I missing some context here?
@Adnan So very tempted to star this. If you were in the Comms Room it would already be. :-P
9:42 PM
18 mins ago, by Adnan
user image
@Ladadadada Thank god I'm not in the Common Room. The guys there are very mean :(
@AviD, is the rep cap for each day or for every 24h period?
@RoryAlsop ^
Meaning, is it for [00:00 - 23:59] of each day, or is it in any 24h period?
9:58 PM
@Adnan no, I meant what did @ThomasPornin say that brought this up?
@Adnan yeah, here we're just a big pile of sugar and spice.
@Adnan I believe it is for a calendar day, UTC.
@AviD Monday morning + SuperCollider = No edit restriction very soon for me
@Adnan hehe, good luck.
@Adnan you've pretty nearly blown your cap on that one answer, already.
but I'm sure this gives you some data for your reptrain research.
@AviD Indeed. I'm getting closer and closer, soon I'll come
with a formula
Trap. Set!
@Adnan It's for each period from 00:00 UTC to the next 00:00 UTC.
@LucasKauffman Hmmmm... same guy, same question. Totally different result.
Q: How to learn how to program?

TwinbornI would like to know the best methods for learning to program. I've been directed towards the Python language because I was told it is good for beginners. I ultimately want to make games for OS X/iPhone. My problem is that I understand what I read but I can't apply my knowledge to anything. I am...

10:12 PM
@Ladadadada heh. so he tried that for a few years, gives up, thinks security is easier?
btw I think the reason it had success on SO 3 years ago, has more to do with it being 3 years ago than it being on SO.
If someone tried that today it would have probably gotten the fire.
@AviD Absolutely. I'm reminded very much of this: bash.org/?3936
Reminds me of dogbert's (or was it rat?) Self Help book to stop reading self help books.
10:29 PM
@Ladadadada @AviD The SE question was also far more specific. "I've been told Python is a good language for beginners, my end goal is to make games for OS X/iPhone" That's a lot more to work with than "I want to get into IT Security and learn Linux"
@Xander That always bugs me, when they say "I want to get into security, so I'm learning Linux" or "I know some Linux so I'm good at security".
Sure, learn it if you want, more knowledge is always good. But Security != Linux.
As I've commented.
@AviD LOL. But Linux is so l33t!
oh! Just now saw what you fellers were on about. Hadn't seen @ThomasPornin's answer to that q before.
10:47 PM
Congrats, @Adnan: you should get your mortarboard badge shortly (don't know exactly when, probably next night). You are now 2% epic.
11:11 PM
I'm a bear!
I'm a beer!
I'm a bore!
@WesleyDavid Truth.
11:21 PM
@ScottPack he said Bore, not Whore.
@AviD Well I wasn't done with confession time yet.
And after dropping that bomb, I'm going to go iron some clothes. You may show your appreciation by upvoting all my things in such a way as to not trigger the abuse code.
@ScottPack You're so domesticated.
I've also been doing laundry all afternoon. Last load is in the dryer.
@ScottPack Oh I'm sure it is.
11:23 PM
If only
Toodles darling.
I hope to talk to you soon!
@WesleyDavid you mean emasculated.
@AviD I mean eviscerated.

« first day (815 days earlier)      last day (2675 days later) »