« first day (839 days earlier)      last day (2933 days later) » 
02:00 - 23:0023:00 - 00:00

2:19 AM
Password must contain a capital letter, a number, a plot, a protagonist with some character development, and a surprise ending.
2 hours later…
4:17 AM
2 hours later…
6:41 AM
morning :)
@LucasKauffman Morning morning!
7:28 AM
Morning morning morning
7:39 AM
@RoryAlsop 3 "Morning"s!! What kind of sorcery is that?!
ah hell, I'll go there morning, morning, morning, morning
that feels oddly catch 22-ish
Question: when reviewing edits that just add a tag, do we reject them as too minor, or do we accept them?
@AntonyVennard I think it should be accepted if the tag is relevant.
@AntonyVennard Here's what I do. If the tag is just relevant, I reject as too minor. If the tag is essential (expresses the core concept of the question) I accept it.
Okay. In this case, rejected cause I've spotted other issues that should have been fixed too.
8:13 AM
@AntonyVennard Do you think it's better this way?
@Adnan Yep. It still looks a bit like a shopping question, though.
@AntonyVennard Well it basically is, right?
@Adnan Yep. Those are sometimes off topic, although, we'll see how it goes.
@RoryAlsop @AviD @JeffFerland you guys interested in an explanation on how DNS Amplification works? (related to security.stackexchange.com/questions/33565/…)
or is someone already busy with that?
@LucasKauffman Are you asking for someone to explain, or if someone interested in reading the explanation?
Also, that question is asking about mitigation techniques
8:20 AM
@Adnan I'm thinking of making a blog post about how a DNS amplification attack works, so explaining it
I had a talk about a few weeks ago with a guy that used to work for the .eu top domain
it was quite interesting
@LucasKauffman In that case, sure. I'd be interested in reading about that.
Borderline off-topic?
Q: What is the origin of the three factors of authentication?

thelionroars1337The three factors of authentication - something you have, something you know, something you are - are ubiquitous in security literature, but I have yet to find a reference to the origin of the paradigm. Can anyone shed some light on this?

8:37 AM
@lucas - definitely worthwhile to have a bolg post on that topic
@adnan - I think it's off topic, but will wait to see how votes go
8:49 AM
Wow, that application crash question is rep-training rapidly
@RoryAlsop Very surprising to me as well. It fits neither my "formula" nor @Terry 's
@RoryAlsop Get your monkeys in quickly!
9:25 AM
I'm all monkey-ed out
2 hours later…
11:02 AM
ok, here's my review of Kali:
3 weeks of solid use, and I've had to re-install the OS twice. Fail.
@Polynomial Would please be more specific?
@Polynomial I always reinstall my OS after every engagement :p
@RoryAlsop I totally could have caught that one too. Decided to push someone else through the closing doors. (How far can we extend this analogy?)
@LucasKauffman That one write there, is gold.
it just keeps things clean, last thing you want to do is mix up evidences
11:18 AM
@Polynomial Should've seen Ubuntu back in the 6.06 days (i.e. when I first started using Linux) or Fedora Core 2. Things have gotten better.
Actually, just last year ext4 kept corrupting itself on my luks volumes. Been better since I switched to xfs, but being dumped into dracut and being told to run e2fsck is not good.
@Polynomial Do you recommend any other pentest distro? I was thinking of looking at Kali having seen the ad here, but now, I'm not so sure ;)
11:36 AM
I expect that it going to be teething troubles for a while with Kali, they have jumped Linux distros from their original Backtrack days. It'll settle down eventually (he says re-installing windows...)
@AntonyVennard So do you recommend XFS instead of Ext4 for Ubuntu?
@Adnan Hmmmmm, that's a hard one. I successfully use ext4 on top of lvm for a raid volume on normal disks. I simply personally had a lot of corruption issues for the root volume on an SSD.
The SSD itself worked fine - sata leads replaced etc.
The one downside to xfs is the inability to shrink it should you wish to later.
So, in answer, I'm personally a tad paranoid about using ext4 now, but hopefully that'll settle down. My RAID has never had any issues and I've been backing up like you've never seen.
@Adnan So to answer that, not unless you have a specific reason to use it and/or a bad experience with ext4.
One of these days btrfs will become stable and all will be good, but until then...!
11:53 AM
@AntonyVennard Aha, alright then. Thank you for the explanation. Currently I have no issues with Ext4, I'm happy with the overall performance and for my usage I think I'm not gonna mess around with other file systems.
12:03 PM
@Adnan menu died randomly due to their stupid menu package thing, you can't clean config or re-install the package, so the entire thing becomes useless
so I re-installed it
then it was doing an apt-get upgrade and ran out of space on the disk (limited VM size) so its idea of "the safe option" was not to roll back the updates and warn me, but to fucking reboot mid-update.
so it completely screwed gdm3 and gnome-shell
and the whole thing died horribly
@AntonyVennard BT5 is still good, but I hear good things about backbox.
@Polynomial I'll give it a spin in the next week, let's see.
a few people who've used it on and off as quick play-around have found it ok
but it's flaky as shit for day-to-day use
@Polynomial Then I guess in the meantime I'll stick with BackTrack5 for day-to-day stuff.
today i was victorious over the bear, let it be written.
@lynks Bounty?
12:18 PM
@Adnan yep :P
@lynks Lucky bastard!
@Adnan was it your bounty?
@lynks No, it wasn't.
@Adnan yeah I don't really understand, but I'm happy to take it and run to the hills.
perhaps this is the universe congratulating me for finally getting our database schema definition into version control.
@lynks Once the bounty expires the grace period is over, the 50% of the bounty amount is awarded to the answer after the bounty with score of 2 or more.
@lynks To be honest, that's something!
12:20 PM
@Polynomial runnn forr yourr lliiIIIIIiiiFFEEEE
ok, that's going on the jukebox
@Polynomial followed by fear of the dark?
I've got plenty of stuff to put on the jukebox now.
from Maiden to Foo Fighters
@lynks One of the best songs in history?
12:24 PM
@Adnan fear of the dark is certainly my favourite maiden song :P
@Polynomial I was about 15 ft away from Dave Grohl a couple of weeks ago
@Polynomial To be fair, they just got started with the distro. They will probably need time to sort out the bugs.
@lynks Paused Moonsorrow, playing Fear of the Dark.
@TerryChia indeed. it still sucks for now.
@Polynomial it was at this keynote, youtube.com/watch?v=Efv0Y5Fs7m4 well worth watching if you have a spare hour.
12:26 PM
@Polynomial I wouldn't go as far as saying it sucks. But I like the whole organization concept of Kali much better than BT. Give them a while to sort out the issues and it will be great.
yeah, it is cleaner than BT
but it still breaks horribly every other day :P
@TerryChia yeah I like the idea of Kali. But to be honest I've never really got the whole 'pen testing distro' thing. I mean, how hard is it to apt-get install nmap, dpkg -i metasploit etc?
@Adnan I have used XFS for some years but I found it disappointing: when you delete a lot of small files, it tends to stall completely for several seconds, a dozen seconds after the deletion. Quite inconvenient when you do Java development (where you tend to often delete then recreate a bunch of .class files).
@ThomasPornin Interesting. Why do you think that happens?
@Adnan As far as I know, XFS has been optimized to handle very big files gracefully (e.g. appending to a file which is already in the gigabytes range still works at top harddisk speed) but this required some special layout of metadata, which implies some reorganization when structural changes occur (e.g. when adding or deleting files)
Filesystem design is a bunch of heuristics. It is very hard to make a filesystem which is efficient both for small files and for big files, and still robust with regards to power cuts (journalling and similar tricks)
12:45 PM
@Adnan Yeah. In fairness, my issues may have been self-inflicted as I was messing around with mount options. You need a special invocation to TRIM correctly with a LUKS volume and I don't think that helps. The defaults seem safe.
Basically the choice of XFS was "what else is supported at install time by Fedora that isn't ext3" and XFS was the only one, aside from say FAT12, which I'm not using for obvious reasons.
@lynks Well, those are the main ones for sure. But there are some nice tools that are less often used. It's handy to have all the tools available right there.
Plus some tools aren't in the repos of the normal distros, so building them yourself is quite troublesome.
@lynks Also, they could just make a metapackage (or whatever debian calls them) so you can do apt-get install pentest.
@TerryChia I don't know, I'm pretty sure I could fully arm a blank debian install in less than an hour.
and besides, half the 'tools' i use i wrote myself
but i understand this is not how the industry operates :P
@AntonyVennard I think that's what they are moving towards for Kali.
> Some packages obviously had to be forked in order to implement some of the Kali-specific features but Kali strives to keep that number of packages to a minimum by improving the upstream packages when possible (either by integrating the feature directly, or by adding the required hooks so that it’s trivial to enable it without actually modifying the upstream packages).

Each package forked by Kali is maintained in a Git repository with a “debian” branch so that updating a forked package can be easily done with a simple git merge debian in the master branch.
@lynks :|
12:53 PM
@lynks Sure. But it's nice to save the effort if there is a prewritten tool that does the job. Besides, Kali is quite lightweight imo.
@TerryChia :O I didn't know that the chat can do this "(see full text)" thing. Nice!
@TerryChia yeah its certainly pretty cool
1:45 PM
morning morning morning
@TildalWave morning morning
@TildalWave mornorning
(awkward silence ensues)
Are we done being polite now?
tell me, why did you say 'good morning' when you know perfectly well that it's the afternoon?
for the uninitiated: youtube.com/watch?v=zP0sqRMzkwo
@lynks I'm nocturnal and live on Mars :P (25 hour days)
1:51 PM
@TildalWave ring ding ding ding ding ding
@Adnan So etymology of security related vocabulary is OT?
@lynks why with Portuguese subtitles?
@TildalWave that was just the one that I found first
@lynks OK so now I know that the Portuguese word for ding is ding
@TildalWave one day that will be useful.
1 hour later…
3:02 PM
Do you think it is against ethics to publish a 0-day vulnerability? I've found a serious security issue in a widely-used website. I personally am not interested in abusing it, but rather have its bragging right. Am afraid that the website owner would fix the bug and treat as if it were never there. Any help on that?
@SeMeKh Yes, it's totally unethical to publish without giving the site prior warning.
Take screenshots and document the bug if you want bragging rights. You can publish if you give the site ample warning and they still didn't fix it.
@TerryChia well, I'm aware about that. But what's your suggestion then?
Do they really work? I mean, they can be easily faked!
@SeMeKh Make a video showing you exploiting it, blur away all the details that would allow reproduction, share however you want, inform the vendor, wait until you hear back from them.
@SeMeKh Like I said, document everything properly with screenshots and the likes. Alternatively, go through something like zerodayinitiative.com if the bug is serious enough.
You can even make some good cash if they accept your report.
@lynks And so it was written: even a blind squirrel finds a nut once in a while.
3:08 PM
@SeMeKh Without disclosing any details about the vulnerability itself, would you disc louse the name of the vendor?
@Adnan Not a worldwide vendor. blogfa.com
But it's almost the most-widely-used blogging service inside Iran
@JeffFerland question: if there were an infinite number of blind squirrels on an infinite plane containing 1 nut would the nut ever be found?
@SeMeKh Have you informed them yet?
@Adnan No, I haven't
3:10 PM
That's why I'm afraid they would totally deny its existence
Fine, I think I'd go the screencast way.
@SeMeKh I'll be honest with you. I have some experience specifically with at least 2 Iranian websites regarding SQL Injection (which I think it's what you found). They never replied to my email and didn't fix the issue. Probably after a couple of months they silently fixed it.
@lynks ∞/∞ == 1, and it's a ratio, so yes. One squirrel will be on / in / surrounding the nut.
@JeffFerland Jesus! That's scary!
So, I believe that guy. I'd say if @SeMeKh does the same format, we'll believe him.
@JeffFerland 1 squirrel, infinite plane, 1 nut?
3:13 PM
@lynks It would take, on average, an infinite amount of time. :)
@SeMeKh I had a similar problem not a week ago, and the consensus was that I should write an anonymous email to the site and explain in detail how easy it is for someone to exploit it
@Adnan Not a SQL injection. Overall, Iranian sites are too vulnerable. But this one -- being defacto blogging service in Iran -- tends to care for its users security.
@Adnan Having that said, they may deny its existence because (I know) they fear losing their users that way.
@SeMeKh Well regardless of the vulnerability itself. That's what happened with me. I'd say screencast it, brag about it. Just don't disclose enough information for others to exploit it.
@SeMeKh Of course that's just my opinion.
@Adnan Fine, thanks btw.
@Adnan That might actually get him in a lot of trouble
3:17 PM
@TildalWave Not really, why do you think so?
@SeMeKh Legal issues.
@TerryChia It's Iran.
@Adnan IANAL. :P
@SeMeKh I said it might as I don't know the background and I'm just reading your posts here and the question. Not sure, did the process of learning about this vulnerability involve some illegal activity (depends on local laws as well), or did you stumble upon it by pure chance?
He'd face "legal" issues if he hacked Khamina'i website or some Rev Guards service. Other than that, I don't think he'll face much troubles.
Of course that's just what I know. The real situation might be different.
@Adnan I like the way you think.
@SeMeKh Geeee! 136 global! 3 Iran! That's some important stuff!
@SeMeKh I think that the best way forward is to consider what those that can solve this issue would consider most decent of you, without resorting to FUD
@Adnan although that seems to be correct, it's a bit funny :D
3:26 PM
@SeMeKh BTW, does the vulnerability have any anything to do with sanitizing user posts for XSS? Just reading your other question here and wondering if it's connected?
@SeMeKh But for what it's worth, IMO the way you have shown URL sanitization should be considered sufficient, I don't see any way to exploit that (provided the escape_double_quotes escapes URL encoded double quotes as well)
3:42 PM
@TildalWave Nope, not related to that. I was just pentesting some famous Iranian services, and it was related to another blogging service "blog.ir" :D
They digitized @AviD :))
should break 30k today, w00t
@Polynomial I'll make sure you won't. DOWNVOTE RAMPAGE!!!
@Polynomial Already done! Hwahahahaha!!
3:53 PM
@Polynomial oh you rep whore you realize you've made me your sockpuppet now and go read your answers I didn't up-vote before?!?
Or should that be rep pimp? :O
@TildalWave Self-pimping = whoring. AFAIK
@Adnan but it's not self in this case :P
@Adnan Yeah,... so what does that make me? :(
a motherfucking P.I.M.P. ^^
3:59 PM
@Polynomial reading your answers, I don't think you mention zombies often enough! gotta love zombies!
@TildalWave "cause i walk with a limp like an old school pimp"
this conversation makes my eyes bleed
@TildalWave zombie zombie zombie zombie zombie zombie zombie MUSHROOM MUSHROOM
@Polynomial your question is making me feel like a noob, are you talking about the mutexes used to communicate with a kernel driver?
@lynks mutexes are system-wide syncronisation objects. they can be used for lots of things.
4:01 PM
so for example, Firefox creates a mutex to check if a second FF process is running
@Polynomial yep, got that, so its just a generic fingerprinting approach? why would malware not randomise the mutex 'name' (do they have names?) with each run?
Note: system-wide mutexes, with a name, are a Windows feature
@lynks they have a name, but randomising them wouldn't make sense - how would the second executable find the name of the first one's mutex?
@Polynomial i can think of a few ways, hash of some system-property like a mac address?
4:03 PM
@Polynomial Now there is a way to do that
some generate mutex names based on system info (e.g. OS product serial) so it's unique to that machine
but 90% of the time the mutexes are static
it's not meant to be a concrete method
it's just a quick way of detecting potential signs of breach during a build review, as part of a larger test script
so your approach will only work for malware authors that use a static name mutex name?
ok i understand now :)
take a space of, say, one million possible mutex names. Have each malware instance lock 3000 random mutexes in that space. If there is another malware instance, chances of a collision are very high.
@ThomasPornin then I'll just scan for all of those mutex names.
not hard.
at some point I'll modify my checking algorithm to accept regex
but for now... cba
@Polynomial Generally speaking, if malware succeeds in detecting itself, so can you
4:05 PM
that's what I'm relying on.
@Polynomial - 8 points to go... wanna go do four edits? :P
@TildalWave You don't get rep for edits when you pass a certain point.
After the 2k mark I believe.
@TerryChia Oh :( yeah figures... so how could he make 8 rep?
oh... doh! One up-vote and one down-vote ... hmmm
@Polynomial 30k. :)
4:08 PM
what's with that unupvote?
I was the only one that up-voted on that answer today, and it looks like the system unupvoted it automatically. What the...? I realize there's a need to detect sockuppeting for users with more than one account, but what's with this? The answer is actually great and shows a lot of effort. I'm not allowed to support answers from individuals I trust and make sure my upvotes are equally distributed among members even if that's not necessarily deserved?
i actually just advised someone to use 'some kind of iteration' , couldnt help being reminded of this;
@TerryChia 30k indeed
@Polynomial gratz :P
30k party, everyone get wasted!
man i havent said that since my WoW days
4:16 PM
@lynks My cousin, working on her PhD in something involving lit, hates that one :)
@Polynomial gratz on 60
80 these days
@Polynomial pfff it will always be 60 in my eyes
AQ40 was hard
and is pretty much the inspiration for the final raid of my mmo
@Polynomial Nice! Congratulations! If I can maintain my current rate of approximately 55.6 rep points per month, I too should hit 30k, 'round about...October 2055. :-)
it always speeds up as you learn and get more latent rep
4:41 PM
@Polynomial Yeah, it was just amusing to calculate.
@Polynomial I'm almost there! Major release today and lots of beer.
@Polynomial Now just a bit more effort to pass @Rory.
@ThomasPornin oy that's ambiguous Rory'ing :op @RoryA is the approved short form for that rory
@Polynomial I'm still puzzling over the ROT256-ECB thing. I feel it supposed to be something like ROT0 or ROT26, but can wrap my head around it.
5:08 PM
Anyone else been on the HTG Discourse board? Kind if interesting the way discussion threads sort-of display similar to SE chat rooms - linear by post time, with links back and forth between reply posts.
@Adnan wassat?
@Adnan ahh i get it
@lynks Explain it to me then, please.
@Adnan so take ROT256 as a block cipher with a block length of 8 bits (which is implicit from the humor).
@Adnan it just works as an identity function, returning the plaintext untouched.
@Adnan ECB is the mode of operation, which just means encrypt each block separately, one at a time.
@Adnan so ROT256-ECB(message) = message
@lynks Ahaaa.. so that's what I was missing, the 8-bit blocks.
@lynks Thanks, buddy.
@Adnan noproblemo
5:17 PM
Ambiguous @rory-ing ... Sounds like something from a party in the seventies
Do we have a @poly passing me pool? I suggest the 10th of April.
@lynks Actually, no, I still don't get it. Operating on 8-bit blocks means encrypting each letter by itself (since generally, each 8bits are 1 char). Using mod 26, ROT256 = ROT22.
So ROT256-ECB("ab") = "wx"
I'm genuinely trying to learn, so I'd be happy if someone corrects what I got wrong.
Maybe @RoryAlsop, since you're already here.
5:33 PM
Probably most famous ECB (electronic codebook) encryption example
Doesn't :P
@TildalWave Any idea about that ROT256-ECB thing?
The way I read @Polynomial's sig is "I might joke about but my answers aren't random"
@TildalWave According to @lynks it ROT256-ECB keeps the text unchanged. I feel that it should (similar to @makerofthings7 ROT26), but I just can't see it.
@Adnan But where does it say blocks necessarily have to be 8 bits in size? Why not 256 bits?
It could just as well be one of those more is better jokes
@TildalWave I don't know. I feel it should be one of those ROT0/ROT26 things. Hopefully @Poly will shed some light on that when he comes back.
5:39 PM
Don't make me go and encrypt that penguin in ROT256 just so we see the difference LOL
@TildalWave I don't think you have to. 256 mod 26 = 22
@Adnan where are you getting ROT26 from?
@TildalWave I know, but Polynomial doesnt mention that
@lynks ROT0 = ROT26 = ROT52..
5:43 PM
ROT256, ROT26 and ROT0 are all joke ciphers
they all mean 'identity'
@lynks ROT256 is ROT22.
@Adnan ... ROT doesnt exclusively have to act upon the set of lowercase letters
@lynks For a ROTn to be "identity", n mod 26 = 0. Right?
@Adnan on 8bit blocks
@Adnan it just means, rotate the set of possible plaintexts. all block ciphers are permutations, ROT is just a very simple permutation.
5:45 PM
@Adnan In the head of the one who is saying "ROT256", the problem is about encrypting bytes (in the 0..255 range), not letters (in the A..Z range).
@Adnan forget 26, 26 has nothing to do with this
It is a stupid joke. Don't try to understand it by thinking about it.
@ThomasPornin Jihaaaa!! Okay okay, now I get it.
one word from the bear and my page of explanation is rendered obsolete :(
@ThomasPornin So because 256 mod 256 = 0. Much clearer now.
5:47 PM
@Adnan youre really thinking about this too much :P
@lynks Well, it's simple. Your "explanation" is treating me like an idiot. Explaining what ROT is and what ECB is, and telling me to forget 26 as "it has nothing to do with it" without telling me what has to do with it.
@lynks Please don't get it the wrong way, I'm truly grateful that you tried to help. But just this time, the attempt wasn't successful.
@Adnan i thought "ROT doesnt exclusively have to act upon the set of lowercase letters, it just means, rotate the set of possible plaintexts. all block ciphers are permutations, ROT is just a very simple permutation." would have nailed it
@Polynomial you've caused a ruckus.
@lynks Well then the problem is on my side. I probably just needed to hear it twice :p
@ThomasPornin I know we/I say this a lot and I know that you're here waay before me, but I think it must be said. Thank you for being here. You're great.
6:11 PM
Last Monday (25th) I learned that Windows has some advanced task scheduling options, after some messing around I've set the following command to run every 2 hours on working hours.
msg adnan "Stretch and do some situps, then come back and sit correctly"
Today I checked my situps log and I've made 600 since that Monday.
Maybe Windows doesn't suck so much after all.
2 hours later…
8:06 PM
Q: I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?

Ben DavisMy client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload their photos, and the photos are judged by moderators for a winner. The site will be hosted on a ...

@LucasKauffman My answer is either missing something (I don't know what it is) or it is wrong altogether.
8:40 PM
@Adnan FWIW I think it's pretty good. It's difficult to answer such questions and cover all aspects of it, especially since OP isn't all that active in the comments. Other answers kinda complete yours, so IMO that's enough. But I don't think that pen-test would be done on Rackspace server, so maybe that warning could be less intense? :)
@Adnan It's a bit like asking "My client wants me to check his breaks, does it help if I change the oil?"
@TildalWave It would be pretty silly to DDoS-test the poor developer's laptop. Unless you can replicate the production infrastructure and stress-test that, you have to stress-test the production infrastructure itself.
@Adnan aren't they after pen-testing it? I think this question is just some case of lost in translation as it doesn't seem all that sensible to me either.
@LucasKauffman True. I think Rory's and mine are covering it pretty well.
@Adnan yea no question about that :p
8:47 PM
@TildalWave I think that in essence, the client is scared of DDoS.
*giggles* DDoS pen-testing... I've seen too much German porn
@Adnan SpeeDDoS penetration testing :=
@TildalWave I was thinking more of a GB situation.
That is, gang-bang, for the amateurs.
@Adnan not following you... what's GB in this sense?
ah lol
@Adnan then you could google for ... oh nvm :)))
I really hate that our office's alarm automatically activates at 23:59.
At 23:58 I have to start running to the door to deactivate it in the 20s grace period.
Now here's the catch, the alarm's clock is 2 minutes ahead of all our systems.
Ro(a)ry! Good evening!
8:53 PM
Evening squire :-)
And everyone else
@polynomial - will you be involved with the Portcullis Arms at Infosec? Just asking as I'm taking the wife to London/Infosec for her 40th and looking for fun things to do, and specifically drinking.
9:25 PM
@RoryAlsop you should be a shoe-in for a spot at the arms this year given your new employer....
9:41 PM
@TildalWave @LucasKauffman That question is now 7th in the SuperCollider
@Adnan I actually don't even know what SuperCollider even is in the scope of Sec.SE really. OK, I get what it's supposed to mean, but what's the official way of measuring collisions here? That's a nickname for which list of questions?
Q: What formula should be used to determine "hot" questions?

Jeff AtwoodRight now the front page Popular tab is fairly broken -- it's a simple descending sort by views. As Joel said in podcast #18, it is "a self-fulfilling prophecy." But this is not intentional, it's only because we haven't had time to improve it yet! As I sit down to write a better algorithm, I tho...

@JeffFerland Choo choo!
@Adnan You're just confusing me even more. I thought there's a simple answer
@Adnan OK, so it's hot questions
9:57 PM
@Ladadadada Nice and detailed answer.
@Adnan Thanks. It's about time I started answering questions more often around here.
10:14 PM
@RoryAlsop Apparently we don't do that any more, since Infosec got annoyed that we got orders of magnitude more people at the stand than anyone else.
10:32 PM
Q: 3DES with fixed-encoded random key

kappaI need an advice. I have a communication protocol using 3DES cipher. Each time the client connects (and it can be very often like 1-10 per second), the 24-byte key is generated randomly on server side, encoded by XORing with some static 24-byte password (quite complicated, not many repeated bytes...

I'm this close to think this is one of the regulars with another account attempting to troll us.
am I reading this correctly? Is he transmitting multiple payloads xored with the same password?
G'day all :D
@Gilles I'm more interested in his key length. IIRC 3DES had a key length of 168bit. He seems to be using a 192bit key. Or am I reading the question incorrectly as well?
@D3C4FF hei hei hei
@Adnan what's news
@D3C4FF I'd say check the starred posts, but I think you know better.
10:41 PM
A: Select a TripleDES key so that it effectively behaves as regular DES

Thomas PorninDES is defined to use a 64-bit key. Only 56 of these bits are really used, so the "effective key length" (for resistance against exhaustive search) is that of a 56-bit key. Yet, any implementation will expect a sequence of 64 bits (hence, 8 bytes, not 7). Triple-DES (aka "3DES") is three DES ins...

@Gilles Jihaa! Thanks.
@Ladadadada Where else do you think I get these from?
What the bleep? I have no post of mine starred on the wall? You haven't seen the digitized @AviD video? I thought resemblence is striking :O
He even talks about frozen yogurt FFS!
Just curious if you were referencing that post or were just a fan of cheese.

Or pandas.
@TildalWave frozen yogurt is so 2010. Jelly beans are the rage now. Key lime pie if you want to be avant-garde.
10:47 PM
@Gilles Have you seen the video? Not so 2010 IMHO
@Gilles Oh, and I don't expect it to run well on Android :P
Talking of which... ARM just announced they're taping out A57
Before I reply to this, I'd like to know what you guys think.
Aren't stress-testing/load-testing situations very different from actual DDoS attacks?
I really don't see how you can test your system against DDoS attacks without a botnet. Ideas?
@Adnan dunno it's a legit question, but the -1 is a bit on the lame side
Heya y'all
@TildalWave Of course it is, I'm not complaining about the -1 or the question. I don't mind that at all. After all, this is how SE work.
been missing me much lately?
@TildalWave what booping video of me are you talking about?
10:52 PM
@AviD It's been very cold and dark without you here.
@Adnan there was a question from a guy this week about amplifying through poisoning his own DNS server ... but I'm really not an expert in this
@Adnan yeah, well... between holidays, kids vacation, local cultural equivalance of spring cleaning, and that damn project that was overdue - I had to make the hard choices, and refrain from popping in here.
@AviD @AviD @AviD @AviD!!!
@TildalWave Oh yes yes yes, that's one way.
@Adnan EC2. Spin up hundreds of instances, fire 'em all off for an hour, shut 'em down. Total cost, $15 for 30... so about $50 for 100 machines.
10:53 PM
almost as hard as not touching my hardware for a week.
no no no! I meant the new computer components that I had to put aside.
@TildalWave @TildalWave @TildalWave @TildalWave
@AviD Are you fishing for out-of-context stars? If I didn't know better...
@AviD We missed you so much we made a virtual @AviD
@Ladadadada But is a DDoS attack usually performed with 100 machines? Aren't 1000s usually involved?
10:55 PM
@Adnan It depends on the target. I once saw a DDoS with three machines.
Needless to say, that one was easily mitigated.
@Ladadadada From different IP addresses and not a set of know subnets.
@TildalWave huh? is that supposed to look like me?
Tigger looks more like me.
But it did bring the site down.
@Ladadadada Interesting..
I'll try to correct my answer.
@AviD All we had to work with was distant memory of a thumbnail photo of yours and imagination. It's a work in progress...
10:58 PM
@TildalWave hahaha, I guess its the baldness that is in play?
feel free to peek at my linkedin...
@AviD dunno, I'm no expert but the guy on the video seems to be roughly from your area... maybe a bit more east?
@TildalWave yathink? I would have guessed more UK...
02:00 - 23:0023:00 - 00:00

« first day (839 days earlier)      last day (2933 days later) »