The DMZ

D3C4FF

12:14 AM

Mawning all

Xander

12:32 AM

Just flagged this as spam, since it's a straight-up product advert from a new user

-1

A: Are there any Windows permissions management applications?

For a quick bi-drectional view of access controls, check out Varonis DatAdvantage . Varonis offers a free 30 day trial.

Stack Exchange

4:22 AM

Sure, T. rex is closer in height to Stegosaurus than a sparrow. But that doesn't tell you much; 'Dinosaur Comics' author Ryan North is closer in height to certain dinosaurs than to the average human.

TildalWave

5:36 AM

@Xander He's taking a piss, no doubt about it. No pricing information on the official product's page and Google says "Pricing starts at $25,000 for a license for one to 250 users".

AviD

7:01 AM

@TildalWave @TildalWave FTR, Varonis happens to be a pretty good product, and the pricing - for an EAM product - is not too high, either. That said, of course I agree about the spam flag.

though to be fair the OP was explicitly asking for product recommendations... I removed that.

TildalWave

7:32 AM

@AviD It's clearly not what OP was asking about, no matter how good it is it's a slight overkill to help organize and visualize what's so far been possible manually. I realize what's it for and who it would be helpful to, but OP expressed concern about another product's $110 asking price, so $25k is clearly over budget LOL

@AviD BTW thanks for clearing that Desi thread, that was ... something :)

AviD

@TildalWave oh sure, I dont disagree. It's stupid marketers like that that ruin good products.

as they say, 98% of marketers give the rest a bad name.

@TildalWave .... "something", yes it was.

TildalWave

@AviD There's a company making one of these products like maybe 300 meters away from me,... had a job interview once, but they blew it for me with this almost pyramid like sales attitude and involvement with what we call here brown envelopes marketing. You probably know what I mean. ;)

AviD

@TildalWave actually I dont...?

you've mentioned that before, and I didnt know what it was...

Bribes?

Mayank Sharma

hey guys look at this prepaid card fraud

timesofindia.indiatimes.com/india/…

TildalWave

@AviD mostly gov't subcontractors that ensure the deal by exchanging brown envelopes filled with a certain percentage of the deal's worth of money ;)

AviD

7:47 AM

it really is shocking and despicable, how even good companies get their reputation trashed by crap salespeople and marketers.

its just business as usual for them, horrible and unethical for everybody else.

@TildalWave ah, yeah. Bribes. I like the euphamism. :-)

TildalWave

@AviD Couldn't agree more. And I used to work for some of such companies in my early days (honestly had no clue beforehand)... can't say I was short on money, but the game was rigged and dirty and I really didn't want to have anything to do with it, not just for legal reasons

AviD

there actually are a few companies that stand up for it, and have their salespeople perform sensibly.

I remember reading a blog post about how a company stopped doing sales commissions. wasnt able to find it...

oh hang on, just found it: blog.fogcreek.com/why-do-we-pay-sales-commissions

now that is what I call a good company. I would be happy to give them money.

TildalWave

8:08 AM

@AviD That's the companies I like to work with. Sales people should actively participate in development, or even the other way around sometimes. At the end of the day, a company is a single system, and trying to run multiple different reward systems within a single company just doesn't work IMO. Not to even mention the management overhead. I'm glad to see more companies returning back to basics on this one, I'd rather buy a product from a spotty geek that knows what he/she's talking about.

AviD

@TildalWave absolutely. I have no clue why we are in the minority.

But yeah, Fog Creek seems to really be a great place to work with, they seem to care about doing the right thing.

Perhaps thats what happens when you have an engineer run the company, instead of sales...

TildalWave

@AviD Naïvety I guess... and a good point with engineer running the company there. Case in point - all the major players out there (in IT at least) ;)

AviD

@TildalWave well, not really... its well known that engineers cant sell (well, to non-engineers).

CA, IBM, Oracle, MS... none of them currently run by an engineer.

MS was at least built by one, but the others not so much.

@TildalWave you have examples of that?

I can think of a few, but it does seem to be the exception rather than the rule. Sadly.

TildalWave

@AviD I kinda disagree, because they were all built on products they made (ok, forget IBM, that's another case). Anyway, that's semantics, what I wanted to say is these are not companies that (at least used to) are involved in selling smoke. What has become of them is another matter tho ;)

AviD

8:23 AM

@TildalWave oh, sure, all real companies sell actual products, no doubt. My point is "who runs the company", who is "in charge", who sets the tone and who decides who is the core of the company and who is a cost center.

TildalWave

@AviD MS, Apple, Sun,... pretty much any Silicon Valley company before .com ... some even have a name after the founding engineer, like Cray

AviD

See even in most big tech companies, who make their living on programmers (and other techies), these are considered a cost center, whereas the salespeople are the core. Look at Oracle, CA, etc... who makes the biggest bucks? Who is most respected there, who is higher up the chain?

@TildalWave Sun - I agree, though they're not around... MS was the case, not anymore - and their culture is changing. Apple not exactly - Jobs was a designer, not an engineer.

Which, btw, is what I claim the biggest difference between Apple and MS is - the difference between design and engineering. While they are both learning the other side, it is clear which is natural to one.

TildalWave

@AviD I think the real question here is would they have the need to start selling smoke and mirrors, if they had the vision a developer that started it had

AviD

'Course now they're both moving towards a salesman focus....

@TildalWave naw, they dont really sell smoke. (Well, except for Google ;-) ).

TildalWave

@AviD Oh then I have to agree with you, if we distinguish between the two here... I was thinking more about those that make products vs. those that sell products

AviD

8:28 AM

It says a lot about a company, though - do they build a product in order to have sales, or do they sell the product that they built for the customers...

@TildalWave true, I did get off point there.

but lets assume that these companies both make products, and sell them. My point is, which is core, and which is support?

TildalWave

Time for a Field of Dreams quote? :))

AviD

btw I have a theory that sales-oriented companies have a substantially larger amount of shelfware sales, whereas engineer-oriented companies do not.

@TildalWave go for it :-)

TildalWave

@AviD my meme-fu sucks :(

Rory Alsop

Morning

TildalWave

Morning @RoryA :)

AviD

8:37 AM

@RoryAlsop yes, it is

TildalWave

I'm a bit shocked that I can't find a suitable and ready made if you build it meme on Google images... loads of crappy ones tho

Rory Alsop

And it is a gorgeously sunny / sleety dark morning here. Yes, both. Typical Scottish summer BBQ weather

TildalWave

@RoryAlsop I have problems imagining that... what do you mean both? Intermittently? :O

AviD

@TildalWave try the alternative "if you book them" from waynestock...

TildalWave

@AviD It's already stale by now, like I said - my meme-fu sucks. I'll try harder next time ;)

Terry Chia

8:42 AM

Afternoon guys.

Holy crap that punishing hackers question really paid off in terms of rep.

+90 rep on the third day.

4

Q: Homomorphic encryption used for e-voting?

I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused: "The homomorphic property of various cryptosystems can be used to create secure voting systems, ..." How would you possibly use homomorphic encryption to secure the voting process? Of course, you wo...

Sounds like a question for @nealmcb.

TildalWave

7

A: In what ways does Full or Partial Homomorphic Encryption benefit the cloud?

Homomorphic encryption is about encryption schemes which allow computing with encrypted value without decrypting them. For instance, given E(a) and E(b) (the encryption of a and b), you can compute E(a+b) without knowing a, b nor the decryption key. Homomorphic encryption schemes are very useful...

@TerryChia It's kinda already answered in that thread, by @Neal too actually... not sure what to make of the question you link to, since the other question isn't an exact duplicate, but the answers are also relevant

Rory Alsop

9:13 AM

@Tildal - in different bits of the sky visible to me at the same time :-)

TildalWave

@RoryAlsop marbelous :)

0

A: Homomorphic encryption used for e-voting?

You are right, the problem with e-voting is validation, not encryption. One can change values on the fly prior to encryption. What is important is the ability to check the votes after the fact. Scantegrity has this all worked out, they even have a vote-by-computer system that uses mail-in ball...

I find this answer slightly fishy... spam? not an answer? ... dunno, but the certificate of the website he's linking to has expired on Aug 2012, which is rather strange for a company that suggests integrity in its name

Terry Chia

0

A: How can I punish a hacker?

TL;DR It's not the correct IP address and law enforcement doesn't care.

A TL;DR warning without anything to read.

@Adnan RE the ZIP file question. How is integrity maintained if the attacker can replace files in the ZIP archive?

(At least according to the asker the files can be replace, I'm not familiar with the ZIP archive format.)

TildalWave

@TerryChia Not an answer or LowQ?

M'vy

@TerryChia It has more of a TL;DW than a TL;DR

TildalWave

@M'vy can't flag answers for being incorrect tho

Parimal

9:29 AM

hello

Rory Alsop

Anyone fancy writing this QoTW?

0

A: Requests for Question of The Week blog posts

I would like to see a blog post inspired by the 'How to punish a hacker' question ( How can I punish a hacker? ) The important bit of this one isn't so much the actual answers, although they are good, but the wider ethical piece and the challenges Scott Pack listed.

@Terry and @Tildal - I converted it to a comment.

Rory McCune

9:56 AM

@roryalsop its nice up in crieff at the moment although theres still snow on the hills up here !

M'vy

Google+ information in Gmail is driving me crazy

Terry Chia

@RoryAlsop Perhaps throw a protect on it?

AviD

@TerryChia Welcome to 20 hours ago.

Terry Chia

@AviD Ah damn, must be blind.

AviD

@TerryChia Your momma told you that would happen, if you keep it up.

Terry Chia

10:10 AM

@AviD heh

High chance I will be rep capping again, that would make it the 7th one this month.

Adnan

Damn it! I said that I won't be coming to the DMZ again! But now this ZIP thing forced me to

@TerryChia Let's say you signed a file, then gave it to me and told me to give to @AviD.

On the way I replaced it with another file

AviD

@Adnan I dont want it!

Adnan

I gave it to AviD

AviD

I'm not gonna open any suspicious file from any random guy!

or girl!

you cant make me!

@Adnan nuh uh! no you didnt!

Adnan

He attempts to verify it, he finds out it's not genuine.

Antony Vennard

10:22 AM

@AviD Even if it's "GetRichNow.exe"?

Adnan

@TerryChia The mere action of replacing the file isn't the integrity problem.

AviD

@AntonyVennard well, sure, that one is fine, its not suspicious.

Terry Chia

@Adnan You mean sign as in PGP for example?

Adnan

@TerryChia Yes, or even simply encrypt it with AES-gazillion.

Terry Chia

That isn't part of a normal password protected ZIP file though?

Antony Vennard

10:24 AM

@AviD On account of being definitely a virus?

AviD

@AntonyVennard no, on account of going to make me rich, of course.

And then I will buy all of you.

Adnan

@TerryChia It's not. But with it or without it, nothing changes.

Antony Vennard

@AviD I don't come with a money back guarantee, or any guarantee of fitness for purpose. Is this going to be an issue?

AviD

@AntonyVennard not at all. all you humans grind up the same.

Terry Chia

@Adnan Ok, let me see if I got this right. The ZIP file is a container as per your answer. The individual files inside the container is encrypted when you password protect it. I can swap out individual files in the container without requiring the password. Am I right so far?

AviD

10:26 AM

I... think I may have been watching too much Dr.Who lately...

Adnan

@TerryChia Correct.

Terry Chia

@Adnan So I don't get how integrity is guaranteed, assuming that nothing else is being done to the ZIP file (signing it for example.)

Ohhhh, it's guaranteed because whatever files I replace it with isn't encrypted?

So I can tell if individual files have been tampered with?

Adnan

@TerryChia Exactly

@TerryChia And even if it was encrypted, you'll know it's not the same because your key wouldn't work.

Terry Chia

@Adnan Ahhh makes sense now. So why did you delete your answer?

Adnan

@TerryChia Because I found out I'm not 100% familiar with the concept of integrity. To me, it makes perfect sense that any tampering will be detected and the attack is mere a social engineering attack.

But after reading this security.stackexchange.com/questions/9437/…

I started to be confused

@Poly or @Thomas, could you please shed some light on this one?

If I encrypt something with AES-CBC, then somebody tampers with it, will I find it when I attempt to decrypt it?

TildalWave

10:31 AM

@Adnan I must have missed that memo, but I'm offended nonetheless ... I thought we had something going here!? :(

Adnan

@TildalWave Without giving him/her too much credit, my decision was affected by what Iszi said the last time.

TildalWave

note to self: send that "GettingRichIs.rar" file to @AntonyVennard

Adnan

It was the second time I was talked to in that condescending manner by the same person.

I'm not one to make big scenes, so I just preferred to walk away.

Antony Vennard

@TildalWave I don't know what it is about rars, but I always associate them with either malware, or illegal software...!

TildalWave

@Adnan Didn't read all of it, but I thought you were taking it to heart too much ... cute, understandable even, but slightly too vulnerable perhaps? It's just differences of opinions anyway, what you put on BBQ is more important than that! :)

Adnan

10:35 AM

@TildalWave It might not have seemed like a big deal, but it is to me. I don't like the urge in people to compulsively correct others, so much that it blinds them and prevent them from actually reading what is written, making them believe that the person is wrong and rushing to correcting them.

Again, it's nothing personal. I've already told @Iszi before, I respect him a lot, but I don't like that small thing about him. Sometimes it's very annoying.

TildalWave

@Adnan granted, it's easier to talk aye to aye ;)

Adnan

@TildalWave But anyway, I realize it shouldn't be that big of a deal and stop me from coming her. It would be too drama-queeny.

@Terry Any idea on that integrity thing?

Terry Chia

@Adnan Nope, beyond me.

Let's wait for Thomas.

Antony Vennard

@Adnan This behaviour in the general case (don't know anything about your specific one) also irks me somewhat. I've been bitten by "YOU ARE WRONG" "well yes I said I was, but I also said it was a simplification" "YOU ARE WRONG" cycles before. I've also been bitten by "YOU ARE WRONG" when actually I'm right and the commenter hasn't read my post.

Actually, I really wish we could constrain the amount of commenting on SE further.

TildalWave

@AntonyVennard Origins of the compression algo and time of it's first release maybe?

anyway, whatever happened to ARJ?

Antony Vennard

10:47 AM

@TildalWave Yeah, possibly. And that every file ever shared on a torrent is rar'ed. Not even tgz, or tar.bz2, or tar.xz, or zip... always rar.

It's like to get your software pirate's license you need an illegal copy of WinRAR.

Adnan

@AntonyVennard Well, in my case it was a different situation. I hold part of the responsibility, mainly because I didn't explain myself well enough.

@LucasKauffman So it was illegal in the end?

Extremely ridiculous

Lucas Kauffman

@Adnan no, it's very complex, hunting is disallowed, pest control too except if it's pest control on certain disease carrying animals

Adnan

@LucasKauffman So even if you have a hunting license, you can conduct normal pest control with an air rifle?

@Lucas I should probably just move to the UK and get it over with.

Lucas Kauffman

@Adnan no no, it gets better, you don't need a hunting license for pest control

TildalWave

hmmm didn't react fast enough... I just saw some blue notice on close vote... "your close vote.... something ... has been [reached I think]"... what did it say? is there some daily quota on close votes?

Lucas Kauffman

10:54 AM

well certain pest control

Adnan

@LucasKauffman Are rabbits considered pests? :D

Lucas Kauffman

nope currently it's only wildered domestic pigeons

TildalWave

@LucasKauffman In normal, developed countries such things are usually governed by more laws, not just the most obvious one that applies... so in pest control toxins I'm pretty sure you also have laws regarding pollution, land contamination, e.t.c. that might all apply. So while you'd have some law that's less restrictive (permissive even), you'd have a lot of others making those liberties from the first one pretty much impossible

Lucas Kauffman

@TildalWave no because it's also defined what toxins can be used

TildalWave

@LucasKauffman ~~Which animals are we talking of here?~~ nvm just saw it

Adnan

11:02 AM

@TildalWave But the think that annoys me (and @Lucas as well) is illogical argument they use. Animal poison is usually more painful for the animal than a pellet to the heart or head.

Yet they tell you that air rifles abuse animals.

Lucas Kauffman

@TildalWave aha, that's also a cool thing, we have actually 4 types of animals

protected, ones which can be hunted, pests and unregulated

pests still fall under pest control, but unregulated allows "free for all"

TildalWave

@Adnan dunno, hard to say really without specifics... but in general I'd say you're correct

Adnan

Yaay! Thomas is here!

Lucas Kauffman

our favorite bear!

TildalWave

@LucasKauffman would be interesting to see in which of these categories fall humans :)

Thomas Pornin

11:06 AM

@Adnan Short answer is no, or, at best, "it depends".

Lucas Kauffman

@TildalWave when it comes to laws and regulations this country is incredible complex

Thomas Pornin

If I modify one bit in CBC-encrypted data, then it modifies the same bit in the clear data; it will also replace the next block of clear data with randomish junk, but only that block. The rest of the data will be unaffected.

TildalWave

@LucasKauffman You know of any that isn't? I thought that's the whole point of laws - to be so complex we'd actually need dedicated people that would otherwise have hard time being useful

Adnan

@ThomasPornin Jihaa! Makes perfect sense.

Good that I deleted my answer then.

Thomas Pornin

For Zip archives, the situation is a bit more complex because the format includes some checksums -- non cryptographic, but checksums nonetheless, which can make the task a bit harder.

Adnan

11:14 AM

@Thomas One more question about that, just to see if I understood correctly. Say I have a file with a very forgiving format (doesn't completely break if it had some junk). With careful modification to the ciphertext, I can modify some, say, text in the file so that when it's decrypted it, the user will see the new "evil" text. Am I right?

@Thomas Okay, no need for an answer. I've just read more about CBC and I can see how what you said applies. Thanks

TildalWave

0

Q: Making undeterminable containers inside existing file system

Suppose, I have 1 disk partition (previously filled with random data) and create some file system on it (NTFS, FAT, EXT2, etc). I am going to keep some files here (i.e. visible files). Then i create a few loobpack devices with different offsets and make some file systems on them. The question...

encryption

What is a file system loopback device? :O

Adnan

11:30 AM

@TildalWave He probably means lofis

@TildalWave en.wikipedia.org/wiki/Loop_device

Think mountable .iso files

TildalWave

@Adnan oh thanks, never had any need for these... I find the word loopback rather a strange choice here tbh

Adnan

@TildalWave Because it's wrong

@TildalWave Unless he's actually talking about loopback devices, and I don't think that's the case.

TildalWave

@Adnan I'll take your word on it ;) It's not really my strong point tho I can see some uses for it, I might have even used them before but setup by someone else :?

Adnan

@TildalWave I'm pretty sure we all used loop devices one way or the other.

If you've pinged localhost before, you've "used" loopback devices (not loop devices)

and if you've mounted .iso file, you've used loop devices (not loopback devices)

TildalWave

@Adnan technically, I've used the device it loops back to ;)

Adnan

11:38 AM

@TildalWave Great, one thing to add to the list that contains Web Proxies and HTTP proxies

TildalWave

@Adnan pics or it didn't happen!

ManishEarth

@Adnan Whenever you boot from GRUB, loops are involved

So any Ubuntu user would have used loop devices

TildalWave

Anyway, I know what a loopback device is, I just had problems understanding it in this particular context (as in: never heard it used to describe this before)

Adnan

@TildalWave Because it shouldn't be. It should be called loop device in that context.

Adnan

11:58 AM

@Thomas I don't know if it's intentional or you just can't bring yourself to answer stupid questions, but in either case, thanks for that. I've just went even deeper (at least to me) in block cipher modes and learned even more nice (and surprising) things.
I was especially surprised that (in CBC) you can decrypt all but the first block without (or with a wrong) IV.

lynks

@Adnan yeah CBC lets you do random-access, which is nice

TildalWave

:9397764 I've asked myself same question before... scroll up ;) (why did you remove it?)

Adnan

@TildalWave Because after a closer look, I think it can be looked at as an answer.

Pretty bad one, but still one.

TildalWave

@Adnan problem with that thread is, that the best answers for it are in another, but the question itself isn't a duplicate

Terry Chia

@TildalWave I dunno, Bear post is pretty awesome.

TildalWave

12:05 PM

@TerryChia didn't see it yet, I stand corrected then

Adnan

@TerryChia Indeed.

lynks

I love this: The US government has demanded designs for a 3D-printed gun be taken offline. ... taken offline ... yeah because that's a thing...

TildalWave

@lynks hahaha that's a good one

lynks

12:23 PM

@TildalWave it has like 40,000 seeders on pirate bay, it might be a bit late for that

Adnan

@lynks Of course it's possible $('.3dPrintedGuns_Design').prop('offile', true);

I probably should make an offer to the US government to implement that solution, I'm sure they'll give me like 100K

@lynks Want in?

TildalWave

@lynks maybe they just meant we should make more hard copies?

lynks

@Adnan yep lets do it :P

Adnan

@TildalWave Jesus! This made me giggle.

@TerryChia So I Googled that one.

Terry Chia

12:52 PM

@Adnan heh.

Boom. Repcapped.

99

A: "Username and/or Password Invalid" - Why do websites show this kind of message instead of informing the user which one was wrong?

If a malicious user starts attacking a website by guessing common username/password combinations like admin/admin, the attacker would know that the username is valid is it returns a message of "Password invalid" instead of "Username or password invalid". If an attacker knows the username is vali...

SO CLOSE!

Adnan

@TerryChia So now they're 10.

@TerryChia Already have an unpvote there, can't upvote more

Terry Chia

@Adnan hehe, it will get there eventually.

Adnan

@TerryChia Faaauck! I thought 10.. you have 12 now!!

Nice!

Terry Chia

@Adnan Got 7 this month. Pointy ears really work.

Adnan

Closer and closer to the Epicness

Scott Pack

1:07 PM

That punishment question is really turning into a repevator

TildalWave

@Adnan 12 of what?

@TerryChia can't upvote either, not more than I already did :P

Terry Chia

@ScottPack heck yeah, helped me repcap three days in a row

Adnan

@TildalWave 20/50

Terry Chia

44 upvotes on the first day, 23 on the second, 11 today (so far).

TildalWave

@TerryChia and I still didn't get my mortarboard badge, I think I discovered a bug in the system

Adnan

1:10 PM

@TerryChia Soon we'll find you with 20K.. from that question

TildalWave

@Adnan Huh? 12? 20/50? ... I'm not R2D2 ya'know?

Terry Chia

@TildalWave That's weird. Maybe make a meta post of it?

TildalWave

@TerryChia the problem seems to be with reaching 200 but losing some rep on later removed downvotes (spam and such)... so the advice seems to be: don't downvote and you'll get it :)

I mean... I lost some rep that was later returned

HamZa DzCyberDeV

Hello

TildalWave

Hey @HamZa ;) sup?

Terry Chia

1:15 PM

@TildalWave Ah, that might explain it. Pity.

HamZa DzCyberDeV

Fine, and you ? @TildalWave

lynks

fml, I didn't git push from home...I might have to drive back across town...

Terry Chia

@lynks facepalm

lynks

@TerryChia screw it, I'll just work on something else and face the merge-nightmare when I get back :P

Adnan

@HamZaDzCyberDeV Hey hey Hamza

@HamZa Your name sounds familiar. Egyptian?

TildalWave

1:17 PM

@HamZaDzCyberDeV fine too thanks :)

HamZa DzCyberDeV

@Adnan elsalamoe 3aleikom

@Adnan nope 1/2 algerian :)

Adnan

@HamZaDzCyberDeV Hello to you too. But let's keep it English

HamZa DzCyberDeV

close enough :p

Adnan

@HamZaDzCyberDeV Welcome welcome

HamZa DzCyberDeV

@Adnan Yeah I know, just the greetings :)

So I'm new here, third day :p
Not a real hacker, just a developer who likes to boot backtrack from time to time and try out nmap/metasploit :p

TildalWave

1:20 PM

@Adnan I believe that really shouldn't be a problem ;) I mean... you used way worse Finnish on us! ;))

Adnan

@TildalWave That sounds dirty

TildalWave

@Adnan that's what she said :P

Adnan

@HamZaDzCyberDeV You're welcome! Just to avoid mistakes of the others, keep the following in your mind.

TildalWave

@HamZaDzCyberDeV speaking for myself of course - much the same here ;)

Adnan

@HamZa Most of the time we don't talk about security here, we make a lot of jokes, so take things easy. Even if it looked that way, nobody will try to offend you.

Terry Chia

1:22 PM

@HamZaDzCyberDeV developers. eww. :P

Adnan

@TerryChia What do you have against our kind?

HamZa DzCyberDeV

@Adnan I know, I'm usually hanging on stackoverflow chat room (PHP and Regex) :D

TildalWave

@Adnan You really ought to read his answers on Sec.SE ;)

Scott Pack

@TerryChia Shazaam. I've not done quite so well, but still pretty respectable.

HamZa DzCyberDeV

@TerryChia we developers are building software that you're using :D

3

TildalWave

1:23 PM

@HamZaDzCyberDeV and that's your first star in DMZ I believe ;)

Colin Cassidy

we developers are building the software you're ab-using :)

Scott Pack

@HamZaDzCyberDeV We all have our crosses.

Terry Chia

Dec 25 '12 at 13:52, by Scott Pack

@Anuj Sounds like one of those "programmer" problems. Ew.

HamZa DzCyberDeV

@TildalWave my first one was this
http://chat.stackexchange.com/transcript/message/9388906#9388906

TildalWave

@ColinCassidy we developers are abusing your ability to use our software

Terry Chia

1:25 PM

Ah, this is the one I wanted.

Mar 3 at 15:13, by Scott Pack

Fucking programming.

No offence intended of course, just joking. :)

TildalWave

@HamZaDzCyberDeV oh shoot missed that one, good one too

Scott Pack

@TerryChia Yes, it's true. I get pretty cranky when I have to write code.

HamZa DzCyberDeV

So guys I want to be a security specialist who mainly performs pentests or someone who dive in the programming world.
But for security, I don't know where to begin, a few years ago I wanted to learn hacking, tried some programs on windwos, ended up being infected with +30 trojans ... I realised that I needed to learn programming and knowing the internals of the computer/OS etc...
So that's how I started, I started with html/css and now I'm somehow coding in PHP

Scott Pack

12

A: Fresh Graduate Going into Penetration Testing

A Little Background Penetration testing probably feels like the sexiest part of security, but it is also a very small part. It's also exceptionally broad. The term "penetration test" is often used as an umbrella to mean any one of the following: Vulnerability Assessment Security Assessment Sec...

TildalWave

@ScottPack why would you assume that us developers are any different? I hate writing code, that's why it's concise, easy to maintain and usually just works

HamZa DzCyberDeV

1:29 PM

@ScottPack thx will read it ...

Scott Pack

Shush, I'm trying to find any more self-promotion that would be relevant!

Terry Chia

@HamZaDzCyberDeV php. eww. :D

Scott Pack

Nah, that's all I got. Rory[0] recently gave a talk on this kind of stuff.

Adnan

@TildalWave I've read two of them. They're good

HamZa DzCyberDeV

my answers :o ?

TildalWave

1:32 PM

@Adnan yup they are, certainly not a case for what was required with that Cisco manual fan ;)

HamZa DzCyberDeV

@TerryChia Do you suggest ruby ? python ?

Scott Pack

@TildalWave You know, it's funny. I've found that writing the usage documentation and "best practices" formatting are about the only things I enjoy doing.

Terry Chia

@HamZaDzCyberDeV nah, kidding again. php is perfectly fine if you actually know what you are doing.

Adnan

@HamZa I see I see what you're doing. So you just go everyday into a new chat room and tells they you're new here. Reminds me of a girl I knew

Terry Chia

I am really biased towards python though.

Adnan

1:33 PM

@TerryChia :O :O :O!! He finally said it!

TildalWave

@HamZaDzCyberDeV yes, they're good answers

Terry Chia

@Adnan that's a huge if though. :P

HamZa DzCyberDeV

@TerryChia PHP isn't really suited for pentest ...

Terry Chia

I have been writing php for almost 4 years and I still don't feel comfortable with it.

Scott Pack

Lots of the young kids are using python now days, or ruby. It really comes down to picking a language that's still being supported, has features that are a good fit for your task, and you're comfortable with.

Adnan

1:33 PM

@HamZaDzCyberDeV Ha? Is there such thing? A language is suited for pentest?

TildalWave

@ScottPack well you're strange :)))

Scott Pack

Trying to write code in a language you're uncomfortable with is very likely going to produce bad code.

HamZa DzCyberDeV

@Adnan lol I actually signed in here because of this Q security.stackexchange.com/q/35756

Terry Chia

@Adnan python fits that requirement well. mainly because it is just easy to write usable code.

HamZa DzCyberDeV

@Adnan RUBYYYY or PYTHOOOON !

TildalWave

1:34 PM

Object Pascal FTW!

Scott Pack

@TildalWave pastebin.com/SjzHNWzX

Terry Chia

@TildalWave you are a disgusting creature.

Colin Cassidy

C/C++

Scott Pack

@TildalWave Repeat until output is meaningless.

Colin Cassidy

easiest language to pentest

TildalWave

1:35 PM

@TerryChia that's what she said!

Terry Chia

@TildalWave that isn't much of a comeback since it's directed at you. LOL

TildalWave

@TerryChia it is, if she likes it dirty :P

Adnan

@Xander I'm pretty sure Google and Facebook don't obfuscate just to save bytes.

Terry Chia

@TildalWave dirty and disgusting aren't really the same thing....

Scott Pack

@TildalWave I've also been getting comfortable with Getopt::Long and POD.

TildalWave

1:36 PM

@TerryChia that's what she said too :)))

Adnan

@Xander They can get much smaller JavaScript with minification alone.

HamZa DzCyberDeV

Who's SHE xD ?

Terry Chia

@HamZaDzCyberDeV SHE.

Adnan

@HamZaDzCyberDeV @Terry's mom!

2

BANG! That was a good one

HamZa DzCyberDeV

@Adnan Facebook uses hiphop FYI

Adnan

1:37 PM

@HamZaDzCyberDeV For backend, we're talking about JavaScript

Scott Pack

@JeffFerland What hipster languages does Facebook use?

Terry Chia

@Adnan THAT'S WHAT SHE (DIDN'T) SAY!

HamZa DzCyberDeV

Ah ok ...

Terry Chia

@ScottPack php compiled to c iirc.

Adnan

@ScottPack PHP compiled into C++

Terry Chia

1:38 PM

ah, c++. almost the same thing.

Scott Pack

@TerryChia That's terrible.

HamZa DzCyberDeV

@ScottPack en.wikipedia.org/wiki/HipHop_for_PHP

Scott Pack

@Adnan That's even more terrible.

Terry Chia

@ScottPack So's your face.

HamZa DzCyberDeV

yeah, I wondered why didn't they just implement directly C++ sigh

Terry Chia

1:39 PM

@HamZaDzCyberDeV I think it was because their codebase was already written in php initially.

Xander

@Adnan That's exactly what I'm talking about. They minify, which in practice obfuscates the code. They really don't care whether anybody can read it or not. There's no threat there.

HamZa DzCyberDeV

@TerryChia That's a valid reason for the short term

Terry Chia

So I guess they found it easier to write a compiler to compile it to native code than refactor their whole codebase to c++.

Adnan

@Xander I'm well aware of that. But they minify AND obfuscate. Take a look at GMail or Facebook. It would be pretty silly if an application depended on JavaScript being secure

TildalWave

@ScottPack Gibberish++ w/ Garbage Collector

Scott Pack

1:40 PM

@TildalWave So...ColdFusion?

TildalWave

@ScottPack hehehe

Terry Chia

@TildalWave You are gibberish with a garbage collector.

Adnan

@HamZaDzCyberDeV They already had a PHP codebase when they decided to compile to bytecode. It would be very expensive to rewrite in C++

Terry Chia

@Adnan Already said that. SLOWWWWWWWW!

Adnan

@TerryChia Damn! Didn't see it

@HamZaDzCyberDeV Plus, they compile into C++ for performance. I remember reading somewhere that their C++ code is completely unmaintainable.

HamZa DzCyberDeV

1:42 PM

It's pretty cool though

@Adnan If I remember right, you have to re-compile the code after each change ...

Scott Pack

I can't possibly imagine how software translating PHP into C++ could ever cause maintainability problems. That sounds perfectly readable.

Terry Chia

@Adnan Well, it's compiled from their PHP codebase, what do you expect?

Adnan

@TerryChia Jesus! Dude! It's compiled into efficient + unmaintainable code. Machines tend to be very good at that.

Computers don't really need readability

Scott Pack

Just look at VisualBasic 6.

Terry Chia

@Adnan Yes. I know that. I'm just stating that your statement about their C++ code being completely unmaintainable is kinda obvious. :P

Adnan

1:45 PM

@ScottPack They don't just compile to C++, they compile into highly efficient C++, which is more times that not, unreadable.

Scott Pack

@Adnan So Facebook is the Gentoo of PHP?

Adnan

@TerryChia But it's not because it's PHP originally, it's because readability isn't a goal.

Terry Chia

Alright, now I'm wondering. Why did they compile it to C++ instead of optimized assembly directly?

HamZa DzCyberDeV

@TerryChia impossibruuu

Terry Chia

@Adnan Well, we are making the same point. So peace. :D

Adnan

1:47 PM

@TerryChia Maybe C++ compilers are already pretty good in outputting optimized binaries.

HamZa DzCyberDeV

PHP internals is built in C, C ressembles C++. Do you see the connection ?

Xander

@Adnan As far as I'm aware, Google uses the closure compiler (developers.google.com/closure/compiler) to minimize the JS for GMail, and that's it. Do you have a reference to the contrary?

Adnan

Okay, so apparently they don't do that anymore.

44

A: Why does Facebook convert PHP code to C++?

They don't. Not anymore, at least. Turns out doing it that way causes too many problems, including deployment headaches and nullifying one of the prime advantages of using a scripting language in the first place--being able to change scripts without needing to recompile--so they revamped the Hi...