The DMZ

12:45 AM

@RoryMcCune then there's also these: en.wikipedia.org/wiki/Reserved_IP_addresses that's at least 300M IPv4 addresses that IANA is sitting on for whichever reasons

@TildalWave he's also posted several questions on Unix & Linux

the more we tell him that he doesn't understand what he's doing, the more he insists on exotic security theatre

@Gilles Well I don't even know where to start answering his questions, this latest one for example is so trivial to do I don't have words to describe it, it's ... well, what kids do with LEGOs... take a small block, assemble a few of these together... viola - a castle. And what in heaven's name is the question if C++ can do this? How do you answer that without being sarcastic even?

Having seen your recent questions on IT Security and Unix & Linux, I can tell that you do not understand what you are doing. None of what you're trying to do makes any difference to the security of your system. I recommend that you stop trying for now, read a good book on security (such as Security Engineering), and re-read the answers that I and others wrote. You are trying to defend against an intruder with a lock on the door, under the assumption that the intruder has the house keys — that just doesn't work. — Gilles 39 secs ago

@Gilles Oh cheers for that! :)

1:16 AM

(To other readers: yes, there are processors that encrypt RAM on the fly. But Sulla isn't using one. You find this in some high-security embedded devices, not on servers. They are not relevant to the context of this question.) — Gilles 11 mins ago

@Gilles ty for introducing me to processors that encrypt ram! — Sulla 5 mins ago

:(

@Gilles I just shot my brains out reading this

and I didn't even mention the Linux patch to keep keys in the processor cache, which could be relevant to some of his questions, but not to his overall security model (where the attacker has access to the persistent storage containing the keys anyway, so a RAM dump is overkill)

@Gilles Have you tried directing him to Steve Gibson's Research Corp.? He seems to be better fitted to troll there. He might even get answers he's hoping for :)

lynks

1:31 AM

this is all very saddening

A: Can unencrypted keys & logins be kept out of program memory?

2:06 AM

0

Apparently, there is a poor man's encrypted RAM. TRESOR Actually, the steps to install this on linux are easy as it seems to have already been done with ubuntu

You were saying? :)))

I don't want to open yet another can of worms here, but where do you plan on storing these encryption keys to later load them into CPU's internal cache memory? You're stuck in a loop here with this chain of questions, and none will provide security you're after on an untrusted box! Whatever you do, you'll return to this same vantage point, you're just taking it the longest way around of realizing this that I've ever witnessed. — TildalWave 33 secs ago

adding my 2 cents... man he's tiring

@RoryA, @AviD Can either of you make the CTF room private?

@TildalWave I'm just ignoring him at this point.

Sad thing is that some of his questions actually have some merit.

2:23 AM

@TerryChia Well yes but all of it together is an utter mess and he just resists in getting it he won't be able to do what he wants on some collocated standard box with some cheap provider he's been saying he'd like to host his solution on

@TerryChia why already? CTF is in 2 days

@TildalWave No harm doing it slightly earlier in case we forget

@TildalWave I think the only plausible solution to his problems now is "Magic unicorns".

@TerryChia ah so we're done recruiting? I thought maybe we could get a few new hands in... I've been thinking of asking @HamZa if he stops by

You don't have encryption problems, what you've been describing in other questions related to this one, you have first and foremost trust problems. There's no encryption in the world that can enforce trust. While it may require less of it in certain schemes, we're only talking of eliminating trust in the middleman, not end points in a linear chain of trust. The only way to eliminate required trust in one of your end points is to not require it in the first place. You won't be able to do that, when basic premise is the end point is untrusted, and you insist in requiring it. — TildalWave 1 min ago

@TildalWave Someone can always add people in if they are interested. They can always ask in here anyway.

But yeah, just a reminder for the mods. I don't care if they private it today or in 2 days really. :P

@TerryChia ah true, forgot that... it's late/early ;)

@TildalWave Man you have the patience of a saint. You should run for mod in the next election.

2:39 AM

@TerryChia I wish that was true actually... it might appear so, but that's mostly because I now only deal with as much as I can handle... becoming a mod means you have to deal with as much as others can't handle, which might be a bit too much for me, frankly ;)

@TildalWave Then you can go all @AviD on them.

TBH the flag load on Sec.SE probably isn't bad.

It's just dealing with the one or two idiots once in a while.

Plus many of the recent closures aren't modhammers. Pretty nice actually.

@TerryChia hehehe that's the main seller for the position yup :) tho, I don't think mods we have can't handle it already and they do a good job too IMO... I think it's more worth paying attention to which users that do exhibit site self-evaluation skills should be better supported by our voting to finally reach 3k where they can help more on that front... yes, I'm thinking of @Xander here that I wish he was 3k user already, but there are some new ones too that seem quite down to Earth

@TildalWave woops, forgot @ on my last one. anyways, i totally agree that the central issue is trust, but it is my 1 true constraint. it looks like i'm at the near end of the practical rope, as i'm sure that i would not be able to program anything workable past tresor. it looks like i'll be playing keep away for a long time... — Sulla 12 mins ago

@lynks thought that ^ might cheer you up ;)

5:57 AM

@AviD Use a RasPi with XBMC and a usb HDD? Or is that not what you meant

@TildalWave Went well, it was only a short one, i had a nap, then got back into it. No SQLi but plenty of things that broke the application in the end.

I would have liked some more time to test and a wider scope, but oh well.

Back to trying to set up my newest firewall :P

@D3C4FF What is it?

@Adnan paloaltonetworks.com/products/platforms/PA-500.html

6:14 AM

@D3C4FF Oh yeah! We have a PA firewall, though I don't know which model. I hear they're pretty smart.

@Adnan They're gangster :D

A bit pricey.

But they're solid

my only complaint, the UI is shit slow and making changes requires a 'comit' which takes between 5-20 minutes

._.

I remember when our sysadmin was testing the SSL inspection

He deployed the fake certificates using Group Policy

Luckily I had Certificate Patrol installed on my browser

@Adnan Yeah it does a pretty solid job at that, i'm quite fond of the traffic analysis

I haven't found a way around it, so i thought i'd buy one, try find a way

@D3C4FF If you're whitelisting protocols, of course it's gonna be really difficult to bypass it, which is the case in most corporate environments.

@Adnan Indeed. But usually tunneling applications works (like tor over HTTP/over bridges etc) but not with this thing

6:24 AM

@D3C4FF Yeah, after our discussion the other day, I played with our backup firewall. Turns out it looks inside the HTTP request, it sees that you're not exactly sending normal plaintext as the request's payload, so it flags the connection.

Luckily, it's against our policy to strip SSL traffic, and that SSL inspection was just a test by the sysadmin.

@Adnan Clever hey? :P

@Adnan Yeah, very few compaines actually SSL intercept

Also, other PA drawback.

NOISY AS SHITTING BRICKS.

@D3C4FF That's why you have a soundproof server room :D

@Adnan Yeah, my warehouse doesn't yet have one of those... >_>