The DMZ

@TildalWave Try it and let me know

@Adnan what do I need to get out?

@Adnan number of close votes for @ScottPack?

@TildalWave For example, yes.

@Adnan OK

@Adnan I only get out of those "Favorites"... data.stackexchange.com/it%20security/query/edit/117847

@TildalWave Yup. They're stripping so much data (anonymity and stuff..)

4:18 PM

@Adnan seems that way... well bollocks

4:33 PM

Am I the only one annoyed by the fact the you have to buy different copies of Ida Pro to use them on different operating systems?

Antony Vennard

@TerryChia Nope.

What's more, if you buy the Linux one you can't use the Windbg stuff available in the Windows one.

@TerryChia Also, the price is kinda annoying.

@AntonyVennard I don't mind paying the price for a license. In fact I'm actually planning to use the pay from my upcoming internship to spring for one. I just hate the fact that the license is tied to a specific platform especially since I do use all three platforms frequently...

@TerryChia You have to? That's strange! Is this only applies for individual users?

@Adnan They have different versions of license for each platform.

And it applies to all their license types.

@AntonyVennard Hmm that's a bugger... is there anything found in the linux (or OS X) version that can't be found in the Windows one?

@TerryChia Strange. We have multiple copies of the three versions (Linux, Windows, Mac). I think the company made some special deal or something.

Because I don't remember they paid separate for each OS

I could be confused though. Are we talked about this? hex-rays.com/products/ida/index.shtml

4:41 PM

@Adnan Yeah, have a look at the pricing hex-rays.com/products/ida/support/orderforms/namedworld.pdf

@TerryChia Then yes, that's the one. I'm pretty sure that each copy was treated individually (each copy had 3 versions).

@TerryChia Though I'm pretty sure the pricing was higher than what's in the PDF

@Adnan Maybe they worked out a special deal. Still sucks for any individuals who wants to purchase their products though. :(

@TerryChia True. Aren't there any alternatives that come a bit close?

@Adnan Not that I have heard of. Ollydbg is the most commonly cited free alternative on windows. And there is gdb on linux. But I don't think they come close in functionality.

Antony Vennard

@TerryChia I don't think so. I was interested in IDA for my kernel stuff, and windbg is pretty damned good if you ever touch the Windows kernel. You can ofc use the gdb stub on a VM if you have say vmware and it has the added advantage of being able to step over interrupt instructions (which the KD* debuggers can't do) but, still...

4:54 PM

@AntonyVennard Yeah bugger.... I think I'll just go for the Windows one when I save up enough $$.

Antony Vennard

@TerryChia It's okay, you can debug Windows with the Linux one. What I don't know is whether you need to do anything fancy to make it understand the symbols, etc.

Symbols are VERY handy.

There is nothing worse than being lost in the kernel with only addresses.

Right, got to run.

@AntonyVennard My main headache is that I use all three platforms almost equally..

Alright, it's bed for me. Have a good day gents.

Q: What are the statistics on how often client form submissions fail CAPTCHAs?

5:06 PM

0

We've got plenty of argument that CAPTCHA can easily be beaten, and that they introduce usability problems to users. People say that because they can be broken, they shouldn't be used. So if you've chosen to deploy CAPTCHAs on your forms, do you keep track of the number of users who fail (and wh...

NARQ/NC?

Iszi

5:22 PM

Didn't I just see something here or on Twitter about questions asking for statistics not being right for SE?

Gotta say, I'm a bit disappointed to see a former mod return with a question that's so VtC-worthy.

Speaking of, there's 4 on that one now. Whose turn is it to play moderator this time?

Scott Pack

Now I understand Graham's crankiness on ze twitters.

@Iszi And, yes, that was in response to you guys piling onto his question. :)

> Why does google not allow us to log out of gmail on android I thought you guys ate smart this is such a stupid idea every body reads my mail when they get my phone when I get a good substitute I will stop using gmail. Idots.

LOL

5:42 PM

@TildalWave BEST. ANSWER. EVER.

@TerryChia hehe you're really going for that Electorate badge, aren't you? 1070 votes in total in a year, and 120 votes in the last three days :))

Idots!

Iszi

@ScottPack Ah, that's where I'd heard it from.

@Adnan funny he said he's gonna stop using Gmail when he finds a good alternative... on Android, that's a bit of a problem so far :))

@TildalWave Well.. you don't understand smart fons!! Idot!!

5:45 PM

@Adnan Smartphone inside, idiot outside?

@TildalWave Idot! U no no hau 2 spell! Itz cold smart fon!

It's only Thursday and I have 24:30 hours on my log for this week already. I'm gonna be so fuuu**ed this week.

Laters!

Q: Getting internet to Linux VM without being detected by Network

6:02 PM

@Adnan DNC

@Adnan iDots? No, we're talking about Google, not Apple

1

I'm trying to get internet to a Linux VM (Backtrack 5 on VMWare Workstation). Unfortunately I was told to not "bridge" the connection from the VM because it could be detected by our companies network admins. Our company has a firewall and proxies for normal web browsing. I can get around it by s...

linux vmware backtrack

6:20 PM

For modern criteria for HMAC security, I recommend New Proofs for NMAC and HMAC: Security without Collision-Resistance, although it is hard reading and some of it goes over my head. — fgrieu 1 hour ago

if a crypto paper goes above fgrieu's head, that only leaves one person on SE who might understand it

Lucas Kauffman

2

6:47 PM

@Gilles I can't even wrap my head around what's h' supposed to be? How do you even derive an integral of what's considered a one-way function? Is that possible?

Lucas Kauffman

how long has crypto been in beta?

@TildalWave I'm sorry, I don't speak Chinese

@LucasKauffman Private beta started: 12.07.2011

@Gilles Already have voted to.

@Gilles hehe well obviously I don't either :P

Iszi

ISO 8601 was published on 06/05/88 and most recently amended on 12/01/04.

6:52 PM

@Iszi I don't like it.

@Iszi Looks like someone mixed up their medication

7:19 PM

@Gilles What in heaven's name is NMAC? What does the N stand for?

@TildalWave The definition and analysis of the HMAC construction was first published in 1996 by Mihir Bellare, Ran Canetti, and Hugo Krawczyk, who also wrote RFC 2104. This paper also defined a variant called NMAC that is rarely if ever used.

are you operating under the mistaken assumption that I'm a cryptographer?

@Gilles Yes I have that open already, but what's the N in its name? I don't know how to read it, not failing to understand that it uses two independent keys in contrast to HMAC... I would just like to call it by its name when reading, because well... I hate acronyms! :P

@Gilles compared to me, you are... deal with it :P

> In this paper we present two (related) new schemes, NMAC (the Nested construction) and HMAC (the Hash based mac).

@Gilles wow thanks yup that makes sense, I was slightly worried that it stands for New.. .where the hell did you copy this from?

7:46 PM

@TildalWave the HMAC (and NMAC) paper, which is the first citation in the HMAC WP article

@Gilles Got it now, it's in the Keying Hash Functions for Message Authentication paper (PDF). ;) Cheers!

@TildalWave You're learning Black Magic?! In Chinese?!!

8:03 PM

@Adnan Don't worry! You're safe for the time being. You can start worrying when I'll understand more than a single sentence at a time. Might take a while! ;)

@Adnan Here ^ some pr0n ;)

@TildalWave I get squeezing, but what the hell is absorbing?

> In the absorbing phase, the r-bit input blocks are XORed into the first r bits of the state, interleaved with applications of the function f. When all input blocks are processed, the sponge construction switches to the squeezing phase.

@TildalWave Sex is now ruined for me

8:19 PM

@Adnan that's what she said

@Gilles That's what she always says :(

@Adnan given your idea of sex, I sympathize (with her, of course)

@Adnan you must have been having it with... hmmm... less complex females than I did then... crypto is fairly easy to understand in comparison IMHO

@Gilles Wait what?! I do have a fairly good idea about sex. You hold hands with a girl then rub your head on her back while eating ice-cream!

@Adnan Aw how cute, you've only unlocked the 1st ice-cream eating phase! :)

8:26 PM

@TildalWave Whaaaa?! There's more?!

@Adnan watch out when it starts disappearing in bucketloads!

@TildalWave Sigh to me it's a perfectly understandable concern for a parent to have and a reasonable question to ask, even if the answer is "there's no good technological answer to this" that's a legitimate answer

@RoryMcCune Actually, I've put myself in the guy's shoes and I changed my mind about it. He still deserves an answer. You're right.

@Adnan cool :)

@RoryMcCune well I think the question could be quite easily edited to be less ambiguous and at the same time match better your answer, it's probably what he was asking about anyway, just put it a bit strange. In particular: What can I install to view what they are browsing and the media they have? I want to make sure my kids are safe. These two sentences don't necessarily mean the same thing.

8:39 PM

@TildalWave indeed wording was odd, and I restricted my answer to things that could help protect his kids from the nasties of the Internet (in as much as that's possible :) )

@RoryMcCune yup I agree with your answer actually, no problems there, I just didn't appreciate mixing between spying on what pages they're visiting and making sure they don't browse inappropriate pages. Two very distinct things.

indeed spying on people is rarely a good thing (tm)

8:55 PM

>! shame the spoiler formatting doesn't work here :(

9:07 PM

HOOOOLY SHIT!

►

It automatically adjusts for holdover, windage, atmospheric pressure and temperature. Scary!

@Xander, @AviD, and @Lucas. You should see that one

Jeff Ferland

I hearby dub thee Second Place Scott

... and really that's a shame. You're a great shot for a mod slot.

@ScottPack ^^

9:36 PM

@Adnan wow - but speaking as a non-gun type person...isn't that a bit...cheating?

@RoryAlsop Well, instead of relying on experience (or a separate ballistic application), and on your steady hand, now you have it in one user-friendly package. Of course, it gives you a great advantage, but still doesn't replace an experienced marksman. So it all depends on how you define cheating.

@Adnan I was just joking - I know so little about guns. I had one week of training in 1982, then another couple of hours at the Gun Store in Vegas over the last couple of years, and the odd clay pigeon day in the highlands

@RoryAlsop Haven't you taught a long-range shooting course here or there?

@Adnan pffft - nope. I was pretty good with a crossbow as a young kid, and I got to be reasonably good with the GPMG on may week on a cruise liner in the south Atlantic...

This one...I think:

FN MAG

The FN MAG is a Belgian 7.62 mm general-purpose machine gun, designed in the early 1950s at Fabrique Nationale (FN) by Ernest Vervier. It has been used by more than 80 countries, and it has been made under licence in countries such as Argentina, Egypt, India, Singapore and the United Kingdom. The weapon's name is an abbreviation for Mitrailleuse d'Appui Général, meaning general-purpose machine gun (GPMG). The MAG is available in three primary versions: the standard, infantry Model 60-20 machine gun, the Model 60-40 coaxial machine gun for armoured fighting vehicles and the Model 60-...

@RoryAlsop You were shooting a GPMG on cruise trip?! What the hell?!

9:45 PM

@Adnan Nope - it was a cruise liner, but all on board were Royal Marines and other military personnel..and my family :-)

@RoryAlsop Damn! That's awesome!

@Adnan My father had gone on ahead and my mother gets very bad sea sickness, so guess who looked after us lot (we were kids at the time)... yup, the Royal Marines. Awesome folks to be around when you are a teenager!

@RoryAlsop Now I'll go sit in the corner of my room and think about my teenage years.

@Adnan (I'll not mention the playing in submarines, helicopters and BV's then...)

sorry

The bit that was coolest at the time though - the Scouts in the Falklands not only got to drive armoured vehicles etc, but we got to camp out in tents...with girls!

@RoryAlsop I understand, you're a security guy, you had to put a salt on it.

9:52 PM

@RoryAlsop I think you just turned @Adnan into a human hovercraft, sobbing :))

@TildalWave the problem was I got to do a taste of various things that I haven't done since - I know what I'm missing

10:05 PM

@RoryAlsop Subs are great fun, I've been on board of the Una class sabotage submarine that's now being sold for scrap in Montenegro. It's not one of the spacious ones tho, all is really narrow in there and to think there was half of the equipment missing, I'm not sure I'd like to be in it for long when submerged... but I hear US Navy was kinda hoping they won't have to deal with those during the Balkans wars, they're really difficult to detect and swift movers too

These are the puppies ... not sure if any are still in service, prolly not

10:52 PM

These were the ones I saw - pretty tight inside as well: