The DMZ - 2013-06-11 (page 1 of 2)

« first day (908 days earlier) ← previous day next day → last day (3981 days later) »

1:00 AM

@ScottPack man I really didn't like it, and it's not the violence at all, but that it felt like... dunno, hard to describe, it's like someone is babbling yada yada for hours on end but keeping you interested, then all of a sudden says to forget all that's been said and it isn't relevant at all to the point he's trying to make... then goes on with more babbling yada yada... I really felt stupid for trying to pay attention to it

It's like trying to maintain your own credibility while being served a beer at Hooters

1:22 AM

Well, from what I understand that scene was written because Martin realized he had too man freaking main characters.

In retrospect I'm happy about it, though. The fallout makes for some pretty exceptional story.

6 hours later…

7:17 AM

@Xander 'we provide user data to governments only in accordance with the law.' Which governments, which law?

@this.josh plausible deniability.

yes, we choose where the data is after we decide what we want it for.

@ScottPack well, no, not bad, just naive, childish, entitled, and disrespectful. Now she's really developing into the Mother persona.

Also, she's damn hot.

@TildalWave I know what you mean (ish). The collegehumor version was spot on.

then pick the right law and presto, it's legal

> "I'll make you like this character.... THEN I'LL KEEEEL HIIIIM!!!

@ScottPack so kill off the side characters! not the ones in the center of the conflict.

though I imagine it would make the story be more engaging, if he pulls it off.

he keeps changing the focus of the story too, which is not a bad thing - if you thought it was about political shenanigans, its not. just when you think its about the war between starks and lannisters, he changes it again.

one thing it's definitely not, is a feel-good story.

8:11 AM

@AviD It was pretty obvious from the books that the story has never been primarily about Starks vs Lannisters. Not so obvious from the show.

@TerryChia in the books, IS there one thing that you could say the show is about? Besides "Westeros", of course.

but no spoilers, of course.

@AviD Is this... possible?

@AviD I'll say the story is building up to the eventual confrontation against the White Walkers.

@AntonyVennard I think that would result in an integer overflow of Time.

@AntonyVennard Legend tells us that in the very distant Appalapchixi galaxy, lies the First Planet, where existence started. There, past the silver waterfall, lies the Diamond Cliffs. Since the beginning of time, there was graffiti etched into the Diamond Cliffs, and in all the eons of existance, noone has been able to translate it.

Legend tells us that it was @RoryAlsop that put that graffiti there.

@TerryChia yeah, it started going that way this episode.

my reaction: meh, not really into zombies.

@AviD Oooo.

I always wondered what that said.

8:29 AM

-1

Q: i find the admin page but can't use username and password that i found to deface

hi after find the sql injection bug in a site i use havij to find the tables and then i find admin table and user and pass. but i can't use them in admin page to log in.my real question is that how to use this uesrname and password to deface a website ?i search all over the web but all of them su...

sql-injection mysql

facepalm @AviD nuke please.

@AntonyVennard "Hello Sweetie" :-)

(I took a bit of liberties, thanks to loose memory...)

@TerryChia done. care to leave a corrective comment? I cant be arsed right now... phone calls and whatnot.

@AviD I'm afraid anything I would care to say would be considered rude. Where is @TildalWave when you need him?

9:06 AM

Anyone tempted by the new Mac Pro? :P

9:21 AM

@TerryChia Sure, I'm sure that somewhere there are some clueless, wannabe-hipsters that delude themselves into thinking that's "a good deal".

@AviD Heh. It's a total workhorse though.

@TerryChia So's your mom ;-)

@AviD Damn!

I must say - using an IDE for python after being used to simple text editors for such a long time feels weird.

havent actually looked at the details of the latest, but typically they are overpriced and underpowered, comparitively.

@AviD Full details aren't released yet from what I can see. It uses a 12 core Xeon chip as well as a dual workstation class GPU configuration.

It appears that most of the extended functionality will come in the form of Thunderbolt.

9:27 AM

@TerryChia okay, damn thats some full powered kit there.

haha, comment in another room: I think MSO is broken - my question has had only upvotes.

@AviD Must be opposite day.

@AviD The biggest draw of the Mac Pro is that the enclosure looks like something Darth Vader will use.

@TerryChia I WILL BUY IT JUST BECAUSE OF THAT.

then again, he'd probably only use Force User Interface, so I would need some training first.

hmm, Force User Interface, goes well with the Mac UI and Apple's reality distortion field.

This is not the OS you're looking for.

hmm, looking at it, I see what you mean. It does look incredibly sexy....

(so does your mom)

but really, who cares how the desktop enclosure looks? you stick it under the desk, in the cabinet, behind the monitor, whatever - YOU DONT LOOK AT IT ALL DAY.

reminds me of their cube.... also looked great, but nobody bought it based on that.

9:53 AM

@AviD Roflcopter.

@AviD Don't follow the light!

@AntonyVennard heh, dont worry. My taste in computing machinery runs to the more functionalist, rather than reflectivist.

though now that you mention it, where till now I thought my shiny new Corsair Graphite enclosure was gorgeous, by comparison its starting to look a bit drab.

So I googled the Mac Pro thing. If anyone is interested, it's here.

I'd personally be worried I'd mistake it for a barrel, or maybe a park bin.

Informal poll: Anyone likes using the git interfaces in IDEs? I never found one I really prefer over simple CLI commands.

@TerryChia Nope. I'm a git command line only type person. The UI takes forever.

@AntonyVennard I would like to hang out in parks where the bins look like this.

9:59 AM

On another note, is it possible to get the damned Powershell to have tabs? I have like 5 Powershell windows open and it's annoying.

@TerryChia and I'm an hg guy.

@TerryChia try using the ps ise?

Yes. The PS IDE is amazing.

@AviD Ahhh! Didn't know that existed. That will work.

But dammit man @AviD! You just gave me one less reason to complain about Windows...

10:23 AM

@TerryChia hahaha, you poor baby.

Face it man, Windows rocks. Only reasons you can find to complain about it, stem from ignorance.

Okay, that's not strictly true - I have a few valid complaints, and there are many others.

but I would say most complaints that are raised against it, are either religious, ignorant, or prehistoric.

@AviD Wait, isn't it hip to hate on any Microsoft product nowadays?

@TerryChia exactly, hipsters = religious ignoramuses. They hated on MS long before it was popular to do so.

@AviD I hate on Microsoft and write server-side javascript. Deal with it.

@TerryChia hahaha

@TerryChia you disgust me. ;-)

@AviD - that does sound like the sort of thing I would carve into a diamond cliff

I always liked the way the light on the front of sgi's Octane looks like it follows you. So it is definitely supposed to be on a desk where you can see it

10:31 AM

@AviD "AVID also has access to information from PRISM" translate.google.nl/…

@D3C4FF well of course I do. Where do you think they keep those big PRISM mainframes, if not in my lair?? :D

@D3C4FF Ah so that's what he has been doing in his bunker.

@TerryChia LAIR, maan, not bunker. BIG difference.

@TerryChia Explains it all doesn't it? Those absences when he's 'Sleeping'

@D3C4FF Hibernating, to run daily maintenance and AV scans. Wait, you didnt think I was human, did you?

10:33 AM

@D3C4FF Indeed....

@AviD Of course not. Its just like sleep mode on a computer!

@AviD You need AV scans? What, you run on Windows or something?

;)

I'm buzzed on RedHat propaganda after a visit to their office today, so forgive me for my Windows hate. :P On the up side, I got a free polo tee.

@TerryChia no, but I wear a condom when running AV.

@TerryChia 301 news.ycombinator.com then ;)

And that's *another* crypto conference I've been kicked out of. C'mon, it's a great analogy!

10:36 AM

@AviD I think the problem isn't running an AV on voting machines. It's running McAfee AVs on voting machines. Those things suck real bad.

@TerryChia I love free (wet) T-Shirts!

@TerryChia yeah, almost nearly as bad as symantec.

@D3C4FF Of course you do.

what the wreck you are .., sorry but i'm it security student..., on ongoing course...., dont mess up and tell me about that tool, unless i'll search out my own — vabo juninho 38 mins ago

What?

Can anyone parse that sentence?

@TerryChia Does anyone even lift?

11:09 AM

@TerryChia ParseError: No sense at all Exception

why would you run ipconfig to view browser history.?

user image

4

11:29 AM

@TerryChia Nope. +1'd

@TerryChia God damn it! This is the 2nd Blue Screen of Death I get while parsing comments by new members.

11:49 AM

@Gilles Is it just me or does that key exchange protocol described make no sense at all?

I mean, the key exchange is encrypted (presumably with a asymmetric key), so even if I intercept and replay the session key, I won't be able to send/receive legitimate looking data anyway.

I was typing out an answer halfway before I realized it makes no sense at all to me.

@Adnan heh. STOP USING WINDOWS! :P

Blog - Stack Exchange: Podcast #49 – The One Where We Edited Out The Title Reference

Alex Miller on June 11, 2013

Welcome to episode 49 of the Stack Exchange Podcast! We are welcoming special guest Matt Grum, as well as usual suspects Joel, David, and Jay. Matt is the top rep user on Photography. He’s got 957 answers (and has never asked a question)! He’s a photographer and a developer, so his exposure to the Photography site came from his involvement with Stack Overflow

First, some site milestones! Blender is in public beta. (Matt is way more qualified to tell you what Blender is than any of the rest of us.) Also, the second attempt at a Freelancing site is successfully moving to public beta. …

12:06 PM

user image

BEST.COSPLAY.EVER.

lol

12:26 PM

@TerryChia Flagged as Offensive.

@AviD Your face is offensive.

@TerryChia is that supposed to be Danearys? If so, not enough boobies.

@AviD I'm not sure you want that guy with more boobies.

@TerryChia no, not him.

12:56 PM

@TerryChia what do you need me for? that is quite obviously a request for support with illegal, possibly criminal activity and the lack of any explanation of it's intention doesn't make it any less so, even if we're capable of understanding it might be for educational purposes afterall. I doubt the site can afford to be seen in such light, so nuke it from index and keep the data in the archive.

@TildalWave You excel at patiently explaining stuff to idiots who don't seem to comprehend you. :P

It was more a reply to "leave a corrective comment"

Hmmm.

user image

Someone in Apple must really love Star Wars.

@TerryChia Oh you want to abuse my seemingly endless patience to deal with those that don't deserve it, is that it? How could I say no? :))

@TerryChia this looks similar to some Asus project that didn't quite make it... but since it's Apple the 1st thing I thought of is I wonder where they stole the idea from LOL

1:12 PM

@TildalWave Ehh, that thing is pretty damn amazing if you consider the power/size ratio.

that project was a bit more modular , basically an idea that you could attach different "rings" (fans, storage, mobo, PSU,...) one on top of another into a cylinder shape

Plus how many PC workstations can say they have 6 thunderbolt ports? :P

I'm really drooling over it today.

@TerryChia I thought the whole idea was that you'd only need one LOL

@TildalWave Ehh, there are still some things that can stress out a single thunderbolt port. :P

I love this: coincidence, or have they been told what to say? docs.google.com/document/d/…

1:14 PM

Each port can daisy chain up to 6 peripherals IIRC. So you can daisy chain 36 peripherals on the Mac Pro.

@lynks Ehh, sounds like pretty standard "cover your ass" legal-speak.

@TerryChia yeah I agree, I'm just playing devil's advocate..CONSPIRACY

@TerryChia OK but that still sounds like a 6-port TB hub more than 6 individual TB controllers to me... and I don't think the system could handle so many of them individually anyway, too many PCIe lanes

1:35 PM

@lynks you're ignoring the obvious third possibility: like everything else in zuckerberg's career, he is simply copying Page's statement verbatim.

4

1:51 PM

Shitty questions, shitty questions everywhere

@AviD It is all about political shenanigans, really. You'll find out more later.

@TerryChia link for reference: security.stackexchange.com/questions/37277/…

yeah, I don't understand the protocol either, but we're only getting a small part of it, we don't know what K is

Hmm.. I was surprised to find people I know from my city data.stackexchange.com/stackoverflow/query/119691/…

@Gilles I assumed that K is something like RSA or some type of asymmetric key pair, considering the text used the word session key.

hmm, anyone have any ideas why someone may have downvoted my question security.stackexchange.com/questions/37238/…

@TerryChia I now almost want to buy one and shine a blue light out the top that starts bright and gets dimmer

2:01 PM

@AJHenderson No idea, looks rather ok to me. Gave you an upvote.

thanks, I understand why it hasn't gotten many upvotes since it's pretty highly specialized, but the down vote had me scratching my head

maybe someone thought it was too localized

though I think the broader question of Windows user authentication behavior is applicable to a wide enough audience

@AJHenderson no, I think hating on Windows is pretty widespread.

though that would explain the downvote - whye u so stoopid using windoze

@AviD that could be it too I suppose, though then I would think they would rather answer gloating about how poorly it deals with the attack

though ironically, several Linux flavors are also vulnerable to the given attack

@LucasKauffman We have a couple of good ones.

@LucasKauffman Well, I wouldn't exactly say goood, but they bring traffic and rep.

@LucasKauffman the way I look at it, at least people are thinking about security, even if they don't really know how to ask a good question

2:05 PM

@AviD Starred. :)

@AJHenderson Thing is, what they think is security usually isn't security at all.

@TerryChia yes, but if they come here, we can correct them on that and steer them in the right direction

I know I've personally lowered my quality standards a little bit for the questions that are obviously being driven by an increase in interest about security (one way or another) due to the recent leaks

@AJHenderson thats not really ironic. Discover a new vector of attack, odds are most OS's will be vulnerable. The real question is how vulnerable, and how quickly its patched up.

@AviD yeah, I realize, it was more ironically to the idea it may have been downvoted for "stoopid windoze"

On the topic of crappy questions: @AviD @RoryAlsop Do you have stats on reopen votes and are you able to share them with us non-mods? I was curious as to the number of questions that have been edited and reopened. I often see this touted as a nice part of a StackExchange community but I have no idea if it's actually effective.

@AJHenderson ah, I see. The irony there would be the cognitive dissonance, as they scramble to explain why "that's different".

2:08 PM

the key with the Inception thing is that it can't be fixed while still being fully Firewire compliant either unless the firewire spec is updated

@TerryChia hmm, dont know offhand. Can go digging later.

@AJHenderson Wait, FireWire still isn't dead?

@AJHenderson well there you go. its not an implementation bug, its a design bug.

vulnerable by definition.

spec bug.

@AviD Cool thanks, it isn't part of the stats 10k users can see. I think mods have access to way more though?

basically firewire has to allow DMA access and doesn't provide sufficient spoof prevention

so password subroutines can be overwritten. Reason nobody really blinked is it requires physical access and once you have physical access, system is basically not yours anymore anyway

but if it also allows network access, that's a bigger deal

and I'm not sure since it is replacing part of the unlock which may or may not break network authentication

and my test AD server is currently out of commission due to hardware failure

and I really don't feel like setting up an entire VM test lab

@TerryChia and no, thunderbolt as Apple is now calling it is still alive and well

though Apple did atleast decide to break from standards and disable DMA when locked

so their latest version of OSX is immune

though also not 100% firewire compatible

2:15 PM

@AJHenderson Eh... they aren't the same thing..

I think it was deleted

@Terry Can you see that "easy-peasy" question?

@Adnan I don't think I can see any deleted questions unless it's linked somewhere. If I can, I haven found the page/button yet. :P

Oh wait, it's in the tools page. Hang on lemme check.

@TerryChia only 3 questions re-opened in the last 30 days

@TerryChia Thunderbolt is a newer version, but still implements IEE1394 as well. It is directly backwards compatible

@Adnan Nope, nothing remotely similar to what you mention in the recently deleted page.

@TerryChia Damn, it was a good one. I'll try to find the link, it must be somewhere on Google.

@TerryChia Google strikes again..

security.stackexchange.com/questions/37248/…

2:20 PM

@TerryChia you actually have access to that info under Review...Tools...Close...Recently Reopened

Oh.. the author removed it :(

@AJHenderson Any source for that? This is the first time I actually heard someone mention that (not to say I dug that deep into the topic). It isn't mentioned on the wiki page of FireWire or Thunderbolt as well

@Terry Can you see it, though?

@TerryChia personal experience plugging in to it?

@AJHenderson Nope. Don't own any firewire or thunderbolt devices.

2:22 PM

No, I mean that's my source

@Adnan Yeah, reading it right now.

I've physically plugged my firewire devices in to my buddy's thunderbolt port

it takes an "adapter cable" but it appears to basically just be a pinout change

and I know that Thunderbolt is vulnerable to the same attack due to that support

So, for those not in the Twitterverse, I connected a few dots this morning:

1. Xbox One is being non-optionally bundled with Kinect.
2. Kinect for Xbox One will always be on, even when the console is off.
3. Xbox One will require a daily Internet connection to play games.
4. Microsoft is signed up for PRISM.

Anyone else seeing the problem, here?

@Iszi Nothing a piece of masking tape can't fix ;)

@AJHenderson And for the microphone?

2:26 PM

hmm.. white noise generator?

that or just play britney spears in to it all the time

though that might get you branded as a terrorist

(possibly legitimately)

@AJHenderson Eh, that's quite a claim that Thunderbolt implements IEEE 1394 just from personal experience. This is the first time I have heard this mentioned anywhere. My understanding is that Thunderbolt is essentially a mini-DP connector slapped in front of a PCI-e slot. I don't think FireWire is remotely similar? Not challenging you or anything like that - I don't have any experience with this sort of things.

Would it be too much to ask for ability to remove one's VTC? We're clearly actively working with posters to edit their questions/answers to be more in line with recommendations and requirements, and some actually respect that. They then edit their posts, but VTC remain.

@TildalWave There was a mSO post about that. I think it was another one of Jeff's "Over my dead body" thing.

@TerryChia that's what I was afraid ... not good, because not all sites on SE are as unmanageable as SO

@Iszi problem... why would I have a problem with an always on hi-def camera and microphone in my house connected to the Internet controlled by a company who has a data sharing agreement with a country who then shares that information on to other parties as they see fit and who's only accountability is to a court who have only rejected 0.03% of the requests made

@Iszi surely as a law abiding citizen there's no problem here

2:38 PM

@TildalWave Oh, it isn't. It says status-planned meta.stackoverflow.com/questions/915/…

@RoryMcCune Wait, they rejected a request?

@Iszi apparently so

that was the stat I saw anyway

@TerryChia yey! cheers for looking :)

I wonder if companies will start requiring employees to unplug their Kinects (or just not own one) whenever they telework from home?

@TerryChia I could be wrong if Apple slapped a really small really cheap firewire chip in a thunderbolt cable.

but a $30 cable is able to provide Firewire connectivity through a thunderbolt port

2:42 PM

@AviD If you're still around, spam here: security.stackexchange.com/a/37289/12

Or @RoryAlsop

@TildalWave VTC?

oh

nm

vote to close

@AJHenderson oy! caps! :))

@Iszi someone asked to see their info

clearly they just needed to be excluded, then it was fine to go forward

@TerryChia either way, thunderbolt is also vulnerable to the same attack (by design as I understand it)

@AJHenderson Yeah, Thunderbolt is basically a mini-DP connector slapped in front of a PCI-e slot. It needs to be able to perform DMA.

@TerryChia We chatted about this in the office this morning. Given how much different stuff the Thunderbolt connector can do I find it pretty reasonable that on link-up the driver could do some protocol detection and figure out what you've plugged in.

2:54 PM

> Similarly, when I see that a homemade construction of "hash the data with the secret appended" is described as "a good way", I cringe and growl and shed tears of blood. Haven't they heard of HMAC ? Do you want to follow cryptographic advice from people who have not heard of HMAC ?

I miss the bear

@LucasKauffman where did he go

@AJHenderson he ascended to a higher form of life

@ScottPack Maybe..

@AJHenderson He is teaching those punks at NSA a lesson in cryptography.

@TerryChia Maybe the bear IS prism

3:04 PM

@LucasKauffman Nah, PRISM is waaaaay too primitive to be The Bear.

the bear made the system that spies on the guys using prism

My first that I approved a minor suggested edit just to move that XKCD password strength up the list so we hopefully can avoid more "how safe is my password" questions that seem rather popular lately LOL

@RoryMcCune Lol! ..Why would your always-on hi-def camera need to be connected to anything but your own network?

@LucasKauffman It's true he's not been around for a while, but that doesn't really grant you the right to confuse him with unicorns! You're in danger of forcefully seeing all the colors of the rainbow if he hits you with that PRISM :P

Anyone who caught the latest GoT episode find the ending to be really really cheesy and lame?

3:10 PM

@Dagelf well I believe with the XBox one because they want to watch you for example to "reward" you for watching adverts (not sinister at all!)

@TerryChia NO SPOILERS!

@LucasKauffman Robb Stark died.

:P

@TerryChia Well all starks will die eventually

Oh yes, of course. I'm looking forward to the day computer intelligence renders all our security useless. :-p ...Scary on the one hand... on the other, it begs the question: what makes you different from anyone else and why would anyone watch you?... Personally.... I'd have no issues if I could simply "watch back" ie. see exactly who is watching me and making sure they see how much their ad is annoying me...

@LucasKauffman valar morghulis

3:15 PM

I still find it a pitty that they will replace Tyrion

Well, after a day of use I feel comfortable enough to recommend PyCharm to anyone who needs a nice IDE for python.

@LucasKauffman They will?!?! Oh man...

...but what if it, if it's "sentient Google" watching... "sentient Google" will in no time at all reach a point where it wouldn't need to watch, it will just tell them up front that their ad won't work... or what they need to do to make it work, in which case it wouldn't need to watch :-D

@TerryChia yea they are replacing him with Warwick Davis

@TerryChia pycharm rocks

especially the way you can deploy code with it

@LucasKauffman I'm still getting used to the buttload of features. I have been writing python with simple text editors for sooo long.

@LucasKauffman The new guy will have huge shoes to fill. The current actor is awesome.

Regardless... interesting universe we live in... specifically the fact that so many things in our lives and worlds are purely position-bound.

On the surface, if you're born into a rich family, you have a better chance of being better off... or if you're born with enough wits to "escape your situation"... or if you're at the right place at the right time, and you've learnt the right lessons so as to be ready for that "opportunity" presented to you...

But if you're intelligent enough you can turn most any situation into an opportunity...

If you were born somewhere else, or in another time, would you be someone else?

Okay... back to work. :-)

3:20 PM

@Dagelf the problem is not necessarily the informations primary use, more that once the data on your habits is a big-ass database somewhere, people can mine it and pull incorrect conclusions from it, which could cause "bad things"

@iszi motherjones.com/mojo/2013/06/… source for the 0.03 :)

Yup, exactly.

Which is why I like SE's "reputation" policy.

You have to go through an "initiation" process to earn reputation points...

@RoryMcCune Nevermind if that database ever gets hacked/leaked...

You know what really sucks? The fact that we have the technology required to fix our governments and legal systems... but everyone becomes too cynical or demotivated to actually do it by the time they realize that it's necessary...

@Iszi well yeah the OpSec of these systems would be interesting, especially given that they'll inevitably use low-bid contractors for some of it :)

Woah!

user image

@TerryChia I WILL CONTINUE TO SPECULATE WITHOUT INFORMATION

3:25 PM

Know what I'm thinking? In all this mess, perhaps the biggest news is really that there's a 30-year old these days who is willing to give up his $200k/year job, residence in Hawaii, and possibly his freedom and his hot girlfriend, to blow the whistle on his government. That takes balls this world hasn't seen in ages.

@Iszi indeed it's either really impressive or really stupid, I can't make up my mind which. Definitely took courage though, no argument there!

@Iszi and he has disapeared...

3:52 PM

I appreciate the way he handled the leak more than old man Manning did.

So I'm trying Pandora instead of a local iTunes playlist. I notice Metaltech isn't available in Pandora.

Slackers.

@ScottPack They're in Spotify though.

The thing I like about Pandora is that I basically seed a playlist with things I like, then it figures it all out and I get to hear all kinds of other things too, that I usually also like.

Does Spotify do that, or how does it compare?

@Dagelf do tell what tech that is?

@ScottPack Spotify has a similar function on most platforms, but not on WP8.

@Iszi WPwhut?

4:07 PM

Their main feature is on-demand access to tracks & albums.

@ScottPack Windows Phone 8 :-P

Is that part of the paid stuff?

@ScottPack Might be.

@Iszi he wanted to feel important. It does sound like he over inflated himself in the interview. It may be FUD, but he was supposedly only making $122k. That said, he did still give up a lot, but he still struck me as a bit full of himself though. Not to the scale that Manning or Assanage is, but there seemed to be elements of it.

and that's not just from details released from the government, but also some of how he conducted himself in what I caught of the interview

@Iszi It's somewhat cheap, so I may be willing to pay for it. Right now Pandora gets me everything I want for free, just every now and then I'll hear an ad.

@ScottPack WP8 doesn't get the ads, for free.

4:10 PM

I'm still confused. You're using letters that I recognize, but not in that order.

I'm also going home. I need me some noms.

@ScottPack agreed on that though I'm still not 100% convinced there couldn't have been better ways to get the information out there. Sure good came from some of what manning leaked (exposing over classification) but a fair bit of the information leaked by manning was justifiably classified too, even by the most loose interpretations of what should be secret

The one thing that still seems to be getting glanced over is that the really big issue is the overuse of classification rather than the spying

I can possibly see a case being made for why the metadata particularly is necessary (still not sure I'd agree with it, but I can see where a case could be made), but I can't see any case for why that collection had to be secret

and I'd love it if the government would give a justification for that part

but I doubt we'll ever get one :(

@AJHenderson I can tell you what their justification would be. "If the terrorists know we're looking at GMail/Hotmail/Insert-Service-Here" they'll just quit using it and communicate another way that we're not tracking." It's not a valid justification IMO, but that seems to be the party line for stamping "classified" on everything.

@Xander I was more thinking about in terms of knowing that they are tracking phone call meta data. I could understand keeping the list of companies secret

but saying "we collect meta data on phone calls made and have access to get to records that we request from online databases" is hardly all that surprising and rather hard to argue would negatively impact national security

@AJHenderson Gotcha.

and still would allow a dialog to occur if the public considers that worth the privacy costs

overall, I wish there was more oversight on the classification process itself since it seems to frequently be used when something is a politically difficult truth far too often

which makes it make all the more sense why we see an explosion of it under Obama since for Bush, it was more politically popular and thus didn't need to be hidden for political reasons

but Obama wants to seem different so his administration tries to hide it more

even though they are doing the same

but then you also have the tough question of how to do you review or police that? Leaks always have the risk of having some negative impact to security that the leaker didn't think of. I almost wonder if what we need is some type of an internal system where someone can report material they feel is inappropriately classified

though it does ask how do you insure the integrity of that process too

seems like there should be a good, legal path for someone to take that finds information they are exposed to that they feel is inappropriately classified though without having to leak it

4:29 PM

Quick question for Android users out there. Assuming a non rooted phone, can one app access another apps database?

It is possible for a trust to be setup I believe

but normally no

each app has it's own user unless trust is otherwise given

@AJHenderson By trust you are referring to the list of permissions one has to grant when installing the app?

I don't remember the exact details, I think it is based on signatures of the applications that should have access

@AJHenderson Alright, I'll do more research/ask on Android.SE. Thanks. :)

so like if I'm writing two apps that I want to be able to access each other's data, I believe I can give one the signature of the other so that it will allow them to interact with each other's data

but I haven't looked at it in that much depth in about 3 years

so this is off the top of my head and covered in rust

and may have changed since Android 2.2

since it's now on 4.2.2

4:33 PM

I'm doing some research since this question of mine got me interested: security.stackexchange.com/questions/37203/…

@TerryChia of interest to your question source.android.com/tech/security/index.html

If it is at practically difficult/impossible for someone to access the Authenticator's databse assuming a non-rooted phone, it should at least be as secure as average complexity passwords.

And hey, I get a good reason to dig into Android's security models. :P

if the app does not intend to grant access, then other apps can't access it

unless rooted

@AJHenderson Thanks for the link. :)

or a trusted app

4:36 PM

I figure I'll find out some facts and throw them into an answer. I'll let people draw their own conclusions.

trusted apps, device administrators and the kernel can all access areas of other apps

but a user space application can not access another application's storage unless it is configured to be permitted to do so by the developer

@AJHenderson What do you mean by device administrators in the context of an Android device?

Device Administrators is a particular class of program or service granted control over portions of the device not normally allowed by an application

for example, some Exchange systems require being granted Device Administrator so that they can enforce security policy

similarly, Lookout Mobile Security has an ability to function as a device administrator to give it further control over the lock screen, an extended ability to wipe the device and better ability to hide itself

I don't believe device administrators get quite root access, but they get substantially more access to the device than is typically allowed for a user space application

@AJHenderson Interesting! I didn't realize there is such a distinction between apps until now.

yeah, preinstalled application have additional rights (which is why they can't be uninstalled without root)

and Device Administrators is a fairly rarely used portion of the Android system, but has a lot of interesting implications

or were you refering to the sandboxing between apps

they manage to make it fairly transparent to the user through intents

which is how apps that aren't specifically designed to interact can appear to share data

when you see the screen asking which application you want to use for an action, that's one example of intents

basically an application can say it provides one or more services with UI (intents) and then other applications can use that application when they need that functionality

it's a very interesting system

and they can be custom intents or common ones. For example, Blizzard's Authentication app can automatically pass the one time password to their WoW Armory application

because the WoW Armory application can access the intent of the authenticator

4:47 PM

@AJHenderson I was asking about an application's ability to directly access the sqlite database of another application stored in the /data directory.

looks like ContentProviders were what I was thinking of for applications sharing their data directly

Interestingly enough, even after I copied the sqlite database file into the /sdcard/ directory, I was unable to view that particular file on my Windows or OS X machine. I had to use Dropbox to get the file out of my device..

yeah, the user permissions were probably preserved

if it only gave user level read permissions you wouldn't have access to it

the actual way the sandboxing works at the kernel level is that each application is it's own linux user

@AJHenderson Ah right.... dammit i must be getting sleepy. Completely overlooked permissions.

with advanced tools there are actually ways to force shared users or even using a different user altogether, though I think some of those require root to use

well anyway, back to work

4:54 PM

@AJHenderson Cheers! :)

One night I dreamed I was walking along the beach with the Lord.
Many scenes from my life flashed across the sky.
In each scene I noticed footprints in the sand.
Sometimes there were two sets of footprints.
Other times there were one set of footprints.
This bothered me because I noticed that during the low periods of my life
When I was suffering from anguish, sorrow, or defeat,
I could see only one set of footprints.
So I said to the Lord, "You promised me, Lord,
That if I followed you, you would walk with me always.

7

« first day (908 days earlier) ← previous day next day → last day (3981 days later) »

Transcript for

Jun '1311

The DMZ

A serious place where infosec is discussed PS we don't do hard...

404-errors moderate-anarchism pretending-to-work staring-into-the-abyss

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile