user12986714

general recent conversations

Charcoal HQ

Where smoke is detected, diamonds are made, and we break thing...

user12986714

Dec 23, 2021 03:49

ohhh windoze nooooooooo

user12986714

Dec 23, 2021 03:42

Mostly I'd much rather have vim { ask owner /** rw, } rather than vim { owner /** rw }... Especially since vim modeline has a lot of vulns but it is Convenient(TM). But this is off topic for Charcoal anyway... :(

user12986714

Dec 23, 2021 03:36

I thought you are an AppArmor expert :)

user12986714

Dec 23, 2021 03:35

@ThomasWard By the way, is there any way to let AppArmor execute a userspace program to decide allow/deny?

user12986714

Dec 23, 2021 03:00

user12986714

Dec 23, 2021 02:59

re CSRF, I think posting an "image" in SE chat is pretty much enough

user12986714

Dec 23, 2021 02:59

Now that it is fixed, the problem is mostly because grep has an argument -f, which takes a file. So I can do '-f/dev/random' to crash the entire VM

user12986714

Dec 23, 2021 02:56

:+1:

user12986714

Dec 23, 2021 02:32

Also pretty sure there is a easy DoS exploiting this... But I think we are not concerned about those as of now?

user12986714

Dec 23, 2021 02:31

@thesecretmaster A question: are there any reasons why developer#production_log is a GET route? This makes it pretty vulnerable to hypothetical CSRF attacks. Note that such vulns has been discovered in the past (github.com/Charcoal-SE/metasmoke/pull/766, arbitrary RCE)

user12986714

Dec 22, 2021 22:25

@user12986714 github.com/github/dmca/tree/…

user12986714

Dec 22, 2021 22:12

@Undo Actually, all forks are the same git repo behind the scene if I remembered correctly.

user12986714

Dec 22, 2021 19:23

@ThomasWard @Makyen A potential vuln report ^

user12986714

Dec 22, 2021 19:22

user12986714

Apr 10, 2021 05:12

Can someone in the security team take a look at chat.stackexchange.com/transcript/message/57569626#57569626 ? @Makyen @ThomasWard

user12986714

Apr 7, 2021 05:14

@ArtOfCode ^

user12986714

Apr 7, 2021 05:14

user12986714

Nov 21, 2020 20:00

Looks like it contains title, body, user_link and username

user12986714

Nov 21, 2020 19:58

@ArtOfCode The filter string is MLLKIHJMHIHKKFMJLLHGMKIMMGOKFFN

user12986714

Nov 21, 2020 15:59

Mysql2::Error: Unknown column 'posts.title' in 'field list': SELECT posts.title, posts.body, posts.user_link, posts.username FROM feedbacks WHERE feedbacks.is_invalidated = FALSE AND feedbacks.post_id = 276115 ORDER BY feedbacks.id DESC LIMIT 10 OFFSET 0

user12986714

Nov 21, 2020 15:59

(key redacted)

user12986714

Nov 21, 2020 15:59

Gives 500 error

user12986714

Nov 21, 2020 15:58

metasmoke.erwaysoftware.com/api/v2.0/feedbacks/post/…

user12986714

Nov 21, 2020 15:58

@ArtOfCode Looks like there is an MS API breakage for whatever reason:

user12986714

Nov 2, 2020 03:36

Furthermore, although some experiments indicated a somewhat promising result, I have eventually became unable to catch up for now as RealLife kicks in. Therefore, I think it is a good idea to revoke my access to the machine.

user12986714

Nov 2, 2020 03:36

@tripleee I was given ssh access to the Halflife EC2 instance back in June. While I remain interested in the development of the corresponding project, it have been quite a while since my last code commit.

user12986714

Sep 19, 2020 18:33

:-P

user12986714

Sep 19, 2020 18:33

!!/addblu- ru.stackoverflow.com/users/405384/…

user12986714

Sep 19, 2020 18:30

!!/addblu- ru.stackoverflow.com/users/395234/…

user12986714

Sep 19, 2020 18:07

!!/test DANGEROUS CODE : cat "test... test... test..." | perl -e '$??s:;s:s;;$?::s;;=]=>%-{<-|}&|{;;y; -/:-@[-{-};-{/" -;;s;;$_;see'`

user12986714

Sep 19, 2020 01:26

!!/report stats.stackexchange.com/questions/11859/…

user12986714

Sep 18, 2020 15:20

!!/scan opendata.stackexchange.com/questions/16284/…

user12986714

Sep 17, 2020 02:06

@NobodyNada Well it is a borderline case; the medium post is on Aug. so not super spammy

user12986714

Sep 17, 2020 02:04

@NobodyNada They have posted two similar promotional answers in short succession I think

user12986714

Sep 17, 2020 02:02

!!/report stackoverflow.com/questions/63446354/…

user12986714

Sep 17, 2020 02:01

!!/report stackoverflow.com/questions/48126280/…

user12986714

Sep 17, 2020 00:59

@Rubiksmoose Many posts in the queue have 1 fp feedback, waiting for another one.

PM integration

user12986714

Sep 24, 2020 22:03

(antifreeze)

Test

user12986714

Sep 21, 2020 00:33

SD is experiencing network outage

user12986714

Sep 21, 2020 00:33

!!/alive

user12986714

Sep 19, 2020 01:24

!!/errorlogs 1

user12986714

Sep 17, 2020 15:13

@Daniil I think I have added you back to the list. You can run some dummy commands to verify.

user12986714

Sep 17, 2020 12:27

!!/stappit

user12986714

Sep 16, 2020 23:27

@Daniil Nothing; it is a bug related thing

user12986714

Sep 16, 2020 23:26

@Daniil You get it around here; this is likely to be reverted once some critical patches are applied to the kernel.

user12986714

Sep 16, 2020 23:25

@Daniil I am temporarily removing your shell access due to concerns of system security.

user12986714

Sep 16, 2020 23:17

This room was placed in timeout for 58 minutes; No reason provided

user12986714

Sep 16, 2020 23:16

!!/alive

user12986714

Sep 16, 2020 23:16

!!/sh kill -SIGSTOP 961; sleep 3600; kill -SIGCONT 961

Charcoal Test

Test results from various unofficial Charcoal clients. If you ...

user12986714

Sep 16, 2020 23:35

!!/ms-down-force-