last day (1381 days later) » 

2:46 AM
room topic changed to Security / Privacy: General chatroom for software based information security offensive and defensive topics. [crypto] [dnt] [ids] [infosec] [privacy] [security] [sql-injection] [waf] [xss]
room topic changed to Security / Privacy: General chatroom for software based information security offensive and defensive topics. owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents [crypto] [dnt] [ids] [infosec] [privacy] [security] [sql-injection] [waf] [xss]
 
 
3 hours later…
5:23 AM
cryptic ツ has made a change to the feeds posted into this room
posted on March 07, 2016

The most effective steps you can take to secure your wireless network at home is to change the default admin password, enable WPA2 encryption and use a strong password for your wireless network.

posted on March 08, 2016

Be careful: the more information you post online about yourself, the easier it is for a cyber attacker to target you and create custom attacks against you or your organization.

posted on March 09, 2016

Passphrases are the strongest type of passwords and the easiest to remember. Simply use an entire sentence for your password, such as "What time is coffee?" By using spaces and punctuation, you create a long password that is hard to guess but easy to remember.

posted on March 10, 2016

Be careful with email auto-complete. This is an email feature that automatically completes a name for you when you begin typing it in the TO field. However, your email client can easily complete the wrong name for you. If you are emailing anything sensitive, always be sure to check the TO field a second time before hitting the send button.

posted on March 11, 2016

Eventually, we all have an accident or get hacked. And when we do, backups are often the only way to recover. Backups are cheap and easy; make sure you are backing up all of your personal information (such as family photos) on a regular basis.

cryptic ツ has made a change to the feeds posted into this room
posted on January 01, 0001

A researcher has found that some telematics gateway units (TGU), which are used to monitor vehicles - primarily industrial vehicles like ambulances, trucks, and buses - do not require any sort of authentication.......

posted on January 01, 0001

Cisco has released security updates to address vulnerabilities in some of its cable modem and residential gateway devices.......

posted on January 01, 0001

The US Internal Revenue Service (IRS) has suspended a tool that was misused by attackers to steal tax information that could be used to file fraudulent returns.......

posted on January 01, 0001

FCC Chairman Tom Wheeler has circulated for consideration by the full Commission a Notice of Proposed Rulemaking (NPRM) to ensure consumers have the tools they need to make informed choices about how and whether their data is used and shared by their broadband providers.......

posted on January 01, 0001

The US Justice Department is reportedly readying an indictment against an unspecified number of Iranians for allegedly launching a cyberattack against a dam in New York in 2013.......

cryptic ツ has made a change to the feeds posted into this room
https://packetstormsecurity.com/news/view/25781/Microsoft-Patches-Flaw-From-Hacking-Team-Media-Player-Exploit.html
0 Day News ≈ Packet Storm
Microsoft Patches Flaw From Hacking Team Media Player Exploit

1441893952
https://packetstormsecurity.com/news/view/25911/The-First-Rule-Of-Zero-Days-Is-No-One-Talks-About-Zero-Days.html
0 Day News ≈ Packet Storm
The First Rule Of Zero-Days Is No One Talks About Zero-Days

1445355820
https://packetstormsecurity.com/news/view/26135/Microsoft-SmartScreen-Claims-It-Can-Block-Zero-Day-Attacks.html
0 Day News ≈ Packet Storm
Microsoft SmartScreen Claims It Can Block Zero-Day Attacks

1450472601
https://packetstormsecurity.com/news/view/26229/Hacking-Teams-Leak-Helped-Researchers-Hunt-Down-A-Zero-Day.html
0 Day News ≈ Packet Storm
Hacking Team's Leak Helped Researchers Hunt Down A Zero-Day

1452695492
https://packetstormsecurity.com/news/view/26246/Hot-Potato-Exploit-Mashes-Old-Vulns-Together.html
0 Day News ≈ Packet Storm
Hot Potato Exploit Mashes Old Vulns Together

1453308072
 
Wes
this one?
 
room topic changed to Security / Privacy: General chatroom for software based information security offensive and defensive topics. owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents [crypto] [csp] [dnt] [ids] [infosec] [privacy] [secure-coding] [security] [sql-injection] [waf] [xss]
Was sad there was no room on either chat networks for security.
 
Wes
definitely useful to have
 
If you build it they will come.
If they care about it of course.
I didn't know what to link to in the desc, so linked to OWASP guide.
 
Wes
5:33 AM
i know nothing about security but i'll stick around. maybe i will learn something :B
 
That's the idea! Learn =oD
 
Wes
would have some advices about the session / remember me cookie
i don't use ext/session, i only send a session cookie. it's 128 bytes long. as a kick off, how and when should i regenerate it?
 
I need to compile a TOC with links to documentation and papers for various topics.
Well if you are using PHP you'd use secure.php.net/manual/en/function.session-regenerate-id.php so to retain the session data, as for the interval...
 
Wes
would be useful
 
you'd regenerate after the session has been authenticated i.e. user has logged in. Otherwise you could be susceptible to a session fixation attack.
 
Wes
5:45 AM
i do that even when the user is authenticated, like every n minutes
 
Over HTTPS?
 
Wes
nope. no idea yet of https :B
i'm mostly doing software that is not accessible through internet these days
 
If over HTTPS I don't see the benefit of changing it as the cookie is protected. If you don't have HTTPS, well you shouldn't be logging people into their account in the first place =oP
 
Wes
but i will have to look at https eventually
the information about https is hella confusing. in my mind it should be the default. if it still struggles to be adopted these days it's because clearly something is wrong with the information
 
LetsEncrypt is available
 
Wes
5:50 AM
last time i tried to get updated about it i ended up reading about hashing algorithms. and ain't nobody got time to read that
 
even major sites like *cough* wordpress.com is using it.
automated, I do hate the short expiration limit and no wildcard support, but those may be fixed once it's out of beta.
 
Wes
ok this is interesting
 
I haven't tried the automated tool as it will modify your nginx configs, which I don't want it fucking up. I did the standalone server verification and setup.
 
Wes
nginx is another thing that is an hell to switch to
php-fpm.org last updated in 2011, version 0.x
also there is an alternative implementation for that, right? and here comes the confusion
 
php-fpm is built into PHP since like forever. I don't know if it comes precompiled in distribution, I always compile PHP myself and enabled php-fpm. Using it with Nginx is pretty simple.
location ~ \.php$ {
    include fastcgi.conf;
    fastcgi_pass unix:/some_path/php-fpm.sock;
}
 
Wes
6:03 AM
so what is the other alternative implementation that some say it's better?
 
I didn't know anything was better. php-fpm allows you to create separate pools for each site/service. Which allows you to set pool specific php.ini settings, workers, and even chroot it.
chroot is a bitch though. The less extensions you have loaded the easier it is, but getting all the correct dependencies in the chroot is a nightmare.
 
Wes
php has way too many bundled extensions
php.net/tidy why is this even in core. it wasn't useful when having nicely indented markup was trendy, imagine how useful it is now...
 
I disable all extensions even things like dom and JSON. Then I enabled them per site as needed. Lowers any potential threat footprint and I'm sure it helps a bit on resource load as well.
 
Wes
i do that as well
json can't be disabled though. maybe in the past but now it's forced to be enabled
 
nope, when compile compile each extension as 'shared' so it creates a .so file in the extension directory. Then you load that extension as you would the bundled ones.
 
Wes
6:13 AM
ah, right you compile php yourself
 
I've got 40 .so files
technically PHP has 39, but I also compile libsodium-php
 
Wes
json is an extension i'd have always enabled. i do design all my classes to be serializable as json by default as most of times you end up doing that anyway
then i always use pdo, mbstring, bcmath, and intl
occasionally gd2
others are all disabled
 
I've found json, openssl, and ctype are the most common ones I need to enable for 3rd party apps to work.
 
Wes
i'd use some of them if they werent that old. dom is barely usable these days for instance
you can reliably use it only with xml
what is ctype for?
 
mcrypt is crap compared to libsodium. Scott is working on pushing to get it replaced in I think PHP 8 I think.
the ctype_*() functions
useful for checking that a value is a string, int, etc and I think it's faster.
 
Wes
6:19 AM
oh, you can use php.net/manual/en/intlchar.isupper.php IntlChar now though
uses ICU internally, which is possibly the nicest lib php bundles
 
@Wes I didn't remember seeing that in the PHP7 changelog.
 
ah so it was added to PHP7 back in 2014, but someone forgot to add it to the PHP7 changelog.
One day nobody will know what is even in PHP anymore. We'll just type random words and see what it does.
 
Wes
yeah could be lol
lol, yeah
i dream of php being just userland stuff and pecl
 
Have you tried Zephir?
 
Wes
6:27 AM
yes, i don't like it
 
oh why not? I haven't tried it yet since PHP7 support is still buggy.
 
Wes
i only remember that hack is more interesting currently
but also that is not very interesting
 
cphalcon?
 
Wes
looks a mess built on top of something that is already very messy
phalcon the framework?
i don't like frameworks :B
 
yeah, it's a c-extension using Zephir
 
Wes
6:30 AM
yeah i don't like that
 
I plan on using it to for my report-uri servers for my CSPs and HPKPs for it's speed.
hi @user2723335
 
Wes
your first guest
 
only 6pts so can't talk.
 
Wes
@crypticツ you sure it's a good idea? i haven't heard good things about phalcon and zephir
 
I'll reconsider now, I haven't begun work on it yet.
 
Wes
6:34 AM
i dislike forks. it's wasted energy :B
i mean, unless forks have the purpose of creating competition
 
like HHVM?
is that a fork though?
 
Wes
i don't think hhvm was intended to be like that but it resulted in php having to keep up with it, and now it's even possibly better
although still slightly different
node.js and io.js is a better example. do you know the story?
 
nope
 
Wes
that was basically just about politics, not technical stuff
 
i've compiled a node.js program before
but i still don't understand it... is it javascript?
i compiled a chat bot in the command line
 
6:42 AM
@Wes sounds like MySQL and MariaDB, but the latter got millions in backing by Google not to mention the mass exodus of core devs to MariDB.
 
Wes
yes, same thing
just made the first commit of a new project \o/
nothing works yet, but gotta start somewhere
 
link me!
 
Wes
private for now :B
 
6:59 AM
That's what I tell people when I'm embarrassed about my code.
 
Wes
ahahah
i'm embarrassed about several things, it's incomplete, it has weird english comments mixed with italian ones, readme with swearing, etc. :B
 
Wes
7:29 AM
ISP drives me nuts
i will shamelessly ping people just to bring them there though
 

  last day (1381 days later) »