« first day (3280 days earlier)      last day (903 days later) » 

12:02 AM
Anyone else having issues connecting to chat.stackexchange.com over VPN?
well, all the various chats, not just Chat.SE
oh, hm, I think I figured it out -- it's to do with my VPN, I think. BRB, gonna test some stuff.
Yup, that was it. For whatever reason, NordVPN's CyberSec feature breaks things.
works weirdly, too. It redirects connections to 127.0.0.1, which seems like the worst possible way to block connections...
 
12:18 AM
@NicHartley its a common/cheap way to
Cheap as in it takes up no bandwidth, and it an easy way to blackhole something to an IP address you know has nothing hosted on it
its the same approach that pi hole and the old hosts file blocking technique use
 
 
3 hours later…
3:01 AM
If someone would add a comment to let op know why... I can delete it. I am on my phone
 
status-completed
 
 
2 hours later…
4:44 AM
@JourneymanGeek But localhost doesn't always have nothing hosted on it. They don't route it to a specific port or anything; it's just port 80. I regularly run servers on 80.
If they're already intercepting DNS requests, it seems easier to just return whatever the DNS equivalent of a 404 is
plus, even if they ran their own thing on an ephemeral port to avoid accidentally showing MyTestSite.html when I wanted Chat.SE, just giving a domain name not found error means that whatever they route traffic to can't possibly have any exploitable vulnerabilities, because it's not there.
 
5:10 AM
@NicHartley I never said it was a smart way to do it.
 
Ah, so you didn't
 
And you can't route DNS quiries to a port
 
I misread "cheap/common" as "good", my bad
@JourneymanGeek huh, TIL. Yet more reason it's a bad idea :D
 
I mean, someone could run a blackhole on a specific IP
but you'd still need to trust them
or stick a VM/container with an always known IP that's meant to go to into the bitbucket
or an IP that's always null routed.
or...
But there's no place like 127.0.0.1
 
hm
Spitballing here: Could you redirect it to a different loopback address (172.0.0.2) and bind a socket to that receiving address
that is, if you must set up a blackhole rather than just doing a 404 like a normal person
 
5:16 AM
well assuming it worked, and nothing listened to it
 
It's less likely than something listening on 127.0.0.1
 
Using the hosts file for blocking or poor mans name resolution is.... kinda older than the internet I think
Or DNS
 
Wait what
 
Ohhh okay that explains why it was invented
 
5:18 AM
DNS was a more scalable, sensible way to do name resolution than sharing a text file between machines
 
Doesn't explain why a consumer security product is using it but now I get why it ever existed
 
@NicHartley Its cheap and...
honestly if you're running a VPN service, I can totally see running a simple, fast, low resource web server and pointing blocked domains at that.
 
It's probably no cheaper than just sending a 404
 
@NicHartley on the other hand
by blackholing to yourself, I guess there's no network traffic...
 
which requires no webserver at all to be run on the consumer's machine which is accessible to any website
Like, my big issue is this is supposed to be a security product
 
5:20 AM
@NicHartley everyone does it like that ;p
 
But now they're putting unknown software on your machine, which can be communicated with by any website you visit
@JourneymanGeek Then everyone is wrong :|
 
@NicHartley Well, product design idea ;p
 
lmao
Sure, I'll make a VPN. I'd get that one part right and everything else wrong.
 
(I wonder how pihole does it)
 
Jump ship from the sinking one to the one that's on fire and sinking!
 
5:22 AM
@NicHartley I don't trust VPNs as a security thing
 
QVPN: At least we won't be on fire for long :D
 
You're just moving the supoena from your ISP to the VPN provider. Who views all your traffic anyway
 
I trust my VPN a lot more than I trust my ISP, though
At least my VPN doesn't have a complete and total monopoly
 
ah
that's not a thing here
 
If NordVPN does something wrong, I can switch. Like I currently am.
 
5:24 AM
I mostly use a VPN to deal with my (old) ISP's incompetance
 
Whereas if Spectrum f*cks me like they've been doing constantly since I signed up with them, they can laugh at me and I can do nothing.
 
and most of the time I'm lazy and just ssh tunnel traffic through my dedi
 
I actually started using a VPN specifically so they'd stop killing off all persistent connections that lasted longer than 30 seconds
 
._.
see, that's different
 
Multiplayer games kept disconnecting, constantly.
 
5:24 AM
you're dealing with your ISP doing things badly
 
Because I guess they wanted to extort the game companies or something.
No, I'm dealing with my ISP being actively hostile
 
Ya
that's not just security though
also ISP monopolies...
 
But that's what I mean by "security"
 
The things I would say would make me suspend myself
 
It's not just "the government can't access my data"
It's "the massive, greedy, provably amoral company can't extort more money out of me and the companies I want to interact with"
 
5:25 AM
@NicHartley that's an ISP failing to live up to a minimum standard
 
Yup
 
(In singapore - I have... at least 6 ISP options with a minimum of gigabit, and... about as many mobile providers. I've currently got accounts with 3 mobile ISPs ... )
 
Here in America, they bragged about intentionally not competing and forming a cartel to artificially inflate prices.
 
But yes, that's a fine reason to use a VPN
... dude, stop tempting me to swear ;p
 
American ISPs are basically the one thing everyone in this country agrees are awful
 
5:27 AM
Other than Ajit Pai ;p
 
@JourneymanGeek suspend yourself first, then swear :D
 
No, there are plenty of people who've been lied to by their bought-off political representatives
They're not mad at Pai
 
@NicHartley I mean, he dosen't think the current setup is terrible
 
@JourneymanGeek Ah, lmao, yeah, probably not
People like him are why I hedged it :D
[cough]
anyway, justified ranting aside
 
@NicHartley that said, you could literally grab a hosts file from somewhere, set your system to listen to a arbitrary loopback address (if needed) and do a quick search and replace
 
5:30 AM
@JourneymanGeek Search and replace what?
 
(other than massive host files performing horribly... so...)
@NicHartley something like... winhelp2002.mvps.org/hosts.htm
actually that uses 0.0.0.0 0_0
 
Oh I getcha
yeah 0.0.0.0 is the "unspecified address"
Which... I genuinely can't believe I didn't remember
That's a pretty good blackhole address lmao
The one that's required to be dropped by any machine that receives a packet destined for it
 
I know, so is 127.0.0.1
 
clearly they did not have this conversation at your VPN provider
 
5:31 AM
But if it's sent from that machine it's not dropped
right, which is why I'm switching
Thank goodness for 30-day risk-free trials
 
So hypothetically
what stops you from finding a nearer VPS or dedi provider and just running it yourself?
 
@JourneymanGeek Laziness
I could run it myself, but like... why bother?
 
(but this is my own bias lol. google burnt me so many times that I don't trust outside providers for anything critical)
That's good enough
and a perfectly good reason
 
I could also just get a VPN that DNS notfound's requests instead of sending them to 127.0.0.1
@JourneymanGeek It's not really that critical, is my point
If I was trying to protect my data from the US government, I'd definitely be more concerned
But at that point I feel like I'd be more concerned with like
SWAT teams
 
@NicHartley or rely on a VPN provider for VPNs
and find a DNS provider that does the filtering you want
 
5:37 AM
@JourneymanGeek Sure. Do you know any DNSes that filter out ads/known spam sites/etc?
 
@NicHartley errr...
I was running pihole for a bit
but that's additional hardware or work
 
I mean, it wouldn't be infeasible to make a custom USB dongle that performs similar functions
 
.....
ACTUALLY
 
I happen to know you can make custom WiFi dongles with "extra functionality" for relatively cheaply
because I've done that, and oh boy is it a fun prank
Which slightly fell flat but I'm still counting it as a success
 
5:41 AM
Haha
I did something similar, but made the hardware myself
 
I have the former ... had something in mind but I forgot
I'm lazy to build hardware
 
and it didn't run anything too fancy, just watched for packets with certain contents and modified the responses
 
I did build my own router ;p
 
Nice
 
.... actually 2...
 
5:43 AM
lmao
 
(One's x86 based. The other is built on a Orange Pi r2 - just wanted to see if my slightly unusual stack would run on that)
I'm debating throwing pihole on the latter
 
What is the DNS equivalent of a 404 anyway?
NXDOMAIN right?
 
@NicHartley NXDOMAIN
 
5:48 AM
Cool, only took like 5 minutes to Google haha
 
but some ISPs do stinky things with those
 
I kept getting things like "are you getting a DNS error about your domain not being found? Here's how to fix it!"
 
My ISP did that for a while...it redirected nonexistent domain users to a search page.
Fortunately there was a setting on that search site to disable that behavior, and after I did so, I got the proper NXDOMAIN responses
 
wow, NordVPN customer service was pretty great
 
@NicHartley this, precisely, is why we cannot have nice things
 
5:50 AM
"Can I have a refund?" "Sure, can I ask why?" "[explains]" "Oh, that's unfortunate. Your refund will be on its way in 3-5 business days."
 
Longtime Private Internet Access user myself
 
No upselling, no "we need you to try this troubleshooting", no nonsense
@SonictheAnonymousWizHog I have a bad taste in my mouth from their early days when they were incredibly slow and laggy. Have they gotten better?
 
@NicHartley Much better
 
@SonictheAnonymousWizHog Nice, that's good to hear
 
Looks like they've hiked their pricing a bit; I'm on a grandfathered plan
 
5:52 AM
Oh, damn
The old pricing was really nice...
Hah, I'm still connected to NordVPN and PIA is saying I'm not protected
 
Monthly pricing went from $7 to $10, yearly pricing went from $40 to $72, and two-year pricing went from $60 to $70 to $84
 
but my ISP isn't Virtuzo and I'm not at the IP they think I am
 
Personally I'm on the $60 per two years plan
 
@SonictheAnonymousWizHog I vaguely remember it being $5/month at some point
As a monthly thing, not as a discounted long-term rate
But it's been so long that I could just be misremembering
 
That price equates to $2.50 per month
 
5:54 AM
Oh, per two years
That's pretty nice
 
 
1 hour later…
7:15 AM
 
7:27 AM
@rene ....
If OP hadn't done that, I'd have strong words.
Now I just have confusion ;p
 
well... it has more.... SPACES!
 
=> arrows are a great way
-> to indicate that you're saying something
 
@JourneymanGeek yeah. I did poke a bit to see if there is a relation between users but found no evidence, so I write if off on their appreciation for the attention their answer got.
 
8:03 AM
@NicHartley ↑↓↨
 
@Marshmallow I feel an urge to break out the Zalgo text...
 
It's not Zalgo
Not pure breed anyway
 
Its just mild unicode abuse
not even stacked diacritics
 
Mild unicode abuse ur face. I just typed alt + 24, Jesus Christ.
Now that Its is English abuse
grump
I haven't had breakfast.
 
paws @Marshmallow a dogbiscuit
 
8:06 AM
@JourneymanGeek why did you roll back this? While too minor and I'd reject the edit as such, can't see any reason to roll back? What did I miss?
 
A Mild Unicode abused Your Face. It is not very effective...
 
@ShaWiz to see what happens
 
umm....
what???
 
See what @rene and I were talking about a little before ;p
 
When you roll back, well.... there's a.... roll back.
 
8:07 AM
yup
 
@ShaWiz Sock bait r us
 
But that was also a bizzarely minor edit
 
Trying to find out if the two users are connected
 
I'd assume the OP just came back after a long time and saw... hey, what's this button? Then clicked it without knowing the effect...
 
I think it's just probably some random guy.
Unless Journey can do some IP voodoo
 
8:10 AM
@Marshmallow but how rolling back has anything to do with that?
 
@ShaWiz baiting the other user to resuggest the edit
 
@ShaWiz If this is rep . . . laundering? . . . the OP or the editor would insist
 
Answer author appears to be just someone who doesn't really care the edit was minor, he probably followed old inbox item he never noticed before.
 
@Marshmallow That's why I said I feel the need to break it out. It hadn't been broken out yet.
 
↑↑↓↓←→←→SE
 
8:13 AM
@MetaAndrewT. +1 Accounts
 
@ShaWiz so the ideal would be they both realise its not a good edit
And rolling it back sounds like one way to do it, no?
 
Oooh. The villain explaining their moral stance ↑↑↑↑
 
Wait...
I HAVE A MORAL STANCE?
 
It's simple math, little one. The universe is finite, its resources finite.
 
@Marshmallow no way... that's impossible..!
 
8:23 AM
@MetaAndrewT. Meh, it all only exists in the mind anyway. Let's go have an existential crisis in the corner.
 
What if... the corners only exist in your mind?
 
@Marshmallow Anyone can do IP voodoo if they embed an image.
 
@JourneymanGeek As long as they're cozy
 
@ShaWiz you're questioning me? You've lost faith in the flower? Go into the Shadow Wizard.
 
@forest he means the legit IP voodoo
 
@rene ha! Knew you're a sock of @Journeyman. plan succeeded
:P
 
Wait, why was that image removed?
It's on Imgur.
Huh... and why was the post deleted? I thought the Community user only deletes negatively-voted and closed questions if it doesn't have any positive answers.
 
@forest Look again :)
The image is hosted on a domain that was, weirdly enough, used in another, different spamming attack somewhere else. It's linked to an Imgur domain.
 
Oh lol I just skimmed it.
 
As did I, the first time
 
8:39 AM
Well it's not like this doesn't happen. I've uploaded images to SE to geolocate before.
And nothing in the site prevented that. It's supported behavior.
 
And I think positively-voted answers don't matter when it's downvoted that heavily, but I'm hardly the resident expert on the Roomba
 
huh
At least they don't let you embed SVGs. :P
(I don't think)
 
I've never tried it, but I don't see why not-- Oh, you can embed JavaScript in SVG.
iiiiiinteresting
 
Yeah but it doesn't execute if it's embedded.
My point was more that SVG parsers are... insecure.
 
Ah okay
 
8:43 AM
It'd be much easier to find an RCE in the SVG parser than in, say, libpng.
I think there used to be a way to execute JS in embedded GIFs.
A bug in Firefox's handling that acted as a NoScript bypass.
 
I wouldn't be surprised.
 
Not sure if it got patched. I assume so. I could be misremembering though.
 
GIF handlers used to be wildly awful
 
I wonder how often ICO handlers get audited. :P
Ever tried fuzzing your browser's favicon code?
 
Nope
 
8:47 AM
There are a lot of scary things in browsers that people don't often look at.
 
Reminds me of my source code.
 
:P
 
:D
 
I try to make the code I write look pretty (Linux kernel coding style), but it's not always secure.
I never trust my own code. Not that I trust other people's code...
 
I write my code in Rust, which means it's always totally secure against all possible attacks /s
 
8:50 AM
>not writing code in sendmail config
 
@NicHartley you could write it in perl, it would be secure against ever being read...
 
I've actually been poking at a language idea which is designed specifically to be memory-safe and constant-time
 
I actually think Perl is nice to read.
@NicHartley Constant time for all operations? What about the ones it slows down?
I mean, you don't need constant time string comparisons for grep.
 
at least within the same bounds that languages like Rust and C# use, where you can relax the constraints for performance or whatever
@forest shortcircuit { s1.fast_eq(s2) } or the like; it's hardly a fleshed-out idea
 
Honestly I just use ASM when I want constant time.
 
8:54 AM
Even that's not constant-time.
 
That way I can be sure the code is doing exactly what I expect it to do.
Well what I mean is that I know what is constant time and what isn't.
 
Ah gotcha
 
I can know exactly how many cycles a given instruction will take, and under what circumstances, whereas with a higher level language, I have no such guarantee.
 
That would be the goal of this language, yes
To provide that type of guarantee
 
Also, writing crypto in ASM is fun. :P
 
8:55 AM
Probably not in absolute terms, but in relative terms ("X will always take precisely the same amount of time as Y", as opposed to "X will always take 5 clock cycles")
 
9:12 AM
@NicHartley The sucky part is they matter
 
@Marshmallow The sucky part of what?
 
@NicHartley The sucky part of Roomba. A -50 question with an answer of +1 stays AFAIK.
 
Ah, gotcha
I think it requires votes more than a certain threshold, more than zero
 
But that one was -8 with an answer that was +2.
 
but I can't actually find the Roomba rules, so ¯\_(ツ)_/¯
 
9:17 AM
@NicHartley meta.stackexchange.com/a/5222/280934 9, 10, and 11
 
Ah there they are, I was Googling too specifically
Oh
The user's account might have been destroyed (#12)
They'd posted a whole lot of nonsense up to that point, seemed like a troll to me
 
Not a very good troll if it was one. Sounded more like a script kiddie.
 
Script troll. Troll kiddie.
 
Scroll kiddie
Either way, I'm just speculating. I'm not exactly a mod on Sec.SE lol
 
 
1 hour later…
10:51 AM
Kaboom
 
That one is super strange
it literally looks like someone copy pastaed an legit email
 
 
4 hours later…
2:43 PM
The Twitter algorithms don't like @Catija.
 
@Mithrandir Booh!. I think it switches for me whenever I close the tab and open it again next day. But if I leave the tab open, chrome picks up where it left of, and it's still set to newest.
 
2:58 PM
@Mithrandir wha???
Is that why no one likes my tweets?
 
I can only see it if I open it in incognito.
 
:(
That makes it sound like you're blocked... but I've only blocked companies that I don't like ads from... can you see any of my tweets?
 
Yes, but not that one for some reason.
 
Odd.
 
3:16 PM
@Catija you might have gotten shadowbanned
 
What does that mean?
I don't even tweet much.
 
Although I have no earthly clue how. I opened the same tweet (I think I also follow you) and it isn't available, but is when I open it in another browser window
An algorhitm thinks you're a spam bot or extremist
>_>
 
Maybe they don't like that I'm sharing specifics about their new format.
 
That would be surprisingly petty even for twitter
 
But... I just reported someone for that yesterday.
 
3:18 PM
It's probably just whatever new algos they push messing
 
:(
 
Of all people why you
I've never even seen you tweet anything contentious, let alone controversial
 
Revenge report?
 
Because I share cute videos of Gus?
Well, someone on MSO did just accuse me of being racist.
 
sigh
 
3:30 PM
I had a follow message in my lock screen at one point this morning but the username I saw wasn't the same as the person who followed me... and when I checked my inbox, it said I had two events but there was only one unread.
 
Twitter is weird.
 
@Catija if "this morning" means "1 hour ago", it's probably me... after cleaning up my Twitter account for the 3rd time and forgotting to change my username to be more sensible for general use...
 
@MetaAndrewT. Ah. Maybe ... did you change your username after you followed me?
 
@Catija yes, because I just realized it. Sorry for the confusion...
 
I half wondered if that's what it was... since you change your username here so much, I thought it was possible that you changed it on Twitter regularly, too. :D Glad to know that wasn't something too odd.
 
4:13 PM
Cabbage soup meatballs.
I bet that's the username
@Catija . . . Plot twist
Hey everyone, you can officially blame Mith for whatever trashy ads Google serves you.
 
... ha!
 
4:29 PM
Please spare me the aggressiveness accusations. Here's my answer explaining why voting here is common. The whole thread is a good read. Here's another thread touching on your very exact issue. Here's a thread on what to expect here. We're humans like you, and we don't feel entitled. The downvotes are people having their say. That's all. — Marshmallow 1 min ago
I hope I won't regret this.
Admittedly, it's not in a Catijaic mood.
 
4:48 PM
For a moment I though you were saying this in response to The Company fleeing MSO
 
@Marshmallow not helping either.
 
@rene What would? Not responding at all, or?
 
yeah, just let roomba have it and move on
I admit I'm not always keeping to that advice myself
 
You're probably right
 
5:05 PM
I'm a strong adherent to "never comment"
 
5:51 PM
@JohnDvorak Hey, sometimes when I feel that I can take the insults in case they happen, I go ahead and comment.
On SO and Meta.SE, they haven't turned the tables around much as far as I recall
But other sites, sometimes the OP had an epiphany.
. . . whoosh. Tinkering belled.
Or maybe Catija'd.
I've had experiences of "omg im so sorry ur right", sometimes better formatted, sometimes worse o.O But every time they happened, I felt Battery fully charged for quite a while.
 
 
2 hours later…
7:48 PM
@Marshmallow Now isn't that taking things a drop far? I only take responsibility for the weird ads, not the trashy ones.
 
@Catija FWIW, you're hardly the first to be shadowbanned over literally nothing. They shadowban "suspected" bad accounts all the time over evidence that, to a human, would be utter nonsense. It might be something as simple as a spammer once used a compromised computer in the house next door as part of a botnet, so your ISP's entire IP for that area was banned.
Or, amusingly, if you have "roughly the same" word frequency distribution as a spammer, you can get banned on suspicion of being them. Have you ever made a lot of typos in a tweet?
 
I don't make typos. :P If I notice them, I tend to delete and resend.
But that's only happened once or twice.
 
¯\_(ツ)_/¯ not being a Twitter dev, I couldn't tell you even if you're shadowbanned, let alone why
I'm just mentioning that it's possible, and you don't actually have to have done anything wrong.
 
Appreciate it. :) I figure that Twitter is kinda wonky at times.
 
You could contact customer support
But if you're shadowbanned and don't have hundreds of thousands of followers to argue your case, don't expect much
 
8:02 PM
It seems to just be that one tweet so... meh
 

« first day (3280 days earlier)      last day (903 days later) »