« first day (3280 days earlier)      last day (1903 days later) » 

user248725
12:02 AM
Anyone else having issues connecting to chat.stackexchange.com over VPN?
user248725
well, all the various chats, not just Chat.SE
user248725
oh, hm, I think I figured it out -- it's to do with my VPN, I think. BRB, gonna test some stuff.
user248725
Yup, that was it. For whatever reason, NordVPN's CyberSec feature breaks things.
user248725
works weirdly, too. It redirects connections to 127.0.0.1, which seems like the worst possible way to block connections...
12:18 AM
@NicHartley its a common/cheap way to
Cheap as in it takes up no bandwidth, and it an easy way to blackhole something to an IP address you know has nothing hosted on it
its the same approach that pi hole and the old hosts file blocking technique use
 
3 hours later…
3:01 AM
If someone would add a comment to let op know why... I can delete it. I am on my phone
 
2 hours later…
user248725
4:44 AM
@JourneymanGeek But localhost doesn't always have nothing hosted on it. They don't route it to a specific port or anything; it's just port 80. I regularly run servers on 80.
user248725
If they're already intercepting DNS requests, it seems easier to just return whatever the DNS equivalent of a 404 is
user248725
plus, even if they ran their own thing on an ephemeral port to avoid accidentally showing MyTestSite.html when I wanted Chat.SE, just giving a domain name not found error means that whatever they route traffic to can't possibly have any exploitable vulnerabilities, because it's not there.
5:10 AM
@NicHartley I never said it was a smart way to do it.
user248725
Ah, so you didn't
And you can't route DNS quiries to a port
user248725
I misread "cheap/common" as "good", my bad
user248725
@JourneymanGeek huh, TIL. Yet more reason it's a bad idea :D
I mean, someone could run a blackhole on a specific IP
but you'd still need to trust them
or stick a VM/container with an always known IP that's meant to go to into the bitbucket
or an IP that's always null routed.
or...
But there's no place like 127.0.0.1
user248725
5:13 AM
hm
user248725
Spitballing here: Could you redirect it to a different loopback address (172.0.0.2) and bind a socket to that receiving address
user248725
that is, if you must set up a blackhole rather than just doing a 404 like a normal person
well assuming it worked, and nothing listened to it
user248725
It's less likely than something listening on 127.0.0.1
Using the hosts file for blocking or poor mans name resolution is.... kinda older than the internet I think
Or DNS
user248725
5:17 AM
Wait what
user248725
Ohhh okay that explains why it was invented
DNS was a more scalable, sensible way to do name resolution than sharing a text file between machines
user248725
Doesn't explain why a consumer security product is using it but now I get why it ever existed
@NicHartley Its cheap and...
honestly if you're running a VPN service, I can totally see running a simple, fast, low resource web server and pointing blocked domains at that.
user248725
5:19 AM
It's probably no cheaper than just sending a 404
@NicHartley on the other hand
by blackholing to yourself, I guess there's no network traffic...
user248725
which requires no webserver at all to be run on the consumer's machine which is accessible to any website
user248725
Like, my big issue is this is supposed to be a security product
@NicHartley everyone does it like that ;p
user248725
But now they're putting unknown software on your machine, which can be communicated with by any website you visit
user248725
5:21 AM
@JourneymanGeek Then everyone is wrong :|
@NicHartley Well, product design idea ;p
user248725
lmao
user248725
Sure, I'll make a VPN. I'd get that one part right and everything else wrong.
(I wonder how pihole does it)
user248725
Jump ship from the sinking one to the one that's on fire and sinking!
5:22 AM
@NicHartley I don't trust VPNs as a security thing
user248725
QVPN: At least we won't be on fire for long :D
You're just moving the supoena from your ISP to the VPN provider. Who views all your traffic anyway
user248725
I trust my VPN a lot more than I trust my ISP, though
user248725
At least my VPN doesn't have a complete and total monopoly
ah
that's not a thing here
user248725
5:23 AM
If NordVPN does something wrong, I can switch. Like I currently am.
I mostly use a VPN to deal with my (old) ISP's incompetance
user248725
Whereas if Spectrum f*cks me like they've been doing constantly since I signed up with them, they can laugh at me and I can do nothing.
and most of the time I'm lazy and just ssh tunnel traffic through my dedi
user248725
I actually started using a VPN specifically so they'd stop killing off all persistent connections that lasted longer than 30 seconds
._.
see, that's different
user248725
5:24 AM
Multiplayer games kept disconnecting, constantly.
you're dealing with your ISP doing things badly
user248725
Because I guess they wanted to extort the game companies or something.
user248725
No, I'm dealing with my ISP being actively hostile
Ya
that's not just security though
also ISP monopolies...
user248725
But that's what I mean by "security"
5:25 AM
The things I would say would make me suspend myself
user248725
It's not just "the government can't access my data"
user248725
It's "the massive, greedy, provably amoral company can't extort more money out of me and the companies I want to interact with"
@NicHartley that's an ISP failing to live up to a minimum standard
user248725
Yup
(In singapore - I have... at least 6 ISP options with a minimum of gigabit, and... about as many mobile providers. I've currently got accounts with 3 mobile ISPs ... )
user248725
5:27 AM
Here in America, they bragged about intentionally not competing and forming a cartel to artificially inflate prices.
But yes, that's a fine reason to use a VPN
... dude, stop tempting me to swear ;p
user248725
American ISPs are basically the one thing everyone in this country agrees are awful
Other than Ajit Pai ;p
@JourneymanGeek suspend yourself first, then swear :D
user248725
No, there are plenty of people who've been lied to by their bought-off political representatives
user248725
5:28 AM
They're not mad at Pai
@NicHartley I mean, he dosen't think the current setup is terrible
user248725
@JourneymanGeek Ah, lmao, yeah, probably not
user248725
People like him are why I hedged it :D
user248725
[cough]
user248725
anyway, justified ranting aside
5:29 AM
@NicHartley that said, you could literally grab a hosts file from somewhere, set your system to listen to a arbitrary loopback address (if needed) and do a quick search and replace
user248725
@JourneymanGeek Search and replace what?
(other than massive host files performing horribly... so...)
@NicHartley something like... winhelp2002.mvps.org/hosts.htm
actually that uses 0.0.0.0 0_0
user248725
Oh I getcha
user248725
yeah 0.0.0.0 is the "unspecified address"
user248725
Which... I genuinely can't believe I didn't remember
user248725
5:31 AM
That's a pretty good blackhole address lmao
user248725
The one that's required to be dropped by any machine that receives a packet destined for it
user248725
I know, so is 127.0.0.1
clearly they did not have this conversation at your VPN provider
user248725
But if it's sent from that machine it's not dropped
user248725
5:32 AM
right, which is why I'm switching
user248725
Thank goodness for 30-day risk-free trials
So hypothetically
what stops you from finding a nearer VPS or dedi provider and just running it yourself?
user248725
@JourneymanGeek Laziness
user248725
I could run it myself, but like... why bother?
(but this is my own bias lol. google burnt me so many times that I don't trust outside providers for anything critical)
That's good enough
and a perfectly good reason
user248725
5:33 AM
I could also just get a VPN that DNS notfound's requests instead of sending them to 127.0.0.1
user248725
@JourneymanGeek It's not really that critical, is my point
user248725
If I was trying to protect my data from the US government, I'd definitely be more concerned
user248725
But at that point I feel like I'd be more concerned with like
user248725
SWAT teams
@NicHartley or rely on a VPN provider for VPNs
and find a DNS provider that does the filtering you want
user248725
5:37 AM
@JourneymanGeek Sure. Do you know any DNSes that filter out ads/known spam sites/etc?
@NicHartley errr...
I was running pihole for a bit
but that's additional hardware or work
user248725
I mean, it wouldn't be infeasible to make a custom USB dongle that performs similar functions
.....
ACTUALLY
user248725
I happen to know you can make custom WiFi dongles with "extra functionality" for relatively cheaply
user248725
because I've done that, and oh boy is it a fun prank
user248725
5:40 AM
Which slightly fell flat but I'm still counting it as a success
user248725
Haha
user248725
I did something similar, but made the hardware myself
I have the former ... had something in mind but I forgot
I'm lazy to build hardware
user248725
and it didn't run anything too fancy, just watched for packets with certain contents and modified the responses
5:42 AM
I did build my own router ;p
user248725
Nice
.... actually 2...
user248725
lmao
(One's x86 based. The other is built on a Orange Pi r2 - just wanted to see if my slightly unusual stack would run on that)
I'm debating throwing pihole on the latter
user248725
What is the DNS equivalent of a 404 anyway?
user248725
5:47 AM
NXDOMAIN right?
@NicHartley NXDOMAIN
user248725
Cool, only took like 5 minutes to Google haha
but some ISPs do stinky things with those
user248725
5:48 AM
I kept getting things like "are you getting a DNS error about your domain not being found? Here's how to fix it!"
My ISP did that for a while...it redirected nonexistent domain users to a search page.
Fortunately there was a setting on that search site to disable that behavior, and after I did so, I got the proper NXDOMAIN responses
user248725
wow, NordVPN customer service was pretty great
@NicHartley this, precisely, is why we cannot have nice things
user248725
"Can I have a refund?" "Sure, can I ask why?" "[explains]" "Oh, that's unfortunate. Your refund will be on its way in 3-5 business days."
Longtime Private Internet Access user myself
user248725
5:50 AM
No upselling, no "we need you to try this troubleshooting", no nonsense
user248725
@SonictheAnonymousWizHog I have a bad taste in my mouth from their early days when they were incredibly slow and laggy. Have they gotten better?
@NicHartley Much better
user248725
@SonictheAnonymousWizHog Nice, that's good to hear
Looks like they've hiked their pricing a bit; I'm on a grandfathered plan
user248725
Oh, damn
user248725
5:52 AM
The old pricing was really nice...
user248725
Hah, I'm still connected to NordVPN and PIA is saying I'm not protected
Monthly pricing went from $7 to $10, yearly pricing went from $40 to $72, and two-year pricing went from $60 to $70 to $84
user248725
but my ISP isn't Virtuzo and I'm not at the IP they think I am
Personally I'm on the $60 per two years plan
user248725
@SonictheAnonymousWizHog I vaguely remember it being $5/month at some point
user248725
5:53 AM
As a monthly thing, not as a discounted long-term rate
user248725
But it's been so long that I could just be misremembering
That price equates to $2.50 per month
user248725
Oh, per two years
user248725
That's pretty nice
7:15 AM
7:27 AM
@rene ....
If OP hadn't done that, I'd have strong words.
Now I just have confusion ;p
well... it has more.... SPACES!
user248725
=> arrows are a great way
user248725
-> to indicate that you're saying something
@JourneymanGeek yeah. I did poke a bit to see if there is a relation between users but found no evidence, so I write if off on their appreciation for the attention their answer got.
8:03 AM
@NicHartley ↑↓↨
user248725
@Marshmallow I feel an urge to break out the Zalgo text...
It's not Zalgo
Not pure breed anyway
Its just mild unicode abuse
not even stacked diacritics
Mild unicode abuse ur face. I just typed alt + 24, Jesus Christ.
Now that Its is English abuse
grump
I haven't had breakfast.
paws @Marshmallow a dogbiscuit
8:06 AM
@JourneymanGeek why did you roll back this? While too minor and I'd reject the edit as such, can't see any reason to roll back? What did I miss?
A Mild Unicode abused Your Face. It is not very effective...
@ShaWiz to see what happens
umm....
what???
See what @rene and I were talking about a little before ;p
When you roll back, well.... there's a.... roll back.
8:07 AM
yup
@ShaWiz Sock bait r us
But that was also a bizzarely minor edit
Trying to find out if the two users are connected
I'd assume the OP just came back after a long time and saw... hey, what's this button? Then clicked it without knowing the effect...
I think it's just probably some random guy.
Unless Journey can do some IP voodoo
8:10 AM
@Marshmallow but how rolling back has anything to do with that?
@ShaWiz baiting the other user to resuggest the edit
@ShaWiz If this is rep . . . laundering? . . . the OP or the editor would insist
Answer author appears to be just someone who doesn't really care the edit was minor, he probably followed old inbox item he never noticed before.
user248725
@Marshmallow That's why I said I feel the need to break it out. It hadn't been broken out yet.
↑↑↓↓←→←→SE
user248725
8:13 AM
@MetaAndrewT. +1 Accounts
@ShaWiz so the ideal would be they both realise its not a good edit
And rolling it back sounds like one way to do it, no?
Oooh. The villain explaining their moral stance ↑↑↑↑
Wait...
I HAVE A MORAL STANCE?
It's simple math, little one. The universe is finite, its resources finite.
@Marshmallow no way... that's impossible..!
8:23 AM
@MetaAndrewT. Meh, it all only exists in the mind anyway. Let's go have an existential crisis in the corner.
What if... the corners only exist in your mind?
@Marshmallow Anyone can do IP voodoo if they embed an image.
@JourneymanGeek As long as they're cozy
@ShaWiz you're questioning me? You've lost faith in the flower? Go into the Shadow Wizard.
@forest he means the legit IP voodoo
@rene ha! Knew you're a sock of @Journeyman. plan succeeded
:P
Wait, why was that image removed?
It's on Imgur.
Huh... and why was the post deleted? I thought the Community user only deletes negatively-voted and closed questions if it doesn't have any positive answers.
user248725
@forest Look again :)
user248725
The image is hosted on a domain that was, weirdly enough, used in another, different spamming attack somewhere else. It's linked to an Imgur domain.
Oh lol I just skimmed it.
user248725
8:39 AM
As did I, the first time
Well it's not like this doesn't happen. I've uploaded images to SE to geolocate before.
And nothing in the site prevented that. It's supported behavior.
user248725
And I think positively-voted answers don't matter when it's downvoted that heavily, but I'm hardly the resident expert on the Roomba
huh
At least they don't let you embed SVGs. :P
(I don't think)
user248725
I've never tried it, but I don't see why not-- Oh, you can embed JavaScript in SVG.
user248725
iiiiiinteresting
8:42 AM
Yeah but it doesn't execute if it's embedded.
My point was more that SVG parsers are... insecure.
user248725
Ah okay
It'd be much easier to find an RCE in the SVG parser than in, say, libpng.
I think there used to be a way to execute JS in embedded GIFs.
A bug in Firefox's handling that acted as a NoScript bypass.
user248725
I wouldn't be surprised.
Not sure if it got patched. I assume so. I could be misremembering though.
user248725
GIF handlers used to be wildly awful
8:45 AM
I wonder how often ICO handlers get audited. :P
Ever tried fuzzing your browser's favicon code?
user248725
Nope
There are a lot of scary things in browsers that people don't often look at.
Reminds me of my source code.
8:48 AM
I try to make the code I write look pretty (Linux kernel coding style), but it's not always secure.
I never trust my own code. Not that I trust other people's code...
user248725
I write my code in Rust, which means it's always totally secure against all possible attacks /s
>not writing code in sendmail config
@NicHartley you could write it in perl, it would be secure against ever being read...
user248725
I've actually been poking at a language idea which is designed specifically to be memory-safe and constant-time
I actually think Perl is nice to read.
@NicHartley Constant time for all operations? What about the ones it slows down?
I mean, you don't need constant time string comparisons for grep.
user248725
8:51 AM
at least within the same bounds that languages like Rust and C# use, where you can relax the constraints for performance or whatever
user248725
@forest shortcircuit { s1.fast_eq(s2) } or the like; it's hardly a fleshed-out idea
Honestly I just use ASM when I want constant time.
user248725
Even that's not constant-time.
That way I can be sure the code is doing exactly what I expect it to do.
Well what I mean is that I know what is constant time and what isn't.
user248725
Ah gotcha
8:54 AM
I can know exactly how many cycles a given instruction will take, and under what circumstances, whereas with a higher level language, I have no such guarantee.
user248725
That would be the goal of this language, yes
user248725
To provide that type of guarantee
Also, writing crypto in ASM is fun. :P
user248725
Probably not in absolute terms, but in relative terms ("X will always take precisely the same amount of time as Y", as opposed to "X will always take 5 clock cycles")
9:12 AM
@NicHartley The sucky part is they matter
user248725
@Marshmallow The sucky part of what?
@NicHartley The sucky part of Roomba. A -50 question with an answer of +1 stays AFAIK.
user248725
Ah, gotcha
user248725
I think it requires votes more than a certain threshold, more than zero
But that one was -8 with an answer that was +2.
user248725
9:15 AM
but I can't actually find the Roomba rules, so ¯\_(ツ)_/¯
user248725
Ah there they are, I was Googling too specifically
user248725
Oh
user248725
The user's account might have been destroyed (#12)
user248725
They'd posted a whole lot of nonsense up to that point, seemed like a troll to me
9:20 AM
Not a very good troll if it was one. Sounded more like a script kiddie.
Script troll. Troll kiddie.
user248725
Scroll kiddie
user248725
Either way, I'm just speculating. I'm not exactly a mod on Sec.SE lol
10:51 AM
Kaboom
That one is super strange
it literally looks like someone copy pastaed an legit email
 
4 hours later…
2:43 PM
The Twitter algorithms don't like @Catija.
@Mithrandir Booh!. I think it switches for me whenever I close the tab and open it again next day. But if I leave the tab open, chrome picks up where it left of, and it's still set to newest.
2:58 PM
@Mithrandir wha???
Is that why no one likes my tweets?
I can only see it if I open it in incognito.
:(
That makes it sound like you're blocked... but I've only blocked companies that I don't like ads from... can you see any of my tweets?
Yes, but not that one for some reason.
Odd.
3:16 PM
@Catija you might have gotten shadowbanned
What does that mean?
I don't even tweet much.
Although I have no earthly clue how. I opened the same tweet (I think I also follow you) and it isn't available, but is when I open it in another browser window
An algorhitm thinks you're a spam bot or extremist
>_>
Maybe they don't like that I'm sharing specifics about their new format.
That would be surprisingly petty even for twitter
But... I just reported someone for that yesterday.
3:18 PM
It's probably just whatever new algos they push messing
Of all people why you
I've never even seen you tweet anything contentious, let alone controversial
Revenge report?
Because I share cute videos of Gus?
Well, someone on MSO did just accuse me of being racist.
sigh
3:30 PM
I had a follow message in my lock screen at one point this morning but the username I saw wasn't the same as the person who followed me... and when I checked my inbox, it said I had two events but there was only one unread.
Twitter is weird.
@Catija if "this morning" means "1 hour ago", it's probably me... after cleaning up my Twitter account for the 3rd time and forgotting to change my username to be more sensible for general use...
@MetaAndrewT. Ah. Maybe ... did you change your username after you followed me?
@Catija yes, because I just realized it. Sorry for the confusion...
I half wondered if that's what it was... since you change your username here so much, I thought it was possible that you changed it on Twitter regularly, too. :D Glad to know that wasn't something too odd.
4:13 PM
Cabbage soup meatballs.
I bet that's the username
@Catija . . . Plot twist
Hey everyone, you can officially blame Mith for whatever trashy ads Google serves you.
4:29 PM
Please spare me the aggressiveness accusations. Here's my answer explaining why voting here is common. The whole thread is a good read. Here's another thread touching on your very exact issue. Here's a thread on what to expect here. We're humans like you, and we don't feel entitled. The downvotes are people having their say. That's all. — Marshmallow 1 min ago
I hope I won't regret this.
Admittedly, it's not in a Catijaic mood.
4:48 PM
For a moment I though you were saying this in response to The Company fleeing MSO
@Marshmallow not helping either.
@rene What would? Not responding at all, or?
yeah, just let roomba have it and move on
I admit I'm not always keeping to that advice myself
You're probably right
5:05 PM
I'm a strong adherent to "never comment"
5:51 PM
@JohnDvorak Hey, sometimes when I feel that I can take the insults in case they happen, I go ahead and comment.
On SO and Meta.SE, they haven't turned the tables around much as far as I recall
But other sites, sometimes the OP had an epiphany.
. . . whoosh. Tinkering belled.
Or maybe Catija'd.
I've had experiences of "omg im so sorry ur right", sometimes better formatted, sometimes worse o.O But every time they happened, I felt Battery fully charged for quite a while.
 
2 hours later…
7:48 PM
@Marshmallow Now isn't that taking things a drop far? I only take responsibility for the weird ads, not the trashy ones.
user248725
@Catija FWIW, you're hardly the first to be shadowbanned over literally nothing. They shadowban "suspected" bad accounts all the time over evidence that, to a human, would be utter nonsense. It might be something as simple as a spammer once used a compromised computer in the house next door as part of a botnet, so your ISP's entire IP for that area was banned.
user248725
Or, amusingly, if you have "roughly the same" word frequency distribution as a spammer, you can get banned on suspicion of being them. Have you ever made a lot of typos in a tweet?
I don't make typos. :P If I notice them, I tend to delete and resend.
But that's only happened once or twice.
user248725
¯\_(ツ)_/¯ not being a Twitter dev, I couldn't tell you even if you're shadowbanned, let alone why
user248725
I'm just mentioning that it's possible, and you don't actually have to have done anything wrong.
8:00 PM
Appreciate it. :) I figure that Twitter is kinda wonky at times.
user248725
You could contact customer support
user248725
But if you're shadowbanned and don't have hundreds of thousands of followers to argue your case, don't expect much
It seems to just be that one tweet so... meh

« first day (3280 days earlier)      last day (1903 days later) »