Tavern on the Meta

user248725

12:02 AM

Anyone else having issues connecting to chat.stackexchange.com over VPN?

user248725

well, all the various chats, not just Chat.SE

user248725

oh, hm, I think I figured it out -- it's to do with my VPN, I think. BRB, gonna test some stuff.

user248725

Yup, that was it. For whatever reason, NordVPN's CyberSec feature breaks things.

user248725

works weirdly, too. It redirects connections to 127.0.0.1, which seems like the worst possible way to block connections...

Journeyman Geek

12:18 AM

@NicHartley its a common/cheap way to

Cheap as in it takes up no bandwidth, and it an easy way to blackhole something to an IP address you know has nothing hosted on it

its the same approach that pi hole and the old hosts file blocking technique use

Journeyman Geek

3:01 AM

If someone would add a comment to let op know why... I can delete it. I am on my phone

Sonic the Anonymous WizHog

status-completed

user248725

4:44 AM

@JourneymanGeek But localhost doesn't always have nothing hosted on it. They don't route it to a specific port or anything; it's just port 80. I regularly run servers on 80.

user248725

If they're already intercepting DNS requests, it seems easier to just return whatever the DNS equivalent of a 404 is

user248725

plus, even if they ran their own thing on an ephemeral port to avoid accidentally showing MyTestSite.html when I wanted Chat.SE, just giving a domain name not found error means that whatever they route traffic to can't possibly have any exploitable vulnerabilities, because it's not there.

Journeyman Geek

5:10 AM

@NicHartley I never said it was a smart way to do it.

user248725

Ah, so you didn't

Journeyman Geek

And you can't route DNS quiries to a port

user248725

I misread "cheap/common" as "good", my bad

user248725

@JourneymanGeek huh, TIL. Yet more reason it's a bad idea :D

Journeyman Geek

I mean, someone could run a blackhole on a specific IP

but you'd still need to trust them

or stick a VM/container with an always known IP that's meant to go to into the bitbucket

or an IP that's always null routed.

or...

But there's no place like 127.0.0.1

user248725

5:13 AM

hm

user248725

Spitballing here: Could you redirect it to a different loopback address (172.0.0.2) and bind a socket to that receiving address

user248725

that is, if you must set up a blackhole rather than just doing a 404 like a normal person

Journeyman Geek

well assuming it worked, and nothing listened to it

user248725

It's less likely than something listening on 127.0.0.1

Journeyman Geek

Using the hosts file for blocking or poor mans name resolution is.... kinda older than the internet I think

Or DNS

user248725

5:17 AM

Wait what

Journeyman Geek

Yup

user248725

Ohhh okay that explains why it was invented

Journeyman Geek

DNS was a more scalable, sensible way to do name resolution than sharing a text file between machines

user248725

Doesn't explain why a consumer security product is using it but now I get why it ever existed

Journeyman Geek

@NicHartley Its cheap and...

honestly if you're running a VPN service, I can totally see running a simple, fast, low resource web server and pointing blocked domains at that.

user248725

5:19 AM

It's probably no cheaper than just sending a 404

Journeyman Geek

@NicHartley on the other hand

by blackholing to yourself, I guess there's no network traffic...

user248725

which requires no webserver at all to be run on the consumer's machine which is accessible to any website

user248725

Like, my big issue is this is supposed to be a security product

Journeyman Geek

@NicHartley everyone does it like that ;p

user248725

But now they're putting unknown software on your machine, which can be communicated with by any website you visit

user248725

5:21 AM

@JourneymanGeek Then everyone is wrong :|

Journeyman Geek

@NicHartley Well, product design idea ;p

user248725

lmao

user248725

Sure, I'll make a VPN. I'd get that one part right and everything else wrong.

Journeyman Geek

(I wonder how pihole does it)

user248725

Jump ship from the sinking one to the one that's on fire and sinking!

Journeyman Geek

5:22 AM

@NicHartley I don't trust VPNs as a security thing

user248725

QVPN: At least we won't be on fire for long :D

Journeyman Geek

You're just moving the supoena from your ISP to the VPN provider. Who views all your traffic anyway

user248725

I trust my VPN a lot more than I trust my ISP, though

user248725

At least my VPN doesn't have a complete and total monopoly

Journeyman Geek

ah

that's not a thing here

user248725

5:23 AM

If NordVPN does something wrong, I can switch. Like I currently am.

Journeyman Geek

I mostly use a VPN to deal with my (old) ISP's incompetance

user248725

Whereas if Spectrum f*cks me like they've been doing constantly since I signed up with them, they can laugh at me and I can do nothing.

Journeyman Geek

and most of the time I'm lazy and just ssh tunnel traffic through my dedi

user248725

I actually started using a VPN specifically so they'd stop killing off all persistent connections that lasted longer than 30 seconds

Journeyman Geek

._.

see, that's different

user248725

5:24 AM

Multiplayer games kept disconnecting, constantly.

Journeyman Geek

you're dealing with your ISP doing things badly

user248725

Because I guess they wanted to extort the game companies or something.

user248725

No, I'm dealing with my ISP being actively hostile

Journeyman Geek

Ya

that's not just security though

also ISP monopolies...

user248725

But that's what I mean by "security"

Journeyman Geek

5:25 AM

The things I would say would make me suspend myself

user248725

It's not just "the government can't access my data"

user248725

It's "the massive, greedy, provably amoral company can't extort more money out of me and the companies I want to interact with"

Journeyman Geek

@NicHartley that's an ISP failing to live up to a minimum standard

user248725

Yup

Journeyman Geek

(In singapore - I have... at least 6 ISP options with a minimum of gigabit, and... about as many mobile providers. I've currently got accounts with 3 mobile ISPs ... )

user248725

5:27 AM

Here in America, they bragged about intentionally not competing and forming a cartel to artificially inflate prices.

Journeyman Geek

But yes, that's a fine reason to use a VPN

... dude, stop tempting me to swear ;p

user248725

American ISPs are basically the one thing everyone in this country agrees are awful

Journeyman Geek

Other than Ajit Pai ;p

Meta Andrew T.

@JourneymanGeek suspend yourself first, then swear :D

user248725

No, there are plenty of people who've been lied to by their bought-off political representatives

user248725

5:28 AM

They're not mad at Pai

Journeyman Geek

@NicHartley I mean, he dosen't think the current setup is terrible

user248725

@JourneymanGeek Ah, lmao, yeah, probably not

user248725

People like him are why I hedged it :D

user248725

[cough]

user248725

anyway, justified ranting aside

Journeyman Geek

5:29 AM

@NicHartley that said, you could literally grab a hosts file from somewhere, set your system to listen to a arbitrary loopback address (if needed) and do a quick search and replace

user248725

@JourneymanGeek Search and replace what?

Journeyman Geek

(other than massive host files performing horribly... so...)

@NicHartley something like... winhelp2002.mvps.org/hosts.htm

actually that uses 0.0.0.0 0_0

user248725

Oh I getcha

user248725

yeah 0.0.0.0 is the "unspecified address"

user248725

Which... I genuinely can't believe I didn't remember

user248725

5:31 AM

That's a pretty good blackhole address lmao

user248725

The one that's required to be dropped by any machine that receives a packet destined for it

Journeyman Geek

Well

user248725

I know, so is 127.0.0.1

Journeyman Geek

clearly they did not have this conversation at your VPN provider

user248725

But if it's sent from that machine it's not dropped

user248725

5:32 AM

right, which is why I'm switching

user248725

Thank goodness for 30-day risk-free trials

Journeyman Geek

So hypothetically

what stops you from finding a nearer VPS or dedi provider and just running it yourself?

user248725

@JourneymanGeek Laziness

user248725

I could run it myself, but like... why bother?

Journeyman Geek

(but this is my own bias lol. google burnt me so many times that I don't trust outside providers for anything critical)

That's good enough

and a perfectly good reason

user248725

5:33 AM

I could also just get a VPN that DNS notfound's requests instead of sending them to 127.0.0.1

user248725

@JourneymanGeek It's not really that critical, is my point

user248725

If I was trying to protect my data from the US government, I'd definitely be more concerned

user248725

But at that point I feel like I'd be more concerned with like

user248725

SWAT teams

Journeyman Geek

@NicHartley or rely on a VPN provider for VPNs

and find a DNS provider that does the filtering you want

user248725

5:37 AM

@JourneymanGeek Sure. Do you know any DNSes that filter out ads/known spam sites/etc?

Journeyman Geek

@NicHartley errr...

I was running pihole for a bit

but that's additional hardware or work

user248725

I mean, it wouldn't be infeasible to make a custom USB dongle that performs similar functions

Journeyman Geek

.....

ACTUALLY

user248725

I happen to know you can make custom WiFi dongles with "extra functionality" for relatively cheaply

user248725

because I've done that, and oh boy is it a fun prank

user248725

5:40 AM

Which slightly fell flat but I'm still counting it as a success

Journeyman Geek

gl-inet.com/products/gl-usb150 + openwrt.org/docs/guide-user/services/ad-blocking?s[]=adblock

user248725

Haha

user248725

I did something similar, but made the hardware myself

Journeyman Geek

I have the former ... had something in mind but I forgot

I'm lazy to build hardware

user248725

and it didn't run anything too fancy, just watched for packets with certain contents and modified the responses

Journeyman Geek

5:42 AM

I did build my own router ;p

user248725

Nice

Journeyman Geek

.... actually 2...

user248725

lmao

Journeyman Geek

(One's x86 based. The other is built on a Orange Pi r2 - just wanted to see if my slightly unusual stack would run on that)

I'm debating throwing pihole on the latter

user248725

What is the DNS equivalent of a 404 anyway?

user248725

5:47 AM

NXDOMAIN right?

Journeyman Geek

uhm

Sonic the Anonymous WizHog

@NicHartley NXDOMAIN

Journeyman Geek

Ya

user248725

Cool, only took like 5 minutes to Google haha

Journeyman Geek

but some ISPs do stinky things with those

user248725

5:48 AM

I kept getting things like "are you getting a DNS error about your domain not being found? Here's how to fix it!"

Sonic the Anonymous WizHog

My ISP did that for a while...it redirected nonexistent domain users to a search page.

Fortunately there was a setting on that search site to disable that behavior, and after I did so, I got the proper NXDOMAIN responses

user248725

wow, NordVPN customer service was pretty great

Journeyman Geek

@NicHartley this, precisely, is why we cannot have nice things

user248725

"Can I have a refund?" "Sure, can I ask why?" "[explains]" "Oh, that's unfortunate. Your refund will be on its way in 3-5 business days."

Sonic the Anonymous WizHog

Longtime Private Internet Access user myself

user248725

5:50 AM

No upselling, no "we need you to try this troubleshooting", no nonsense

user248725

@SonictheAnonymousWizHog I have a bad taste in my mouth from their early days when they were incredibly slow and laggy. Have they gotten better?

Sonic the Anonymous WizHog

@NicHartley Much better

user248725

@SonictheAnonymousWizHog Nice, that's good to hear

Sonic the Anonymous WizHog

Looks like they've hiked their pricing a bit; I'm on a grandfathered plan

user248725

Oh, damn

user248725

5:52 AM

The old pricing was really nice...

user248725

Hah, I'm still connected to NordVPN and PIA is saying I'm not protected

Sonic the Anonymous WizHog

Monthly pricing went from $7 to $10, yearly pricing went from $40 to $72, and two-year pricing went from $60 to $70 to $84

user248725

but my ISP isn't Virtuzo and I'm not at the IP they think I am

Sonic the Anonymous WizHog

Personally I'm on the $60 per two years plan

user248725

@SonictheAnonymousWizHog I vaguely remember it being $5/month at some point

user248725

5:53 AM

As a monthly thing, not as a discounted long-term rate

user248725

But it's been so long that I could just be misremembering

Sonic the Anonymous WizHog

That price equates to $2.50 per month

user248725

Oh, per two years

user248725

That's pretty nice

rene

7:15 AM

awesome suggested edit approved: meta.stackexchange.com/review/suggested-edits/63983

Journeyman Geek

7:27 AM

@rene ....

If OP hadn't done that, I'd have strong words.

Now I just have confusion ;p

Meta Andrew T.

well... it has more.... SPACES!

user248725

=> arrows are a great way

user248725

-> to indicate that you're saying something

rene

@JourneymanGeek yeah. I did poke a bit to see if there is a relation between users but found no evidence, so I write if off on their appreciation for the attention their answer got.

Marshmallow

8:03 AM

@NicHartley ↑↓↨

user248725

@Marshmallow I feel an urge to break out the Zalgo text...

Marshmallow

It's not Zalgo

Not pure breed anyway

Journeyman Geek

Its just mild unicode abuse

not even stacked diacritics

Marshmallow

Mild unicode abuse ur face. I just typed alt + 24, Jesus Christ.

Now that Its is English abuse

grump

I haven't had breakfast.

Journeyman Geek

paws @Marshmallow a dogbiscuit

ShaWiz

8:06 AM

@JourneymanGeek why did you roll back this? While too minor and I'd reject the edit as such, can't see any reason to roll back? What did I miss?

Meta Andrew T.

A Mild Unicode abused Your Face. It is not very effective...

Journeyman Geek

@ShaWiz to see what happens

ShaWiz

umm....

what???

Journeyman Geek

See what @rene and I were talking about a little before ;p

ShaWiz

When you roll back, well.... there's a.... roll back.

Journeyman Geek

8:07 AM

yup

Marshmallow

@ShaWiz Sock bait r us

Journeyman Geek

But that was also a bizzarely minor edit

Marshmallow

Trying to find out if the two users are connected

Meta Andrew T.

I'd assume the OP just came back after a long time and saw... hey, what's this button? Then clicked it without knowing the effect...

Marshmallow

I think it's just probably some random guy.

Unless Journey can do some IP voodoo

ShaWiz

8:10 AM

@Marshmallow but how rolling back has anything to do with that?

Meta Andrew T.

@ShaWiz baiting the other user to resuggest the edit

Marshmallow

@ShaWiz If this is rep . . . laundering? . . . the OP or the editor would insist

ShaWiz

Answer author appears to be just someone who doesn't really care the edit was minor, he probably followed old inbox item he never noticed before.

user248725

@Marshmallow That's why I said I feel the need to break it out. It hadn't been broken out yet.

Meta Andrew T.

↑↑↓↓←→←→SE

user248725

8:13 AM

@MetaAndrewT. +1 Accounts

Journeyman Geek

@ShaWiz so the ideal would be they both realise its not a good edit

And rolling it back sounds like one way to do it, no?

Marshmallow

Oooh. The villain explaining their moral stance ↑↑↑↑

Journeyman Geek

Wait...

I HAVE A MORAL STANCE?

Marshmallow

It's simple math, little one. The universe is finite, its resources finite.

Meta Andrew T.

@Marshmallow no way... that's impossible..!

Marshmallow

8:23 AM

@MetaAndrewT. Meh, it all only exists in the mind anyway. Let's go have an existential crisis in the corner.

Journeyman Geek

What if... the corners only exist in your mind?

forest

@Marshmallow Anyone can do IP voodoo if they embed an image.

Marshmallow

@JourneymanGeek As long as they're cozy

rene

@ShaWiz you're questioning me? You've lost faith in the flower? Go into the Shadow Wizard.

Journeyman Geek

@forest he means the legit IP voodoo

user248725

8:31 AM

@forest We learned that a little while back on Sec.SE :D

ShaWiz

@rene ha! Knew you're a sock of @Journeyman. plan succeeded

:P

forest

Wait, why was that image removed?

It's on Imgur.

Huh... and why was the post deleted? I thought the Community user only deletes negatively-voted and closed questions if it doesn't have any positive answers.

user248725

@forest Look again :)

user248725

The image is hosted on a domain that was, weirdly enough, used in another, different spamming attack somewhere else. It's linked to an Imgur domain.

forest

Oh lol I just skimmed it.

user248725

8:39 AM

As did I, the first time

forest

Well it's not like this doesn't happen. I've uploaded images to SE to geolocate before.

And nothing in the site prevented that. It's supported behavior.

user248725

And I think positively-voted answers don't matter when it's downvoted that heavily, but I'm hardly the resident expert on the Roomba

forest

huh

At least they don't let you embed SVGs. :P

(I don't think)

user248725

I've never tried it, but I don't see why not-- Oh, you can embed JavaScript in SVG.

user248725

iiiiiinteresting

forest

8:42 AM

Yeah but it doesn't execute if it's embedded.

My point was more that SVG parsers are... insecure.

user248725

Ah okay

forest

It'd be much easier to find an RCE in the SVG parser than in, say, libpng.

I think there used to be a way to execute JS in embedded GIFs.

A bug in Firefox's handling that acted as a NoScript bypass.

user248725

I wouldn't be surprised.

forest

Not sure if it got patched. I assume so. I could be misremembering though.

user248725

GIF handlers used to be wildly awful

forest

8:45 AM

I wonder how often ICO handlers get audited. :P

Ever tried fuzzing your browser's favicon code?

user248725

Nope

forest

There are a lot of scary things in browsers that people don't often look at.

ShaWiz

Reminds me of my source code.

forest

:P

ShaWiz

:D

forest

8:48 AM

I try to make the code I write look pretty (Linux kernel coding style), but it's not always secure.

I never trust my own code. Not that I trust other people's code...

user248725

I write my code in Rust, which means it's always totally secure against all possible attacks /s

forest

>not writing code in sendmail config

Journeyman Geek

@NicHartley you could write it in perl, it would be secure against ever being read...

user248725

I've actually been poking at a language idea which is designed specifically to be memory-safe and constant-time

forest

I actually think Perl is nice to read.

@NicHartley Constant time for all operations? What about the ones it slows down?

I mean, you don't need constant time string comparisons for grep.

user248725

8:51 AM

at least within the same bounds that languages like Rust and C# use, where you can relax the constraints for performance or whatever

user248725

@forest shortcircuit { s1.fast_eq(s2) } or the like; it's hardly a fleshed-out idea

forest

Honestly I just use ASM when I want constant time.

user248725

Even that's not constant-time.

forest

That way I can be sure the code is doing exactly what I expect it to do.

Well what I mean is that I know what is constant time and what isn't.

user248725

Ah gotcha

forest

8:54 AM

I can know exactly how many cycles a given instruction will take, and under what circumstances, whereas with a higher level language, I have no such guarantee.

user248725

That would be the goal of this language, yes

user248725

To provide that type of guarantee

forest

Also, writing crypto in ASM is fun. :P

user248725

Probably not in absolute terms, but in relative terms ("X will always take precisely the same amount of time as Y", as opposed to "X will always take 5 clock cycles")

Marshmallow

9:12 AM

@NicHartley The sucky part is they matter

user248725

@Marshmallow The sucky part of what?

Marshmallow

@NicHartley The sucky part of Roomba. A -50 question with an answer of +1 stays AFAIK.

user248725

Ah, gotcha

user248725

I think it requires votes more than a certain threshold, more than zero

forest

But that one was -8 with an answer that was +2.

user248725

9:15 AM

but I can't actually find the Roomba rules, so ¯\_(ツ)_/¯

Marshmallow

@NicHartley meta.stackexchange.com/a/5222/280934 9, 10, and 11

user248725

Ah there they are, I was Googling too specifically

user248725

Oh

user248725

The user's account might have been destroyed (#12)

user248725

They'd posted a whole lot of nonsense up to that point, seemed like a troll to me

forest

9:20 AM

Not a very good troll if it was one. Sounded more like a script kiddie.

Marshmallow

Script troll. Troll kiddie.

user248725

Scroll kiddie

user248725

Either way, I'm just speculating. I'm not exactly a mod on Sec.SE lol

ShaWiz

10:51 AM

Kaboom

Journeyman Geek

That one is super strange

it literally looks like someone copy pastaed an legit email

Mithrandir

2:43 PM

The Twitter algorithms don't like @Catija.

Tinkeringbell

@Mithrandir Booh!. I think it switches for me whenever I close the tab and open it again next day. But if I leave the tab open, chrome picks up where it left of, and it's still set to newest.

Catija

2:58 PM

@Mithrandir wha???

Is that why no one likes my tweets?

Mithrandir

I can only see it if I open it in incognito.

Catija

:(

That makes it sound like you're blocked... but I've only blocked companies that I don't like ads from... can you see any of my tweets?

Mithrandir

Yes, but not that one for some reason.

Catija

Odd.

Magisch

3:16 PM

@Catija you might have gotten shadowbanned

Catija

What does that mean?

I don't even tweet much.

Magisch

Although I have no earthly clue how. I opened the same tweet (I think I also follow you) and it isn't available, but is when I open it in another browser window

An algorhitm thinks you're a spam bot or extremist

>_>

Catija

Maybe they don't like that I'm sharing specifics about their new format.

Magisch

That would be surprisingly petty even for twitter

Catija

But... I just reported someone for that yesterday.

Magisch

3:18 PM

It's probably just whatever new algos they push messing

Catija

:(

Magisch

Of all people why you

I've never even seen you tweet anything contentious, let alone controversial

Meta Andrew T.

Revenge report?

Catija

Because I share cute videos of Gus?

Well, someone on MSO did just accuse me of being racist.

Magisch

sigh

Catija

3:30 PM

I had a follow message in my lock screen at one point this morning but the username I saw wasn't the same as the person who followed me... and when I checked my inbox, it said I had two events but there was only one unread.

Mithrandir

Twitter is weird.

Meta Andrew T.

@Catija if "this morning" means "1 hour ago", it's probably me... after cleaning up my Twitter account for the 3rd time and forgotting to change my username to be more sensible for general use...

Catija

@MetaAndrewT. Ah. Maybe ... did you change your username after you followed me?

Meta Andrew T.

@Catija yes, because I just realized it. Sorry for the confusion...

Catija

I half wondered if that's what it was... since you change your username here so much, I thought it was possible that you changed it on Twitter regularly, too. :D Glad to know that wasn't something too odd.

Marshmallow

4:13 PM

Cabbage soup meatballs.

I bet that's the username

@Catija . . . Plot twist

Hey everyone, you can officially blame Mith for whatever trashy ads Google serves you.

Meta Andrew T.

... ha!

Marshmallow

4:29 PM

Please spare me the aggressiveness accusations. Here's my answer explaining why voting here is common. The whole thread is a good read. Here's another thread touching on your very exact issue. Here's a thread on what to expect here. We're humans like you, and we don't feel entitled. The downvotes are people having their say. That's all. — Marshmallow 1 min ago

I hope I won't regret this.

Admittedly, it's not in a Catijaic mood.

John Dvorak

4:48 PM

For a moment I though you were saying this in response to The Company fleeing MSO

rene

@Marshmallow not helping either.

Marshmallow

@rene What would? Not responding at all, or?

rene

yeah, just let roomba have it and move on

I admit I'm not always keeping to that advice myself

Marshmallow

You're probably right

John Dvorak

5:05 PM

I'm a strong adherent to "never comment"

Marshmallow

5:51 PM

@JohnDvorak Hey, sometimes when I feel that I can take the insults in case they happen, I go ahead and comment.

On SO and Meta.SE, they haven't turned the tables around much as far as I recall

But other sites, sometimes the OP had an epiphany.

. . . whoosh. Tinkering belled.

Or maybe Catija'd.

I've had experiences of "omg im so sorry ur right", sometimes better formatted, sometimes worse o.O But every time they happened, I felt Battery fully charged for quite a while.

Mithrandir

7:48 PM

@Marshmallow Now isn't that taking things a drop far? I only take responsibility for the weird ads, not the trashy ones.

user248725

@Catija FWIW, you're hardly the first to be shadowbanned over literally nothing. They shadowban "suspected" bad accounts all the time over evidence that, to a human, would be utter nonsense. It might be something as simple as a spammer once used a compromised computer in the house next door as part of a botnet, so your ISP's entire IP for that area was banned.

user248725

Or, amusingly, if you have "roughly the same" word frequency distribution as a spammer, you can get banned on suspicion of being them. Have you ever made a lot of typos in a tweet?

Catija

I don't make typos. :P If I notice them, I tend to delete and resend.

But that's only happened once or twice.

user248725

¯\_(ツ)_/¯ not being a Twitter dev, I couldn't tell you even if you're shadowbanned, let alone why

user248725

I'm just mentioning that it's possible, and you don't actually have to have done anything wrong.

Catija

8:00 PM

Appreciate it. :) I figure that Twitter is kinda wonky at times.

user248725

You could contact customer support