| 00:28.40 | *** join/#wowace Ressy (~Ressy@WoWUIDev/WoWAce/ARL/Ressy) |
| 01:23.35 | *** join/#wowace AcidWeb (~AcidWeb@vulturis.eu) |
| 01:52.28 | *** join/#wowace AcidWeb (~AcidWeb@vulturis.eu) |
| 02:23.15 | *** join/#wowace kagaro1 (~kagaro@cpe-173-095-140-190.nc.res.rr.com) |
| 04:11.56 | *** join/#wowace ShadniX (dagger@p5481D880.dip0.t-ipconnect.de) |
| 04:26.45 | *** join/#wowace RLD_osx_ (~RLD_osx@ip-static-212-117-176-49.as5577.net) |
| 06:44.31 | *** join/#wowace Megalon (~wig0r@62-116-53-190.adsl.highway.telekom.at) |
| 07:06.02 | *** join/#wowace Yoshimo (~Miranda@unaffiliated/yoshimo) |
| 07:44.02 | *** join/#wowace ShadniX (dagger@p5481D880.dip0.t-ipconnect.de) |
| 08:33.21 | *** join/#wowace stolenlegacy (~stolenleg@unaffiliated/stolenlegacy) |
| 08:37.15 | *** join/#wowace kagaro (~kagaro@cpe-173-095-140-190.nc.res.rr.com) |
| 10:20.38 | *** join/#wowace TNSe (~evil@ti0042a400-3869.bb.online.no) |
| 11:12.46 | *** join/#wowace Yoshimo (~Miranda@aftr-88-217-181-55.dynamic.mnet-online.de) |
| 11:12.46 | *** join/#wowace Yoshimo (~Miranda@unaffiliated/yoshimo) |
| 11:50.05 | *** join/#wowace RLD_osx_ (~RLD_osx@ip-static-212-117-176-49.as5577.net) |
| 12:50.41 | *** join/#wowace Funkeh` (~Funkeh`@WoWUIDev/WoWAce/Ace3/BigWigs/funkeh) |
| 12:50.46 | *** mode/#wowace [+o Funkeh`] by ChanServ |
| 12:51.28 | Stanzilla | https://www.dropbox.com/s/px80k0exu4cfig9/Screenshot_2014-04-12-14-50-47.png :( |
| 12:54.53 | nevcairiel | client applications are typically not affected, as they dont tpyically open a socket to listen on |
| 13:01.27 | Stanzilla | all good then |
| 13:03.23 | znf | Oh. |
| 13:03.27 | znf | The cloudflare challenge has been beaten |
| 13:04.06 | znf | We rebooted the server at 3:08PST, which may have contributed to the key being available in memory, but we can’t be certain. |
| 13:04.08 | znf | heh |
| 13:50.31 | *** join/#wowace RLD_osx_ (~RLD_osx@ip-static-212-117-176-49.as5577.net) |
| 13:52.40 | *** join/#wowace Yoshimo (~Miranda@unaffiliated/yoshimo) |
| 13:59.18 | *** join/#wowace Yoshimo (~Miranda@unaffiliated/yoshimo) |
| 14:22.45 | Fisker | deymad znf |
| 14:27.41 | *** join/#wowace RLD_osx_ (~RLD_osx@ip-static-212-117-176-49.as5577.net) |
| 15:20.59 | *** join/#wowace RLD_osx (~RLD_osx@24-182-109-19.dhcp.ftwo.tx.charter.com) |
| 15:21.48 | *** join/#wowace pompy (~Mike@c-50-166-85-212.hsd1.nj.comcast.net) |
| 15:36.00 | *** join/#wowace Venara (~Venara@95.44.83.252) |
| 16:03.39 | harl | how do addons cause taint by calling a protected function if they don't even call it directly.. |
| 16:06.36 | Stanzilla | tainting the root kills a tree |
| 16:38.30 | quiescens | magic |
| 16:41.15 | *** join/#wowace Yoshimo (~Miranda@aftr-88-217-181-253.dynamic.mnet-online.de) |
| 16:41.16 | *** join/#wowace Yoshimo (~Miranda@unaffiliated/yoshimo) |
| 16:41.49 | nebula169 | Q: Also, what would it do if the printed to file combat log saw EVERYTHING. Including things in other phases (like Norushen). |
| 16:41.50 | nebula169 | A: Working on getting the combat log to do exactly that - couple of issues to sort out but nothing insurmountable |
| 16:41.51 | nebula169 | woo |
| 16:42.38 | nebula169 | hopefully not just the file log |
| 16:44.36 | nevcairiel | they did more thorough logging for the files before just recently, i wouldn't be surprised |
| 16:46.42 | Fisker | nevcairiel you wouldn't really connect to a client anyway, so it's pretty much only vulnerable in the only case it makes sense for it to be connecting to a client |
| 16:46.45 | *** join/#wowace Megalon (~wig0r@62-116-53-190.adsl.highway.telekom.at) |
| 16:47.23 | Fisker | I wonder why they bundle their own openssl if Android already provides it? |
| 16:47.39 | silentium | clients can theoretically be vulnerable to attacks from servers, which could be a problem with clients connecting to multiple servers with different credentials |
| 16:48.56 | Fisker | Exactly silentium |
| 16:49.10 | Fisker | Which is where the attack makes sense |
| 16:50.14 | Fisker | Since most clients are behind nat anyway, it wouldn't really make sense to attack a client like that |
| 16:59.36 | *** join/#wowace Ressy (~Ressy@WoWUIDev/WoWAce/ARL/Ressy) |
| 17:43.29 | quiescens | ! |
| 18:25.47 | *** join/#wowace Grum (~grum@irc.grum.nl) |
| 18:34.41 | Stanzilla | nevcairiel: did you change something about your git repo? |
| 18:37.51 | Fisker | btw Stanzilla |
| 18:38.03 | Fisker | If you have a pre-release 2919442 version installed and /resetbase'd you're borked and need to re-install windows. |
| 18:38.11 | Fisker | I guess I had the pre-release one |
| 18:38.14 | Fisker | Somehow |
| 18:38.18 | Fisker | which is weird since I got it after you |
| 18:38.57 | Stanzilla | yeh |
| 18:56.43 | nevcairiel | Stanzilla: like what? |
| 18:56.55 | Stanzilla | poking me for auth info |
| 18:58.02 | nevcairiel | i didnt change anything |
| 18:58.38 | Stanzilla | ok |
| 18:59.39 | Stanzilla | ah, sourcetree forgot my ssh key |
| 18:59.42 | Stanzilla | nvm! |
| 19:13.37 | *** join/#wowace MysticalOS (~Myst@50.96.85.224) |
| 20:00.07 | harl | stanzilla: true. so, basically, every addon that hooks into the editbox a certain way might taint every slash command. i wonder though, why does /focus work just fine sometimes and taints a few minutes later. |
| 20:00.41 | harl | also, why do protected functions get tainted in the first place. if they're protected, why aren't they just completely inaccessible (or rather invisible) to addons. |
| 20:01.21 | nevcairiel | because the default ui uses them, and can use them |
| 20:01.25 | nevcairiel | and we can modify the default ui |
| 20:01.30 | nevcairiel | just not all parts |
| 20:01.47 | nevcairiel | and taint protects the parts we're not supposed to mess with |
| 20:02.04 | nevcairiel | so it just stops working instead of being exploitable |
| 20:03.34 | nevcairiel | the alternative would've been to make large parts of the default UI inaccessible to addons so they don't get abused to automate tasks ingame, which would be far worse |
| 20:04.14 | *** join/#wowace JonesFK (jygga@unaffiliated/jygga) |
| 20:04.44 | nevcairiel | also - its usually not the protected functions that get tainted, but the code that calls these protected functions. When you mess with the editbox, it doesn't tain the function that sets focus, but it tains the editbox. And once the editbox is tainted, any execution that goes through the editbox is tainted, and tainted execution cannot call protected functions anymore |
| 20:05.44 | harl | i see. that last part explains a lot then. |
| 20:06.08 | harl | i just think taint better shouldn't happen in the 1st place. |
| 20:06.32 | nevcairiel | you can never avoid taint, if you install any addon, some parts get tainted |
| 20:06.44 | nevcairiel | addons just have to be careful not to tain stuff that relys on calling protected functions |
| 20:07.06 | harl | say, an addon tries to run FocusUnit() which is protected, it shouldn't error "hey, you tried to run a protected function!", but instead just make the protected function local to the UI parts which use it and let the addon run another localized function. |
| 20:07.07 | nevcairiel | taint isn't "bad" in itself, its only bad when it needs to call protected functions |
| 20:07.49 | nevcairiel | and whats the function supposed to do then? just nothing? it certainly cannot set the focus. Might as well let someone know that something didn't work as expected |
| 20:07.53 | harl | and then, when someon enter /focus no matter where, it should just execute the local (protected) function and ignore the addon |
| 20:08.11 | harl | yes, basically it should do nothing |
| 20:08.25 | nevcairiel | that doesnt solve the problem at all though |
| 20:08.33 | nevcairiel | its not that function that gets tainted |
| 20:08.44 | nevcairiel | its the editbox, or the code which handles slash commands |
| 20:08.48 | harl | if someone was as blunt or unknowledgable to create a function with the same name as a protected one, *that* would be another thing |
| 20:08.59 | *** join/#wowace RLD_osx (~RLD_osx@24-182-109-19.dhcp.ftwo.tx.charter.com) |
| 20:09.10 | harl | mh |
| 20:09.55 | nevcairiel | taint isn't the problem |
| 20:10.05 | harl | well, it seems i don't quite have the general view how functions/apis etc are "layered" |
| 20:10.11 | nevcairiel | the problem is one of two things; 1) addons doing shit they shouldn't be doing |
| 20:10.35 | nevcairiel | 2) the default UI being stupid and doing things way too complicated, and pulling in taint from all over the place |
| 20:11.03 | harl | i see.. |
| 20:11.13 | nevcairiel | taint is like a virus, once an addon infected a small part of the default UI, it'll spread |
| 20:11.17 | *** join/#wowace Parnic (user@distribution.xbins.org) |
| 20:11.42 | harl | sometimes it goes away when i reload or relog but sometimes it doesn't. |
| 20:12.05 | nevcairiel | reload completely clears it, but of course that doesn't mean an addon isn't going to re-taint it right away during load |
| 20:13.49 | nevcairiel | anyway, in the majority of cases its either addons doing shit wrong (because the author didn't know any better), or addons doing shit wrong because the author didn't find another way |
| 20:14.04 | nevcairiel | but there are some cases where no-one can ever really figure out where the fuck the taint is coming from |
| 20:14.20 | nevcairiel | thats usually the default UI spreading the infection all over the place :p |
| 20:15.26 | harl | sometimes /focus works. at one point, i thought it would always work in-combat since certain UI parts were like "locked" to addons then but from my experience i see no consistency to why it sometimes stops working and not even reload helps. |
| 20:16.26 | harl | it's just annoying. none of the addons i use actually tries to run FocusUnit() so i have no idea which one actually causes taint |
| 20:16.26 | nevcairiel | i dont remember my slash commands being broken. the "Set Focus" option on the unit right click menus was broken for a long time though, but that was something Blizzard did, it was just impossible for this to work in any unit frame addon |
| 20:17.31 | Repo | shadowed-unit-frames: 03Shadowed 04v3.10.7 * c422336 /: [new tag, +1 commits] Tagging as release v.3.10.7 |
| 20:18.21 | harl | yea, "Set Focus" usually continues to work |
| 20:18.45 | harl | now anyway |
| 20:44.55 | harl | thanks for the explanations btw :) |
| 21:11.22 | *** join/#wowace Skizelli (~skizelli@unaffiliated/skizelli) |
| 22:18.43 | Stanzilla | Fisker: I think this might have happened to you http://www.neowin.net/news/microsoft-offers-two-windows-81-update-install-fixes-but-problems-remain |
| 22:31.35 | *** join/#wowace RLD_osx (~RLD_osx@24-182-109-19.dhcp.ftwo.tx.charter.com) |
| 23:21.38 | *** join/#wowace Timmeh (tim@will.code.for.food.wienk.net) |
