The DMZ

Adnan

12:00 PM

@RoryMcCune Speaking of which..

Terry Chia

This one: html5sec.org/innerhtml

@TildalWave Hello Miha.

TildalWave

@TerryChia hehe hello Terry :)

@TerryChia trying to endorse those few skills you listed, but dunno what's going on... it's not accepting it :O

Terry Chia

@TildalWave I can endorse you no problem. Weird.

lynks

Any of you guys ever taken Ritalin? My friend has started taking it for his University exams, that to me sounds bad...

Lucas Kauffman

@lynks in my experimental fase I tried it once, half a normal dose

It's very unpredictable what effects it can have on you, on me it increased my concenctration ability, yet it also gave me a very "sad" feeling like a depression.

lynks

12:15 PM

@LucasKauffman while 'up' or as a come-down?

Lucas Kauffman

@lynks while up

and you can become dependant of it

also it's dangerous if you have a bad heart

@lynks during the come down you will actually be more hyper and less able to concentrate

if it

if it's just a try out I wouldn't worry for your friend, but I would definitely not take for every exam

AviD

@LucasKauffman hence the dependancy....

lynks

sounds altogether rather unpleasant, what ever happened to good old caffeine and nicotine?

Lucas Kauffman

@lynks It's the same effect only enhanced and it keeps you focussed

and tbh niccotine or ritaline don't know which one is worse

lynks

a strong cocktail of caffeine, nicotine and aspartame gets me through long nights at the keyboard.

Antony Vennard

12:20 PM

I just sleep!

Lucas Kauffman

@lynks for me it's green tea ^^

@AntonyVennard lazy bastard

Adnan

@LucasKauffman +10000

Lucas Kauffman

sleep is for the weak!

3

Antony Vennard

@LucasKauffman yep, and proud. Actually, it's more that I worked out that spending all night doing something wrecks me for the next few days, and my ability to concentrate falls apart at about 1am, so it's not worth bothering with. I'm much, much more effective if I actually rest.

Lucas Kauffman

@lynks I need to clock down on my caffeine though, I drink about half a liter of coffee a day together with about 1 to 1.5 liters of coke

Antony Vennard

12:22 PM

That, and I cycle >25 miles a day to work, so staying awake all night isn't really a possibility. I'd die.

Lucas Kauffman

@AntonyVennard I wasn't serious :p

Antony Vennard

@LucasKauffman I was... I used to try working hard all the time and it wasn't good :(

Adnan

@AntonyVennard What?! You cycle 25 miles to work?!!

Antony Vennard

Also, a stuffed up sleep pattern is bad.

@Adnan Nope, 12.5 each way, so 25 a day.

lynks

@AntonyVennard see I commute diagonally across a city centre, with no cycle lanes. At rush hour loads of people get knocked off bikes.

Adnan

12:23 PM

@AntonyVennard Ahaa.. alright

Lucas Kauffman

@RoryAlsop what's your trick for the long nighters?

Adnan

@LucasKauffman Viagra.

4

Terry Chia

@LucasKauffman When you are a hundred years old you don't need much sleep.

5

Lucas Kauffman

LOL

lynks

And frankly, if you're cycling at rush hour in the winter when it's dark, around the 5 lane inner-city ringroad, you're putting yourself in harms way...

Antony Vennard

12:24 PM

@lynks Yes, that's a tad insane. I'm okay though, all my roads are single or dual lane (the dual lane one is only a short distance).

The hills are a pig on friday evening though. I swear they get steeper.

lynks

@AntonyVennard and I enjoy driving far too much :P particularly the cheeky bus lane usage

Lucas Kauffman

I take the train or the car, train is often faster

Rory McCune

@LucasKauffman his trick is being a mutant :) I've known him about 10 years now and he's never needed to sleep much

Antony Vennard

@LucasKauffman It's faster door to door for me to cycle... by about 5 minutes over the train. Car? That's so slow it's untrue...!

Lucas Kauffman

@RoryMcCune it's like one of the partners, when we were doing night testing the guy would still be there working when we left at about 3-4 am, when we were coming in around 3PM, he would already be sitting there.

Adnan

12:28 PM

@AntonyVennard I love the bike as well. I use it so much sometimes I forget how to walk.

Terry Chia

@RoryMcCune Maybe he is one of those sparkly things from Twilight?

Rory McCune

@TerryChia now that is a harsh insult :op

Antony Vennard

@RoryMcCune Some people are like that. I have a friend who gets up at 5am whatever time he sleeps. It's madness. Y'know that kellogs advert with the prehistoric man before he has his cornflakes? That's me if you wake me up at 5am!

Terry Chia

@RoryMcCune hehe

Rory McCune

@AntonyVennard If I'm interested in something I can do lates, but realistically I wake up around 7-7:30 anyway, so if I stay up too late I just don't get enough sleep...

Antony Vennard

12:31 PM

@RoryMcCune As I say, my limit is really 1am. Beyond that, I'm unproductive. I can force myself to stay up and I will just get less sleep (6.30's my wake up time) but it's just generally bad, really. Much better to give up at 11.30, get some decent sleep, then carry on.

I have before now got up in the morning and worked. That works well if motivated.

Rory McCune

@AntonyVennard indeed. I got into the early morning habit with commutes along the M8 in scotland that were much less painful if done early :)

Antony Vennard

@RoryMcCune Yeah. I find if I ride in earlier, less people are half awake "driving" their cars.

Which makes the roads much safer.

lynks

We need to promote sec.se, the questions really feel like they're drying up :(

Terry Chia

@lynks Yeah boohoo. One freaking day without a question making it to the top of the supercollider. ;)

Antony Vennard

@lynks Maybe security is a totally solved problem and we can all go home?

6

Terry Chia

12:39 PM

@AntonyVennard Dammit, I haven't even graduate yet. How am I supposed to find a job?

lynks

@AntonyVennard you might be right.

@TerryChia It has felt like a slow month :(

Terry Chia

@lynks I repcapped 7 days. Not for me.

lynks

@TerryChia maybe I just suck :P

Antony Vennard

@TerryChia Nobody said anything about cyber. That's not a solved problem. Not by far.

Terry Chia

@lynks Nah, you just need to learn how to repwhore more.

lynks

12:42 PM

@TerryChia like this :P security.stackexchange.com/questions/25375/…

Terry Chia

@AntonyVennard cyber as in cybersex?

@lynks Argh dammit. I hate you for that. :P

lynks

@TerryChia don't, most of the upvotes came on day 1, so I only got 200 rep for like 150 votes :(

Terry Chia

@lynks hehe. still an amazing number of votes though.

Antony Vennard

@TerryChia No, cybersecurity. I'm not sure how you'd make a career out of that...

lynks

@AntonyVennard we need a cybersecurity.se that would get loads of attention.

Terry Chia

12:44 PM

I still have not got a frigging great answer badge. That ain't fair.

Cmon, even @Adnan has one!!

@AntonyVennard hehe.

lynks

@TerryChia the best thing about that answer was that it was not accepted, so I got the 'populist' badge from it :P

Antony Vennard

@lynks Yeah! Well... actually they shut down bigdata.se. Can't see that going wrong, can you...?

Terry Chia

@lynks I managed 2 populist badge actually. :P

lynks

@TerryChia and here I was thinking I was special :P

@TerryChia actually, all 5 of my highest votes answers are not-accepted... how does that happen?

AviD

@lynks because you didnt have a graph. We always need graphs.

btw regarding commutes - you all suck, my commute is the best.

Terry Chia

12:46 PM

@AviD And freehand circles. Don't forget the freehand circles.

@lynks You suck obviously.

:P

AviD

though it is about 3 times as long as it was last year...

4

Terry Chia

@AviD So you actually got out of your room this year?

@AviD Oh, and THAT'S WHAT SHE SAID!

lynks

@TerryChia way ahead of you on the starring :P

AviD

@TerryChia yeah. Before I moved house, when I would sit up to get out of bed I would already be at work. Now I have to walk down a couple lights of stairs....

@TerryChia works good with the previous mention of viagra....

lynks

@AviD I did the work-from-bedroom thing for a year or so. It was nice working on such a powerful machine.

2

^^ there is so much wrong with what I just said

Terry Chia

12:48 PM

@lynks THAT'S WHAT SHE SAID!

AviD

@lynks aww, now you're just begging for the stars.

Terry Chia

awwh damn ninja-ed.

lynks

@AviD haha, honest mistake

AviD

actually I found it far from ideal, but there was definite advantage too.

Scott Pack

@AviD So. WTF?

AviD

12:52 PM

@ScottPack agree/disagree?

Scott Pack

@AviD I'm suffering a parse failure.

AviD

@ScottPack Do you agree with the previous statement, or do you disagree with it?. Better? ;-)

Scott Pack

I don't know what you're talking about?

Lucas Kauffman

@ScottPack Scott, that's what perl does to you

Scott Pack

@LucasKauffman Some asshole changed the regex to be case insensitive by default.

Lucas Kauffman

12:54 PM

AviD

nevermind....

Lucas Kauffman

@ScottPack colleague?

Scott Pack

YOU'RE CONFUSING ME!!!

Terry Chia

@ScottPack I think you need to import coffee.

Scott Pack

@LucasKauffman Not really, but that did happen to me a couple of weeks ago. I was writing a regex to parse a custom log message that we use for one of our detection systems.

@LucasKauffman I copy/pasted the bigs for IP and MAC from another regex, and it was failing to work.

@LucasKauffman I went to one of those tester websites, threw it in, and it worked just fine.

@LucasKauffman As it happens, the regex for MAC I was using was uppercase only. The log message I was parsing had the MAC in lowercase.

@LucasKauffman I just about burned down my house.

That was 45 minutes of my life I will never get back.

lynks

12:57 PM

@ScottPack uppercase hex, not even once.

Lucas Kauffman

@ScottPack Scott, we are here for you, but you really need to stop using Perl, it's starting to take a toll on you.

Terry Chia

@LucasKauffman I think we need an intervention.

Scott Pack

@LucasKauffman I should start doing some stuff in python to at least get a feel for it. Honestly, though, perl tends to be The Right choice for most of our use cases.

Lucas Kauffman

@ScottPack codecademy.com/tracks/python

time for you to go to rehab

Terry Chia

@LucasKauffman I think those topics in there should be quite easy. Even for @ScottPack. :P

Scott Pack

1:00 PM

@LucasKauffman Based on my previous experience with python, I doubt it would become my go to language. I do need to get more comfortable with it, though.

Terry Chia

Honestly, half the job in python is knowing which library to import.

Lucas Kauffman

exactly ^

Scott Pack

I really don't like the implicit scoping that python does.

Terry Chia

So Google App Engine is gonna support PHP. Ewwwww.

Lucas Kauffman

@ScottPack like that you need to assign "global var" before it's accessible from within a method

lynks

1:17 PM

yeah, weird scoping and required explicit self are my only two gripes with python so far. but as I have only ever used it to build throwaway scripts, it seems perfectly suited to my uses.

Lucas Kauffman

@lynks once you get used to self it's quite ok

3

AviD

@LucasKauffman I think we've heard more than enough about your sexual experiences....

Rory McCune

@ScottPack ewww that's so close to being the one true path but still so wrong... ruby is obviously the answer :)

Terry Chia

@RoryMcCune click We need to combine Ruby and python.

Rory McCune

@ScottPack only rubyists can have... chunky bacon... mislav.uniqpath.com/poignant-guide

@TerryChia sure if by combine you mean "stop all that python nonsense" that'll work out great :)

Lucas Kauffman

1:32 PM

@RoryMcCune so how many 0days did we see in python again these last few months :P

Rory McCune

@LucasKauffman poor unloved language that it is, not even hackers will touch it

Terry Chia

@LucasKauffman Ooooh burn!

Rory McCune

a better comment is that those were in rails not ruby :)

Lucas Kauffman

thats true

Terry Chia

Alright alright, let's just agree to hate Java.

Dammit @Jeff, why did you quit before fixing that stinking pile of crap!

TildalWave

1:35 PM

@TerryChia OK it took it now, was probably some LinkedIn linking in problem :)

Rory McCune

BTW on the topic of linkedin, this is quite cool inmaps.linkedinlabs.com

visualisation of your connections and who they know. Mind tend to clump together by employer with a couple of cross-cuts (OWASP, Sec.SE)

AviD

@RoryMcCune I really wish there was an abridged version of that, without all the crap with the goat and ghosts and stuff. the actual ruby part is great, but have to dig through pages and pages to find it.

D3C4FF

3

Q: Touch Screen Password Guessing by Fingerprint Trace

After having some garlic bread at a friend's who is not security-aware, she managed to figure out the PIN code to unlock the screen of my Samsung SIII. The way she figured this out was by simply putting the device against the light and looking at the pattern that the grease of my thumb left on t...

Rory Alsop

Trying to catch up with the transcript. Long nighters: genetics,sugar and caffeine. Mostly sugar. Oh, and being very laid back.

D3C4FF

Sup all

Rory McCune

1:40 PM

@AviD there's quite few other options for free ruby training... codeschool.com/paths/ruby has some stuff which is free. Also codecademy.com/tracks/ruby also rubylearning.com/satishtalim/tutorial.html

Rory Alsop

No @avid - not Viagra.

Terry Chia

@RoryMcCune Stop promoting ruby dammit!

AviD

@D3C4FF brilliant. Garlic bread: The newest edition to hackers' toolboxes.

Rory McCune

@TerryChia hey I just spent two days at a ruby conference and they were nice about my talk, what did you expect :)

Terry Chia

@RoryMcCune Here's a cookie. Now shut up! :P

AviD

1:42 PM

@RoryAlsop I didnt say that...

Terry Chia

@RoryAlsop That would be @Adnan.

Rory McCune

AviD

@RoryMcCune havent looked at that for a while, now I get: Wow, you've got a complex network! This is going to take a bit longer than we expected.

no really?

Rory McCune

@AviD heh

AviD

@RoryMcCune that look is priceless.

Like @LucasKauffman's face if you show him boobies.

or @Adnan's face when you show him @LucasKauffman's face.

Terry Chia

1:44 PM

@AviD @LucasKauffman's face is nowhere near priceless.

Adnan

@AviD Does @Lucas have female breasts on his face?

AviD

@Adnan only in his dreams :D

D3C4FF

@AviD Hahaha. Yep. Pretty much.

Rory Alsop

Oh, sorry @avid

:-)

AviD

had fun with the interviews?

crushing some poor souls' hopes and dreams?

Rory Alsop

1:50 PM

Hmmmm.

Well, I'll be pushing out a message on LinkedIn later today to suggest I need more candidates...used up the last lot

@rorym my LinkedIn graph is pretty

AviD

heh. What qualifications are you looking for? I assume they have to be local?

Rory Alsop

inmaps.linkedinlabs.com/share/Rory_Alsop/…

AviD

@RoryAlsop ooh prettyyyy

@RoryAlsop you seem to know quite a few lesbians, thats cool

Rory Alsop

We have a range of roles still available from relatively junior analysts in security and risk all the way to senior managers in infrastructure or application technology oversight.

Rory McCune

@RoryAlsop amusingly on mine inmaps.linkedinlabs.com/share/Rory_McCune/… if you see that other very well connected dot down from centre that's you that is

Rory Alsop

1:53 PM

@avid - how is that shown on the graph?

AviD

@RoryAlsop orange ;-)

Antony Vennard

@AviD Well your avatar is kinda orange! ;)

Just sayin'.

AviD

@AntonyVennard hahaha

Terry Chia

@RoryAlsop That sounds evil.

AviD

well, no, the key marked them as orange.

Rory Alsop

1:55 PM

@Terry - said in a voice of a zombie - need more candidates

@avid - on this iPad (spit) I can't see the key easily.

AviD

@RoryAlsop LBG ;-)

curious why you insist on leaving out the transgendered, though.

(not going to mention @Iszi.... :P )

Terry Chia

@AviD you just did.

AviD

@TerryChia oh, did I? Interesting.

Rory Alsop

Hahahahaha

AviD

hmm, a weird thought... how often should encryption keys be backed up?

on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often.

only once per key change? That sounds dangerous... not sure it wont leak some cryptoinformation.

thoughts?

eh screw it, I'll ask a q.

hmm might have been asked already.

Adnan

2:11 PM

I really like this query data.stackexchange.com/it%20security/query/81279/…

I've found some really awesome comments.

AviD

nope, no matches.

1

Q: Backup schedule for Encryption Keys

How often should encryption keys be backed up? Should this be done on the same schedule as the encrypted content/configuration? That seems excessive, as the keys do not change as often. Perhaps only once, every time the key changes? That sounds dangerous... and I'm not sure it wont leak some...

cryptography key-management backup

Lucas Kauffman

@RoryAlsop are you also working with Aidan again?

AviD

@TerryChia Hail Grammer Naxis!

Terry Chia

@AviD Nazis*

AviD

@TerryChia Grammar *

ManishEarth

2:15 PM

@AviD ftfy

:P

AviD

@TerryChia Heil *

ahem, I spelled everything wrong. Just to have you prove it for me... ;-)

ManishEarth

@AviD lol

AviD

bazinga.

Terry Chia

@AviD Excuses.

:P

AviD

anyway, if anybody (@Thomas) has any thoughts on that, I'd be appreciative.

the problem is it crosses both cryptographic and operational concerns.

key management is always fun....

AviD

2:31 PM

whoa, is that @Jin come down from Mount Olympia to visit...??

Rory Alsop

@lucas - has Aidan moved?

AviD

heya @Jin!

Antony Vennard

@AviD He's hoping nobody noticed him sneaking in...!

AviD

@AntonyVennard oooo, maybe he's here for our easter eggs....!

dang, he is so money!

Jin

howdy!

i was looking for these mini site cards I did for you guys a while back

i can't find my mockup. I thought I had posted them here before.

they're the cards that's half sized moo cards, with 3 different questions and urls. I think we passed them out at conferences

AviD

2:40 PM

11

Q: IT Security Stack Exchange moderator cards

We recently printed some business cards for our Stack Exchange employees and they turned out great. It got us thinking: our sites' moderators have been working hard to keep our sites high quality for the past few years. They may not be employees, per se, but great community moderators are why ou...

discussion

these?

ah no, hang on...

Jin

no

AviD

nope, cant find it, are you sure you posted it? or maybe just sent them out.

I remember them, was cute.

Terry Chia

Dammit I want those cards! Looks awesome.

Antony Vennard

@AviD Did we tell him about our secret bacon stash? Maybe we should keep quiet about that?

Terry Chia

@AntonyVennard Hey I want in on that stash...

AviD

2:45 PM

@TerryChia dammit @AntonyVennard!

Quick, move the stash to my lair!

Antony Vennard

Sorry...

@AviD Oh yeah! It'll be safe there.

AviD

@AntonyVennard yeah, well.... I can't eat it :-(

@Jin: I dont think pics were actually posted here. Can't find anything in meta about it, at least.

Scott Pack

@LucasKauffman Mostly the whole code block indentation thing. That really throws me. I find it very difficult to read.

Rory Alsop

Hey @Jin - I'm not sure that you actually posted pics of them here. They were really good. And excellent print quality! They went rapidly though - although the business cards went eventually too.

Scott Pack

@Jin I still have my set from the top user hand out. What do you need, kiddo?

Antony Vennard

2:50 PM

@AviD I was actually being serious which is a rare thing I know, but, given how armoured your bunker is, I can't imagine anywhere safer.

Rory Alsop

@aviD - I will look after all the bacon. In my secret bacon lair. It is well protected. By my teeth:-)

Jin

@ScottPack thanks all. i think i can find the original files on my computer at home. I'm in our NYC office this week

AviD

@AntonyVennard well, if I could eat it, it wouldnt be very safe, now, would it?

besides my "lair" isnt really locked down as much as you think....

Antony Vennard

@AviD I don't know. Even if you could, you might not like it?

Jin

I only did those mini cards for maybe 2 or 3 SE sites. I plan to do them for all the SE sites.

AviD

2:51 PM

@AntonyVennard I HIGHLY DOUBT THAT

Rory Alsop

Lol @AviD

Terry Chia

@AviD You didn't harden your secret lair? WHAT KIND OF SECURITY EXPERT ARE YOU?!?!?!

AviD

its meat. and its fried. its fried meat. How could I possibly not like it?

Scott Pack

@Jin Would pictures of the cards help you out at all?

Jin

@ScottPack sure!

AviD

2:52 PM

@TerryChia heh

Scott Pack

@Jin I'll see if I can get any good quality versions.

Antony Vennard

@AviD Good point.

Jin

@ScottPack only if you're free. don't spend too much time on it :)

AviD

@AntonyVennard heck, I would probably love Joey's English Trifle.

Terry Chia

@Jin @ScottPack is always free. Look at his mod nomination on SF.

ManishEarth

2:53 PM

@AviD you mean Rachel's English Trifle

AviD

@ManishEarth technically, yes.

ManishEarth

:p

Antony Vennard

English trifle? What is this? There's only Trifle!

Scott Pack

@Jin For you? The bigger problem is actually taking a picture that won't end up being washed out. The camera we have at work is mostly for documenting investigation scenes, and at home my lighting is so bad that the flash would overwhelm everything.

@AntonyVennard I think he's talking about a small Englishman

AviD

►

"these people".... hehe

Lucas Kauffman

2:56 PM

@RoryAlsop ah no, it's because you are security at RBS and I thought he worked a lot of RBS

TildalWave

@TerryChia Everything looks more awesome when @Jin's around... even DMZ and that's to say a lot with @ScottPack in here (him being cute and all) :)) :P

Terry Chia

@TildalWave suckup

Transcript for