« first day (1443 days earlier)      last day (3429 days later) » 

4:32 AM
@AviD Heard my name mentioned, can't find context. 'Sup?
 
 
1 hour later…
5:59 AM
 
 
3 hours later…
8:42 AM
mornin'
 
just got a request if I want to do a review of 1000k lines of COBOL and .NET
 
@LucasKauffman 1MLoC of .NET is not too painful (though that depends on the programmers...), but for Cobol I would agree forcefully.
 
@AviD And you do know when they don't split it up it will be 999k cobol and 1k .NET
 
heh, yeah true
actually, probably 900K Cobol, 5K .NET, and oh yeah we also have 95K of 4GL or something else weird
 
Morning people.
 
8:57 AM
@LucasKauffman question is how long were you getting for it...
 
How much memory would a Blowfish algorithm in C would consume? Umm, sounds pretty weird question but, I am writing a IAP code that is part of a somewhat close to a secondary bootloader for a very memory critical controller.
 
@RоryMcCune I'd ask 1 euro per 5 lines of code
 
@LucasKauffman cheap.
 
I want to keep the secondary bootloader as small as possible, so I am a bit confused about what algorithm to implement for ciphering.
 
@LucasKauffman if you think about average manual review rate of 1Kloc a day and a rate of 1k Euro a day is should really be 1line=1euro :)
 
8:59 AM
@RоryMcCune actually you are right
 
@LucasKauffman see I totally just made you 800K Euros, my commission is only 10% :)
 
@RоryMcCune no you made my partner so much money
 
@AviD 1MLoC of Cobol would be much easier to read than .NET
 
:( :( :(
 
@LucasKauffman so you're saying I should send my bill to Ken?
 
9:00 AM
lol
 
@RоryMcCune I wish
 
do you want sweaty palms and a high heart rate?
If so:
 
@RoryAlsop BTW have you seen the llamas in hats videos?
 
@RоryMcCune nope - Lucas did a vid?
 
@RoryAlsop heh possibly. May be your kind of humour (massively NSFW) youtube.com/watch?v=zB92yoK242s
 
9:07 AM
@RoryAlsop should have based off
 
9:17 AM
still regret I never tried it
 
@LucasKauffman ... I'd use the Nope JPG again, but it's been overused today. Also that's not what I thought free-basing was
 
@RоryMcCune It's a massive rush though
I'm not sure I'd have the stones to combine the climbing
 
@LucasKauffman yeah that's what I'd heard about the other free-basing, perhaps that's why it's called that
 
@RoryAlsop ha! you would say that... ;-)
 
9:24 AM
@RоryMcCune 1KLoC per day? that's pretty aggressive.
 
@AviD IIRC that was the MS guideline for general code review
 
50-100 LoC per hour is standard. I have some specialized methodologies that can increase that, but not by much.
hmm.... I guess 1KLoC per day is not THAT much more than 100 LoC per hour....
 
@AviD yeah I guess familiarity with codebase comes into it a lot...
@AviD and then you see security consultancies sell code review at 2 man-weeks for 200Kloc codebases
 
@RоryMcCune what? no, for 200KLoC we can sell it in 1 week.
We're better, because we're cheaper.
Hell, I'll admit that I recently did (was forced to do) 1.2 MLoC in about 2 weeks... :-(
 
@AviD ouch
 
9:29 AM
'course I defined the scope as pretty narrow, they werent happy about that....
automation + threat model.
 
@AviD "we will only do automated scanning en general grepping for keywords"
 
@AviD well you'd have to, or rely on automated tools ('cause static analysis tools can totally do that stuff for you)
 
still kinda tight, but actually can be not much more than that, with the right prep work.
 
@AviD I always find it fun to bargain with people when they try to creep the scope
 
@LucasKauffman Sounds like @Simon would be perfect for the job.
 
9:31 AM
@AviD "please can you do X as well" --> Simon: "Donut with maple syrup" --> "ehm sorry" --> Simon "DONNUUUUUUUUUT" --> "alright alright we'll pay, as long as you get this crazy person out of here"
3
 
hahaha
or "oh yeah, I'll do X, I'll do it with my D"
actually I meant perfect for the job of creeping the scope
 
"Please do X"
@Simon: "you're an X"
 
9:44 AM
@RоryMcCune That's orphan meat. I'm building a meat dragon. :-)
 
@RoryAlsop Caaarrrrl
 
@RоryMcCune Killing people is like my least favourite thing to do
@RоryMcCune Oops, forgot to mention I teared a hole to a parallel universe
 
see who knew llamas could be so dangerous!!
 
That is brilliant
 
balls.
I should get some work done
 
10:05 AM
^ not mine, although I wish I'd thought of it
 
@RоryMcCune nice. Just had my Tesco delivery today - had good chat with the driver about the rioting at Tesco down south!
 
@RoryAlsop flippin' bizarro world, everyone know that's boxing day that happens!
@RoryAlsop I did like the responses when someone on /r/glasgow/ asked about black friday reddit.com/r/glasgow/comments/2nkobf/black_friday_suggestions
 
10:35 AM
@WedaPashi Why blowfish?
@WedaPashi And when talking about memory, do you mean RAM or CodeSize/ROM?
 
11:13 AM
my boredom makes all my thoughts go bizzare
and they're like, just out of this world
damn right, they're out of this world
I could tell you, but that'd be weird
 
Sounds like lyrics @kalina. Or maybe a national anthem
 
sing it to the tune of milkshakes
 
lol
yup
 
peanut butter and vanilla ice cream
today I am going to be completely lazy
until about 45 minutes before I have to stop being lazy
@RoryAlsop I can't believe that humanity can fall apart just by knocking 20% off the price of a shitty no brand TV
I say "I can't believe"
I really meant "I'm not surprised in the slightest"
 
@kalina exactly. It's a TV. Sure - getting money off it is good, but is that £100 how much you value a fight/black eye/night in the cells?
 
11:26 AM
'ello
 
@RoryAlsop psh, it's not even a £100 saving in most of the instances I've looked at
and what about the racial angle that's suddenly appeared this year?
I've never heard those murmurs before
then again it's like i'm some Black Friday specialist or anything
 
@kalina ? hadn't heard that
 
@RoryAlsop my Facebook feed is full of nonsense
if I had Facebook
 
lol
 
every year I get older and I feel like I'm understanding the world less and less the more I learn
 
11:32 AM
@kalina that happens with most stuff, the more I know about IT the more I know that I don't know :)
 
yup - I'm old enough that I now know nothing :-)
 
are you using IT as a euphemism or an acronym of Information Technology
 
@kalina Information Technology
I'm not @AviD :)
 
is it bad that I have a bunch of late 90s pop stuck in my head and that it's influencing my other activities?
.oO( remixing All Saints )
 
@kalina I don't recall late 90's pop being a good thing
 
11:36 AM
perspectives are a wonderful thing
 
@RоryMcCune 90's dance music were awesome
 
90s dance isn't included in 90s pop
let's see if I can find an accapella for one of these tracks:
all saints pure shores
spice girls stop
red nex cotton eye joe
scatman john scatman
 
this is retro house though
 
either that or just dancify a bunch of christmas songs for fucking about purposes
 
@CodesInChaos: I am talking about internal flash program memory
 
11:50 AM
I don't know the architecture of the device. Are you talking about temporary storage during compuations/RAM or code size?
I'd probably use AES-CTR or ChaCha if you need unauthenticated encryption and AES-CCM if you ned authenticated encryption.
 
@kalina you mean like nightcore?
 
yeah basically
nothing serious, just some fuckabout tunes to play over christmas
 
@RоryMcCune s/IT/cyber
IT is so 2000's.
 
@TerryChia Terry you're alive
 
cyber technology is like teledildonics, right?
 
11:56 AM
@kalina Teledildonics in the cloud.
 
@TerryChia hows stuff going? Is it interesting at least a little?
 
that's a whole new level of promiscuity
 
@LucasKauffman Meh, kinda boring. But not too bad.
 
thousands of people having remote sex with you per night
 
So the star wall looks interesting as usual.
 
11:58 AM
star wall looks relatively tame
 
When did @LucasKauffman quit his job as consultant/EY salesperson and become a songwriter?
 
I need to go and start prep for tonight
o/ whenever
 
@kalina DJ'ing?
@kalina \o
 
@TerryChia Since I saw Kalina was doing music, I decided to make a career switch. Me and her are going to be like Avicii and Cold Play,
@TerryChia I'll come to Singapore and perform at the national parade
@TerryChia and yes there will be llamas
 
@LucasKauffman in hats?
 
12:02 PM
@RоryMcCune yep
 
@LucasKauffman I'll watch out for news of the bloodbath then
 
@RоryMcCune because of the llamas killing people or because of the bleeding eardrums
 
@LucasKauffman why not both!
 
@RоryMcCune "And that's how I beat ISIS"
 
my first C# application
 
12:12 PM
@Lighty That's not an application.
 
@TerryChia DON'T DESTROY MY DREAMS TERRY
 
@WedaPashi Basically 4 kB RAM. Blowfish uses four 8->32 bits S-boxes whose contents depend on the key, so you need RAM for them.
A typical AES implementation would use 4 kB of ROM.
If you worry about code size (and not RAM usage) then both can fit in less than 512 bytes (each).
In fact a complete, playable Tetris game can fit in less than 512 bytes.
512 bytes ought to be enough for everyone.
3
 
12:50 PM
Hi, in this message on MSO the on-topicness of certain question for security is mentioned: meta.stackoverflow.com/q/277984/881272
Would you have a look?
 
1:06 PM
@AngeloNeuschitzer posted an answer :)
 
@LucasKauffman @AngeloNeuschitzer funny, I just commented.
not in disagreement, I guess.
Huh. Anybody know much about Apress? I just got a cold call on linkedin from them looking for authors...
 
@LucasKauffman 10/10
 
@AviD yea they have contacted me before and @Rorym as well I think
@AviD to write a book about Nessus ...
 
@AviD Do you really have time to write a book?
 
1:33 PM
@Thomas: Thank you :)
 
2:02 PM
@TerryChia well, seeing as I am currently an unemployed bum....
I was tasked to write most of a book at the startup, but obviously thats not happening...
@LucasKauffman I thought that was Hakin9 or something like that?
 
@AviD "My Macbook and me: A Silicon Valley love story"?
 
@AviD Whaaat? What happened?
 
@AviD You may already know all this, but from what I've heard writing a book is a massive amount of work, you don't get paid enough directly for it (someone likened it to minimum wage levels when worked out) unless you're massively popular of course, but that's unlikely for a tech book. that said, the exposure is likely to be good.
@AviD that said I have a massively cunning book writing strategy
@AviD which would totally make it profitable :)
Just work out the ToC, phrase a set of questions on each bit, ask them on Sec.SE, then paraphrase the top answer... profit!
3
 
2:22 PM
@RоryMcCune If it's a crypto book, you can even get @ThomasPornin to write it out for you.
 
@AviD Really? I thought you run your own business
Also, is there no such thing as a paid position at OWASP? Because it looks like they could certainly use some permanent pros to keep it in one piece before it explodes from too much outsourcing :)
 
You're an OWASP.
 
expand
Over-Worked And Stressed Professional?
 
You're an expansion.
 
@RоryMcCune If you are Schneier you can simply paste your blog posts into a big PDF and sell that.
 
2:30 PM
@ThomasPornin sounds like a post from schneierfacts.com
 
@RоryMcCune Worse than that; it is real. That's how the "Schneier On Security" books are made.
 
When apps collect your personal data, what's the general "guideline" to send it back to their servers?
SSL?
(encryption-wise)
 
heh, general guidelines
 
I don't get this one ...
> Bruce Schneier's first childhood pet was a squeamish ossifrage.
a what?
shouldn't that be "a canary"?
 
@kalina I'm gonna generally guide your line.
 
2:47 PM
@Simon That would be the responsible way to do it, yes.
 
@Xander Is that what they actually do? I'm wondering if I could sniff what is being sent from most apps on Android, for example.
I should probably just test it out instead of asking.
 
@Simon My limited experience with capturing my Android traffic is that most apps do use HTTPS, yes, but there are many that still do not. And of the ones that do, most of them require a valid cert, but some do not. And yes, you should test it out. Because it's fun, if for no other reason.
 
@Xander Great, thanks.
 
@Xander Not only should you use HTTPS, you really should pin the cert. No point trusting the OS cert store for this.
 
@TerryChia Yes, and that I have not bothered to test. I've thought about it, because I'm particularly interested to see if my bank's app has cert pins, but I haven't gotten around to it.
 
2:55 PM
Also, is there a quick way to figure out if an app uses SSL on Android itself?
 
@Simon I don't think so. Just run wireshark.
 
Alright, thanks boiz.
 
@Simon I like to hook my phone up to Fiddler and use that to watch the traffic.
 
I'm sure that's many hours of fun.
Especially if you start analyzing everything that is being sent/received.
And try to understand what's going on.
 
@Simon No no, that's not fun, that's work. Then fun is just to do a high-level scan for particularly badly-behaved apps.
 
3:04 PM
@Xander Pfffft! Also, if you figure out that an app is being a bad boi, you could share it to da world.
Make some blog or something.
Pretty much like plain-text offenders.
 
@Simon Yup. Troy Hunt does that very thing from time to time. Also does conference presentations on them.
 
@Xander Ah damn it. See, that's my main issue. I wanna work on something that doesn't already exist.
As soon as I learn that someone did/does it, I lose all motivation.
 
@Simon LOL, good luck with that. What you can do, is that same thing but exposing badly behaved apps that no one else has found.
 
@Xander Yeah, exactly, everything was once done so I just end up doing nothing like a damn Christmas donut.
 
@Simon That's a couple of hundred thousand blog posts.
 
3:10 PM
Dayum.
 
@Simon Two words: usable security.
 
@TerryChia What?
 
@Simon Security that normal people can actually use effectively. That doesn't exist yet.
 
Oh, yeah. I don't think I'm the one who's gonna figure that out.
 
@Simon Me neither, but you wanted to work on something that doesn't already exist.
I was in favour of space exploration until I realised what it'd mean for date time libraries
 
3:15 PM
-2
Q: Cracking Password

Mr.Great***I've forgot my email password password and I have'nt set my number and security question.Now I am unable to open my email.Please help me to crack my password.

Oh lawd.
 
@Simon What I like best is the starting "***". He wanted his question to be in big bold letters (and failed).
 
@AviD no
 
@ThomasPornin Haha, I was trying to figure out why he did that, just thought he was really dumb.
 
3:27 PM
@Simon What's an email password password? In Freudian terms, wouldn't that mean that his email password is "password"?
 
@TildalWave Possibly but in Simonian terms, it means that he's a dumb fuck.
 
@Simon jeez dude he's not asking to have sex with you
 
ô_ô
 
@Simon Wouldn't it be "dumb donut" in Simonian terms?
 
@TerryChia I kind of felt bad after I typed that because I totally missed an opportunity to type "donut", yes.
 
"fn" as "function", haha.
 
@Simon That's common you donut.
 
fml
 
> The Next-Gen Programming Language for the Web.
HAHAHAHAHAHAHAHAHA no
Though, to be fair, I have a secret side project of a version of Servo that works with Rust instead of JS for content scripts
 
@ManishEarth Meh, that doesn't sound appealing. :P
 
3:58 PM
@TerryChia it's just for the lulz
 
I'm liking Rust a lot but I generally prefer dynamic languages. :)
 
@ManishEarth Any update on the exploit you found?
 
@Simon sold it to the NSA
now he's buying a Porsche
 
OOMs are not security bugs apparently. Also was a dupe :p
 
@LucasKauffman How about you go trade your jailbroken iPhone for a 350Z you donut?
 
4:01 PM
@Simon in your case they would bribe you with donuts
 
@ManishEarth Oh!
 
THEYRE CALLED SWEET BAGELS GODDAMMIT
 
@ManishEarth That's fucking stupid.
 
NO THEY'RE NOT
@TerryChia Even I find it stupid.
 
YES THEY ARE
 
4:02 PM
NOOOOOOOOOOOO
 
GO BACK TO YOUR IGLOO YA STUPID CANADIAN
 
@ManishEarth You racist bastard
 
GO DO SOME SPICY YOGA YOU INDIAN DONUT
 
@LucasKauffman As a racist, that statement offends me
lol
 
@ManishEarth Seriously, that duped bug hasn't been fixed for 6 years?
 
4:03 PM
Holy crap, I didn't look at the date.
Let's abuse the crap out of this.
 
@TerryChia After poking deeper, it seems like firefox eventually catches it
 
Is FF the PHP of applications?
@ManishEarth After using all of your RAM? -.-
 
@Simon lol yes
but Chrome doesn't consider OOMs as seriosu either
Remember, Javascript can effectively OOM too
though the browser catches it
 
How does that work? FF checks your memory once in a while and then if it's almost all used, it checks of it's his fault and then kill the plugin-manager that is leaking?
 
@TerryChia hey @AviD Terry has found the subject for your new book. "Spider in Action" and use Manning as your publisher.
 
@ManishEarth COOL IMAGE BRO
 
Oh god I just crashed myself
I did not expect that to happen
Sorry, Firefox users
..if there are any of you here
 
Wait, what? Linking that made FF people go OOM?
I'm using Chrome, it just said "image not found".
 
@Simon yep
 
lulz silly FF users
What if you post it on your FB wall?
 
4:16 PM
wait....SE allows SVG in chat
rubs palms
 
You donut.
 
@Simon FB doesn't try to rasterize SVGs, and it doesn't accept SVG uploads, and it anyway always proxies images
But I could have tried to crash FB servers with it
@Simon I AM A SWEET BAGEL
RESPECT MY HERITAGE
 
That's even funner.
 
AS I RESPECT YOUR IGLOO
 
YOUR HERITAGE IS A LIE
 
4:18 PM
YOU MOOSE
 
YOU BUDDHA
 
YOU POUTINE
 
OH YOU LE DIDN'T
 
We should attack some other chatroom with this image
@Simon MAIS OUI
 
I suggest PHP chatroom.
 
4:20 PM
good idea
then again, maybe not a good idea
 
It's PHP, even StackExchange won't care.
 
as a spicy yoga sweet diamond bagel, I must adhere to my spicy yoga diamond bagel ethics
 
Which is "crashing people for science", right?
 
um...hmm....
 
Did you check out if it does the same on mobile FF?
 
4:24 PM
@Simon I'm on a winphone
(don't blame me, got it free)
 
@ManishEarth Still better than Android.
 
And you can't even get a different browser on Windows Phone? Jeeze.
 
@Simon doubt it
 
@TerryChia You're better than Android.
Did some donuts report my comment about Mr. Great not being so great?
Sigh.
 
@ManishEarth doesn't show me an image
current Chrome
 
4:36 PM
@RoryAlsop in firefox, when I paste it
lemme try again
 
Let him try again.
 
@ManishEarth just an image not found
 
@RoryAlsop Load it up in FF you donut.
 
@Simon I don't even have FF on this VM
 
still crashes, and it's persistent
 
4:37 PM
In fact
do I have it on anything here
maybe not
nope
it annoyed me so much a while back I stopped using it
didn't realise I uninstalled it as well
 
@ManishEarth Weird. Last time, it was plugin-manage.exe that was leaking for me
Now, it's FF itself who leaks slowly.
 
perhaps SVG is implemetned as a plugin?
 
Erm and now when I open the page, it seems to be fine.
 
@Simon DMZ, or the direct link?
 
Direct
 
4:41 PM
I neutered the image inside the DMZ
try again
 
4:54 PM
Nope ô_ô
 
hm
shrug
maybe you have a computer fast enough to actually render and cache the image
 
It used to work yesterday.
 
must be your love of sweet bagels keeping it away
 
Are you sure that it's not my love for your mom instead?
 
 
2 hours later…
7:00 PM
-1
Q: To work in the information security field

YupyuI am a first-year Cryptology graduate student in university, focusing on both engineering and mathematical aspects of information security. I plan to proceed to a doctorate degree right after my graduation and then to do indutsrial research rather than academic research. Fro what I have read, to...

SIGH.
 
7:28 PM
@Simon Question is, how do you do a PhD degree "industrial research" (aka one that isn't "academic research") with no prior experience?
or indeed how do you finish your research without gaining any
 
@TildalWave And since when does age matter? Experience does.
Pointing out his age makes go donut.
 
 
2 hours later…
9:13 PM
@schroeder I finally got an answer from the teachers. I asked why integrity excludes availability and confidentiality and this is the explanation I got: "Confidentiality means no access. Integrity means read access. Availability means read and write access. It's the methods used in the OS on files." — hansn 52 mins ago
We need to find his teacher ....
 
9:36 PM
@schroeder Oh dear
 
10:31 PM
 

« first day (1443 days earlier)      last day (3429 days later) »