The DMZ

@TheGuywithTheHat it might be, if you explain why there is a security (including privacy) reason why it matters

The Guy with The Hat

@Gilles Okay, Thanks

3:30 AM

@RoryAlsop Wait, if you prefer smaller devices won't you like iPhones better? ;)

So today I woke up to another TLS vuln. Interesting year so far. armoredbarista.blogspot.de/2014/04/…

5:40 AM

good moaning

@LucasKauffman Why are you moaning?

@TerryChia because I saw your face.

@LucasKauffman I'm very creeped out.

@TerryChia sssst just sit very, very still

@TerryChia so that's the last time you ask that question I guess

:p

6:36 AM

@LucasKauffman here was me thinking it was an Allo' Allo' homage

@RоryMcCune It was, but I guess @Terry is not aware of the great show

@LucasKauffman probably true, sadly

7:11 AM

good morning, everyone in UTC+XXXX

@tylerl morning your up late again.

@RоryMcCune every night

more or less

@tylerl ah what it is to be younger :op

@RоryMcCune How young do you think I am?

@tylerl hmm at a random guess, late 20's/early 30's?

I'm guessing not 40's or you'd risk displacing @RoryAlsop :)

7:16 AM

I'm only 5 years younger than you

tylerl, United States

29.6k 5 45 105

@tylerl you put a real age on there!

double bluff central

well...

If I'm going to put a false age there, then I certainly wouldn't tell you the REAL number in chat on the same site, would I?

@tylerl see triple bluff! security people are tricky

They are indeed. That's not his real name. Or photograph. In fact tylerl is actually a dolphin named Sally, and she is a precocious three year old... (Might be a long bluff, this one)

7:46 AM

/me appears and hands round fresh cups of coffee to the room

And I forgot that stackchat has no /me

returns to lurking

8:14 AM

@BarryCarlyon thanks for the cup barry

@BarryCarlyon Mine's a vanilla latte - thanks :-)

@rory

you would have to be difficult :-P

I do like two shots of expresso in mine

turns into a barista

@BarryCarlyon so what brings you to this parts of the stackexchange

@BarryCarlyon I notice that you develop magento and wordpress

8:21 AM

I saw a tweet about people posting Heartbleed things in here. And thought I'd poke my head in. And I'm still here :-D

Indeed magento and wordpress keep me busy

Ah - the fun of heartbleed :-P

well, I say fun

what I mean is - things become complicated when the media get hold of them

@RoryAlsop Was that referring to the openssl vuln or the condition you get when working on magento and wordpress for an extended period of time?

@TerryChia hahaha - seems a little harsh. (You know our blog is on a Wordpress host)

haha

I only have the second not the first.

"Luckily" my works server is on 0.9.8 \o/

@RoryAlsop Well core wordpress isn't that bad. :P

Magento is horrid though.

8:27 AM

Keeps me in work

So can't complain.

It's not too bad overall though.

@BarryCarlyon That's a fallacy. You can always complain about work.

What do you think @AviD does in here half the time?

I complain about everything

Hello chat :P

@Nick morning!

Morning @nick

backs away slowly into the darkness

8:40 AM

Yea the chat is pretty much dead :P

A: Is saving passwords in Chrome as safe as using LastPass if you leave it signed in?

@Manishearth What ever happened with the autocomplete=off password management in Mozilla. Did you come to a conclusion about it?

I rewrote my "what do you think about Chrome saving passwords" answer, and re-hashed my not-at-all-humble opinion on the autocomplete thing.

8

First of all, Chrome does encrypt your passwords and other secret data. But there's are different aspects to this depending on the setting, plus a few details that you should keep in mind. On your Computer, In your OS When passwords are saved locally on your computer, Google will attempt to use...

@Nick Hello nick

@LucasKauffman hey

@Nick How's Greece this time of year?

@LucasKauffman hot, with good weather

8:53 AM

@Nick ah nice

►

The audio track on that one had me scratching my head.

9:12 AM

@tylerl random, I hesitate to ask how you came to find that video...

TildalWave

@tylerl Jesus dude that's country music! Too early, haven't even touched a bottle yet out of the bare minimum of three!

Meta Chat Q, if a answer belongs on another site that's not on our list of places to migrate what's the "correct" close reason?

@RоryMcCune I usually just flag for a mod and poke @AviD and/or @RoryAlsop on chat.

@RoryAlsop off topic I think

There is that whole

> This question does not appear to be about Information security within the scope defined in the help center.

That should work as well.

9:20 AM

yeah that's the main reason I picked but the sub-reason "belongs on another site in the network" is mis-leading 'cause if you go down that line you end up with 3 choices and no "other site" option

9:51 AM

Yeah - that oddness has been discussed

Not sure if a solution is near

@RoryAlsop There is a great solution. It's called poke the mods. ;)

@Nick - ah, are you a useful person to ask about nice places to holiday in Greece?

@Terry, you modpoker

@RoryAlsop uhh possibly

CHERSONISSOS

not really

10:32 AM

I honeymooned in Alykes (north shore of Zakynthos) and it was lovely - 16 years ago. Don't know what it might be like now

@LucasKauffman If that is an 18-30s type place then...no thanks

@RoryAlsop Lol what type of place do you want

@Nick Only requirements are a pool and/or beach, and can cope with 2 adults and 3 kids. Ideally somewhere drunken Brits don't go. Away from resorts etc. - villages are good, huge hotels bad

10:47 AM

@RoryAlsop Uhhh I don't know then I know some good villages up in mountains but only big-ish cities near sea

@Nick Ok - never mind. Thanks anyway - I'm scouring the internet for places. Thinking Greece, Turkey, Croatia, Minorca, Italy - and possibly even Israel, @AviD

@tylerl autocomplete=off is now impotent wrt thepassword manager. Still works as expected for autofill (eg it blocks credit card numbers from being autofilled and all)

11:52 AM

> When you factor in De Castro’s salary and stock-based compensation, he earned roughly $244,000 a day — assuming he worked weekends — by Forbes’s calculations.

washingtonpost.com/news/morning-mix/wp/2014/04/17/…

Where do I sign up for this job?

@TerryChia I'll help you find if I get 10%

@ManishEarth d'ya know if there's an official FF doc for removing autocomplete=off, I can find refs for Chrome and IE, but not FF at the moment.

12:10 PM

soundcloud.com/majorlazer/walshy-fire-bbc-radio-1xtra

OSCPing on the sounds of Major Lazer

12:27 PM

@RоryMcCune As in, an MDN article?

This is the bugzilla bug: bugzilla.mozilla.org/show_bug.cgi?id=956906

It's marked as dev-doc-needed

I can add something to MDN if you'd like

12:41 PM

edx-cs169-1x.stackexchange.com

This is an odd SE site.

12:57 PM

@TerryChia edx course?

@ManishEarth Am I missing some context?

dunno

Q: What is cs50 and why can't I access it?

21

I just stumbled over this page in the Stackexchange dropdown (top left corner). cs50 - For students of HarvardX CS50x: Introduction to Computer Science When I click on it I get the following message: Warning: this site is currently in private beta for at least a few more days. To...

discussion area51 stackexchange private-beta

Huh, interesting.

Stackexchange for classes?

2

Q: Should course-specific sites appear in the site switcher?

Site switcher currently shows two sites (private betas) that are intended for students in specific edX courses, namely HarvardX CS50 and BerkeleyX CS169. I think this is a bug, because the sites are not shown in the full list. It would make sense to show them in both places, or in neither. (T...

bug status-bydesign stackexchange-button communities-list

@TerryChia got access :)

Blog - Stack Exchange: Announcing The Launch Of Meta Stack Exchange

1:21 PM

@RoryAlsop You want a place where you can drown a corpse without witnesses ?

Stack Exchange

Tim Post on April 17, 2014

We’re very pleased to announce that as of today, we’re (finally) splitting the site formerly known as Meta Stack Overflow into two sites:

Meta Stack Overflow is a brand-spanking new site for discussions specific to the Stack Overflow (programming) community:

Meta Stack Exchange will cover feature requests, bugs, and any discussion topics that affect the entire network:

Meta has always been one of the most important things that make our network… work. Almost all of our most important features, improvements, and community rules were partly or entirely based on our users telling us how we could help …

@ThomasPornin hahaha - no :-)

I'm just much more a fan of places which have no/few people

@RoryAlsop Novaya Zemlya may be the place, then.

Apparently Russia has plans to develop tourism there.

I am not sure you can visit the Tsar Bomba site, though.

@RoryAlsop I hear mars is good this time of the year. ;)

If you are to get mauled by a polar bear, you could at least make sure that it is a radioactive mutant polar bear.

1:35 PM

@ManishEarth cool thanks for that :)

@RоryMcCune what do you mean by official FF doc?

example?

or just MDN?

@ManishEarth MDN fine I was just interested in the chat behind the change, with Chrome 34 flipping over to that, that's the three major browsers all disabling it on password fields, so considered dead now. It's relevant to my line of work 'cause we commonly recommend that companies consider autocomplete=off on sensitive sites

so need to update our recommendations database

@RоryMcCune ah

Yes please, do that

OWASP too, I guess

+ I'm planning to blog about it and the death of remember me functions on websites

'cause why should companies put remember me as their own code when browsers will all essentially override it...

owasp.org/index.php/… <-OWASP still recommends it

@RоryMcCune ooh, link me to it when done

Q: How to disable autocomplete for a HTML password field in IE11?

1:40 PM

@ManishEarth well I kind of think it's debatable that it was removed as an option, but that said no sense in crying over spilt milk, the browser makers have decided and that's pretty much that :)

CodesInChaos

The workarounds are really WTF:

6

IE11 dropped support for autocomplete=off for input type=password at both the form and element level. Has anybody found a working solution to disable autocomplete under IE11?

html autocomplete internet-explorer-11

@tylerl You can't fix it, it's broken-by-design.

2:00 PM

Your mom is broken by design.

2:25 PM

@ManishEarth raesene.github.io/blog/2014/04/17/…

@ManishEarth not now they don't :op

2:53 PM

My OSCP report is already close to 100 pages and I'm only half way

@LucasKauffman this a work thing you're writing?

@LucasKauffman BTW on a related note did you see isc.sans.edu/crls.html

@RоryMcCune OSCP, the cert thing.

@LucasKauffman My lab resumes on April 20th. I feel like I'm gonna fuck up my report.

@TerryChia <sigh> I can't read

@RоryMcCune The cert requires you to write a report.

3:04 PM

The cert requires you to write a pen-test report in the same fashion and format that would be presented to a client.

@RоryMcCune Moar coffee!

@TerryChia sorry I misread OSCP as OCSP

So.

200 page report?

Fuck that noise.

Let me tell you.

@terrychia hey it's a transposition and they're both cert related

@RоryMcCune Goddamn acronyms. :P

3:05 PM

If you handed me a 200 page report I would look at it. Look at you. Look at it. Look at you. Then ask for you to give me a new one that's 50-100 pages that I can actually read.

@TerryChia and overloaded terms.... cert and domain have to be two of the worst...

@ScottPack No no, love. The real life business/tech report for OSCP is only on for the exam. As for the course itself, you have to go tech all the way.

@ScottPack 50, 1-5 page exec summary is the most that management will read

Because a 200 page report either means my environment is so badly fucked up that I should get a new job in Tahiti and hope no one notices I'm gone until I'm out of the country. Or it's just too long.

@Adnan I know. I've done the class.

@ScottPack Coulson will disagree with Tahiti. ;)

3:06 PM

@ScottPack ya know I have done 100+ plus reports that were all vuln details....

@TerryChia It's a magical place.

@RоryMcCune That's not a report, that's an appendix. :)

@Rory So, in my visa application, I have to write in full details what I'm planning to do in the UK. I wrote about the conference, that I'll meet some friends and then taste some whisky. Today, they told me that my application isn't valid because I didn't specify the friends I'll meet. Is it okay if I mention you guys?

@ScottPack potato, potato

@Adnan That seems a little bit stupid to go into that much detail for a visa report...

@Adnan really, these guys are nuts! but sure feel free to mention me (I'm guessing I was included even though you were pinging the other guy :op )

3:09 PM

@RоryMcCune Oh no, I was actually pinging both of you guys.

@Adnan yeah my ambiguous ping defence can be a bit annoying sometimes..

@TerryChia Yup. This is by far the most detailed visa report I've ever filled.

4 times more fields than the one for Schengen

Braiam

@Adnan hey, you are lucky, at least they didn't asked the kind of whisky you will taste

@Braiam Or when he will be moving his bowels.

Nearly double the fields for the US visa form

People, the application asks if I ever worked with any thing related to security. It asked if I ever done my military service in any country in the world (I have to include rank, tasks, equipments, etc.)

It asks how much I plan to spend (in details: x on food, y on transport, etc.)

I'm pretty sure I'll be asked if I'm planning to sleep with British women.

5

3:14 PM

@Adnan Are you?

Wait, no. Don't answer that.

3:41 PM

Well this is very not good...

They just let go two people who have worked here for longer than I've been alive.

@DavidFreitag Why?

@TerryChia Money

Apparently this ship is sinking

@DavidFreitag Oww, that's no good.

The company now has no purchaser and no dedicated shipping staff. This... could get bumpy...

@ScottPack I updated MDN, and also added a link to your OWASP edit / your blog. Cheers :)

3:54 PM

@ManishEarth I'm guessing you were going for me rather than scott with that one :) I've updated the new OWASP testing guide too, so it shouldn't feature there either..

@RоryMcCune uh, whoops, got confused :p

For some reason I thought raesene was Scott

@RоryMcCune what's a raesene anyway?

@ManishEarth Something Scottish I presume.

me too, but what?

@ManishEarth raesene is just my online handle, I've used it for aaages, it's actually a character name from a mid-90's ADnD setting (Birthright). Easy username to grab on almost all sites

Ah, I see

3:58 PM

although now I'm thinking I should've spun a yarn about it being some fearsome scottish beastie..

Heh. Usernames do not have to make sense. Ayrx is just 4 random letters I put together. :P

@TerryChia Yeah but at least it's creative enough to look cool.

indeed rather than [name][year_of_birth]

@RоryMcCune I was thinking more along the lines of scottish raisin.

2

Or "XxXxSomethingStupidxXxX"

4:00 PM

@TerryChia that would've been cool, perhaps it could be a whisky soaked raisin

@ManishEarth ya know something occurs to me. If passwords are cached in the browser wouldn't it make sense that for sites where the user has chosen to save the password any expiring session cookies are ignored/automatically renewed. The effect is the same (on that machine user is trusted) but without the annoyance of logging back in

I mean as a security person that thought makes me shudder, but it seems like a logical extension

@RоryMcCune That is an ... interesting idea

I certainly would use it as a pref

@ManishEarth yeah on my home PC where I do cache passwords in the browser, auto-logoff is just annoying

same here

I just have to click the form and resubmit on a periodic basis...

no security benefit (person who is there can get access to the site as me)

@RоryMcCune How would the site know the users preference?

4:06 PM

@TerryChia because they chose to save their password in the password manager

once they've done that someone with access to that OS session can log in as them regardless

@RоryMcCune remind me tomorrow, I'll file a bug about it

@ManishEarth cool, it'd be interesting to see what people think, may be a crazy idea but I can't think of a specific reason why at the moment...

@RоryMcCune Isn't that done by the browser? How would the site know that this particular session should persist?

Or are you talking about the browser automatically resubmitting the credentials?

@TerryChia site wouldn't (probably) but the browser could ignore perhaps do that

@TerryChia browser

@RоryMcCune but yeah, if I turn my laptop on the next day the site will have forgotten about the cookie

4:09 PM

@RоryMcCune @ManishEarth Interesting idea...

They probably are expired server side too

@ManishEarth yeah it would need some way of the browser re-initiating it which would be tricky/impossible... I see all sorts of weirdness on websites session handling..

@RоryMcCune I can see the browser periodically submitting a POST /login or something like that though.

From the vantage point of the site it will be an entirely new session.

@TerryChia yeah you cold code browser automation to do it, but it would be per-site. Another option might be the browser exposing a setting "user trusted browser" which would let the site set a longer expiry

@RоryMcCune So there already is an autologin feature for HTTP BASIC auth

(and proxy auth)

maybe that can be extended?

but that would be icky

4:13 PM

@ManishEarth possibly but yeah anything predicated on the predictability of forms login is likely to be icky...

Saving cookies is good

@ManishEarth yeah I bet there's some sites that don't realise that the old advice of "close the browser and the session cookies go away" doesn't apply any more...

heh

@RоryMcCune I think we should first look into whether or not it would work before filing

I might be able to whip up a firefox extension that does this

but only after May starts

@ManishEarth indeed as I think about it more, the expiry at server-side in well run things would be a problem, but perhaps exposing a setting for sites to check could work (but then adoption would likely be low...)

If you expose to the sites that the session should be persisted longer, this could be abused by mitmers

4:17 PM

@ManishEarth true but then if you're properly MITM you've grabbed the creds and can replay at will :)

not in 2FA

@ManishEarth true true

@Adnan Yeah - no worries, and I would suggest using my titles: President of ISACA Scotland, and Chairman Scottish Branch of Institute of Information Security Professionals. Think that'll count as useful...?

I know - it's also icky, but if it helps...

@RoryAlsop Only if you have CISSP.

@TerryChia I did for 10 years but gave it up a year ago. It was no longer useful and it ws just costing me money#

4:26 PM

@RoryAlsop you missed "rock god"

@RоryMcCune And HR manager.

2

@RоryMcCune that's less than one would expect

@ScottPack Most of it is pictures

@LucasKauffman indeed it'll be v.interesting to see how that tracks.

@ScottPack I could write a one pager 'PATCH YOUR THINGS YOU MORRON'

4:53 PM

I need to pee but I have a headache and don't want to stand.

@ScottPack well is it a chair you own or someone elses...

@TerryChia stoppit you!

@RoryAlsop so has anyone endorsed you on LinkedIn for HR Skills yet?

5:08 PM

@RоryMcCune don't you dare ...

I'm amusing myself by watching this with full surround sound and the subwoofer right up

►

@RoryAlsop gotta say when that + oculus come out, it may be tricky to resist buying them and a decent control stick...

@RоryMcCune Yup - I have already budgeted for it

Did you buy the alpha or beta version?

@RoryAlsop I would really go for a game like that if it had real conservation-of-momentum physics instead of the "flying in syrupy air but actually you're in in space" concept that these games always default to.

@tylerl This one does seem to be trying - certainly better than any other I have seen

@RoryAlsop don't think so, IIRC I went for the option that provided a cobra + starting in a safe system or something

5:15 PM

@RоryMcCune Dev kit is still $1500

@RoryAlsop yoinks!

@RoryAlsop After seeing KSP and seeing how you would actually juggle the dynamics, every other space game feels like it has training wheels on.

@tylerl that is true

@RoryAlsop Like, you turn your engine off and then you stop? What does stop even mean in space? Who decides what speed "stopped" is?

Anyway, one more thing for me to put on my to-eventually-build-but-probably-never list.

@tylerl Elite Dangerous appears to work like KSP in that respect. EG a rotation continues until you apply a tangential thrust etc

5:19 PM

@tylerl "Elite II" was probably the only correct space game from that point of view.

CodesInChaos

5:32 PM

@tylerl Problem with that is that you're either mainly limited by fuel, or you can get freaky fast once you accelerate for a while. Might not make fun gameplay in many contexts.

For example I don't think it'd be nice in some kind of space shooter.

@CodesInChaos I'd go the "freaky fast" route. But then you have to eventually match the velocity of your target, which means accelerating for a long time on the other side.

CodesInChaos

Similarly being unable to hear anything outside your own craft isn't that nice either.

So it would require a certain amount of computation be done for you on your HUD -- e.g. time to impact, how long it would take to accelerate to match velocity, etc.

@CodesInChaos It's something that the war pilots from WWII reported. During a bomb raid, everything occurred in freaky silence; all they could hear was their own plane. All the explosions and detonations were without any sound (from their point of view) and it was seriously creeping them out.

@ThomasPornin also, the planes were LOUD.

5:38 PM

Actually, the Elite Dangerous premise on sound is pretty good. You get all the in ship noises, but they also add ambient sounds to give extra information

kiBytes

5:59 PM

just holidays =)

Just wanted to let you know that you haven't got rid of me yet

'Ello Im back

6:44 PM

@tylerl Whoever you are measuring your distance from.

Jeff Ferland

XKCD talks about KSP so that's the topic of the day?

@JeffFerland It's all @Rory's fault

Jeff Ferland

@RoryAlsop I didn't renew mine this year.

@JeffFerland Naw. someone mentioned elite dangerous. so "space games" was the topic.

7:00 PM

5

@LucasKauffman Nice, you should sell a bunch of them

Jeff Ferland

@LucasKauffman WANT NAO

Anonymous

7:16 PM

There should be a fine for putting images in your email signature

Why?

Nothing huge -- just, say, $5 payable to each recipient.

@DavidFreitag Don't tell me you DO that?

@tylerl Nope. Just wondering why.

About 5 pages of attached images on every email.

Shouldn't you be able to hide the list of attachments?

7:22 PM

You shouldn't send attachments unless they're important

Ban all HTML emails, bring back the good old days. I remember when zmail let you have a 16x16 icon... Crazy!

probably 1/3 of my total mailbox storage is taken up by pictures in email signatures

Yes but because of the way images in emails work they get sent as attachments. If email were a bit more intelligent you wouldn't have to worry about it.

FEichinger

If email authors were a bit more intelligent ...

Also, evening folks.

But we don't need images in emails! When vendors insist on sending me html emails they end up getting redirected to dev/null

7:23 PM

@tylerl Really? I don't even have 0.5% of my gmail storage filled.

You get a 5MB email from someone, and it's just the word "OK" followed by a full width logo banner and 3-dozen social media links

@DavidFreitag storage in use, not storage available

@tylerl That is seriously annoying.

@tylerl Ah.

@tylerl you try to find a company that doesn't have a policy that you must include the company logo in all emails, plus a 50-line “disclaimer”

But one image in a signature is OK by me.

@Gilles which is why they should just have to pay a fee for every email they send out.

sure you can put the logo in your footer. That'll be $1 per MB, please.

7:25 PM

Ahhh - now text disclaimers... I have worked for big-4 audit firms... 50 line disclaimer isn't a huge exaggeration.

the storage requirements are nothing compared to all these word and powerpoint documents which keep being exchanged in email

Just delete them

@tylerl Just tack it onto your fee. When they ask what it is during the budget review you can tell them.

:-)

Is there a decent computer chair that anyone here could recommend? Mine is on its last leg.

Preferably with a full-height back and arms. Doesn't have to be anything special.

7:49 PM

@DavidFreitag Get a cat. Then you are the chair.

@ThomasPornin I already have one.

@ThomasPornin a standing human isn't that comfortable

@DavidFreitag The chair i'm using isn't sold anymore :-(

@DavidFreitag but i'd definitely recommend one with a mesh back

@tylerl That's unfortunate. I think my best bet aside from getting a good recommendation is going down to the local Staples and taking the whole store for a test drive.

@DavidFreitag That's where mine came from.

This is probably the closet thing to it:

staples.com/…

8:05 PM

@tylerl Heh they say 400lbs carrying capacity like that's something special

It's got a single 1-star review by someone who didn't want to put it together.