The DMZ

« first day (1221 days earlier) ← previous day next day → last day (3663 days later) »

Falcon Momot

1:52 AM

@Gilles unless the people writing the malicious kernel made a total cock-up of it...

AJ Henderson

2:25 AM

hmm, I found a good reason not to use SSL on a site

because if I did, it would give away my baby's name too early to attentive parties

since I'd have to add it as an alternate name on my main site's cert

I suppose I could get a second IP for 5 months :/

and yes, I'm enough of a nerd that a requirement of finalizing a baby name was that the website be available

Terry Chia

3:05 AM

@deed02392 It's module-local.... The Ruby behaviour is global.....

2 hours later…

Terry Chia

4:45 AM

Hey @TildalWave, you might be interested in this. news.ycombinator.com/item?id=7613543 ;)

4 hours later…

CodesInChaos

9:08 AM

I switched from Delphi to C# mainly because Delphi didn't support generics at the time.

deed02392

9:19 AM

@TerryChia Oh yes, you did say that

1 hour later…

TildalWave

10:46 AM

@TerryChia yup, most of it is quite true

those compile times are probably the first shocker for the uninitiated

it kinda completely changes your debug cycle since you can afford to do new builds even whenever you feel like

Rоry McCune

11:00 AM

some impressive pace from Oracle there, only 11 days after HB comes out and they get an advisory e-mail out..

TildalWave

hehe

Terry Chia

@RоryMcCune They were probably waiting for the select query for the list of email addresses to finish running.

AviD

11:18 AM

@RоryMcCune still, orders of magnitude faster than their usual handling of security vulnerabilities in their systems.

Rоry McCune

@AviD yeah, perhaps 'cause they can't keep this one quiet via "responsible disclosure" chat :op

AviD

yeah. Or maybe the new CSO is actually having some effect?

Rоry McCune

@AviD Mary Ann Davidson?... hmm not sure there. wasn't she the person that basically tried to blame researchers for the problems..

AviD

@RоryMcCune maybe I'm confused, but wasnt that the attitude that was there before her, and she changed it?

or before her they just ignored researchers, and now they blame them....

well, at least now they have an official CSO. Which, no, they did not actually have a real one before.

Rоry McCune

heh could be wrong I guess. Looking at her blog though I'm betting Checkmarx aren't her biggest fans.... blogs.oracle.com/maryanndavidson/entry/…

AviD

11:25 AM

I would say "any vendor of security testing products"...

Rоry McCune

yeah in general my impression of her rhetoric is "hey we're big professional companies, you can trust us to get security right"

as though their vulnerability history wasn't public or something...

AviD

not to mention list of security patches, or rather lack thereof....

Rоry McCune

@AviD oh and I think they've taken a page out of Ciscos stellar security play book and you can't even get to their support site now if you're not a paying customer...

AviD

they are a good counter-example of what I always say: Security bugs happen. The fact they exist, is not a reason to damn the vendor. How they respond to them (or not respond), is.

Thats what bugs me when people knock MS' security - sure they had more than their share of secbugs, but they respond (usually) remarkably well.

not to mention how they are basically the poster child for an open SDL.

Rоry McCune

@AviD people knocking MS on security these days just strike me as not keeping up to date with current security...

AviD

11:29 AM

@RоryMcCune usually several years out of date.

seriously though, name a product with big competition, that MS' product isn't among the most secure.

browser, webserver, OS, DB, mail....

of course thats not to say its not possible to unsecure it, not to mention likely - it's a lot easier to do so, because well its a lot easier to do most things on windows (when you dont know what youre doing)...

Rоry McCune

@AviD true although I would say that MS are moving more to the enterprise over time. some of their products are dramatically more complex than they used to be (e.g. IIS),

AviD

@RоryMcCune oh absolutely. It has become a monster of functionality and configuration.

That said, for the most part it is pretty damn secure out of the box, and even after reconfig+deployment.

Terry Chia

@AviD Nothing beats Apache for that.

Well, the configuration bit at least.

2 hours later…

Adnan

1:37 PM

Stats from Okcupid.

Now we know the story behind @Lucas and the lama.

I think I'm gonna get a dog

Noah Huppert

Having a bit of trouble figuring this one out. How would you verify a user is who they say they are, when they are using your RESTful api and Google + Login for initial auth, while keeping your API stateless. This is what I have thought up:

http://i.imgur.com/2BmYBlV.png

The issue is, what does the user send to my RESTful api server after my server has gotten its long term tokens.

I'm probably missing something very obvious here

Terry Chia

@NoahHuppert What is this "long term token"? Something that G+ returns?

Noah Huppert

@TerryChia The user initially has a 1 time use kinda token that it can use to sent to the server, the server can then send that to the G+ server to get another token that it can use on behalf of that user when the user is offline, from this

Terry Chia

1:55 PM

@NoahHuppert Hmm, my thought will be to map that token to a randomly generated key and return that to the user. The user will then use the key to HMAC the request body which the server can then use to verify.

But maybe I missed something because I am sleepy.

Noah Huppert

2:10 PM

Alright ill look into that

So every time they make a request they send the randomly generated key along with their userId. Than the server checks its DB for the G+ Auth token associated w/ that randomly generated key and uses that token to request the associated userId from G+, if the provided userId from the user and the G+ userId match up the user is auth.

Noah Huppert

2:30 PM

Would 407(proxy authorization required) work in the case that the client doesn't include randomly generated key
and
401 work if the userId provided and the userId from the G+ tokens does not match?

2 hours later…

tylerl

4:22 PM

@AviD Outlook

ActiveX and email shouldn't mix

The very idea of pushing an unsolicited message that can call any registered dll function on the machine is something that should have been removed decades ago. There's no way to do this safely.

1 hour later…

Lucas Kauffman

5:45 PM

Rоry McCune

@LucasKauffman CFO: We sack them in a "right-sizing" operation and get some cheap new offshore people

</cynic>

Lucas Kauffman

@RоryMcCune exactly and then we have a breach of data

so what do we do now?

Rоry McCune

@LucasKauffman tell everyone we used "best practices" get an audit company in to do a review and sue the ex-employee :)

Lucas Kauffman

@RоryMcCune hahahaha

Rоry McCune

2. ...

3. Profit

Lucas Kauffman

6:06 PM

@RоryMcCune So how are you enjoying your easter ^^?

Rоry McCune

@LucasKauffman yeah absolutely gorgeous weather here (clear cool), had a good walk on Friday and out again tomorrow for another

@LucasKauffman hows about you?

Lucas Kauffman

@RоryMcCune ah nice

@RоryMcCune just doing some OSCP today, gamed yesterday and a colleague is coming over tomorrow for some tea and waterpipe so pretty relaxed actually ^^

Rоry McCune

@LucasKauffman cool. At the moment I'm reading up on docker (www.docker.io)

seems interesting, but some of the security implications make me shudder

Lucas Kauffman

thats always dangerous

Rоry McCune

@LucasKauffman reading yeah tendency to encounter potential stupidity does go up..

Lucas Kauffman

6:17 PM

@RоryMcCune haha

right: forums.openvpn.net/topic13368.html I lolled

2 hours later…