The DMZ

Scott Pack

12:00 AM

Ohai guise! We're looking for a Dynamics/Sharepoint admin in Columbus, OH that can sling some .NET. Tell your friends.

4

ManishEarth

1:41 AM

I just submitted a preliminary self-xss-prevention patch to Firefox bugzilla.mozilla.org/show_bug.cgi?id=994134

(based on Chrome's idea here: code.google.com/p/chromium/issues/detail?id=345205#c18)

Hopefully this gets through

TildalWave

2:06 AM

@ManishEarth Wait, FF isn't event driven? I mean, why discuss on which events to trigger the warning, if it could simply be on before code update?

then you don't have to worry what caused the update, e.g. copy/paste or drag&drop

or anything else

@ManishEarth BTW grats on the bug bounty!

copy

6:12 AM

If you're bored, read the commit messages in freshbsd.org/search?project=openbsd&q=file.name:libssl

Terry Chia

@copy Am I the only one that finds it sad that openbsd is still using fucking cvs?

copy

6:27 AM

Meh, as long as they develop a decent OS and attempt to fix OpenSSL, what do we care?

Terry Chia

@copy See, what happens to OpenBSD after another 5-10 years and the dinosaurs that are still willing to use CVS retire?

copy

6:42 AM

We well use OSes written in JavaScript? Fuck yeah ...

3

AviD

7:01 AM

@TildalWave oh come on, you know exactly what I'm talking about. Besides, I was still trying to be spoiler-free.

AviD

7:34 AM

@ScottPack that this is a surprise to you, is surprising. It shouldn't have been, though.

ManishEarth

8:09 AM

@TildalWave Because you don't want to block people who are typing it from doing it

@TildalWave thanks :)

@copy destroyallsoftware.com/talks/the-birth-and-death-of-javascript

@TildalWave Most of the code is event driven iirc though

If by event driven you mean that there are a lot of custom events being fired here and there

(There's also an observer system for message passing across disjoint bits of code)

deed02392

8:46 AM

guys, can anyone remember the name of that website that you go on and it takes you through a bunch of hacking exercises, starting with basic SQLi and SSI?

I'm trying to put together some links for absolute cyber security novices to start from

I thought it was something like hackmyserver

AviD

there's been q on that... there are quite a few such sites.

webgoat, hackmebank, hackmecasino, google gruyere, DVWA....

ManishEarth

@deed02392 hackthissite?

deed02392

@ManishEarth that's the one

@AviD thanks for those

ManishEarth

@deed02392 ping me with the post when done :)

Rоry McCune

@ScottPack Dynamics... shudder . Looks nice but really complex. Fun fact for you I found an XSS in that one time, had lots of fun trying to explain to the MS support person how to use Burp to re-produce the error..

deed02392

8:55 AM

@ManishEarth those aren't actually gonna be appropriate, this is for absolute novices to programming/cyber security, we're talking school kids. Those links seem to be intermediate programmers+

ManishEarth

@deed02392 not for me :)

Oh, you mean hackthissite?

AviD

@RоryMcCune I happen to think .net dynamics are a really cool language feature.

ohhhh you mean MS Dynamics....

Rоry McCune

@AviD yeppers

AviD

;-)

deed02392

@ManishEarth no the ones @AviD listed

hackthissite is good because it guides you from nothing

and webgoat et al need you to download and install stuff

AviD

8:57 AM

@deed02392 did you look at gruyere?

Rоry McCune

@deed02392 if ya want another railsgoat is v.good

deed02392

@AviD yeah it seemed to require a download and install?

@RоryMcCune thanks, but these kids aren't going to understand what to do with that

Rоry McCune

@deed02392 ah sorry missed the school kids part of the requirement,

AviD

@deed02392 not at all. google-gruyere.appspot.com/part1

I use it for training corporate programmers, so smart schoolkids should have no problem with it.

Adnan

@deed02392 How did your interview go?

Rоry McCune

9:03 AM

anyone interested in setting up windows boxes might find this useful...

trycatchfail.com/blog/post/…

Adnan

@RоryMcCune What the hell?!

AviD

I dont think anyone is ever interested, just something you have to do....

Adnan

This is great!

Rоry McCune

@AviD ok interested in a nice way to save some time and manual effort (pedant ;oP)

AviD

hehe, but yeah that looks pretty cool!

Rоry McCune

9:12 AM

interesting also to note that MS are getting behind this kind of thing officially with one-get

github.com/OneGet/oneget

AviD

so, kinda like nuget for OS and programs?

just without sounding all delicious and chocolatey.

mmm, I love me some chocolate and nuget.

deed02392

@AviD Toblerone.

AviD

@deed02392 that would be a great project name for this. better than "oneget".

they could even spell it "ToblerOne".

deed02392

OneGet is going to be art of Windows?

@RоryMcCune that reinstalls Windows? I can't see where you provide the install source

Rоry McCune

9:40 AM

@deed02392 wel IIRC it's an MS production (downloads hosted on their site)

@deed02392 think it's more for package management on windows

like apt-get

deed02392

Ah ok, I think what's missing from that blog post is he's just formatted and reinstalled windows from fresh

I use ninite to do my installing now, but this looks better

especially those directives that show extensions and hidden files

TildalWave

11:29 AM

@ManishEarth Ah you see that would be improperly defined event model then. "On before update" should not even happen on any keyboard events (key down, up, press,...) but before you commit updates to the document. I know, because I'm used to writing with properly defined event models that even MS first wanted to buy (Delphi) then wanted to copy (.NET) and almost succeeded (C#) :P

@AviD Of course I know :) Spoilers? I think that producers kinda ruined that already with those "all men must die" season 4 posters

deed02392

11:59 AM

@TildalWave @AviD I thought this week's was a bit meh all the way through, too

TildalWave

@deed02392 I liked the ending, it oozes with potential for 4x4

AviD

@TildalWave yeah, it also had a very tasteful "f**k you", as that person tends to do so well.

TildalWave

12:18 PM

@AviD also don't forget about another side story developing with that wife of the alleged king murderer and that murders are getting increasingly gratifying :))

That could easily be misunderstood LOL ... Just so there's not confusion, I am still talking about the Game of Thrones

AviD

@TildalWave hey! spoilers!

TildalWave

@AviD c'mon there's at least 20 married king murderers in GoT by now :P

deed02392

12:33 PM

i love GoT

AviD

pervert

Adnan

12:50 PM

OH MY GOD!!!!

Once again, the UK visa people are being assholes!

Apparently, my fucking payslips (yup, they require my work payslips) need to be in English.

AviD

@Adnan s/visa/ /

@Adnan wait, what?

wtf do they need your frikkin payslips for??

Adnan

@AviD Oh, dude. I've given then my tax cards, a paper from my employer, and a paper from my school

They said it's not enough, we need to see payslips

I sent them. They said they need to be in English

It says on them "xxxxx EUR" as the monthly salary

What more do they need? WHAT WHAT WHAT?!

Should I grow a fucking beard and take my girlfriend in a burka so they give me a fucking visit visa for 13 fucking days?!!!

Rоry McCune

@Adnan :( Disappointing , but I'm not entirely surprised UK authorities seem to be upping the dickishness levels these days

hey perhaps Scotland will go independent soon and then they'll be less dickish (hopefully!)

Iszi

I'm calling "abuse of room owner powers" here...

13 hours ago, by Scott Pack

Ohai guise! We're looking for a Dynamics/Sharepoint admin in Columbus, OH that can sling some .NET. Tell your friends.

Rоry McCune

@Iszi but what's the point in having power if you don't abuse it

:op

AviD

1:06 PM

►

2

Scott Pack

1:28 PM

Ohaiguise

@Iszi I'm with @RоryMcCune. A little abuse just makes for a good time.

@RоryMcCune I'm kind of hoping Scotland goes independent. Since you'll get cut off from the Pound, and it'll take several years before you can even apply to start using the Euro, I imagine traveling to Scotland will get pretty dang cheap for a time.

ManishEarth

@TildalWave I don't quite get you

the thing is, here we want to treat pasted code differently from typed code

TildalWave

1:44 PM

@ManishEarth Yeah, good point, I didn't think of that

ManishEarth

And possibly drag dropped code

TildalWave

these young people, so smart, such wow

ManishEarth

incompleteness.me/blog/2014/04/24/combatting-self-xss-part-2

> I’d like to frame Self-XSS in terms of a human script execution engine. It’s an interpreter - and probably not JITed, but it works with a broad and poorly specified grammar. Not all humans have the same interpreter, but there’s enough of a dominant language to provide a mono-culture which makes attack easy.

lol

@TildalWave ?

TildalWave

@ManishEarth Smart thinking, I'm impressed (and old)

ManishEarth

ah :p

TildalWave

1:50 PM

I didn't use the doge speak correctly?

ManishEarth

you used it properly, I just didn't know you were talking about me :p

Rоry McCune

@ScottPack LOL, well I'd expect they'll keep the pound (currancy union or no) till going into the Euro, despite how much the SNP think we'd be able to keep the pound forever..

Scott Pack

2:09 PM

@RоryMcCune Damn. I was looking forward to you guys going into a partial economy tank for a while.

Rоry McCune

@ScottPack this is a cheap whisky thing isn't it? well could still happen, unless the Bank of England agrees to provide cover for scottish debt, I'd wager that speculators will make it rough for scotland for a while...

Scott Pack

2:25 PM

@RоryMcCune No, travel primarily. Whiskey is too long a game for a 3 year slump to cause an issue.

deed02392

@ScottPack Cheap, but safe, for Englanders?

Scott Pack

If the Scottish economy tanked it would be cheaper for us to travel there so it might happen.

deed02392

probably not

AviD

that would be a good name for a movie - "Whisky - the Long Game"

Scott Pack

@deed02392 Who care about the limeys?

deed02392

2:27 PM

Well, the limeys, for a start

Scott Pack

meh

The last time I went to Scotland I found people liked me well enough. Just so long as I made sure to bring up, "I didn't vote for Bush." and not make a fuckup akin to "The English Empire" I was golden.

Scott Pack

2:48 PM

@RоryMcCune I'm guessing you submitted OWASP AppSec EU?

deed02392

@ScottPack I work in England for a company with HQ in Scotland. There is a definite North-South divide evident in all sorts of areas of the business.

Personal experience though, Welsh hated me more

AviD

@deed02392 that doesnt mean much, Welsh hate everybody.

2

@ScottPack naw, twas I.

Rоry McCune

@ScottPack for talks? I'm on the programme committee, so nope (although the missus did put a talk in..

AviD

almost had a mixup, based on not looking at any other calendar.... so I rectified it.

@RоryMcCune he meant for his happenstance calendar.

Rоry McCune

@AviD yeah I got that once your comment appeared :)

AviD

3:01 PM

@RоryMcCune I really wanted to, also - but if they dont cover travel its a nogo.

Scott Pack

@AviD It had to be one of you two. :)

AviD

3:21 PM

whaaaat, you think noone else likes OWASP....?

Rоry McCune

3:37 PM

OWASP... OWASP... OWASP... OWASP...

AviD

@RоryMcCune @ScottPack and some people really like it. I mean "really".

Jeez, just get a room, you two.

Rоry McCune

@AviD where else can you get such quality InfoSec Theatre for free

AviD

@RоryMcCune if your owasp amounts to just Theatre, they're doing it wrong.

Rоry McCune

@AviD do you not follow the leaders/board mailing lists...

locally we're remarkably drama free

AviD

@RоryMcCune lord, no. I get enough of that stuff from GoT.

'course, if the OWASP leaders list started featuring as much nudity, I might be inclined to follow along more.

what is it this time? Someone doesnt like using random encryption keys?

Rоry McCune

3:47 PM

@AviD ... really I don't want to imagine most of the OWASP leaders in that kind of way...

In fact my face is stuck in a grimace now

AviD

hahaha, nooooo I meant featuring the GoT nudity....

Xander

@AviD No, last I saw, someone's brought up the uncomfortable fact that several of the flagship projects are crap quality and virtually unmaintained, and that it's seemingly impossible for the good incubator projects to get flagship status.

AviD

@Xander well, that's not untrue.

and to be completely fair, also not without reason.

Xander

@AviD Hence why I called it an "uncomfortable fact." :-)

AviD

many of the new ones are just as crap, if not moreso.

not to mention how little resources actually work on the good flagships...

Lucas Kauffman

3:53 PM

who is cristian dobre?

> Hello Lucas,

I’m a security consultant and contributor on Security StackExchange. I'd like to extend my network by connecting with experienced infosec professionals. I would appreciate connecting with me. If you don’t see any benefits in this, you can ignore this message.

Thank you.

Cristian Dobre, Romania

4.4k 1 8 33

this guy apparantly

AviD

@LucasKauffman he's making the rounds, apparenlty

cmon, you know him - you've upvoted a lot of his posts....

Scott Pack

So do OWASP presentations have as much blood and boobies as GoT?

2

Rоry McCune

4:29 PM

what the actual smeg synack.com just raised $7.5m in series A funding...

Scott Pack

> The only human-powered cyber security solution
offering scalable continuous testing for your applications and infrastructure
on an enterprise-grade platform. Let’s redefine security testing together.

DRINK

Rоry McCune

yeah and their meta description "Synack is a platform that connects the global white hat hacker community and security minded organizations. Synack makes vulnerability testing more effective and mimics real-world adversarial environments by crowdsourcing to an expert community of security researchers around the world. Synack's platform formalizes successful vulnerability disclosure programs in place by some of the world's largest tech corporations."

and actually they'd already raised $1.5m so that's $9m all in!

Scott Pack

What did I just read?

Rоry McCune

something worth $9m!

'cause that's the kind of level of detail they have on their site...

Thomas Pornin

@RоryMcCune Logo : check. Web site : check.

They certainly understood how security works these days.

Rоry McCune

4:41 PM

@ThomasPornin founders are ex-NSA : check

FEichinger

@RоryMcCune "We let a bunch of people loose on your system and call it a day."

Rоry McCune

@FEichinger including from overseas, 'cause doing good background checking on people from other countries is super easy! "And the company is now finding a large talent pool coming from emerging markets, according to Kaplan"

Xander

5:38 PM

@RоryMcCune I'm sure it'll be fine, because they're contracting with pen-testers who are recommended by their existing pen-testers, and that never ends badly.

Simon

5:58 PM

@ScottPack Definitely gonna apply, just think about how we could be best friends IRL, that'd be amazing.

4

Scott Pack

@Simon Do you're an experienced Dynamics admin with .NET experience, eh? Awesome.

Simon

@ScottPack Everything's possible when you are motivated by love and passion.

AviD

6:35 PM

@ScottPack umm, didnt April 1st pass a few weeks ago?

@RоryMcCune Did Gibson write that?

Stack Exchange

7:02 PM

Blog - Stack Exchange: Podcast #57 – We Just Saw This On Florp

Abby T. Miller on April 24, 2014

Welcome to Stack Exchange Podcast #57, recorded Friday April 11, 2014 with your hosts Jay Hanlon, David Fullerton, and Joel Spolsky. Today’s podcast is brought to you by the Heartbleed bug.

We have lots to talk about (which makes Joel scared), starting with Community Milestones (after we discuss 2048 strategy, that is)!

Expats is newly in public beta. It’s a site for people that are dealing with the bureaucratic messes involved in living outside your home country. Check out their top-voted questions. Can I lose my US citizenship for accepting employment within a foreign government? …

AviD

7:20 PM

@StackExchange oh hey! we're the community of the week!

too bad noone told us, we would have cleaned up a bit, maybe put on some make-up....

Anonymous

Anonymous

the triple handshake attack has a logo now too

AviD

> brought to you by Hearbleed – the first buffer overflow bug with a website, a logo, and a marketing department.

TildalWave

7:52 PM

@PatoSáinz and it would go well with the Gibson's color scheme too

Anonymous

lol

TildalWave

8:08 PM

Almost the whole front page of Information Security Meta is filled with posts edited by the community because of MSO to MSE links fix, can that not be fixed so the "community" edits are silent?

Gilles

@TildalWave it was a bug, but by the time they realized it was too late

4

A: Last-activity link from main is wrong for Community edits

There was a bug in the codepath that prevented bumps - when answers were edited the setting to not bump got ignored (questions did not get bumped). The codepath has been fixed and deployed since, but unbumping is not simple to do.

TildalWave

@Gilles Well there's revision history so I think it wouldn't be much more difficult than writing a query and run it, no?

Gilles

@TildalWave I guess that the bumping is computed from the revision history

and changing existing revisions would be too invasive

for example, the bot did a first round where it produced invalid output. You woudn't want to have overwritten the database at that point.

TildalWave

@Gilles OK I guess it's not too bad here, it'll eventually clear up, but are there SE sites that had loads of this?

Gilles

@TildalWave yes

TildalWave

8:15 PM

@Gilles shit!

I added pagesize=50 to your URL, it's not so impressive with default 15 per page

Gilles

@TildalWave oh, I have 50 by default

English Language Learners even got a handful on the main site

TildalWave

we only had one on space meta and I think it didn't even bump it

Iszi

9:01 PM

Reasons why to follow @IceManProps because he makes cool things like these props. http://t.co/oaSpABRRrh

Tweeted by WindoftheStars on April 24, 2014 at 8:37 PM

Someone help me out here. I think I need my eyes checked. I don't see any props.

Anonymous

9:39 PM

wat

ManishEarth

9:52 PM

@RоryMcCune You might want to join in, this user seems to have a major issue with the autocomplete changes : bugzilla.mozilla.org/show_bug.cgi?id=956906#c61 :)

Anonymous

10:06 PM

@ManishEarth oh, are you a mozilla dev?

CodesInChaos

I thought that PCI stuff only applies to servers/merchants, not clients. While storing CCs in the browser may be dumb, is it really in scope for PCI?

AviD

@Iszi that's really a guy. It just looks like a girl because of the props.

Actually its @Simon.

@CodesInChaos if they are stored in the browser by the payment system, then yes.

well, if its stored by the payment system, its already not compliant. So complying the browsers would be moot.

ManishEarth

11:08 PM

@PatoSáinz As in?

I do not work for the Mozilla Foundation/Corporation, no

But I am a volunteer.

(In Mozilla, the distinction between employee and volunteer is rather blurred, you can go for weeks without knowing that a particular active contributor is in fact a volunteer and not an employee)

Anonymous

11:32 PM

@ManishEarth in which projects?

ManishEarth

Currently? Firefox, Servo, and I once solved a Bugzilla security bug

Anonymous

I know perl and I'd love to help but I wouldn't go for bugzilla (I already checked whatcanidoformozilla.org )

ManishEarth

Currently working on this devtools fix, which I think this room might like :)

@PatoSáinz heh, why not?

I don't know perl :P

Anonymous

@ManishEarth cause nahh

ManishEarth

heh

Firefox is fun. And if you like cool stuff, so is Servo. It's in Rust, though.

Anonymous

11:34 PM

@ManishEarth is there anything else perl?

ManishEarth

(the idea behind it is crazy yet brilliant)

hm

Dunno. Doubt it. Most of the newer webapps (eg kuma, the thing behind MDN) are Django

Anonymous

i think some obscure build scripts but that's obscure and low workload

ManishEarth

yeah

build scripts are mostly python (mach)

Seriously though, try Servo. The project is still starting off, and Rust is awesome.

(youtube.com/watch?v=IvtyihvXdS8)

Anonymous

@ManishEarth I'd learn Rust but when it gets stable and well-well-well-documented

Anonymous

like perl

ManishEarth

11:37 PM

But that's the fun part!

One day they change the default visibility of struct fields to priv! :p

Rust is more or less stable when it comes to learning it, just that some of the small details keep changinge

but yeah, not yet well documented, and still unstable

Anonymous

lol

Anonymous

@ManishEarth also, I only know perl and have hacked some php, so I'd rather first learn say, C, Haskell or Chicken Scheme and then move to Rust

Anonymous

I'd still love to play with rust

ManishEarth

Look at match in Rust. It is teh awesome. (ML-like)

Lucas Kauffman

@CodesInChaos PCI is relevant to merchants, aquirerers and issuers

ManishEarth

11:47 PM

@AviD /cc @LucasKauffman What if it's stored in the browser after a prompt?

Anonymous

Does QT5 also needs you to sell your soul to Trolltech?

Anonymous

@ManishEarth blog.mozilla.org/blog/2014/04/24/mozilla-cto-andreas-gal

Anonymous

so eric's not coming back isn't he?

ManishEarth

eric?

you mean eich?

Nope

he's still involved in some projects though

Lucas Kauffman

@ManishEarth who stores it in the browser, does the person who processes the card also performs the storing

ManishEarth

11:57 PM

@LucasKauffman ?

Lucas Kauffman

if so then he needs to be PCI-DSS compliant, also for the local storage client side

ManishEarth

the browser

Lucas Kauffman

ah you mean the browser stores the credit card data

@ManishEarth that's due dilligence

ManishEarth

What if the browser prompted the user "should I store this password" (when the password field is being used for credit cards)

Lucas Kauffman

@ManishEarth due dilligence applies

ManishEarth

11:58 PM

Will that break compliance?

Lucas Kauffman

the card holder is responsible

ManishEarth

as in?

ah

Lucas Kauffman

but the card holder does not need to be PCI DSS compliant

however if there fraud and it is observed that the user stored it in his browser, the brand may decide that this is breach of due diligence and the card holder will be held responsible for the fraud committed with his card

Transcript for