The DMZ

Lucas Kauffman

6:55 AM

►

crazy chinese

David Freitag

@LucasKauffman Wait, they have non-automatic sperm extractors? Ohhh myyyy.

I find it funny that UFC: Knockouts is in the suggested videos for that.

AviD

7:51 AM

@TerryChia heeey I was only drunk on Friday!

Terry Chia

@AviD So... hangover on Saturday?

AviD

okay and a little bit on Saturday morning. Johnny Walker, but someone brought a bottle of Platinum label. MUCH nicer than standard black.

@TerryChia naah not that drunk.

thats another awesome thing I love about my hipster SV startup company - we actually have a company-wide calendar item called "Beer Oclock". Friday afternoon (SV time), beer (or equivalent) mandatory.

@Adnan isnt that what the media is supposed to do?

Terry Chia

@AviD Heh. The place I'm working at has a fridge full of beer. Plus some vodka and whisky but I think that's gone now.

AviD

I dunno, almost all the pictures the media dispersed during the whole palestinian happenings were from different countries, and the rest were from many years ago.

@TerryChia well, it is tricky in a distributed team...

Journeyman Geek

@Kisunminttu I do this a lot ;p

Terry Chia

7:57 AM

@AviD True. So Beer Oclock is any hour of the week. :P

Journeyman Geek

Though its not always think geek, and I occationally manage to get wierd shit I want ;p

AviD

@TerryChia true, but this is everybody together

Terry Chia

@JourneymanGeek Should we ask...?

Journeyman Geek

@TerryChia: My current desktop ... I planned for over a year after I saw this case I wanted ;p

(nothing to do with porn at all ;p)

for once.

Terry Chia

@JourneymanGeek Who said anything about that? You must be feeling guilty about something. :P

Journeyman Geek

8:00 AM

I've been oggling a nicer monitor for ages, but I'm leaving it for when I'm actually gainfully employed, even if I can 3 month plan it.

;p

AviD

@Adnan shame on you. @Kisunminttu is right.

►

Journeyman Geek

@TerryChia: IT WAS MENTIONED!

AviD

11:05 AM

hehe, lovely. This from a researcher's vulnerability disclosure about a certain issue in a certain app:

> Hint: Actually the codebase is full of Ruby on Rails worst practices. You might want to use it as a sample "Hack Me" application.

I think I'm going to start using that in every disclosure, report, advisory, bug report, really anything.

Terry Chia

@AviD Nice. :) But hey, you can take that insult one step further.

AviD

"It almost looks like PHP" ?

Terry Chia

@AviD Well... not that far...

AviD

heh, was gonna say, its more than just one step.

so what did you have in mind?

Terry Chia

More along the lines of "This application contains more worst practices than a sample "Hack Me" application.

Adnan

11:12 AM

@TerryChia Nah, I like the quoted version more

Your version shows an intentional insult

while the other one is nicely covert

Terry Chia

@Adnan How is "full of Ruby on Rails worst practices" covert?

Adnan

Oooh... speaking of reports

Terry Chia

@Adnan Bad news?

Adnan

I'm having a problem. I've been auditing an application, and so far I've only found only two minor issues: Lack of rate-limiting and using SHA1 for the password storage

The rest is absolutely well-written

Last-version libraries for parametrized queries, XSS and CSRF protection included with their framework (Vaadin), they're using some automatic permission and access control management system for Java

I feel very embarrassed writing the report

AviD

dont be.

Adnan

11:18 AM

I have no idea what to do! Should I just present a glamourized 3-4 page report on why they should switch to Bcrypt?

AviD

instead, turn it around, dont base your "worth" on their mistakes - instead report on what they did right.

Adnan

@AviD Hmmm..

Fantastic idea!

AviD

that is, the audit should not be just about fixing mistakes, but also about getting some actual feedback and knowledge as to where their level of security really is.

Adnan

I mean, surely, I cannot really audit against every conceivable aspect.

AviD

no, but before the audit, they (management) dont really have any idea what their security level is. Now, they do.

the fact that that level is good, doesnt change the fact that beforehand they didnt know.

"you cant manage what you dont know", amirite?

Adnan

11:21 AM

I thoroughly checked against some well-known criteria (OWASP's, etc.) and it came out clean.

@AviD Sounds very reasonable

I'm just afraid because I'm kind of a virgin in this area

4

Terry Chia

@Adnan Star whore.

Adnan

This is actually the first time in which an application I'm auditing comes out relatively clean.

AviD

see, the low-end pentesting firms that consist of two kids and their dog can ONLY report on mistakes (because thats all they know), but they still leave management none the wiser as to their actual level of security.

@TerryChia (is he pointing to his backside...? )

@Adnan I know, it is rare.

Terry Chia

@AviD I... don't want to know.

Adnan

@TerryChia I've actually just noticed what I said after I saw the first star

AviD

11:23 AM

but in my experience, those are the ones that are immensely more enjoyable.

first of all, more of a challenge. But also those are the ones you can actually learn something from (and not just as a cautionary tale).

Adnan

Well, I got 24 hours to produce a report on it. I usually poop out 2 pages an hour.

Oh, damn!

I forgot my kilt picture!

Terry Chia

@Adnan Thank god.

AviD

@Adnan to be fair, this is harder report to write, because you have to be more complete and cover all the important issues, and be able to give assurance on those. but I think much more worth it.

I'm sure @RоryMcCune can add more to that...

Adnan

Thanks, @Avi, for the advice. I definitely feel more comfortable now

@TerryChia I'll take it soon. I just need some clear skies

AviD

@Adnan pleeeeeze tell me that is NOT a euphemism.

Terry Chia

11:27 AM

I'm just leaving this here...

AviD

@Adnan sure thing. when I was at $BIG_CONSULTING_FIRM they also would measure the report by its thickness, which could include only problems. it really is a mind opener when you think of it the other way, but not all clients can take it.

@TerryChia hehe. You bastard.

AviD

2:04 PM

oof I missed fruit picking :-(

no no, I meant picking fruit off my tree

no, I meant juicy fruits

actual fruit tree, ya damn perverts

Journeyman Geek

Peaches? Fuzzy peaches?

Terry Chia

@AviD I wasn't even going to say anything.

AviD

pommy fruit

Pomegranate

The pomegranate /ˈpɒmɨɡrænɨt/, botanical name Punica granatum, is a fruit-bearing deciduous shrub or small tree growing between 5 and 8 m (16–26 ft) tall. In the Northern Hemisphere, the fruit is typically in season from September to February, and in the Southern Hemisphere from March to May. Pomegranates are used in cooking, baking, juices, smoothies, and alcoholic beverages, such as martinis and wine. The pomegranate is considered to have originated in the region of Iran to northern India, and has been cultivated since ancient times. It is mentioned in many ancient texts, notably in Babylonian...

superfood of the year.

Journeyman Geek

oh, that's even better.

AviD

yes yes, I know, nobody likes them. Doesnt stop them from being awesome.

Journeyman Geek

2:11 PM

Oh, I like it. Its just a pain to shuck.

2

AviD

@JourneymanGeek yeah, that is true.

Terry Chia

@JourneymanGeek TWSS!

AviD

heh. somebody starred that.

Terry Chia

@AviD Me. Obviously.

AviD

@TerryChia obviously.

actually had a smaller batch this year, only about 2 dozen after the rejects. but, they came off quite huge this year.

should also make the shucking easier, when they are so big.

^ go ahead @TerryChia, I wont hold it against you.

Terry Chia

2:13 PM

@AviD Heh. One is enough.

^ TWSS

AviD

heh

Terry Chia

This is interesting... wiki.postgresql.org/wiki/HTTP_API

TildalWave

4:50 PM

Well this was funny. I substantially edited a question that an edit was suggested for (rejected that, it was only removing a signature), and this happened: security.stackexchange.com/posts/67707/revisions

So Deer Hunter also rejected that edit, and it ended up rejecting my minor update to my previous edit (during the grace period). That in turn created 2 more needless revisions.

TildalWave

5:13 PM

@AviD I like them but why "superfood of the year"?

BTW they're not too difficult to shuck at all, you just find someone else to do it for you. Easy. :)

How I do it is to cut into its skin shallow but all around, then split it in half by hand. Then I use the back of a spoon to press on its skin to force the seeds out and remove the however they're called (rind?) inner membranes

No not rind, that's on the outside ... hmmmm

AviD

7:37 PM

@TildalWave I dunno, I'm not a fruit scientist.

@TildalWave heh, thats my method, but I didnt want to say...

actually if you soak it for a few seconds in a bowl of water it helps a lot, too

Scott Pack

8:41 PM

@AviD Is that a euphemism?

AviD

@ScottPack heh. Fruitanist? Fruitologist? Fruitist?

Lets go with Botanist.

either way, I am none of those.

Did get a nice haul of fruits about half the size of my head, though.

thats one bucket of them.

TildalWave

9:00 PM

@AviD NOT SURE IF THE SIZE OF THE HEAD OR THE FRUIT

shit, caps, sorry about that

AviD

@TildalWave "fruits about half the size of my head"

WHAT IS NOT CLEAR ABOUT THAT

TildalWave

@AviD how big your head is?

AviD

I TAKE IT YOU HAVE A 4 YEAR OLD TOO

@TildalWave I'm talking about my head that holds up my face

TildalWave

@AviD hahaha touché

made you say it tho :)

So has anyone here already tried those new Intel procs and DDR4?

Arperum

@TildalWave Nope, but I've seen some DDR4 thursday, does that count for something?

TildalWave

9:08 PM

@Arperum well it means they actually exist and it wasn't a paper launch

Arperum

@TildalWave I was on an IT meeting thing, and they had some DDR4 on display in one specific boot.

TildalWave

All of it is too expensive for the moment tho, I'll wait while the prices go down. I'd still like to know if in real-life it's worth saving for.

David Freitag

@Arperum Ooooh DDR4.

TildalWave

What I'd usually do is upgrade each tick (or is it each tock, I don't remember which one is the one with more mature parts of the same family ... well, that one). But this one seems interesting enough to perhaps upgrade sooner, budget permitting.

So I'd then switch to upgrading with each new tech. Never done that before so I'm not too sure about it.

Probably not the best idea considering this drags other new pieces of hardware with it and that means it's all heavier on the wallet

Simon

@AviD I DO HAVE MYSELF

TildalWave

9:14 PM

On the other hand, both Intel as well as AMD were kinda on hiatus for quite a while now, so I'm also anxious to fiddle with new toys :)

So my question ... does it go up to 11?

Transcript for