The DMZ

@AviD Hey, I just needed to remove one letter. You had to do that, then infantilize it, then reference a relatively obscure Internet meme to have it make any sort of sense.

kalina

4:06 PM

my exact location is within 50 miles of the NG7 postcode </operationalFailure>

Ohnana

30 mi/hour winds on thursday. FML

Rory Alsop

@kalina well, if we play the Maze again, you're invited

Ohnana

i already live in the windo corridor of the city

kalina

@RoryAlsop I'll be gone again within a week

Simon

@Ohnana Windo? I like it.

Iszi

4:09 PM

@Simon That should totally be the name of Microsoft's next OS.

Simon

Agreed.

Ohnana

@Simon windy

my fingers are derpy :(

Iszi

@Ohnana No autocowrecked?

Ohnana

@Iszi i'm on a real computer. no.

Simon

@Ohnana Yo man, non-real computers have feelings too.

Iszi

4:11 PM

@Ohnana No spellcheck in the browser?

Ohnana

@Iszi firefox gets weird about the text box on SE. that and I hit enter too quickly because I'm not looking at the text box

Iszi

@Ohnana Translation: Your fingers are derpy and your ass is lazy.

And I've got no clue what you mean about Firefox being weird about SE chat's text box. I never have issues.

Ohnana

@Iszi i never denied that

AviD

@Iszi @Ohnana AND you're using firefox. in 2015.

Iszi

@AviD STFU. Firefox still rocks.

Simon

4:16 PM

@AviD Star'd for accuracy.

Iszi

IE, on the other hand...

AviD

@Iszi no it IS rocks. Like a big back of lumpy rocks.

Ohnana

@AviD just because you remember netscape doesn't mean you have to be so damn sour

AviD

@Ohnana hehe

Netscape: The last time it made sense to be running Firefox.

Simon

I wanted to use Opera as my main browser on my Macbook. Then, I realized I'd have to install Flash.

Ohnana

4:17 PM

firefox comes without flash. i use two browsers: beefy firefox for protection. lax chrome for youtube and pandora

Simon

Dumped that shit and I'm back with Chrome.

Iszi

What else would you suggest? We-want-to-pwn-all-your-data Chrome?

Rory Alsop

@Ohnana Ahhh - netscape

proper tyrranosaurus

Simon

@Iszi As if your data isn't donuted with FF.

Iszi

@Ohnana Better: When flash is installed, Firefox will disallow by default if it's outdated.

Ohnana

4:18 PM

also shout out to simon for publicly shaming my software choices

Simon

wat

Ohnana

@Iszi or I can just use HTML5 instead and not worry

AviD

Google Chrome exposes all your data to Google. Firefox exposes all your data to everyone else.

Iszi

@Simon Pretty sure I've never been prompted to sign in with my Mozilla account so they can track everything.

Simon

@Iszi That integration is very convenient for websites like SE.

Iszi

4:19 PM

@Simon [Insert @AviD's Law here.]

raz

It's 2015 if you haven't accepted that your data is everywhere by now then you can git out.

Tinned_Tuna

I'm thinking of running chrome from a FreeBSD jail...

Iszi

@raz Is that intended to be a pun or just phonetic?

Tinned_Tuna

though I'm not sure what other impacts that would have just yet.

raz

@Iszi Phonetic.

kalina

4:21 PM

Who actually still uses Firefox?

Simon

^lol

AviD

@Iszi Funny. When my Flash is outdated, it decides to crash the system.

Rory Alsop

@kalina @Iszi and @Ohnana

AviD

@kalina inorite??

Ohnana

@RoryAlsop #nofucksgiven

AviD

4:21 PM

I actually do have it installed on my old laptop, I use it sometimes for streaming.

kalina

might as well just say you use IE6, it's less embarrassing

Simon

@AviD I honestly only use it to check if my CSS works fine.

AviD

because, as legend has it, back when firefox was actually relevant they had better streaming technology.

Simon

Or if I need a different browser session.

Rоry McCune

@kalina me :)

kalina

4:22 PM

@Simon ctrl+shift+N

AviD

@Simon so for THAT you use IE.

Rory Alsop

@AviD I have it on a machine somewhere in case I need it. And I have IE on this work machine. I do also have a machine running Netscape...

AviD

you could even add -NORFAMEMERGING if you need more than one.

Simon

@kalina I could absolutely use that, yes, good idea.

Rоry McCune

@AviD or multiple FFox profiles (super handy feature)

kalina

4:22 PM

I'm incredibly disappointed. Do you guys still use Windows 98 as well?

AviD

or, I dunno, use private browsing.

raz

@RoryAlsop Just in case you wanted to downgrade to SSLv2?

kalina

@RоryMcCune multiple Chrome profiles

Rory Alsop

@kalina I have softwin95 on a machine as well - just in case

AviD

@kalina that doesnt give you a different session.

kalina

4:23 PM

fixed that for you

Rоry McCune

@kalina what are my other options. the privacy invading chrome or the backwards IE

Rory Alsop

my leaving to go commute is failing

kalina

@AviD yes it does, it opens an incognito window

Simon

@AviD Ya it does.

AviD

@RoryAlsop Netscape on your iPhone?

@kalina oh sorry, that does give you incognito.

Rory Alsop

4:24 PM

@AviD I...don't...have...an...IPHONE!!!!

Ohnana

oh hey guys after we decide who's right about this, can we debate text editors?

Rory Alsop

lol

kalina

@RоryMcCune if you're worried about Chrome invading your privacy and think that these issues won't occur when using any other browser anyway, then... wow

AviD

@RоryMcCune IE is backwards?

or are you still on IE6?

Rory Alsop

@Ohnana vi

Simon

4:24 PM

@Ohnana Sublime Text 2. Done.

raz

@Ohnana emacs4life

Rory Alsop

obviously

Ohnana

@RoryAlsop aw yis

@Simon also acceptable

kalina

@Ohnana there is no debate, even I know it's vi

Rory Alsop

or UltraEdit

Ohnana

4:24 PM

@raz install notepad pleb

Simon

Should I be ashamed that I use nano on ssh sessions? :(

Rоry McCune

@kalina one example sigh, chrome and IE send any chars you type in the URL bar (even if you delete) them to their respective search providers

Ohnana

@Simon yes gtfo

AviD

78

A: Do we need to logout of webapps?

This is not a trivial, simplistic question. There are several different aspects you need to consider, and several different mechanisms and countermeasures that apply to several different threats in several different scenarios that are affected by several different clients. Let's examine these one...

Simon

fml

Rоry McCune

4:24 PM

fun fact IE does it in the clear

AviD

damn delayed post

Rоry McCune

@AviD IE release cycle is waaay slower than chrome/ffox

AviD

now it looks like I'm whorespamming

@RоryMcCune is it now?

Rоry McCune

@AviD one example caniuse.com/#search=hsts

Ohnana

@Simon i actually used nano when the vi settings are irreparably fubar'd. but then I learned :nocp

AviD

4:25 PM

or do you mean the actual sane numbering?

Rоry McCune

no HSTS on IE11

AviD

as opposed to running up 8 and a half versions when you move a button

kalina

@RоryMcCune I like that Chrome autoguesses what i'm trying to search for, a large portion of the time it's successfully preemptive and saves me time

Rory Alsop

@AviD I'd already upvoted it years ago

Simon

@Ohnana No idea how vi works, I refuse to learn.

kalina

4:26 PM

it would actively annoy me if it didn't do that

Rоry McCune

@kalina sure and the cost is that anything you type (including internal URLs) goes to google

AviD

@RоryMcCune rare example.

Rоry McCune

it's a trade off

AviD

for the most part IE 11 is a lot more standards compliant than the others.

Simon

And also lot less secure than the others.

Ohnana

4:26 PM

@RоryMcCune why the hell would you be using chrome on a sensitive computer

raz

@Ohnana on linux.... unlikely

Ohnana

that's what chromium is for

AviD

@Simon ymean "insecure".

Rоry McCune

@AviD no caniuse.com/#compare=ie%2B11%2Cfirefox%2B35%2Cchrome%2B40

Simon

@AviD BLABLABLA

Rоry McCune

4:27 PM

@Ohnana I wouldn't :)

kalina

@RоryMcCune I don't see this as an issue

Rоry McCune

@AviD depends on how you define standards.. of the signed off ones quite possibly

AviD

@RоryMcCune you know a lot of those are not standards, and are still changing, right?

so IE is more stable. boohoo.

kalina

programmatically, how else would you make a preemptive search work, without a local copy of the search index?

Rоry McCune

@AviD sure doesn't mean they're not in use :)

kalina

4:28 PM

you wouldn't - thus, it's a necessary sacrifice in order for functionality to work

Rоry McCune

@kalina you wouldn't as I said it's a trade-off, usuability costs privacy

AviD

@RоryMcCune ya and IE doesnt support GO in the browser either ;-)

Rоry McCune

@kalina and I choose a browser that has better privacy at the cost of having to type more stuff

kalina

I don't see it as a privacy violation

Rоry McCune

@AviD so you've ditched it for breach or vivaldi right

AviD

4:29 PM

@RоryMcCune I... wut?

kalina

the amount of times I actually use Google's cross device sync'd search history makes the feature completely acceptable

Rоry McCune

@AviD breach.cc vivaldi.com (call yourself a hipster :op)

kalina

the amount of times I get to chat.stackexchange by typing "chat" and nothing else, in any browser, on any of my devices...

Simon

You're a cross device sync'd search history.

2

AviD

@RоryMcCune I really dont :-)

kalina

4:30 PM

@Simon you really really need to stop doing this

Rоry McCune

@kalina sure and gooogle know all about you and if you're fine with that them knowing all about you then it's not a problem :)

AviD

@Simon wow, you really stretched but it worked.

kalina

@RоryMcCune Google don't know "all about me"

Simon

:D

AviD

@RоryMcCune Google.doesn't.care.about.you.

Rоry McCune

4:31 PM

@kalina if you save search history cross browser and log into their services you might be surprised how much they do know about you :)

AviD

neither does Doogle.

kalina

I do get annoyed that every time I log into gmail it asks me for my mobile number

Rоry McCune

@AviD sure and are you sure they won't sell your data to someone who does?

kalina

@RоryMcCune but my Google account belongs to "Kalina McIntyre"

Tinned_Tuna

Google: Don't Be Good.

Rоry McCune

4:32 PM

@AviD googles services are free at point of consumption ergo you are the product not the customer

kalina

and Kalina McIntyre is not a real person

and the person who pretends to be Kalina McIntyre is not a real person

but the person one level up from that is

AviD

@RоryMcCune oh of course.

Rоry McCune

their goal is to get as much information about you as possible to sell to people who will pay them money for that information

Simon

@kalina Sometimes, you make me think that you're a war criminal.

kalina

@Simon just sensible

Lucas Kauffman

4:33 PM

@Adnan great, yesterday had the cuvee delphine, even better

Rоry McCune

now I can't avoid them and their ilk completely, it's incompatible with my job but doesn't mean I have to give them everthing they want :)

AviD

@LucasKauffman flagged as incomprehensible.

just cuz we give @Simon a free pass to be incomprehensible as he wants, doesnt mean we'll do the same for you all the time.

Simon

aw yuh

kalina

why does he get a free pass

that seems a little bit too much like positive discrimination

Rоry McCune

@kalina 'cause you wanted him back in the room so much

kalina

4:35 PM

which, by the way, is still discrimination

Rоry McCune

so now we have to give him a free pass

kalina

@RоryMcCune I regret that

FOREVER

and ever

and ... ever

Lucas Kauffman

@AviD ratebeer.com/beer/struise-cuvee-delphine/94955

Simon

@kalina Let's make this last forever.

That's blink-182.

kalina

who is blink 182?

oh is this the conversation we were having yesterday?

Simon

4:37 PM

Yesterday, love was such an easy game to play.

Rоry McCune

@Simon bit old school for you that

Simon

Blame one of my English teachers.

kalina

@Simon beatles?

Rоry McCune

@Simon congratulate more like, nothing wrong with knowing the classics

Simon

@kalina I think so, yes.

Rоry McCune

4:40 PM

<sigh> yes , it is

Simon

I also know:

GOT A DEVIL HAIRCUT IN MY MIND

kalina

@RоryMcCune ...

Simon

A different English teacher should be blamed for that one.

Rоry McCune

@kalina so you're finally getting started then

kalina

you know what, all these old people are actively ageist against younger people

Rоry McCune

4:42 PM

@kalina what led you to that conclusion

you're only 6 months younger than me anyway!

AviD

@kalina lowered expectations.

Simon

Time to listen to Bitter Sweet Symphony.

Rоry McCune

@Simon I currently have paradise circus on

Simon

Look what you've done, I'm living in the past.

kalina

@RоryMcCune psh, you are seriously mistaken

Simon

4:43 PM

@RоryMcCune dunno

kalina

@Simon I know Bitter Sweet Symphony

Rоry McCune

@kalina I'm not mistaken necessarily I just have no information that's definitive one way or the other

AviD

@RоryMcCune heh, you still on that 42 year old truck driver from Des Moines?

kalina

I also know it samples a Rolling Stones track

that's all I know

Simon

@kalina Ah yes, there was a lawsuit about that IIRC.

Rоry McCune

4:44 PM

@AviD you're right it was 42, so actually I'm 6 months younger than @kalina not the other way around, yay!

Simon

Your age is the answer? Wow.

kalina

@RоryMcCune even with the lack of definitive, you're still mistaken. It's quite obvious to even the least intelligent individual that there is no way I'm as old as you are

isn't that so, @Simon?

Rоry McCune

►

AviD

yes that is so #Simon.

Simon

pls

Rоry McCune

4:45 PM

@kalina or that you have good OpSec

Simon

@RоryMcCune I'll listen to it right after this track.

Rоry McCune

@Simon 'tis good

kalina

@RоryMcCune completely next level opsec

Rоry McCune

@kalina sure.. but that's possible

@kalina there's loads of net warriors who hang out on the Internet pretending to be teenage girls to trap people...

Simon

ew

Rоry McCune

4:46 PM

some of them are doubtless good at it

kalina

I know, just another instance of men making my life difficult

don't think I don't already blame every person with a penis for these troubles

Simon

@RоryMcCune IT NEVER PICKS UP.

I DON'T WANT TO FALL ASLEEP

Rоry McCune

@Simon it's trip-hop

it's not meant to pick up

it's chilled out

Simon

I'll listen to Don't Fear The Reaper instead.

kalina

even chillout needs a crescendo

Rоry McCune

4:47 PM

but then bittersweet symphony doesn't pick up either...

AviD

@kalina now who is reverse-discriminating for @Simon.

Simon

@RоryMcCune Yes, but the violin is beautiful.

kalina

@RоryMcCune sure it does, the percussion kicks in, there is a clear and obvious progression through the track

Rоry McCune

@Simon sure , but I guessed you were on a chilled out note if that's what you were listening to

which is why I suggested paradise circus

Simon

@RоryMcCune Now that chilled apparently :p

Rоry McCune

4:49 PM

@kalina yeah paradise circus has progression too

although I'm not a music person, I just like music

kalina

of course you like music

without music, life sucks

Simon

And without my D, life sucks.

2

Rоry McCune

if you want realllly laid back try Portishead - Glory Box

awesome track

Adnan

@Iszi I actually haven't looked at the transcript, or even scrolled up.

I saw @kaliana and @AviD, so I assumed it's the usual

@LucasKauffman If we meet in Amsterdam this May, we can treat each other to some nice beers.

Rоry McCune

@Adnan Appsec EU?

Adnan

4:55 PM

By the way, who's gonna be in AppSec EU 2015?

Yup

@Tildal Should go since it's closer than the UK

Rоry McCune

@Adnan ooh , we might be there, we've both put talks in.

Adnan

Sweet!!

The Germany people should also be there

Rоry McCune

@Adnan yeah could be cool, may even go if we don't get accepted, but obv. definitely will if we do :)

Adnan

Then half of the DMZ can go together to a cafe in Amsterdam to.. have some coffee.

AviD

@Adnan hey hey now

Simon

4:57 PM

Aw, Amsterdam!

I need to gooooooo!

Adnan

Yeah, about you, @Avi?

Amsterdam in May?

It is 19th, IIRC

Rоry McCune

hey @kalina you're based in Europe you could come along and fulfill your dream of meeting @Adnan :)

Simon

@RоryMcCune 10/10

AviD

@RоryMcCune so did I, but I doubt I'll be able to go.

Adnan

@RоryMcCune You mean my nightmare?

Rоry McCune

4:59 PM

@Adnan well a nightmare is kind of a dream isn't it?

AviD

would need to be home for the weekend, which means I have to fly thurs.nite/friday morning, which means I would miss half the conf anyway :-(

Adnan

I think @Kisu will be there as well

Rоry McCune

@AviD awww you book yourself out too far ahead!

Adnan

So @RоryM and @Marion get to meet her

AviD

@RоryMcCune no, its the holiday schedule :-(

Transcript for