The DMZ

> Submission of proposals by: 31 December, 2014 (11:59pm GMT) Extended to 15 January, 2015 (11:59pm GMT) CLOSED

•Notification of acceptance: 26 January, 2015
•Publication of program: 11 February, 2015
•Conference Date: 21-22 May, 2015

Rоry McCune

@AviD yah I know but twitter.com/AppSecEU/status/560000971439636480

AviD

5:20 PM

ah the CFP page has this update:

> •Notification of acceptance: 10 February, 2015

Rоry McCune

and twitter.com/AppSecEU/status/560000619814342657

@AviD so it could be then

AviD

so what is the diff between call for papers and call for research?

Rоry McCune

@AviD good Q. I've never really got this "appsec research" differentiation,... I think it's for academics

Adnan

@RоryM The tickets are a lot cheaper this year.

Especially the training

Lucas Kauffman

@Adnan I dont make bad money, but I'm not earning 6 digits yet

far from actually

Adnan

5:32 PM

@LucasKauffman Is it even possible to earn 6 digits in our field in Europe?

Oh, you mean brutto not netto, right?

Lucas Kauffman

@Adnan brutto yea

netto not so much unless you manage the field

like a director or a partner

Adnan

Hmm, but even brutto, that would require about 9k a month.

Rоry McCune

@Adnan yeah you need to be pretty senior or a busy freelancer but doable

Adnan

It's quite unheard of around here in this field

Lucas Kauffman

@RоryMcCune as a freelancer 6 digits is easy here

Rоry McCune

5:34 PM

@LucasKauffman sure if you can get booked up..

Lucas Kauffman

@RоryMcCune yea true

Adnan

Man, is Finland so different from the rest of Europe this much?

I cannot really imagine anybody here making 9k euros/month

Unless you're a very brilliant surgeon, or something like that

Lucas Kauffman

@Adnan I think a senior manager here makes a minimum of 4500 a month without any other form of compensation

Rоry McCune

@Adnan my best month as a freelancer was something like 12-15k Sterling IIRC

Adnan

@LucasKauffman Okay, that's reasonable. That kind of number is also here

Rоry McCune

5:37 PM

found a customer who was happy to pay £1k/day :)

Adnan

@Lucas and how much of that is shaved by taxes?

Lucas Kauffman

@Adnan 50%

give or take

Adnan

Duuuuck me!

Lucas Kauffman

but yea then theres your car and monthly allowances and the fact they pay your internet and stuff

Adnan

I always ask you, and I'm always shocked by the number

Lucas Kauffman

5:38 PM

@Adnan net allowances for a senior manager will be around 600 euro

Ohnana

@LucasKauffman what the hell where are you

Lucas Kauffman

@Ohnana Belgium

Ohnana

@LucasKauffman that's a ton of taxes

Adnan

@Ohnana How much do you pay?

I pay around 31% now

Rоry McCune

@Ohnana similar in UK higher rate tax is 40% + National insurance at 10%

Ohnana

5:39 PM

@Adnan 10%-15% at my income bracket

Lucas Kauffman

@Adnan yea it depends, the higher your wage the more you pay in taxes

Ohnana

1% local, 3.5% state

Adnan

@Ohnana Where?

Lucas Kauffman

but I think our partner made like 300k last year, our managing partner made about 1.5 million

Ohnana

@Adnan united states, PA in an undisclosed borough

Simon

5:40 PM

@Ohnana 40% for me I think.

Adnan

@LucasKauffman Yeah, partners. I'd imagine they have a completely different scale

Lucas Kauffman

directors is not bad either

Rоry McCune

@Adnan god yeah

Lucas Kauffman

I think they earn around 6k average

Rоry McCune

@LucasKauffman and then partner is what like 10x that?

Lucas Kauffman

5:41 PM

@RоryMcCune think a starting partner is about 12 -15 k a month

Ohnana

then again I pay for college and healthcare...

Lucas Kauffman

not counting their pensions funds, which our huge

Ohnana

but still 50% is insane

Lucas Kauffman

@Ohnana I dont pay for healthcare and college is about 1000 euro a year for a top 100 university

Rоry McCune

@LucasKauffman IIRC when I was at EY (10+ years ago) average partner income was +£450k

Lucas Kauffman

5:42 PM

@RоryMcCune yea it depends on the region, of course I can only see what's on their annual balances

Adnan

@RоryMcCune Holy shit!

That's insane!

Ohnana

@LucasKauffman my university is 43160 euros a year

roughly

Lucas Kauffman

@RоryMcCune In germany a Manager earns about 70k a year whereas a manager here earns half of that

Adnan

@Ohnana That's close to what I pay as well

Except with a difference of 43160 euros

Sorry, had to be a dick. Education here is free :D

Rоry McCune

@Adnan indeed it is, but remember that to make partner most spent 10+ years slogging their guts out in a really competitive env. and I know of several people I would really rate who (so far anyway) haven't made it that far.... getting partner in the big-4 is a v. high risk/high reward strategy

Lucas Kauffman

5:44 PM

@RоryMcCune managers wage is 3500 euro brutto +- 400 euro as net allowance

@RоryMcCune one of the managers who joined deloitte at manager I earns 4k

Rоry McCune

@LucasKauffman no idea where EY are these days, that sounds around where they were when I was there...

Ohnana

@Adnan :sadwhale:

Adnan

@LucasKauffman What the fuck?! That's really low

Lucas Kauffman

@RоryMcCune yes they still are.

they're has been a lot of criticism about the wage

Adnan

@Lucas Are you sure of that number?

Lucas Kauffman

5:45 PM

and they loose tons of people

@Adnan yea

Ohnana

to be fair my uni is one of the really expensive ones. the good cheap unis didn't accept me

Adnan

@LucasKauffman Jesus! I'm not complaining about my salary anymore

Lucas Kauffman

@Adnan dont forget our benefits in kind though, you need to add cars and phones to that

and petrol

Adnan

@LucasKauffman Yeah, actually you're right. Cars and petrol make a big difference

Plus the allowance

raz

6:06 PM

Mods of SE

Is this an infosec question?

1

Q: Conspicuous changes in the encrypted Truecrypt container

I have a backup of my important data in the cloud with a given size of several gigs. To prevent snooping the data is inside a TrueCrypt container and everything which will be transmitted is the TrueCrypt container (no hidden volume). Because uploading several gigs with even a fast Internet conne...

truecrypt

Adnan

@raz It's about how TrueCrypt works.

Of course, I can see that there are some security implications, but this is mostly answered with ow TrueCrypt works

I'd say it's suitable for Sec.SE

raz

I would think explaining security techniques falls under our jurisdiction.

Especially with his last comment I think it's clear he doesn't quite understand how encryption works.

Adnan

I agree with you

raz

I'm willing to bet that while his files are there, most of them are corrupt.

Simon

I corrupt your mom.

Adnan

6:17 PM

@raz One thing is bothering me, though. Don't think it's odd that, out of all the MB-size file files he has, only 5% were changing at first?

raz

Yeah, I was wondering about that as well

Adnan

I'd imagine he'd always get 100% changes, since he's comparing post-encryption

I wanna know more about what he's doing

raz

@Adnan Well the chances of a random byte being the same as any random byte is roughly 50% right?

Adnan

@raz I don't think I'm following you

raz

If he's just doing a comparison, and the random is evenly distributed. Wouldn't 50% of the data match?

Adnan

6:27 PM

I have a feeling that the answer is no. Here's my thought process:

enc("Adnan is trying to make sense of stuff")->
5E7EF11D8B5495D669DC42A691940FCE373B1E863BB8AA85

raz

alrighty

Simon

@Adnan My new password!

Adnan

Then he splits it

raz

oh I see

Adnan

5E7EF1 1D8B5 495D6 69DC4 2A691 940FC E373 B1E86 3BB8A A85

See where I'm going?

raz

6:30 PM

Yeah only 1 in every 256 bytes can be expected to be the same.

So you'd get close to 100% change in data.

Adnan

I asked him to show us the script

raz

Yeah, I posted an preliminary answer.

I hate statistics, never been good at it.

This schroeder guy is pretty dismissive of questions.

Simon

He's here if you'd like to talk to him.

schroeder

@raz yep

If he did a file compare within the container, are the files corrupt?

raz

That's what I'm thinking

schroeder

6:34 PM

sorry, let me reverse: if they are corrupt, how could he do a file compare?

raz

I don't think it ever worked correctly. And only portions of blocks became corrupted, but not enough to notice.

schroeder

Any way you slice this question, it isn't InfoSec

raz

@schroeder He's comparing ciphertext

So he probably doesn't even realize that what he's doing is wrong.

Because I don't think he understands how encryption works. Which I think falls under InfoSec.

schroeder

@raz via "file compare"? He's able to mount and file compare - that seems to indicate the ability to read the files within the volume.

Adnan

@raz But but.. how do you compare freaking ciphertext in this case?

Isn't it all supposed to be indistinguishable from random?

(again, in this case)

raz

6:37 PM

@schroeder The underlying structure could still be intact enough to mount.

Adnan

@Thomas some insight here, maybe?

raz

@Adnan Exactly, but he doesn't understand how encryption works.

he thinks he can just substitute changed bytes in and out.

At least that's what I gather from his description, without seeing the script.

schroeder

@raz I'm cool with that concept, but that assumes a general misunderstanding. His stated misunderstanding is specifically with TrueCrypt's implementation, which is too specific

We are trying to troubleshoot his script, his TC volume, and his backup.

I'm pretty sure that falls outside our scope

Adnan

For me, I'm just trying to understand what he's doing

raz

True, I just figured we'd explain how encryption works, and maybe he'd realize how to fix the rest himself.

Adnan

6:39 PM

@raz Yes!

raz

Inconceivable!

Now if you'll excuse me I have some idea balls to steal out of a manatee tank.

Adnan

@raz I understood 5% of that

schroeder

Please excuse raz while he plays with a manatee's balls

3

Simon

Me too, what are balls again?

Adnan

@schroeder Okay, that makes more sense

Thomas Pornin

8:16 PM

@Adnan I have not followed at all what you are talking about.

If this is about deduplication on encrypted files (i.e. noticing that two encrypted files are identical), then it suffices to make deterministic encryption.

For instance, use CBC encryption, with an IV computed as a HMAC on the plaintext.

If you use the same keys for CBC and for the HMAC, then you get the same ciphertext for the same plaintext.

Gilles

@raz Yes: it's about working out whether an observation is a security concern

raz

Yeah, the OP seems a bit confused.

AviD

@schroeder @raz ahahaha, okay that is not actually as random and coincidentally hysterical as I originally thought. southpark.cc.com/clips/103666/idea-balls Kudos, well done.

raz

@AviD Haha

One of my favorite episodes.

Ohnana

8:34 PM

pogoplug.com/safeplug are these people for real

someone's gonna haxx0r ur IP! buy our crappy hardware!

AviD

8:48 PM

that should be illegal.

not the product, the marketing.

schroeder

9:06 PM

tee hee "Why does Google show up in foreign languages?"

AviD

@Xander there are altogether too many poop questions on the coffee site.

schroeder

@AviD re: constipation or civets?

AviD

@schroeder yes.

schroeder

lol

AviD

that is TWO questions, which is 2 questions too many when talking about coffee, or any beverage.

unless you're a gastroendocrinologist.

Iszi

9:20 PM

@AviD Really? I figured there'd be more urine questions - e.g.: "why does it always smell like coffee right after I just had some?"

AviD

I just commented on a question about diuretics. So it might be leading there.

TildalWave

@Iszi what kind of coffee are you drinking?

Iszi

@TildalWave Oh, this happens with nearly any coffee-based drink unless it's extremely diluted.

TildalWave

actually, never mind ... I just asked a merican about coffee

Iszi

Aww, still five days in private beta. Can't see all the coffee shit for myself.

AviD

9:22 PM

@Iszi interestingly, only one of the questions was about coffee shits. The other one was about shit coffee.

Iszi

@TildalWave Yeah, it's been awhile since I've had a "real" cup o' Joe.

TildalWave

@Iszi inb4

1 min ago, by TildalWave

@Iszi what kind of coffee are you drinking?

Iszi

@AviD You mean like that wild cat shit variety?

Or is it monkeys? I forget.

AviD

@Iszi yup

Iszi

If it's monkeys, why the hell is it so expensive? Go to the zoo and they'll throw it at you for free.

AviD

9:23 PM

@Iszi weasel cat.

TildalWave

@AviD it's not even shit ... it's thrown up, half digested

AviD

this wont help you:

Iszi

@AviD Well, there goes my joke.

AviD

11

Q: Is Kopi Luwak safe to drink?

Kopi luwak, i.e. Vietnamese weasel coffee, is made from beans that have been consumed and excreted by civets. It can cost as much as $3000/lb, so few have probably tried it. This process doesn't seem incredibly sanitary. Is this coffee safe to drink? Do people contract diseases from drinking ...

health specialty kopiluwak weaselcoffee

ooop!

Iszi

@TildalWave Hairball coffee?

AviD

9:24 PM

@TildalWave nope, its pooped

TildalWave

@AviD According to Wikipedia!

AviD

Kopi Luwak

Kopi luwak (Indonesian pronunciation: [ˈkopi ˈlu.aʔ]), or civet coffee, refers to the seeds of coffee berries once they have been eaten and defecated by the Asian palm civet (Paradoxurus hermaphroditus). The name is also used for marketing brewed coffee made from the beans. Producers of the coffee beans argue that the process may improve coffee through two mechanisms, selection and digestion. Selection occurs if the civets choose to eat coffee berries containing better beans. Digestive mechanisms may improve the flavor profile of the coffee beans that have been eaten. The civet eats the berries...

@TildalWave yes, "defecated".

TildalWave

Jesus, you're not gonna pull Wikipedia as proof, are you?

AviD

heh

curious if its kosher....

Gilles

quite a popular topic!

5

Q: What makes the 'Cat poo' coffee (Kopi Luwak) flavour worth drinking?

I'm actually on the hunt for this coffee in Melbourne, being it's such a coffee-oriented city: Where can I buy a cup of 'cat poo' coffee (Kopi Luwak) in Melbourne?, but while discussing it in the travel.SE chat room, we were wondering what it is that makes it worth drinking? From Wiki and other ...

flavor coffee food-processing

3

Q: Does Indonesian Kopi Luwak coffee have a distinctive taste?

The Indonesian Kopi luwak AKA civet coffee is the world's most expensive coffee at $160 per pound. Are there any testimonials, considering its premium price, that its taste even distinguishable compared to other premium beans?

coffee perception taste

11

Q: Where can I buy a cup of 'cat poo' coffee (Kopi Luwak) in Melbourne?

I'm currently in Melbourne, a coffee-lover's paradise. As such, I'm quite keen to try the infamous 'cat poo' coffee (Kopi Luwak) in Melbourne, given that the skill of a Melbourne barista is likely to surpass mine, and should be able to brew a good cup. To be clear - I don't want to buy the coff...

australia food-and-drink melbourne coffee

AviD

9:27 PM

hahaha

close them all as duplicates.

Gilles

7

Q: Is kopi luwac (civet excreted coffee beans) kosher?

Kopi luwak , or civet coffee, refers to the seeds of coffee berries once they have been eaten and egested by the Asian palm civet http://en.wikipedia.org/wiki/Kopi_Luwak Is it kosher because they are still viewed as coffee beans or is it viewed as the product of a nonkosher animal (akin to a s...

food kashrut-kosher animals bathroom

TildalWave

it only proves that snobs will buy anything if it's got the right price tag

AviD

@Gilles dang son well done!

dammit, so the answer is "we dunno"

TildalWave

@AviD So what would happen if you had some and you later discover it isn't kosher?

that's not necessarily a bad thing tho

schroeder

his mezuzah would melt

TildalWave

9:34 PM

his what?

schroeder

(sorry, comment deleted to remove potential insensitivity ...)

TildalWave

in DMZ?

schroeder

LOL

AviD

@TildalWave I would have to pee it out.

TildalWave

@AviD which is what happens with it anyway

AviD

9:35 PM

exactly

TildalWave

so nothing would happen

AviD

what happens if you eat a turkey sandwich and later discover it belonged to somebody else?

schroeder

crushing guilt

AviD

nothing, at least not directly. You may want to hide from me for a while.

THAT'S MYYYYYYY TURKEY SAAAANDWIIICH

TildalWave

@AviD you apologize and explain that you were hungry

simple

AviD

9:37 PM

►

TildalWave

then you have to pee it out and return to its rightful owner?

AviD

> MYYYY SAANDWICH!!

Rory Alsop

10:36 PM

You can't pee a sandwich

AviD

no, but you can sand your peewich.

2

I'm sorry, that was wrong.

My only excuse is #simon.

schroeder

password managers as a cheap encryption key management system? E.g. LastPass?

AviD

@schroeder VtC as unclear.

schroeder

10:53 PM

it's my own question

TildalWave

hehehe

schroeder

what am I losing by using an encrypted password manager as a key management system?

I can store, expire, restrict access

AviD

@schroeder that doesnt absolve you

@schroeder I can see two POSSIBLE areas:

schroeder

@AviD I get that, but I need to justify to management why we need to spend $10k over another cheaper solution

I'm looking at the extreme end of the spectrum as something like LAstPass

TildalWave

@AviD you can use it 1) where password == key or 2) key == password?

AviD

10:57 PM

1. differing functionality. E.g. split knowledge? dual control? Distribution? etc.
2. Crypto-specific aspects, which would totally be a @ThomasPornin / @CodesInChaos question.

schroeder

hmmm - distribution

TildalWave

@AviD that's one possible area that you can see!

AviD

then there are architectural aspects - e.g. network protocol, application accessiblity, isolation, etc etc

@TildalWave uh, 2? I see an area, doesnt mean its not opaque.

Transcript for