The DMZ

Scott Pack

1:22 AM

@LucasKauffman I'm self-verifying.

Stack Exchange

4:47 AM

Hang on, I've heard this problem. We need to pour water into the duct until the phone floats up and ... wait, phones sink in water. Mercury. We need a vat of mercury to pour down the vent. That will definitely make this situation better and not worse.

AviD

6:13 AM

IBM Informix-4GL

Informix-4GL is a 4GL programming language developed by Informix during the mid-1980s. == Description == It includes embedded SQL, a report writer language, a form language, and a limited set of imperative capabilities (functions, if and while statements, and supports arrays etc.). The language is particularly close to a natural language and is easy to learn and use. It has two versions of compiler which either produce 1) intermediate byte code for an interpreter (known as the rapid development system), or 2) C Programming Language code for compilation with a C compiler into machine-code (which...

'80s style programming.

Terry Chia

7:04 AM

@RoryAlsop inb4 @RoryAlsop.

Ugh, I meant to reply to @AviD.

M'vy

Morning!

AviD

7:36 AM

@TerryChia your face meant to reply to avid.

Barry Carlyon

@TerryChia replying to @AviD is so '80s anyway…

Adi

8:52 AM

Anybody noticing a surge in the amount of random upboats in the last 40-50 days?

Rоry McCune

@Adi it's just you... there must be someone stalking you.. but hey on the upside , free internet points :)

Adi

My last answer was on the 23rd of March

After that, I'm just getting random upboats

The 15th and 16th of April are interesting because there was a Ctrl+Alt+Del question in the supercollider that referenced my answer

Rоry McCune

@Adi nah I've seen nothing like that .. I get the odd upboat but mainly on more general questions that you can see people would wander by

M'vy

hum my rep is 5555 today

interesting

Adi

@M'vy Not anymore

M'vy

9:00 AM

@Adi Yeah I figured you would do this

Rory Alsop

@Adi - I'm the same as @RоryMcCune - general background level of jam, but nothing dramatically changed

M'vy

Especially when I saw a +5 on the only question I ever asked here :P

Adi

@M'vy Honestly, I wanted to downvote, but then I looked at my voting stats

M'vy

@Adi ah ah ah

Adi

M'vy

9:02 AM

wow

Adi

@RoryAlsop Hmm.. are they all coming from small group of users?

M'vy

you serial downvoter :P

Adi

@RoryAlsop Well, I guess the system would tell you.

I'm just very curious

Arperum

@Adi Heh. I can get you a screenshot from someone on Arqade who's stats are even more towards downvoting.

Adi

@Arperum Well, I usually try to behave myself and keep a 1:2 ratio.

I also engage in the shady activity of punishment downvoting.

Arperum

9:07 AM

Adi

When somebody makes a bad review (especially accepting bad edits), I go and find two of their worst answers/questions and downvote them

AviD

@RoryAlsop @Adi same with me.

I do see changes once in a while - like a week after I post an answer, or when one of my canonical answers is referenced somewhere - but for the most part its just jam, and nothing special recently.

Adi

Uuggh.. my curiosity glands and soaring now.

In the last 32 days, I've gotten 500 rep points for things I've posted long long time ago

AviD

@Adi TMI, man, TMI

Adi

I see similar (even higher) numbers with people who have +700 answers

But I barely have 300

Terry Chia

9:23 AM

@Adi, @Arperum Nothing compared to Eric Lippert.

Adi

@TerryChia I wonder which is the only post he upvoted

Terry Chia

I wonder what my stats are. I can't tell on mobile.

Arperum

@TerryChia 1134 up, 546 down.

Terry Chia

Yay!

AviD

@TerryChia in overall ratio, sure, but far exceeds him in total downvotes.

Arperum

9:27 AM

Mine on Arqade are 483 up, 369 down.

Rory Alsop

Looks like I'm heavily biased towards upvotes. 10000 up, 1800 down

Rоry McCune

@RoryAlsop heh, I'm even more that way, 1223 up, 45 down..

@RoryAlsop BTW you going to the "cyber academy" thing next week at napier?

Rory Alsop

Yay - Rories are positive people

I don't know that one. Going to Scot-Secure tomorrow. Mostly because Glenn A is one of the speakers

AviD

@RoryAlsop Fionna Glenn Anne??

Rоry McCune

@RoryAlsop i saw the invite list for this academy thing and it was amusing spotting people I know from pretty much every previous job I've had for the last 15 years

Rory Alsop

9:39 AM

Googling now

Rоry McCune

@RoryAlsop iidi.napier.ac.uk/c/news/newsid/13382278

Rory Alsop

Somehow all news of that passed me by - despite Google showing me articles by ISACA and everyone else. Guess I've been busy

AviD

@RоryMcCune Watch out for that Ramsay fellow. I heard he has a mean streak.

Rory Alsop

I don't see anything about an event though

Rоry McCune

@RoryAlsop it's a lunch thing

Rory Alsop

9:43 AM

And no one sent me an invite so I'm obviously now out of the loop :-(

Rоry McCune

@RoryAlsop you should crash it :)

Rory Alsop

Hehehehehe

Rhino

@AviD You poor poor person

Actually I think you mentioned it earlier...

Rоry McCune

10:18 AM

Betfair Poor Account Security

►

^2015 online gambling site that handles cash... aaaand that's how they do forgotten password

Rhino

@RоryMcCune Sigh

Tinned_Tuna

@RоryMcCune I'm not even mad. That's amazing.

Rhino

It's not the worst thing I've seen though

AviD

@Tinned_Tuna you would be mad if you read the conversation with customer support.

Tinned_Tuna

@AviD there's a conversation with customer support?

Rhino

10:24 AM

@AviD I'm not sure getting mad at customer support for not understanding web security is a constructive approach.

AviD

@Rhino no no, it's worse than that.

@RоryMcCune have that link handy?

see @RоryMcCune and I follow all the same twitter feeds.

Rhino

that's bad

@AviD Ah, they're not trained in identity checking procedures?

AviD

@Rhino they're not trained in customer support procedures.

Rоry McCune

@BetfairHelpdesk Is it right that all one needs to change their password is their username and date of birth?

Tweeted by psawers on April 23, 2015 at 4:37 PM

AviD

and the public nature of social networks.

and honesty.

Rhino

10:26 AM

okay

Rоry McCune

conversations still up... wonder if betfair PR will get involved and "clean it up"

AviD

@RоryMcCune xlnt.

wait, where is the rest of it?

@RоryMcCune looks like they did, the last half is gone

Rhino

aaaahhh

AviD

yknow, where they insult him and get caught lying to his face.

Rоry McCune

@AviD keep scrolling it should come in...

AviD

10:28 AM

@RоryMcCune ah interesting, I wasnt logged in to twitter. so it only shoed me the first batch.

@Rhino fair warning, you will need a stiff drink after reading that.

Rоry McCune

@AviD ahh didn't realise that's how it works...

AviD

@RоryMcCune neither did I. Pretty smart, if you ask me.

@RоryMcCune I especially enjoyed the part where they subtly implied they would send lawyers at him for revealing his birthday to other people.

Rоry McCune

@AviD yeah happy birthday notifications should be banned! outlaw cake!

Rhino

I don't see much insulting in those messages. That said... I've had the T&C response before.

It's basically "fingers in ears la la la we don't want to deal with you please go away"

AviD

there was a part that they claimed he was lying, and another when they implied he was a moron

Rhino

10:38 AM

It's still technically engaging with the help desk. I get this is bad security, but since when has anyone got any technical support from help desk anywhere?

If the help desk staff had any sense they'd refer the matter up the chain quickly. Probably they did and their manager said "hey make the problem go away you're supposed to manage people"

AviD

@Rhino I wouldnt expect an immediate fix or even a direct answer from them. I would expect a "we will check this and get back to you" or at least "we have sent this on to those ~~that understand~~ responsible".

a "you're lying and dont know how to work your email" is just really uncalled for.

Rhino

@AviD Agreed me too, but, there's an onus on talking to these people to say "hey wait, I think I need to talk to your technical staff, can you please put me through"

AviD

@Rhino I think its clear that they didnt.

Rhino

@AviD Agreed, but my point is they're stuck between a rock and a hard place. Their boss just wants the problem to disappear. The customer is being awkward. The help desk agent has zero power to fix this and zero knowledge to really get it.

Adi

Any ideas on how I can further investigate those upboats, guys?

Rhino

10:43 AM

I'm not saying the situation isn't bad and needs fixing from a security point of view and I'm not saying dealing with these people isn't incredibly frustrating

AviD

@Rhino it is possible that the culture there is so putrid that what you're saying is true, but that still wouldnt mean that they are expected to be so rude.

Adi

Hmm.. interesting. So far, 3 of the posts in question had some modifications/comments/answers on the days they received the upboats

Why would that bring more upvote?

Rhino

@AviD No and hopefully they'll fix that. As customer service they should be courteous at all times, even if the customer is oftentimes infuriating and wrong

AviD

@Adi it could give more visiblity, for those that see the page by recent activity.

Adi

I got two upvotes today on this security.stackexchange.com/questions/57748/…

AviD

10:47 AM

@Rhino ... which he was neither, this time

Adi

@AviD More visibility? Is there some section where recently modified posts appear?

Rhino

@AviD Agreed, but you can be right and still an asshole about it

AviD

@Adi yes, the default homepage view.

Adi

@AviD OH MY GOD!!

AviD

@Adi security.stackexchange.com/?tab=active

Adi

10:48 AM

I feel stupid for asking

AviD

heh, not at all. most people change to "newest" pretty quickly.

Adi

@AviD Yes! My bookmarks link leads to "Newest"

I almost never see the other one, and I thought it pretty much has to do with showing posts with recent edits, and that's pretty much it

Rhino

Again, not saying the reporting side is a total asshole, but, it's bordering on being difficult. "So you're saying" could be construed as "are you really that stupid?"

AviD

@Adi even without it, the site remembers your preference and becomes the new default.

@Rhino could be, though I think he was just trying to force the ~~idiot~~ customer support to THINK about what they were saying. And/or catch them in an explicit lie...

Rhino

@AviD perhaps. My point is that delivery is as important as the message.

If you want people to change their minds, starting out with the premise that they're idiots generally isn't a great starting place.

AviD

10:56 AM

@Rhino he didnt need them to change their minds. he needed them to deal with it.

also the guy only started being harsh when the support was flipping him off.

Rhino

11:24 AM

@AviD Mummph. Well I can't talk, I've flipped at people before. But even so, it's still better to try to come to a resolution, right?

AviD

@Rhino yeah, but the CS guy was explicitly not interested.

Acidic Simon

11:38 AM

Shut top ovid.

Rоry McCune

@AcidicSimon hey old simon, what's "trap" music when it's at home?

Acidic Simon

@RоryMcCune When it's at home?

wot

Rоry McCune

@AcidicSimon sorry british idiom. What's trap music?

Acidic Simon

Some new cool style of music that implies a lot of gangsterism.

Rоry McCune

@AcidicSimon so a bit too young for you ... hey we need some young people in this room to help us fogies keep up

Acidic Simon

11:42 AM

QQQQQQ

Journeyman Geek

As long as they stay off my lawn

Rоry McCune

Rhino

@RоryMcCune it's kinda like schrodinger's music: if you've heard of it, it's no longer edgy and cool. The act of listening to it removes its quantum superedginess.

Rоry McCune

@Rhino ahh well it was on my youtube suggested videos, so ipso facto no longer cool

AviD

@Rhino damn when did you become a quantum hipster

Rоry McCune

11:49 AM

@AviD you planning to have a "hipster off" with him?

AviD

heh, yeah right.

Old Man Dr. Evil vs The Neckbeard.

should be fascinating.

;-)

Rhino

@RоryMcCune Avi would win. He owns a Mac. I just can't compete.

AviD

@Rhino nope!

not at all, not even a little.

had to post it back to them, since I didnt own it.

detoxed from that part pretty quickly though

Rhino

Is it because I use Linux and like Haskell? IS IT?

I'll have you know I source my haskell locally and responsibly.

Besides how does a 20 something year old adult become a neckbeard?

@AviD *owned" a Mac.

Same thing

Still 100% more hipster than me.

AviD

@Rhino "used" a Mac.

Rhino

11:52 AM

Although with Informix, I think you're competing pretty strongly in the neckbeard stakes ;)

AviD

@Rhino hahaha OMG you have no idea.

it's like a history lesson.

kinda interesting actually, it used to be state of the art.

I used to hear stories about this kind of thing.

Rhino

@RоryMcCune We will start back to back, walk 20 paces away from each other, turn around and write node.js. Fastest reimplementation of something we already have in javascript wins!

This hipster town aint big enough for the two of us!

@AviD yeah

Rapid application development

wasn't that like a visual basic 4 thing?

Rоry McCune

@AviD yeah I remember their ad campaigns of the late 90's

Rhino

Zomg you can drag and drop ActiveX controls!

Rоry McCune

was a big thing back then

AviD

11:55 AM

@Rhino bloody hell that sounds about right

Rhino

and compile 32-bit applications

AviD

@RоryMcCune like yesterday...?

Rhino

So much wow

All you needed was to distribute the visual basic virtual machine with your app

and man activex controls let you do anything

AviD

@RоryMcCune not found

Rоry McCune

AviD

11:58 AM

heh

@RоryMcCune I am putting in the report the first finding (in bold) that using '80s tech in 2015 is a pretty bad idea.

Rоry McCune

yeah probably not the best idea for a robust system in use today...

AviD

the next 2 findings are specific issues with all 4GL apps.

Rоry McCune

they should re-write in 'Go' hell everyone else seems to be rewriting stuff in Go these days

Rhino

@RоryMcCune Security by obscurity. Literally... it's so obscure nobody knows anything about it

Apart from @Avid who is now an expert and will forever get emails from recruiters looking for 4GL programmers.

AviD

@Rhino oh geez, I have to make sure that doesnt make it to my linkedin. That would totally happen.

Rhino

12:01 PM

@AviD Yeah. I once said PHP on one CV once. I still get emails about it.

Rоry McCune

@AviD yeah it would be bad if people started endorsing you for that

AviD

@RоryMcCune ....

Rоry McCune

hey @LucasKauffman I was just saying how bad it would be if people who were linked in to Avi started going on linkedin and endorsing him for "Informix 4GL"

Lucas Kauffman

@RоryMcCune That would be ... evil laughter

even I am not that evil

not when my colleagues pranked me once by endorsing me for ETL, SalesForce and internal audit :(

AviD

HOLLY CRAAAAP

@RоryMcCune I KEEEEEEEL YOOOOUUUUU

Rоry McCune

12:06 PM

@AviD LOL

had to be done :)

Lucas Kauffman

my mommy told me not to lie

AviD

:21365386 oh damn, its hopeless

Lucas Kauffman

we just had a client who wants to DDoS testing

I've explained them what that actually entails

AviD

oh cool! didnt know you could remove endorsements.

whew

Lucas Kauffman

and they still want to do it to see how they cope,... on production

Rоry McCune

12:08 PM

@AviD that's no fun!

Lucas Kauffman

@AviD I think we endorsed RoryA for Human Resources once

Rоry McCune

@LucasKauffman quick spin up some AWS instances :)

AviD

@LucasKauffman actually a very good idea - before it is open to the public.

Acidic Simon

@LucasKauffman Sounds fun :)

Lucas Kauffman

@AviD "before" --> good one.

Acidic Simon

12:09 PM

But yeah, do you have an infrastructure capable of DDoSing?

Lucas Kauffman

@AcidicSimon AWS, Rackspace

AviD

@RоryMcCune @LucasKauffman to do it right, you need to have not just AWS, you should also use Azure, maybe linode, etc. Spread it out from different regions.

Acidic Simon

@LucasKauffman How many machines?

Rоry McCune

@AviD yeah that would be the best, but you can still get regional spread with just AWS by using all their various regions

AviD

@LucasKauffman you skipped azure. Troy Hunt will be upset with you.

@RоryMcCune wouldnt they still have a similar range of IPs?

Rоry McCune

12:10 PM

@LucasKauffman github.com/newsapps/beeswithmachineguns Bees With Machine Guns is what you need

@AviD hmm not sure, they would obv. be Amazon ranges, but I'd have thought different netblock/ASs

Lucas Kauffman

@RоryMcCune excellent

Rоry McCune

@LucasKauffman I've not actually used it (looked into it when some customers thought they might want DoS testing) but it's been around for a while, so will likely work...

@RоryMcCune You can turn off endorsements :)

Permanently... as in nobody can endorse you for anything

Acidic Simon

First world problem: "someone endorsed me on linkedin!"

raz

12:30 PM

@AcidicSimon I don't do Linked In

And look you figured out how to change your name

Acidic Simon

@raz Yeah I made an account a few months ago and still didn't add a picture.

@raz :D, it was a matter of syncing.

AviD

@AcidicSimon your momma is a matter of syncing.

raz

So you had 2 different accounts?

Acidic Simon

@raz Your chat's name syncs with your main account but something like once every hour.

raz

Right, but what does that have to do with creating an account and not adding a picture?

Acidic Simon

12:36 PM

@raz OH, I was talking about linkedin.

Then, I was referring to my SE name.

raz

Ohhhhhh gotcha

M'vy

12:55 PM

> Star Wars is essentially a movie about data breach response -- one that failed rather miserably.
https://www.linkedin.com/pulse/empire-star-wars-had-big-data-daniel-solove?trk=hp-feed-article-title

AviD

heh nice

but then I guess also about risk management, threat intel, vulnerability analysis, etc...

> "The Empire does not consider a small, one-man fighter to be a threat. ... We should be able to penetrate their defenses quite easily."

M'vy

@AviD yeah, clearly the risk analysis for the first death star was a failure

AviD

@M'vy 2nd one was worse - they didnt learn from previous mistakes?? no retrospective? And the worst part - they specifically intended on baiting the rebels, doncha think it would make sense to ensure that the honeypot you're using isnt actually the production database?

M'vy

@AviD ah ah . True

AviD

damn that right there would make a fantastic blog post.

M'vy

1:04 PM

@AviD ^^

AviD

"Target, Sony, Death Star - Big Breaches and Security Failures"

ok now I'm just avoiding that 4GL mess.

my forehead is getting sore from all the vigorous facepalming.

OH CRAP! @Rhino I just found the biggest WTF in that 4GL language.... Arrays are all 1-based.

Acidic Simon

This week in The DMZ, the on-topic technology to mock is: 4GL.

Tune in next week to find out if node.js will make a comeback.

raz

4GL?

Couldn't they just make it 5G

AviD

heh @Simon you crack me up.

@Simon you are still @Simon. You will ALWAYS be @Simon.

@AcidicSimon dont make me have to type in the whole "@Simon" each time. change it back!

or I could just modchange it for you...

hmm, then you wouldnt be just @simon....

Acidic Simon

You can change my display name on InfoSec.SE?

That would make sense, in case someone has an abusive name.

AviD

1:17 PM

@raz they couldnt count that high back in the '80s.

oh thank goodness. 4GL supports GOTO.

Acidic Simon

ANSWER MY QUESTION YOU 4GL DONUT

raz

1:33 PM

ahahahaha

4GL's wiki page

"This article may be confusing or unclear to readers. (December 2012)"

@AviD And goto has it's place in programming, at the beginning of a function for parameter checks and skip right to cleanup.

AviD

@raz thats the wrong page, you need this one: en.wikipedia.org/wiki/IBM_Informix-4GL

raz

Still confusing to readers

Thomas Pornin

@raz "goto" is a powerful tool; in many cases, more constrained versions (break, continue, return, throw...) are easier to use, but sometimes a goto is the cleanest method.

Especially in plain C.

raz

@ThomasPornin I agree. It just gets complicated if you're not careful and don't free resources correctly because you jump around too much.

AviD

1:54 PM

@ThomasPornin those are not just "constrained versions" of goto - those are relative jumps, whereas the classic goto is absolute.

and, to my mind, that makes all the difference.

'course I would not argue the point that sometimes in plain C it is cleanest....

Acidic Simon

You're the cleanest.

Transcript for