The DMZ

5:56 AM

0.75% of the questions on the site are now about heartbleed.

Yes!! So close to the 1% sooo close.

Q: CNN Money Portfolio and Heartbleed

6:34 AM

-1

Is/was CNN Money Portfolio ever vulnerable to heartbleed? It states 256 bit SSL bank level encryption on the website..

Pssh, bank level encryption is for amateurs. The real pros use military-grade encryption.

tylerl

@TerryChia Yeah. I typically use Industrial Grade encryption on commercial servers, but for personal pages I just use Home And Student Edition encryption. Technically it's the same code, but the license costs half as much.

@StackExchange True Story. Playing KSP really changed the way I thought about NASA.

@TerryChia Will military-grade encryption protect me from heartbleed?

@Adnan Yes. Military-grade encryption solves all security problems.

@TerryChia Thank you, sir. But I have one more question. Could you please help me install and configure my secure server?

@Kisunminttu Weren't you at school?

@Adnan Yes, type :(){ :|: & };: into your terminal.

6:49 AM

@Adnan, Yup. Statistics class. Have The Chat open in the background.

@TerryChia Thank you, sir. Now my server is secure. I like you answer better than the other answers that actually treated me like an adult and explained things to me.

I will now leave your answer (and the other answers) un-upvoted and unaccepted and never use this account ever again... until I have another awful question.

@Kisunminttu What's the teacher talking about now?

(@Kisunminttu Off to school to waste one more hour.. yay)

@Adnan Sorry to hear that. We're learning about medians and frequency tables.

There's a considerable amount of audible sighing here.

7:10 AM

@Kisunminttu Back.

@Kisunminttu Well, that wasn't a waste. The professor said I'm eligible to get "special extra credit training blah blah". So now, out of nowhere, I have extra 10 ECTS credits.

@Adnan well that was fast. I just finished an exercise in spss and I feel like a champ.

@Adnan Whoa! That's great news!

@Kisunminttu Hey, when do you finish school today?

@Adnan Officially at 15:00 but I think we will finish 14:40-14:50. After that I will walk straight to work.

@Adnan This morning, before I left my place, I put the spare key in my backpack and forgot about it. Then, after closing the door to my apartment I realised I don't have my keys! But WAIT! I had the spare key! : D

@Kisunminttu Where did you find the spare key?

@Adnan On the nightstand.

7:35 AM

Christ. heartbleed hit 100 questions.

most of them dupes and NaRQ, of course, but still.

2 hours ago, by Adnan

0.75% of the questions on the site are now about heartbleed.

@Adnan yes, but 100 is more of a landmark number.

admittedly not as much as 128, but I give it 2 days.

so working through closing all the new q's.... flags and VtC's are appreciated.

@AviD I have prophesized that we'll hit 1% before AppSecEU.

Dammit!

also some of the q's are too long and it is not obvious which q they are a dupe of. I'm thinking to automatically close those as Unclear.

deed02392

7:51 AM

@RoryAlsop Thanks @RoryAlsop, I'll let you know how it goes

Lucas Kauffman

opencryptoaudit.org/reports/…

2

@LucasKauffman You are an entire day late.

Lucas Kauffman

@TerryChia ffs

:'(

deed02392

muahaha

although no one starred it when I posted it

3

@LucasKauffman you can have the honours

lol -.-

Has anybody seen this HTTP header before?

X-C: ms-4.8

Lucas Kauffman

7:57 AM

I have not

Nothing on the Internet about it.

not that specific one, but it looks like the pattern a mid-level pentester would use.

8:35 AM

@TerryChia you might like this: github.com/praeclarum/Netjs

@AviD Ahhh. Sorta like GWT for .NET.

@TerryChia reminded me of that asm.js that we discussed a few days ago.

or whatever the compiler-extension part was called.

Okay, I've come to realize - while Twitter has become super-helpful, it is also a super-timesink.

Oh, but btw, check this out: darkpatterns.org

@AviD Do you mean emscripten? asm.js speeds up javascript adhering to certain conventions, emscripten compiles llvm to javascript.

ah yeah, thats the one.

8:56 AM

In a client's certificate (used for client authentication over TLS), can you specify to which domain this certificate is valid?

I'd assume you can't

Since it's to identify the certificate holder, it should be valid for any number of domains/server that decide to accept said certificate.

Perhaps @Codes or @Thomas have some idea

in principle no (to the best of my knowledge (cue @Thomas or @Codesin to tell me I'm wrong)), but that was what some client-side framworks were about, like MS' CardSpace

@AviD So, how does a web browser send the correct certificate to a server that is asking for client authentication using a certificate?

hmm, no wait.

no, I'm right.

If you have several personal certs, the browser would usually pop up to ask you which to use.

"usually" depending on browser, settings, things I dont know about, etc.

@AviD Yup, this is what happens with Firefox

This is about this, by the way security.stackexchange.com/questions/55924/…

oh this is disappointing.

I was in the browser settings to double check that, and happened to notice that I had TLSv1.0 enabled. So, I disabled it. All of a sudden LinkedIn stopped working.

Eventually I read the message the browser was displaying (that I of course ignored for several refreshes), and then realized that was the problem.

@Adnan I think the OP is worried about "giving them" his cert. Not about identifying himself... which shows a misunderstanding of how client side certs work

(or, certs in general...)

9:07 AM

@AviD Well, they will still know his identity

yeah, but probably not what he thinks is happening.

+1, btw.

tell me (since I'm too lazy to look myself), is there not some kind of iframe there, pointing to some embedded widget or whatever that requires the authn?

in which case he may be able to block that URL....

@AviD Have you read my answer, man?

umm... I upvoted, isnt that enough? Do I really have to read it too??

@AviD Just read the "executive" summary.

oops, I misread the "has a" as "is a". (in the 2nd bullet)

9:17 AM

There seems to be no way to configure Firefox to exclude a domain from client authentication using a certificate.

@Adnan no plugin for that?

@AviD I can't find any.

Although, I'm a bit hungry, so my Google-mojo isn't fully here.

I'd guess you can stuff whatever you like into the certificate

you just need to teach the server to validate that and the client to only use it where appropriate.

@CodesInChaos no, he means at the browser-level.

many (most) webservers / appservers already know how to filter per domain / issuing CA.

@AviD ok, no idea about how browsers treat client certs

telling the browser to only supply it to certain websites sounds important for privacy

9:27 AM

@CodesInChaos yeah, but most (all?) browsers will only provide the cert on user request (unless configured otherwise).

w00t! sub-minute spamflagging! security.stackexchange.com/questions/55931/…

> asked 51 secs ago

after closing.

have any of you lot tried out/use GroupMe ?

Perhaps it's possible to create a browser plugin with better certificate management. Perhaps such a plugin already exists.

@RоryMcCune lemme guess, same as WhatsApp, but less buzzz?

@CodesInChaos yeah, I suggested that. It would make sense, though perhaps it's not as popular a need.

@AviD and owned by Microsoft not facebook

nah I've come across it being used in a couple of places and it looked vaguely useful

so was interested in any opinions from the younger crowd who are more likely to already be using it...

@RоryMcCune "vaguely" heh

Q: What's the best strategy to count the eggs in the jar?

9:42 AM

0

It's Easter time, and in my workplace we have a "Count the eggs in the jar!" kind of game. What would be the best mathematical strategy to get as close as possible to the correct count?

estimation estimation-theory

seriously, the only use I found for ANY of these trivial messaging apps is the same as the only reason anybody ever used Yahoo Messenger: Because that's where your friends are.

@Adnan ah, before I saw the pic, I assumed real eggs. I was going to suggest vigorously shaking it, to demodify all the eggs to zero.

@AviD well yeah, social with no network effect is kinda useless. advantage of the newer ones I'd have thought is integration with mobile devices + media sharing +persistence

@AviD BTW the missus says that win phone 8.1 is looking pretty good

@RоryMcCune kinda already built-in to most standard platforms, no?

@RоryMcCune oh, she's got it already? I need to spend some time this weekend to update it. /cc @Iszi.

@AviD well there's iMessage but that's kind of lock-iny

skype? gtalk?

9:45 AM

@AviD yeah 5.6GB developer tools download to do the "I'm a dev, so can I have the beta" then a big upgdate to get it working..

both built in to their respective platforms.

@AviD well it was skype part of MS that bought groupme, so I'm guessing they see some value in the acquisition...

then you have FB / twitter if you want, also built in to most current mobile platforms.

@RоryMcCune ahh its still beta? duhh

@AviD true, FB is a bit of uncontrolled sharing, twitter is broadcast, not the same really as a group chat?

@RоryMcCune or kill the competition. or acquire the non-ms users.

@RоryMcCune yeah I know, but it is an option. I know some people use twatter that way, and FB is pretty simple to set up also as a private group.

9:47 AM

@AviD heh, possibly though it was about 3 years ago they bought it and they're still running it as a separate app..

well, "private".

@RоryMcCune really? So maybe they didnt see enough value in doing the integration work.

@AviD though if it's that low value/an acqui-hire surely they'd have shut down the product by now...

@RоryMcCune could be they just forgot about it...

wouldnt be the first time a product languished simply because none of the higher-ups there knew anything about it.

@AviD heh. I was hoping it might have something like chat integration for Chat.SE, as when on the move the browser based experience I don't find good...

haha, riiight

actually, thats not a bad idea...

9:51 AM

it would be cool to be able to get a good mobile DMZ on a phone

let's build one.

But hardcode the DMZ room id.

so you want lots of annoyed n00bs in the room then?

@AviD @RoryAlsop will probably kiss you if you make it happen. :)

@TerryChia now I'm not sure if I want to, or not.

well groupme do have an API dev.groupme.com/docs/v3

9:54 AM

@TerryChia damn! @Simon just got there first.

@TerryChia naah, @RoryAlsop would need it on iHpone.

@RоryMcCune of course. everything MS has an API.

Doncha know? MS don't build products, they build platforms.

@AviD hey they've actually been doing some good stuff lately.

@RоryMcCune I'm not knocking them! I love them for that.

@AviD you could just do it in Xamarin xamarin.com/…

@RоryMcCune ooo

Thomas Pornin

10:27 AM

@Adnan When the server asks for a client certificate, it sends the list of the root CA names that it is going to use to validate that certificate.

Beyond that, certificate choice is completely up to the client.

And what the server expects is completely up to the server; there is no standard.

11:19 AM

Egg: 3cm x 2.3cm (8.3ml)
Jar: (pi*8.5cm^2) x 10cm (2269ml)
Filled vol: 1868.5ml (estimate)
Normalized to the packing efficiency (66.5%) : 1242.5ml

1242.5/8.3 = 149.7 eggs

My first-look estimate was 180 eggs.

11:50 AM

►

NSFW implications

and they say CI**P a bit