The DMZ

tylerl

4:22 AM

Said nobody ever.

Stack Exchange

5:16 AM

'Oh, hey Mom. No, nothing important, just at work.'

tylerl

5:26 AM

Terry Chia

I have not kept up with .NET, what's the preferred method of writing desktop apps now?

Rоry McCune

6:17 AM

@tylerl well of course,.... it stopped being called metro ages ago :)

Terry Chia

@RоryMcCune Yeah, but Modern UI sounds stupid. :)

Rоry McCune

@TerryChia well yeah. Marion has a T-Shirt with "I call it Metro" on it

Journeyman Geek

Its universal apps now ;p

(Yes, they changed the name again)

Terry Chia

@JourneymanGeek Wait what? That sounds even dumber.

Journeyman Geek

And eh, found an entry level security job listed at NCS

I didn't realise those existed ;p

Rоry McCune

6:22 AM

@TerryChia actually it's really cool, you should be able to write one app and have it work on phones tablets desktops servers and eventually X-Boxen

Terry Chia

@JourneymanGeek That wouldn't be a physical security position by any chance? ;)

Journeyman Geek

(though some aspects of their application form make me weep, but shhh)

@TerryChia: careers.ncs.com.sg/psc/public/EMPLOYEE/HRMS/c/…

Fits what I studied quite well, even if its not as hands on as I'd like ;p

Terry Chia

@JourneymanGeek FWIW, some of the consultants I have spoken to from NCS are really !@#$%^ clueless.

Journeyman Geek

@TerryChia: perfect?

Terry Chia

@RоryMcCune squints

I distrust any promises of write once run everywhere.

Journeyman Geek

6:25 AM

My brother was like "Apply for desktop support, it seems easy"

Which I also did

Rоry McCune

@TerryChia true true, but in theory if anyone can do it, it should be MS for their own kit

Terry Chia

@RоryMcCune The main issue is that UX cannot be the same across all those form factors. Business logic itself is already very easy to get portable.

Journeyman Geek

@TerryChia: Its probably the only thing that could save windows phone, so they're probably doing it right ;p

Also, The UI of many names is probably meant to be phone/tablet first

it sucks on as a desktop UI

Terry Chia

@JourneymanGeek Meh, those type of places don't usually offer a good experience imo. Probably not too bad for a first job but I wouldn't want to stay long.

Journeyman Geek

@TerryChia: essentially yeah, that's what it is.

Terry Chia

6:29 AM

@JourneymanGeek If you want a security related position try the big 4?

Journeyman Geek

@TerryChia: Big 4?

Oh, accounting firms?

Terry Chia

@JourneymanGeek EY, pwc etc.

Journeyman Geek

Yeah, actually that's a good idea

I have no clue how to go about this ;p

Terry Chia

@LucasKauffman can probably point you at someone at EY SG.

Is it just me or is ctrl-A broken in SE chat?

Journeyman Geek

What's ctrl - A supposed to do?

Terry Chia

6:33 AM

Hmm nvm, opening it in a new tab fixed it. Probably some browser stupidity.

Journeyman Geek

ahh

I just tend to tripleclick

Terry Chia

@JourneymanGeek e-cop.net/careers-opportunities.html This company is pretty good for security jobs as well.

Journeyman Geek

I'll take a look.

rofl.

~~GOT~~ A song of ice and fire reference ;p

Terry Chia

@JourneymanGeek Heh. I actually didn't notice that.

Journeyman Geek

@TerryChia: Detail oriented ;p

Also, I have a pretty scary memory for stuff like that.

Lucas Kauffman

8:25 AM

@TerryChia EY Singapore is recruiting I think

not sure though

Terry Chia

@JourneymanGeek ^

Lucas Kauffman

WIGGLE WIGGLE WIGGLE

Rоry McCune

@addelindh @thegrugq 1. All of the cybers 2. The NSA. Also Mossad. And aliens. 3. Certain. 4. I will fire you 5. Must be $0 and zero effort

Tweeted by pwnallthethings on October 24, 2014 at 8:27 AM in reply to addelindh

^seems accurate

Terry Chia

@RоryMcCune Heh.

Rory Alsop

8:46 AM

@Journey - I'd second Big-4 as a really good way to get into security and get wide experience of companies and teams

(Disclosure - worked for 2 of them.)

(Further disclosure - would recommend 1 of those 2...)

Terry Chia

9:11 AM

Are there any browsers besides IE (which I presume uses the Windows CA store) that uses the operating system CA bundles?

I know Mozilla ships their own, I presume Chrome does as well.

Tinned_Tuna

@TerryChia Maxathon?

Terry Chia

@Tinned_Tuna Huh, I didn't even know that existed.

Tinned_Tuna

@TerryChia I don't know for sure, but it shares a lot of IE's internals (eg. Trident for rendering) so it may use OS CA bundles.

Journeyman Geek

9:29 AM

At the risk of sounding blur... EY?

Terry Chia

@JourneymanGeek Ernst and Young.

Journeyman Geek

ahh

Terry Chia

@JourneymanGeek Do you know any convenient places to pick up Kindles in Singapore by any chance?

Journeyman Geek

@TerryChia: I know a few stores in SLS sell em

But yanno, SLS, wretched hive of scum and villany (though not as much as days past) and all that

Terry Chia

@JourneymanGeek Hmm. I'll go have a look someday.

Journeyman Geek

9:33 AM

so... comparison shopping is a great idea.

I'd go there more often if I had a job ;p

Terry Chia

Worst case I'll ship it from Amazon myself but it's annoying.

Journeyman Geek

There's that

Amazon may end up being cheaper tho

Terry Chia

I'm pretty satisfied with my current setup so I don't feel tempted by new hardware. :)

I honestly doubt I'll get a new system for the next 4 years unless something major dies.

Journeyman Geek

lol

I'm a hardware geek primarily

Though, other than my monitor, I'm pretty happy

and my monitor is probably very sensible for what I do with it

Terry Chia

I really want a 8 bay NAS but the disk prices are a killer.

Journeyman Geek

9:36 AM

lol

Rоry McCune

leviathansecurity.com/blog/the-case-of-the-modified-binaries <-- great example of why security and privacy are not the same thing

Journeyman Geek

They are

I think I know someone who works there.

Ahh, yeah, it is

I probably should drag falcon down here at some point ;p

Terry Chia

@RоryMcCune Honestly I'm not sure why people are stupid enough to use Tor without HTTPS...

Journeyman Geek

@TerryChia: cause its magically and will hide you from all the bad people.

Terry Chia

Tor is basically inviting people to MITM you.

Journeyman Geek

9:39 AM

yup

Its a fairly obvious target for that kinda thing

Rоry McCune

@TerryChia yeah I remember years back before the whole snowden thing a guy set up sniffing on his exit node and got all sorts of plain text creds for things like embassys..

Terry Chia

Things people think they understand but they really don't: Tor, Bitcoin, Cloud.

Rоry McCune

@TerryChia appliances as well "hey we don't need to manage the OS for all these servers"

cough shellshock, cough

Terry Chia

@RоryMcCune INTERNET OF THINGS!

Rоry McCune

@TerryChia oh yeah that one too

god that's going to be hideous

Terry Chia

9:44 AM

I can't wait till IoT becomes widespread and the first RCE vulnerability that affects them gets announced.

Try explaining to your grandma why her oven toaster needs patching.

Rоry McCune

when people work out they've deployed huge numbers of linux boxes with no visibility of patch level and no patch capability in a lot of cases

Terry Chia

@RоryMcCune And we in 2014 thought the Android situation was bad. ;)

Rоry McCune

@TerryChia we don't even see the half of the android problem I bet. The number of chinese manufs chucking out AOSP android is huge

Terry Chia

@RоryMcCune Ah well, job security ftw.

Rоry McCune

aliexpress.com/premium/… <-- 100,000 results on aliexpress for "tablet"

Terry Chia

9:48 AM

Android is also big in set top boxes.

Rоry McCune

also some of 'em are frickin' cheap aliexpress.com/item/… <-- $41

Terry Chia

@RоryMcCune Hum, string together 20-30 of those and get a cheap ARM fuzz farm.

Lucas Kauffman

@TerryChia we had that with smart meters at a client once

Rоry McCune

@LucasKauffman were they able to fix it?

Lucas Kauffman

@RоryMcCune fortunately they can flash firmware at a distance

Terry Chia

10:00 AM

@LucasKauffman That... sounds dangerous for a whole different reason...

Lucas Kauffman

@TerryChia they were just used for billing nothing else

but yea questions were asked :p

Terry Chia

@LucasKauffman That can be a nice target as well. ;)

Rоry McCune

@TerryChia @LucasKauffman nah nah it'd would have been with correct strong authentication and configured only to accept cryptographically signed firmware with good key management over the signing key, I'm sure

Lucas Kauffman

@RоryMcCune oh the other day I read a report from a competing company, I'm not sure where they got their info from, but it was about a "plain text password in a web.conf file"

Rоry McCune

@LucasKauffman nice... did you see the plain text passwords in Samsung Knox BTW

Lucas Kauffman

10:05 AM

they're recommendation was to: "Use assymetric cryptography to encode the password like SHA-1 in the config file"

@RоryMcCune no :p

Rоry McCune

@LucasKauffman appleinsider.com/articles/14/10/23/…

Terry Chia

@RоryMcCune Heh nice!

Lucas Kauffman

@RоryMcCune well if you need recovery you don't have an option

Terry Chia

Why do I have a feeling that the researcher waited till the US gov announcement? ;)

Lucas Kauffman

stupid users who want to have a recoverable password

and the encryption key is stored on the device

who needs key derivation algorithms when u got #swag?

2

Terry Chia

10:09 AM

@LucasKauffman You need to get that printed on a t shirt.

Lucas Kauffman

@TerryChia might actually do that

Rоry McCune

@LucasKauffman and then put a picture of @ThomasPornin 's avatar underneath the slogan

Lucas Kauffman

@RоryMcCune hahahahaha

and attribute the quote to him

Terry Chia

@RоryMcCune I'd totally buy one. ;)

Actually, I bet @ThomasPornin has thousands of t shirt worthy quotes in his answers.

Rоry McCune

@TerryChia so you're saying we should have a T-Shirt store populated solely with slogans from Sec.SE users

might be a bit niche

but I'm sure it'd get some sales

Terry Chia

10:20 AM

@RоryMcCune If someone wants to put in the effort to organise it... ;)

Lucas Kauffman

HOLY FUCK

DONT GOOGLE "THOMAS PORNIN BEAR" WITH SAFE SEARCH OFF

7

glad google uses SSL

Terry Chia

@LucasKauffman Hahaha!

Lucas Kauffman

the images

some things can't be unseen

Terry Chia

This is funny: quora.com/…

Adnan

10:43 AM

@TerryChia Very amusing read

Lucas Kauffman

QOTW

:o

raz

12:04 PM

@LucasKauffman Don't worry, Google still knows what you searched for. You should be getting some very interesting ads...

Terry Chia

@raz I don't get ads.

raz

@TerryChia Cool story

Rory Alsop

12:34 PM

@RоryMcCune Well, I am well on the way to a theme song...

Lucas Kauffman

12:47 PM

@RoryAlsop NANANANANANANA RORRYYYYYY NANNANANANANA RORRRYYYY RORYYYYY ROORYYYYY

on the batman tune ofc

Rory Alsop

You've been listening outside the studio door, haven't you?

Anyway it's not a theme song about me. It's about security :-)

TildalWave

1:26 PM

@RoryAlsop I thought you burned the world with one of your previous songs. Now you want security too? :P

Xander

@TildalWave I've just noticed that you've recently passed @Adnan in total reviews across all queues on sec.SE. You're now the second most prolific reviewer of all time on this site.

TildalWave

@Xander Yay! The honors :)

@Xander and congrats on being #1

Xander

@Ha, thanks. :-) You need less than 2000 more reviews to catch me. ;-)

Rory Alsop

Hahahahahahahaha @Xan and @Til - congrats

@TildalWave And heavy weaponry

And alcohol

TildalWave

it's actually a lot of work, we should be compensated in some amusing way by SE

beer vouchers

Rory Alsop

1:28 PM

@TildalWave :-)

TildalWave

1:38 PM

@RoryAlsop That ISS / nitrogen question is close to becoming a rep train ... let's get some more answers ... who's game for some lateral thinking?

Rory Alsop

@TildalWave oooo - I hadn't looked at that since I posted it

@TildalWave I like your point about airflow

have an upvote

TildalWave

@RoryAlsop Yeah you're developing sailor habits on SE aren't you? Wham bam thank you ma'am on hundreds of sites around Stack Exchange :)

Rory Alsop

@TildalWave pffft. I have a routine which works around my work breaks

TildalWave

hmmm beer.se isn't doing that well

Rory Alsop

(and it's only 74 sites)

TildalWave

1:43 PM

LOL @ "only"

Rory Alsop

@TildalWave I have a lack of questions about beer. I mostly work on "do I like the taste"

@TildalWave and only 16 over 2k

TildalWave

I have some posts on 18 sites and only 3 over 2k

space consumes quite a lot of my time tho, modding betas is like having a baby

Xander

@RoryAlsop So does everybody else, apparently. It's down to 0.1 questions per day.

Rory Alsop

@TildalWave I've had weird balance on modding. Sec was high effort in the early days, but rapidly decreased (we got a good sized active core community quickly)

Productivity is hard work

Music is really easy

Sound Design - very challenging

Video - pretty simple

Outdoors - great fun, and low load

Key seems to be that core group of active members. Get that quickly, and get the culture right, and you're laughing.

Sound and Productivity have very small core communities and disparate audiences (Prod has everything from actual productivity to psychological issues!! and Sound came from 2 separate communities with opposite cultures)

Adnan

@Xander :(

TildalWave

1:50 PM

I expect space to get a lot worse before it gets better ... well I hope. We could definitely use more members and activity in general and that means more work with larger number of newbies that need guidance. Judging by activity in our meta we've sailed through the lowest activity period but it's picking up the pace quite slow (as expected)

Rory Alsop

@TildalWave yeah - you've seen the graphs, haven't you

typical beta behaviour from early to mid to pre-graduation

TildalWave

@RoryAlsop @ManishEarth made sure I did :)

Adnan

@Xander Waaait.. are you sure?

raz

@Xander Yeah I love beer, but I dont' go on there at all because there's almost no discussions happening.

Rory Alsop

cool - it helps to not be as worried

Adnan

1:51 PM

I'm still number one in LQP and suggested edits

Rory Alsop

@Adnan Congrats to you too then!

Xander

@Adnan As of this morning, @TildalWave had 5641 reviews, and you had 5525.

Adnan

and higher than @Tildal in Late Answers and Reopen

@Xander Oh, the total

Rory Alsop

@Xander I wonder what folks are trying. I'm guessing looking at what concerns brewers etc on other forums and asking definitive questions over here?

Xander

@Adnan Yeah, he has 600+ more close votes than you do. That's the big diff.

Adnan

1:53 PM

A while ago my close votes activity has almost stopped

Too much responsibility and it's easy to make the wrong call.

Xander

@RoryAlsop Well, one of the issues is that there's already a home brewing site...So that knocks out a lot of brewing questions.

Rory Alsop

@Xander oh, yeah - I'd forgotten about that

raz

@Xander Yeah trying to break into that market kinda rough

Rory Alsop

What has happened with the couple of proposed merges? The (all alcohol) one or the (beer and brewing) one

raz

@RoryAlsop I think merging the beer into the brewing would just annoy the brewers.

Rory Alsop

1:55 PM

@raz heh

raz

@RoryAlsop Know what I mean though?

Xander

@RoryAlsop Dead in the water, as far as I know. I think either of those would potentially work, (and have advocated for both at various points) but there doesn't seem to be any administrative movement in that direction.

raz

@Xander It would essentially just delete the Beer Se

Speaking of beer, I'm gonna be out in Colorado this weekend. I need breweries or pubs! I've been to Boulder, Great Divide, and Oskar Blues already.

Xander

@raz How about New Belgium? Left Hand is in Colorado somewhere, and I think Avery is as well.

raz

@Xander Yeah New Belgium is in Fort Collins. I'll be in the Denver/Aurora area. Fort Collins is about 2 hours away, maybe 90 minutes.

Avery! I forgot about them.

Xander

2:06 PM

@raz Sounds like you've already hit some of the best though.

raz

@Xander Yeah, I want to look up some small breweries that I can't get around here.

I can get Great Divide, Oskar Blues, and Avery

Xander

@raz Ah, gotcha. Those are going to be the ones I'm not familiar with, most likely. :-)

raz

@Xander Further your knowledge!

Track me on untapped... I have a feeling I'll be drinking quite a bit of beer the next 3 days.

Xander

@raz LOL, ok, will do.

Simon

I drank La Fin Du Monde again last night <3

raz

2:10 PM

@Simon Can't go wrong with that one.

There's a small brewery call Realerevival. Big Lizz is their Harvest Ale. And it was quite delicious.

TildalWave

@ThomasPornin Cheers for the answer, that's exactly what I hoped someone will point out.

now let's rep train it :)

10

Q: Why does ISS atmosphere contain nitrogen?

The WP page for the ISS says that it has a fairly earth-like, sea-level atmosphere: 21% oxygen, balance nitrogen at 101.3 kPa. Supposedly it's because a pure-oxygen environment is dangerous as in the Apollo 1 disaster, but in that case "pure-oxygen" meant 1.15 atm of O2. It seems like a pure, 0....

clickety click!

would be cool if even more of sec.se people add an answer :) @LucasKauffman are you up for it?

Simon

2:26 PM

I can answer "Because racecar" if you like.

TildalWave

@Simon or "because beer and donuts"

Simon

@TildalWave Nicely edited.

TildalWave

well drinking beer (even opening it) at 0.2 atmosphere would be a challenge if not impossible

and donuts could spring a leak

Simon

Who would have thought that a such amazing thing could cause that much damage?

raz

@Simon Same could be said about children/babies.

Simon

2:33 PM

@raz They're annoying though.

TildalWave

even more so if you have to live in denial that only a few years back you were exactly the same, ain't that right @Simon? :P

Rory Alsop

@Simon they have upsides though

Simon

2:49 PM

@RoryAlsop They smell.

Rory Alsop

@Simon At first, yes, and then not for a few years, but then again in their teens...

They are essential for the survival of the species though

(well, at least some are)

AJ Henderson

@RoryAlsop more importantly, they are essential for paying my social security

Rory Alsop

@AJHenderson not necessarily - my children may not ever end up in (insert your country here)

:-)

Simon

@RoryAlsop I guess I could raise a kid who would dedicate his life to donuts.

Rоry McCune

when asked why they block pasting passwords

@gep13 The site has been built to industry standards which specifically don’t allow this. Sorry. ^Gal

Tweeted by TNLUK on October 24, 2014 at 1:42 PM in reply to gep13

<sigh>

Rory Alsop

2:55 PM

@RоryMcCune lolwut?

Rоry McCune

@RoryAlsop apparently the lottery site blocks pasting passwords in (by using JAvascript)

breaks password managers

someone calls them on it on twitter and that's their response

pretty much what Vodafone said as well

If I find the UK security consultant that's going around telling people this I willl...... explain in a polite but forceful manner why he is wrong

Simon

Paypal actually does that too, IIRC.

(at least when you're changing your password)

Rory Alsop

@Simon which is incredibly annoying

Simon

@RoryAlsop Absolutely.

Rory Alsop

I understand why they do it (you may have copy'n'pasted from the wrong thing etc) but still

Simon

2:58 PM

It sucks for people who use password managers.

Undo

3:23 PM

@TildalWave SR is kinda like having triplets :/

So I suppose SO must be like running three full daycares, each a mile apart, with no help

TildalWave

3:41 PM

gtg ... time to parteeeee :P

Thomas Pornin

@RoryAlsop Problem is not really that they block copy-paste on password; the problem is that they don't understand password security.

Rоry McCune

@TerryChia @LucasKauffman here's the more technical version of that samsung knox thing.. mobilesecurityares.blogspot.co.uk/2014/10/…

Terry Chia

> Samsung didn't make any use of code obfuscation but really tried to hide the password storage code within hundreds of java classes, inheritance and proxies.

Isn't that just normal Java?

> In the end it just uses the Android ID together with a hardcoded string and mix them for the encryption key.

Yep, that's just bad.

Rоry McCune

@TerryChia well I suppose it's not too bad it's not like it's going to be used by a large government or anything....

Terry Chia

@RоryMcCune Approved by the NSA.

AJ Henderson

4:03 PM

@Simon that's why good password manager have a typing option

Rоry McCune

6:41 PM

@TildalWave @RoryAlsop did you spacy types see this nytimes.com/2014/10/25/science/…

crazy, guy breaks Baumgartner's record with no publicity or build up

Thomas Pornin

@RоryMcCune He must have forgot to make a logo or a Web site

Rоry McCune

@ThomasPornin What was he thinking!

David Freitag

7:06 PM

Note to self: Don't go poking around in InstallShield's settings ever again

Xander

7:35 PM

@DavidFreitag At one place I worked, we had a full time guys who's only job was building installers. InstallShield's a complicated product. He went to InstallShield training classes and everything.

David Freitag

@Xander Yeah we only need a simple installer. I really hate that Microsoft got rid of the old installers available from directly within VS

Xander

@DavidFreitag Yeah, the VS Installer projects were great when you didn't need all of the complexity of a dedicated installation build tool.

AJ Henderson

8:52 PM

@DavidFreitag wait, when did they get rid of them?

as of 2012, I think I still have some installer projects in VS

David Freitag

@AJHenderson VS 2010 was the last I remember them being available

AJ Henderson

I haven't tried in 2013

it's a seperate download now though

David Freitag

Nope, because that's what I use. VS 2012 only has InstallShield

AJ Henderson

that said, I do like install shield pretty well too

Xander

When a question has a perfectly good answer, why do people feel the need to create brand new accounts just to post what are clearly completely bogus answers?

AJ Henderson

8:57 PM

@DavidFreitag visualstudiogallery.msdn.microsoft.com/…

though that isn't actually what I was thinking of, I was thinking of the VISX tools, but those are just for extensions to visual studio, not stand alone installers

Xander

It irritates me because I've already lost rep to the repcap today, and now I have to lose a 200 rep day just to downvote his sorry butt.

David Freitag

@AJHenderson Hmm, I suppose that probably would've saved us the $600 we spend on ISE

Iszi

10:11 PM

So, here's something interesting for discussion: Are machine-unique identifiers, on potentially multi-user computers, PII?

forum.avast.com/index.php?topic=157693.msg1140066#msg1140066

Transcript for