The DMZ

@LucasKauffman yeah one of the reasons I like OpenVPN is that it sets up easily (at client and server) and works on almost all platforms (including iOS devices...)

@TerryChia you can get OpenVPN Access Server as a VM image from the commercial companies site

if you just want 1/2 active users it's free

Terry Chia

6:37 AM

@RоryMcCune Nah, I'm looking at spinning up DO instances for this. (This is for the iffy wifi when travelling scenario.)

So something that I can bring up and down automatically will be good.

Oh @LucasKauffman, remember that new Sec.SE user from Google you mentioned the other day? Who is it?

Been looking through the profile of the top monthly users but I can't find him/her.

Terry Chia

8:34 AM

@RоryMcCune (and @AviD who isn't here at the moment): Ever tried this? scan.coverity.com

Gilles

10:07 AM

cybersecurity burninate? merge into security-theater?

Lucas Kauffman

10:24 AM

@TerryChia ah yea

let me find him

@TerryChia security.stackexchange.com/users/692/david

Terry Chia

@LucasKauffman Ahh. Not a new user though.

He has been on the site longer than me.

Lucas Kauffman

@TerryChia yea but he only started to gain a lot of rep recently

Simon

12:32 PM

#yolo

I've seen a ghost town more active than this place.

Rоry McCune

12:50 PM

@Simon woooooooo </ghost>

Terry Chia

@RоryMcCune Goddammit man!

Rоry McCune

@TerryChia I've not tried their on demand offering but in the past Coverity were more of a software quality mob moving into security, as opposed to a native security tool. Not that that's particularly a bad thing just one to be aware of.

@TerryChia ?

Terry Chia

@RоryMcCune You broke the silence. :P

Was trying to see how long @Simon would be ignored. ;)

Rоry McCune

@TerryChia I didn't realise we were going for a record...

@TerryChia easy way to do that is everyone put him on silent :)

Terry Chia

@RоryMcCune Ahh interesting. Any idea when they started offering this? I have been seeing more C projects on GitHub using it recently.

Interesting to have it as part of the build process.

Rоry McCune

12:54 PM

@TerryChia yeah it could well be good for that, and I think there's others offering similar things (e.g sourceclear cough cough @avid)

Terry Chia

@RоryMcCune We need that free for FOSS projects though. (@AviD hint hint) ;)

Rоry McCune

@TerryChia I think it is.. I signed up and scanned a github repo for free anyway (Although at the moment it just seems to be doing a version scan...)

Terry Chia

Wait, is Sourceclear free? I have not actually looked at their stuff.

Hmm, no mention of pricing on their site.

Rоry McCune

@TerryChia I think things like the basic scanning will be, but likely add-on features wil cost...

Terry Chia

Hmm, fairly interesting stuff. I guess their more focused on .NET and Java atm?

Simon

12:58 PM

@TerryChia You shouldn't ignore me, I actually made my first django app this weekend.

A simple AJAX request that gets data from the DB but still, it was fully made with Python!

Terry Chia

Hum: sourceclear.com/integrations/code-editors/eclipse

Java, PHP, Node.JS and RoR with Python coming soon.

Rоry McCune

@TerryChia well with their audience being corps, Java and .NET make sense...

Terry Chia

@Simon Yay! 10 points to @Simon.

Simon

The PHP framework called Symfony I've been working with for the past week is pretty much a copy cat of django's structure so it was very easy for me to pick it up.

Terry Chia

@RоryMcCune Looking at their list of supported languages, I'm surprised by the number of dynamic languages.

Rоry McCune

1:04 PM

@TerryChia well if you've got to accept supporting the horror that is JavaScript, I guess adding other more sane dynamic languages isn't as bad really..

Terry Chia

@RоryMcCune Yeah, but analysis tools for dynamic languages have traditionally been tricky.

Heck, even JetBrains can't get automatic refactoring to work well for Python...

Rоry McCune

@TerryChia hells yeah, knowing even the limited amount I do about ruby/rails, makes me realise how difficult it could be

Terry Chia

If they can get the tools to be effective on dynamic languages they will have a real winner I think.

Rоry McCune

@TerryChia well now they've got @avid I'm sure it'll be childsplay!

Simon

Avid is the donut of all donuts.

Terry Chia

1:10 PM

@RоryMcCune @AviD likes Windows though. He is crippled without Visual Studios and C#. ;)

He needs to embrace Python and Ruby and all the Apple-loving that comes with it first. ;)

Simon

Python 4 lyf3

Rоry McCune

@TerryChia well there's WinJS of course...

David Freitag

@Simon So that's different.

Terry Chia

@RоryMcCune That sounds awful...

Rоry McCune

@TerryChia oh oh now I'm in trouble

the trouble and strife is here :op

David Freitag

1:12 PM

@TerryChia visual studio supports js... even Node.JS now

The LightSwitch projects all use Node.JS

Simon

@DavidFreitag I feel like a new man.

Marion McCune

@rorymccune you obviously need a degree of supervision and moderation to ensure you don't waste your time when you are supposed to be working on our tax forms...

5

Terry Chia

@RоryMcCune Uh oh.

David Freitag

@Simon Me too. Got my head shaved again, and I'm moving out. It feels great

Rоry McCune

@MarionMcCune ha can't ping me that way :op

Simon

1:14 PM

@DavidFreitag Nice, your own apartment?

@MarionMcCune Baha.

David Freitag

@Simon Nope, it's a 2 bedroom 1.5 bath. It's kinda awkward though

Simon

@DavidFreitag You know the other person well?

David Freitag

@Simon Yep, it's my best friend's girlfriend.

Simon

LOL

in b4

David Freitag

Heh, it's not like that. Her housing situation just went nuclear, and I've been looking to move out for a long time.

Simon

1:16 PM

Kk. I hope your friend trusts you and won't annoy the fuck out of both of you because he's jealous.

David Freitag

It was his idea actually

Simon

Interesting.

David Freitag

We are both in the "I want to not be living where I am currently, but I don't make enough money to have my own apartment"

Simon

I can assure you it's gonna get awkward for sure though, lawl.

David Freitag

Yeah, from what I hear she like to walk around naked half asleep.

Simon

1:18 PM

Good times incoming.

David Freitag

@Simon More like heart palpitations

Simon

D palpitations, imo.

David Freitag

At this point she's practically my sister.

Simon

Yeeeeeah, the good ol' sister excuse.

Terry Chia

@DavidFreitag A piece of advice, you better shut up about this topic in here now. ;)

David Freitag

1:20 PM

@TerryChia Well I am American...

Terry Chia

Anything you say will just be taken as a euphemism. ;)

Simon

My tat is peeling like a donut.

David Freitag

Heh, I forgot aboot that.

Simon

And now I want my arms covered.

Terry Chia

►

Simon

1:21 PM

SLEEVE PLS

David Freitag

@Simon Did you ever listen to that song I linked?

Simon

@DavidFreitag Hang on, I'm gonna check what it was. I wasn't here last week cuz vacation.

Ah stardust? A classic.

Very good indeed.

David Freitag

The "Top Songs" playlist for Wildstylez is ridiculous

Simon

He's quite good, yeah.

Him and Headhunterz were rocking the scene back then.

David Freitag

Isn't Wildstylez the dude who does Hard With Style?

Simon

1:25 PM

Nah, Headhunterz is.

David Freitag

o

Simon

They made a bunch of collabs together. Like that Project One album, pure madness.

David Freitag

@Simon Oh god it's so good

Simon

1:36 PM

I convinced my gf to dump Windows for OS X, win.

That was shameful.

David Freitag

@Simon Ew

Simon

@DavidFreitag Wanna hear a sick melody that will probably be stuck in your head? play.google.com/music/m/Tcf3tff7ilfe5i4264fsavqkr7q

David Freitag

@Simon I'll have Wildstylez stuck in my head for a loooong time.

Simon

@DavidFreitag That's fine hehe.

David Freitag

@Simon play.google.com/music/m/Tjfjpwsczud4dkofna4nqjq4vrq

Simon

1:46 PM

Meh, his new stuff isn't as good, imo. Yeah it's very melodic and all but it doesn't feel like it's special to me.

David Freitag

Tatanka has some weird music.

First track I heard by them was Africa.

Simon

It's hella good ^^

Italian producers are simply amazing.

David Freitag

Must be something in the water

Simon

Haha.

TildalWave

2:23 PM

What the haberdashery is going on here then?

Tatanka, Africa, Italian producers? WT*?

Simon

And I linked a track called Tokyo.

TildalWave

isn't Tatanka what they called buffaloes in Dances with Wolves?

David Freitag

@TildalWave Don't worry, it's not something you would even remotely be interested in.

TildalWave

@DavidFreitag Oh I didn't, it was posted by @Simon, hardly worth a check :)

Simon

@TildalWave DON'T BE A DONUT

David Freitag

2:30 PM

@TildalWave To be honest it is very good, but I don't expect someone with your... experience to enjoy it.

TildalWave

@DavidFreitag there there now you're just being orthophobic

Xander

IMO, a product as expensive as Fortify should be smart enough to be able to exclude standard libraries from its scans. I get very annoyed when I get 25 page scan reports consisting of "critical" issues like "hardcoded password in jquery.min.js" that I have to respond to.

David Freitag

@TildalWave I'm afraid of property??

TildalWave

@DavidFreitag propriety

David Freitag

@TildalWave phobiasource.com/orthophobia-fear-of-property

TildalWave

2:37 PM

@DavidFreitag well they obviously haven't a clue

David Freitag

@TildalWave Apparently.

TildalWave

@DavidFreitag common-phobias.com/Ortho/phobia.htm

David Freitag

Also, I was more hinting at the fact that you are old :b

Rоry McCune

@Xander you'd hope that either there would be a trivial way to exclude those libs or it'd be done by default..

David Freitag

@Xander How extensive are the scan results? If possible why not write up a small perl script to process them into sortable results so you can hide the libs.

Terry Chia

2:42 PM

@DavidFreitag Because you will obviously want to write a Python script...

Xander

@RоryMcCune Yes, exactly, and preferably by default, because I'm not the one running the scans typically...My customers are, and it's a lot of work to write up responses that diplomatically explain that all of the scary issues their very expensive product reported are actually invalid.

David Freitag

@TerryChia Does it really matter what he writes it in?

Xander

@DavidFreitag See above. The problem is that I'm not the one running the scans, so I don't have control over what they're scanning.

Terry Chia

@DavidFreitag Yes, because you will want to read the script a day later. :P

I'm only messing with you.

David Freitag

@TerryChia I know, silly pedant.

Xander

2:43 PM

But it should be easy for them to compare signatures of files to those of well known libraries and not examine matches.

David Freitag

@Xander Or separate the results of the test based simply on the name of the script that got scanned

Rоry McCune

@Xander I think one of the big problems with this kind of architecture is that devs include a whole library (e.g. JQuery) where they're using a tiny portion of the functionality. The tool can't easily analyse what parts they are/aren't using so takes the default position of flagging ALL THE ISSUES...

Xander

@DavidFreitag Yes, I could, but that doesn't mitigate my main pain point of responding to whatever it arbitrarily decided to report against those scripts. Some of the issues I see repeatedly and could have standard responses too, but I get other seemingly random findings each scan.

@RоryMcCune True, but I'm of the position that they shouldn't be heuristically scanning libs like JQuery at all. They should do a manual review, hardcode any real issues (of which I don't know that there are any well-known vulns in JQuery right now) and bypass the automated source scanning entirely

Rоry McCune

@Xander yeah but that's difficult, automated scanning is easy :)

Xander

@RоryMcCune LOL, yes that is true.

AJ Henderson

3:17 PM

2

Q: Drive-by download attacks: the exact how to

To trigger a drive-by download attack, this article states that a second method exists: The second takes advantage of the natural design of your web browser to display web page content. If that content includes something that needs to be downloaded to view it correctly, your browser may o...

drive-by-download

how is this upvoted???

Simon

Even donuts are allowed to upvote questions.

AJ Henderson

the hardest part is deciding if I should VTC as "breaking security of a system you don't understand" or "unclear what you are asking"

I finally decided on the former

David Freitag

@AJHenderson More importantly, why was it favorited four times?

AJ Henderson

@DavidFreitag my guess, he has friends

which is half of why I posted it in here

as well as letting those sane individuals with down votes and VTC votes to jump in

M'vy

3:51 PM

hiya

Xander

4:03 PM

@M'vy Howdy

Rоry McCune

@M'vy hi

M'vy

how are you?

Xander

@M'vy I am well. I assume @RoryMcCune is well as well, as he's Scottish, and the Scots can endure any circumstance with a smile.

3

Rоry McCune

@Xander @M'vy I am indeed well 'cause the temperature has stopped being a distinctly unscottish 25C and is now a more reasonable 17C

Terry Chia

@Xander s/smile/whisky?

Rоry McCune

4:11 PM

@TerryChia mmm whisky

Xander

@TerryChia Ha ha. Yes. This.

Rоry McCune

Got an early day tomorrow tho' flying down to Manchester on the Redeye so 4am start...

M'vy

:)

David Freitag

6:55 PM

Waaaaagh. All my music is getting old.

Gilles

7:26 PM

0

Q: Security risk stemming from data passed in $_GET superglobal

This is a short but general question. I am relatively new to programming in general. My site,w which is predominately written in PHP, will be launched soon and is undergoing some security tightening. This started with converting the whole thing to PDO with prepared statements (from what was a mys...

security url data

is this fit for sec.se?

TildalWave

@DavidFreitag you're the one getting old, music is either eternal or it just goes stale on you because your taste in it sucks :P

@Gilles feels like a dupe, let me check ...

shit, 100 results LOL security.stackexchange.com/search?q=%24_GET

OK, 21 questions about php + $_GET security.stackexchange.com/… that's better

Meh, I don't feel like reading through PHP questions at the moment ...

Gilles

@TildalWave Thanks. I've told the mod to go ahead and migrate.

If it's a dupe, someone will find it.

TildalWave

Indeed

Rory Alsop

7:55 PM

@DavidFreitag You call that old? This is old...

Hello everyone

Xander

@RoryAlsop Howdy!

Rory Alsop

how's things? I pretty much missed the entire weekend.

drink was to blame

.... and the hot tub

no waterproof devices :-)

Xander

@RoryAlsop No idea! I've missed the whole last week. Family vacation was to blame in my case.

Rory Alsop

@Xander excellent!

I'll drink to that

(maybe next weekend - give my liver a break)

Thomas Pornin

@RoryAlsop You drink hot tubs ?

That's impressive.

Xander

8:03 PM

@RoryAlsop :-)

Rory Alsop

8:23 PM

In the hot tub. Everything from mojito jelly to champagne, via beer, cider, whisky, Bourbon...

I just discovered that the UK will decriminalise online piracy from next year. Instead of a criminal record they will send four sternly worded letters telling you not to be so naughty

I'm a bit old to take it up as a hobby though

AJ Henderson

so I think Foscam may have set a new standard for creepy work places

they have demo units of their cameras setup in some of their offices

anyone can just log in and control the cameras

Xander

9:53 PM

@RoryAlsop Nice!

Gilles

Eeeek, what a horrible tag wiki

Braiam

@Gilles I think is appropriated to obliterate it

Gilles

@Braiam no can do, once the tag wiki exists, you have to write something that's above the minimum length

7

Q: Allow deleting a tag wiki or excerpt

Sometimes a tag wiki excerpt or body ends up with unacceptable or useless content: plagiarized text that must be removed, or a totally unhelpful dictionary definition. (For example: this latest incident — and I've seen this situation many times before.) The only way to get rid of that content is...