The DMZ

Rory Alsop

3:00 PM

@RоryMcCune You having to do a 'settling in' bit at head office, or are you still WFH?

AJ Henderson

but there are dozens of people that do the choreographed lights thing now

atleast

there are actual cash prize competitions for Christmas lighting

with prizes worth thousands of dollars

Rory Alsop

@Polynomial You have seen Steel Panther live, right?

AJ Henderson

(which isn't saying a whole lot when you consider that some of the systems that people build cost tens of thousands or more... but anyway)

Rоry McCune

@RoryAlsop down in the office this week to get creds/setup/inducted then WFH from then (although disturbingly They seemed interested in the fact that I had experience of $large_bank) so I may end up doing some work through your way at some point...

@deed02392 Indeed. Just need to get my creds for that env. sorted then I should be getting myself set-up on IRC

Simon

@RоryMcCune The company is using an internal IRC?

Rory Alsop

3:04 PM

@RоryMcCune heh - coffees it is then :-)

Rоry McCune

@Simon I am given to understand that there is one

Simon

@RоryMcCune I like it, that's pretty cool.

Rоry McCune

@RoryAlsop I'll need it after the commute to the east coast if I have to do it :)

@Simon yeah seems like a neat idea!

AJ Henderson

-1

Q: My laptop doesn't show Sd card, the camera says that it needs to be formated

I have a problem with my SD card, a week ago I replaced my SP Silicon power 16GB 10th generation card with another card, when I put it beck into the camera, it said that card needs to be reformatted, I tried to format the card with camera, but couldn't, so I took it out again and put it in my lep...

nikon

facepalm

hmm, I got this new SD card, it doesn't work in my camera or my computer, what's going on?

.........

Rory Alsop

@AJHenderson must be a photography question!

Simon

3:06 PM

Also, he put it in his "leptop"

Rory Alsop

heh - thes es muy leptop

TildalWave

Oh hey @Poly how's the ALS ice bucket challenge going?

AJ Henderson

@RoryAlsop it was so tempting to post a comment pointing out maybe he shouldn't get "bargain" basement imported SD cards from no-name companies and retailers that have a smaller QA department than my butler department

(ie, none)

Rory Alsop

@AJHenderson heh Blatantly off topic

added my flag

TildalWave

@RoryAlsop nice custom close vote reason :D

Polynomial

3:17 PM

@RoryAlsop Yeah, once, at download.

@TildalWave Why would I be doing that?

Braiam

You said you hate PHP? What about SharePoint?

Polynomial

@Braiam Sharepoint is a giant fustercluck of horrors.

TildalWave

@Polynomial Because I had the audacity to nominate you? Also, it's fun?

deed02392

@RоryMcCune It's a great idea. Clearly shows how cool this company is

Polynomial

@TildalWave Oh. Meh. I'll just donate a quid and avoid it like a boring sod. I have an aversion to viral stuff like this.

AJ Henderson

3:26 PM

@Polynomial yeah, if anyone nominated me, I would ignore it completely on the principle that chain letters are a greater evil upon society

Scott Pack

@Polynomial So's your mom.

Polynomial

@ScottPack You'd know.

@TildalWave I'd rather donate to a charity I actually care about, like Mind or OLPC.

especially because the ALS charity spends in excess of 70% of donation money on non-care funding, e.g. advertising / paying staff.

whereas OLPC spend 70% on the actual project, and Mind spend 40% on direct care and a further 30% on awareness campaigns (which are sorely needed in the UK).

I know 20-30 people with or that have had mental difficulties, zero with ALS.

and last I checked, the latter weren't still being told their condition doesn't exist and that they should just cheer up.

AJ Henderson

@Polynomial you sure? which one did you look at? Most of the ALS places I looked at (including the one doing the challenge) actually had pretty good usage numbers

there were a couple of regional offices that weren't very good

Polynomial

@AJHenderson the one that started the challenge has a bunch of stats on their website that don't actually match up to their filed costs.

AJ Henderson

MDA has that problem though where they spend like 60 to 70% of the money they bring in on advertising to get more money

Polynomial

3:33 PM

@AJHenderson the great thing about being a registered charity in the UK is that all of their tax filings are public record.

AJ Henderson

@Polynomial is that because they are being inefficient or because they want to seem bigger than they are?

I've seen charities have a tendency to exaggerate on the web before

Polynomial

@AJHenderson no, it's fully receited tax filings. if they weren't accurate, they'd be committing fraud.

AJ Henderson

right, I'm talking about the web stats being inaccurate, not the filings

Polynomial

oh, on their site? it's probably creative accounting.

being liberal with rounding and the like

AJ Henderson

my dad is a career non-profit CFO

Polynomial

3:35 PM

then I'm sure he'll tell you that most charities spend a fortune on stuff that isn't actually care.

AJ Henderson

and probably gonna be the first male CEO of a girlscout council if things keep going the way they are

Polynomial

I'm sure that can't possibly end badly.

AJ Henderson

yeah, you have to be careful with charities

Polynomial

(people being paranoid fucksticks, that is, not your dad doing anything dodgy)

AJ Henderson

oh believe me, my Dad bitches about the bad accounting and financial state of non-profits all the time

Polynomial

3:37 PM

prime example of an awful charity is PETA

AJ Henderson

and then you have the ones that are flat out scams

Scott Pack

To be fair, PETA is staff by terrible people.

Polynomial

@ScottPack it's just awful full stop

AJ Henderson

there are charities where 97% or more of the donations goes to the owners and their chronies

Polynomial

PETA put down more animals than any other animal-related organisation in the entire United States.

including animal testing labs.

they've been proven to be involved in illegal activities: fraudulent fundraising, extortion, libel, criminal damage, animal cruelty and abuse

huge portions of their funding go straight into the pockets of the directors

they are just flat out evil

AJ Henderson

3:39 PM

yeah, you should never donate to a charity without checking their finances first, and not just to make sure that they are making effective use of the funds, but that they also are running themselves in a sustainable manner as well

the vast majority of charities have a problem on one side or the other

Polynomial

remember the fake KFC video?

two ex-employees broke back into the battery farm and recorded themselves kicking and beating chickens, and stamping on them

AJ Henderson

they either take large amounts of money and apply it to their own people liberally or they are truly mission oriented people that will put everything that comes in to the mission of the organization without remembering you have to run it like a business still if you want to continue to exist and be able to continue to make effective use of funds

Polynomial

sent the video to PETA, who knew it was fake, and they used it as a smear campaign

so they directly profited from cruelty.

@AJHenderson very true. it's a tight line to walk.

and very easy to get tempted when you see huge sums of money coming in

AJ Henderson

it's also why I tend to be much more personally on the time donation side

Simon

I wish I could profit from donuts.

AJ Henderson

3:41 PM

I very much prefer to buy myself the tools I need to help charities and then provide services

Polynomial

I also refuse to donate money to aiding developing nations, because I know where that money ends up, even if the charities have the best of intentions.

OLPC is an exception due to the fact that they don't send money over there, and the equipment they send is useless to anyone but kids.

AJ Henderson

water programs are similar

when they are sending over water treatment gear

and installing it in villages

Polynomial

the problem is you still have to pay the bribes to get through

which contributes to corruption

AJ Henderson

or you have to go with small organizations that can slip under the radar

anytime an organization becomes large, it becomes more of a target

Polynomial

hence OLPC. they do a lot of stuff in South America where they know the area, so they avoid the corruption.

AJ Henderson

3:45 PM

I have friends that work with a decent sized water project in Uganda and they are able to avoid the corruption issues

Polynomial

Uganda*

AJ Henderson

right

Polynomial

if the stuff's in the country already, it's not so hard

it's getting it over the border that's often hard

AJ Henderson

they are bringing stuff in, but on a scale that they can fly in with them when they go in for the install

Polynomial

yeah, best way to do it

Red Cross level stuff == bad news

little bi-plane going over the border is much easier

AJ Henderson

3:46 PM

less efficient overall, but less contribution to corruption makes it worth it

Polynomial

once you're using milspec gear to dump entire crates of aid, stuff goes bad.

AJ Henderson

@Polynomial well, unless you have your own muscle, ie, when it's something like a UN program with military making sure they make it through without the bribes

though the UN has it's whole own ballgame of corruption

I'm sure

Polynomial

almost guaranteed

AJ Henderson

but that's at the 1st world nation level rather than towards the developing nation so much

and it isn't the aid funds going in to bribes, but political funds

which is really the job of political funds to begin with

sad but true

Polynomial

I'll just send them pictures of Goatse

actually, that'd be a great way to deal with the Taliban

"This is the nation you're attacking. We have people who do this. You think you're likely to win against that kind of insanity?"

CodesInChaos

3:54 PM

Polynomial

hahahaha

is that really legit?

CodesInChaos

Yes, it's legit. content.time.com/time/covers/0,16641,20040920,00.html

Polynomial

They must have known, right?!?

Terry Chia

@tqbf @jpgoldberg I was an emacs/gdb expert 25 years ago, then I grew up.

Tweeted by ErrataRob on August 26, 2014 at 4:30 AM in reply to tqbf

Polynomial

@TerryChia I ignore pretty much everything that man has to say.

AJ Henderson

3:57 PM

@Polynomial well when it is that far open, I guess it would be easy to sneak in

Terry Chia

@Polynomial Well, that one is pretty funny. I only saw it because @tqbf retweeted it.

Polynomial

@TerryChia he was on BBC News the other day as a "security expert" and completely got a description of some attack wrong, then said hackers usually get into people's home computers because people don't patch their systems, which is totally untrue.

99% of the time they get in because people click stupid shit

like "codec_pack_install.exe" when they're trying to watch movies/tv/pr0n online for free.

CodesInChaos

@Polynomial Often it's a mix. I click stupid shit because I assume that it won't drop a zero day on my browser+plugins.

Polynomial

@CodesInChaos but you're a security person

whereas the average Daily Mail reader just clicks everything and goes to stupid sites

and thinks firewall + AV means they're safe because that's what it says on the box

AJ Henderson

@Polynomial well, not totally, I mean, a lot of drive by stuff is a result of unpatched systems that updates would have prevented

Polynomial

4:03 PM

@AJHenderson sure, but 90% isn't drive-by, or is drive-by via Silverlight or Java and the user clicks "OK" on the security prompt.

AJ Henderson

I see plenty of infections that aren't the result of recent zero day vulnerabilities, though I suppose even more is people clickign ok

yeah

though patching still limits to an extent what can be done in a lot of those cases unless they give it the UAC go ahead as well, but I do see your point

Polynomial

@AJHenderson sure, but that would imply that he said "people should run Windows Update frequently and make sure Java and Adobe Reader are updated when it prompts you"

AJ Henderson

and I was thinking about saying that unpatched systems are the main cause for non-stupid users, but then it occured to me not patching pretty much qualifies as stupid user too

Polynomial

which he didn't. he just said that most infections are from unpatched systems, which is wrong and provides no benefit to the average end user.

@AJHenderson stupid levels and technical levels do not necessarily correlate directly :P

AJ Henderson

@Polynomial I'm sure it is in that order

Polynomial

4:07 PM

hehe

AJ Henderson

@Polynomial ah, that just makes me sad then

though really, even then, telling people not to click on shit they don't expect is still better than giving them a false sense of security that patching will protect them from their own idiocy

Polynomial

exactly, but he did the latter.

AJ Henderson

oh, so he was passing it off as a "you don't really have to worry because..."?

Polynomial

and some of the stuff he said was flat-out wrong. even my fiancee's mum picked up on it and asked me when I next saw her, and I said "Was his name Robert David-Graham?" straight away, because he does this shit all the time.

@AJHenderson nah, it was more of a "this is how hacking works" statement.

which gives people the complete wrong idea

I swear it's a rule that only people that don't actually have a clue are allowed to go on the news and talk about security.

at least in the UK.

AJ Henderson

@Polynomial because the people who know what they are doing are too busy doing it

those who can't do teach, those who cant teach administrate, those who can't administrate go in to talk radio

Polynomial

4:13 PM

@AJHenderson pffft, no we're not! We're busy slacking on the DMZ!

AJ Henderson

@Polynomial well there is that

Terry Chia

@Polynomial Says the guy who went missing for a year. :P

AJ Henderson

wow, what is with all the super blatantly off topic posts today

Polynomial

@TerryChia I was just busy slacking off on Reddit.

David Freitag

4:41 PM

@TerryChia I think we met briefly before he poofgonned.

Polynomial

@DavidFreitag We met for a fair while.

David Freitag

@Polynomial Heh, shows just how bad my memory is

Simon

@DavidFreitag Did you find out if he's the father?

David Freitag

Also, @RоryMcCune the USBCondom link you found was for a device that basically allows for just charging, it's not the same as what I'm working on, but it is the reason I need a different name.

AJ Henderson

5:08 PM

@Arperum that's really more like punk than metal

but it still works

@DavidFreitag USB IUD, lets stuff through but makes sure it is dead first

David Freitag

@AJHenderson Heheh, that's messed up.

Also it gives me visions of some idiot trying to use it as an actual IUD. "Honey, I plugged in the USB, it says that's how it works on the box!"

AJ Henderson

and it goes inbetween the ports

so it is even anatomically correct

and it prevents the USB device from leaving an unwanted present to grow in your computer

David Freitag

@AJHenderson More importantly it prevents the computer from sharing something nasty with your USB device so you can further infect other computers.

AJ Henderson

@DavidFreitag ah

David Freitag

@AJHenderson If it wasn't hardened to the original attack, what's the point?

Simon

5:21 PM

I like hardened.

David Freitag

The harder the better.

Rоry McCune

@DavidFreitag Ahh, thought that might be the one. BTW from the HN discussion there was a list of similar projects that might well be of interest/use to you... news.ycombinator.com/item?id=8216068

Arperum

@AJHenderson Meh, names.

David Freitag

@RоryMcCune It looks like those are all charging utilities.

I really should frequent HN more.

David Freitag

5:55 PM

Duuuuuude, i have class at 10am tomorrow morning :[

Simon

lulz class

David Freitag

They only offer one Differential Equations per semester and I got shafted with the 10am one.

Simon

Sounds like a lot of fun.

David Freitag

Honestly I have no idea. I bet it will be though. I've got that, Linear Algebra, and Calc-based physics 2 which I also got shafted, but at least that one's 11am

Simon

First Date has the most accurate lyrics ever.

David Freitag

6:00 PM

Never heard of them.

Simon

You donut. blink-182 - First Date

David Freitag

Never heard of it.

Simon

Stop donutting around.

David Freitag

Yeah for some absurd reason my brain wants me to listen to Vampire Weekend.

Simon

6:27 PM

wat

David Freitag

It's better now, I switched to Norther.

David Freitag

6:41 PM

This is terrifying. cds.linear.com/docs/en/application-note/an88f.pdf

Lucas Kauffman

6:51 PM

Rоry McCune

7:05 PM

@LucasKauffman sounds about right..

@LucasKauffman BTW have we seen @kisu or @adnan since they got the Ice bucket challenge? I'm hoping they haven't perished in some freak sauna/ice related accident...

David Freitag

7:39 PM

Oooh a new Machinae Supremacy album. Sweet.

Lucas Kauffman

8:11 PM

@RоryMcCune I haven't actually

Simon

I know I am posting every forum I know, I'am hardworking plz — Abdale mohamed - Abdalestar 11 mins ago

SIGH

Lucas Kauffman

David Freitag

@LucasKauffman What has been seen cannot be unseen.

Lucas Kauffman

8:36 PM

@AviD I extracted all instances where you said the f-word:

> Fuck Oracle and Jeff too.
@D3C4FF Yeah! And fuck Dr. Phil, too!
And fuck Lance Armstrong's balls, too.
@Iszi generally fuck with. figured "molest" was a nicer word :)
I think Google Glasses might be the last straw for in-person communication. My plan when Google Glasses replace smartphones is to just say fuck it and never again attempt to make conversation in person. It will be too frustrating.
You read the latest post on highscalability.com and think you're a fucking Google architect and parrot slogans like 'web scale' and 'sharding', but you have no idea what the fuck you are talking a…

Simon

How many times has he said my name?

I'm not sure if I wanna know, actually.

Lucas Kauffman

let's see

Gilles

How many times has he said them consecutively?

Lucas Kauffman

there are 1010 hits for author Avid with Simon in a message o.O

Simon

Oh lawd.

AviD

8:43 PM

@LucasKauffman hmmm. most of those are actually quotes.

Lucas Kauffman

I'm going to write a blog post

need to do some analytics

David Freitag

Maaaan NPP's macro feature is soo freaking useful.

Gilles

-1

Q: iOS Security/Encryption techniques for REST webservice

Say there's a banking app with a lots of web-service calls involved. How do you store secure data (such as sessions, fund transfer validation keys etc) encrypted locally which can be retrieved back again when needed? What are the possible techniques and methods to minimize the security risk? D...

encryption web-service ios rest

I disagree with the close vote as too broad, this is answerable. But is it answerable here? It feels like an API usage question, so should be on SO.

Adnan

9:11 PM

@RоryMcCune Sorry. We've been so busy, and I guess we'll have to break the 24h thing. I'm planning on filming it tomorrow with @kisu

AviD

9:44 PM

Hey, anybody wanna sponsor AppSecIL? Very good deal.

and would prevent us from having to cut back on the logistics, due to some ... corporate budget holders

David Freitag

@AviD Yeah sure, I think I have a massive jar of pennies lying around here somewhere...

So, the pull request lifecycle (from scratch) on GitHub looks like this: Fork -> Clone -> Commit -> Push -> Pull Request?

David Freitag

10:33 PM

Lol, the office 360 mobile site is completely broken. If I hit "Sign out" it loads a bunch of times then signs right back in.

AviD

well sure, you got signed out, and obviously you need to be signed in.

David Freitag

Eh it was only my college email, what could possibly go wrong.

AviD

does your college want to sponsor?

I feel like that guy in Silicon Valley accosting random strangers at Disrupt asking them what the company should do.

David Freitag

I doubt it. Attendance is down and they are poor.

AviD

on the other hand, AppSecIL attendance is way up, but we are become poor.

we cannot feed the hungry hordes of hackers.

hmm, I should tweet that. Might work.

#HelpHugHungryHackerHordes

David Freitag

10:46 PM

@AviD Change that to #HelpHugHungryHackers

AviD

why?

whats wrong with hordes?

David Freitag

Nothing, it seems too wordy.

AviD

thats the point

it still rolls off the tongue, though

KnightOfNi

Hi all

KnightOfNi

11:32 PM

Does anyone know where our 'motto' ("The first breach costs you an arm...") comes from?

David Freitag

11:54 PM

Feb 20 '12 at 20:50, by Scott Pack

room topic changed to The DMZ: The first breach costs you an arm.... [food] [libations] [security] [xxx]

KnightOfNi

@DavidFreitag So, it's not a reference to anything?

David Freitag

@KnightOfNi You'll have to ask @ScottPack, I just used the search button to find the first occurrence.

KnightOfNi

@DavidFreitag I couldn't find anything online, but I do remember an xkcd reference... Do you know if he's a fan?

Ah, here it is... xkcd.com/169

Transcript for