The DMZ

Scott Pack

00:46

zomg! It's back from the dead!! best-practices

I thought that tag got banned?

Get to work @AviD

AviD

urggh.

okay, this time I'm making it a synonym. What should it be a synonym of?

Scott Pack

your-mom

AviD

hehe

Scott Pack

It was only 3 questions, but I'm editing it out.

AviD

sorted!

lets wait and see how accurate a choice it was.

Scott Pack

00:52

I wonder if meta.SO has any guidance on what the best practices for handling restricted tags....

AviD

think I heard somewhere that making it a synonym of something useful - or utterly useless - is the best way.

hmm, should have made it a synonym of undefined.

Scott Pack

Not \0?

There. No more best-practices

AviD

just figured defense is actually mostly what was intended, usually.

Bob Watson

You don't like best-practices?

Scott Pack

For those 3? I don't actually think so. I ended up replacing one with incident-response one with hardening and one with network. That covered them all. Only in one case was someone actually asking for best-practices.

Bob Watson

00:58

Ah, ok. It shows up in audit documentation all the time.

"Demonstrate the application of Best Practices..."

etc.

Scott Pack

@BobWatson As a tag, no. Very early on in the site we decided it would be pretty well verboten.

The idea is that it seems to imply that if something doesn't have that tag, then the information is somehow less correct, or actually goes against industry best practices.

Bob Watson

So in case of a question about complying with an auditor, etc. - that'd be compliance

Scott Pack

right

Which is a much better descriptor because complying with an auditor has nothing to do with what is "generally accepted industry practices" and everything to do with what the auditor tells you to do.

AviD

tagging a q with "best practices" has two big problems.

Bob Watson

Well, in the case where I'm the auditor and my reference policy contains that sentence.

AviD

01:02

1. it's a "meta" tag - it says nothing about the question, and provides nothing in the way of categorization or searchability.

2. its a "null" tag. like tagging somethign here with security, or on Stack Overflow with programming.

of course you are looking for the best practices. It really does go without saying.

(And that's not even getting into the whole issue of undustry reliance on this mystical concept of "best practices". Aint no such thing. )

Scott Pack

@BobWatson That's a bit of a tricksome slope to navigate. For example...

It is a very common audit finding in financial systems to require password complexity policies to forbid consecutive characters as an accepted best practice.

Outside of financial audits, however, I've never found any situation where it actually is considered a best-practice.

AviD

Calling to the higher power of Best Practices only makes sense when there is no specific context, and you have no specific expertise to analyze and solve the problem yourself.

Scott Pack

It is, however, an instance of compliance and password policy.

AviD

Or if you're a 3rd rate consultant and you're having a hard time justifying your findings report.

Scott Pack

@AviD My best kept secret is that when someone isn't buying all my reasons for doing something is that I'll throw out the "industry best practices" card. That usually shuts them up.

Bob Watson

01:09

@ScottPack I should show you this list of policy documents I have to review; they all contain the words "Best Practice" or "Better Practice" somewhere.

AviD

@ScottPack I admit to having used it too, when the client doesnt care about whats right, and only in "not being fired for buying IBM" - but only if it actually supports my analysis.

and I've actually had to explain why the BP were NOT correct more often than I've relied on them.

@BobWatson sucks to be those documents.

Scott Pack

Generally this is only when talking to That Guy who just downright doesn't want to agree.

You know the one, the guy who complains endlessly about how desktop AV is crippling his system. The one running 10.8 on 3GB of RAM with a Windows 7 virtual machine running.

AviD

The REAL "Best Practice" is to do a proper investigation and risk analysis, threat modeling, and design-level review, based on experience, to define the best solution for this specific context.

@ScottPack heh, yes indeed.

Scott Pack

@AviD You forgot to include the word cyber.

AviD

no, I was being real, with actual security specialist expertise, not marketingy.

Scott Pack

01:14

I think you need to tell more stories. If listening to the SE podcast has taught me anything it's that you don't talk about your service in the Israeli army nearly enough.

AviD

@ScottPack hahaha

yeah? does Joel keep bringing that up?

Scott Pack

Almost every single episode.

AviD

well, it does do something to your head.

actually had lunch today with an ex-special forces (US.Army) guy, served some time in Iraq... I got nuthin on him.

Scott Pack

Isn't that called indoctrination? Or are you talking aout the massive blunt force trauma?

AviD

@ScottPack more like the second.

the terms we used were "a scratch to the brain".

Scott Pack

01:18

Too bad. That one's harder to make fun of.

AviD

oh please. Of course its easier.

buncha crazy guys? running around with guns? this stuff practically writes itself.

Scott Pack

Fine, easier, but less socially acceptable.

AviD

nah, not talking real PTSD.

its more like... lets say you had to live IN THIS ROOM. with no interaction at all with anybody else. for week after week.

Scott Pack

Sounds like when I had mono.

AviD

I bet your snarkiness is starting to look pretty chill by now, eh?

then add to that the living conditions (out in the field), physical stress, danger, etc etc.

Noone ever considered Bruce Wayne to be sane.

Scott Pack

01:23

He's not dark, he's just drawn that way.

Scott Pack

03:09

@Gilles If you don't mind me asking a personal question...do you, perchance, have a beard?

Thomas Pornin

03:19

@AviD Bruce Wayne is not insane. He is rich enough to be "eccentric".

He can totally afford to spend his nights disguised as a flying mouse, if that's his thing.

What good would it be to be filthy rich if it did not allow you such simple pleasures ?

Scott Pack

I find it rather difficult to argue with that logic.

TildalWave

04:00

Hi all! A quick question. Do you know of any honeypots with publicly available IP history? I'm trying to identify what history an IP of 74.117.177.167 had. It was blocked on Spamhaus CBL and there are a few comments on ProjectHoneypot for it, but nothing substantial and I have problems moving it in the proper local policy.

It was blocked down my end, but trapped in a non-descriptive rule set that I've imported from God knows where and am trying to establish what these rules were put there for in the first place. This IP looks clean to me at this point in time, with a small exception that the UA string still looks suspecious ("Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.307.7 Safari/532.9"). It might have found its way in my BL as a forum spammer, but can't be sure.

AviD

07:51

@ThomasPornin that's exactly my point. Most soldiers aren't rich. Even with combat pay.

@ThomasPornin btw re Israel's nukes - exactly, they've never been acknowledged or proven. However, the effect is the same - if even people like you assume there are hundreds of warheads, the intimidation effect is still there.

Nuclear weapons have a lot more power as a threat (as long as it is known there is a willingness to use them) than as an actual explosive device.

and IF israel does have them - I highly doubt there are over 100. waaay out of scale for us.

On the other hand, Israel is a nuclear power, and has the enrichment facilities etc - there are a couple of nuclear power plants. Those are a poorly kept secret.

Rory McCune

08:23

For those that were waiting for it, here's the Securi-Tay talks youtube.com/playlist?list=PL2Nv8J__40K29OGsyNURKOxmsI6JYuy9b

3

AviD

08:41

@RoryMcCune ooo... and I thought I was gonna get some work in today :-)

CodesInChaos

I thought that it's pretty much proven that israel has nukes

AviD

@CodesInChaos not mathematically, as far as I know.

CodesInChaos

it's not mathematically proven that the US has nukes either

but that says more about mathematics than about nukes

Can somebody unsticky scotty's message?

It's obsolete

AviD

@CodesInChaos is it? damn, I never finished going through the whole set. :-(

CodesInChaos

what annoyed me is that it doesn't ask you questions you skipped again

Rory Alsop

10:09

@RoryMcCune Oh dear - I soooo dislike the way I look on video

Now, how many times did I get Sec.SE in there

CodesInChaos

10:30

Rory what happened to your face? It's not all painted and stuff

that can't be you

Rory Alsop

10:59

@CodesInChaos It's my other self :-) A bit like the Great Bear and the Little Bear.

Terry Chia

1

Q: A list of very specific infosec topics with very fine detail

CISSP CBK seems relatively rudimentary and extremely broad. Does anyone know a good resource that lists (a nice, long list) topics in information security with a very, very fine granularity? This: - Stack canaries - exec shield - SUID/SGID bits Not this: - Buffer overflows - Access control...

Mind closing this one? :)

@RoryMcCune Yay!

Rory Alsop

@RoryMcCune Good plug for Sec.SE rep :-)

@TerryChia done

Terry Chia

@RoryAlsop That "quick introduction" of yours is actually quite long. :P

Rory Alsop

@TerryChia heh - was sort of supposed to be - to give an idea of why it's kind of irrelevant what your background is :-)

Terry Chia

11:22

@RoryAlsop Are the slides available online? It's kinda hard to get a good look at it with the camera angle.

Rory Alsop

@TerryChia I will do a blog post on it and have the slides up there

AviD

@RoryMcCune did Mrs.Fairy pick up a Surface Pro while they were available? They all sold out by now...

It's funny reading that right next to reports that Surface sales were "dismal" and the expectation that the Pro will bomb.

I've seen reviews on the RT - one review reports that the UI is unfriendly and unintuitive, and the few units that were sold were mostly returned in droves. The other report says they were flying off the shelves and users were thrilled by how intuitive the UI is.

unbiased reporting, anyone? anyone? Bueller?

Terry Chia

@AviD The damn things aren't even officially available in my country.

AviD

@TerryChia right now the 128gb models are not available anywhere.

Terry Chia

Even the RT models aren't available here I think.

CodesInChaos

11:56

I wouldn't get an RT model. Those aren't even computers

at least they're not your computer

Rory Alsop

@CodesInChaos Actually, Marion's device did look rather good, and the interface was quick and responsive. I am not a fan of the metro UI, but the device itself was impressive

Rory McCune

12:16

@AviD she asked a friend who works for Microsoft in the US to see if he could get her one, but she's not heard back. There's scalpers selling them for $1500 on ebay but we're not paying that!

@RoryAlsop yeah I'm never a fan of the way I sound. also started too quickly as per normal, ah well feedback for next time!

AviD

12:32

@RoryMcCune whoa. nice scalp rate there :)

Rory McCune

@AviD yeah and that's assuming that they actually have the goods and aren't just scammers!

AviD

@CodesInChaos well, its a tablet. Whether or not a tablet is a computer or not, is a taxonomical semantics discussion.

and whether its yours or not, well its at least as much yours as an ipad would be (if you were to buy an ipad).

same for unjailbroken android tablets, of course.

Rory McCune

@CodesInChaos well you can Jailbreak them (at least at the moment) as @AviD says much like iPads really

AviD

but as I said, there are some usage models where the RT fits really well - and possibly even better than the Pro.

if you dont need the native code (or the other little bits - like pen, usb3, etc) then you have poor tradeoffs there.

battery life, heat, price, etc.

CodesInChaos

12:49

You can install custom software on an unjailbroken android

AviD

@CodesInChaos so? you can do that on RT too.

of course there are limitations to that, just as there is on android.

CodesInChaos

I thought you can only install software from the store

AviD

@CodesInChaos not... exactly.

Rory McCune

@CodesInChaos Developer license allows side-loading IIRC

AviD

A store (you can deploy and configure your own store). or sideload it yourself.

and MS' store has plenty of custom software, too.

CodesInChaos

12:54

What I want is that a normal user can simply download a application from a random website and install it on his device

without needing to ask MS, apple or google for permission

AviD

the only restriction is that it uses the new API / framework / UI / whatever.

Terry Chia

@CodesInChaos That's just a recipe for malware.

Rory McCune

@CodesInChaos ahh for tablets best option is a Atom or Core with windows 8 full fat

AviD

(I dont know exactly because I havent done that yet.)

Rory McCune

I'd like to see a linux tablet but I'm not holding my breath on that one

AviD

12:55

@CodesInChaos I would not want that (for most users).

@RoryMcCune waddaya think android is? ;-)

Rory McCune

I actually think there's a good niche for atom powered windows 8 tablets. Full windows but good battery life hopefully.

CodesInChaos

IMO one should have that ability, even if one rarely actually uses it

AviD

Android is like Linux RT.

Rory McCune

@AviD yeah it's "kind of" linux

AviD

@RoryMcCune I think thats where the market is heading, eventually.

the laptop compromise just doesnt make sense much longer.

Rory McCune

13:04

@AviD yeah I've been a bit down on them in the past, but I might look at them as an iPad replacement in the future..

AviD

so you'll have a range of these tablet/laptops, on the spectrum between very-portable/medium-power and almost-as-portable/more-power.

@RoryMcCune at version 3, right? ;-)

Rory McCune

@AviD well would definitely wait for Haswell based stuff before going in that direction, but my tablet won't be due for refresh for a while anyway...

TildalWave

@RoryMcCune I heard whispers an Ubuntu tablet is coming... ;)

Rory McCune

@TildalWave yeah I'd be interested in a linux tablet if one pops up, especially for wireless site surveys and the like but I'd want to see the user interface working well before I got one..

TildalWave

@RoryMcCune You've seen announcements for Ubuntu mobile? I'm holding my breath until it finally comes out and have a feeling I won't be looking anywhere else for a long time

Terry Chia

13:15

Damn ubuntu. I want a fedora tablet. :(

TildalWave

LOL well I want CentOS one then :P

AviD

@TerryChia damn fedora, I wanna see a NetBSD tablet!

TildalWave

so, no Windows supporters here, I take it? :)

Rory Alsop

13:36

Slackware tablet FTW!

AviD

@TildalWave was my sarcasm not snarky enough?

okay, how about: damn fedora, I wanna see a System V tablet!

oo oo: damn fedora, I wanna see a VMS tablet!

TildalWave

14:05

@AviD ... Gone are the days when each commandment required a separate tablet... :D

AviD

@TildalWave clearly you've never typed a tar command on a tablet before.

TildalWave

lol

I've actually been loading 'snake' to a Cray console using a similar command, but no tablet no, that was a round seat with a built in heating system :)

cray-cyber.org/pictures/cc545.php

... but I hear Microsoft is back in the furniture business :))))

Terry Chia

14:39

Something that might be potentially useful: kickstarter.com/projects/1107117096/…

Rory Alsop

loving that vector font!

@TerryChia that looks nice, but not for me at $169

Woot - got my 30k with probably a month before @Poly overtakes me :-)

Terry Chia

15:06

@RoryAlsop Yeah, it's a little pricey.

AviD

screw pricey, I'm getting gigabit internet!!

well, next year, I hope.

Terry Chia

@AviD oooo awesome

AviD

guvmint here is pushing for it.

honestly, dont know what I'd do with it at this point - most servers would not support it anyway.

all it means is I can hit more servers at once - and I do that now.

Terry Chia

I'm using a 100mpbs fiber line. It's shitty on wifi though... I really need to run an Ethernet cable into my room.

AviD

dont think I get close to maxing out my 30 Mbps connection...

@TerryChia definitely. as good as wifi can be, it's still no comparison. especially if your internet is fast enough.

one of the @Rory's was recommending powerline ethernet...

Terry Chia

15:13

@AviD It's even worse considering in my country, the channels are jammed. inSSIDer is picking up around 30 APs...

AviD

wow, thats crowded.

Rory Alsop

@AviD I think it is pretty good/simple - prefer proper wired ethernet everywhere, but hey

Terry Chia

The good thing about higher bandwidths is that using multiple devices at once doesn't suck. My family of 4 has about 15 devices using the internet at once.

AviD

@TerryChia well we only have about 6, and some of those are kids phones that are far from high bandwidth. but you're right, couple years from now will probably have a few more devices.

always good to have headroom.

Terry Chia

@AviD Heh, I alone have 4 devices connected.

But most of them aren't high bandwidth.

Lucas Kauffman

18:10

TildalWave

18:22

@LucasKauffman LOL Lucas

Java isn't female in Belgium? :D

Gilles

@LucasKauffman It has been [_] days since this photo was posted

Lucas Kauffman

@Gilles Aren't we grumpy today!

TildalWave

hey what's that number under our nicknames?

total rep?

jrg

yes

TildalWave

well some boys sure do have them here then :)

jrg

18:28

a grumpy old man once told me it's just a number.

i foolishly believed him, and then i realized that numbers = more fun toys to play with.

Scott Pack

You kids today, it's always about the toys isn't it?

TildalWave

yes? at what number do i get a woman?

Scott Pack

We're still waiting on @Gilles to let us know.

Gilles

@TildalWave vOhRyDYa4/EK0AkNkqCOBYJ5pvaDzSjJLwIpdtw9pCAurdKm0FCkVP1IGTwQH3P7

TildalWave

@Gilles you like to salt your answers don't you?

Gilles

18:35

@TildalWave this is a public channel, I can't just broadcast private information like that

TildalWave

OT, can we please get a description for that rory tag? Someone might think it's a 'a third-class airport that serves travelers to and from Yoronjima (Yoron Island) in Kagoshima Prefecture of Japan' like Google does :)

2

define:rory

AviD

@TildalWave 72, or at least thats what they say around these parts.

oh wait, I think I got that backwards.

Rory Alsop

19:01

Rories are not third class airports! Sheesh!

Scott Pack

Second class at least.

Rory Alsop

Exactly!

At least a Google for Rory security comes up with the usual suspects on page 1

Rory McCune

@RoryAlsop weird how word order on google search plays. I'm number one for rory security but number 4 for security rory

Lucas Kauffman

19:26

@RoryMcCune because you're first a rory and then security?

Rory McCune

@LucasKauffman indeed also my old blog which comes up in the results is called Rory.Blog, which I'm guessing influences the results...

AviD

one of them means "rory for security" and the other means "security from rory".

Iszi

Sec.SE is offline for maintenance? What gives?

Scott Pack

@Iszi Since when?

AviD

@Iszi special for you.

I considered a "so's your mom" there, but I'm not sure how well it would work.

TildalWave

19:42

@RoryMcCune Google will weight results depending on your usage patterns so I wouldn't be too surprised you'd score higher on your own computer than you do on say mine. They use both tracking cookies (various, also from Analytics of other sites that use it) and your IP history. It was much disputed in many blogs and I've tested myself for that IP part if it's indeed true, when asked to check that by a friend of mine. Google is basically the biggest Proxy in the world.

Rory McCune

@TildalWave interesting, I should try the results through tor browser or something and see what the result is...

Lucas Kauffman

@RoryMcCune or private browsing

TildalWave

@RoryMcCune You're on page 6 when I search for 'rory security', Rory Alsop is #4 on 1st page

Rory McCune

@LucasKauffman pshh too easy. If I do that my blog is bottom of the 1st page for security rory and one off bottom for rory security

TildalWave

@LucasKauffman that wouldn't get rid of the IP based results weighting, I checked they do that also

Rory McCune

19:46

@TildalWave yeah @RoryAlsop 's got some serious SEO sorted there! he's positively famous In the rory security world!

Scott Pack

On my first page our own Rory[0] is sandwiched between Rory Steyn and Rory McIllroy.

Rory McCune

yeah that looks like the "unadulterated" version

Scott Pack

Do you mean to imply that Google still supports enabling SafeSearch?

AviD

@RoryMcCune you've been... searching for "rory" with SAFE SEARCH ON??

of course your results will be skewed.

Rory McCune

@AviD I'm fairly sure I don't want to search it with safesearch off!

AviD

19:49

hehehe

TildalWave

donttrack.us

@RoryMcCune Probably your new favorite search engine as you score #1 and Rory Alsop #24 :D

Scott Pack

@RoryMcCune Not to worry, mate. @RoryAlsop does his drag show under a different name.

@TildalWave Oh does he?

Lucas Kauffman

duckagogo

jesus

AviD

scarily enough, searching for "avid security" shows me nowhere within my patience zone.

I really need to grab some domain names: avidsecure.com, avidsecurityplus.com, etc

some DavidSecurity thrown in there too...

Scott Pack

It doesn't help that your screen handle is also a proper word.

TildalWave

19:59

@ScottPack LOL You realize he just changed position in the last few minutes? I just refreshed my page and there he goes... plummeting :))

Scott Pack

I'm going to side step the obvious and crude jokes.

AviD

@ScottPack true. "douglen security" nets me the entire first page on google except for one (my grandfather), and most of the next two pages (almost all of those that are not me are my relatives. )

gorramit. Douglen Developments Ltd has nothing to do with me???

Scott Pack

@AviD I have very similar problems.

TildalWave

@AviD You're #3 on DuckDuckGo

AviD

@TildalWave woot

TildalWave

20:03

that's beyond your patience zone?

i.imgur.com/8Qzg4et.png?1

i took a screengrab this time ;)

Scott Pack

So I think this is the first time I've seen DuckDuckGo used non-ironically.

CodesInChaos

It's useful when using TOR

TildalWave

I've actually first heard of it on another security related forum when Google page ranking popped-up in the conversation

CodesInChaos

since google throws CAPTCHAs at you while using TOR

TildalWave

I throw 403 on TOR LOL

CodesInChaos

20:10

why? I understand disabling write access for TOR users

but denying them read access is not nice

TildalWave

experimental... only on my site that no one ever visits anyway lol

I've asked some related question here about how members here feel about blocking IP addresses that don't resolve using Forward DNS check... which I argued was mostly security related in a sense that visitors that would have the need to fake their DNS records probably have no business being on my server...

...while TOR does resolve their exit nodes correctly, I gather it's mostly used for dishonest purposes like unsolicited site crawling, content scrapping, link spamming,... stuff like that

users coming from TOR exit nodes should get a nice warning message by my web-app filters... I hope LOL (didn't do much testing yet)

Silence probably means I better check my server logs, huh? :D

Iszi

Hrm. Apparently, Rory is a pop punk/indie rock band originating not far from me.

Also, in the Hitchhiker's Guide to the Galaxy universe, an "Award For The Most Gratuitous Use Of The Word "Fuck" In A Serious Screenplay".

Rory McCune

don't know if anyone's seen todays interenet meme of choice, it's ..... very weird reddit.com/r/harlemshake

TildalWave

(changed to "Belgium" in the U.S. version)

Rory McCune

20:29

@TildalWave for a while I was #1 for Rory blog on there but tbh I've not kept the blogging going in recent years..

sounds like I need to do more SEO on my social medias

TildalWave

@RoryMcCune You find SEO of much use for personal stuff?

Rory McCune

@TildalWave not for personal stuff, but I've had some work from people finding my things on my blog in the past

TildalWave

@RoryMcCune Gotcha. I'm still at the stage where I have my websites just for kicks and testing. Doing most business by begging, like most of us mere mortals

Rory McCune

@TildalWave had my blog running for years, pretty much just as a place to keep info or rant, I really should keep it up more.

TildalWave

@RoryMcCune Yeah you probably should. I've also been flirting with an idea of expanding on some of my answers here (well not so much SE.sec, more SO) in my 'blog' as well. I don't actually have a blog per se, I've never much appreciated its format... but I could add some 'articles and opinions' section to my news feeder in minutes if I wanted to (which I might one day). Then again I'm 'only' 38 and can't afford to reminisce much yet, you know, keeping up appearances

@RoryMcCune (aka, if I start working more on my own websites, my customers will think I worked less on theirs)

Rory McCune

20:40

@TildalWave I think it can definitely be handy, it's surprising how things get picked up by search engines after they've been on-line a while. I'm definitely not immune to reminiscing about the "good old days" of security and I'm all of 39!

@TildalWave Well when I've looked at developers websites, I always thinks it pays to have a nice one, so that people can see what you can do for them..

TildalWave

@RoryMcCune well we're both older than Internet but you're same age as ARPAnet and I'm younger for a year

Rory McCune

ooh same age as ARPAnet, now I do feel old!

2

TildalWave

@RoryMcCune pardon, bad information... that was in 2009 LOL

@RoryMcCune you're also younger than ARPAnet

Rory McCune

woo!

Thomas Pornin

@AviD There is a lot of information in this book: amazon.com/Uranium-Energy-Rock-Shaped-World/dp/014311672X

Notably, Israel officially admitted in the 1960s having built a "research reactor" (at a place called Dimona) which has delivered 25 MW of power since it went critical in 1963.

Such a reactor mechanically produces enough plutonium to build 4 warheads per year.

Under the facilities of Dimona is an underground reprocessing chemical plant which extracts the plutonium (plans were a gift from France, by the way, and it came with a substantial amount of yellow cake).

What Israel did not is a complete detonation test (if only for lack of space) but they did test all the other components

TildalWave

20:50

@ThomasPornin Mind me asking if this discussion about Israel nuclear capabilities started with someone mentioning the 'Nuke it from orbit' phrase? I do realize that AviD is from Israel, thus the connection...

Thomas Pornin

(For a plutonium-based bomb, this involves carefully synchronized explosives to compress the material into a critical mass, like what was done in the Trinity test and the Nagasaki bomb.)

@TildalWave It seems to have come from @AviD making a metaphor on "plausible deniability".

TildalWave

@ThomasPornin Well I can't contribute much on the subject (save for what was in The Sum of All Fears LOL), so please continue...

Thomas Pornin

Well, basically, in an uranium-based power plant, there is U235 and U238. U235 is the one which does the reaction, but most of Uranium ore is U238 (more than 99%).

"Enrichment" is about separating U235 and U238 to make material with more U235

But you still get a lot of U238.

When U238 is hit by a neutron, it absorbs it, becoming U239, which very quickly (less than a nanosecond) degrades into Pu-239 (a neutron spontaneously turns into a proton, and an electron is emitted -- that's "beta- radioactivity")

So at the end of a day, you get some Pu-239 as a "reject".

What comes out of a power plant must be treated so that unused uranium can be reused, and the most radioactive elements fixed in molten glass, then buried.

There are only two or three facilities in the world which officially do that (one of them is at La Hague, in French Normandy). They process the output of all nuclear power plants in the world.

Israel is not a customer of these facilities. Therefore, they must process the post-reaction materials themselves, and they don't tell how.

There is only one logical explanation, which is that they accumulate Plutonium for construction of warheads.

The full details of the Dimona underground facilities were published in 1986 by the London Sunday Times, complete with plans and photographs obtained from a technician called Vanunu, who worked there but was disgruntled at how Israel dealt with Palestinians.

Vanunu himself got caught by Mossad soon after the publication (apparently the capture operation involved a "honey trap" who was a blonde girl allegedly called Cindy). He was condemned to 18 years prison for treason.

There is even a Wikipedia page on him: en.wikipedia.org/wiki/Mordechai_Vanunu

To sum up, Israel denying possession of nuclear weapon is rather a case of implausible deniability.

CodesInChaos

21:15

But it's enough

Thomas Pornin

Details on plutonium production and reprocessing are necessary to understand what is going on with Iran right now. Western countries are trying to convince Iran to delegate uranium enrichment and post-processing to "safe" countries. If Iran is left to do either in its own facilities, then Iran can build bombs.

Since you can build a bomb out of (almost pure) U235, and out of Pu239 (but not with the same technologies). The U235 bomb is much easier to build, by the way.

China's first bomb was documented to have been assembled in one night by a single operator in a small workshop.

@CodesInChaos What was enough is that Israel did not sign the NPT

They don't acknowledge having the bomb because they need the US support, and US being a democratic country, they need at least tacit consent from their public opinion.

TildalWave

What reason did they give for not signing it?

Thomas Pornin

Average Americans, being basically people, are very good at turning a blind eye on almost anything which could upset them, but a four-miles high mushroom-shaped cloud in the Negev desert would really be rather conspicuous.

@TildalWave Sovereign countries do not have to justify not signing an international treaty, so Israel offered no justification. Ultimately, they are responsible with regards to their own people, who are rather favourable to the idea of Israel wielding the Nuclear Fire as long as they are not forced to admit it openly (which could be embarrassing).

(And the same goes for just any other country save Germany and Japan. Israelis are, also,, just people.)

The real bugger is North Korea, who did sign the treaty, and then unilaterally "withdrew" from it.

TildalWave

@ThomasPornin Yes I dig that, but they must have given some reason for not signing it, at least in discussions in their own parliament or something

@ThomasPornin I found this but that's for another nuclear related treaty and not NPT itself the way I read it.

@ThomasPornin "This resolution is deeply flawed and hypocritical. It ignores the realities of the Middle East and the real threats facing the region and the entire world." ... this sounds rather moot to me

Coming from a country that was once a part of Yugoslavia, and the associated Balkans attribute, I can vouch that when you hear words like "It ignores the realities of the [insert random troubled area]..." it's just a not too diplomatic way of telling someone to stop nosing around. Meaning there probably is indeed something fishy going on.

Thomas Pornin

21:33

> Israel was originally expected to sign the 1968 Nuclear Non-Proliferation Treaty (NPT) and on June 12, 1968, Israel voted in favor of the treaty in the UN General Assembly. But when the invasion of Czechoslovakia in August by the Soviet Union delayed ratification around the world, Israel's internal division and hesitation over the treaty became public. The Johnson administration attempted [...] to pressure Israel to sign the treaty that fall[...].

That's from the Wikipedia page:
http://en.wikipedia.org/wiki/Nuclear_weapons_and_Israel

So Israel did not have to "justify" their non-signing; this was the result of an internal debate with a majority ending up willing to keep the possibility of developing their own nuclear weapons program.

(And some of them knowing that it was actually already done.)

TildalWave

I think Israel wants every other nation, especially their neighbors, to KNOW that they possess WMD and use that fear of retaliation as a deterrent, but will categorically deny it for obvious reasons not to be pressured by other nations into various international treaties. They're probably also really sensitive to any indications of other nations wanting to be too suggestive what Israel should and/or shouldn't do with their sovereignty.

Thomas Pornin

22:02

Nuclear weapons are for dissuasion. Tactical usage of nuclear weapons is regularly evoked and investigated, but it does not work well.

It makes too big a blast, and radioactive deposits make the area unsuitable for conquest for too long a time.

Davy Crockett (nuclear device)

The M-28 or M-29 Davy Crockett Weapon System(s) was a tactical nuclear recoilless gun for firing the M388 nuclear projectile that was deployed by the United States during the Cold War. Named after American soldier, congressman, and folk hero Davy Crockett, it was one of the smallest nuclear weapon systems ever built. Development The Davy Crockett recoilless spigot gun was developed in the late 1950s for use against Soviet armor and troops, had war broken out in Europe. Davy Crockett Sections were assigned to USAREUR [United States Army Europe] armor and mechanized infantry battalions ...

TildalWave

OT - could someone please change the CSS of this fixed bottom page footer where we type messages (id="input-area") to include style="overflow: auto;"?

It's driving me crazy each time I change the size of the textarea beyond display space and can't get the resize hook back to the visible area in Chrome in any other way than to either reload, zoom out until its right bottom corner is visible again, or manually change CSS in Chrome developer tools (which might be a bit much to ask from for some users).

Thomas Pornin

Wasn't one of the points of CSS that you could change it yourself, in your own browser ?

TildalWave

Well, I can't afford to host not even a single SE CSS file.. .too much traffic :D

Thomas Pornin

No, I mean, Web browsers are (were) supposed to give an interface where you could enforce your own CSS-based properties.

There is probably a Firefox extension for that.

Personally, I don't resize the textarea so I don't see your problem

TildalWave

I realize that, but my point was that maybe others might appreciate this as well, not just me

I'm a bulky person both on chair and in text :)))

If the CSS would be changed the way I proposed, it wouldn't change anything if you don't resize it, but would enable you to easily access (and read) bottom part of it, if you do. It would only show the vertical scroll-bar for this DIV when necessary. It's not supported well in low figure IE browsers, but those don't have this resize hook anyway, so it doesn't matter.

Gilles

22:11

6

Q: Understanding CSS for user styling in a browser

I want to make a specific change to the appearance of a specific site in my web browser. This site uses CSS, so I think what I should do is write a user CSS override (please correct me if this is wrong). My browsers are Firefox (for which I think I should write something in chrome/userContent.cs...

firefox google-chrome html css

TildalWave

I changed that now in my Chrome also, it doesn't take a minute, but it could be done in default layout so others don't even have to do that

OK it's just a suggestion I can live without so back on topic. I wanted to say that there's other military uses for nuclear plants' waste, such as depleted uranium ammunition, which I think might be of particular interest to Israel since they already faced tanks invasion in the conflict with Syria. Depleted uranium ammunition tips are especially useful there.

Lucas Kauffman

22:30

I wonder if EY would add the Toyota GT6 to the car policy

*GT86

AviD

@TildalWave yay! I'm not the oldest non-rory in here anymore!!

Lucas Kauffman

38 JESUS YOU'RE OLD

This is going to come back at me one day

Thomas Pornin

@TildalWave Depleted uranium is not extracted from the output of nuclear plants; it is a byproduct of the enrichment process, which occurs before the use of the uranium.

Nuclear plant don't produce "depleted" uranium (aka U238), they actually consume it (by turning it into plutonium).

Lucas Kauffman

and then they make dirty bombs with the plutonium

that tend to be turned off at 0:01 seconds before explosion

AviD

@ThomasPornin second logical explanation: they feed it to parliament. Have you heard some of the laws coming out of there?? Freaks.

Lucas Kauffman

22:38

@AviD what is Israel up to this time?

Thomas Pornin

@AviD Ah ! Would be fun. Plutonium is one of the most poisonous substances in the world.

Gilles

in Russia, they feed it to political opponents

Thomas Pornin

@Gilles It was Polonium, not Plutonium. Poland was not pleased at the association.

(Pluto was not available to comment)

Lucas Kauffman

wasn't that polonium they fed litchenko?

*litvenko

AviD

Bah. Putin sprinkles plutonium on his breakfast cereal.

@ThomasPornin oo I like that term.

> Policy of Deliberate Ambiguity.

TildalWave

22:45

@LucasKauffman LOL Lucas. Remember, I have already been your age but you still have to survive to be of my age one day!! :P :)

AviD

@TildalWave @ThomasPornin yeah, that's pretty much what I said earlier.

@ThomasPornin also dont forget the extreme short range under discussion here - they would need to be pretty low-yield to not have massive spillover into self-destruction.

Thomas Pornin

@AviD Yes, quite frankly, Israel's strategic position has been very sloppily designed.

TildalWave

anyone doing the BSIDES challenge?

AviD

@ThomasPornin lol. Yes, next time we should choose an island. Like Australia.

Thomas Pornin

The Lord was quite careless when He gave it to Abraham. Or, possibly, a weird sense of humour.

@AviD Third Reich Germany actually had an official "sionist" plan which involved giving the whole island of Madagascar to Jews (and send them all there).

They cancelled it because of the transportation costs (since this was wartime)

AviD

22:50

@ThomasPornin BZZZZZTTTT!! I call Godwin's law.

@ThomasPornin funny, in some of X-Men arcs, weren't Magneto and all the other discovered mutants sentenced to stay there?

Thomas Pornin

@AviD And you fail. Godwin's law is about comparing one of the honourable participants to the Nazis.

Here, I just compared God with the Nazis, and by Godwin's law that's allowed.

AviD

@ThomasPornin heh, I know.

I was snarkily expanding it's use for humours sake.

not familiar with Godwin Chicken? First one to call Godwin on the other wins.

it's a delicate balance.

Thomas Pornin

@AviD That's quite unlike nuclear weapons, then.

AviD

no, it was a bit north of there.

Genosha

Genosha is a fictional country that has appeared in numerous comic book series published by Marvel Comics. It is an island nation that exists in Marvel's main shared universe, known as "Earth 616" in the Marvel Universe and a prominent place in the X-Men chronology. The fictional nation served as an allegory for slavery and later for South African apartheid before becoming a mutant homeland and subsequently a disaster zone. The island is located off the Southeastern African coast, northwest from Seychelles, and its capital city was Hammer Bay. Publication history Genosha first appeared i...

TildalWave

All these comparisons make my head spin, I'm quantum pairing y'all into my little Schrödinger's box for the night and check if you're still here in the morning! Was nice chatting with you, cheers!

Gilles

23:05

@ThomasPornin isn't God omnipresent? That would make him a participant. Not an honorable one, but then Godwin's law isn't limited to honorable participants

Thomas Pornin

@Gilles He is There (for all values of "There") but that does not mean that He acts.

The Almighty would be what they call a passive accomplice.

AviD

Feb 3 at 17:01, by Scott Pack

http://basicinstructions.net/basic-instructions/2010/1/10/how-to-write-a-superhero-story.html

Scott Pack

Indeed. Omnipresence would suck.

There's another, creepier, comic about him too. I'll try to find it later.

AviD

@ScottPack yeah, love that series.

jrg

23:55

so, i'm looking at the list of talks from securi-tay, seems like most of them are @stacksecurity people.

Transcript for