The DMZ

Simon

19:06

@RoraΖ It should be illegal to reply to something 2 days old.

I was a different person back then.

RoraΖ

0

Q: UK or EU regulations that require Security Awareness Training

I was completing a survey of the various regulations and standards that require Privacy or Security Awareness training, and have compiled the following list from various sources: FEDERAL LAWS AND REGULATIONS HIPAA GLBA FISMA FTC Red Flags Rule INDUSTRY CODES PCI DSS STANDARDS NIST 800-...

@schroeder voting to close as off-topic, talk to a lawyer

Simon

.......

RoraΖ

/sarcasm

Simon

It is off-topic.

TildalWave

@Simon Nou as in nouhau? If you're going full Russian on us I might have to preemptively nuke you! :P

Simon

19:09

@TildalWave AS IN NO YOU YOU DONUT

TildalWave

@Simon you as in aye as in nou nay?

Simon

@TildalWave !!!!!!

@schroeder I'm fairly sure that your question is actually off-topic.

Rоry McCune

@Simon pls, mods can't be off topic

Simon

@RоryMcCune Don't say that in front of @kalina.

schroeder

@RoraΖ not a legal question - aught to be a common knowledge question

Rоry McCune

19:13

@Simon heh, I wouldn't but mods could

schroeder

does not require legal advice or opinion

Rоry McCune

@schroeder UK Data Protection Act 1998 "Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."

that's based on the EU Data Protection Directive

could be held to indirectly require Security Awareness training :)

schroeder

@RоryMcCune I was just going to say .... that's very indirect, but possibly applicable

TildalWave

@schroeder EU Cookie law? It required that PHP devs train in basic literacy...

Rоry McCune

@schroeder yeah UK infosec laws suck

unless you want a law that lets the gov. spy on stuff

TildalWave

19:20

> European Union has directed all European member countries to develop and define laws regarding the protecting of personal privacy of the citizens of their respective country.

While each country’s implementation of this directive is different and unique, many of them require security awareness training to educate people on how to protect individual privacy.

securingthehuman.org/media/resources/business-justification/…

TL;DR EU isn't a country! :P

RoraΖ

@TildalWave But where do all the refugees go?

TildalWave

@RoraΖ According to Germany, to Germany. Of course, they conveniently forget to mention that they did squat all when they came first elsewhere, starting decades ago, and how pretty much any other nation in EU has way higher percentage of non-indigenous population / immigrants.

Simon

IN GERMANY

DA WOMEN R PRETTY

IN GERMANY

Nah fuck it, I'm done.

Germany is not that inspiring.

TildalWave

In Germany... whole Bavaria currently smells of vomit because of the Oktoberfest

Simon

o

David Freitag

19:33

@TildalWave You think so? It has only been October for 18 hours or so

TildalWave

@DavidFreitag I think it started on 16th of September

SEJPM

Oktoberfest starts like in mid-september

TildalWave

or thereabouts

Simon

Oh wow.

And I'm the dumb one.

At least I know how to properly name things.

Lucas Kauffman

Stacks change is "not comfortable" giving me a list of message ids. Public information.

SEJPM

19:35

Oktoberfest is from 19th september to 4h october

TildalWave

I got the best of it. Official Oktoberfest beer from my fav German brewery and no need to observe the decadent drunks there

SEJPM

Oktoberfest

Oktoberfest is the world's largest Volksfest (beer festival and travelling funfair). Held annually in Munich, Bavaria, Germany, it is a 16-day folk festival running from mid or late September to the first weekend in October, with more than 6 million people from around the world attending the event every year. Locally, it is often simply called the Wiesn, after the colloquial name of the fairgrounds (Theresienwiese) themselves. The Oktoberfest is an important part of Bavarian culture, having been held since 1810. Other cities across the world also hold Oktoberfest celebrations, modeled after the...

TildalWave

@SEJPM I was close :)

David Freitag

OMNOMNOM COFFEE CAKES

Simon

Why isn't it called Mid-September-early-Oktober-fest?

TildalWave

19:37

You know they advertise it in Germany as the world's largest festival? I guess they never heard of any of the way larger ones...

SEJPM

@DavidFreitag now i'm hungry...

David Freitag

@SEJPM :D

SEJPM

@Simon cause they're bavarian, nobody understands them...

@TildalWave 6.3 million people come to Oktoberfest in 2014

TildalWave

They also advertise some city there as the world's first free WiFi city... only about 6-7 years after my city did that LOL

David Freitag

@TildalWave Yeah pretty sure some of the EDM festivals have waaaaay more people than Germany even has citizens

SEJPM

19:39

@DavidFreitag >80 million ?

Simon

Well of course if it lasts more than 2 weeks it's gonna attract a lot of people.

SEJPM

@Simon 0.5 million people per day

(more or less)

TildalWave

@DavidFreitag I was thinking more like Diwali

David Freitag

@TildalWave Yeah that would easily do it.

Simon

MRW when I cast a variable to int in PHP and it solves everything:

David Freitag

19:41

@Simon Nope, still a string.

Looks like an int, smells like an int, but you forgot to taste it.

Simon

o

David Freitag

It tastes like lies!

Simon

If you dare to use the operator "===", better cast everything to int modafuka.

David Freitag

@Simon Doesn't ==== already do that?

Simon

@DavidFreitag "TRUE if $a is equal to $b, and they are of the same type."

David Freitag

19:43

@Simon "====: Hard casts both sides to int and performs an === operation."

Simon

Is that from PHP though?

Don't forget that PHP behaves how the hell it wants to.

David Freitag

No, I pulled it from somewhere.

Simon

Well there you go, another aberration from PHP.

TildalWave

What does ===== do in PHP? Inserts <hr>?

David Freitag

@TildalWave I have no idea, I was messing with @Simon

Oooh I know, we could make ===== cast both operands to a random data type before checking for equivalence!

TildalWave

19:57

One does not simply mess with equality to @Simon

@DavidFreitag PHP has data types? :OO

David Freitag

@TildalWave Nah, they are really all just strings

TildalWave

PHP has equivalence? :OOO

Ohnana

@TildalWave i am so jelly :(

Iszi

@Ohnana So who's the peanut butter? @Simon?

Ohnana

20:28

@Iszi you fuck right off

TildalWave

do I smell friction? :))

David Freitag

@TildalWave No I think that's the lube

Simon

@Ohnana rekt

TildalWave

@DavidFreitag at which point I wonder what makes for a better lube, jelly or peanut butter?

Ohnana

oh god why

both will give you a yeast infection

TildalWave

20:35

did you verify that?

David Freitag

@TildalWave Definitely jelly, but after a long enough period of time it just devolves into a huge sugary mess

Ohnana

@TildalWave no i used my brain. they both have a ton of sugar

Iszi

@Ohnana Is that a long ton or a short ton? Or is it all in how you use it?

David Freitag

@Ohnana Sugar + yeast, you can make beer with that right?

TildalWave

@Ohnana in US more likely corn syrup

Ohnana

20:37

@DavidFreitag you know what someone's probably tried it

@TildalWave doesn't matter it's glucose.

David Freitag

@Ohnana vomits

TildalWave

true

Thomas W.

Good day to all. General question regarding encryption - has VeraCrypt effectively replaced TrueCrypt, and is it generally usable for system encryption?

Iszi

@Ohnana Not sure that falls exactly under Rule 34, but it's close enough that the same effect probably applies.

Ohnana

veracrypt is patched truecrypt... no idea if truecrypt is suitable. between the two, vera is your best bet

it's still maintained and checked

Thomas W.

20:38

@Ohnana Given the two CVEs that came out, it's why I asked

Ohnana

@ThomasW. both are fixed in the vera project I think

Thomas W.

re-examining security practices at work - we currently have truecrypt on a few computers that go off-site for FullDisk Encryption, and I'm tempted to say "PULL TRUECRYPT! USE VERACRYPT!"

kalina

@Simon fine

Ohnana

@ThomasW. eeeeeee

Rory Alsop

@RоryMcCune the thing was okay, actually. Wee bit more stressful on the run up, as I had to get the day job out the way first, but fairly relaxed during and after.

Ohnana

20:39

that's a bit scary

Rory Alsop

Will find out if I get through to round 3

Thomas W.

@Ohnana we're not talking recent systems

Ohnana

especially with the new 9+ that came out

Iszi

@ThomasW. In that case, *crypt is probably the least of your patching concerns.

Thomas W.

i was nonspecific

Rory Alsop

20:41

@SEJPM I really grew to love Paulaner during Oktoberfest in '91 or '92

Thomas W.

@Iszi it's Win7 but not a version that comes with Bitlocker

hence the need for another encryption solution

kalina

@RoryAlsop I had no major issues with either of my builds

Rory Alsop

@TildalWave Like the Edinburgh Festival

kalina

just the time consuming reinstalling

Rory Alsop

@kalina And I only had issues. Must be age related (inB4)

Thomas W.

20:41

only two laptops have Symantec's encryption, but the rest're truecrypt'd right now. if you had to choose between any of the solutions out there and were on an extremely tight budget, would you use veracrypt or something else?

Rory Alsop

Anyway my win10 arrived today, so I'm going to gub the entire thing and build from scratch

kalina

@RoryAlsop I would never suggest such a thing

@RoryAlsop heh I'm still waiting for my second free upgrade to start on this machine

Simon

@kalina It's too late now, I'm home.

Iszi

@ThomasW. Is it really that expensive to get PGP on the rest?

kalina

@Simon well fine, going again then

Iszi

20:42

I'd especially favor that if you're using a centrally managed version.

kalina

o/

Simon

bai

Thomas W.

@Iszi twenty five laptops, and Symantec charging $125+ each computer because each user also needs email encryption? yeah pricey

@Iszi (mine's one of the ones with PGP Desktop on it for encryption xD)

Rory Alsop

Oooooh - I like the package Win 10 comes in if you order it on USB

very slinky

Iszi

@ThomasW. I'm confused. Which are you using PGP for - e-mail or drive encryption, or both? Could you not use just the drive encryption on systems that don't need e-mail encryption, and would that not be cheaper?

@RoryAlsop It walks down stairs?

Thomas W.

20:45

@Iszi All the laptops that need drive encryption, the users who use those laptops need PGP Email Encryption. Which, according to Symantec licensing, you need to pay extra for - you can't run a disk encryption license while running email-encrypt only license, according to their support staff, when we were pricing this out last year

@Iszi hence my head-scratching for solutions.

Rory Alsop

Slinky Master

►

TildalWave

@RoryAlsop Is it that big?

4

erm, the festival

Rory Alsop

@TildalWave Edinburgh festival is waaaay bigger :-)

@TildalWave T

W

S

S :-)

Simon

Jesus that took forever.

4

Rory Alsop

@Simon It didn't want me to submit two consecutive 'S's

you try it

Simon

20:48

Sure.

Rory Alsop

@Simon 2015 years so far

Simon

S

rekt

Rory Alsop

now try more

Iszi

@RoryAlsop That's alone, how about in pairs?

T
W
S
S

Simon

@Iszi that's one message

S

Iszi

20:49

@Simon So I cheated. What of it?

Simon

S

TildalWave

@RoryAlsop I realize that anything in Scotland seems bigger, but is it bigger?

Simon

S

STOP TALKING I'M SHOWING THAT I CAN DO IT TO RORO

3

YOU SILLY MONGS

Iszi

@Simon Nope

Simon

@RoryAlsop The trick is to rotate between "S" and " S".

The chat gets rid of the space but it's a different character to it so it works.

Iszi

20:50

@RoryAlsop Is there an auto-ban trigger for spamming chat, or does it just ramp up the delay?

Asking for a ex-son.

Rory Alsop

@Iszi maybe it would have to be manual...

Thomas W.

AFAIK there's no autoban

it just increases the "time to post" timer a lot

(I had 45 seconds wait once)

Iszi

Know what's sad? Every time I think of Slinky I end up on this.

SEJPM

@ThomasW. VeraCrypt would be your cheapest best choice, BestCrypt would be the easiest to manage choice (I think)

Iszi

Log Commercial

►

And I didn't even really watch the show.

@RoryAlsop You sure? @Simon's suddenly gotten pretty quiet.

Simon

20:55

I WAS TALKING TO MY DONUT YOU DONUT

Thomas W.

@SEJPM That's really what I was trying to find out. If I had my way, it'd be PGP Desktop encryption all the way (we already have a few computers set up with it, and everyone using the email encryption has it already minus the disk encryption part). So, VeraCrypt if we can't get license funds, PGP Desktop (with the management server) or BestCrypt as alternatives.

Thanks.

l1thal

I had someone try and tell me yesterday that TrueCrypt isn't really insecure, it's just a myth, lol..

I just didn't reply.

Thomas W.

@l1thal Total lies.

:P

l1thal

I know, haha. This guy has all of his pentesting drives encrypted with TrueCrypt.. I tried to tell him, but he's hard-headed about his TrueCrypt..

Iszi

@l1thal Up until very recently, it wasn't demonstrably insecure. It was just end-of-life. Now, we have known vulnerabilities. That changes things.

Rоry McCune

20:58

@RoryAlsop yay (apart from day job stress... boo to that!)

l1thal

@Iszi Yeah I gotcha.

Rоry McCune

@kalina phhhbt

l1thal

Anyone here know much about RSA-2048, or CryptoWall 3.0?

Simon

@l1thal No but here's a picture of a lizard sleeping in a flower:

l1thal

That's oddly satisfying.

Rоry McCune

21:03

yubico.com <-- that's amusing, Github endorse Yubikeys and their site promptly caves

Simon

I can also offer you a close-up:

Rоry McCune

@Simon TWSS

Simon

pls

Iszi

@l1thal If you're asking that question, I have a feeling the answer you need is "pull out the backups".

Rory Alsop

21:27

So - windows 10 install. From USB stick. On my third attempt now. Sure, it's fast, but it's crap. It can't cope with properly formatting a drive and erasing everything. Gaaaah

Wow - also fails on All drivers! Manually identifying everything :-(

This was way more annoying than any PC I have ever built. Or server, come to think of it

Didn't even identify the mouse properly...

I'm going to be too ranty to chat for a bit. Beer is calling me.

Iszi

@RoryAlsop Thanks for reminding me why I'm still waiting before I do mine. Gonna wipe and fresh install over the Christmas break, I think.

Hopefully by then they'll have the major kinks worked out.

Rory Alsop

Not sure if it's just because the hardware is pretty new...

Oh, and the number of reboots required...

And what's worse - now it is sort of booting into windows 10, it has the W10 user interface. Why did I decide to do this?

Iszi

@RoryAlsop Seriously. I thought all you super-pro pen-test guys were Linux devotees.

Rory Alsop

I am. This is my gaming machine

Iszi

@RoryAlsop Hence why I've never been able to convert.

@RoryAlsop So, going full-on Win10 for that system or dual-booting?

Rory Alsop

21:43

Full on

Iszi

Hey, do a tri-boot: Win10, Linux distro of choice, Steam OS.

Rory Alsop

The whole point with this one was to use the full capability for games

Almost all my important servers are now virtualised anyway

Iszi

@RoryAlsop Multi-boot still allows that. They just have to share the HDD space.

Rory Alsop

I have 256gb ssd that I want just for windows

Iszi

That's more than plenty. I've got a 120 GB SSD that's got Windows, plus a couple games, and I think even Office is on it. IIRC there's around 6 GB still left there.

Rory Alsop

21:46

Windows 10 doesnt even spot that I have two screens! Wtf??

Iszi

Drivers, man.

Or maybe (yet) another reboot?

Rory Alsop

Manually going through all the drivers

Reboot after every one

Sucks sooooo much

David Freitag

@RoryAlsop You don't need to do that.

Install everything then reboot once

Iszi

@RoryAlsop Seriously? I say pile 'em on and let them all share one reboot.

Rory Alsop

Wont let me

Iszi

21:48

@RoryAlsop Zefuq?

Rory Alsop

Needed some of them in order to find the next hardware

David Freitag

@RоryMcCune #worksforme...

Rory Alsop

It still is only aware of the basics

Iszi

Gilles

huh, and people complain about driver problems on Linux

Rory Alsop

21:49

And various installs get to a reboot now button

Linux is always easier than windows, because you know the dependencies

Iszi

@Gilles There's a substantial difference in impact between "gotta reboot after install" and "can't find the damn thing".

Rory Alsop

Here it's all guesswork

David Freitag

Why is Excel so freaking useless at inserting charts with custom horizontal axes?

Sheets is almost as useless.

kalina

why are you even spreadsheeting

David Freitag

Data collection and accuracy measurement

kalina

21:50

that sounds boring

Iszi

inb4 "Excel is not a database".

kalina

"Excel is not a database"

David Freitag

@Iszi You are correct, it is a spreadsheet editor, which is exactly what I need.

It's just completely useless at its sole function

Iszi

@DavidFreitag I know. That's what I keep telling myself too.

Rory Alsop

Even the one screen it does see is only recognised as a generic monitor, so rubbish resolution! Whyyyyyy

kalina

21:51

@DavidFreitag it's pretty good at storing data in columns and rows

David Freitag

@Iszi I have 20 data points that I need to calculate %error and generate graphs... it seems only good enough for the former...

Iszi

@RoryAlsop Boot & Reboot were on a boat. Boot fell off. Who's left?

Rory Alsop

Twentieth reboot?

David Freitag

@Iszi Trick question: It's @Simon's mom.

Iszi

@DavidFreitag Maybe you just suck at graphs.

kalina

21:52

@RoryAlsop I did get a random issue in the last hour where Windows thought my left monitor was on the left but the mouse behaved like it was on the right (so wouldn't move between the monitors in that direction)

I've never seen that before

ended up reinstalling my graphics card

Rory Alsop

Yeah - not even at stage where that is an option

David Freitag

@Iszi Yeah that could be, but it certainly doesn't help that excel (and sheets for that matter) are so impossibly unintuitive it isn't even funny.

Rory Alsop

Still trying to get basic devices recognised

Iszi

@DavidFreitag And I'm sure the ribbon interface makes it so much better too.

Rory Alsop

Oh, but the on board soundblaster - perfectly installed

Of course

kalina

21:54

I disabled on board sound before even installing an OS

Rory Alsop

Next forced reboot

Iszi

@kalina Seen it before, but not usually without some recognizable trigger. I guess you tried going into the "Screen Resolution" dialog?

kalina

@Iszi no I knocked one of the displayport cables while moving the box after putting the sides back on it

Iszi

@kalina Hm. Usually it should be able to take that gracefully. But the Screen Resolution dialog is where you should be able to fix it.

kalina

yeah it didn't want to fix

Iszi

21:56

@kalina All the way to un/re-install of the graphics drivers eh? That's tough.

David Freitag

FFS I DON'T WANT TO WRITE JAVASCRIPT JUST TO MAKE A FUCKING CHART

Iszi

I've got a triple-monitor setup at work that likes to randomly bug out on first login of the day, or a reboot, some times. Usually turning the monitors off/on, mucking about in Screen Resolution, forcing a re-detect... one of those will work. Haven't had to nuke drivers yet, or even actually mess with the cables.

@DavidFreitag Who needs charts? People can't just read?

David Freitag

@Iszi I FUCKING WANT A GODDAMN CHART

Seriously is that so much to ask?

Transcript for