The DMZ

Mark Buffalo

19:03

1

Q: Is there a term for the combination of principal and credential?

In an API that needs to take a principal and a credential as arguments, what is the pair of those two pieces of information commonly called? FFW Apache Shiro seems to call this an AuthenticationToken. Is that established terminology though?

terminology

I don't understand this VTC

What he's asking is clear as day

Ohnana

what, do they just want a name?

Mark Buffalo

Yeah, the OP is just asking for a term

I don't know what that term is because terminology is my weak spot

Thomas Pornin

@MarkBuffalo There is no really accepted term for that. Microsoft documentation just calls the lot "credentials", but they call everything "credentials" anyway.

Mark Buffalo

ah

I'm voting to close this question as off-topic because this is not your home but it is your work. — gowenfawr 2 hours ago

rofl

Thomas Pornin

If you write a DLL that plugs into the Windows logon interface, then that DLL is a "credential provider" and every piece of data that it manipulates is called a "credential".

This includes, e.g., a picture with the logo of the enterprise.

Or a banner that says "Hello"

Ohnana

19:10

what??

Thomas Pornin

All of these elements are "credentials" in Microsoft terminology.

Simon

You're a credential.

Thomas Pornin

@Simon Yes, you got it.

You too.

Simon

Everyone's a credential.

Ohnana

the credentials are coming from inside the user!!!

Simon

19:11

No, you don't understand. The users are the credentials.

Mark Buffalo

@Ohnana Explain this reference

Ohnana

@MarkBuffalo tvtropes.org/pmwiki/pmwiki.php/Main/…

Mark Buffalo

ahh

Thomas Pornin

The MS class names are rather explicit. You create an ICredentialProvider instance, that creates ICredentialProviderCredential instances, each of them being "a credential", e.g. an editable field.

Mark Buffalo

ICredentialProvider = instance, or interface?

Thomas Pornin

19:15

(What you type in the field is a credential, but the field in which you type it is also a credential.)

Ohnana

WTF

Mark Buffalo

You're a credential.

</simon>

Thomas Pornin

In MS conventions, 'I' means "interface". These are C++/COM interfaces.

Ohnana

there's a reason why the ballmer curve is named after a microsoft guy

Mark Buffalo

thought so. I use IClassName to name my interfaces as well :b

@Ohnana You mean Ballmer Peak?

Thomas Pornin

19:16

The same documentation also says that your DLL must implement COM, but also that it runs in the "pre-logon environment" where it is forbidden to use or make any reference to COM.

Simon

Maybe credentials are the solution to quantum computing.

Ohnana

@MarkBuffalo right, yeah

Mark Buffalo

@Ohnana Which means alcohol?

0

Q: Tracing nuisance or malicious cellphone calls

Is it possible for an ordinary citizen to trace source of nuisance calls to cell phone when caller ID has been blocked?

phone

My comment :o

Ohnana

@MarkBuffalo i'm implying that microsoft programmers are drunk 99.9% of the time which explains ppl's stupidity

Mark Buffalo

I'm thinking it will cause unnecessary paranoia

Simon

19:18

ok bye

Mark Buffalo

@Ohnana Yeah probably lol

Mark Buffalo

19:41

@DavidFreitag area51.stackexchange.com/proposals/94224/internet-of-things

Ohnana

AAAAAAAAAAAAHHHHHHHHHHHHHHHHHHHH

also half of those questions are trollin at the speed of light

Mark Buffalo

> Help! My toaster got a virus which is performing a DOS attack on my doorlock and prevents me from entering my apartment. What do I do? [closed]

rofl

@Ohnana What do you think of the idea of adding a malware deobfuscator stackexchange? It'll be a mix of code review / reverse engineering / information security all in one... since the snippets keep getting banned from all of those sites

Ohnana

@MarkBuffalo area51 is ready and waiting

Mark Buffalo

I don't know if it will really get off the ground though

and it wouldn't be all that popular

Ohnana

it definately won't if you don't try

HOW POPULAR DO YOU THINK THIS IS?!

???

Rоry McCune

19:52

hey @DavidFreitag you getting into the Linkedin Game or have I just accepted an invite from one of @RoraΖ 's CIA plants?

Ohnana

Mark Buffalo

@Ohnana What would it be called?

Ohnana

must i go on with backwoods SE sites

Doesn't matter that's a graduation task IIRC

Mark Buffalo

unknowncode?

Thomas Pornin

@Ohnana IoT does not mean "Internet of Things" but "Internet of Trolls". Rumour has it that it has already been deployed widely.

4

Mark Buffalo

19:53

@RоryMcCune @RoraΖ is secretly John Brennan

Rоry McCune

@MarkBuffalo thanks for the heads up, glad you SIGINT guys are keeping an eye on the spooks

Mark Buffalo

I AM NOT SIGINT

I AM SIGSEGV

RoraΖ

@RоryMcCune muahahaha

Ohnana

@RоryMcCune wait what are they interrupting?

i am so confoosed

Mark Buffalo

@RoraΖ What do you think? Would you like to see a StackExchange website dedicated to deobfuscating malicious code?

That goes for everyone in here... sup?

RoraΖ

19:57

@MarkBuffalo isn't that just Reverse Engineering SE

Mark Buffalo

no

Steve DL

@MarkBuffalo that was a very poor reference, if I may...

RoraΖ

Why not? It's reverse engineering

Mark Buffalo

@SteveDL Whuh?

Rоry McCune

@Ohnana pls get with the military speek ohunuh , it's Signals Intelligence, gotta know that if you want to be a proper cyber warrior!

Steve DL

19:58

(would work better in French as "nul" = lame, but hey.)

Mark Buffalo

@RoraΖ That's 100% IDA pro posts

Steve DL

@MarkBuffalo "I AM SIGSEGV"

Ohnana

@RоryMcCune barf

Mark Buffalo

@SteveDL It starts with "SIG"

Ohnana

imma sigterm your shit

RoraΖ

19:59

@MarkBuffalo Security SE is 90% SSL and software security, but Physical Security such as safes are still on topic.

Ohnana

i'm a cyber gansta

RoraΖ

Just because people don't ask questions about it, doesn't make it off-topic.

Mark Buffalo

@RoraΖ Hrm, I'll take a look

Steve DL

@MarkBuffalo yes you are SIGSEGV, and that was a poor reference. A NULL one. Duh.

RoraΖ

Deobfuscating malicious code is Malware Analysis, aka RE. So I think it'd be a lot of cross-voer.

over*

Steve DL

20:00

goes cry in a corner of the graveyard for C programmers

Mark Buffalo

@SteveDL H....haha....

RoraΖ

@SteveDL :facepalm:

Mark Buffalo

@RoraΖ So maybe we should send it to reverse-engineering... but, let me check if that's on topic first

RoraΖ

@MarkBuffalo Send what?

Yeah double check that it's on topic, but in my opinion it would be.

Mark Buffalo

Send the malicious code posts to RE

Rоry McCune

20:01

Kill -9 - Monzy | Linux Rap

►

Ohnana

@RoraΖ it's a similar relationship to crypto and sec.se, no?

RoraΖ

@Ohnana Yeah I would agree that. You want details on crypt, go to Cryptography SE. You want details on Software Analysis, go to RE SE

Ohnana

@RоryMcCune this is now my new ringtone

Mark Buffalo

Okay, so it's apparently on topic

RoraΖ

@MarkBuffalo I try to be somewhat active in RE SE, but you're right. It's all "IDA PRO GRRRRR I'm doing this cool plugin". Sadly less actual RE questions are there.

Mark Buffalo

20:07

Yeah, I want to be more active there

Rоry McCune

hey @kalina I just realised what genre you should do a track for next.... Nerdcore!!

Mark Buffalo

@RoraΖ Seems like you have some experience in getting around ASLR? :b

RoraΖ

@MarkBuffalo Not really, I've just read a lot about the topic. I'm all theory, no actual exploit dev

Mark Buffalo

Well it's easy to get around

RoraΖ

@MarkBuffalo In theory

Mark Buffalo

20:13

YOU ARE AN EXPLOIT DEV

RoraΖ

Just grab a memory disclosure and calculate the offsets right?

Mark Buffalo

@RoraΖ en.wikipedia.org/wiki/Return-oriented_programming

This one is for DEP

RoraΖ

ROPs are a mindfuck to me

One minute they make complete sense the next I'm like.... but wtf!?!?

Mark Buffalo

this is not something I am very good at

RoraΖ

I actually took a 3 month hands on course about vulnerability analysis which is how I got introduce to a lot of these concepts.

Mark Buffalo

20:18

ah, I see

Ohnana

0

A: Should I change the private key when renewing a certificate?

Did you change your keys after HeartBleed? What do your data center techs do with bad hard drives? Has anyone left the ops org in the last year? When's the last time you rotated admin passwords and ssh keys? All of these questions should start you thinking about the integrity of your keys. I'm...

Thomas Pornin

ROP is easy to understand once you master threaded code, and to master threaded code you have to learn Forth.

Ohnana

?? this doesn't seem like a good answer and i can't put my finger on why

RoraΖ

@ThomasPornin Forth?

Mark Buffalo

@ThomasPornin You have to learn Forth? Also, have you learned it?

Thomas Pornin

20:22

@MarkBuffalo You should learn Forth. I did.

Not for the language itself (it is atrocious), but for the concepts.

Mark Buffalo

@ThomasPornin Have you mastered it?

RoraΖ

@Ohnana Because it doesn't answer the question. It mentions a lot of things that are somewhat related, but have nothing to do with the actual answer.

Thomas Pornin

@Ohnana This is a bad answer because the question was about a key change when renewing a certificate while the answer is about changing keys "often".

Ohnana

hmm okay

Thomas Pornin

@MarkBuffalo Sufficiently.

Mark Buffalo

20:25

@ThomasPornin Got a different language with the same concepts? Forth seems like an utter atrocity

Xander

Yay. I'm back up to -30 rep for the day, so far.

Mark Buffalo

@Xander I am hoping to get one more upvote, but I've failed to get one in the last several hours... even though I already repcapped. Maybe that is the problem?

Stuck at 190, won't move

RoraΖ

@Xander Lol, what did you fail at today?

Thomas Pornin

@MarkBuffalo Yes, that's how it goes with user removals.

RoraΖ

Or did a question/answer get moved?

Thomas Pornin

20:26

The rep cap is counted without the removals.

Mark Buffalo

@RoraΖ A user was deleted. I lost 10, he lost 100, and whats-his-face lost 70.

Thomas Pornin

Get an answer accepted if you want your 2% epicness.

Ohnana

@MarkBuffalo i also lost 10

w/e

Mark Buffalo

@ThomasPornin Yep. My favorite was +80 after repcap

RoraΖ

I didn't lose any

Xander

20:28

@RoraΖ A user was deleted today, and it cost me 100 rep. Apparently they had upvoted 10 of my posts at some point in the past.

Rory Alsop

Wow - proper TEMPEST: theregister.co.uk/2016/02/16/em_leak_harvests_crypto_keys

Mark Buffalo

@RoryAlsop Yep, they've already done this with special equipment next to the CPU. This is voodoo-level research in comparison

Xander

@RoryAlsop Nice!

Mark Buffalo

Israeli researchers are next-level nuts at finding stuff like this

RoraΖ

@Xander lol, that's a bummer

Mark Buffalo

20:29

They're amazing

RoraΖ

It's like you had a secret admirer

Mark Buffalo

Wait, how is a software update fixing this problem?

> The researchers (Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer) are due to present their findings in full at the upcoming RSA Conference in San Francisco on 3 March. Security conscious computer users are advised to update their libgcrypt11 packages, something that is already happening. For example, an update for Linux distro Debian can be found here.

@ThomasPornin Save me from this

Xander

@RoraΖ I have 256 answers. One user upvoting 10 of them isn't particularly odd.

Speaking of which, now my last 7 answers have all been accepted. The streak continues.

Mark Buffalo

@Xander I upvoted your post about authentication recently.

RoraΖ

@MarkBuffalo You can technically perform operations other than the crypto ones to create white noise in the EM fields.

Mark Buffalo

20:33

Because it's the same concept I watch you perform at work every day when I SIGINT you with @RoraΖ and @RоryMcCune

RoraΖ

No idea how to actually do that, but it is possible.

Xander

@MarkBuffalo Thanks! Not 100% sure which one that would be though. According to my tags, I've answers 33 authentication questions.

Mark Buffalo

@RoraΖ Ah, that makes a lot of sense.

2

Q: Storing a password securely as part of a webservice

Say I'm creating a public web service which needs to write files to a Dropbox account (just an example). It needs to write files to one central account, not one per user. This service needs to access the Dropbox account with a password. I want the web service to be able to access my Dropbox accou...

web-application access-control

Thomas Pornin

@MarkBuffalo Side-channel attacks often leverage a key-dependent behaviour, in particular executing a specific piece of code only if a key bit is a 1.

Mark Buffalo

@ThomasPornin You're a side-channel attack

Xander

20:34

@MarkBuffalo Ah, yes, that one.

Mark Buffalo

@Xander So it's about key storage

Thomas Pornin

Constant-time implementations, which use a fixed memory access pattern (both for code and data), stand a good chance of withstanding side-channel attacks.

Xander

@MarkBuffalo All of encryption comes to naught, without adequate consideration of key protection.

Mark Buffalo

Indeed

Thomas Pornin

With a constant-time implementation, attackers will have to be able to differentiate between operations based only on their operands (e.g. whether storing a 1 or a 0 in a given memory slot).

This can be done in smart cards because the attacker controls (and measures) the raw power input and the clock signal. It is probable that in that TEMPEST case they cannot do that.

Mark Buffalo

20:37

@ThomasPornin Are encryption keys readable through viewing electromagnetic equivalent of the emitted binary code? Or am I looking at this wrong?

Thomas Pornin

There was an attack based on sound, with pretty much the same theory and consequences.

@MarkBuffalo You are looking at this wrong. From the outside, you cannot see individual bits.

What you can measure is whether a peculiarly power-hungry piece of the CPU is activated or not.

Mark Buffalo

But you'd expect the emitted bits to produce some kind of electromagnetic signal or something for that particular number?

Thomas Pornin

So you can get some strong information on the specific code path, but not on the values.

Mark Buffalo

again, I might be looking at it wrong

err, not emitted bits. The bits, when calculated on the CPU, emit a signal outside

Thomas Pornin

With such external measures you can for instance know when the CPU is computing a multiplication.

You do not obtain the values of the operands or of the result

But you know that the execution goes through a mul opcode at that point.

Mark Buffalo

20:39

Interesting

Thomas Pornin

In a classic double-and-add EC point multiplication algorithms, you can thus know when the 'add' occur.

Rory Alsop

it was one of my first languages. It is incredibly fun - and at the time was so much faster than anything else, even my simple code impressed folks who had much better coding skills - they couldn't see how I got the speed :-)

Thomas Pornin

And these moments correspond to the private key bits equal to 1.

Mark Buffalo

@RoryAlsop Context?

Thomas Pornin

@MarkBuffalo He is talking about Forth.

TildalWave

20:40

wrong tab?

Mark Buffalo

I thought so

Thomas Pornin

Because Forth is a rather, let's say, elderly language.

2

Rory Alsop

@MarkBuffalo Thought I had linked it to your post - odd...

:-)

@ThomasPornin but damn clever

Mark Buffalo

LOL

Rory Alsop

it only does exactly what you specify

I like that

TildalWave

20:42

to be honest I barely remember Forth, so old it is :P

elderly LOL

Mark Buffalo

@ThomasPornin So if I understand you correctly, and this is what I thought previously, but didn't explain it well: when the cpu performs a specific action, that type of action can be detected through special equipment... so you see it did X, and then Y, and then Z, and so forth?

Thomas Pornin

@MarkBuffalo That's about that.

Mark Buffalo

That is... incredibly interesting

TildalWave

@MarkBuffalo ... and so forth :))

Mark Buffalo

I need this kind of technology

Ohnana

20:43

@MarkBuffalo teeny tiny CPU squeaking

Mark Buffalo

@TildalWave LDKSLFDSFGK

TildalWave

@MarkBuffalo c'mon, I'm trolling you but I'm being really cute about it, you have no idea how cute, look, ponies

Mark Buffalo

haha, I'm not upset. It's funny

JukEboX

oye I want the firewall at this crazy place to stop messing with me

Gilles

@RоryMcCune Wow, ouch!

TildalWave

20:45

@MarkBuffalo have you seen Tron? It's like that :D

Mark Buffalo

haven't, no

It always looked like crap to me

TildalWave

yeah it is a bit crap but the original one was ahead of its time

Mark Buffalo

I mean the original one

As a kid, the whole concept of tron bothered me... so I never watched it

Rory Alsop

@MarkBuffalo the original one rocked! That was cutting edge, man

Mark Buffalo

It looked like crap on every front

HEY AS A KID I WAS PREJUDICED AGAINST UGLY VHS MOVIE COVERS

I will give it a shot, though. Gonna watch it later

TildalWave

20:53

@MarkBuffalo the white covers?

:))

Mark Buffalo

@TildalWave Hey now... I have a lot of white friends...

TildalWave

for kids that don't remember, that was standard covers for pr0n movies in some countries where it was prohibited to display any form of nudity on products

or even be suggestive in any way

Mark Buffalo

@TildalWave Israel?

TildalWave

some other countries enforced that they be sold in opaque bags

@MarkBuffalo no, I think it was in some US states and UK had something similar back in the days (don't remember if opaque bags or white covers)

Mark Buffalo

I don't remember that

They had a red curtain here

Rory Alsop

20:57

@TildalWave brown paper bags

Mark Buffalo

With black, opaque covers leading to a dark room

Rory Alsop

erm..probably

TildalWave

@RoryAlsop ah yes

Mark Buffalo

@RoryAlsop No, you're supposed to put the brown paper bag on the head, not the VHS cover

Rory Alsop

@MarkBuffalo oh, I thought we were talking about Betamax...

;-P

Mark Buffalo

20:58

I thought we were talking about brown bagging... never mind

I don't know, though. I've never purchased or rented that kind of filth.

TildalWave

I don't think you're allowed to walk on the streets displaying cover of an adult magazine in all US states even today, can you?

Ohnana

@TildalWave well no it's nudity

TildalWave

there you go

Rory Alsop

@TildalWave do they exist any more? I thought t'interwebs had kind of destroyed that industry, no?

Ohnana

@RoryAlsop still a thing

TildalWave

21:00

@RoryAlsop I... I... wouldn't know?

Ohnana

niche stuff is still in print

Rory Alsop

@Ohnana wow - I'd have thought internet was probably better for that

from a pure supply perspective

Ohnana

@RoryAlsop professional photo shoots and classified

Mark Buffalo

@RoryAlsop Uh... I... I wouldn't know, but... if I were to know, it would be due to walking past magazine stands, and seeing they still exist... or going to a convenience store in Tokyo and seeing a middle-aged man looking at weird cartoon magazines in the store, sitting there sweating, and licking his lips in the most demented manner while literally shaking

Ohnana

hell, there are a few newspapers for that genre still in print!

Rory Alsop

21:02

I'm so out of touch...

4

Mark Buffalo

#fogey

Rory Alsop

since they stopped carving them on the side of pyramids...

3

Mark Buffalo

lmfao

TildalWave

@RoryAlsop what, in @AviD's face?

Ohnana

@RoryAlsop i actually have difficulty finding one of the newspapers i enjoy, so i have to go online for it... It's all SFW special interest news, but simply talking about these things i apparently seedy...

TildalWave

21:04

actually, that could explain why pyramids lack facade

maybe they were too progressive :)

you know, like some ancient buildings in India

Mark Buffalo

so many questions I can't answer right now

can't reference a lot of sites because they are blocked

Thomas Pornin

@MarkBuffalo Bring your laptop. Bring your phone. Enjoy your own Internet and stop using your office hardware for doing smart things.

Stupidity is a business imperative.

Ohnana

@ThomasPornin mobile data isn't free man

i get 4GB per month!

TildalWave

quick, dump some huge gifs

Xander

@Ohnana Pro tip: You can buy more.

Thomas Pornin

21:09

@Ohnana I get 2 GB, and through a supreme effort, I can channel my awesomeness in such a compressed output.

Ohnana

@Xander Pro tip: you can't do that if someone else pays the bill

which is why i'm not too peeved, and i do my best to use Wifi when available

@ThomasPornin is "supreme effort" code for "potato phone"

TildalWave

I used to have 4GB/month but if I exceeded that I'd still have net, just not a very fast one... and frankly, I never did, not even close

Xander

@Ohnana Pro tip #2: You can buy a second phone, or a WiFi hotspot with as much data as you like.

TildalWave

mostly because free wifi spots

qwertz1029384756

guys, do you know where I can ask some questions about Sockets and stuff?

Rory Alsop

21:12

@TildalWave I currently have 10Gb, but toying with moving to 20 - as I also have my two eldest on my plan. Seems to almost be enough for 3 - especially as they are good at using wifi where possible

Ohnana

@qwertz1029384756 programming, system administration, or security?

Rory Alsop

@qwertz1029384756 what kind of sockets?

Thomas Pornin

@qwertz1029384756 If it is a programming question, that's stackoverflow.com

TildalWave

pretty much every bar has free wifi here if you're a customer, and there's a city-wide free wifi for an hour per day

Rory Alsop

DIY has home power sockets

Mark Buffalo

21:12

@ThomasPornin BYOD restrictions

Rory Alsop

@MarkBuffalo bring your own data

Ohnana

@Xander Protip #3: Have money to buy yourself nice things

Mark Buffalo

@RoryAlsop dollar restrictions ;)

qwertz1029384756

i want to decrypt websocket traffic over a proxy

Mark Buffalo

in murica, you pay by the gigabeezy for mobile data.. mine is severely limited

Rory Alsop

21:13

@MarkBuffalo here it is far too expensive

Ohnana

> gigabeezy

WAT.

TildalWave

@RoryAlsop most providers here have moved to unlimited data by now

Xander

@Ohnana That is indeed a prerequisite, unfortunately. Hence the "pro" nature of the tips.

Ohnana

@qwertz1029384756 as part of an attack/defense testing?

Mark Buffalo

@Ohnana gigabeezy fo' sheezy

Ohnana

21:13

@Xander :|

qwertz1029384756

reverse engineering

TildalWave

there's still PAYG ones but that's just lame it always ends up being the most expensive option

Mark Buffalo

@qwertz1029384756 Okay, tell us more

We have a reverse-engineering stack exchange

Rory Alsop

could work on Network Engineering

TildalWave

most providers just add unlimited data for something like 4 eur per month now

Ohnana

21:14

@qwertz1029384756 Ah! we just had this discussion i believe. Reverse engineering and the like is on topic in reverse engineering stack exchange!

qwertz1029384756

@MarkBuffalo I try to analyse traffic coming from my android device

Ohnana

be sure to only pick one site. crossposting is bad

Mark Buffalo

@TildalWave WHAT

TildalWave

@MarkBuffalo ah yes I forgot you're in US with abominations like Verizon, AT&T,...

qwertz1029384756

i posted it on superuser...

I thought because of the decrypting software

Xander

21:18

@qwertz1029384756 Actually decrypt data, or just RE the protocol and figure out what it's doing?

qwertz1029384756

@Xander My problem is to log all the traffic. I just know how to log http(s) traffic

TildalWave

@MarkBuffalo I now quite literally live just above a 20 inch diameter optical cable, so it's not like I need mobile providers much... maybe if we go to pick mushrooms in the forests (yes, there's coverage there)

our national carrier was tasked with 100% coverage because apparently that saves a lot of lives

qwertz1029384756

I just dont know where to start

schroeder

@qwertz1029384756 maybe if you linked to your question here, we would know what the details are

qwertz1029384756

0

Q: Decrypt TLS websocket traffic from android device via proxy

I am trying to decrypt TLS websocket packets from my Android device. I tried "mitmproxy" to route all the traffic over my PC and decrypt the packets. It only decrypts HTTPS traffic. In mitmproxy there is an HTTPS Request for upgrading the connection to websocket. The next program I tried is "Char...

proxy encryption android man-in-the-middle websocket

Thomas Pornin

21:33

@TildalWave Of course there is 4G coverage in Slovenia forests -- bears live there.

Ohnana

@TildalWave very nice!

TildalWave

@ThomasPornin oh yes and we export some to France where they're killed by local farmers

Ohnana

@TildalWave what country are you living in?

TildalWave

@Ohnana It was just mentioned

Ohnana

slovenia?

TildalWave

21:35

yup

Ohnana

SHUSH

Thomas Pornin

@TildalWave And all done in the name of "biodiversity".

Ohnana

do you like it there?

Thomas Pornin

France now has a secrétaire d'état (a kind of sub-minister) dedicated to biodiversity.

Ohnana

> Each year since 2000, the Festival of Roasted Potatoes is organized by the Society for the Recognition of Roasted Potatoes as a Distinct Dish, attracting thousands of visitors. The roasted potatoes, which have been traditionally served in most Slovenian families only on Sundays—preceded by a meat-based soup, such as beef or chicken soup—have been depicted on a special edition of post marks by the Post of Slovenia on 23 November 2012.[259]

TildalWave

21:36

@Ohnana that's an odd question

Ohnana

@TildalWave i like hearing about life in other countries

TildalWave

as a place to live, it's fantastic... as a place to work, not so much

Ohnana

it slakes my wanderlust temporarily :)

@TildalWave general woes or is it just drained in infosec jobs?

Mark Buffalo

snippets.cdn.mozilla.net/media/files/…

This is good

TildalWave

@Ohnana ah no we're right up there in infosec or IT in general, sometimes I think that binary is our second language but it's a small country

Ohnana

21:38

@TildalWave i see

TildalWave

and frankly our governments have been sucking at it real hard for a while now, that's not good for business

it might not matter for big nations, but small ones can't afford to suck that bad ;)

Mark Buffalo

@TildalWave What country?

TildalWave

@MarkBuffalo How many times have you asked me that already? :P Slovenia, it has been mentioned just before too LOL

it's not like you're gonna remember it this time :)

Gilles

@ThomasPornin in name, that is — mostly she's dedicated to political diversity

Mark Buffalo

You, you're a slovakian

Kidding.

TildalWave

21:42

wrong country, we don't even border it, but yeah it's a common mistake

Mark Buffalo

I have a friend teaching English in Slovakia

Back when it was Czechoslovakia... and he's still there now

TildalWave

he lost his passport? :))

Mark Buffalo

Czechoslovakia is like the most bad-ass sounding country name ever. Slovakia sounds neutered.

Nah, he still pops back into other European countries from time to time

TildalWave

Slovakia is an European country ;)

Rоry McCune

@TildalWave oh pls, who would believe a real country would have a name like that :op

TildalWave

21:53

honestly, I'm not even sure if one would still need a passport now within the Schengen area ... this refugee crisis kinda made everything more difficult in that regard, but I wouldn't think so

probably an ID is fine

Rоry McCune

@TildalWave well it's looking a bit dodgy TBH, schengen it looking a bit precarious...

TildalWave

@RоryMcCune Yeah, and looks like ours are forced to start closing the border with Croatia too

Rоry McCune

@TildalWave yeah it sucks all round, but not entirely surprising given the budget/financial crisis in Greece, that border patrols aren't their #1 priority...

Xander

Yay! Back up to -1 for the day. 100 rep gained, 100 rep lost to a deleted user, 1 rep sacrificed for a downvote.

TildalWave

@RоryMcCune you know, most of those refugees don't even know where they are... it's a mess... and while we made sure to have as many facilities available to them as possible, nobody wants to stay here because they've never heard of the place... they all wanna go to Germany, France, UK,... places like that

of course, they'll only end up being next to imprisoned there

Transcript for